Business data detection method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a service data detection method and device, equipment and a storage medium, and relates to the technical field of computers, the method comprises the following steps: determining that a safety detection triggering condition is met, and according to a first service module and a preset service logic and a calling interface of a first client, calling the first client; executing security detection of the first service module and the second service module in the operation process, obtaining a service logic execution path of the first service module in the operation process, sending the service logic execution path of the first service module in the operation process to a server, receiving a security detection result sent by the server, and sending the security detection result to the server. The safety detection result is that the server performs safety detection according to a service logic execution path of the first service module in the operation process, a service logic execution path of the second service module in the operation process, a preset service logic execution path of the first service module and a preset service logic execution path of the second service module; and performing path integrity verification.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a business data detection method, device, equipment and storage medium. Background Art

[0002] At present, in end-to-end access scenarios, for example, when two terminal devices perform service access (such as remote access) or data synchronization through a server or gateway, security verification is performed before the business modules at both ends interact with each other. The security verification includes access ticket application and verification, executable file static feature verification, and interface security verification. Specifically, the security management client and server running on the terminal device are used to verify the business module of a single terminal device. After the security verification passes, the business modules at both ends are allowed to connect and perform data communication.

[0003] However, the above-mentioned existing security verification is only limited to the security verification between the business modules of each terminal device and the server, which is not enough to cover the security verification scenarios. Attackers can disguise themselves as legitimate business modules in various ways to illegally obtain data or make service calls. Therefore, the security of data and services in end-to-end access scenarios is not high. Summary of the invention

[0004] The embodiments of the present application provide a business data detection method, apparatus, device and storage medium, which can improve the security of data and business in end-to-end access scenarios.

[0005] In a first aspect, an embodiment of the present application provides a service data detection method, the method being applied to a first client, the method comprising:

[0006] Determining that a security detection trigger condition is met, the security detection being a security detection of a first service module and a second service module during operation, the first service module and the first client running on a first terminal device, and the second service module and the second client running on a second terminal device;

[0007] According to the business logic and calling interface preset by the first business module and the first client, perform security detection of the first business module and the second business module during operation, and obtain the execution path of the business logic of the first business module during operation;

[0008] Sending the execution path of the business logic of the first business module during operation to the server;

[0009] Receive a security check result sent by the server, where the security check result is obtained by performing a path integrity check based on the path of business logic execution of the first business module during operation, the path of business logic execution of the second business module during operation, a preset path of business logic execution of the first business module, and a preset path of business logic execution of the second business module.

[0010] In a second aspect, an embodiment of the present application provides a service data detection method, which is applied to a server and includes:

[0011] receiving a path of a business logic execution of a first business module during operation sent by a first client, wherein the first business module and the first client are running on a first terminal device, wherein the path of the business logic execution of the first business module during operation is obtained when the first client performs security detection of the first business module and the second business module during operation according to the business logic and calling interface preset by the first business module and the first client;

[0012] receiving a path of the execution of the business logic of the second business module during operation sent by the second client, the second business module and the second client running on the second terminal device, wherein the path of the execution of the business logic of the second business module during operation is obtained when the second client performs security detection of the first business module and the second business module during operation according to the business logic and calling interface preset by the second business module and the second client;

[0013] Perform a path integrity check according to the path of the business logic execution of the first business module during operation, the path of the business logic execution of the second business module during operation, the preset path of the business logic execution of the first business module, and the preset path of the business logic execution of the second business module to obtain a security detection result;

[0014] The security detection result is sent to the first client and the second client.

[0015] In a third aspect, an embodiment of the present application provides a service data detection device, including:

[0016] A determination module, used to determine whether a security detection trigger condition is satisfied, wherein the security detection is a security detection of the first service module and the second service module during operation, wherein the first service module and the first client are running on a first terminal device, and the second service module and the second client are running on a second terminal device;

[0017] A processing module, configured to perform security detection of the first business module and the second business module during operation according to the business logic and calling interface preset by the first business module and the first client, and obtain a path for executing the business logic of the first business module during operation;

[0018] A sending module, used for sending the execution path of the business logic of the first business module during operation to the server;

[0019] A receiving module is used to receive the security detection result sent by the server, wherein the security detection result is obtained by the server performing a path integrity check based on the path of business logic execution of the first business module during operation, the path of business logic execution of the second business module during operation, the preset path of business logic execution of the first business module, and the preset path of business logic execution of the second business module.

[0020] In a fourth aspect, an embodiment of the present application provides a service data detection device, including:

[0021] a receiving module, configured to receive a path of a business logic execution of a first business module during operation, which is sent by a first client. The first business module and the first client are running on a first terminal device, wherein the path of the business logic execution of the first business module during operation is obtained when the first client performs security detection of the first business module and the second business module during operation according to the business logic and calling interface preset by the first business module and the first client;

[0022] The receiving module is further used to: receive a path of the business logic execution of the second business module during operation sent by the second client, the second business module and the second client running on the second terminal device, wherein the path of the business logic execution of the second business module during operation is obtained when the second client performs security detection of the first business module and the second business module during operation according to the business logic and calling interface preset by the second business module and the second client;

[0023] A processing module, used to perform a path integrity check according to a path of business logic execution of the first business module during operation, a path of business logic execution of the second business module during operation, a preset path of business logic execution of the first business module, and a preset path of business logic execution of the second business module to obtain a security detection result;

[0024] A sending module is used to send the security detection result to the first client and the second client.

[0025] In a fifth aspect, an embodiment of the present application provides a business data detection device, comprising: a processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory to execute the method of the first aspect or the second aspect.

[0026] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on a computer program, enable the computer to execute a method as in the first aspect or the second aspect.

[0027] In a seventh aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when executed on a computer, causes the computer to execute the method of the first aspect or the second aspect.

[0028] In summary, in the embodiment of the present application, when the first client determines that the security detection trigger condition is met, according to the business logic and call interface preset by the first business module and the first client, the security detection of the first business module and the second business module during operation is performed, and the path of the business logic execution of the first business module during operation is obtained, and then the path of the business logic execution of the first business module during operation is sent to the server. The server performs a path integrity check according to the path of the business logic execution of the first business module during operation, the path of the business logic execution of the second business module during operation sent by the second client, the preset path of the business logic execution of the first business module, and the preset path of the business logic execution of the second business module, obtains the security detection result and sends it to the first client. By presetting the business logic and call interface for runtime detection in the business modules at both ends and the clients at both ends, the client of any terminal device can initiate the runtime security detection of the other end or the server can initiate the runtime security detection for both ends, so as to realize the security detection of the client and business modules running on the terminal devices of the two communicating parties and the communication link constructed by the server during the operation of the business modules at both ends. Therefore, the security detection capability can be improved to a certain extent, thereby improving the security of data and business in the end-to-end access scenario.

[0029] Furthermore, in the embodiments of the present application, when executing security checks during operation, the client interacting with the business module is verified with respect to user identity and device compliance before performing security checks on the communication link. If the verification is normal, the security check of the communication link is performed again. If the verification is abnormal, the terminal device is isolated from the network, which can further enhance the security detection capability and further improve the security of data and business. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0031] Figure 2 A schematic diagram of the processing flow of a zero-trust network security service is provided;

[0032] Figure 3 An interactive flow chart of a business data detection method provided in an embodiment of the present application;

[0033] Figure 4 A schematic diagram of the business logic and calling interface of a business module 1 in a terminal device A and a security management client running in the terminal device A provided in an embodiment of the present application;

[0034] Figure 5 An interactive flow chart of a business data detection method provided in an embodiment of the present application;

[0035] Figure 6 A schematic diagram of the structure of a service data detection device provided in an embodiment of the present application;

[0036] Figure 7 A schematic diagram of the structure of a service data detection device provided in an embodiment of the present application;

[0037] Figure 8 It is a schematic block diagram of a business data detection device 300 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the embodiments of the present application.

[0039] It should be noted that the terms "first", "second", etc. in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or server comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0040] The method involved in the embodiments of the present application can be based on cloud technology, and can perform real-time or quasi-real-time security detection on the communication link composed of the security management client, server and business module running on the devices of the communicating parties mentioned in the embodiments of the present application, as well as perform security detection on the security management client interacting with the business module in terms of user identity and device compliance. When the security detection result is abnormal, the server or security management client terminates the operation of the business module, or the server initiates a network isolation operation for the terminal device, and transfers the terminal device to an isolation network, so that the terminal device is isolated from other devices in the enterprise network. It is suitable for the cloud security field in cloud technology.

[0041] Cloud technology refers to a hosting technology that unifies hardware, software, network and other resources within a wide area network or local area network to achieve data computing, storage, processing and sharing.

[0042] Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model. It can form a resource pool, which can be used on demand and is flexible and convenient. Cloud computing technology will become an important support. The backend services of the technical network system require a large amount of computing and storage resources, such as video websites, image websites and more portal websites. With the rapid development and application of the Internet industry, in the future, each item may have its own identification mark, which needs to be transmitted to the backend system for logical processing. Data of different levels will be processed separately. All kinds of industry data need strong system backing support, which can only be achieved through cloud computing.

[0043] Among them, cloud security refers to the general term for security software, hardware, users, institutions, and security cloud platforms based on cloud computing business model applications. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and unknown virus behavior judgment. Through a large number of networked clients, it monitors abnormal software behavior in the network, obtains the latest information on Trojans and malicious programs on the Internet, and sends it to the server for automatic analysis and processing, and then distributes virus and Trojan solutions to each client.

[0044] Specifically, the main research directions of cloud security include:

[0045] 1. Cloud computing security, mainly studying how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, compliance audit, etc.;

[0046] 2. Cloudification of security infrastructure, mainly studying how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event, information collection and processing platform through cloud computing technology, realizing the collection and correlation analysis of massive information, and improving the ability to control security events and risks across the entire network;

[0047] 3. Cloud security services mainly study various security services provided to users based on cloud computing platforms, such as antivirus services.

[0048] To facilitate understanding of the technical solutions provided in the embodiments of the present application, some key terms and terms used in the embodiments of the present application are explained here:

[0049] Verification credential: also known as network request credential or ticket, etc., is the authorization information issued by the security management server for a single business access request, which is used to identify the authorization status of the network request. After intercepting the business access request, the security management client or security management server issues a verification credential for it. The network access agent carries the verification credential to initiate access to the zero trust gateway. The zero trust gateway forwards the business access request to the corresponding business server only after the verification credential corresponding to the business access request has been verified and passed on the security management server.

[0050] Zero Trust Access Control Policy: It consists of trusted applications that users can use and accessible areas that they can access. Within the trusted applications and accessible areas within the scope of the user's zero trust access policy, users can access any accessible area through any trusted application. The granularity of the zero trust access policy is the logged-in user, allowing different zero trust policies to be formulated for different logged-in users.

[0051] Zero Trust Gateway: Also known as an intelligent gateway, it is deployed at the entrance of enterprise applications and data resources and is responsible for verifying and forwarding each business access request to enterprise resources.

[0052] Access agent: An access agent is a terminal agent deployed on a controlled terminal device to initiate secure access. It is responsible for initiating requests for trusted identity authentication of the access subject. Once the identity is verified to be trustworthy, an encrypted access connection can be established with the access gateway. It is also the policy enforcement point for access control.

[0053] Access subject: In the network, the party that initiates access, the person / device / application that accesses intranet business resources, is a digital entity composed of a single person, device, application, etc. or a combination of these factors.

[0054] Access object: The party being accessed in the network, that is, the enterprise's intranet business resources, including applications, systems (development and testing environment, operation and maintenance environment, production environment, etc.), data, interfaces, functions, etc.

[0055] Business module: A collection of multiple files that complete certain specific functions. The concept of module can not only describe the product more clearly, but also more conveniently specify the content to be installed and uninstalled. For example, you can specify to install only a "threat response" module or an "application software management" module.

[0056] In the related art, in an end-to-end access scenario, for example, when two terminal devices perform service access (such as remote access) or data synchronization through a server or gateway, a security check is performed before the business modules at both ends interact with each other. For example, a business module of client 1 calls a service or data with a business module of client 2 through a server, and client 1's own security management client and server check each other with the business module, and client 2's own security management client and server check each other with the business module. However, this method is not enough to cover the security check scenario. Attackers can disguise themselves as legitimate business modules in various ways to illegally obtain data or make service calls. Therefore, the security detection capability is low, resulting in low security of data and business in the end-to-end access scenario.

[0057] To solve this problem, the embodiments of the present application preset the business logic and calling interface for runtime detection in the business modules and security management clients at both ends. The security management client of any terminal device or the server can initiate runtime security detection for both ends, thereby achieving security detection of the security management clients and business modules running on the terminal devices of the communicating parties and the communication link constructed by the server during the operation of the business modules at both ends. For example, a unified security detection is performed on the entire link of client 1-server-client 2, and corresponding processing is performed according to the security detection results. Therefore, the security detection capability can be improved to a certain extent, thereby improving the security of data and business in end-to-end access scenarios.

[0058] Furthermore, in the embodiments of the present application, when executing security checks during operation, the security management client that interacts with the business module is verified with respect to user identity and device compliance before performing security checks on the communication link. If the verification is normal, the security check on the communication link is performed again. If the verification is abnormal, the terminal device is isolated from the network, which can further enhance the security detection capability and further improve the security of data and business.

[0059] The method provided in the embodiment of the present application is used to improve the security of data access, service requests and interface calls between business modules, and is applicable to end-to-end access to resources such as interfaces, data or services (for example, terminal device 1 and terminal device 2 call each other through a server to interfaces, data or services). In the scenario where both terminal devices at both ends are installed with a security management client, the security management client in the embodiment of the present application can be a client that can provide zero-trust access security services, such as a security management client. The security management client can implement security verification before data interaction between the business modules at both ends, and specifically, the following zero-trust network security service can be used to perform security verification before data interaction.

[0060] For example, the security management client provided in the embodiment of the present application can be installed on a terminal device such as a PC or a laptop. The security management client has multiple functions such as zero-trust office, virus detection, compliance detection, vulnerability repair, etc. In terms of office security implementation protection, it has factual protection including application entry protection and system bottom layer protection, antivirus protection, and multiple terminal security reinforcement capabilities.

[0061] Optionally, the terminal device user can initiate the detection of the device environment status silently through the execution policy cycle issued by the background. The detection category, granularity and coverage scenarios are formulated by the security policy. The terminal device is responsible for executing the various detection logics contained in the policy. At the business module level, it can perform detection and protection including software security baseline detection, illegal processes and services, etc. If the detection fails, the security management client automatically executes disposal measures including forced logout, blocking access to corporate intranet resources, blocking business module business function calls, and transferring the current device network to an isolated network.

[0062] The method provided in the embodiment of the present application can be applied to the scenario where the business modules in two terminal devices are connected to the security management clients in which they are located, and interfaces, data or services are called through the server. Figure 1 A schematic diagram of an application scenario provided in an embodiment of the present application, such as Figure 1 As shown, it involves terminal device A and terminal device B, a security management client and business module 1 are installed and run on terminal device A, and a security management client and business module 2 are installed and run on terminal device B. Specifically, the method provided in the embodiment of the present application can be applied to the scenario where the business module 1 in terminal device A and the business module 2 in terminal device B are connected to their respective security management clients and interfaces, data or service calls are made through the server.

[0063] It should be noted that the application scenarios described above are only used to illustrate the embodiments of the present application and are not intended to be limiting. In specific implementation, the technical solutions provided in the embodiments of the present application can be flexibly applied according to actual needs.

[0064] Combine the following Figure 2 Describe the security management client related processing flow provided in the embodiment of the present application.

[0065] Figure 2 A schematic diagram of the processing flow of zero-trust network security services is provided, such as Figure 2 As shown, the security management client and server act as zero-trust network security service providers, and the data plane composed of zero-trust access agents and zero-trust gateways is the access subject (such as Figure 2 The users shown in the figure also include applications that access the target system or resources) and provide a unified access portal for accessing the resources of the object through the network. The security management client provides traffic monitoring and authentication operations for the unified access portal based on the access control policy. Only network traffic that passes the traffic authentication can be forwarded by the zero-trust access agent to the zero-trust gateway. The access request for internal enterprise resources is forwarded to the corresponding back-end service through the zero-trust gateway to complete the overall access process.

[0066] The data flow is composed of the access agent and zero-trust gateway of the terminal device, forming a unified policy execution point. The security management client and server jointly form a unified policy decision point. The session traffic initiated by the access subject is authenticated based on the access control policy engine, and the environmental status within the device is security tested. Through the joint action of the data flow and the control flow, explicit dynamic trust is given to specific sessions in which authenticated users in trusted devices access internal enterprise resources through trusted applications. Only through this link (or unified access portal) can resources be successfully accessed, and other untrusted traffic will fail to access.

[0067] It can be understood that in the specific implementation of the present application, related data such as user information (such as object information of client login, when the object is a user) is involved. When the method of the embodiment of the present application is applied to a specific product or technology, it is necessary to obtain user permission or consent, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0068] The technical solution of the embodiment of the present application will be described in detail below:

[0069] Figure 3 An interactive flow chart of a business data detection method provided in an embodiment of the present application, such as Figure 3 As shown, the method may include:

[0070] S101: The first client determines that a security detection trigger condition is satisfied, where the security detection is a security detection of the first service module and the second service module during operation.

[0071] The first service module and the first client are installed and run on the first terminal device, and the second service module and the second client are installed and run on the second terminal device. In this embodiment, the first service module and the second service module can be a set of multiple files that complete certain specific functions. The concept of module can not only describe the product more clearly, but also more conveniently specify the content to be installed and uninstalled. For example, it can be specified to install only a "threat response" module or an "application software management" module.

[0072] Optionally, the first business module and the second business module in this embodiment can be business modules loaded and run by the main processes of two same or different versions of the same application program. For example, in terminal device A and terminal device B, business module 1 and business module 2 are respectively loaded and run by two instances of the same software. For example, terminal device A and terminal device B both install the same software S, and the software versions in the two terminal devices may be different. For example, terminal device A installs S1, version V1, and terminal device B installs S2, version V2. V1 may be the same as or different from V2. Among them, business module 1 is loaded and run by the main process of software S1 on terminal device A, and business module 2 is loaded and run by the main process of software S2 on terminal device B. The first business module and the second business module in this embodiment can also be business modules loaded and run by one process of two different application programs, and this embodiment does not limit this. For example, business module 1 and business module 2 can also be loaded and run by application processes corresponding to different software. For example, terminal device A and terminal device B install software S and software H respectively, wherein service module 1 is loaded and run by process P1 of software S on terminal device A, and service module 2 is loaded and run by process P3 of software H on terminal device B. The clients of terminal device A and terminal device B are called client A and client B respectively.

[0073] Specifically, optionally, the first client and the second client in this embodiment can be the above-mentioned security management terminal, which can implement security verification before data interaction between the business modules at both ends, and can specifically use the above-mentioned zero-trust network security service to perform security verification before data interaction. The server can be the above-mentioned security management server.

[0074] Specifically, in the embodiment of the present application, the security detection during operation can be initiated by the server or by a terminal device at one end. There are two implementable ways to determine whether the security detection trigger condition is met in S101:

[0075] Method 1: In S101, it is determined that the safety detection trigger condition is met, which can be:

[0076] S1011. If a preset time interval is reached during the operation of the first service module and the second service module, it is determined that a security detection trigger condition is satisfied.

[0077] Specifically, before two terminal devices perform service access (such as remote access) or data synchronization through a server or gateway, if the executable file feature verification, interface parameter or credential verification of both parties is passed to allow the business modules of the two terminal devices to start data interaction, it is determined as the beginning of the security check. The time interval for runtime security detection is when the business modules of the two terminal devices stop data interaction due to security check exceptions or the end of normal business. The time interval for security detection is the time period during the operation of the above-mentioned first business module and the second business module. In this implementation, the first client initiates the security check, and periodically initiates the security check during the operation process with a preset time interval as a period. If the preset time interval is reached, it is determined that the security check trigger condition is met.

[0078] Optionally, after S1011 determines that the security detection trigger condition is met, the following may also be included:

[0079] S1012: Send a security detection request for the second service module and the second terminal device to the server.

[0080] In this manner, if the server receives a security detection request for the second service module and the second terminal device sent by the first client, the server sends a security detection request to the second client. If the second client receives the security detection request sent by the server, a similar process to S102 is performed accordingly, such as performing security detection of the first service module and the second service module during operation according to the service logic and call interface preset by the second service module and the second client, and obtaining the path of the service logic execution of the second service module during operation.

[0081] Method 2: In S101, it is determined that the safety detection trigger condition is met, which can be:

[0082] S1011′: The first client receives a security detection request sent by the server, and determines that a security detection trigger condition is met. The security detection request is sent by the server at a preset time interval during the operation of the first service module and the second service module.

[0083] In this manner, the server can send a security detection request to the first client and the second client at a preset time interval during the operation of the first business module and the second business module. In this embodiment, the server initiates the security detection, and periodically initiates the security detection during the operation with a preset time interval as a period. If the preset time interval is reached, a security detection request is sent to the first client and the second client.

[0084] S102: The first client performs security detection of the first business module and the second business module during operation according to the business logic and calling interface preset by the first business module and the first client, and obtains the execution path of the business logic of the first business module during operation.

[0085] Specifically, the business logic in this embodiment can be described by a series of codes or rules, defining how the application processes data input, performs operations and returns results. It is a core component within the application and implements specific functions by processing, controlling and organizing data. The business logic can include multiple logical nodes and interfaces for mutual invocation between logical nodes.

[0086] The business logic and calling interface preset by the first business module and the first client may include: the business logic of the first business module, the business logic of the first client, the interface for mutual calling between logical nodes in each business logic, and the interface for cross-application process calling between the first business module and the first client. Figure 4 Describe the business logic and calling interface preset by the business module and the client.

[0087] Figure 4 A schematic diagram of the business logic and calling interface of a business module 1 in a terminal device A and a security management client running in the terminal device A is provided in an embodiment of the present application, such as Figure 4 As shown, the rectangular entities E1, F1, G1, L1 and D1 represent specific logical nodes, and the arrows represent the calling interfaces (i.e., the interfaces for logical nodes to call each other). The calling interfaces can specifically include the interfaces called by the modules in the security management client, the interfaces called by the modules in the business module 1, and the interfaces called by the business module 1 and the security management client across application processes. Figure 4 The E1->E2->E3 shown in the figure indicates that E1 depends on E2 (to complete the business logic of E1, E2 needs to be called), and E2 depends on E3 (similarly, to complete the business logic shown in E2, the interface provided by E3 needs to be called). Therefore, to complete the business logic of E1, it is necessary to complete the calls of E2, E3 and the remaining logical nodes. Similarly, to complete the business logic of E2, it is necessary to complete the dependent calls of E3 and the remaining logical nodes. Figure 4 In the optional, rectangular entities D1, D2, etc. in the security management client represent the logical nodes that respectively encapsulate the security compliance detection of the security management client for the terminal device A, the identity verification of the security management client login user, etc. The logic corresponding to these logical nodes is independent of the business module, and is responsible for the common logic of device security detection, identity verification, and behavior feature collection and reporting. Different from this, Figure 4 L1, L2 and L3 shown in the figure are specific logic nodes that interact with the business module. In business module 1, there are three groups of business logic calls, namely E, F and G. Each group of business logic has chain calls, for example, F1 calls F2, and F2 calls F3, which are all interface calls within the module. Each group of business logic provides an external interface to receive calls from external modules or application processes. For example, F1 provides an external interface for third-party modules outside business module 1 to call, and F1 completes the implementation of business functions by calling F2 and F3 in sequence. In theory, the output result of F1 is used as the input of F2, and the output of F2 is used as the input of the F3 logic node, and finally the final result is formed after being processed by F3. If F2 or F3 is not called in sequence as designed, the result may not be output within the required time period, or the final result of the output may not meet expectations.

[0088] Optionally, the path of executing the business logic of the first business module during operation is obtained in S102, which may specifically be:

[0089] S1021. During the security check, collect execution process information, where the execution process information includes the identifier of the logical node passed during the security check, the execution time of the logical node, and an indication of whether the logical node call is successful.

[0090] S1022: Determine a path for executing the business logic of the first business module during operation according to the execution process information and the calling sequence of the logic nodes.

[0091] Specifically, for example, Figure 4 As for the E logic, under normal circumstances, E1, E2, E3 and the remaining business logic need to be fully executed to complete the normal E logic, and the execution result is returned to the outside by calling the interface. The lack of any node can be considered an exception. The same applies to the execution logic of F, G and the L logic of the security management client.

[0092] During the security detection process, the execution process information is collected. According to the execution process information and the calling sequence of the logical nodes, for example, Figure 4 The path of business logic execution of business module 1 during operation is E1-E2-E3-…F1-F2-F3-G1-G2-G3-…. If any node is missing from the path, it is considered abnormal.

[0093] In order to perform runtime security detection, the security management client and the business module preset the following logic: accept input parameters in a preset format, including input parameters in the form of JSON format, XML configuration or Protobuf encoding format, etc., and be able to distinguish whether it is an external module or application process that performs runtime security checks rather than normal business logic calls. In this embodiment, there are two ways to perform security detection during operation. One way is to separate the runtime security detection process from the actual business execution process, and the other way is to integrate the runtime security detection process with the actual business execution process. The following is a detailed description.

[0094] In an practicable manner, the security detection of the first service module and the second service module during operation is performed in S102, which may be specifically:

[0095] S21. If the interface call parameter carries the first parameter, a security check of the first business module and the second business module during operation is performed, and the business logic of the first business module and the second business module is not executed.

[0096] Specifically, in this method, the runtime security detection process is separated from the actual business execution process. Specifically, the callee (business module or security management client) identifies that it is a normal business logic call, for example, the interface call parameter does not carry a parameter value, and then executes the corresponding business logic; if the interface call parameter carries the first parameter, it is identified that the external module or application process is performing a security check, and the specific business logic is not executed. Instead, the execution result of the logical node simulation call and the intermediate process of the execution are returned to the caller.

[0097] For example, Figure 4 The L1 logical node represents the process in which the security management client receives a request from the business module for an access ticket (i.e., a zero-trust network access process), L2 represents the process in which the security management client parses the request parameters and obtains the corresponding feature information of the business module executable file, and L3 represents the process in which the security management client applies for a ticket from the server. If L1 receives an input parameter (such as the first parameter) indicating the execution of a runtime security check, the L2 logical node returns the default value of the executable file-related features, and does not actually perform the actual collection of the executable file features. L3 then initiates a ticket application process to the server, but a field in the request parameter indicates that it is a security check request, not the actual ticket application logic. Correspondingly, the server returns the default result of the ticket response, and does not actually perform the request parameter verification, permission verification, ticket generation and response process, but instead responds to the security management client with the preset default value.

[0098] S22: If the interface call parameter carries the second parameter, while executing the business logic of the first business module and the second business module, perform security detection of the first business module and the second business module during operation.

[0099] Specifically, in this method, the runtime security detection process is integrated with the actual business execution process. Specifically, when the callee (such as a business module or a security management client) recognizes that it is a business logic call, for example, if the interface call parameter does not carry a parameter value, the corresponding normal business logic is executed and the execution result is returned to the caller; if the interface call parameter carries a second parameter, it can be identified as a business logic call that takes security detection into consideration. While executing the specific business logic, the execution process information of each intermediate logic node actually executed is returned to the caller in the response result. The execution process information includes the identification of the logic node passed during the security detection process, the execution time of the logic node, and an indication of whether the logic node call is successful.

[0100] For example, Figure 4 The L1 logical node represents the process in which the security management client receives a request from the business module for an access ticket (i.e., a zero-trust network access process), L2 represents the process in which the security management client parses the request parameters and obtains the corresponding feature information of the business module executable file, and L3 represents the process in which the security management client applies for a ticket from the server. If L1 receives an input parameter (such as the second parameter) that indicates the execution of runtime security verification, L2 and L3 will perform the actual collection of executable file features and the logic of normal ticket application, and will also return the execution process information actually executed by the intermediate logical node to the caller accordingly. The execution process information includes, for example, the logical node identifier through which the intermediate result is executed (a descriptive content of which logical node has been passed, based on which the caller knows whether the corresponding business module has been actually called), an indication of whether the call is successful, time-consuming parameters, etc., which are returned to the caller step by step. The caller not only receives the execution result of the normal business logic, but also receives the execution process information of the intermediate execution process. The execution process information can be a standardized description, for example, a standardized description method agreed upon by the business module, the security management client, and the server.

[0101] Optionally, in an implementable manner, the business logic of the first client includes business logic for interacting with the first business module and business logic for performing device security detection. The business logic for performing device security detection is, for example, Figure 4 D logic in, accordingly, in the embodiment of the present application, before obtaining the execution path of the business logic of the first business module during operation in S102, it may also include:

[0102] S107. Perform target detection according to the business logic of the first client for performing device security detection, and determine that the target detection is normal, where the target detection includes at least one of a first detection, a second detection, and a third detection;

[0103] Among them, the first detection is: to detect whether the first terminal device and the second terminal device are abnormal; the second detection is: to perform security verification on the usage object information of the first terminal device and the usage object information of the second terminal device; the third detection is: to compare and analyze the behavioral characteristics of the login object of the first client and the network traffic of the first client, as well as the behavioral characteristics of the login object of the second client and the network traffic of the second client.

[0104] Optionally, in S107, target detection is performed according to the service logic of the first client for performing device security detection, which may be:

[0105] S1071. During the time period when the first business module and the second business module are running, if it is determined that the target detection trigger condition is met, the business logic of the first client for performing device security detection is executed, and a detection request is sent to the server so that the server instructs the second client to execute the business logic of the second client for performing device security detection to complete the target detection.

[0106] Optionally, the business logic for performing device security detection of the first client is executed in S1071, which may specifically be:

[0107] S10711. The first client obtains first target information, and the first target information includes at least one of the current operating environment status information and compliance detection results of the first terminal device, the object information logged in by the first client, the operating status information of the first client, the behavioral characteristics of the login object of the first client, and the network traffic information of the first client.

[0108] S10712. The first client sends a detection request to the server. The detection request carries first target information. The detection request is used to instruct the server to send a detection request to the second client, and after receiving the second target information sent by the second client, complete target detection according to the first target information and the second target information.

[0109] Specifically, the second target information includes at least one of the current operating environment status information and compliance detection results of the second terminal device, the object information logged in by the second client and the operating status information of the second client, the behavioral characteristics of the login object of the second client and the network traffic information of the second client.

[0110] The server completes the target detection according to the first target information and the second target information, which may be specifically: the server performs the target detection according to the first target information and the second target information, and the target detection includes at least one of the first detection and the second detection;

[0111] The first detection is to detect whether the first terminal device and the second terminal device are abnormal; the second detection is to perform security verification on the usage object information of the first terminal device and the usage object information of the second terminal device; the third detection is to compare and analyze the behavioral characteristics of the login object of the first client and the network traffic of the first client, as well as the behavioral characteristics of the login object of the second client and the network traffic of the second client.

[0112] Specifically, the third detection can be specifically a comparative analysis of the behavior characteristics of the login object of the first client and the network traffic of the first client, as well as the behavior characteristics of the login object of the second client and the network traffic of the second client. The behavior characteristics of the login object can use user and entity behavior analytics (UEBA), and the network traffic can specifically use network traffic statistical analysis. Taking the first client as an example, the second client is similar. The comparative analysis of the behavior characteristics of the login object of the first client can be based on the behavior characteristics of the current login object of the first client and the behavior characteristics of the same login object in history. If it is determined that there is an abnormality, the comparative analysis result is determined to be abnormal. The comparative analysis of the network traffic of the first client can be specifically based on the detection of whether there is abnormal traffic based on the network traffic of the first client. If there is abnormal traffic, it is determined that the network traffic comparative analysis is abnormal. Through the third detection, the security detection capability in the end-to-end access scenario can be further improved.

[0113] In an implementable manner, the server performs target detection according to the first target information and the second target information, which may be:

[0114] S31. When the first business module and the second business module start to interact with each other, the server obtains the interaction mapping information between the first business module and the second business module, and the interaction mapping information includes: the current running environment status information and compliance detection results of the first terminal device, the object information logged in by the first client and at least one of the running status information of the first client, and the current running environment status information and compliance detection results of the second terminal device, the object information logged in by the second client and at least one of the running status information of the second client.

[0115] S32. The server performs target detection according to the first target information, the second target information, the first business module and the interaction mapping information.

[0116] Specifically, the server performs target detection based on the first target information, the second target information, and the first business module and the interactive mapping information. The target detection includes the first detection and the second detection, that is, the verification is performed based on the interactive mapping information obtained when the first business module and the second business module start to interact with each other, and the first target information and the second target information obtained during the operation. The target detection can be performed based on the preset device security status and the minimum security standard required for the login user identity. If it is below this standard, the device is considered to be abnormal. For example, the security management clients at both ends are required to be in the login state, and the device compliance detection results are required to reach the compliance level, otherwise the device is considered to be in an abnormal state. Target detection can also include a third detection. The third detection can be described in detail above and will not be repeated here.

[0117] For example, it can be a verification of the object information of the client login (to see whether the two are consistent) and basic security checks such as whether the device is compliant, so as to determine whether the terminal devices at both ends meet the compliance test and whether the login users of the clients at both ends are consistent. For example, in the interactive mapping information, user Usr1 of terminal device A establishes an association with user Usr2 of terminal device B. During runtime, it is detected that the current user is Usr3 of terminal device A, which is different from the mapping relationship when the association is established, and it is determined to be an abnormal state.

[0118] Furthermore, in an implementable manner, the method of this embodiment may further include:

[0119] S108: If the server determines that the target detection is abnormal, the server performs network isolation on the first terminal device or the second terminal device.

[0120] Specifically, if the server determines that the target detection is abnormal, it will perform network isolation on the first terminal device or the second terminal device. The first terminal device or the second terminal device can be transferred to an isolation network, so that the terminal device transferred to the isolation network is isolated from other devices in the enterprise network. At the same time, it can also send an alarm message to the client, which will display the alarm message.

[0121] In this embodiment, when executing security checks during operation, the security management client that interacts with the business module is verified for user identity and device compliance before performing security checks on the communication link. If the verification is normal, the security check of the communication link is performed again. If the verification is abnormal, the terminal device is isolated from the network. This can further enhance the security detection capability and further improve the security of data and business.

[0122] S103: The first client sends the execution path of the business logic of the first business module during operation to the server.

[0123] S104: The second client sends the execution path of the business logic of the second business module during operation to the server.

[0124] S105. The server performs a path integrity check based on the path of the business logic execution of the first business module during operation, the path of the business logic execution of the second business module during operation, the preset path of the business logic execution of the first business module, and the preset path of the business logic execution of the second business module to obtain a security detection result.

[0125] Specifically, the server performs a path integrity check based on the path of the business logic execution of the first business module during operation, the path of the business logic execution of the second business module during operation, the preset path of the business logic execution of the first business module, and the preset path of the business logic execution of the second business module. The path integrity check can be performed on the path of the business logic execution of the first business module during operation and the preset path of the business logic execution of the first business module, and the path integrity check can be performed on the path of the business logic execution of the second business module during operation and the preset path of the business logic execution of the second business module to obtain a security detection result. Among them, the path integrity check can be to check whether the logical nodes passed by the path and the calling order are the same.

[0126] Optionally, as an implementable manner, S105 may specifically be:

[0127] S1051. The server matches the logical nodes and call paths of the business logic execution path of the first business module during operation and the preset business logic execution path of the first business module in a preset manner to obtain a first detection result.

[0128] Optionally, the above preset method can be: matching all logical nodes in the path of business logic execution; or, matching all logical nodes and the calling path in the path of business logic execution; or, matching preset logical nodes in the path of business logic execution; or, matching preset logical nodes in the path of business logic execution and the calling path of the preset logical nodes.

[0129] Optionally, multiple consecutive cycles may be selected to match all logical nodes, or multiple consecutive cycles may be selected to match some preset logical nodes, where the preset logical nodes may be logical nodes of key business logic, instead of all matching, which can improve the efficiency of security detection.

[0130] For example, for Figure 4The L logic of the security management client in the business module, as well as the logical nodes E, F and G of the business module that directly participate in the business logic, can be periodically actively initiated by the server or the security management client on one end to verify. You can choose to cover several groups of logic each time, and cover all logical nodes and interfaces for several consecutive cycles; you can also cover all logical nodes or interfaces each time. Each data can be sent to the server. When matching logical nodes, if all logical nodes in the path of the business logic execution of the preset business module can be covered, the integrity of the business logic execution is met, and the security detection result is normal. If some of the logical nodes in the path of the business logic execution of the preset business module are not covered, the security detection result is abnormal. Optionally, based on the results of multiple verifications, if some key business logic nodes are not covered, and the statistical ratio of abnormalities exceeds the set value, the security detection result is determined to be abnormal. For example, for Figure 4 In the logic F1, F2 and F3, if F2 and F3 are not covered in multiple consecutive security detection processes, the abnormality rate reaches 100%, exceeding the set benchmark value of 25%, then the security detection result is considered abnormal and the business module may be maliciously attacked or destroyed.

[0131] S1052. The server matches the logical nodes and call paths of the business logic execution path of the second business module during operation with the preset business logic execution path of the second business module in a preset manner to obtain a second detection result.

[0132] The verification of the execution path of the business logic of the second business module is the same as the verification of the execution path of the business logic of the first business module, which will not be repeated here.

[0133] S1053. The server obtains a security detection result based on the first detection result and the second detection result.

[0134] Specifically, the server obtains a security detection result based on the first detection result and the second detection result, and can determine that the security detection result is normal when the first detection result and the second detection result are both normal, and determine that the security detection result is abnormal when either the first detection result or the second detection result is abnormal.

[0135] S106: The server sends the security detection result to the first client and the second client.

[0136] Furthermore, in an practicable manner, after S106, the method of this embodiment may further include:

[0137] S109: The first client controls the operating state of the first service module according to the security detection result.

[0138] Correspondingly, the second client may control the operation state of the second service module according to the security detection result. For example, if the security detection result is abnormal, the operation of the second service module is terminated.

[0139] The business data detection method provided in this embodiment is that when the first client determines that the security detection trigger condition is met, according to the business logic and call interface preset by the first business module and the first client, the security detection of the first business module and the second business module during operation is performed, and the path of the business logic execution of the first business module during operation is obtained, and then the path of the business logic execution of the first business module during operation is sent to the server. The server performs a path integrity check according to the path of the business logic execution of the first business module during operation, the path of the business logic execution of the second business module during operation sent by the second client, the preset path of the business logic execution of the first business module, and the preset path of the business logic execution of the second business module, obtains the security detection result and sends it to the first client. By presetting the business logic and call interface for runtime detection in the business modules at both ends and the clients at both ends, the client of any terminal device can initiate the runtime security detection of the other end or the server can initiate the runtime security detection for both ends, so as to realize the security detection of the client and business module running on the terminal devices of the two communicating parties and the communication link constructed by the server during the operation of the business modules at both ends, so that the security detection capability can be improved to a certain extent, thereby improving the security of data and business in the end-to-end access scenario.

[0140] Combine the following Figure 5 , using a specific implementation example, taking a business scenario of cloud desktop access as an example, involving end-to-end resource access, specifically taking cloud desktop remote access initiated by two terminal devices as an example, the specific process of the business data detection method provided by the embodiment of the present application and the technical effect achieved are described in detail.

[0141] Cloud desktop remote access involves cloud desktop streaming components and cloud desktop streaming components. These two components need to be applied in a cloud desktop access business scenario (for example, through full-link hardware acceleration, GPU-based desktop capture and H.265 hardware encoding and decoding solutions, real-time transmission based on WebRTC, reducing operation latency, and improving remote accessibility and access experience). Both components belong to client components and processes. The streaming component is installed on the terminal device that initiates the remote desktop request, while the streaming component is installed on the terminal device that receives the remote desktop request (called the target device). The cloud desktop streaming component is responsible for initiating a connection request to the remote desktop. After the connection is successful, a full-screen window is created locally to display the content of the remote desktop. At the same time, menu items are displayed at the top of the full-screen window to provide basic configuration or remote desktop-related operations. The cloud desktop streaming component is a service component running on the connected target system and runs in the background as a system resident service. Its main responsibility is to capture the desktop image of the target system at a fixed frequency and encode and stream it in real time. The corresponding client streams, decodes, and renders it to the local window. The cloud desktop streaming component needs to process the client's keyboard and mouse events in real time, and process the client's camera and microphone devices in the form of virtual devices. The cloud desktop streaming component also includes functions such as clipboard and file system mounting.

[0142] In the scenario where terminal device A and terminal device B are interacting with each other, a security management client is installed in both terminal devices, and the business module includes cloud desktop remote components at both ends, namely, cloud desktop push streaming component and cloud desktop pull streaming component. Before the cloud pull streaming business module executes the pull streaming, the interface triggers the notification of the security management client to obtain the access ticket for accessing the remote desktop of the target device from the security management server. The security management client passes the access ticket as a key parameter to the cloud pull streaming business module, and when the cloud pull streaming business module pulls the stream, it takes it to a third-party content distribution network (Content Delivery Network, CDN). The CDN parses the request, obtains the access ticket, and initiates the access ticket verification to the security management server. After the verification passes, the pull streaming is allowed.

[0143] On the target device, before the security management client calls up the cloud desktop streaming component to execute streaming, it obtains the access ticket for the local remote desktop from the security management server. The security management client passes the access ticket as a key parameter to the cloud desktop streaming component (business module), and brings it to the CDN when the cloud desktop streaming component executes the streaming operation (a business field can be added to the body of https to store this ticket). The CDN parses the request, obtains the credentials, and initiates an access ticket verification to the security management server. Only after the verification passes, is streaming allowed.

[0144] In the prior art, after the security management server completes the ticket verification, it allows the business module to perform the push flow action on the remote target device and initiates the pull flow operation on the remote terminal device. Or for efficiency, it is necessary to allow the push and pull flow first, and place the access ticket verification operation in asynchronous execution. If the ticket asynchronous verification fails, the push flow or pull flow is asynchronously interrupted. The prior art solves the problem of whether the business module starts to push or pull the flow through local authentication or remote authentication, but the access process has the risk of data leakage or illegal business access. For example, a malicious attacker forges a pull flow component, obtains the desktop image of the target device by illegal means, or performs remote operations on the target device to steal data, causing serious problems such as enterprise data leakage. To solve this problem, the embodiment of the present application performs device and user identity detection on the security management client at both ends, and performs multiple verifications on the interaction logic between the security management client and the pull flow component and the push flow component, as well as the internal logic execution logic nodes of the push and pull flow components in the devices at both ends, thereby improving the security detection capability to a certain extent, thereby improving the security of end-to-end access data and services. The following describes the specific process of the method for business data detection provided by the embodiment of the present application.

[0145] The security detection method provided in the embodiment of the present application can be applied to the scenario where the terminal device A and the terminal device B are performing data interaction at both ends, wherein the terminal device A and the terminal device B are both installed with a security management client, and the business module 1 and the business module 2 are installed and run in the terminal device A and the terminal device B respectively. The security management clients in the terminal device A and the terminal device B both maintain a periodic heartbeat with the security management server (which can be composed of various nodes and clustered). The security management server can sense whether the security management client is installed on the specified terminal based on the heartbeat, and whether the security management client is running normally. Optionally, the security management server can be composed of various nodes and clustered.

[0146] Figure 5 This is an interactive flow chart of a business data detection method provided in an embodiment of the present application. In this embodiment, a security management client at any end triggers a runtime security check as an example. Figure 5 As shown, the method may include:

[0147] S201. The first security management client determines that a security detection trigger condition is satisfied, where the security detection is a security detection of the first business module and the second business module during operation.

[0148] Specifically, S201 may specifically be: within a time period during which the first service module and the second service module are running, the first security management client determines that if a preset time interval is reached, then it is determined that the security detection trigger condition is satisfied.

[0149] S202. The first security management client obtains first target information, and the first target information includes at least one of the current running environment status information and compliance detection results of the first terminal device, the object information logged in by the first client, the running status information of the first client, the behavior characteristics of the login object of the first client, and the network traffic information of the first client.

[0150] S203: The first security management client sends a detection request to the security management server, where the detection request carries first target information.

[0151] S204: The security management server sends a detection request to the second client.

[0152] S205. The second security management client obtains second target information, which includes at least one of the current operating environment status information and compliance detection results of the second terminal device, the object information logged in by the second client and the operating status information of the second client, the behavioral characteristics of the login object of the second client and the network traffic information of the second client.

[0153] S206. The second client sends second target information to the security management server.

[0154] Optionally, if after S204, the security management server does not receive the second target information sent by the second security management client within a preset time, the security management server determines that a detection abnormality has been detected and may perform network isolation on the first terminal device or the second terminal device, such as by transferring the first terminal device or the second terminal device to an isolation network so that the terminal device transferred to the isolation network is isolated from other devices in the enterprise network. At the same time, an alarm message may be sent to the first security management client and the second security management client, and the two security management clients may display the alarm message respectively.

[0155] S207: The security management server performs target detection according to the first target information and the second target information.

[0156] Wherein, the target detection includes at least one of a first detection, a second detection and a third detection;

[0157] The first detection is to detect whether the first terminal device and the second terminal device are abnormal; the second detection is to perform security verification on the usage object information of the first terminal device and the usage object information of the second terminal device; the third detection is to compare and analyze the behavioral characteristics of the login object of the first client and the network traffic of the first client, as well as the behavioral characteristics of the login object of the second client and the network traffic of the second client.

[0158] In an implementable manner, the security management server performs target detection based on the first target information and the second target information. For details, please refer to the description of S31-S32 in the above embodiment, which will not be repeated here.

[0159] S208: The security management server determines that the target detection is normal, and sends indication information that the target detection is normal to the first security management client and the second security client.

[0160] If the security management server determines that the target detection is abnormal, the first terminal device or the second terminal device can be isolated from the network by transferring the first terminal device or the second terminal device to an isolation network so that the terminal device transferred to the isolation network is isolated from other devices in the enterprise network. At the same time, an alarm message can be sent to the first security management client and the second security management client, and the two security management clients will display the alarm message respectively.

[0161] S209. The first security management client performs security checks on the first business module and the second business module during operation according to the business logic and calling interface preset by the first business module and the first security management client, and obtains the execution path of the business logic of the first business module during operation.

[0162] S210. The second security management client performs security checks on the first business module and the second business module during operation according to the business logic and calling interface preset by the first business module and the second security management client, and obtains the execution path of the business logic of the second business module during operation.

[0163] S211. The first security management client sends the path of the business logic execution of the first business module during operation to the security management server.

[0164] S212: The second security management client sends the path of the business logic execution of the second business module during operation to the security management server.

[0165] S213. The security management server performs a path integrity check based on the path of business logic execution of the first business module during operation, the path of business logic execution of the second business module during operation, the preset path of business logic execution of the first business module, and the preset path of business logic execution of the second business module to obtain a security detection result.

[0166] Specifically, the specific process of S209-S213 can be found in Figure 5 The description in the illustrated embodiment will not be repeated here.

[0167] S214: The security management server sends the security detection result to the first client and the second client.

[0168] S215. The first security management client controls the operating state of the first business module according to the security detection result.

[0169] S216. The second security management client controls the operating state of the second service module according to the security detection result.

[0170] Specifically, if the security detection result is abnormal, the first security management client terminates the operation of the first service module, and the second security management client terminates the operation of the second service module. If the security detection result is normal, the two service modules operate normally.

[0171] Optionally, after S213, if the security detection result is abnormal, the security management server may initiate the termination of the two service modules, specifically by sending instruction information to the two security management clients, the instruction information being used to instruct the termination of the two service modules.

[0172] Optionally, in another embodiment, the runtime security check may be triggered by the server. The specific process is similar and will not be described again here.

[0173] The business data detection method provided in this embodiment is that the clients running on the two terminal devices are security management clients. The security management clients at both ends can perform security checks before the business modules at both ends interact with data. When performing security checks during operation, the security management clients interacting with the business modules are checked for user identity and device compliance before performing security checks on the communication link. When the check is normal, the security check on the communication link is performed again. When the check is abnormal, the terminal device is isolated from the network. Specifically, when performing security checks on the communication link, by presetting the business logic and call interface for runtime detection on the business modules and security management clients at both ends, the security management client of any terminal device can initiate runtime security checks on the other end or the server can initiate runtime security checks on both ends, thereby achieving security checks on the security management clients and business modules running on the terminal devices of both communicating parties and the communication link constructed by the server during the operation of the business modules at both ends, thereby improving the security detection capability and improving the security of data and services in end-to-end access scenarios.

[0174] Figure 6 A schematic diagram of a business data detection device provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, the device may include: a determination module 11, a processing module 12, a sending module 13 and a receiving module 14.

[0175] The determination module 11 is used to determine whether the security detection trigger condition is met, and the security detection is a security detection of the first business module and the second business module during operation, the first business module and the first client are running on the first terminal device, and the second business module and the second client are running on the second terminal device;

[0176] The processing module 12 is used to perform security detection of the first business module and the second business module during operation according to the business logic and calling interface preset by the first business module and the first client, and obtain the execution path of the business logic of the first business module during operation;

[0177] The sending module 13 is used to send the execution path of the business logic of the first business module during operation to the server;

[0178] The receiving module 14 is used to receive the security detection results sent by the server. The security detection results are obtained by performing a path integrity check on the server based on the path of business logic execution of the first business module during operation, the path of business logic execution of the second business module during operation, the preset path of business logic execution of the first business module, and the preset path of business logic execution of the second business module.

[0179] In one embodiment, the processing module 12 is used to: collect execution process information during the execution of the security detection process, the execution process information including the identification of the logical nodes passed during the execution of the security detection process, the execution time of the logical nodes, and an indication of whether the logical node call is successful;

[0180] According to the execution process information and the calling sequence of the logic nodes, a path for the execution of the service logic of the first service module during operation is determined.

[0181] In one embodiment, the processing module 12 is used to: if the interface call parameter carries the first parameter, perform security detection of the first business module and the second business module during operation, and do not execute the business logic of the first business module and the second business module;

[0182] If the interface call parameter carries the second parameter, then while executing the business logic of the first business module and the second business module, security detection of the first business module and the second business module during operation is performed.

[0183] In one embodiment, the business logic and calling interface preset by the first business module and the first client include: the business logic of the first business module, the business logic of the first client, the interface for mutual calling between logical nodes in each business logic, and the interface for cross-application process calling between the first business module and the first client.

[0184] In one embodiment, the business logic of the first client includes business logic interacting with the first business module and business logic for performing device security detection, and the processing module 12 is further used to:

[0185] Before obtaining the execution path of the business logic of the first business module during operation, perform target detection according to the business logic of the first client for device security detection to determine that the target detection is normal, and the target detection includes at least one of the first detection, the second detection and the third detection;

[0186] The first detection is: detecting whether the first terminal device and the second terminal device are abnormal;

[0187] The second detection is: performing security verification on the user information of the first terminal device and the user information of the second terminal device;

[0188] The third detection is: comparing and analyzing the behavior characteristics of the login object of the first client and the network traffic of the first client, and the behavior characteristics of the login object of the second client and the network traffic of the second client.

[0189] In one embodiment, the processing module 12 is used to:

[0190] During the time period when the first business module and the second business module are running, if it is determined that the target detection trigger condition is met, the business logic of the first client for performing device security detection is executed, and a detection request is sent to the server so that the server instructs the second client to execute the business logic of the second client for performing device security detection to complete the target detection.

[0191] In one embodiment, the processing module 12 is used to:

[0192] Acquire first target information, where the first target information includes at least one of the current operating environment status information and compliance detection result of the first terminal device, the object information logged in by the first client and the operating status information of the first client, the behavior characteristics of the login object of the first client, and the network traffic information of the first client;

[0193] The sending module 13 is also used to: send a detection request to the server, the detection request carries the first target information, the detection request is used to instruct the server to send a detection request to the second client, and after receiving the second target information sent by the second client, complete the target detection according to the first target information and the second target information.

[0194] In one embodiment, the determination module 11 is used to determine that the security detection trigger condition is satisfied if a preset time interval is reached during the time period when the first service module and the second service module are running.

[0195] In one embodiment, the sending module 13 is further used to send a security detection request for the second service module and the second terminal device to the server.

[0196] In one embodiment, the determination module 11 is used to: when the receiving module 14 receives a security detection request sent by the server, determine that the security detection trigger condition is met, and the security detection request is sent by the server at a preset time interval during the operation of the first business module and the second business module.

[0197] In one embodiment, the processing module 12 is further configured to: control the operation state of the first service module according to the security detection result.

[0198] Figure 7 A schematic diagram of a business data detection device provided in an embodiment of the present application is shown in FIG. Figure 7 As shown, the device may include: a receiving module 21, a processing module 22 and a sending module 23.

[0199] The receiving module 21 is used to receive the path of the business logic execution of the first business module during operation sent by the first client, the first business module and the first client are running on the first terminal device, wherein the path of the business logic execution of the first business module during operation is obtained when the first client performs security detection of the first business module and the second business module during operation according to the business logic and calling interface preset by the first business module and the first client;

[0200] The receiving module 21 is further used to: receive a path of the business logic execution of the second business module during operation sent by the second client, the second business module and the second client running on the second terminal device, wherein the path of the business logic execution of the second business module during operation is obtained when the second client performs security detection of the first business module and the second business module during operation according to the business logic and calling interface preset by the second business module and the second client;

[0201] The processing module 22 is used to perform a path integrity check according to the path of the business logic execution of the first business module during operation, the path of the business logic execution of the second business module during operation, the preset path of the business logic execution of the first business module, and the preset path of the business logic execution of the second business module to obtain a security detection result;

[0202] The sending module 23 is used to send the security detection result to the first client and the second client.

[0203] In one embodiment, the processing module 22 is used to: match the path of the business logic execution of the first business module during operation with the preset path of the business logic execution of the first business module in terms of logical nodes and call paths in a preset manner to obtain a first detection result;

[0204] According to a preset manner, the path of the business logic execution of the second business module during operation and the preset path of the business logic execution of the second business module are matched in terms of logical nodes and call paths to obtain a second detection result;

[0205] A safety detection result is obtained according to the first detection result and the second detection result.

[0206] In one embodiment, the preset method is: matching all logic nodes in the path of business logic execution; or,

[0207] Match all logic nodes and call paths in the execution path of the business logic; or,

[0208] Matching the preset logic nodes in the path of business logic execution; or,

[0209] The preset logic nodes in the execution path of the business logic are matched with the calling paths of the preset logic nodes.

[0210] In one embodiment, the receiving module 21 is further used to: receive a detection request sent by the first client, the detection request carries first target information, the first target information includes at least one of the current running environment status information and compliance detection result of the first terminal device, the object information logged in by the first client and the running status information of the first client, the behavior characteristics of the login object of the first client and the network traffic information of the first client;

[0211] The sending module 23 is further used to: send a detection request to the second client;

[0212] The receiving module 21 is further used to: receive second target information sent by the second client, the second target information including at least one of the environment status information and compliance detection result of the current operation of the second terminal device, the object information logged in by the second client and the operation status information of the second client, the behavior characteristics of the login object of the second client and the network traffic information of the second client;

[0213] The processing module 22 is further used to: perform target detection according to the first target information and the second target information, where the target detection includes at least one of the first detection, the second detection and the third detection;

[0214] The first detection is to detect whether the first terminal device and the second terminal device are abnormal; the second detection is to perform security verification on the usage object information of the first terminal device and the usage object information of the second terminal device; the third detection is to compare and analyze the behavioral characteristics of the login object of the first client and the network traffic of the first client, as well as the behavioral characteristics of the login object of the second client and the network traffic of the second client.

[0215] In one embodiment, the processing module 22 is further configured to: if it is determined that the target detection is abnormal, perform network isolation on the first terminal device or the second terminal device.

[0216] In one embodiment, the processing module 22 is further used to: when the first business module and the second business module start to interact with each other, obtain interaction mapping information between the first business module and the second business module, the interaction mapping information including: at least one of the current running environment status information and compliance detection result of the first terminal device, the object information logged in by the first client, and the running status information of the first client, and at least one of the current running environment status information and compliance detection result of the second terminal device, the object information logged in by the second client, and the running status information of the second client;

[0217] The processing module 22 is specifically used to perform target detection according to the first target information, the second target information and the first business module and the interactive mapping information.

[0218] In one embodiment, the sending module 23 is further used to send a security detection request to the first client and the second client at a preset time interval during the operation of the first service module and the second service module.

[0219] In one embodiment, the receiving module 21 is further used to: receive a security detection request for the second service module and the second terminal device sent by the first client;

[0220] The sending module 23 is further used to send a security detection request to the second client.

[0221] It should be understood that the device embodiment and the method embodiment may correspond to each other, and similar descriptions may refer to the method embodiment. To avoid repetition, they will not be described here. Specifically, Figure 6 The service data detection device shown can execute the method embodiment corresponding to the terminal device. Figure 7 The business data detection device shown can execute the method embodiment corresponding to the server, and the aforementioned and other operations and / or functions of each module in the device are respectively for implementing the method embodiment corresponding to the terminal device or the server, which will not be repeated here for the sake of brevity.

[0222] The above describes the service data detection device of the embodiment of the present application from the perspective of the functional module in conjunction with the accompanying drawings. It should be understood that the functional module can be implemented in hardware form, can be implemented by instructions in software form, and can also be implemented by a combination of hardware and software modules. Specifically, the steps of the method embodiment in the embodiment of the present application can be completed by the hardware integrated logic circuit and / or software form instructions in the processor, and the steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or a combination of hardware and software modules in the decoding processor to perform. Optionally, the software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory, and completes the steps in the above method embodiment in conjunction with its hardware.

[0223] Figure 8 3 is a schematic block diagram of a service data detection device 300 provided in an embodiment of the present application. The service data detection device may be a terminal device or a server.

[0224] like Figure 8 As shown, the service data detection device 300 may include:

[0225] The memory 310 and the processor 320, the memory 310 is used to store the computer program and transmit the program code to the processor 320. In other words, the processor 320 can call and run the computer program from the memory 310 to implement the method in the embodiment of the present application.

[0226] For example, the processor 320 may be configured to execute the above method embodiments according to instructions in the computer program.

[0227] In some embodiments of the present application, the processor 320 may include but is not limited to:

[0228] General-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc.

[0229] In some embodiments of the present application, the memory 310 includes but is not limited to:

[0230] Volatile memory and / or non-volatile memory. Among them, the non-volatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM) or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus random access memory (DR RAM).

[0231] In some embodiments of the present application, the computer program may be divided into one or more modules, which are stored in the memory 310 and executed by the processor 320 to complete the method provided by the present application. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the electronic device.

[0232] like Figure 8 As shown, the service data detection device may also include:

[0233] The transceiver 330 may be connected to the processor 320 or the memory 310 .

[0234] The processor 320 may control the transceiver 330 to communicate with other devices, specifically, to send information or data to other devices, or to receive information or data sent by other devices. The transceiver 330 may include a transmitter and a receiver. The transceiver 330 may further include an antenna, and the number of antennas may be one or more.

[0235] It should be understood that the various components in the electronic device are connected via a bus system, wherein the bus system includes not only a data bus but also a power bus, a control bus and a status signal bus.

[0236] The embodiment of the present application also provides a computer storage medium on which a computer program is stored, and when the computer program is executed by a computer, the computer can perform the method of the above method embodiment. In other words, the embodiment of the present application also provides a computer program product containing instructions, and when the instructions are executed by a computer, the computer can perform the method of the above method embodiment.

[0237] When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (digital video disc, DVD)), or a semiconductor medium (e.g., a solid state drive (solid state disk, SSD)), etc.

[0238] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.

[0239] In the several embodiments provided in the embodiments of the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the module is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0240] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. For example, each functional module in each embodiment of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0241] The above contents are only specific implementation methods of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or replacements within the technical scope disclosed in the embodiments of the present application, which should be included in the protection scope of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application should be based on the protection scope of the claims.

Claims

1. A business data detection method, characterized in that: The method is applied to a first client, and the method includes: Determining that a security detection trigger condition is met, the security detection being a security detection of a first service module and a second service module during operation, the first service module and the first client running on a first terminal device, and the second service module and the second client running on a second terminal device; According to the business logic and calling interface preset by the first business module and the first client, perform security detection of the first business module and the second business module during operation, and obtain the execution path of the business logic of the first business module during operation; Sending the execution path of the business logic of the first business module during operation to the server; Receive a security check result sent by the server, where the security check result is obtained by performing a path integrity check based on the path of business logic execution of the first business module during operation, the path of business logic execution of the second business module during operation, a preset path of business logic execution of the first business module, and a preset path of business logic execution of the second business module.

2. The method according to claim 1, characterized in that The obtaining of the execution path of the business logic of the first business module during operation includes: During the execution of the security check, collecting execution process information, the execution process information including the identification of the logical nodes passed during the execution of the security check, the execution time of the logical nodes, and an indication of whether the logical node call is successful; The execution path of the service logic of the first service module during operation is determined according to the execution process information and the calling sequence of the logic nodes.

3. The method according to claim 1, characterized in that The performing of the security detection of the first service module and the second service module during operation includes: If the interface call parameter carries the first parameter, the security check of the first business module and the second business module during operation is performed, and the business logic of the first business module and the second business module is not executed; If the interface call parameter carries the second parameter, then while executing the business logic of the first business module and the second business module, security detection of the first business module and the second business module during operation is performed.

4. The method according to claim 1, characterized in that: The business logic and calling interface preset by the first business module and the first client include: the business logic of the first business module, the business logic of the first client, the interface for mutual calling between logical nodes in each business logic, and the interface for cross-application process calling between the first business module and the first client.

5. The method according to claim 4, characterized in that The business logic of the first client includes business logic interacting with the first business module and business logic for performing device security detection. Before obtaining the execution path of the business logic of the first business module during operation, the method further includes: Perform target detection according to the business logic of the first client for performing device security detection, and determine that the target detection is normal, wherein the target detection includes at least one of a first detection, a second detection, and a third detection; The first detection is: detecting whether the first terminal device and the second terminal device are abnormal; The second detection is: performing security verification on the user information of the first terminal device and the user information of the second terminal device; The third detection is: comparing and analyzing the behavior characteristics of the login object of the first client and the network traffic of the first client, and the behavior characteristics of the login object of the second client and the network traffic of the second client.

6. The method according to claim 5, characterized in that The performing target detection according to the service logic for performing device security detection of the first client includes: During the time period when the first business module and the second business module are running, if it is determined that the target detection trigger condition is met, the business logic of the first client for performing device security detection is executed, and a detection request is sent to the server so that the server instructs the second client to execute the business logic of the second client for performing device security detection to complete the target detection.

7. The method according to claim 6, characterized in that The executing the business logic of the first client for performing device security detection includes: Acquire first target information, where the first target information includes at least one of the environment status information and compliance detection result of the current operation of the first terminal device, the object information logged in by the first client, the operation status information of the first client, the behavior characteristics of the login object of the first client, and the network traffic information of the first client; A detection request is sent to the server, wherein the detection request carries the first target information, and the detection request is used to instruct the server to send a detection request to the second client, and after receiving the second target information sent by the second client, complete target detection according to the first target information and the second target information.

8. The method according to claim 1, characterized in that: The determining that the safety detection trigger condition is satisfied includes: During the time period when the first service module and the second service module are running, if a preset time interval is reached, it is determined that the security detection trigger condition is met.

9. The method according to claim 8, characterized in that After the safety detection trigger condition is determined to be satisfied, the method further includes: Send a security detection request for the second service module and the second terminal device to the server.

10. The method according to claim 1, characterized in that The determining that the safety detection trigger condition is satisfied includes: When a security detection request sent by the server is received, it is determined that the security detection trigger condition is met, and the security detection request is sent by the server at a preset time interval during the operation of the first business module and the second business module.

11. The method according to claim 1, characterized in that The method further comprises: According to the security detection result, the operation state of the first service module is controlled.

12. A business data detection method, characterized in that: The method is applied to a server, and the method comprises: receiving a path of a business logic execution of a first business module during operation sent by a first client, wherein the first business module and the first client are running on a first terminal device, wherein the path of the business logic execution of the first business module during operation is obtained when the first client performs security detection of the first business module and the second business module during operation according to the business logic and calling interface preset by the first business module and the first client; receiving a path of the execution of the business logic of the second business module during operation sent by the second client, the second business module and the second client running on the second terminal device, wherein the path of the execution of the business logic of the second business module during operation is obtained when the second client performs security detection of the first business module and the second business module during operation according to the business logic and calling interface preset by the second business module and the second client; Performing a path integrity check according to the path of the business logic execution of the first business module during operation, the path of the business logic execution of the second business module during operation, the preset path of the business logic execution of the first business module, and the preset path of the business logic execution of the second business module to obtain a security detection result; The security detection result is sent to the first client and the second client.

13. The method according to claim 12, characterized in that The path integrity check is performed according to the path of the business logic execution of the first business module during operation, the path of the business logic execution of the second business module during operation, the preset path of the business logic execution of the first business module, and the preset path of the business logic execution of the second business module to obtain a security detection result, including: According to a preset manner, matching the logical nodes and call paths of the execution path of the business logic of the first business module during operation with the preset execution path of the business logic of the first business module to obtain a first detection result; According to the preset manner, matching the logical nodes and call paths of the execution path of the business logic of the second business module during operation with the preset execution path of the business logic of the second business module to obtain a second detection result; A safety detection result is obtained according to the first detection result and the second detection result.

14. The method according to claim 13, characterized in that The preset method is: matching all logic nodes in the path of business logic execution; or, Match all logic nodes and call paths in the execution path of the business logic; or, Matching the preset logic nodes in the path of business logic execution; or, The preset logic nodes in the execution path of the service logic are matched with the calling path of the preset logic nodes.

15. The method according to any one of claims 12 to 14, characterized in that: The method further comprises: Receive a detection request sent by a first client, the detection request carrying first target information, the first target information including at least one of the environment status information and compliance detection result of the current operation of the first terminal device, the object information logged in by the first client and the operation status information of the first client, the behavior characteristics of the login object of the first client and the network traffic information of the first client; Sending a probe request to the second client; receiving second target information sent by the second client, the second target information including at least one of the environment status information and compliance detection result of the current operation of the second terminal device, the object information logged in by the second client and the operation status information of the second client, the behavior characteristics of the login object of the second client and the network traffic information of the second client; Performing target detection according to the first target information and the second target information, wherein the target detection includes at least one of a first detection, a second detection, and a third detection; The first detection is: to detect whether the first terminal device and the second terminal device are abnormal; the second detection is: to perform security verification on the usage object information of the first terminal device and the usage object information of the second terminal device; the third detection is: to compare and analyze the behavioral characteristics of the login object of the first client and the network traffic of the first client, as well as the behavioral characteristics of the login object of the second client and the network traffic of the second client.

16. The method according to claim 15, characterized in that The method further comprises: If it is determined that the target detection is abnormal, the first terminal device or the second terminal device is isolated from the network.

17. The method according to claim 15, characterized in that The method further comprises: When the first business module and the second business module start to interact with each other, obtaining interaction mapping information between the first business module and the second business module, the interaction mapping information including: at least one of the current running environment status information and compliance detection result of the first terminal device, the object information logged in by the first client, and the running status information of the first client, and at least one of the current running environment status information and compliance detection result of the second terminal device, the object information logged in by the second client, and the running status information of the second client; The performing target detection according to the first target information and the second target information includes: The target detection is performed according to the first target information, the second target information, and the first business module and the interaction mapping information.

18. The method according to claim 12, characterized in that The method further comprises: During the operation of the first service module and the second service module, sending a security detection request to the first client and the second client at a preset time interval; or, Receiving a security detection request for the second service module and the second terminal device sent by the first client; Send a security check request to the second client.

19. A service data detection device, characterized in that: include: A determination module, used to determine whether a security detection trigger condition is satisfied, wherein the security detection is a security detection of the first service module and the second service module during operation, wherein the first service module and the first client are running on the first terminal device, and the second service module and the second client are running on the second terminal device; A processing module, configured to perform security detection of the first business module and the second business module during operation according to the business logic and calling interface preset by the first business module and the first client, and obtain a path for executing the business logic of the first business module during operation; A sending module, used for sending the execution path of the business logic of the first business module during operation to the server; A receiving module is used to receive the security detection result sent by the server, wherein the security detection result is obtained by the server performing a path integrity check based on the path of business logic execution of the first business module during operation, the path of business logic execution of the second business module during operation, the preset path of business logic execution of the first business module, and the preset path of business logic execution of the second business module.

20. A service data detection device, characterized in that: include: a receiving module, configured to receive a path of a business logic execution of a first business module during operation, which is sent by a first client, wherein the first business module and the first client are running on a first terminal device, wherein the path of the business logic execution of the first business module during operation is obtained when the first client performs security detection of the first business module and the second business module during operation according to the business logic and calling interface preset by the first business module and the first client; The receiving module is further used to: receive a path of the business logic execution of the second business module during operation sent by the second client, the second business module and the second client running on the second terminal device, wherein the path of the business logic execution of the second business module during operation is obtained when the second client performs security detection of the first business module and the second business module during operation according to the business logic and calling interface preset by the second business module and the second client; A processing module, used to perform a path integrity check according to a path of business logic execution of the first business module during operation, a path of business logic execution of the second business module during operation, a preset path of business logic execution of the first business module, and a preset path of business logic execution of the second business module to obtain a security detection result; A sending module is used to send the security detection result to the first client and the second client.

Images