Methods, devices, equipment, and storage media for configuring permissions

Abstract

This application provides a method, apparatus, device, and storage medium for configuring permissions. It relates to the field of data security technology. The method includes: determining a target device for remote access and determining the real-time device information of the target device; inputting the real-time device information into an analysis model to obtain target security information of the target device, whereby the target security information represents the current security of the target device, and the analysis model is obtained by training training samples; determining the historical permissions of the target device; and determining the target permissions of the target device based on the target security information and historical permissions, whereby the target permissions are used to control remote access to the target device. This solution obtains real-time device information, which reflects the current security of the device. By matching the target permissions determined by the real-time device information with the current security of the device, the security of remote access controlled according to the target permissions is improved.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a method, apparatus, device and storage medium for configuring permissions. Background Technology

[0002] With the development of network technology and cloud computing technology, remote access between terminal devices is widely used in various business scenarios, such as remote office work.

[0003] In a zero-trust architecture, to enhance the security of terminal devices, fixed permissions are configured for remote access. These permissions control the remote access granted to terminal devices within a specified scope.

[0004] However, configuring fixed permissions for terminal devices suffers from low accuracy, which in turn leads to low security for remote access. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for configuring permissions to improve the security of remote access.

[0006] In a first aspect, this application provides a method for configuring permissions, comprising: determining a target device for remote access and determining real-time device information of the target device; inputting the real-time device information into an analysis model to obtain target security information of the target device, wherein the target security information represents the current security of the target device, and the analysis model is obtained by training a model on training samples; determining the historical permissions of the target device; and determining the target permissions of the target device based on the target security information and the historical permissions, wherein the target permissions are used to control remote access of the target device.

[0007] In one possible design, determining the target device for remote access includes: receiving a remote access request and determining the target device from the remote access request; or, determining the target device from a remote access list, the remote access list including multiple currently active devices performing remote access.

[0008] In one possible design, determining the target device from the remote access list includes: for any current device in the remote access list, determining the historical security information of the current device and the historical time when the historical security information was generated; determining the target duration based on the historical security information and a first correspondence between the security information and the duration; and determining the current device as the target device if the duration between the current time and the historical time is greater than or equal to the target duration.

[0009] In one possible design, determining the target permissions of the target device based on the target security information and the historical permissions includes: determining the target security information range based on the historical permissions and a second correspondence between permissions and security information ranges; if the target security information is within the target security information range, then the historical permissions are determined as the target permissions; if the target security information is outside the target security information range, then the historical permissions are adjusted to obtain the target permissions.

[0010] In one possible design, the real-time device information includes device attributes and environmental information; adjusting the historical permissions to obtain the target permissions includes: determining the historical behavior records of the target device, the historical behavior records including the access behavior of the target device; determining whether the target device has abnormal behavior based on the device attributes, the environmental information, and the historical behavior records; adjusting the historical permissions based on the target security information and whether the target device has abnormal behavior to obtain the target permissions.

[0011] In one possible design, the method further includes: executing the target permission through a gateway to obtain the target application and encryption policy corresponding to the target permission; the gateway is used to isolate the target device and the application; and controlling the target device and the target application to remotely access each other according to the encryption policy through the gateway.

[0012] In one possible design, the method further includes: acquiring historical device information corresponding to multiple devices and historical security information corresponding to each historical device information; determining that the training sample includes the historical device information and the historical security information corresponding to each historical device information; and training the training sample using a machine learning algorithm to obtain the analysis model.

[0013] Secondly, this application provides a permission configuration device, comprising: a determination module, configured to determine a target device for remote access and determine real-time device information of the target device; an analysis module, configured to input the real-time device information into an analysis model to obtain target security information of the target device, wherein the target security information represents the current security of the target device, and the analysis model is obtained by training a model on training samples; a query module, configured to determine the historical permissions of the target device; and a configuration module, configured to determine the target permissions of the target device based on the target security information and the historical permissions, wherein the target permissions are used to control remote access of the target device.

[0014] In one possible design, the determining module is specifically configured to receive a remote access request and determine the target device from the remote access request; or, the determining module is further configured to determine the target device from a remote access list, the remote access list including multiple current devices that are performing remote access.

[0015] In one possible design, the determining module is specifically configured to determine the historical security information of any current device in the remote access list and the historical time when the historical security information was generated; the determining module is further configured to determine the target duration based on the historical security information and a first correspondence between security information and duration; the determining module is further configured to determine the current device as the target device if the duration between the current time and the historical time is greater than or equal to the target duration.

[0016] In one possible design, the device further includes: a processing module, configured to determine a target security information range based on the historical permissions and a second correspondence between permissions and security information ranges; the processing module is further configured to determine the historical permissions as the target permissions if the target security information is within the target security information range; the processing module is further configured to adjust the historical permissions to obtain the target permissions if the target security information is outside the target security information range.

[0017] In one possible design, the real-time device information includes device attributes and environmental information; the processing module is specifically used to determine the historical behavior records of the target device, the historical behavior records including the access behavior of the target device; the processing module is further used to determine whether the target device has abnormal behavior based on the device attributes, the environmental information, and the historical behavior records; the processing module is further used to adjust the historical permissions based on the target security information and whether the target device has abnormal behavior, to obtain the target permissions.

[0018] In one possible design, the device further includes: a control module, configured to execute the target permission through a gateway to obtain the target application and encryption policy corresponding to the target permission; the gateway is configured to isolate the target device and the application; the control module is further configured to control the target device and the target application to remotely access each other according to the encryption policy through the gateway.

[0019] In one possible design, the device further includes: a training module, configured to acquire historical device information corresponding to multiple devices and historical security information corresponding to each historical device information; the training module is further configured to determine that the training samples include the historical device information and the historical security information corresponding to each historical device information; the training module is further configured to train the model on the training samples using a machine learning algorithm to obtain the analysis model.

[0020] Thirdly, embodiments of this application provide an electronic device, including: at least one processor and a memory; the memory stores computer execution instructions; the at least one processor executes the computer execution instructions stored in the memory, causing the at least one processor to perform the permission configuration method described in the first aspect and various possible designs of the first aspect.

[0021] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions. When a processor executes the computer-executable instructions, it implements the permission configuration method described in the first aspect and various possible designs of the first aspect.

[0022] Fifthly, embodiments of this application provide a computer program product, including a computer program, which, when executed by a processor, implements the permission configuration method described in the first aspect and various possible designs of the first aspect.

[0023] This application provides a method, apparatus, device, and storage medium for configuring permissions. The method includes: determining a target device for remote access and determining real-time device information of the target device; inputting the real-time device information into an analysis model to obtain target security information of the target device, wherein the target security information represents the current security of the target device, and the analysis model is obtained by training a model on training samples; determining the historical permissions of the target device; and determining the target permissions of the target device based on the target security information and the historical permissions, wherein the target permissions are used to control remote access to the target device. This solution obtains real-time device information, which reflects the current security of the device. By matching the target permissions determined by the real-time device information with the current security of the device, the security of remote access controlled by the target permissions is improved. Attached Figure Description

[0024] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0025] Figure 1A schematic diagram illustrating an application scenario of a permission configuration method provided in an embodiment of this application;

[0026] Figure 2 A flowchart illustrating a permission configuration method provided in an embodiment of this application;

[0027] Figure 3 A flowchart illustrating a permission configuration method provided in an embodiment of this application;

[0028] Figure 4 A schematic diagram illustrating the determination of the target device provided in this application embodiment;

[0029] Figure 5 A schematic diagram illustrating the adjustment permissions provided in an embodiment of this application;

[0030] Figure 6 A schematic diagram of the permission configuration architecture provided in the embodiments of this application;

[0031] Figure 7 A schematic diagram of the structure of a permission configuration device provided in an embodiment of this application;

[0032] Figure 8 A schematic diagram of the structure of a permission configuration device provided in an embodiment of this application;

[0033] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0034] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0035] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0036] The collection, storage, use, processing, transmission, provision, and disclosure of financial data or user data involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0037] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0038] Figure 1 An application scenario diagram illustrating the configuration of permissions for existing technologies. For example... Figure 1 As shown, devices can remotely access each other, and the specific applications accessed remotely are controlled by permissions.

[0039] In existing technologies, devices are configured with fixed permissions, and remote access to the devices is controlled based on these fixed permissions. However, device security is dynamically changing, and fixed permissions cannot match the dynamically changing security, resulting in low security for remote control.

[0040] To address the aforementioned technical problems, this application proposes the following technical concept: real-time acquisition of device information, and determination of matching permissions based on the real-time device information.

[0041] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0042] Figure 2 A flowchart illustrating a permission configuration method provided in an embodiment of this application is shown. The method includes the following steps:

[0043] S201. Determine the target device for remote access and determine the real-time device information of the target device.

[0044] As an example, the execution entity of this embodiment can be a permission configuration device, which can be implemented in various ways. For example, it can be program software, or a medium storing relevant computer programs, such as a USB flash drive; or, the device can also be a physical device that integrates or installs relevant computer programs, such as a chip, a smart terminal, a computer, a server, etc.

[0045] Real-time device information includes various types of information that affect device security.

[0046] For example, a trusted access console can be used to manage the digital identity of devices accessing remotely, enabling device authentication. After authentication, the device can access applications.

[0047] With the example scenario, the Trusted Access Console manages multiple authenticated devices in a unified manner. The device information of these devices changes dynamically, and the target device is identified from among the multiple devices in real time, along with its real-time device information.

[0048] S202. Input the real-time device information into the analysis model to obtain the target security information of the target device.

[0049] Among them, the target security information is used to represent the current security of the target device, and the analysis model is obtained by training the model on the training samples.

[0050] For example, an intelligent identity analysis system can be used to determine device security based on real-time device information. This system employs several core technologies, including big data analytics, machine learning, deviation algorithms, and visualization, to analyze device security and respond to risks.

[0051] Optionally, the target security information can be of the type such as security level or security score.

[0052] With scenario examples, the analysis model obtained through model training learns the correspondence between device information and security information, thereby enabling the output of corresponding target security information based on real-time device information.

[0053] It is understandable that specific levels or ratings can be used to evaluate the security of a target device, thereby providing an accurate basis for determining target permissions.

[0054] S203. Determine the historical permissions of the target device.

[0055] Optionally, retrieve historical permissions from the database used to store historical permissions.

[0056] For example, a query command is generated based on the unique device identifier of the target device, and the query command is executed to retrieve historical permissions from the database.

[0057] With the help of scenario examples, historical permissions reflect the security of the target device at every moment in its history and can be used as a reference standard for determining the target's permissions.

[0058] Optionally, target permissions can be determined based on the most recent historical permissions.

[0059] S204. Determine the target device's permissions based on the target security information and historical permissions.

[0060] Among them, target permissions are used to control remote access to the target device.

[0061] For example, the target device can be separated from remotely accessed applications, and the applications that the target device can access can be controlled through target permissions.

[0062] With the aid of scenario examples, the target security information reflects the current security of the target device. Based on the current security, historical permissions are adjusted to obtain the target permissions. After the target permissions are determined, remote access to the target device is controlled using the target permissions instead of historical permissions.

[0063] The permission configuration method provided in this application embodiment determines the target device for remote access and its real-time device information; inputs the real-time device information into an analysis model to obtain the target security information of the target device, which represents the current security of the target device; the analysis model is obtained by training training samples; determines the historical permissions of the target device; and determines the target permissions of the target device based on the target security information and historical permissions, which are used to control remote access to the target device. This scheme obtains real-time device information that reflects the current security of the device, and matches the target permissions determined by the real-time device information with the current security of the device, thereby improving the security of remote access controlled by the target permissions.

[0064] Based on any of the above embodiments, the following, in conjunction with Figure 3 This section provides a detailed explanation of the permission configuration process.

[0065] Figure 3 This is a flowchart illustrating a permission configuration method provided in an embodiment of this application. Figure 3 As shown, the method includes:

[0066] S301. Determine the target device for remote access.

[0067] For example, each device shares its identifier when making remote access, which allows for accurate identification of the target device.

[0068] One feasible implementation is to determine the target device for remote access by receiving a remote access request and determining the target device from the remote access request; or by determining the target device from a remote access list, which includes multiple currently accessing devices.

[0069] In this process, a device sends a remote access request before initiating remote access, and performs remote access only after the request is approved. Devices in the remote access list are those whose requests have been approved and are currently in the process of remote access.

[0070] With the example scenario, once a remote access request is approved, the device that sent the request can access the application. Multiple devices can establish remote access connections simultaneously, and the device identifier of each connected device is stored in the remote access list.

[0071] Optionally, the remote access list stores the devices currently being remotely accessed, as well as historical access records, which store devices that have been accessed in the past.

[0072] It is understandable that historical access records can be used to trace remote access and thus troubleshoot problems.

[0073] In this feasible implementation, the target device can be identified through multiple means, which can improve the versatility of permission configuration.

[0074] In one feasible implementation, the target device can be determined from the remote access list as follows: for any current device in the remote access list, determine the historical security information of the current device and the historical time when the historical security information was generated; determine the target duration based on the historical security information and the first correspondence between the security information and the duration; if the duration between the current time and the historical time is greater than or equal to the target duration, then the current device is determined as the target device.

[0075] Here, "current time" refers to the moment when the current execution permission is configured. The devices currently stored in the remote access list of the current device include some devices that require permission configuration and others that do not. The target device requiring permission configuration is determined from the current device.

[0076] With the example scenario, the period for configuring permissions is determined for each current device, and permissions are configured only for the current device whose period has expired.

[0077] Below, in conjunction with Figure 4 The target equipment is described.

[0078] Figure 4 This is a schematic diagram illustrating the determination of a target device as provided in an embodiment of this application. Figure 4 As shown, the historical security information of each current device is determined from the remote access list, and the historical time is determined from the historical security information. Each device has a corresponding period duration. The period duration corresponding to the historical security information is determined through the first correspondence, and the period duration of the current device is determined as the target duration of the current device. The interval between the historical time and the current time is determined as the current duration. The current duration and the target duration are compared. If the current duration is greater than or equal to the target duration, the current device is determined as the target device.

[0079] To illustrate with a scenario example, if the current time on the current device is 10:00, the historical time is 9:50, and the target duration is 8 minutes, then the current duration can be determined to be 10 minutes. Since the current duration is longer than the target duration, the current device is identified as the target device. A target duration of 8 minutes indicates that the permission allocation period for the current device is 8 minutes.

[0080] Optionally, the target duration value can be dynamically adjusted.

[0081] Optionally, the target duration can be dynamically adjusted based on the current behavior of the device.

[0082] For example, if any actions by the current device exceed authorized limits, the target duration is reduced based on the number of such actions. If no actions exceed authorized limits, the current device is considered to be behaving well, and the target duration is increased.

[0083] In this feasible implementation, by comparing the current duration with the target duration, the target device can be accurately determined according to preset rules, thereby improving the accuracy of permission configuration.

[0084] S302. Input the real-time device information into the analysis model to obtain the target security information of the target device.

[0085] It should be noted that the execution process of S302 is the same as that of S202, and will not be repeated here.

[0086] S303. Determine the historical permissions of the target device.

[0087] It should be noted that the execution process of S303 is the same as that of S203, and will not be repeated here.

[0088] S304. Determine the target security information range based on historical permissions and the second correspondence between permissions and security information range.

[0089] The target security information range is used to represent standard security information. The second correspondence is used to represent the standard security information corresponding to each permission.

[0090] With a scenario example, if the target security information is a security score, then the range of the target security information is the score range. Whether the target security information meets the standard is determined by whether it falls within this range.

[0091] If the target security information is within the target security information range, then execute S305.

[0092] If the target security information is not within the target security information range, then execute S306.

[0093] S305. Set historical permissions as target permissions.

[0094] With the example scenario, if the target security information is within the target security information range, it means that the target device's current security meets the standard. This means that since the last allocation of historical permissions, the target device's security has not exceeded the standard range, and no new permissions need to be configured.

[0095] Optionally, after determining the target permissions, update the historical time based on the current time.

[0096] To illustrate with a scenario example, if the current time is 10:00 and the historical time is 9:50, after determining the target permissions, the historical time will be updated to 10:00. This means that updating the historical time provides an accurate basis for subsequent permission configuration, thereby improving the accuracy of permission configuration.

[0097] S306. Determine the historical behavior records of the target device.

[0098] Among them, historical behavior records include access behavior of the target device.

[0099] The access behavior of each device is recorded for subsequent backtracking.

[0100] Optionally, historical behavior records include the moment of the access behavior.

[0101] With the help of scenario examples, we can analyze and process access behavior from a time dimension by using behavior time points to improve the accuracy of permission configuration.

[0102] S307. Based on the equipment attributes, environmental information, and historical behavior records, determine whether the target equipment exhibits abnormal behavior.

[0103] Among them, abnormal behavior refers to access behavior that poses security risks, such as access behavior exceeding permissions or malicious violation of permissions.

[0104] For example, a trusted environment awareness system can perform measurements based on device attributes, environmental information, and historical behavior records, combined with device trust technology, application trust technology, and identity trust technology to ensure the trustworthiness of the device entity. The trusted measurement results can also be returned to the trusted access console to determine dynamic authorization policies, and combined with a trusted proxy to achieve secure isolation of devices or services.

[0105] As illustrated by the scenario examples, device attributes can include hardware information, operating system information, device identification, etc. Device attributes can also include whether it's an office device or a personal device. Environmental information can include network environment, geographical location, time information, etc. Specifically, network environment can include office network, public network, etc.; geographical location can include office setting, public place, etc.; and time information can include working hours or non-working hours. Device attributes, environmental information, and historical behavior records all affect whether the target device's behavior is abnormal. For example, abnormal behavior could be "accessing work services on a public network" or "accessing work services in a public place," etc.

[0106] Based on the above implementation methods, determining abnormal behavior through multiple dimensions can improve the accuracy of identifying abnormal behavior, thereby improving the accuracy of permission configuration.

[0107] S308. Based on the target security information and whether the target device exhibits abnormal behavior, adjust the historical permissions to obtain the target permissions.

[0108] If the target security information is not within the scope of the target security information, further analysis of the target device will be conducted. Both the target security information and abnormal behavior can reflect the security of the target device, and these will be used as the basis for adjusting permissions.

[0109] Using a scenario example, with target security information as the security score (ranging from 70-90), the following steps are taken: If the security score is higher than 90, privileges are increased. If the security score is lower than 70, privileges are decreased. If no abnormal behavior is found or the number of abnormal behaviors does not reach the preset value, privileges are increased. If abnormal behavior is found or the number of abnormal behaviors reaches the preset value, privileges are decreased.

[0110] Below, in conjunction with Figure 5 Explanation of the adjustment permissions.

[0111] Figure 5 This is a schematic diagram illustrating the adjustment permissions provided in an embodiment of this application. Figure 5 As shown, the target security information and its range are compared. If the target security information is outside the range, the permissions are adjusted based on the specific value of the target security information and whether the target device exhibits abnormal behavior.

[0112] Optionally, a safety control strategy can be determined based on device attributes and environmental information.

[0113] Based on the scenario examples, remote office devices typically have endpoint security management software installed by default. Without other blacklisted programs enabled, they can directly access low-sensitivity and high-sensitivity applications on the intranet. However, when risky applications on the blacklist, such as remote desktop, are enabled, the endpoint environment awareness system fails to meet the required score, preventing the remote office device from accessing intranet applications until the endpoint's security status is restored and the environment awareness system determines that the access score meets the requirements. Similarly, remote personal devices, lacking security management software and without other blacklisted programs enabled, must access intranet applications through a sandbox after logging into a zero-trust system. When risky applications on the blacklist, such as remote desktop, are enabled, the endpoint environment awareness system fails to meet the required score, preventing the remote personal device from accessing intranet applications until the endpoint's security status is restored and the environment awareness system determines that the access score meets the requirements.

[0114] One feasible implementation method for configuring permissions further includes: executing target permissions through a gateway to obtain the target application and encryption policy corresponding to the target permissions; the gateway is used to isolate the target device and the application; and the gateway controls the target device and the target application to remotely access each other according to the encryption policy.

[0115] Below, in conjunction with Figure 6 The permission configuration architecture is explained.

[0116] Figure 6 This is a schematic diagram of the permission configuration architecture provided in an embodiment of this application. Figure 6 As shown, multiple devices are connected to the gateway. The Trusted Access Console is also connected to the gateway; it serves as the control center linking various subsystems. The Trusted Environment Awareness System is connected to the gateway and is used to collect and analyze the terminal security environment. The Intelligent Identity Analysis System is connected to both the Trusted Environment Awareness System and the Trusted Access Console. The Intelligent Identity Analysis System receives and evaluates information collected and analyzed by the Trusted Environment Awareness System, sends the evaluation results to the Trusted Access Console, and provides a basis for the console's control commands.

[0117] In this feasible implementation, isolation is achieved through a gateway to prevent remote access between devices, thereby improving the security of remote access.

[0118] One feasible implementation method for configuring permissions further includes: obtaining historical device information corresponding to multiple devices and historical security information corresponding to each historical device; determining that the training samples include historical device information and historical security information corresponding to each historical device; and training the model on the training samples using machine learning algorithms to obtain an analysis model.

[0119] Optionally, the analysis model uses a role-based access control model (RABC) that incorporates business constraints. RABC assigns permissions based on roles, taking into account business logic and rules such as time, location, attributes, or network addresses, to provide more granular control over permissions.

[0120] With scenario examples, RABC conducts comprehensive environmental awareness and endpoint trust assessment from multiple dimensions, including basic security (such as vulnerabilities), system security (accounts, security configurations), application compliance (software, services, registry, etc.), and physical environment (user absence, multiple people watching, etc.), making remote access to intranet services more secure and controllable.

[0121] Optionally, machine learning algorithms include, but are not limited to, logistic regression, support vector machines, random forests, or clustering algorithms.

[0122] In this feasible implementation, training the model from training samples determined from multiple devices can improve the accuracy of model analysis, thereby improving the accuracy of permission allocation.

[0123] Figure 7 This is a schematic diagram of a permission configuration device provided in an embodiment of this application. Figure 7 As shown, the permission configuration device 70 may include: a determination module 71, an analysis module 72, a query module 73, and a configuration module 74, wherein,

[0124] The determination module 71 is used to determine the target device for remote access and to determine the real-time device information of the target device.

[0125] Analysis module 72 is used to input real-time device information into the analysis model to obtain the target security information of the target device. The target security information is used to represent the current security of the target device. The analysis model is obtained by training the model on the training samples.

[0126] The query module 73 is used to determine the historical permissions of the target device.

[0127] Configuration module 74 is used to determine the target permissions of the target device based on the target security information and historical permissions. The target permissions are used to control remote access to the target device.

[0128] Optionally, module 71 can be executed. Figure 2 S201 in the embodiment.

[0129] Optionally, analysis module 72 can execute... Figure 2 S202 in the embodiment.

[0130] Optionally, query module 73 can execute... Figure 2 S203 in the embodiment.

[0131] Optionally, configuration module 74 can execute Figure 2 S204 in the embodiment.

[0132] It should be noted that the permission configuration device shown in the embodiments of this application can execute the technical solution shown in the above method embodiments, and its implementation principle and beneficial effects are similar, so they will not be described again here.

[0133] In one possible implementation, the determining module 71 is specifically configured to: receive a remote access request and determine a target device from the remote access request; or, determine a target device from a remote access list, the remote access list including multiple current devices that are performing remote access.

[0134] In one possible implementation, the determining module 71 is specifically used to: determine the historical security information of any current device in the remote access list and the historical time when the historical security information was generated; determine the target duration based on the historical security information and the first correspondence between the security information and the duration; and determine the current device as the target device if the duration between the current time and the historical time is greater than or equal to the target duration.

[0135] Figure 8 This is a schematic diagram of a permission configuration device provided in an embodiment of this application. Figure 7 Based on the illustrated embodiments, as Figure 8 As shown, the permission configuration device 80 further includes: a processing module 75, a control module 76, and a training module 77, wherein:

[0136] Processing module 75 is used for:

[0137] Based on historical permissions and the second correspondence between permissions and the scope of security information, the scope of target security information is determined; if the target security information is within the scope of target security information, the historical permissions are determined as the target permissions; if the target security information is outside the scope of target security information, the historical permissions are adjusted to obtain the target permissions.

[0138] In one possible implementation, the real-time device information includes device attributes and environmental information; the processing module 75 is specifically used for:

[0139] Determine the target device's historical behavior records, including its access behavior; based on device attributes, environmental information, and historical behavior records, determine if the target device exhibits any abnormal behavior; adjust historical permissions based on target security information and the presence of abnormal behavior to obtain the target's permissions.

[0140] Control module 76 is used for:

[0141] The gateway executes target permissions to obtain the target application and encryption policy corresponding to the target permissions; the gateway is used to isolate the target device and application; the gateway controls remote access between the target device and the target application according to the encryption policy.

[0142] Training module 77 is used for:

[0143] Obtain historical device information for multiple devices and historical security information for each historical device; determine that the training samples include historical device information and historical security information for each historical device; train the model on the training samples using machine learning algorithms to obtain the analysis model.

[0144] It should be noted that the division of the various modules in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. These modules can be implemented entirely in software via processing element calls; they can be fully implemented in hardware; or some modules can be implemented in software via processing element calls, while others are implemented in hardware. Each module can be a separate processing element, or it can be integrated into a chip within the device. Alternatively, it can be stored as program code in the device's memory, and its functions can be called and executed by a processing element. Furthermore, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. During implementation, each step of the above method or each of the above modules can be completed through integrated logic circuits in the processor element or through software instructions.

[0145] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 9 As shown, the electronic device may include: a transceiver 91, a processor 92, and a memory 93.

[0146] Processor 92 executes computer execution instructions stored in memory, causing processor 92 to perform the scheme in the above embodiments. Processor 92 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0147] The memory 93 is connected to the processor 92 via the system bus and completes communication between them. The memory 93 is used to store computer program instructions.

[0148] Transceiver 91 can be used to obtain the task to be run and its configuration information.

[0149] The system bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The system bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the figure, but this does not mean that there is only one bus or one type of bus. The transceiver is used to realize communication between the database access device and other computers (e.g., clients, read-write libraries, and read-only libraries). The memory may include random access memory (RAM) and may also include non-volatile memory. The electronic device provided in the embodiments of this application can be the terminal device of the above embodiments.

[0150] This application also provides a chip for executing instructions, which is used to execute the permission configuration method in the above embodiments.

[0151] This application also provides a computer-readable storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the permission configuration method described in the above embodiments.

[0152] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium, and when the at least one processor executes the computer program, it can implement the technical solution of the permission configuration method in the above embodiments.

[0153] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0154] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0155] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0156] The integrated modules described above, implemented as software functional modules, can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods of the various embodiments of this application.

[0157] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0158] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0159] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0160] The aforementioned storage medium can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium accessible to general-purpose or special-purpose computers.

[0161] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. The processor and storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and storage medium can exist as discrete components in an electronic control unit or main control device.

[0162] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0163] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for configuring permissions, characterized in that, include: The target device for remote access is identified, and the real-time device information of the target device is determined. The real-time device information includes device attributes and environmental information. The environmental information includes network environment, geographical location, and time information. The device attributes include whether the office device has remote desktop application enabled. The network environment includes the office network. The geographical location includes the office setting or public place. The time information includes working hours or non-working hours. The real-time device information is input into the analysis model to obtain the target security information of the target device. The target security information is used to represent the current security of the target device. The analysis model is obtained by training the training samples. Determine the historical permissions of the target device; Based on the target security information and the historical permissions, the target permissions of the target device are determined, and the target permissions are used to control remote access to the target device. Based on the target security information and the historical permissions, the target permissions of the target device are determined, including: The target security information range is determined based on the historical permissions and the second correspondence between permissions and security information ranges; If the target security information is within the scope of the target security information, then the historical permissions are determined as the target permissions; If the target security information is outside the scope of the target security information, the historical permissions are adjusted to obtain the target permissions; Adjusting the historical permissions to obtain the target permissions includes: Determine the historical behavior records of the target device, including the access behavior of the target device; Based on the device attributes, the environmental information, and the historical behavior records, it is determined whether the target device exhibits abnormal behavior; the abnormal behavior includes accessing work services on a public network or accessing work services in a public place. Based on the target security information and whether the target device exhibits abnormal behavior, the historical permissions are adjusted to obtain the target permissions; Identify the target device for remote access, including: For any current device in the remote access list, determine the historical security information of the current device and the historical time when the historical security information was generated; the remote access list includes multiple current devices that are currently performing remote access. The target duration is determined based on historical security information and the primary correspondence between security information and duration. If the duration between the current moment and the historical moment is greater than or equal to the target duration, then the current device is determined as the target device; The method further includes: The gateway executes the target permissions to obtain the target application and encryption policy corresponding to the target permissions; the gateway is used to isolate the target device and the application. The gateway controls the target device and the target application to remotely access each other according to the encryption policy.

2. The method according to claim 1, characterized in that, The method further includes: Obtain historical device information for multiple devices and historical security information for each historical device; The training samples include the historical device information and the historical security information corresponding to each historical device information. The analysis model is obtained by training the training samples using machine learning algorithms.

3. A permission configuration device, characterized in that, include: The determination module is used to determine the target device for remote access and to determine the real-time device information of the target device; the real-time device information includes device attributes and environmental information; the environmental information includes network environment, geographical location, and time information; the device attributes include whether the office device has remote desktop application enabled; the network environment includes office network; the geographical location includes office scene or public place; the time information includes working hours or non-working hours; The analysis module is used to input the real-time device information into the analysis model to obtain the target security information of the target device. The target security information is used to represent the current security of the target device. The analysis model is obtained by training the model on the training samples. The query module is used to determine the historical permissions of the target device; A configuration module is used to determine the target permissions of the target device based on the target security information and the historical permissions, wherein the target permissions are used to control the remote access of the target device; The configuration module is specifically used for: The target security information range is determined based on the historical permissions and the second correspondence between permissions and security information ranges; If the target security information is within the scope of the target security information, then the historical permissions are determined as the target permissions; If the target security information is outside the scope of the target security information, the historical permissions are adjusted to obtain the target permissions; The configuration module is used to adjust the historical permissions, and when the target permissions are obtained, it is specifically used for: Determine the historical behavior records of the target device, including the access behavior of the target device; Based on the device attributes, the environmental information, and the historical behavior records, it is determined whether the target device exhibits abnormal behavior; the abnormal behavior includes accessing work services on a public network or accessing work services in a public place. Based on the target security information and whether the target device exhibits abnormal behavior, the historical permissions are adjusted to obtain the target permissions; The determining module is specifically used for: For any current device in the remote access list, determine the historical security information of the current device and the historical time when the historical security information was generated; the remote access list includes multiple current devices that are currently performing remote access. The target duration is determined based on historical security information and the primary correspondence between security information and duration. If the duration between the current moment and the historical moment is greater than or equal to the target duration, then the current device is determined as the target device; The configuration module is also used for: The gateway executes the target permissions to obtain the target application and encryption policy corresponding to the target permissions; the gateway is used to isolate the target device and the application. The gateway controls the target device and the target application to remotely access each other according to the encryption policy.

4. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-2.

5. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-2.

6. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1-2.

Images