Security identification method and device for remote desktop connection, equipment and medium

Abstract

The invention provides a security identification method and device for remote desktop connection, equipment and a medium, and relates to the technical field of computers. The method comprises the steps that when it is monitored that a terminal is connected with a remote computer based on a remote desktop connection tool, whether the remote computer belongs to computers allowed to be connected or not is judged; if not, the terminal is blocked from being connected with the remote computer through a remote desktop connection tool; if yes, allowing the terminal to be connected with the remote computer through a remote desktop connection tool, monitoring the operation of the terminal for sending out the file based on the remote desktop, judging whether the sent-out file belongs to the file allowed to be sent out or not, and determining whether to block the sending of the sent-out file or not according to the judgment result. According to the invention, the remote desktop connection and the outgoing file of the terminal can be monitored, and when the remote desktop connection or the outgoing file is not compliant, the remote desktop connection or the outgoing file can be timely blocked, so that the potential safety hazard possibly caused by the remote desktop connection of the terminal is avoided.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a remote desktop connection security identification method, device, equipment and medium. Background Art

[0002] Mstsc (Microsoft terminal services client, Remote Desktop Connection) is used to create a connection with a terminal server or other remote computer, allowing users to connect to another computer from one computer for remote operations.

[0003] With the development of information-based office, remote desktop connection tools such as Mstsc are used more and more frequently in office scenarios. However, in the current enterprise network security management, when employees connect to remote computers or computers through remote desktop connection tools, there will be problems such as outgoing files cannot be audited and remote connection objects cannot be controlled, which will cause hidden dangers to enterprise security. Summary of the invention

[0004] The purpose of this application is to provide a remote desktop connection security identification method, device, electronic device and storage medium, which can reduce the security risks of remote desktop connection.

[0005] In a first aspect, an embodiment of the present application provides a remote desktop connection security identification method, including:

[0006] When monitoring that the terminal is connected to a remote computer based on a remote desktop connection tool, determining whether the remote computer is a computer that is allowed to connect;

[0007] If the remote computer is not a computer that is allowed to connect, blocking the terminal from connecting to the remote computer via the remote desktop connection tool;

[0008] If the remote computer is a computer that is allowed to connect, the terminal is allowed to connect to the remote computer through the remote desktop connection tool, and the terminal's operation of sending files based on the remote desktop is monitored to determine whether the outgoing file is a file that is allowed to be sent out, and determine whether to block the sending of the outgoing file based on the determination result.

[0009] In a possible implementation, the determining whether the remote computer is a computer that is allowed to connect includes:

[0010] Obtaining the network address of the remote computer;

[0011] Determining whether the network address is within the range of network addresses allowed to connect;

[0012] If so, the remote computer belongs to the computers allowed to connect; otherwise, the remote computer does not belong to the computers allowed to connect.

[0013] In a possible implementation, the determining whether the outgoing file is a file that is allowed to be outgoing includes:

[0014] If there is no preset keyword in the outgoing file, and the file attribute of the outgoing file does not belong to the preset file attribute, and there is no preset data identifier in the outgoing file, then the outgoing file is a file allowed to be outgoing; otherwise, the outgoing file is not a file allowed to be outgoing.

[0015] In a possible implementation, determining whether to block the sending of the outgoing file according to the judgment result includes:

[0016] If the judgment result is that the outgoing file does not belong to the files allowed to be sent out, blocking the sending of the outgoing file;

[0017] If the judgment result is that the outgoing file is a file that is allowed to be outgoing, the outgoing file is sent.

[0018] In a possible implementation, if the result of the determination is that the outgoing file does not belong to a file that is allowed to be outgoing, after blocking the sending of the outgoing file, the method further includes:

[0019] A violation response is triggered, the violation response comprising at least one of the following:

[0020] Terminal alarms, console alarms, email alarms, alarm log generation, screen lock operations, screenshot operations, and screen recording operations.

[0021] In a second aspect, an embodiment of the present application provides a remote desktop connection security identification device, including:

[0022] A monitoring module, used to monitor when a terminal is connected to a remote computer based on a remote desktop connection tool, and determine whether the remote computer is a computer that is allowed to connect;

[0023] The security identification module is used to block the terminal from connecting to the remote computer through a remote desktop connection tool if the remote computer is not a computer allowed to connect; if the remote computer is a computer allowed to connect, allow the terminal to connect to the remote computer through a remote desktop connection tool, and monitor the terminal's operation of sending files based on the remote desktop to determine whether the outgoing files are files allowed to be sent out, and determine whether to block the sending of the outgoing files based on the determination result.

[0024] In a possible implementation, the monitoring module is specifically used to:

[0025] Obtaining the network address of the remote computer;

[0026] Determining whether the network address is within the range of network addresses allowed to connect;

[0027] If so, the remote computer belongs to the computers allowed to connect; otherwise, the remote computer does not belong to the computers allowed to connect.

[0028] In a possible implementation, the security identification module is specifically used to:

[0029] If there is no preset keyword in the outgoing file, and the file attribute of the outgoing file does not belong to the preset file attribute, and there is no preset data identifier in the outgoing file, then the outgoing file is a file allowed to be outgoing; otherwise, the outgoing file is not a file allowed to be outgoing.

[0030] In a possible implementation, the security identification module is specifically used to:

[0031] If the judgment result is that the outgoing file does not belong to the files allowed to be sent out, blocking the sending of the outgoing file;

[0032] If the judgment result is that the outgoing file is a file that is allowed to be outgoing, the outgoing file is sent.

[0033] In a possible implementation, the security identification module is further used to:

[0034] After the sending of the outgoing file is blocked, a violation response is triggered, and the violation response includes at least one of the following items:

[0035] Terminal alarms, console alarms, email alarms, alarm log generation, screen lock operations, screenshot operations, and screen recording operations.

[0036] In a third aspect, the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect.

[0037] In a fourth aspect, the present application provides a computer-readable storage medium having computer-readable instructions stored thereon, wherein the computer-readable instructions can be executed by a processor to implement the method described in the first aspect.

[0038] Compared with the prior art, the security identification method of remote desktop connection provided by the present application determines whether the remote computer is a computer that is allowed to connect when monitoring the terminal to connect to the remote computer based on the remote desktop connection tool; if the remote computer is not a computer that is allowed to connect, the terminal is blocked from connecting to the remote computer through the remote desktop connection tool; if the remote computer is a computer that is allowed to connect, the terminal is allowed to connect to the remote computer through the remote desktop connection tool, and the operation of the terminal to send files based on the remote desktop is monitored to determine whether the sent files are files that are allowed to be sent out, and determine whether to block the sending of the sent files based on the judgment result. It can be seen that the remote desktop connection and outgoing files of the terminal can be monitored through the present application, and when the remote desktop connection or outgoing files are not compliant, they can be blocked in time, thereby avoiding the potential security risks caused by the terminal connecting through the remote desktop. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0040] Figure 1 A flowchart of a remote desktop connection security identification method provided by an embodiment of the present application is shown;

[0041] Figure 2 A schematic diagram of the structure of a security identification device for remote desktop connection provided by an embodiment of the present application is shown;

[0042] Figure 3 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0043] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0044] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0045] In addition, the terms "first" and "second" etc. are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0046] Please refer to Figure 1 , Figure 1 1 is a flowchart of a remote desktop connection security identification method provided by an embodiment of the present application, comprising the following steps S101 to S103:

[0047] S101, when monitoring that a terminal is connected to a remote computer based on a remote desktop connection tool, determining whether the remote computer is a computer that is allowed to connect;

[0048] The above method provided in the present application is applied to a console, which can monitor each terminal in the intranet.

[0049] The console monitors the connection of each terminal in the intranet to the remote computer based on the remote desktop connection tool (such as Mstsc). The console stores the network address range of the remote computers that each terminal is allowed to connect to based on the remote desktop connection tool. Monitor and intercept the action of a terminal connecting to a remote computer based on the remote desktop connection tool, obtain the network address of the remote computer to be connected, and determine whether the remote computer is a computer that the terminal is allowed to connect to based on the network address.

[0050] The above-mentioned computer may be a server or other terminal.

[0051] Specifically, the step of determining whether the remote computer is a computer allowed to connect in step S101 may be implemented as follows:

[0052] Obtaining the network address of the remote computer;

[0053] Determining whether the network address is within the range of network addresses allowed to connect;

[0054] If so, the remote computer belongs to the computers allowed to connect; otherwise, the remote computer does not belong to the computers allowed to connect.

[0055] S102: If the remote computer is not a computer that is allowed to connect, block the terminal from connecting to the remote computer via a remote desktop connection tool.

[0056] Blocking terminals from connecting to computers that are not allowed can prevent terminals from operating non-compliant remote computers based on remote desktop connections, thereby avoiding security risks that may be caused by terminals connecting through remote desktops.

[0057] S103. If the remote computer is a computer that is allowed to connect, the terminal is allowed to connect to the remote computer through a remote desktop connection tool, and the operation of the terminal to send outgoing files based on the remote desktop is monitored to determine whether the outgoing file is a file that is allowed to be sent out, and determine whether to block the sending of the outgoing file based on the determination result.

[0058] After determining that the remote computer is compliant, the terminal establishes a remote desktop connection with the remote computer. The terminal can send files outward based on the remote desktop connection. When monitoring the terminal sending files outward, the console intercepts the outgoing files and determines whether the outgoing files are files that are allowed to be sent outward to obtain a judgment result.

[0059] Specifically, the step of determining whether the outgoing file is a file allowed to be outgoing in step S103 may be specifically implemented as follows:

[0060] If there is no preset keyword in the outgoing file, and the file attribute of the outgoing file does not belong to the preset file attribute, and there is no preset data identifier in the outgoing file, then the outgoing file is a file allowed to be outgoing; otherwise, the outgoing file is not a file allowed to be outgoing.

[0061] Specifically, the detection rules for outgoing files in this application include: keyword rules, file attribute rules, and data identifier rules. After intercepting an outgoing file, it is detected whether there are preset keywords in the outgoing file, whether the file attributes of the outgoing file belong to the preset file attributes, and whether there are preset data identifiers in the outgoing file. Only when the outgoing file passes the above three tests is it allowed to be sent out.

[0062] Specifically, the step of determining whether to block the sending of the outgoing file according to the judgment result in step S103 can be specifically implemented as follows:

[0063] If the judgment result is that the outgoing file does not belong to the files allowed to be outgoing, the sending of the outgoing file is blocked; if the judgment result is that the outgoing file belongs to the files allowed to be outgoing, the outgoing file is sent.

[0064] The above blocking of the outbound transmission of unauthorized files can prevent the terminal from sending sensitive files based on the remote desktop connection, thus avoiding the potential security risks caused by the terminal through the remote desktop connection.

[0065] In some embodiments, after the console blocks the terminal from sending files that are not allowed to be sent out, it will also trigger a violation response. The violation response includes at least one of the following: terminal alarm, console alarm, email alarm, alarm log generation, screen lock operation, screenshot operation and screen recording operation.

[0066] In some embodiments, in order to facilitate subsequent tracing, after the console allows the terminal to send files externally, it can also record the external file operations and perform external file backups. The external file records include the external file path, backup file, connection server address, external time, and external terminal information. The console administrator can view the details of the terminal's external files.

[0067] In this application, the console recognizes that the terminal has operations to connect to other computers through remote desktop, can identify the network address of the remote computer, and can block the terminal from remotely connecting to other computers; when the terminal allows remote connection to other computers, it will control whether the terminal computer has outgoing file actions. If there are outgoing file actions, they can be intercepted and the rationality of the file will be identified first. If it is unreasonable, the outgoing file blocking operation can be performed.

[0068] The remote desktop connection security identification method provided in the embodiment of the present application has the following beneficial effects:

[0069] This application determines whether the remote computer is allowed to connect by monitoring the terminal based on the remote desktop connection tool when it connects to the remote computer; if the remote computer is not allowed to connect, the terminal is blocked from connecting to the remote computer through the remote desktop connection tool; if the remote computer is allowed to connect, the terminal is allowed to connect to the remote computer through the remote desktop connection tool, and the terminal's operation of sending files based on the remote desktop is monitored to determine whether the outgoing files are allowed to be sent out, and whether to block the sending of the outgoing files based on the judgment result. It can be seen that the remote desktop connection and outgoing files of the terminal can be monitored through this application, and when the remote desktop connection or outgoing files are not compliant, they can be blocked in time, thereby avoiding the potential security risks caused by the terminal connecting through the remote desktop.

[0070] In the above-mentioned embodiment, a security identification method for a remote desktop connection is provided, and correspondingly, the present application also provides a security identification device for a remote desktop connection. The security identification device for a remote desktop connection provided in the embodiment of the present application can implement the above-mentioned security identification method for a remote desktop connection, and the security identification device for a remote desktop connection can be implemented by software, hardware, or a combination of software and hardware. For example, the security identification device for a remote desktop connection can include integrated or separate functional modules or units to execute the corresponding steps in the above-mentioned methods.

[0071] Please refer to Figure 2 As shown, the remote desktop connection security identification device 10 provided by the present application includes:

[0072] The monitoring module 101 is used to monitor that when a terminal is connected to a remote computer based on a remote desktop connection tool, determine whether the remote computer is a computer that is allowed to connect;

[0073] The security identification module 102 is used to block the terminal from connecting to the remote computer through the remote desktop connection tool if the remote computer is not a computer allowed to connect; if the remote computer is a computer allowed to connect, allow the terminal to connect to the remote computer through the remote desktop connection tool, and monitor the terminal's operation of sending files based on the remote desktop to determine whether the outgoing files are files allowed to be sent out, and determine whether to block the sending of the outgoing files based on the determination result.

[0074] In a possible implementation, the monitoring module 101 is specifically configured to:

[0075] Obtaining the network address of the remote computer;

[0076] Determining whether the network address is within the range of network addresses allowed to connect;

[0077] If so, the remote computer belongs to the computers allowed to connect; otherwise, the remote computer does not belong to the computers allowed to connect.

[0078] In a possible implementation, the security identification module 102 is specifically configured to:

[0079] If there is no preset keyword in the outgoing file, and the file attribute of the outgoing file does not belong to the preset file attribute, and there is no preset data identifier in the outgoing file, then the outgoing file is a file allowed to be outgoing; otherwise, the outgoing file is not a file allowed to be outgoing.

[0080] In a possible implementation, the security identification module 102 is specifically configured to:

[0081] If the judgment result is that the outgoing file does not belong to the files allowed to be sent out, blocking the sending of the outgoing file;

[0082] If the judgment result is that the outgoing file is a file that is allowed to be outgoing, the outgoing file is sent.

[0083] In a possible implementation, the security identification module 102 is further configured to:

[0084] After the sending of the outgoing file is blocked, a violation response is triggered, and the violation response includes at least one of the following items:

[0085] Terminal alarms, console alarms, email alarms, alarm log generation, screen lock operations, screenshot operations, and screen recording operations.

[0086] The security identification device for remote desktop connection provided in the embodiment of the present application and the security identification method for remote desktop connection provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented therein.

[0087] The embodiments of the present application also provide an electronic device corresponding to the method provided in the aforementioned embodiments. The electronic device can be a mobile phone, a laptop computer, a tablet computer, a desktop computer, etc., to execute the above-mentioned remote desktop connection security identification method.

[0088] Please refer to Figure 3 , which shows a schematic diagram of an electronic device provided by some embodiments of the present application. Figure 3 As shown, the electronic device 20 includes: a processor 200, a memory 201, a bus 202 and a communication interface 203, and the processor 200, the communication interface 203 and the memory 201 are connected via the bus 202; the memory 201 stores a computer program that can be run on the processor 200, and when the processor 200 runs the computer program, it executes the security identification method for remote desktop connection provided in any of the aforementioned embodiments of the present application.

[0089] The memory 201 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 203 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0090] The bus 202 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 201 is used to store a program, and the processor 200 executes the program after receiving an execution instruction. The remote desktop connection security identification method disclosed in any implementation of the embodiment of the present application may be applied to the processor 200, or implemented by the processor 200.

[0091] The processor 200 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 200. The above processor 200 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a readily available programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor to be executed, or the hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 201, and the processor 200 reads the information in the memory 201 and completes the steps of the above method in combination with its hardware.

[0092] The electronic device provided in the embodiment of the present application and the security identification method for remote desktop connection provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented therein.

[0093] An embodiment of the present application also provides a computer-readable storage medium corresponding to the remote desktop connection security identification method provided in the aforementioned embodiment, on which a computer program (i.e., a program product) is stored. When the computer program is executed by a processor, it will execute the remote desktop connection security identification method provided in any of the aforementioned embodiments.

[0094] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0095] The computer-readable storage medium provided in the above-mentioned embodiments of the present application and the remote desktop connection security identification method provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0096] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application, and they should all be included in the scope of the claims and specification of the present application.

Claims

1. A remote desktop connection security identification method, characterized in that: include: When monitoring that the terminal is connected to a remote computer based on a remote desktop connection tool, determining whether the remote computer is a computer that is allowed to connect; If the remote computer is not a computer that is allowed to connect, blocking the terminal from connecting to the remote computer via the remote desktop connection tool; If the remote computer is a computer that is allowed to connect, the terminal is allowed to connect to the remote computer through the remote desktop connection tool, and the terminal's operation of sending files based on the remote desktop is monitored to determine whether the outgoing file is a file that is allowed to be sent out, and determine whether to block the sending of the outgoing file based on the determination result.

2. The method according to claim 1, characterized in that The determining whether the remote computer is a computer that is allowed to connect includes: Obtaining the network address of the remote computer; Determining whether the network address is within the range of network addresses allowed to connect; If so, the remote computer belongs to the computers allowed to connect; otherwise, the remote computer does not belong to the computers allowed to connect.

3. The method according to claim 1, characterized in that The determining whether the outgoing file is a file that is allowed to be outgoing includes: If there is no preset keyword in the outgoing file, and the file attribute of the outgoing file does not belong to the preset file attribute, and there is no preset data identifier in the outgoing file, then the outgoing file is a file allowed to be outgoing; otherwise, the outgoing file is not a file allowed to be outgoing.

4. The method according to claim 1, characterized in that: The determining whether to block the sending of the outgoing file according to the judgment result includes: If the judgment result is that the outgoing file does not belong to the files allowed to be sent out, blocking the sending of the outgoing file; If the judgment result is that the outgoing file is a file that is allowed to be outgoing, the outgoing file is sent.

5. The method according to claim 4, characterized in that If the judgment result is that the outgoing file does not belong to the files allowed to be outgoing, after blocking the sending of the outgoing file, the method further includes: A violation response is triggered, the violation response comprising at least one of the following: Terminal alarms, console alarms, email alarms, alarm log generation, screen lock operations, screenshot operations, and screen recording operations.

6. A remote desktop connection security identification device, applied to a console, characterized in that: include: A monitoring module, used to monitor when a terminal is connected to a remote computer based on a remote desktop connection tool, and determine whether the remote computer is a computer that is allowed to connect; The security identification module is used to block the terminal from connecting to the remote computer through a remote desktop connection tool if the remote computer is not a computer allowed to connect; if the remote computer is a computer allowed to connect, allow the terminal to connect to the remote computer through a remote desktop connection tool, and monitor the terminal's operation of sending files based on the remote desktop to determine whether the outgoing files are files allowed to be sent out, and determine whether to block the sending of the outgoing files based on the determination result.

7. The device according to claim 6, characterized in that The monitoring module is specifically used for: Obtaining the network address of the remote computer; Determining whether the network address is within the range of network addresses allowed to connect; If so, the remote computer belongs to the computers allowed to connect; otherwise, the remote computer does not belong to the computers allowed to connect.

8. The device according to claim 6, characterized in that The security identification module is specifically used for: If the outgoing file does not contain a preset keyword, the file attribute of the outgoing file does not belong to the preset file attribute, and the outgoing file does not contain a preset data identifier, then the outgoing file is a file that is allowed to be outgoing; Otherwise, the outgoing file does not belong to the files allowed to be outgoing.

9. An electronic device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 5 when executing the computer program.

10. A computer-readable storage medium, characterized in that: Computer-readable instructions are stored thereon, and the computer-readable instructions can be executed by a processor to implement the method according to any one of claims 1 to 5.

Images