Server security access method and device, electronic equipment and readable storage medium

Abstract

The application discloses a kind of server security access method, device, electronic equipment and readable storage medium, applied to server, server is connected with one or more client communication, method includes: according to server log file, the access log of each user corresponding to each client is determined;Each access log is analyzed using risk assessment rule, and the target risk category that corresponding user hits in risk assessment rule is determined;Risk assessment rule includes the combination of one or more of API connection failure assessment rule, server resource access frequency assessment rule, off-site login assessment rule, high concurrent access assessment rule;According to the corresponding relationship between risk category and restriction rule, the target restriction rule corresponding to target risk category is determined;The user that hits corresponding target risk category is limited using target restriction rule.This scheme can be more accurate user risk assessment to client user and realize more flexible risk user control.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer security, in particular to a server-side secure access method, and relates to a server-side secure access device, an electronic device, a computer readable storage medium and a computer program product. BACKGROUND

[0002] In the process of data communication between the server and the client, in order to ensure the security of communication, the user of the client will be controlled for security risk. However, the current security risk restriction for the user has the following problems: only the user role is used to control the specified type of user, and the risk control method for the user is relatively single, which cannot accurately assess and customize the risk control for the user, and reduces the system availability.

[0003] Therefore, how to accurately assess the user risk of the client user and realize more flexible risk user control to effectively protect the system availability is a problem to be solved by those skilled in the art. SUMMARY

[0004] The purpose of the present application is to provide a server-side secure access method which can accurately assess the user risk of the client user and realize more flexible risk user control, effectively protecting the system availability; another purpose of the present application is to provide a server-side secure access device, an electronic device, a computer readable storage medium and a computer program product, all of which have the above-mentioned beneficial effects.

[0005] In a first aspect, the present application provides a server-side secure access method applied to a server, the server being in communication connection with one or more clients, and the method comprising:

[0006] Obtaining a server log file, and determining the access log of each user corresponding to each client according to the server log file;

[0007] Analyzing each access log by using a risk assessment rule to determine the target risk category of the corresponding user in the risk assessment rule; the risk assessment rule includes one or more combinations of API connection failure assessment rule, server resource access frequency assessment rule, out-of-town login assessment rule, and high concurrency access assessment rule;

[0008] According to the corresponding relationship between the risk category and the restriction rule, the target restriction rule corresponding to the target risk category is determined;

[0009] The user hitting the corresponding target risk category is restricted by using the target restriction rule, so as to realize the server-side secure access.

[0010] Optionally, when the risk assessment rule is the API connection failure assessment rule, the risk assessment rule is used to analyze each of the access logs, and a target risk category hit by a corresponding user in the risk assessment rule is determined, including:

[0011] API connection failure information of the corresponding user is determined according to the access logs;

[0012] The number of token invalidations, the number of parameter verification failures, and the number of connection timeouts of the user within a unit time are determined according to each of the API connection failure information;

[0013] When the number of token invalidations within the unit time reaches a first number defined in the API connection failure assessment rule, it is determined that the target risk category hit by the user is an API connection failure risk based on token invalidation;

[0014] When the number of parameter verification failures within the unit time reaches a second number defined in the API connection failure assessment rule, it is determined that the target risk category hit by the user is an API connection failure risk based on parameter verification failure;

[0015] When the number of connection timeouts within the unit time reaches a third number defined in the API connection failure assessment rule, it is determined that the target risk category hit by the user is an API connection failure risk based on connection timeout.

[0016] Optionally, when the risk assessment rule is the server resource access frequency assessment rule, the risk assessment rule is used to analyze each of the access logs, and a target risk category hit by a corresponding user in the risk assessment rule is determined, including:

[0017] Server resource access information of the corresponding user is determined according to the access logs; wherein the server resources include a plurality of important level resources;

[0018] The number of accesses to each of the important level resources of the user within a unit time is determined according to the server resource access information;

[0019] When the number of accesses to the important level resources reaches a corresponding level number defined in the server resource access frequency assessment rule, it is determined that the target risk category hit by the user is a super frequency access risk of the corresponding important level resource.

[0020] Optionally, when the risk assessment rule is the out-of-place login assessment rule, the risk assessment rule is used to analyze each of the access logs, and a target risk category hit by a corresponding user in the risk assessment rule is determined, including:

[0021] determine off-site login information of the corresponding user according to the access log;

[0022] determine IP information and token information of the user according to the off-site login information;

[0023] if each of the IP information of the user is different and each of the token information is different, determine that a target risk category hit by the user is a multi-device login risk;

[0024] if each of the IP information of the user is different and each of the token information is the same, determine that a target risk category hit by the user is an abnormal attack risk.

[0025] Optionally, when the risk assessment rule is the high-concurrency access assessment rule, the step of analyzing each of the access logs by using the risk assessment rule to determine a target risk category hit by a corresponding user in the risk assessment rule comprises:

[0026] determine a user access frequency of the corresponding user within a unit time according to the access log;

[0027] when the user access frequency within the unit time reaches a highest access frequency defined in the high-concurrency access assessment rule, determine that a target risk category hit by the user is an abnormal attack risk.

[0028] Optionally, before the step of analyzing each of the access logs by using the risk assessment rule to determine a target risk category hit by a corresponding user in the risk assessment rule, the method further comprises:

[0029] determine whether each of the users is a risk user according to each of the access logs;

[0030] if the user is a risk user, determine a risk level of the risk user according to the access log;

[0031] determine a target risk assessment rule hit by the corresponding risk user according to the risk level.

[0032] Optionally, after the step of limiting the user hitting the corresponding target risk category by using the target restriction rule to realize safe access of the service end, the method further comprises:

[0033] perform risk detection on the user for a preset number of times according to a preset time interval;

[0034] when the user does not hit the target risk category in all of the risk detection for the preset number of times, cancel user limitation by using a target unlimiting rule corresponding to the target restriction rule.

[0035] In a second aspect, the application further discloses a server-side secure access device applied to a server, wherein the server is in communication connection with one or more clients, and the device comprises:

[0036] an acquisition module, configured to acquire a server-side log file, and determine access logs of each user corresponding to each of the clients according to the server-side log file;

[0037] an analysis module, configured to analyze each of the access logs by using a risk assessment rule, and determine a target risk category hit by a corresponding user in the risk assessment rule; the risk assessment rule comprises one or more of a combination of an API connection failure assessment rule, a server-side resource access frequency assessment rule, an out-of-place login assessment rule, and a high-concurrency access assessment rule;

[0038] a determination module, configured to determine a target restriction rule corresponding to the target risk category according to a corresponding relationship between risk categories and restriction rules;

[0039] a restriction module, configured to restrict the user hitting the corresponding target risk category by using the target restriction rule, so as to realize server-side secure access.

[0040] In a third aspect, the application further discloses an electronic device, comprising:

[0041] a memory, configured to store a computer program;

[0042] a processor, configured to execute the computer program to realize the steps of any one of the server-side secure access methods.

[0043] In a fourth aspect, the application further discloses a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to realize the steps of any one of the server-side secure access methods.

[0044] In a fifth aspect, the application further discloses a computer program product, comprising computer programs / instructions, and the computer programs / instructions are executed by a processor to realize the steps of any one of the server-side secure access methods.

[0045] The application provides a service end security access method, applied to a service end, the service end is in communication connection with one or more clients, the method comprises the following steps: obtaining a service end log file, and determining the access log of each user corresponding to each client according to the service end log file; analyzing each access log by using a risk assessment rule, determining the target risk category of the corresponding user in the risk assessment rule; the risk assessment rule comprises one or more combinations of API connection failure assessment rule, service end resource access frequency assessment rule, out-of-town login assessment rule, high concurrency access assessment rule; determining the target restriction rule corresponding to the target risk category according to the corresponding relationship between the risk category and the restriction rule; limiting the user hitting the corresponding target risk category by using the target restriction rule, so as to realize the service end security access.

[0046] In the process of data communication between the service end and the client, the access log of each user corresponding to each client can be recorded by using the service end log file, so that the risk assessment of each user can be carried out by using various types of risk assessment rules, the target risk category of each user under different risk assessment rules is obtained, and therefore more accurate user risk assessment of the client user is realized; meanwhile, different restriction rules are set for different risk categories, so that the risk of the user can be limited according to the target restriction rule corresponding to the target risk category hit by the user, that is, more flexible risk user control is realized. Therefore, the technical scheme can realize more accurate user risk assessment and more flexible risk user control for the client user, and effectively guarantee the system availability.

[0047] In an embodiment of the application, different numbers and types of risk assessment rules can be set for different user categories (risky users and non-risky users) and risk levels (such as low, medium and high risk levels) to assess the risk of the users, which helps to realize more accurate user risk assessment and more accurate risk user control, and further improves the system availability.

[0048] The service end security access device, the electronic equipment, the computer readable storage medium and the computer program product provided by the application also have the technical effects described above, and the application will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0049] In order to more clearly illustrate the prior art and the technical solutions in the embodiments of the present application, the drawings used in the description of the prior art and the embodiments of the present application will be briefly introduced. Of course, the drawings related to the embodiments of the present application described below are only a part of the embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of the provided drawings, and the obtained other drawings also belong to the protection scope of the present application.

[0050] Figure 1 A structural schematic diagram of a secure access system provided by the present application is shown in the figure.

[0051] Figure 2 A flowchart of a server-side secure access method provided by the present application is shown in the figure.

[0052] Figure 3 A risk assessment diagram for users of different risk levels provided by the present application is shown in the figure.

[0053] Figure 4 A functional principle diagram of a secure access system provided by the present application is shown in the figure.

[0054] Figure 5 A structural schematic diagram of a server-side secure access device provided by the present application is shown in the figure.

[0055] Figure 6 A structural schematic diagram of an electronic device provided by the present application is shown in the figure. DETAILED DESCRIPTION

[0056] The core of the present application is to provide a server-side secure access method, which can more accurately evaluate the user risk of a client-side user and realize more flexible risk user control, effectively guaranteeing system availability. Another core of the present application is to provide a server-side secure access device, an electronic device, a computer readable storage medium and a computer program product, all of which have the above beneficial effects.

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be introduced below in combination with the drawings of the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the present application.

[0058] The embodiments of the present application provide a server-side secure access method.

[0059] First, please refer to Figure 1 ,Figure 1 A structural schematic diagram of a security access system provided by the present application is shown in the figure, the security access system comprises a server and one or more clients, and the server and each client can be communicatively connected. The server security access method provided by the embodiment of the present application is realized based on the security access system.

[0060] Further, refer to Figure 2 , Figure 2 A flowchart of a server security access method provided by the present application is shown in the figure, the server security access method is applied to the server shown in Figure 1 , and can comprise the following S101 to S104.

[0061] S101: Obtain a server log file, and determine the access log of each user corresponding to each client according to the server log file.

[0062] The present step aims to realize the determination of the access log of each user based on the server log file. Specifically, the server log file refers to the access log file of the server by each client, which is recorded and stored by the server, and the inside thereof includes the log information of each user when accessing the server through each client, i.e. the access log of each user. Among them, there can be multiple users using one client, and the access log of each user includes the access log of all users corresponding to each client, so that risk assessment and risk control can be performed for each user.

[0063] S102: Analyze each access log by using a risk assessment rule to determine the target risk category hit by the corresponding user in the risk assessment rule; the risk assessment rule comprises one or more combinations of API (Application Program Interface, application program interface) connection failure assessment rule, server resource access frequency assessment rule, remote login assessment rule, and high concurrency access assessment rule.

[0064] The present step aims to realize the user risk assessment function. Specifically, one or more risk assessment rules can be preset, and the access log of each user is analyzed by using the risk assessment rule, so that the target risk category hit by the corresponding user in the risk assessment rule can be determined. Among them, the API connection failure assessment rule is used to assess the API connection failure of the user within a unit time; the server resource access frequency assessment rule is used to assess the server resource access frequency of the user within a unit time; the remote login assessment rule is used to assess the remote login of the user; and the high concurrency access assessment rule is used to assess the access times of the user to the server within a unit time.

[0065] It should be noted that the number and type of pre-set risk assessment rules are not unique, and the number and type of risk assessment rules used in the analysis of each access log in this step are also not unique. As described above, the risk assessment rules can include one or more combinations of API connection failure assessment rules, server resource access frequency assessment rules, out-of-place login assessment rules, and high-concurrency access assessment rules. However, in this step, when the risk assessment rules include the above four assessment rules, only two of them can be used to assess the risk of user A, only three of them can be used to assess the risk of user B, and all of them can be used to assess the risk of user C.

[0066] Moreover, each risk assessment rule includes multiple risk categories. Accordingly, when a certain user is assessed using one of the above four assessment rules, the hit risk category of the user under this assessment rule (the number of target risk categories is 1) can be obtained. When a certain user is assessed using two of the above four assessment rules, the hit risk categories of the user under the two assessment rules (the number of target risk categories is 2) can be obtained. When a certain user is assessed using three of the above four assessment rules, the hit risk categories of the user under the three assessment rules (the number of target risk categories is 3) can be obtained. When a certain user is assessed using all of the above four assessment rules, the hit risk categories of the user under the four assessment rules (the number of target risk categories is 4) can be obtained.

[0067] Based on this, in an embodiment of the present application, before the above analysis of each access log using risk assessment rules to determine the target risk category hit by the corresponding user in the risk assessment rules, the method can further include:

[0068] determining whether each user is a risk user according to each access log;

[0069] if the user is a risk user, determining the risk level of the risk user according to the access log;

[0070] determining the target risk assessment rule hit by the corresponding risk user according to the risk level.

[0071] In this embodiment, different numbers and types of risk assessment rules can be used to assess the risk of users of different user categories (non-risk users / risk users) and risk levels (low-risk users / medium-risk users / high-risk users). For example, please refer to Figure 3 , Figure 3The risk assessment sketch for users of different risk levels provided in the present application can not use any risk assessment rule to assess the risk of a risk-free user; for a low-risk-level risk user, one of the four assessment rules can be selected to assess the risk (the number of target risk assessment rules hit is 1); for a medium-risk-level risk user, two of the four assessment rules can be selected to assess the risk (the number of target risk assessment rules hit is 2); and for a high-risk-level risk user, three or more of the four assessment rules can be selected to assess the risk (the number of target risk assessment rules hit is 3 or 4).

[0072] Wherein, whether each user is a risk user and the risk level of each risk user can be self-defined by the technician according to the actual situation. After obtaining the access log of a certain user, the risk assessment rule is used to assess the risk before the user category and the user risk level are judged to determine the corresponding target risk assessment rule, and then the step of analyzing each access log by using the risk assessment rule to determine the target risk category hit by the corresponding user in the risk assessment rule is performed.

[0073] As can be seen, the embodiments of the present application can set different numbers and types of risk assessment rules for users of different user categories (risk users and risk-free users) and risk levels (such as medium, low and high risk levels) to assess the risk, which helps to achieve more accurate user risk assessment and more accurate risk user control, and further improves the system usability.

[0074] S103: Determine the target restriction rule corresponding to the target risk category according to the correspondence between the risk category and the restriction rule.

[0075] This step aims to determine the target restriction rule, so as to use the target restriction rule to control the risk of the corresponding user. Specifically, the correspondence between different risk categories and restriction rules can be created in advance. Different risk categories can correspond to different restriction rules. Thus, the target risk category hit by the user in the risk assessment rule can be compared and analyzed with the correspondence to determine the target restriction rule corresponding to the target risk category. It can be understood that the restriction rule is a rule for restricting the user, and its specific content is not unique and is self-defined by the technician according to the actual demand, for example, the access times of the user to the server, the access frequency of the user to a certain type of server resource, the number of API connections of the user to the server, etc.

[0076] S104: limiting the user hitting the corresponding target risk category by using the target restriction rule to realize the safe access of the service end.

[0077] This step aims to realize user restriction based on the target restriction rule, that is, to realize risk user control, which helps to realize the safe access of the user to the service end.

[0078] Further, in an embodiment of the present application, after the target restriction rule is used to limit the user hitting the corresponding target risk category to realize the safe access of the service end, it can further include:

[0079] Performing risk detection on the user for a preset number of times at a preset time interval;

[0080] When the user does not hit the target risk category in all the preset number of risk detections, canceling the user restriction by using the target unlimiting rule corresponding to the target restriction rule.

[0081] Specifically, for the user who has been subjected to user restriction, the user can be subjected to risk detection in a loop, and once the user hits the target risk category, the user restriction can be canceled by using the target unlimiting rule corresponding to the target restriction rule, that is, the user restriction cancellation operation is realized. It should be noted that the specific values of the preset time interval and the preset number of times do not affect the implementation of the technical solution, which can be set by the technician according to the actual demand, and the present application does not limit it.

[0082] It can be seen that the service end safe access method provided by the embodiment of the present application can record the access logs of each user corresponding to each client by using the service end log file in the process of data communication between the service end and the client. Therefore, the risk of each user can be evaluated by using various types of risk evaluation rules, and the target risk category hit by each user under different risk evaluation rules is obtained, so that more accurate user risk evaluation for the client user is realized. At the same time, different restriction rules are set for different risk categories, so that the risk of the user can be limited according to the target restriction rule corresponding to the target risk category hit by the user, that is, more flexible risk user control is realized. It can be seen that the technical solution can perform more accurate user risk evaluation and realize more flexible risk user control for the client user, effectively guaranteeing the system availability.

[0083] On the basis of the above embodiment:

[0084] In an embodiment of the present application, when the risk evaluation rule is the API connection failure evaluation rule, the analysis of the access logs by using the risk evaluation rule to determine the target risk category hit by the corresponding user in the risk evaluation rule can include:

[0085] determine API connection failure information of the corresponding user according to the access log;

[0086] determine the number of token invalidations, the number of parameter verification failures, and the number of connection timeouts of the user within a unit time according to the API connection failure information;

[0087] when the number of token invalidations within the unit time reaches a first number defined in the API connection failure evaluation rule, determine that the target risk category hit by the user is an API connection failure risk based on token invalidation;

[0088] when the number of parameter verification failures within the unit time reaches a second number defined in the API connection failure evaluation rule, determine that the target risk category hit by the user is an API connection failure risk based on parameter verification failure;

[0089] when the number of connection timeouts within the unit time reaches a third number defined in the API connection failure evaluation rule, determine that the target risk category hit by the user is an API connection failure risk based on connection timeout.

[0090] The embodiments of the present application provide a user risk assessment method based on an API connection failure evaluation rule. Specifically, the API connection failure information of the corresponding user to the server can be included in the access log, wherein the reasons for API connection failure mainly include token invalidation, parameter verification failure, and connection timeout, so the number of occurrences of each type of reason within a unit time can be counted to facilitate the identification of the target risk category by referring to the number of occurrences of each type.

[0091] On this basis, in a possible implementation, determining the target restriction rule corresponding to the target risk category according to the corresponding relationship between the risk category and the restriction rule can include:

[0092] determining the number of API connections corresponding to the target risk category according to the corresponding relationship between the risk category and the restriction rule;

[0093] wherein the API connection failure risk based on token invalidation, the API connection failure risk based on parameter verification failure, and the API connection failure risk based on connection timeout correspond to different API connection numbers.

[0094] Specifically, when the API connection failure evaluation rule is used to assess the risk of the user, different API connection numbers can be set for API connection failure risks caused by different reasons, that is, the limitation of the maximum number of API connections of the user is realized. The number of API connections is the number of API connections within a unit time.

[0095] In an embodiment of the present application, when the risk assessment rule is the service end resource access frequency assessment rule, the analysis of each access log by the risk assessment rule to determine the target risk category hit by the corresponding user in the risk assessment rule can include:

[0096] determining the service end resource access information of the corresponding user according to the access log; wherein the service end resource includes a plurality of important level resources;

[0097] determining the access times of each important level resource by the user within a unit time according to the service end resource access information;

[0098] when the access times of the important level resource reach the corresponding level times defined in the service end resource access frequency assessment rule, determining that the target risk category hit by the user is the super frequency access risk of the corresponding important level resource.

[0099] The embodiment of the present application provides a user risk assessment method based on a service end resource access frequency assessment rule. Specifically, the access log can include the access information of the corresponding user to different important level resources in the service end, which can be used to determine the access times of different important level resources in the service end by the user within a unit time. Obviously, the higher the access times within a unit time, the greater the probability of super frequency access risk. Among them, for the service end resource with higher important level, a lower accessible times can be limited; for the service end resource with lower important level, a higher accessible times can be limited.

[0100] On this basis, in a possible implementation manner, determining the target restriction rule corresponding to the target risk category according to the corresponding relationship between the risk category and the restriction rule can include:

[0101] determining the accessible times of each important level resource corresponding to the target risk category according to the corresponding relationship between the risk category and the restriction rule;

[0102] wherein different important level resources correspond to different accessible times respectively.

[0103] Specifically, when the service end resource access frequency assessment rule is used to assess the risk of the user, different accessible times can be set for different important level service end resources, that is, the maximum accessible times of the user for different important level resources are limited. Among them, the accessible times are specifically the accessible times within a unit time.

[0104] In an embodiment of the present application, when the risk assessment rule is the out-of-place login assessment rule, the analysis of each access log by the risk assessment rule to determine the target risk category hit by the corresponding user in the risk assessment rule can include:

[0105] determine out-of-place login information of the corresponding user according to the access log;

[0106] determine IP information and token information of the user according to the out-of-place login information;

[0107] if each IP information of the user is different and each token information is different, determine that a target risk category hit by the user is a multi-device login risk;

[0108] if each IP information of the user is different and each token information is the same, determine that the target risk category hit by the user is an abnormal attack risk.

[0109] The embodiment of the application provides a user risk assessment method based on an out-of-place login evaluation rule. Specifically, the access log can include out-of-place login information of the corresponding user. According to the out-of-place login information, the IP and token used by the user each time when logging in to the server can be analyzed and determined. It can be understood that if the IP and token used when logging in to the server multiple times are all different, it indicates that the user may be using multiple devices (i.e., multiple clients) to log in to the server, and at this time, there may be a multi-device login risk. If the IP used when logging in to the server multiple times is different, but the token is the same, it indicates that the token may have been leaked, and at this time, there is a high probability of an abnormal attack risk from an illegal user.

[0110] On this basis, in a possible implementation manner, determining a target restriction rule corresponding to the target risk category according to the corresponding relationship between the risk categories and the restriction rules can include:

[0111] determining that the target restriction rule corresponding to the multi-device login risk is limiting the user from accessing high importance level resources according to the corresponding relationship between the risk categories and the restriction rules;

[0112] determining that the target restriction rule corresponding to the abnormal attack risk is limiting the user from accessing the server according to the corresponding relationship between the risk categories and the restriction rules.

[0113] Specifically, to effectively ensure the information security of the server, for the multi-device login risk, the access of the corresponding user to high importance level resources can be limited, that is, the user is not allowed to access high importance level resources in the server, and can only access low importance level resources in the server. For the abnormal attack risk, the user is directly denied to access the server.

[0114] In an embodiment of the application, when the risk evaluation rule is a high concurrency access evaluation rule, analyzing each access log by using the risk evaluation rule to determine the target risk category hit by the corresponding user in the risk evaluation rule can include:

[0115] determine the user access frequency of the corresponding user in a unit time according to the access log;

[0116] When the user access frequency in the unit time reaches the maximum access frequency defined in the high-concurrency access evaluation rule, it is determined that the target risk category hit by the user is an abnormal attack risk.

[0117] The embodiment of the application provides a user risk assessment method based on a high-concurrency access evaluation rule. Specifically, the access log can include the access frequency of the corresponding user to the server in a unit time, that is, the above-mentioned user access frequency. Obviously, the higher the user access frequency in the unit time, the greater the possibility of high-concurrency access, and at this time, there is a greater probability of abnormal attack risk from illegal users. It should be noted that the above-mentioned user access frequency can include the number of user access successes and the number of user access failures.

[0118] On this basis, in a possible implementation manner, determining the target restriction rule corresponding to the target risk category according to the corresponding relationship between the risk category and the restriction rule can include:

[0119] determining the server accessible frequency corresponding to the target risk category according to the corresponding relationship between the risk category and the restriction rule;

[0120] Among them, different user access frequencies correspond to different server accessible frequencies.

[0121] Specifically, when the high-concurrency access evaluation rule is used to evaluate the risk of the user, different server accessible frequencies (limitation access frequencies) can be set for different user access frequencies (actual access frequencies), that is, the limitation of the number of times the user can access the server is realized. Among them, the server accessible frequency is specifically the server accessible frequency in a unit time.

[0122] It should be noted that the specific values of various thresholds (first number, second number, third number, limited grade number, maximum access frequency, etc.) in the above-mentioned embodiments do not affect the implementation of the technical solution, which can be set by the technical personnel according to the actual demand, and the application does not limit this.

[0123] On the basis of the above-mentioned embodiments, the embodiment of the application provides another server security access method.

[0124] Please refer to Figure 4 , Figure 4 The function principle diagram of a security access system provided by the application, the implementation process of the corresponding server security access method is as follows:

[0125] I. Risk assessment

[0126] 1. Artificial setting: risk assessment can be artificially set, and each user can be set in the user management, which can set no risk, low risk, medium risk and high risk. This setting will not be affected by the self-assessment, and the priority is higher than the self-assessment. If the user wants to set low risk, medium risk and high risk, it needs to select the restriction item for the rule. Among them, the low-risk user needs to select one restriction rule in the setting rule, the medium-risk user needs to select two restriction rules in the setting rule, and the high-risk user needs to select three or more restriction rules in the setting rule.

[0127] 2. Rule setting: rule setting will set the risk rules, mainly including the following four:

[0128] (1) API connection failure. According to the failure reason, it is classified into API connection failure caused by ordinary class error (such as token invalidation), API connection failure caused by attack class error (such as parameter verification exception), API connection failure caused by timeout, etc. These will affect the system. For example, for token invalidation, if the same user is invalidated multiple times within 1 minute, it is reasonable to suspect that the username or password is leaked and occupied by others. For this kind of situation, login can be limited; for parameter verification exception, the parameters transmitted through the page should all meet the server request, and this kind of error is generally caused by attackers forging data attack, which can limit the API connection number based on this problem; for timeout error, it may be because the server is overloaded and cannot handle more demands in time, at this time, the server situation can be relieved by reducing the request frequency. Based on this, the above condition rules are introduced to facilitate risk assessment and restriction of users, so as to handle dangerous users in time and reduce system security risks.

[0129] (2) Resource access frequency. The server resources can be divided into levels according to importance, including general resources, medium resources and serious resources, and then different important resources are limited, for example: the access frequency of a single user to general resources within one hour cannot exceed 1000 times, the access frequency of a single user to medium resources within one hour cannot exceed 300 times, and the access frequency of a single user to serious resources within one hour cannot exceed 100 times. If it exceeds, the access frequency of different important resources is limited, which realizes different restrictions from the resource level.

[0130] (3) The number of remote logins. Remote login will be limited when the number of remote logins exceeds. This part includes two cases: one is that the user relogs in, the login IP and the previous one are inconsistent, and the user's token is inconsistent. For this case, if the number of remote logins of the user within 1 month exceeds 20 times, the access to important resources or login is limited. The other is that the token is the same but the IP is different. At this time, it is highly probable that the attacker holds the token to operate, because the token of the client logged in for different IPs is highly probable to be inconsistent. If this case exceeds 3 times within a day, it is considered that the user is at risk, and the access to important resources is limited.

[0131] (4) Single-user high-concurrency access. For this rule, the number of high concurrency of a single user within 1 minute can be set. If the number exceeds the limit, the number of access times will be limited in subsequent access to avoid consuming connection numbers and causing system service blockage.

[0132] II. Self-assessment

[0133] 1. API connection failure assessment: failed API connection requests can be filtered from operation logs and system logs (server log files), and classified according to failure reasons. If too many tokens are invalid within a unit of time, the account password is suspected to be leaked, the login can be limited, and the user can be locked; if too many parameter verification exceptions occur within a unit of time, the attacker is suspected to attack, the API connection number within a unit of time can be limited; if too many timeouts occur within a unit of time, the server is suspected to be overloaded, and the API connection number within a unit of time can be limited.

[0134] 2. Resource access frequency assessment: first, the importance of the server resources is graded, then all access requests of each user within 1 hour are filtered from the system logs, the access requests are classified and counted according to the resource importance level, and then they are assessed according to different rules. The number of access times of a single user to general resources within 1 hour cannot exceed 1000 times, the number of access times of a single user to medium resources within 1 hour cannot exceed 300 times, and the number of access times of a single user to serious resources within 1 hour cannot exceed 100 times. If the number exceeds, the user's access to various server resources can be limited. The number of access times of a single user to general resources within 1 hour can be set to 500 times, and the access requests exceeding the number can be discarded; the number of access times of a single user to medium resources within 1 hour can be set to 100 times, and the access requests exceeding the number can be discarded; the number of access times of a single user to important resources within 1 hour can be set to 50 times, and the access requests exceeding the number can be discarded. In this way, the safety and usability of the system can be effectively guaranteed.

[0135] 3. Remote login number assessment:

[0136] (1) Different IP different token: Users can log in on different clients. If a user frequently switches clients to log in, it is suspected that the username or password is leaked. The user can be limited to log in or an IP whitelist can be limited to protect the security of the user account. The number of occurrences of different login IPs can be counted by filtering operation logs, and compared with the rule limit. If the number exceeds, the user can be locked or the IP whitelist can be configured according to the rule configuration.

[0137] (2) Different IP same token: Abnormal attacks can occur. The number of occurrences of different IPs in all access requests of the same user can be filtered from system logs. Under normal circumstances, if the token generated by the same user logging in on different clients is different, if the same token appears on different IPs, it can be considered that the attacker carries the token to switch the proxy IP for attack. If the number of different IPs counted by the same token exceeds the limit, the login or access frequency can be limited according to the rule.

[0138] 4. High-concurrency access evaluation: High-concurrency access is a way to occupy system resources. Normal user operations will not produce high concurrency. For such problems, the number of all access requests of a user in a unit of time can be counted by system logs, and compared with the set rule. If the number exceeds the limit, the user access request number can be limited, and the resource importance level is not distinguished, so as to protect the service availability.

[0139] Further, according to the above four types of rules, the user can also be risk graded. If all rules are not met, the user is a no-risk user; if one rule is met, the user is a low-risk user; if two rules are met, the user is a medium-risk user; and if three or more rules are met, the user is a high-risk user.

[0140] Three, risk recovery

[0141] Risk recovery is an auxiliary module. For example, after a user is limited due to high concurrency, the user can be continuously detected for ten times. If the concurrency number of the user does not reach the limit of the connectable number, the risk level can be reduced and the high concurrency item limit can be cancelled.

[0142] Therefore, through the user risk evaluation, limitation and recovery scheme, the user level is limited to protect the security of the server and the user, and further to protect the availability of the system.

[0143] It can be seen that the service end safe access method provided by the embodiment of the application can record the access logs of each user corresponding to each client by using the service end log file in the process of data communication between the service end and the client. Thus, the risk of each user can be evaluated by using various types of risk evaluation rules, and the target risk category of each user under different risk evaluation rules is obtained. Therefore, more accurate user risk evaluation is realized for the client user. Meanwhile, different restriction rules are set for different risk categories, so that the risk of the user can be restricted according to the target restriction rule corresponding to the target risk category hit by the user, that is, more flexible risk user control is realized. It can be seen that the technical solution can perform more accurate user risk evaluation and realize more flexible risk user control for the client user, and effectively guarantees the system availability.

[0144] The embodiment of the application provides a service end safe access device.

[0145] Please refer to Figure 5 , Figure 5 The structure diagram of the service end safe access device provided by the application is shown in the figure. The service end safe access device is applied to a service end, and the service end is in communication connection with one or more clients. The service end safe access device can include the following components.

[0146] The acquisition module 1 is configured to acquire the service end log file, and determine the access log of each user corresponding to each client according to the service end log file.

[0147] The analysis module 2 is configured to analyze each access log by using a risk evaluation rule, and determine the target risk category hit by the corresponding user in the risk evaluation rule. The risk evaluation rule includes one or more combinations of the API connection failure evaluation rule, the service end resource access frequency evaluation rule, the out-of-place login evaluation rule, and the high-concurrency access evaluation rule.

[0148] The determination module 3 is configured to determine the target restriction rule corresponding to the target risk category according to the corresponding relationship between the risk category and the restriction rule.

[0149] The restriction module 4 is configured to restrict the user hitting the corresponding target risk category by using the target restriction rule, so as to realize the service end safe access.

[0150] It can be seen that the service end security access device provided by the embodiment of the application can record the access logs of each user corresponding to each client by using the service end log file in the process of data communication between the service end and the client. Thus, the risk assessment of each user can be performed by using various types of risk assessment rules, and the target risk category of each user under different risk assessment rules is obtained. Therefore, more accurate user risk assessment for the client user is realized. At the same time, different restriction rules are set for different risk categories, so that the risk of the user can be restricted according to the target restriction rule corresponding to the target risk category hit by the user, that is, more flexible risk user control is realized. It can be seen that the technical solution can perform more accurate user risk assessment and realize more flexible risk user control for the client user, and effectively guarantees the system availability.

[0151] In an embodiment of the application, when the risk assessment rule is the API connection failure assessment rule, the analysis module 2 can be specifically configured to determine the API connection failure information of the corresponding user according to the access log; determine the number of token invalidations, the number of parameter verification failures, and the number of connection timeouts of the user within a unit time according to each API connection failure information; when the number of token invalidations within the unit time reaches the first number defined in the API connection failure assessment rule, it is determined that the target risk category hit by the user is the API connection failure risk based on token invalidation; when the number of parameter verification failures within the unit time reaches the second number defined in the API connection failure assessment rule, it is determined that the target risk category hit by the user is the API connection failure risk based on parameter verification failure; and when the number of connection timeouts within the unit time reaches the third number defined in the API connection failure assessment rule, it is determined that the target risk category hit by the user is the API connection failure risk based on connection timeout.

[0152] In an embodiment of the application, when the risk assessment rule is the service end resource access frequency assessment rule, the analysis module 2 can be specifically configured to determine the service end resource access information of the corresponding user according to the access log; wherein the service end resources include a plurality of important level resources; determine the access times of each important level resource of the user within a unit time according to the service end resource access information; and when the access times of the important level resource reaches the corresponding level number defined in the service end resource access frequency assessment rule, it is determined that the target risk category hit by the user is the super frequency access risk of the corresponding important level resource.

[0153] In an embodiment of the present application, when the risk assessment rule is the remote login assessment rule, the analysis module 2 can be specifically configured to determine remote login information of the corresponding user according to the access log; determine IP information and token information of the user according to the remote login information; if each IP information of the user is different and each token information is different, determine that the target risk category hit by the user is the multi-device login risk; if each IP information of the user is different and each token information is the same, determine that the target risk category hit by the user is the abnormal attack risk.

[0154] In an embodiment of the present application, when the risk assessment rule is the high-concurrency access assessment rule, the analysis module 2 can be specifically configured to determine the user access frequency of the corresponding user within a unit time according to the access log; when the user access frequency within the unit time reaches the maximum access frequency defined in the high-concurrency access assessment rule, determine that the target risk category hit by the user is the abnormal attack risk.

[0155] In an embodiment of the present application, the service-side secure access device can further include a judgment module configured to, before the analysis of the access log by the risk assessment rule and the determination of the target risk category hit by the corresponding user in the risk assessment rule, determine whether each user is a risk user according to each access log; if the user is a risk user, determine the risk level of the risk user according to the access log; and determine the target risk assessment rule hit by the corresponding risk user according to the risk level.

[0156] In an embodiment of the present application, the service-side secure access device can further include a release module configured to, after the restriction of the user hitting the corresponding target risk category by the target restriction rule, perform risk detection on the user for a preset number of times at a preset time interval; and when the user does not hit the target risk category in all the preset number of times of risk detection, cancel the restriction on the user by the target release rule corresponding to the target restriction rule.

[0157] For the device provided in the embodiments of the present application, refer to the method embodiments described above, and the present application will not be repeated here.

[0158] An electronic device is provided in the embodiments of the present application.

[0159] For the device provided in the embodiments of the present application, refer to the method embodiments described above, and the present application will not be repeated here. Figure 6 , Figure 6 A structural schematic diagram of an electronic device provided in the present application, which can include:

[0160] The memory 11 is configured to store a computer program.

[0161] The processor 10 is configured to execute the computer program to implement the steps of any one of the above service-side secure access methods.

[0162] As Figure 6 shown, a schematic diagram of a constituent structure of an electronic device, the electronic device can include a processor 10, a memory 11, a communication interface 12 and a communication bus 13. The processor 10, the memory 11 and the communication interface 12 all complete communication with each other through the communication bus 13.

[0163] In the embodiment of the present application, the processor 10 can be a central processing unit (CPU), an application specific integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic device, etc.

[0164] The processor 10 can call a program stored in the memory 11, specifically, the processor 10 can perform the operations in the embodiments of the server security access method.

[0165] The memory 11 is used to store one or more programs, the program can include program code, the program code includes computer operation instructions, in the embodiment of the present application, the memory 11 at least stores a program for realizing the following functions:

[0166] Obtaining a server log file, and determining the access log of each user corresponding to each client according to the server log file;

[0167] Analyzing each access log by using a risk assessment rule to determine the target risk category corresponding to the user hitting in the risk assessment rule; the risk assessment rule includes one or more combinations of API connection failure assessment rule, server resource access frequency assessment rule, remote login assessment rule and high concurrency access assessment rule;

[0168] Determining the target restriction rule corresponding to the target risk category according to the corresponding relationship between the risk category and the restriction rule;

[0169] Restricting the user hitting the corresponding target risk category by using the target restriction rule, so as to realize server security access.

[0170] In a possible implementation manner, the memory 11 can include a storage program area and a storage data area, wherein the storage program area can store an operating system, and at least one application program required by a function; the storage data area can store data created in the use process.

[0171] In addition, the memory 11 can include a high-speed random access memory, and can also include a non-volatile memory, for example, at least one magnetic disk storage device or other volatile solid state storage device.

[0172] The communication interface 12 can be an interface of a communication module, used to connect with other devices or systems.

[0173] Of course, it should be noted that, Figure 6 The structures shown do not constitute a limitation on the electronic device in the embodiments of the present application, and in actual applications, the electronic device can include more or fewer components than Figure 6 shown, or combine certain components.

[0174] The embodiments of the present application provide a computer readable storage medium.

[0175] The computer readable storage medium provided by the embodiments of the present application stores a computer program, and the computer program is executed by a processor to implement the steps of any one of the above server secure access methods.

[0176] The computer readable storage medium can be any available medium that can be stored by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media, for example, it can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape, etc.), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk) and various media that can store computer program codes.

[0177] For the computer readable storage medium provided by the embodiments of the present application, please refer to the above method embodiments, which will not be repeated here.

[0178] The embodiments of the present application provide a computer program product.

[0179] The computer program product provided by the embodiments of the present application includes computer programs / instructions, which can implement the steps of any one of the above server secure access methods when executed by a processor.

[0180] Specifically, in the above embodiments, all or part of them can be realized by software, hardware, firmware or any combination thereof. When implemented by software, it can be realized in the form of a computer program product in whole or in part.

[0181] The computer program product can include one or more computer programs / instructions, which when loaded and executed on a computer, can generate the processes or functions described in the embodiments of the present application in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. Computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another, for example, computer instructions can be transferred from one website, computer, server or data center to another through wired (such as coaxial cable, optical fiber, digital subscriber line, etc.) or wireless (such as infrared, wireless, microwave, etc.) mode.

[0182] For the computer program product provided by the embodiments of the present application, refer to the above method embodiments, which will not be repeated here.

[0183] The embodiments in the specification are described progressively, and each embodiment focuses on the difference from other embodiments. The same or similar parts of each embodiment can be referred to each other. For the device disclosed by the embodiments, since it corresponds to the method disclosed by the embodiments, the description is relatively simple, and the related parts can be referred to the method part.

[0184] The skilled in the art can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or combination of the two. In order to clearly show the interchangeability of hardware and software, the composition and steps of each example have been described in the above description. Whether the functions are realized by hardware or software depends on the specific application and design constraints of the technical solution. The skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0185] The steps of the method or algorithm described in combination with the embodiments disclosed herein can be directly implemented by hardware, software module executed by processor, or combination of the two. The software module can be placed in random access memory (RAM), memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM or any other form of storage medium known in the art.

[0186] The above describes the technical solutions provided by the present application in detail. The principles and implementation modes of the present application are described by specific examples. The above description of the embodiments is only to help understand the method and its core idea of the present application. It should be pointed out that for the ordinary skilled in the art, without departing from the principles of the present application, some improvements and modifications can be made to the present application, and these improvements and modifications also fall within the protection scope of the present application.

Claims

1. A server-side secure access method, characterized in that, The method is applied to a server, the server is in communication connection with one or more clients, and the method comprises: obtaining a server log file, and determining, according to the server log file, access logs of each user corresponding to each of the clients; analyzing each of the access logs by using a risk assessment rule to determine a target risk category hit by a corresponding user in the risk assessment rule; the risk assessment rule comprises one or more combinations of an API connection failure assessment rule, a server resource access frequency assessment rule, an out-of-place login assessment rule, and a high-concurrency access assessment rule; determining a target restriction rule corresponding to the target risk category according to a corresponding relationship between risk categories and restriction rules; restricting the user hitting the corresponding target risk category by using the target restriction rule to achieve safe access of the server; wherein, before analyzing each of the access logs by using a risk assessment rule to determine a target risk category hit by a corresponding user in the risk assessment rule, the method further comprises: determining whether each of the users is a risk user according to each of the access logs; if the user is a risk user, determining a risk level of the risk user according to the access logs; the risk level comprises a low risk level, a medium risk level, and a high risk level; and determining a target risk assessment rule hit by the corresponding risk user according to the risk level; wherein, determining a target risk assessment rule hit by the corresponding risk user according to the risk level comprises: when the risk level is the low risk level, determining that the target risk assessment rule hit by the corresponding risk user is any one of all the risk assessment rules; when the risk level is the medium risk level, determining that the target risk assessment rule hit by the corresponding risk user is any two of all the risk assessment rules; and when the risk level is the high risk level, determining that the target risk assessment rule hit by the corresponding risk user is any three of all the risk assessment rules or all the risk assessment rules.

2. The server-side secure access method of claim 1, wherein, when the risk assessment rule is the API connection failure assessment rule, the analyzing each of the access logs by using a risk assessment rule to determine a target risk category hit by a corresponding user in the risk assessment rule comprises: determining API connection failure information of the corresponding user according to the access logs; determining, according to each of the API connection failure information, a number of token invalidations, a number of parameter verification failures, and a number of connection timeouts of the user within a unit time; when the number of token invalidations within the unit time reaches a first number defined in the API connection failure assessment rule, determining that the target risk category hit by the user is an API connection failure risk based on token invalidation; when the number of parameter verification failures within the unit time reaches a second number defined in the API connection failure assessment rule, determining that the target risk category hit by the user is an API connection failure risk based on parameter verification failure; When the number of connection timeouts in the unit time reaches a third number defined in the API connection failure evaluation rule, it is determined that the target risk category hit by the user is an API connection failure risk based on connection timeout.

3. The server-side secure access method of claim 1, wherein, When the risk evaluation rule is the server resource access frequency evaluation rule, the risk evaluation rule is used to analyze each access log to determine the target risk category hit by the corresponding user in the risk evaluation rule, comprising: According to the access log, the server resource access information of the corresponding user is determined; wherein the server resource includes a plurality of important level resources; According to the server resource access information, the access frequency of each important level resource by the user in a unit time is determined; When the access frequency of the important level resource reaches the corresponding level number defined in the server resource access frequency evaluation rule, it is determined that the target risk category hit by the user is the super frequency access risk of the corresponding important level resource.

4. The server-side secure access method of claim 1, wherein, When the risk evaluation rule is the remote login evaluation rule, the risk evaluation rule is used to analyze each access log to determine the target risk category hit by the corresponding user in the risk evaluation rule, comprising: According to the access log, the remote login information of the corresponding user is determined; According to the remote login information, the IP information and token information of the user are determined; If each of the IP information of the user is different and each of the token information is different, it is determined that the target risk category hit by the user is a multi-device login risk; If each of the IP information of the user is different and each of the token information is the same, it is determined that the target risk category hit by the user is an abnormal attack risk.

5. The server-side secure access method of claim 1, wherein, When the risk evaluation rule is the high concurrency access evaluation rule, the risk evaluation rule is used to analyze each access log to determine the target risk category hit by the corresponding user in the risk evaluation rule, comprising: According to the access log, the user access frequency of the corresponding user in a unit time is determined; When the user access frequency in the unit time reaches the maximum access frequency defined in the high concurrency access evaluation rule, it is determined that the target risk category hit by the user is an abnormal attack risk.

6. The server-side secure access method of claim 1, wherein, After the target restriction rule is used to restrict the user hitting the corresponding target risk category, the server safe access is realized, and further comprising: According to a preset time interval, the user is detected for a preset number of times; When the user does not hit the target risk category in all the preset number of risk detections, the target unlimiting rule corresponding to the target restriction rule is used to cancel the user restriction.

7. A server-side secure access apparatus, characterized by comprising: Applied to a server, the server is in communication connection with one or more clients, and the device comprises: An acquisition module is configured to acquire a server log file and determine the access log of each user corresponding to each client according to the server log file; An acquisition module is configured to acquire a server log file and determine the access log of each user corresponding to each client according to the server log file; The analysis module is configured to analyze each of the access logs by using the risk assessment rules to determine a target risk category that a corresponding user hits in the risk assessment rules; the risk assessment rules include one or more of a combination of an API connection failure assessment rule, a server resource access frequency assessment rule, a remote login assessment rule, and a high-concurrency access assessment rule; The determination module is configured to determine a target restriction rule corresponding to the target risk category according to a corresponding relationship between risk categories and restriction rules; The restriction module is configured to restrict a user hitting a corresponding target risk category by using the target restriction rule to achieve secure access to a server; The judgment module is configured to determine whether each of the users is a risk user according to each of the access logs before analyzing each of the access logs by using the risk assessment rules to determine a target risk category that a corresponding user hits in the risk assessment rules; if the user is a risk user, determine a risk level of the risk user according to the access logs; the risk level includes a low risk level, a medium risk level, and a high risk level; and determine a target risk assessment rule that a corresponding risk user hits according to the risk level; The judgment module is specifically configured to determine that the target risk assessment rule that a corresponding risk user hits is any one of all the risk assessment rules when the risk level is the low risk level; determine that the target risk assessment rule that a corresponding risk user hits is any two of all the risk assessment rules when the risk level is the medium risk level; and determine that the target risk assessment rule that a corresponding risk user hits is any three of all the risk assessment rules or all the risk assessment rules when the risk level is the high risk level.

8. An electronic device, comprising: The method comprises the following steps: The memory is configured to store a computer program; The processor is configured to execute the computer program to implement the steps of the secure access method to a server according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the secure access method to a server according to any one of claims 1 to 6.

Images