Methods, apparatus, devices and storage media for allocating strategy items

Abstract

This application provides a method, apparatus, device, and storage medium for allocating policy items. It relates to the field of security management technology. The method includes: determining target security status information of a terminal device; determining multiple candidate policy groups and corresponding business scenario information for each candidate policy group, wherein each candidate policy group includes multiple policy items, and each policy item is a rule used to perform security protection functions; determining a target policy group based on the target security status information and the corresponding business scenario information for each candidate policy group, wherein the target security status information matches the corresponding business scenario information of the target policy group; and sending the target policy group to the terminal device so that the terminal device executes multiple policy items in the target policy group to achieve security protection. This solution determines matching policy items based on the target security status information of the terminal device. Compared to manual methods, the determined policy items are more consistent with the security status of the terminal device, thereby improving the security of the terminal device.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a method, apparatus, device and storage medium for allocating policy items. Background Technology

[0002] With digital transformation and the development of network technology, different terminal devices can quickly access each other through the network. The access process involves data access, which poses a challenge to the data security of terminal devices.

[0003] In a zero-trust architecture, a series of policies are designed to enhance the security of terminal devices. These policies include, but are not limited to, virus scanning, scheduled scanning, proactive defense, and firewalls. Terminal devices execute these policies to achieve security protection.

[0004] In related technologies, policy items are determined manually. However, the policy items determined in this way cannot be adapted to the actual state of the terminal device, resulting in low security of the terminal device. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for allocating policy items to enhance the security of terminal devices.

[0006] In a first aspect, this application provides a method for allocating policy items, comprising: determining target security status information of a terminal device; determining multiple candidate policy groups and business scenario information corresponding to each candidate policy group, wherein the candidate policy group includes multiple policy items, and the policy items are rules for performing security protection functions; determining a target policy group based on the target security status information and the business scenario information corresponding to each candidate policy group, wherein the target security status information matches the business scenario information corresponding to the target policy group; and sending the target policy group to the terminal device so that the terminal device executes multiple policy items in the target policy group to achieve security protection.

[0007] In one possible design, determining the target security status information of a terminal device includes: determining a target time; sending an information acquisition request to the terminal device at the target time, the information acquisition request being used to request the terminal device to send security status information; and receiving the target security status information sent by the terminal device.

[0008] In one possible design, determining the target time includes: determining the historical security status information of the terminal device; determining the security level of the terminal device based on the historical security status information; adjusting a preset duration based on the security level to obtain a target duration, the target duration being used to determine the interval between two adjacent information acquisition requests; and determining the target time based on the target duration.

[0009] In one possible design, determining the target strategy group based on the target security status information and the business scenario information corresponding to each candidate strategy group includes: if there is an intermediate strategy group among the multiple candidate strategy groups, then determining the target strategy group based on the intermediate strategy group, wherein the target security status information matches the business scenario information corresponding to the intermediate strategy group; if there is no intermediate strategy group among the multiple candidate strategy groups, then determining the target strategy group based on the target security status information.

[0010] In one possible design, determining the target policy group based on the intermediate policy group includes: if there is only one intermediate policy group, then the intermediate policy group is determined as the target policy group; if there are multiple intermediate policy groups, then the target policy group is determined from the intermediate policy groups according to the security level corresponding to each intermediate policy group.

[0011] In one possible design, the method further includes: determining the value range of each piece of information in the business scenario information corresponding to each intermediate strategy group; determining the target strategy group based on the target security status information and the value range of each piece of information, wherein each piece of information in the target security status information is located within each value range corresponding to the target strategy group.

[0012] In one possible design, determining the target policy group based on the target security status information includes: determining the weight and weight of each piece of information in the target security status information; performing a weighted summation of the weights according to the weights to obtain a target security score for the terminal device; determining a target security level for the terminal device based on the target security score and the correspondence between the security score and the security level; and determining the target policy group from the plurality of candidate policy groups according to the target security level, wherein the security level of the target policy group is the same as the target security level.

[0013] In one possible design, sending the target policy group to the terminal device includes: encapsulating multiple policy items in the target policy group into multiple software development kits; and sending the multiple software development kits to the terminal device.

[0014] Secondly, this application provides a policy item allocation device, comprising: a determining module, configured to determine target security status information of a terminal device; a configuring module, configured to determine multiple candidate policy groups and business scenario information corresponding to each candidate policy group, wherein the candidate policy group includes multiple policy items, and the policy items are rules for performing security protection functions; a filtering module, configured to determine a target policy group based on the target security status information and the business scenario information corresponding to each candidate policy group, wherein the target security status information matches the business scenario information corresponding to the target policy group; and a sending module, configured to send the target policy group to the terminal device, so that the terminal device executes multiple policy items in the target policy group to achieve security protection.

[0015] In one possible design, the determining module is specifically used to determine a target time; the determining module is also specifically used to send an information acquisition request to the terminal device at the target time, the information acquisition request being used to request the terminal device to send security status information; the determining module is also specifically used to receive the target security status information sent by the terminal device.

[0016] In one possible design, the determining module is specifically used to determine the historical security status information of the terminal device; the determining module is further used to determine the security level of the terminal device based on the historical security status information; the determining module is further used to adjust the preset duration through the security level to obtain a target duration, the target duration being used to determine the interval between two adjacent information acquisition requests; the determining module is further used to determine the target time based on the target duration.

[0017] In one possible design, the device further includes: a judgment module, configured to determine the target strategy group based on the intermediate strategy group if an intermediate strategy group exists among the plurality of candidate strategy groups, wherein the target security status information matches the business scenario information corresponding to the intermediate strategy group; the judgment module is further configured to determine the target strategy group based on the target security status information if the intermediate strategy group does not exist among the plurality of candidate strategy groups.

[0018] In one possible design, the judgment module is specifically used to determine the intermediate policy group as the target policy group if the number of intermediate policy groups is 1; the judgment module is also specifically used to determine the target policy group from the intermediate policy groups according to the security level corresponding to each intermediate policy group if the number of intermediate policy groups is multiple.

[0019] In one possible design, the device further includes: a processing module, configured to determine the value range corresponding to each piece of information in the business scenario information corresponding to each intermediate policy group; the processing module is further configured to determine the target policy group based on the target security status information and the value range corresponding to each piece of information, wherein each piece of information in the target security status information is located within each value range corresponding to the target policy group.

[0020] In one possible design, the device further includes: a calculation module, configured to determine the weight and weight of each piece of information in the target security status information; the calculation module is further configured to perform weighted summation processing on the weights according to the weights to obtain a target security score for the terminal device; the calculation module is further configured to determine a target security level for the terminal device according to the target security score and the correspondence between the security score and the security level; the calculation module is further configured to determine a target policy group from the plurality of candidate policy groups according to the target security level, wherein the security level of the target policy group is the same as the target security level.

[0021] In one possible design, the apparatus further includes: an execution module for encapsulating multiple policy items in the target policy group into multiple software development kits; the execution module is also configured to send the multiple software development kits to the terminal device.

[0022] Thirdly, embodiments of this application provide an electronic device, including: at least one processor and a memory; the memory stores computer execution instructions; the at least one processor executes the computer execution instructions stored in the memory, causing the at least one processor to perform the allocation method of the strategy items described in the first aspect and various possible designs of the first aspect.

[0023] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions. When a processor executes the computer-executable instructions, it implements the allocation method of the strategy items described in the first aspect and various possible designs of the first aspect.

[0024] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the allocation method of strategy items as described in the first aspect and various possible designs of the first aspect.

[0025] This application provides a method, apparatus, device, and storage medium for allocating policy items. The method includes: determining target security status information of a terminal device; determining multiple candidate policy groups and business scenario information corresponding to each candidate policy group, wherein each candidate policy group includes multiple policy items, and each policy item is a rule used to perform security protection functions; determining a target policy group based on the target security status information and the business scenario information corresponding to each candidate policy group, wherein the target security status information matches the business scenario information corresponding to the target policy group; and sending the target policy group to the terminal device so that the terminal device executes multiple policy items in the target policy group to achieve security protection. This solution determines matching policy items based on the target security status information of the terminal device. Compared to manual methods, the determined policy items are more consistent with the security status of the terminal device, thereby improving the security of the terminal device. Attached Figure Description

[0026] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0027] Figure 1 A schematic diagram illustrating an application scenario of a strategy item allocation method provided in an embodiment of this application;

[0028] Figure 2 A flowchart illustrating a strategy item allocation method provided in an embodiment of this application;

[0029] Figure 3 A flowchart illustrating a strategy item allocation method provided in an embodiment of this application;

[0030] Figure 4 A schematic diagram illustrating the determination of a target strategy group provided in an embodiment of this application;

[0031] Figure 5 A schematic diagram illustrating the determination of a target strategy group provided in an embodiment of this application;

[0032] Figure 6 A schematic diagram illustrating the value selection rules provided in the embodiments of this application;

[0033] Figure 7 A schematic diagram of the structure of a strategy item allocation device provided in an embodiment of this application;

[0034] Figure 8 A schematic diagram of the structure of a strategy item allocation device provided in an embodiment of this application;

[0035] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0036] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0037] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0038] The collection, storage, use, processing, transmission, provision, and disclosure of financial data or user data involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0039] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, they do not mean that the applicant has used or necessarily used the solution.

[0040] Figure 1 An application scenario diagram for the allocation of strategy items for existing technologies. For example... Figure 1 As shown, policy items are determined and sent to the terminal device. The terminal device executes the rules in the policy items to achieve security protection.

[0041] In existing technologies, policy items are determined by the user. Specifically, the user can determine policy items based on experience or knowledge, or the user can select policy items from preset policy items on the terminal device. However, this method suffers from low accuracy in determining policy items. For example, if the terminal device is processing services with high security requirements or the current environment of the terminal device has security vulnerabilities, and the user-determined policy items fail to provide matching security protection, the terminal device's security will be low.

[0042] To address the aforementioned technical issues, this application proposes the following technical concept: the server acquires the target security status information of the terminal device in real time, and determines the matching policy items based on the target security status information, thereby achieving security protection for the terminal device.

[0043] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0044] Figure 2 A flowchart illustrating a strategy item allocation method provided in this application embodiment, the method comprising the following steps:

[0045] S201. Determine the target security status information of the terminal device.

[0046] As an example, the execution entity of this embodiment can be a policy item allocation device, which can be implemented in various ways. For example, it can be program software, or a medium storing relevant computer programs, such as a USB flash drive; or, the device can also be a physical device that integrates or installs relevant computer programs, such as a chip, a smart terminal, a computer, a server, etc.

[0047] Among them, the target security status information is the current security status information of the terminal device, which can be used to reflect the current security status of the terminal device.

[0048] Optionally, the target security status information includes, but is not limited to, at least one of the following: business attributes, organizational attributes, user attributes, device attributes, or environmental attributes.

[0049] With the example scenarios, the service attribute refers to the attributes of the service currently being processed by the terminal device, which can be the service type or service identifier, etc. The organization can be a department or project team, etc. The user attribute refers to the attributes of the user currently using the terminal device, which can be the user permission type, etc. The device attribute refers to the hardware or software type of the terminal device. The environment attribute can be the network type currently being used by the terminal device, etc.

[0050] With the help of scenario examples, the target security status information reflects the current security status of the terminal device from multiple dimensions.

[0051] S202. Determine multiple candidate strategy groups and the business scenario information corresponding to each candidate strategy group.

[0052] The candidate policy group includes multiple policy items, which are rules used to perform security protection functions.

[0053] For example, taking proactive defense as an example, the policy item may include whether to enable proactive defense, or include the specific level of proactive defense.

[0054] For example, proactive defense includes, but is not limited to, at least one of the following: process protection, registry protection, driver protection, USB flash drive security protection, email protection, download protection, web page security protection, remote login protection, or network intrusion protection.

[0055] With the help of scenario examples, it can be seen that each business scenario has different security requirements. For each business scenario, multiple corresponding policy items are set to meet the security requirements of that business scenario.

[0056] S203. Determine the target policy group based on the target security status information and the business scenario information corresponding to each candidate policy group.

[0057] Among them, the target security status information is matched with the business scenario information corresponding to the target policy group.

[0058] For example, the target security status information reflects the current security status of the terminal device, and the business scenario information reflects the business scenarios in which the policy group can be used to perform security protection. The target policy group is determined based on the matching of the security status and the business scenario.

[0059] To illustrate with a scenario example, the target security status information may reflect that the current user attributes and device attributes of the terminal device have security issues. The issues in the user attributes and device attributes of the business scenario corresponding to the target policy group are matched with the terminal device, thereby determining the target policy group.

[0060] S204. Send the target policy group to the terminal device so that the terminal device executes multiple policy items in the target policy group to achieve security protection.

[0061] In related technologies, the target policy group is determined by the user, which suffers from low accuracy. In this application, the target policy group is determined by the server and sent to the terminal device, avoiding human error and thus improving the accuracy of the target policy group.

[0062] Optionally, if the target policy group is the same as the policy group previously sent to the terminal device, then the target policy group is not sent.

[0063] With the scenario example, the system records the policy groups sent to the terminal device each time. If the currently determined policy group is the same as the previously sent policy group, it indicates that the security status of the terminal device has not changed significantly, and therefore, it is not necessary to send the same policy group. This means that in this scenario, the number of policy groups sent can be reduced, thereby lowering the transmission cost without affecting the security of the terminal device.

[0064] For example, the server-side computing engine allocates policy items by collecting various security status information of the terminal device. The policy item allocation is no longer based on simple static rules, but on dynamic judgment based on security status information. The dynamic policy computing engine continuously maintains the policy through real-time multi-dimensional risk correlation and trust assessment.

[0065] One feasible implementation method is to send the target policy group by encapsulating multiple policy items in the target policy group into multiple software development kits; and sending the multiple software development kits to the terminal device.

[0066] Among them, the Software Development Kit (SDK) is a toolkit that encapsulates independent and reusable functional modules.

[0067] With the illustration of specific scenarios, it can be shown that software development kits are reusable and can be flexibly configured according to specific business scenarios to meet specific security requirements.

[0068] In this feasible implementation, by encapsulating a software development kit, policy groups can be quickly configured based on multiple policy items, thereby improving the efficiency of policy item allocation.

[0069] The policy item allocation method provided in this application embodiment determines the target security status information of the terminal device; determines multiple candidate policy groups and the corresponding business scenario information for each candidate policy group, wherein each candidate policy group includes multiple policy items, and each policy item is a rule used to perform security protection functions; determines a target policy group based on the target security status information and the business scenario information corresponding to each candidate policy group, wherein the target security status information is matched with the business scenario information corresponding to the target policy group; and sends the target policy group to the terminal device so that the terminal device executes multiple policy items in the target policy group to achieve security protection. This solution determines the matching policy items based on the target security status information of the terminal device. Compared with manual methods, the determined policy items are more consistent with the security status of the terminal device, thereby improving the security of the terminal device.

[0070] Based on any of the above embodiments, the following, in conjunction with Figure 3 The detailed process of allocating strategy items is explained.

[0071] Figure 3 This is a flowchart illustrating a method for allocating strategy items according to an embodiment of this application. Figure 3 As shown, the method includes:

[0072] S301. Determine the target time.

[0073] The target time is the time when the next allocation item will be determined.

[0074] In related technologies, the security status of terminal devices may change. Manually determining policy items suffers from a lag, meaning that manually determined policy items cannot respond promptly to changes in the security status. This application, by controlling the target time, can obtain the security status information of the terminal device in a timely manner.

[0075] One feasible implementation method is to determine the target time by: determining the historical security status information of the terminal device; determining the security level of the terminal device based on the historical security status information; adjusting the preset duration based on the security level to obtain the target duration, which is used to determine the interval between two adjacent information acquisition requests; and determining the target time based on the target duration.

[0076] Among them, historical security status information refers to security status information sent by the terminal device.

[0077] Optionally, historical security status information can be sorted in order of relevance from the current time to the earliest. The security level of the terminal device is determined based on a preset number of historical security status information entries that appear at the top of the sort.

[0078] With the help of scenario examples, the historical security status information that is ranked higher is more likely to reflect the current security status of the terminal device, and on this basis, the accuracy of the security level can be improved.

[0079] For example, the higher the security level, the shorter the target duration.

[0080] Using scenario examples, a higher security level indicates a more secure terminal device, requiring less frequent allocation of policy items. Therefore, the interval between two consecutive information retrieval requests can be increased. Conversely, a lower security level indicates a less secure terminal device. To effectively achieve security protection, the security status of the terminal device needs to be frequently determined, thus requiring a shorter interval between two consecutive information retrieval requests.

[0081] In this feasible implementation, the target time determined according to the security level can adapt to the security status of the terminal device, thereby improving the security of the terminal device.

[0082] S302. At the target time, send an information acquisition request to the terminal device. The information acquisition request is used to request the terminal device to send security status information.

[0083] Among them, the security status information refers to the current security status information of the terminal device.

[0084] Optionally, the information request may include the type of information.

[0085] With the help of scenario examples, by identifying the types of information, terminal devices can clearly understand the specific content of security status information, thereby improving the accuracy of sending security status information.

[0086] S303, Receive target security status information sent by the terminal device.

[0087] For example, the target security status information includes the identifier of the terminal device and the information time.

[0088] With scenario examples, the server can assign policy items to multiple terminal devices. The device identifier accurately identifies the corresponding terminal device, improving assignment accuracy. Information snapshots allow for the sorting and recording of each received security status message for later backtracking.

[0089] S304. Determine multiple candidate strategy groups and the business scenario information corresponding to each candidate strategy group.

[0090] It should be noted that the execution process of S304 is the same as that of S202, and will not be repeated here.

[0091] Based on the target security status information, determine whether there is an intermediate policy group among multiple candidate policy groups, where the target security status information is matched with the business scenario information corresponding to the intermediate policy group.

[0092] If so, then execute S305.

[0093] If not, then execute S306.

[0094] S305. Determine the target strategy group based on the intermediate strategy group.

[0095] For example, each candidate policy group is adapted to the corresponding security state. If there is an intermediate policy group among the multiple candidate policy groups, it means that there is a policy group among the multiple candidate policy groups that matches the security state of the terminal device, and the target policy group can be directly determined from it.

[0096] Below, in conjunction with Figure 4 Explain the determination of the target strategy group.

[0097] Figure 4 This is a schematic diagram illustrating the determination of a target strategy group as provided in an embodiment of this application. Figure 4 As shown, target security status information is received from the terminal device. Based on the target security status information, an intermediate policy group is determined from multiple pre-configured candidate policy groups, and the target policy group is obtained from the intermediate policy group.

[0098] One feasible implementation method is to determine the target policy group based on the intermediate policy group as follows: if there is only one intermediate policy group, then the intermediate policy group is determined as the target policy group; if there are multiple intermediate policy groups, then the target policy group is determined from the intermediate policy groups according to the security level corresponding to each intermediate policy group.

[0099] To illustrate with a scenario example, if there is only one intermediate policy group, it means that only one policy group meets the target security state information, and this intermediate policy group is determined as the target policy group. If there are multiple intermediate policy groups, it means that multiple policy groups meet the target security state information, and the target policy group needs to be selected from them.

[0100] For example, the security level can be determined based on the stringency of the security protection for the policy group.

[0101] Optionally, the intermediate policy group with the highest security level among multiple intermediate groups can be identified as the target policy group.

[0102] In this feasible implementation, the intermediate policy group with the highest security level, i.e. the most stringent level, provides the highest level of security protection compared to other intermediate policy groups. Determining this intermediate policy group as the target policy group can effectively improve the security of terminal devices.

[0103] One feasible implementation method for allocating policy items further includes: determining the value range of each piece of information in the business scenario information corresponding to each intermediate policy group; determining the target policy group based on the target security status information and the value range of each piece of information, wherein each piece of information in the target security status information is located within the value range of each piece of information corresponding to the target policy group.

[0104] In this implementation, the target policy group is determined from the intermediate policy group based on the specific value of each piece of information in the target security status information.

[0105] Below, in conjunction with Figure 5 Explain the determination of the target strategy group.

[0106] Figure 5 This is a schematic diagram illustrating the determination of a target strategy group as provided in an embodiment of this application. Figure 5 As shown, for any policy group, the corresponding business scenario information is determined. This business scenario information includes multiple pieces of information, and the value range for each piece of information is determined. If each piece of information in the target security status information falls within its corresponding value range, then this policy group is determined as the target policy group.

[0107] With the aid of scenario examples, the value range is used as a value quoting rule to determine the target policy group. For example, the information can be business attributes, organizational attributes, user attributes, device attributes, or environmental attributes. The value range for business attribute information can be the range of business type or business identifier. The value range for user attribute information can be the range of user identifier or user permission. The value range for environmental attribute information can be the range of network type or network address.

[0108] Below, in conjunction with Figure 6 The rules for determining the values ​​are explained.

[0109] Figure 6 This is a schematic diagram illustrating the value selection rules provided in the embodiments of this application. For example... Figure 6 As shown, each piece of information in the target security status information has a corresponding value, which can be selected via a drop-down list or entered directly. The target policy group is obtained by comparing the selected or entered value with the intermediate policy group.

[0110] In this feasible implementation, the target policy group determined by the value range conforms to the state corresponding to each piece of information in the target security state information, thereby improving the accuracy of the policy items.

[0111] S306. Determine the target strategy group based on the target security status information.

[0112] With the example of the scenario, if there is no intermediate policy group among multiple candidate policy groups, the policy group that matches the terminal device is determined by the security level corresponding to the target security status information.

[0113] Optionally, a new policy group matching the target security status information can be generated.

[0114] Alternatively, the newly generated policy group can be stored for subsequent policy group allocation.

[0115] One feasible implementation method is to determine the target policy group based on the target security status information as follows: determine the weight and weight of each piece of information in the target security status information; perform weighted summation on the weights to obtain the target security score of the terminal device; determine the target security level of the terminal device based on the target security score and the correspondence between the security score and the security level; determine the target policy group from multiple candidate policy groups based on the target security level, and the security level of the target policy group is the same as the target security level.

[0116] For example, each piece of information has a different degree of impact on security, and a corresponding weight is assigned to each piece of information. The overall security score corresponding to the target security status information can be calculated by weighted summation. The overall security score reflects the security of the terminal device. The policy group that matches the security of the terminal device is determined as the target policy group.

[0117] To illustrate with examples, taking device attributes as an example, encrypted devices have higher security, while unencrypted devices have lower security. Similarly, taking environment attributes as an example, internal networks have higher security, while external networks have lower security.

[0118] In this feasible implementation, the security of the terminal device is determined, and the target policy group determined based on the security conforms to the security of the terminal device, thereby improving the accuracy of the target policy group.

[0119] S307. Send the target policy group to the terminal device so that the terminal device executes multiple policy items in the target policy group to achieve security protection.

[0120] It should be noted that the execution process of S307 is the same as that of S204, and will not be repeated here.

[0121] Figure 7 This is a schematic diagram of a strategy item allocation device provided in an embodiment of this application. Figure 7 As shown, the allocation device 70 for the strategy item may include: a determination module 71, a configuration module 72, a filtering module 73, and a sending module 74, wherein,

[0122] The determination module 71 is used to determine the target security status information of the terminal device.

[0123] Configuration module 72 is used to determine multiple candidate policy groups and the business scenario information corresponding to each candidate policy group. The candidate policy group includes multiple policy items, and the policy items are rules used to execute security protection functions.

[0124] The filtering module 73 is used to determine the target strategy group based on the target security status information and the business scenario information corresponding to each candidate strategy group, and the target security status information is matched with the business scenario information corresponding to the target strategy group.

[0125] The sending module 74 is used to send a target policy group to the terminal device so that the terminal device can execute multiple policy items in the target policy group to achieve security protection.

[0126] Optionally, module 71 can be executed. Figure 2 S201 in the embodiment.

[0127] Optionally, configuration module 72 can execute Figure 2 S202 in the embodiment.

[0128] Optionally, the filtering module 73 can perform... Figure 2 S203 in the embodiment.

[0129] Optionally, the sending module 74 can perform... Figure 2 S204 in the embodiment.

[0130] It should be noted that the allocation device for strategy items shown in the embodiments of this application can execute the technical solution shown in the above method embodiments, and its implementation principle and beneficial effects are similar, so they will not be described again here.

[0131] In one possible implementation, the determining module 71 is specifically used for:

[0132] Determine the target time; send an information acquisition request to the terminal device at the target time, the information acquisition request is used to request the terminal device to send security status information; receive the target security status information sent by the terminal device.

[0133] In one possible implementation, the determining module 71 is specifically used for:

[0134] Determine the historical security status information of the terminal device; determine the security level of the terminal device based on the historical security status information; adjust the preset duration according to the security level to obtain the target duration, which is used to determine the interval between two adjacent information acquisition requests; determine the target time based on the target duration.

[0135] Figure 8 This is a schematic diagram of a strategy item allocation device provided in an embodiment of this application. Figure 7 Based on the illustrated embodiments, as Figure 8 As shown, the allocation device 80 for the strategy item further includes: a judgment module 75, a processing module 76, a calculation module 77, and an execution module 78, wherein:

[0136] Module 75 is used for:

[0137] If an intermediate policy group exists among multiple candidate policy groups, the target policy group is determined based on the intermediate policy group, and the target security status information is matched with the business scenario information corresponding to the intermediate policy group; if no intermediate policy group exists among multiple candidate policy groups, the target policy group is determined based on the target security status information.

[0138] In one possible implementation, the determination module 75 is specifically used for:

[0139] If there is only one intermediate policy group, then the intermediate policy group is determined as the target policy group; if there are multiple intermediate policy groups, then the target policy group is determined from the intermediate policy groups according to the security level corresponding to each intermediate policy group.

[0140] Processing module 76 is used for:

[0141] Determine the value range of each piece of information in the business scenario information corresponding to each intermediate policy group; determine the target policy group based on the target security status information and the value range of each piece of information, where each piece of information in the target security status information is located within the value range of each piece of information in the target policy group.

[0142] Calculation module 77 is used for:

[0143] Determine the weight and weight of each piece of information in the target security status information; perform weighted summation on the weights to obtain the target security score of the terminal device; determine the target security level of the terminal device based on the target security score and the correspondence between the security score and the security level; determine the target policy group from multiple candidate policy groups based on the target security level, and the security level of the target policy group is the same as the target security level.

[0144] Execution module 78 is used for:

[0145] Encapsulate multiple policy items in the target policy group into multiple software development kits; send multiple software development kits to the terminal device.

[0146] It should be noted that the division of the various modules in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. These modules can be implemented entirely in software via processing element calls; they can be fully implemented in hardware; or some modules can be implemented by processing element calls to software, while others are implemented in hardware. Each module can be a separate processing element, or it can be integrated into a chip within the device. Alternatively, it can be stored as program code in the device's memory, and its functions can be called and executed by a processing element. Furthermore, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. During implementation, each step of the above method or each of the above modules can be completed through integrated logic circuits in the processor element or through software instructions.

[0147] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 9 As shown, the electronic device may include: a transceiver 91, a processor 92, and a memory 93.

[0148] Processor 92 executes computer execution instructions stored in memory, causing processor 92 to perform the scheme in the above embodiments. Processor 92 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0149] The memory 93 is connected to the processor 92 via the system bus and completes communication between them. The memory 93 is used to store computer program instructions.

[0150] Transceiver 91 can be used to obtain the task to be run and its configuration information.

[0151] The system bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The system bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the figure, but this does not mean that there is only one bus or one type of bus. The transceiver is used to realize communication between the database access device and other computers (e.g., clients, read-write libraries, and read-only libraries). The memory may include random access memory (RAM) and may also include non-volatile memory. The electronic device provided in the embodiments of this application can be the terminal device of the above embodiments.

[0152] This application also provides a chip for executing instructions, which is used to execute the technical solution of the strategy item allocation method in the above embodiments.

[0153] This application also provides a computer-readable storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the allocation method of the strategy items described in the above embodiments.

[0154] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium. When the at least one processor executes the computer program, it can implement the technical solution of the strategy item allocation method in the above embodiments.

[0155] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0156] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0157] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0158] The integrated modules described above, implemented as software functional modules, can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods of the various embodiments of this application.

[0159] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0160] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0161] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0162] The aforementioned storage medium can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium accessible to general-purpose or special-purpose computers.

[0163] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. The processor and storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and storage medium can exist as discrete components in an electronic control unit or main control device.

[0164] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0165] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method of allocating a policy item, characterized by, The method comprises: determining target security state information of a terminal device; determining a plurality of candidate policy groups and corresponding service scenario information of each candidate policy group, wherein the candidate policy group comprises a plurality of policy items, and the policy item is a rule for executing a security protection function; determining a target policy group according to the target security state information and the corresponding service scenario information of each candidate policy group, wherein the target security state information matches the corresponding service scenario information of the target policy group; sending the target policy group to the terminal device, so that the terminal device executes a plurality of policy items in the target policy group to achieve security protection; determining target security state information of a terminal device, comprising: determining historical security state information of the terminal device; determining a security level of the terminal device according to the historical security state information; adjusting a preset time length by the security level to obtain a target time length, wherein the target time length is used to determine the interval between adjacent two information acquisition requests; determining a target time according to the target time length; sending an information acquisition request to the terminal device at the target time, wherein the information acquisition request is used to request the terminal device to send security state information; receiving the target security state information sent by the terminal device; determining a target policy group according to the target security state information and the corresponding service scenario information of each candidate policy group, comprising: if there is an intermediate policy group in the plurality of candidate policy groups, determining the target policy group according to the intermediate policy group, wherein the target security state information matches the corresponding service scenario information of the intermediate policy group; if there is no intermediate policy group in the plurality of candidate policy groups, determining the target policy group according to the target security state information.

2. The method of claim 1, wherein, determining the target policy group according to the intermediate policy group, comprising: if the number of intermediate policy groups is one, determining the intermediate policy group as the target policy group; if the number of intermediate policy groups is a plurality, determining the target policy group from the intermediate policy groups according to the security level corresponding to each intermediate policy group.

3. The method of claim 2, wherein, The method further comprises: determining the value range corresponding to each information in the corresponding service scenario information of each intermediate policy group; determining the target policy group according to the target security state information and the value range corresponding to each information, wherein each information in the target security state information is located in each value range corresponding to the target policy group.

4. The method of claim 1, wherein, determining the target policy group according to the target security state information, comprising: determining the weight and weight of each information in the target security state information; performing weighted summation processing on the weight according to the weight to obtain the target security score of the terminal device; determining the target security level of the terminal device according to the target security score and the corresponding relationship between the security score and the security level; determining the target policy group from the plurality of candidate policy groups according to the target security level, wherein the security level of the target policy group is the same as the target security level.

5. The method according to any one of claims 1-4, characterized in that, sending the target policy group to the terminal device, comprising: Encapsulate each of the plurality of policy items in the target policy group as a plurality of software development kits; Send the plurality of software development kits to the terminal device.

6. An apparatus for allocating a policy item, characterized by comprising: The method comprises the steps of: determining target security state information of a terminal device; configuring a plurality of candidate policy groups and corresponding business scenario information of each candidate policy group, wherein the candidate policy group comprises a plurality of policy items, and the policy item is a rule for executing a security protection function; screening a target policy group according to the target security state information and the corresponding business scenario information of each candidate policy group, wherein the target security state information matches the corresponding business scenario information of the target policy group; sending the target policy group to the terminal device, so that the terminal device executes a plurality of policy items in the target policy group to achieve security protection; The determination module is specifically configured to: determine historical security state information of the terminal device; determine a security level of the terminal device according to the historical security state information; adjust a preset time length by the security level to obtain a target time length, wherein the target time length is used to determine the interval between adjacent two information acquisition requests; determine a target time according to the target time length; send an information acquisition request to the terminal device at the target time, wherein the information acquisition request is used to request the terminal device to send security state information; receive the target security state information sent by the terminal device; The screening module is specifically configured to: if there is an intermediate policy group in the plurality of candidate policy groups, determine the target policy group according to the intermediate policy group, wherein the target security state information matches the corresponding business scenario information of the intermediate policy group; if there is no intermediate policy group in the plurality of candidate policy groups, determine the target policy group according to the target security state information.

7. An electronic device, comprising: The method comprises the steps of: a processor and a memory connected in communication with the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method of any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the method of any one of claims 1-5.

9. A computer program product, characterised in that, The computer program is executed by the processor to implement the method of any one of claims 1-5.

Images