System security protection method and device, equipment and storage medium

Abstract

The invention discloses a system security protection method and device, equipment and a storage medium. Comprising the steps of obtaining an access request of a target system based on a reverse proxy server, and performing identity verification on the access request to generate an identity verification result; when the identity verification result is that verification is passed, analyzing the access request to generate an analysis parameter, and verifying the analysis parameter to generate a parameter verification result; and when the parameter verification result is a parameter error, forwarding the access request to a deployment honeypot to perform system security protection. Through reverse proxy and extensive domain name resolution, an attacker is difficult to acquire real domain name and port information of a target system. Through identity verification and parameter verification, requests which do not conform to specifications or have risks can be found and intercepted in time, normal operation of the system and data integrity are guaranteed, information leakage can be prevented, the exposure area of the target system is effectively reduced, channels for an attacker to obtain information are reduced, and therefore the network security protection capacity is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a system security protection method, device, equipment and storage medium. Background Art

[0002] With the popularization and application of the Internet, network attacks are becoming increasingly rampant. Attackers often collect target information through various means, such as domain name resolution, port scanning, vulnerability scanning, etc., in order to find a breakthrough point for attack. Traditional security protection measures, such as firewalls and intrusion detection systems, mainly detect and defend against attack behaviors, and it is difficult to effectively prevent attackers from obtaining target information. Therefore, measures need to be taken to reduce exposure and reduce the attacker's information collection channels, thereby reducing the risk of being attacked.

[0003] Currently, existing methods to reduce exposure include closing unnecessary ports and services, configuring firewall rules, and using proxy servers. Closing ports and services and using firewall rules can only limit attackers' attack behaviors, but it is difficult to effectively prevent attackers from obtaining target information. Using proxy servers can easily lead to information leakage, such as error information, server version information, etc., which attackers can use to attack. Summary of the invention

[0004] The present invention provides a system security protection method, device, equipment and storage medium to reduce the exposure of the target system, reduce the information collection channels of the attacker, and thus reduce the risk of the target system being attacked.

[0005] According to one aspect of the present invention, a system security protection method is provided, the method comprising:

[0006] Obtaining an access request of a target system based on a reverse proxy server, and authenticating the access request to generate an authentication result;

[0007] When the identity authentication result is verified, the access request is parsed to generate parsing parameters, and the parsing parameters are verified to generate parameter verification results;

[0008] When the parameter verification result is a parameter error, the access request is forwarded to the deployed honeypot for system security protection.

[0009] Optionally, before obtaining an access request from the target system based on the reverse proxy server, the method further includes: determining a target domain name corresponding to the target system, setting a wildcard domain name resolution for the target domain name to determine an associated domain name; and deploying a reverse proxy server for the target system based on the associated domain name.

[0010] Optionally, authenticating the access request to generate an authentication result includes: obtaining authentication information based on the access request; determining whether the authentication information meets preset verification criteria, and if so, determining that the authentication result is verified; otherwise, determining that the authentication result is verified failed.

[0011] Optionally, verifying the parsing parameters to generate parameter verification results includes: determining whether the parsing parameters correspond to the associated domain name, and if so, determining that the parameter verification result is a correct parameter; otherwise, determining that the parameter verification result is an incorrect parameter.

[0012] Optionally, the access request is forwarded to a deployment honeypot for system security protection, including: forwarding the access request to the deployment honeypot to obtain access data corresponding to the access request based on the deployment honeypot; building an attack identification model through a situation awareness platform, and identifying attack behaviors on the access data based on the attack identification model to determine abnormal access data.

[0013] Optionally, after verifying the parsed parameters to generate parameter verification results, the method further includes: when the parameter verification result shows that the parameters are correct, establishing a connection between the access request and the target system.

[0014] Optionally, the method further includes: when the identity authentication result is failure to pass the verification or the parameter verification result is a parameter error, calling a custom page through a reverse proxy server; and displaying the custom page.

[0015] According to another aspect of the present invention, there is provided a system safety protection device, the device comprising:

[0016] The authentication result generation module is used to obtain the access request of the target system based on the reverse proxy server, and authenticate the access request to generate an authentication result;

[0017] A parameter verification result generating module, used for parsing the access request to generate parsing parameters when the identity authentication result is passed, and verifying the parsing parameters to generate a parameter verification result;

[0018] The system security protection module is used to forward the access request to the deployed honeypot for system security protection when the parameter verification result is a parameter error.

[0019] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0020] at least one processor;

[0021] and a memory communicatively coupled to the at least one processor;

[0022] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute a system security protection method described in any embodiment of the present invention.

[0023] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a system security protection method described in any embodiment of the present invention when executed.

[0024] The technical solution of the embodiment of the present invention obtains the access request of the target system through the reverse proxy server and performs identity authentication, which can confirm the user identity at the initial stage of access, effectively prevent the access of illegal users, improve the security of the system, and reduce the risk of unauthorized access. By verifying the parsing parameters, the legitimacy and accuracy of the access request are further ensured. It is possible to timely discover and intercept requests that do not meet the specifications or pose risks, and ensure the normal operation of the system and the integrity of the data. When the parameter verification result is a parameter error, the access request is forwarded to the deployed honeypot, which can effectively confuse potential attackers and trap the attackers in the honeypot, thereby protecting the real target system from attack.

[0025] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 is a flow chart of a system security protection method provided according to Embodiment 1 of the present invention;

[0028] Figure 2 is a flow chart of another system security protection method provided according to Embodiment 2 of the present invention;

[0029] Figure 3 is a schematic diagram of the structure of a system safety protection device provided according to Embodiment 3 of the present invention;

[0030] Figure 4 It is a structural schematic diagram of an electronic device for implementing a system security protection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] Embodiment 1

[0034] Figure 1 A flowchart of a system security protection method is provided for the first embodiment of the present invention. This embodiment is applicable to network security protection scenarios. The method can be executed by a system security protection device. The system security protection device can be implemented in the form of hardware and / or software. The system security protection device can be configured in a computer controller. Figure 1 As shown, the method includes:

[0035] S110: Obtaining an access request from the target system based on the reverse proxy server, and authenticating the access request to generate an authentication result.

[0036] Among them, the reverse proxy server is a server located between the Internet client and the target system. The reverse proxy server receives access requests from the client, then sends requests to the target system on behalf of the client, and returns the response of the target system to the client. The target system refers to the specific system or service to be accessed and protected. The target system can be a website, application, database, etc. An access request refers to a request sent by the client to the target system, which contains information such as the target address and parameters of the request. Authentication refers to the process of confirming the legitimacy of the identity of the initiator of the access request. It can be determined by checking the username, password, token, digital certificate, etc. to determine whether the requester has the right to access the target system. The authentication results include two states: passed or failed.

[0037] Specifically, after receiving an access request, the reverse proxy server will authenticate the access request. The purpose of authentication is to ensure that only legitimate users or clients can access the target system. Authentication can prevent security risks such as unauthorized access, malicious attacks, and data leakage. The reverse proxy server can use a variety of authentication methods, such as username and password verification, digital certificate verification, token verification, etc. For example, the username and password verification method means that the client needs to provide the correct username and password when sending an access request, and the reverse proxy server will verify it. If the verification is successful, it means that the user is legitimate and the request can continue to be processed; if the verification fails, the request is rejected and the corresponding error message is returned.

[0038] Optionally, before obtaining an access request from the target system based on the reverse proxy server, the method further includes: determining a target domain name corresponding to the target system, setting a wildcard domain name resolution for the target domain name to determine an associated domain name; and deploying a reverse proxy server for the target system based on the associated domain name.

[0039] Specifically, you can first determine the target domain name corresponding to the target system. For example, the target domain name of a website may be "www.abc.com". By entering the target domain name, users can access various pages and functions of the corresponding website. Wildcard domain name resolution is a DNS configuration technology, which specifically refers to resolving a wildcard domain name (such as "*.abc.com") to a specific IP address or server. Any subdomain ending with the wildcard domain name can be resolved to the same target. For example, if "abc.com" is subjected to wildcard domain name resolution, all subdomains such as "1.abc.com", "2.abc.com", etc. can be pointed to the server where the target system is located.

[0040] It should be noted that by setting up wildcard domain name resolution, the associated domain name corresponding to the target system can be determined. The associated domain name refers to different subdomains, test domain names, development domain names, etc. of the target system. For example, in addition to the main domain name "www.abc.com", there may also be "test.abc.com" for the test environment, "dev.abc.com" for the development environment, etc. Through wildcard domain name resolution, all associated domain names can be included in the management scope of the reverse proxy server.

[0041] Furthermore, the reverse proxy server can be configured to listen to requests for associated domain names. That is, the reverse proxy server will intercept access requests related to the associated domain name and process them according to the configured rules. For example, when a user accesses "11.abc.com", the reverse proxy server will intercept it and forward it to the corresponding server of the target system according to the configuration. At the same time, the reverse proxy server can perform security checks on the requests to ensure that only legitimate requests can reach the target system.

[0042] In summary, by determining the domain name of the target system, setting up wildcard domain name resolution to determine the associated domain name, and deploying a reverse proxy server for the target system based on the associated domain name, effective management and protection of the target system can be achieved, and the performance and security of the system can be improved.

[0043] Optionally, authenticating the access request to generate an authentication result includes: obtaining authentication information based on the access request; determining whether the authentication information meets preset verification criteria, and if so, determining that the authentication result is verified; otherwise, determining that the authentication result is verified failed.

[0044] Specifically, when the reverse proxy server receives an access request, it needs to extract information for authentication. Access requests usually contain some specific fields or header information that can be used to obtain authentication information. For example, in an HTTP request, you can obtain an authentication token from the "Authorization" field in the request header; or obtain information such as the username and password in the request parameters. Different authentication methods may require obtaining information from different locations. For example, certificate-based authentication requires extracting relevant information from the digital certificate sent by the client.

[0045] Among them, the preset verification standard is a pre-set rule for judging the legitimacy of the authentication information, which may vary according to different authentication methods. For diagnostic username and password verification, the reverse proxy server will compare the extracted username and password with the legitimate user information stored in the database or configuration file. If the match is successful, it meets the preset verification standard. For token verification, the reverse proxy server may verify the validity of the token, the expiration time, whether the signature is correct, etc. If the token passes the verification, it meets the preset verification standard. For certificate verification, the reverse proxy server will verify whether the digital certificate sent by the client is issued by a trusted certificate authority, whether the certificate is within the validity period, etc.

[0046] Specifically, if the authentication information meets the preset authentication criteria, the authentication result can be determined as passed, and the client's identity is considered legitimate, and the access request can continue to be processed. If the authentication information does not meet the preset authentication criteria, the authentication result can be determined as failed. At this point, the reverse proxy server can take appropriate measures, such as returning an error response to the client, blocking the request from further accessing the target system, etc.

[0047] S120: When the identity authentication result is verified, the access request is parsed to generate parsing parameters, and the parsing parameters are verified to generate parameter verification results.

[0048] Specifically, when the identity authentication result is passed, the reverse proxy server will parse the access request to extract key information in the request, such as the request method, request path, request parameters, etc. In addition, the reverse proxy server will also verify the parsed parameters according to preset rules and business logic.

[0049] Optionally, verifying the parsing parameters to generate parameter verification results includes: determining whether the parsing parameters correspond to the associated domain name, and if so, determining that the parameter verification result is a correct parameter; otherwise, determining that the parameter verification result is an incorrect parameter.

[0050] Specifically, when the reverse proxy server receives the access request and parses it, it will obtain a set of parsing parameters, including the target address of the request, the request method, and the specific field value in the request header. The reverse proxy server will parse according to the protocol of the request and the corresponding format specification. When verifying the parsing parameters, it is necessary to determine whether the domain name involved in the parsing parameters belongs to the range of associated domain names. If the parsed domain name matches the associated domain name, then the parsing parameters are considered to correspond to the associated domain name. For example, if the associated domain name is "*.example.com", then "aaa.example.com", "bbb.example.com", etc. are all associated domain names. By determining whether the parsing parameters correspond to the associated domain name, the legitimacy of the access request can be further verified, thereby ensuring that only legitimate requests can access the target system and improving the security and stability of the system.

[0051] S130. When the parameter verification result is a parameter error, the access request is forwarded to the deployed honeypot for system security protection.

[0052] Among them, honeypot is a security technology that can simulate some or all functions of a real system, but it is actually a trap whose purpose is to attract attackers and collect attack information in order to better understand the attack methods and perform security protection.

[0053] Specifically, the reverse proxy server will forward access requests with incorrect parameters to the honeypot. Specifically, you can send requests to the address of the honeypot through a network connection, or automatically forward specific types of requests to the honeypot by configuring the rules of the reverse proxy server. When the request is forwarded to the honeypot, the honeypot will simulate the behavior of the target system and respond to the request. But in fact, the honeypot will monitor and analyze the request to identify potential attack behaviors. Honeypots can attract the attention of malicious attackers, causing them to focus their attack targets on the honeypot instead of the real target system. At the same time, honeypots can record attack behaviors and attack information, providing important clues for security analysis and incident response. Security personnel can take corresponding measures to strengthen the security protection of the system based on the information collected by the honeypot, such as fixing vulnerabilities and adjusting security policies.

[0054] Optionally, after verifying the parsed parameters to generate parameter verification results, the method further includes: when the parameter verification result shows that the parameters are correct, establishing a connection between the access request and the target system.

[0055] Specifically, after the resolution parameters are verified, if the result is that the parameters are correct, it indicates that key factors such as the source of the request (confirmed by identity authentication) and the target address of the request (determined by determining whether the resolution parameters correspond to the associated domain name) are legal and appropriate. At this time, the reverse proxy server can establish a connection between the access request and the target system. When it is determined that the parameters are correct, the reverse proxy server will act as an intermediary between the client and the target system and initiate a connection with the target system. The reverse proxy server will use the corresponding network protocol to send a connection request to the target system based on the address and port number of the target system.

[0056] Optionally, the method further includes: when the identity authentication result is failure to pass the verification or the parameter verification result is a parameter error, calling a custom page through a reverse proxy server; and displaying the custom page.

[0057] Specifically, when the identity verification result is Failed, it means that the identity information provided by the client does not meet the preset verification standard. When the parameter verification result is Parameter Error, it means that the parsed parameters do not meet the expectations. In both cases, the reverse proxy server can decide to call a pre-configured custom page to feedback error information to the client.

[0058] For example, if you use Apache HTTP Server as a reverse proxy server, you can use the ErrorDocument directive in the configuration file to specify a custom page to display when a specific error status code occurs. When authentication fails or the parameters are incorrect, the reverse proxy server can return a specific error status code, such as 401 Unauthorized or 400 Bad Request, and then call the corresponding custom page according to the configuration.

[0059] The technical solution of the embodiment of the present invention obtains the access request of the target system through the reverse proxy server and performs identity authentication, which can confirm the user identity at the initial stage of access, effectively prevent the access of illegal users, improve the security of the system, and reduce the risk of unauthorized access. By verifying the parsing parameters, the legitimacy and accuracy of the access request are further ensured. It is possible to timely discover and intercept requests that do not meet the specifications or pose risks, and ensure the normal operation of the system and the integrity of the data. When the parameter verification result is a parameter error, the access request is forwarded to the deployed honeypot, which can effectively confuse potential attackers and trap the attackers in the honeypot, thereby protecting the real target system from attack.

[0060] Embodiment 2

[0061] Figure 2This is a flowchart of a system security protection method provided in the second embodiment of the present invention. This embodiment adds a specific process of forwarding access requests to the deployment honeypot to perform system security protection on the basis of the above-mentioned first embodiment. Among them, the specific contents of steps S210-S220 are roughly the same as steps S110-S120 in the first embodiment, so they will not be repeated in this embodiment. Figure 2 As shown, the method includes:

[0062] S210: Obtain an access request from the target system based on the reverse proxy server, and authenticate the access request to generate an authentication result.

[0063] Optionally, before obtaining an access request from the target system based on the reverse proxy server, the method further includes: determining a target domain name corresponding to the target system, setting a wildcard domain name resolution for the target domain name to determine an associated domain name; and deploying a reverse proxy server for the target system based on the associated domain name.

[0064] Optionally, authenticating the access request to generate an authentication result includes: obtaining authentication information based on the access request; determining whether the authentication information meets preset verification criteria, and if so, determining that the authentication result is verified; otherwise, determining that the authentication result is verified failed.

[0065] S220: When the identity authentication result is verified, the access request is parsed to generate parsing parameters, and the parsing parameters are verified to generate parameter verification results.

[0066] Optionally, verifying the parsing parameters to generate parameter verification results includes: determining whether the parsing parameters correspond to the associated domain name, and if so, determining that the parameter verification result is a correct parameter; otherwise, determining that the parameter verification result is an incorrect parameter.

[0067] S230: When the parameter verification result is a parameter error, forward the access request to the deployment honeypot to obtain access data corresponding to the access request based on the deployment honeypot.

[0068] Specifically, when the parameter verification result is a parameter error, the reverse proxy server can redirect the access request that should have been sent to the real target system to the honeypot by modifying the target address of the request or using specific routing rules. By forwarding suspicious access requests to the honeypot, threats to the real target system can be avoided, thereby reducing the risk of the system being attacked. At the same time, the honeypot can record the attacker's behavior and the attack methods used, providing valuable information for subsequent security analysis and defense.

[0069] Furthermore, after receiving the forwarded access request, the honeypot will respond to the request like a real system, and will closely monitor and record all access data related to the access request. The access data may include the source IP address of the access request, the time of the request, the protocol used, the specific content of the request, and the honeypot's response to the request.

[0070] S240. Build an attack identification model through the situation awareness platform, and identify attack behaviors on access data based on the attack identification model to determine abnormal access data.

[0071] Specifically, the situation awareness platform is a system used to monitor and analyze network security situation. The situation awareness platform can collect data from various sources, including access data collected by honeypots, network traffic data, system logs, etc., and train attack recognition models by analyzing and learning a large amount of security data. When training attack recognition models, technologies such as machine learning algorithms, statistical analysis methods, or rule engines can be used. For example, machine learning algorithms can learn the characteristics and patterns of attacks by training known attack samples, so that new attack behaviors can be identified. The attack recognition model can automatically detect abnormal access data and issue an alarm so that security personnel can take countermeasures in a timely manner. It can help security personnel quickly and accurately identify potential attack behaviors and improve the efficiency and effectiveness of security protection.

[0072] Optionally, after verifying the parsed parameters to generate parameter verification results, the method further includes: when the parameter verification result shows that the parameters are correct, establishing a connection between the access request and the target system.

[0073] Optionally, the method further includes: when the identity authentication result is failure to pass the verification or the parameter verification result is a parameter error, calling a custom page through a reverse proxy server; and displaying the custom page.

[0074] The technical solution of the embodiment of the present invention obtains the access request of the target system through the reverse proxy server and performs identity authentication, which can confirm the user identity at the initial stage of access, effectively prevent the access of illegal users, improve the security of the system, and reduce the risk of unauthorized access. By verifying the parsing parameters, the legitimacy and accuracy of the access request are further ensured. It is possible to timely discover and intercept requests that do not meet the specifications or pose risks, and ensure the normal operation of the system and the integrity of the data. When the parameter verification result is a parameter error, the access request is forwarded to the deployed honeypot, which can effectively confuse potential attackers and trap the attackers in the honeypot, thereby protecting the real target system from attack.

[0075] Embodiment 3

[0076] Figure 3This is a schematic diagram of the structure of a system safety protection device provided in Embodiment 3 of the present invention. Figure 3 As shown, the apparatus includes: an identity authentication result generating module 310, which is used to obtain an access request of a target system based on a reverse proxy server, and authenticate the access request to generate an identity authentication result;

[0077] The parameter verification result generating module 320 is used to parse the access request to generate parsing parameters when the identity authentication result is passed, and to verify the parsing parameters to generate a parameter verification result;

[0078] The system security protection module 330 is used to forward the access request to the deployment honeypot for system security protection when the parameter verification result is a parameter error.

[0079] Optionally, the device also includes: a reverse proxy server deployment module, which is used to determine the target domain name corresponding to the target system before obtaining an access request of the target system based on the reverse proxy server, set a wildcard domain name resolution for the target domain name to determine the associated domain name; and deploy a reverse proxy server for the target system based on the associated domain name.

[0080] Optionally, the identity authentication result generation module 310 is specifically used to: obtain identity authentication information based on the access request; determine whether the identity authentication information meets the preset verification criteria, and if so, determine that the identity authentication result is verified; otherwise, determine that the identity authentication result is verified and failed.

[0081] Optionally, the parameter verification result generating module 320 is specifically used to: determine whether the parsing parameter corresponds to the associated domain name, if so, determine that the parameter verification result is a correct parameter; otherwise, determine that the parameter verification result is an incorrect parameter.

[0082] Optionally, the system security protection module 330 is specifically used to: forward the access request to the deployed honeypot to obtain access data corresponding to the access request based on the deployed honeypot; build an attack identification model through the situation awareness platform, and identify attack behaviors on the access data based on the attack identification model to determine abnormal access data.

[0083] Optionally, the device further includes: a system connection module, which is used to establish a connection between the access request and the target system after verifying the parsed parameters to generate a parameter verification result, when the parameter verification result is that the parameters are correct.

[0084] Optionally, the device also includes: a custom page display module, which is used to call a custom page through a reverse proxy server after verifying the parsed parameters to generate a parameter verification result, when the identity authentication result is failure to pass the verification or the parameter verification result is a parameter error; and display the custom page.

[0085] The technical solution of the embodiment of the present invention obtains the access request of the target system through the reverse proxy server and performs identity authentication, which can confirm the user identity at the initial stage of access, effectively prevent the access of illegal users, improve the security of the system, and reduce the risk of unauthorized access. By verifying the parsing parameters, the legitimacy and accuracy of the access request are further ensured. It is possible to timely discover and intercept requests that do not meet the specifications or pose risks, and ensure the normal operation of the system and the integrity of the data. When the parameter verification result is a parameter error, the access request is forwarded to the deployed honeypot, which can effectively confuse potential attackers and trap the attackers in the honeypot, thereby protecting the real target system from attack.

[0086] A system security protection device provided in an embodiment of the present invention can execute a system security protection method provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0087] Embodiment 4

[0088] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0089] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0090] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0091] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a system security protection method.

[0092] In some embodiments, a system security protection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of a system security protection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform a system security protection method in any other appropriate manner (e.g., by means of firmware).

[0093] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0094] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0095] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0096] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0097] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0098] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0099] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0100] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A system security protection method, characterized in that: include: Obtaining an access request from the target system based on the reverse proxy server, and authenticating the access request to generate an authentication result; When the identity authentication result is verified, the access request is parsed to generate parsing parameters, and the parsing parameters are verified to generate parameter verification results; When the parameter verification result is a parameter error, the access request is forwarded to the deployment honeypot for system security protection.

2. The method according to claim 1, characterized in that Before obtaining the access request of the target system based on the reverse proxy server, the method further includes: Determine a target domain name corresponding to the target system, and set a wildcard domain name resolution for the target domain name to determine an associated domain name; A reverse proxy server is deployed for the target system based on the associated domain name.

3. The method according to claim 1, characterized in that The authenticating the access request to generate an authentication result includes: obtaining identity authentication information based on the access request; Determine whether the identity verification information meets the preset verification criteria, and if so, determine that the identity verification result is verified; Otherwise, it is determined that the identity authentication result is that the authentication fails.

4. The method according to claim 2, characterized in that: The verifying the parsing parameters to generate parameter verification results includes: Determine whether the parsing parameter corresponds to the associated domain name, and if so, determine that the parameter verification result is that the parameter is correct; Otherwise, it is determined that the parameter verification result is a parameter error.

5. The method according to claim 1, characterized in that The step of forwarding the access request to the deployed honeypot for system security protection includes: forwarding the access request to a deployment honeypot to obtain access data corresponding to the access request based on the deployment honeypot; An attack identification model is constructed through a situation awareness platform, and attack behavior is identified on the access data based on the attack identification model to determine abnormal access data.

6. The method according to claim 4, characterized in that After verifying the parsing parameters to generate parameter verification results, the method further includes: When the parameter verification result shows that the parameters are correct, a connection is established between the access request and the target system.

7. The method according to claim 3, characterized in that The method further comprises: When the identity verification result is failure to pass the verification or the parameter verification result is parameter error, calling a custom page through the reverse proxy server; The customized page is displayed.

8. A system safety protection device, characterized in that: include: An identity authentication result generating module, used for obtaining an access request of a target system based on a reverse proxy server, and authenticating the access request to generate an identity authentication result; A parameter verification result generating module, configured to parse the access request to generate parsing parameters when the identity authentication result is verified, and to verify the parsing parameters to generate a parameter verification result; The system security protection module is used to forward the access request to the deployment honeypot for system security protection when the parameter verification result is a parameter error.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The computer storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method according to any one of claims 1 to 7 when executed.

Images