Service security auditing method and system

Abstract

The invention discloses a service security auditing method, which is applied to a server, and comprises the following steps: providing a login port, receiving an account login application initiated by a client, and generating a login credential; based on the login credential, acquiring personnel information and role identities corresponding to the login account, the role identities including a non-auditing role, an internal auditing role, an external security auditing role and an external business auditing role; and determining an audit operation authority based on the role identity of the login account. According to the method provided by the invention, the internal auditing role and the external auditing role are distinguished, and a part of permissions related to external auditing are provided, so that the external auditing role can view data online without offline calling, and the efficiency of external auditing work is improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a business security audit method and system. Background Art

[0002] In the relevant technologies, many business systems lack security audit functions in actual use, especially when facing external audits.

[0003] In the process of external audit, it is common to retrieve data or obtain evidence. The following problems generally exist in related technologies: when retrieving data or obtaining evidence, it is generally necessary for operation and maintenance personnel to manually retrieve the data and send it via email, or to go to the audit site to obtain paper versions of external audit data. The process of retrieving data or obtaining evidence can only be carried out offline, which reduces the convenience and business processing efficiency of retrieving external audit data. Summary of the invention

[0004] In order to address the deficiencies in the prior art, the purpose of this application is to provide a solution to the problem in the related art that external review requires offline review of materials.

[0005] To achieve the above objectives, this application adopts the following technical solutions: A business security audit method is provided, which is applied to a server and includes the following steps: Provide a login port, receive account login applications initiated by clients, and generate login credentials; Based on the login credentials, obtain the personnel information and role identity corresponding to the login account, where the role identity includes non-audit role, internal audit role, external security audit role and external business audit role; Establish audit operation permissions based on the role identity of the login account.

[0006] According to the above description, the method provided in this application distinguishes between internal audit roles and external audit roles, and provides some permissions related to external audit, so that external audit roles can view information online without offline retrieval, thereby improving the efficiency of external audit work.

[0007] Furthermore, the method also includes: In response to the role identity of the login account being an external security audit role, the audit operation permissions of the login account include: viewing security rules, viewing alarm notification records, and viewing business operation logs marked as unauthorized; In response to the login account's role identity being an external business audit role, the login account's audit operation permissions include: Mark compliance and non-compliance business operation logs for review, and security audit records for non-compliant business operations; Among them, based on the preset business operation authority rules and business compliance rules, the business operation requests initiated by the login account of the non-audit role identity are judged, and the judgment results are marked and recorded to obtain a marked business operation log; the marked non-compliant business operations are pushed to the internal audit role, and the internal audit role generates a security audit record of the non-compliant business operations after auditing.

[0008] Furthermore, the method also includes: Configure business operation permission rules, including determining whether at least some business scenarios are allowed to be operated in the non-logged-in state; Providing a business operation request receiving port to receive business operation requests; Parse the business operation request to obtain the business information of the business operation request, and determine whether there is a login credential; Based on business information and business operation permission rules, determine whether the business scenario corresponding to the business operation request allows operation in the non-logged-in state. If operation in the non-logged-in state is not allowed and the business operation request has no login credentials, the business operation request will be rejected, marked as unauthorized and recorded in the business operation log.

[0009] Furthermore, the method also includes: Configure business operation permission rules, including establishing the role types that are allowed to operate in at least some business scenarios; If the business operation request has login credentials, the role identity corresponding to the login account is obtained based on the login credentials. Combined with the business operation permission rules, determine whether the role identity of the initiator of the business operation request meets the role type requirements of the business scenario. If not, reject the business operation request, mark the business operation request as unauthorized and record it in the business operation log.

[0010] Furthermore, the method also includes: Configure business operation permission rules, including establishing a list of personnel who are allowed to operate at least some business scenarios; If the business operation request contains login credentials, the personnel information corresponding to the login account is obtained based on the login credentials; Combined with the business operation authority rules, determine whether the personnel information of the initiator of the business operation request meets the personnel list requirements of the business scenario. If not, reject the business operation request, mark the business operation request as unauthorized and record it in the business operation log.

[0011] Furthermore, the method also includes: Configure business operation permission rules, including establishing the IP segments and regional scopes that are allowed to operate in at least some business scenarios; In response to receiving the service operation request, parsing the service operation request to obtain an IP address of the service operation request; Query the region where the service operation request is initiated based on the IP address; Combined with the business operation permission rules, determine whether the IP address of the business operation request meets the IP segment requirements of the business scenario. If not, reject the business operation request, mark the business operation request as unauthorized, and record it in the business operation log; Determine whether the region information of the business operation request meets the region range requirements of the business scenario. If not, reject the business operation request, mark the business operation request as unauthorized and record it in the business operation log.

[0012] Furthermore, the method also includes: In response to the business operation request complying with the business operation authority rules, determining whether the business operation request complies with the business compliance rules; If it is determined that the business operation request does not comply with the business compliance rules, the business operation request is marked as non-compliant and recorded in the business operation log; The business operation log marked as non-compliant is pushed to the internal audit role for audit. If the internal audit determines that the business operation request is compliant, the operation log records and marks the business operation request as compliant.

[0013] Furthermore, the method also includes: Configure alarm notification rules, including determining whether unauthorized operations in at least some business scenarios require alarm notifications; In response to the business operation request being marked as unauthorized, the business operation request is judged according to the alarm notification rule, and if it meets the alarm notification rule, relevant personnel are notified.

[0014] The present application also provides a business security audit system, which is applied to the server side and includes: Login port, which is configured to receive account login requests initiated by clients and generate login credentials; A role determination module, wherein the role determination module is configured to obtain the personnel information and role identity corresponding to the login account based on the login credentials, wherein the role identity includes a non-audit role, an internal audit role, an external security audit role, and an external business security audit role; The permission setting module is configured to establish audit operation permissions based on the role identity of the login account.

[0015] Furthermore, the permission setting module is configured as follows: In response to the role identity of the login account being an external security audit role, the audit operation permissions of the login account are configured to include: security rule viewing, alarm notification record viewing, and business operation log viewing marked as unauthorized; In response to the login account's role identity being an external business audit role, the audit operation permissions configured for the login account include: Mark compliance and non-compliance business operation logs for review, and security audit records for non-compliant business operations; Among them, based on the preset business operation authority rules and business compliance rules, the business operation requests initiated by the login account of the non-audit role identity are judged, and the judgment results are marked and recorded to obtain a marked business operation log; the marked non-compliant business operations are pushed to the internal audit role, and the internal audit role generates a security audit record of the non-compliant business operations after auditing. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of a business security audit method provided in an embodiment of the present application; Figure 2 A schematic diagram of the processing flow of a business operation request provided in an embodiment of the present application; Figure 3 Schematic diagram of the business security audit system provided for an embodiment of the present application. DETAILED DESCRIPTION

[0017] The present application will be described in detail below in conjunction with the specific implementation modes shown in the accompanying drawings, but these implementation modes do not limit the present application. Structural, methodological, or functional changes made by ordinary technicians in the field based on these implementation modes are included in the protection scope of the present application.

[0018] The purpose of this application is to provide a business security audit method for security auditing business scenarios. A business scenario refers to a scenario where an action (query, create, update, delete, etc.) is performed on a resource; security auditing refers to tracing and analyzing the operation records of each business scenario, and the relevant business operations must meet the security rules defined in each business scenario.

[0019] like Figure 1 As shown, the present application provides a business security audit method, which is applied to the server and includes the following steps: Provide a login port, receive account login applications initiated by clients, and generate login credentials; Based on the login credentials, obtain the personnel information and role identity corresponding to the login account, where the role identity includes non-audit role, internal audit role, external security audit role and external business audit role; Establish audit operation permissions based on the role identity of the login account.

[0020] Specifically, the operator can use the client to initiate an account login application to the server with the account and login password. The server verifies the account login password and issues the login credentials to the client after verification. The login credentials include: the personnel information and role identity corresponding to the login account. Personnel information can include name, department, position, etc. Role identities can include non-audit roles, internal audit roles, external security audit roles, and external business audit roles.

[0021] The method provided by the present application establishes the permissions that the account can perform based on the role identity of the login account. For example, for accounts with non-audit roles, only regular business operation processes are allowed, but audit operations are not allowed; for accounts with internal audit roles, internal audit-related operations initiated by the account are allowed; for accounts with external security audit roles, external security audit-related operations initiated by the account are allowed; for accounts with external business audit roles, external business audit-related operations initiated by the account are allowed.

[0022] According to the above description, the method provided in this application distinguishes between internal audit roles and external audit roles, and provides some permissions related to external audit, so that external audit roles can view information online without offline retrieval, thereby improving the efficiency of external audit work.

[0023] For example, for audit-related operations, when the client initiates an http / https operation request, the login credentials can be written into the head of the http / https operation request. When the server receives the operation request, it verifies the login credentials in the operation request to determine whether the user is logged in. If not, it returns a request failure and prompts the user that the user is not logged in; if the user is logged in, the person information and role identity can be obtained based on the login credentials.

[0024] As an optional implementation, in response to the role identity of the login account being an external security audit role, the audit operation permissions of the login account include: viewing security rules, viewing alarm notification records, and viewing business operation logs marked as unauthorized. In response to the role identity of the login account being an external business audit role, the audit operation permissions of the login account include: viewing business operation logs marked as compliant and non-compliant, and viewing security audit records of non-compliant business operations.

[0025] Among them, based on the preset business operation authority rules and business compliance rules, the business operation requests initiated by the login account of the non-audit role identity are judged, and the judgment results are marked and recorded to obtain a marked business operation log; the marked non-compliant business operations are pushed to the internal audit role, and the internal audit role generates a security audit record of the non-compliant business operations after auditing.

[0026] Specifically, in the embodiment of the present application, the business operation authority rules refer to: the prerequisites that need to be met for business operations, such as meeting IP rules, meeting the rules of the region where the operator is located, meeting the requirements for being able to operate within a limited list of personnel, meeting the requirements for being able to operate within a specific role, etc. Based on the business operation authority rules, it can be determined whether an operation request for a certain business exceeds the authority. Business compliance rules are used to determine whether an operation request for a certain business is compliant. In the embodiment of the present application, business operation authority rules and business compliance rules are collectively referred to as security rules.

[0027] Business operation logs mainly record the operation requests for business scenarios and the changes in business scenarios before and after the operation. For example, business operation logs may include: record ID, timestamp, operator, business resource, business resource model, operation type (query, add, modify, delete), operation input parameter, operation return result, business data before operation, business data after operation, abnormal message content (business operation error or security rule violation information summary), operation source IP, operation initiation region, operation tag (overauthorized, normal, non-compliant).

[0028] It should be noted that different business scenarios have different business resource models (different attribute fields, such as resource name, resource core information field, resource extended information field, resource attachment field, and related view layout and font color size, etc.). When querying the business operation log details, the business scenario changes before and after the operation can be displayed based on the scenario model.

[0029] Security audit records mainly record the audit results of various business operations by the audit role, for example, the processing of non-compliant operation requests (such as confirming that the request is non-compliant, or determining that the request is compliant, modifying the non-compliant mark, and approving the operation request).

[0030] Alarm notification records are used to record the alarm conditions of the system. For example, alarm notification records may include: alarm ID, alarm name, trigger time, trigger condition (condition or rule that triggers the alarm), trigger source business operation log ID (for easy association and display of related operation information), notification status (sent, not sent, failed to send), notification time, recipient (user or system that receives the alarm notification), notification method (email, SMS, phone, API, etc.), and additional information (other information related to the alarm, such as error details and log records).

[0031] According to the business security audit method provided by this application, operations are marked in the business operation log (overauthorization, compliance, non-compliance), and the external security audit role is provided with the permission to view the business operation log marked "overauthorization", and the external business audit role is provided with the permission to view the business operation log marked "compliance" and "non-compliance". In this way, the needs of external audits can be met while avoiding the leakage of internal business information, thereby improving the efficiency of external audits.

[0032] As an optional implementation, the business security audit method provided by the present application further includes: configuring business operation permission rules, including determining whether at least some business scenarios are allowed to be operated in a non-logged-in state; Providing a business operation request receiving port to receive business operation requests; Parse the business operation request to obtain the business information of the business operation request, and determine whether there is a login credential; Based on business information and business operation permission rules, determine whether the business scenario corresponding to the business operation request allows operation in the non-logged-in state. If operation in the non-logged-in state is not allowed and the business operation request has no login credentials, the business operation request will be rejected, marked as unauthorized and recorded in the business operation log.

[0033] Specifically, according to the business security audit method provided in the embodiment of the present application, the business operation permission rules are configured to allow some business scenarios to be operated without logging in, and some business scenarios are commonly only allowed to be operated when the account is logged in. For business scenarios that are only allowed to be operated in the logged-in state, if the received business operation request has no login credentials, it can be determined that the account is not logged in, and the business operation request can be rejected, marked as unauthorized and recorded in the business operation log for subsequent internal / external review roles to view.

[0034] As an optional implementation, the business security audit method provided by the present application further includes: configuring business operation permission rules, including establishing the role types that are allowed to operate in at least some business scenarios; If the business operation request contains login credentials, the role identity corresponding to the login account is obtained based on the login credentials. Combined with the business operation permission rules, it is determined whether the role identity of the initiator of the business operation request meets the role type requirements of the business scenario. If not, the business operation request is rejected, the business operation request is marked as unauthorized and recorded in the business operation log.

[0035] Specifically, the business operation permission rules establish the role types that are allowed to operate in at least some business scenarios. For example, for some business scenarios, only non-audit roles are allowed to operate, and internal / external audit roles are not allowed to operate; or, for some business scenarios, only internal audit roles and external security audit roles are allowed to operate (such as viewing the business operation log marked as unauthorized); or, for some business scenarios, only internal audit roles and external business audit roles are allowed to operate (such as viewing the business operation log marked as compliant / non-compliant).

[0036] According to the method provided in this application, the role permissions that can be operated in the business scenario are agreed upon, and business operation applications that exceed the role permissions are marked and recorded in the business operation log to facilitate audit work.

[0037] As an optional implementation, the business security audit method provided in the embodiment of the present application further includes: configuring business operation authority rules, including establishing a list of personnel who are allowed to operate in at least some business scenarios; If the business operation request contains login credentials, the personnel information corresponding to the login account is obtained based on the login credentials; Combined with the business operation authority rules, determine whether the personnel information of the initiator of the business operation request meets the personnel list requirements of the business scenario. If not, reject the business operation request, mark the business operation request as unauthorized and record it in the business operation log.

[0038] Specifically, according to the business security audit method provided in the embodiment of the present application, a rule is set to limit the operability to a specific list of personnel. For operation requests where the initiator of the operation is not on the list, the business operation request is rejected, the business operation request is marked as unauthorized and recorded in the business operation log to facilitate subsequent audit work.

[0039] As an optional implementation, the method provided by the present application further includes: configuring business operation permission rules, including establishing IP segments and regional scopes that are allowed to operate in at least some business scenarios; In response to receiving the service operation request, parsing the service operation request to obtain an IP address of the service operation request; Query the region where the service operation request is initiated based on the IP address; Combined with the business operation permission rules, determine whether the IP address of the business operation request meets the IP segment requirements of the business scenario. If not, reject the business operation request, mark the business operation request as unauthorized, and record it in the business operation log; Determine whether the region information of the business operation request meets the region range requirements of the business scenario. If not, reject the business operation request, mark the business operation request as unauthorized and record it in the business operation log.

[0040] Specifically, according to the business security audit method provided in the embodiment of the present application, the IP segment and regional range of the business scenario allowed operation are set. When a business operation request is received, regardless of whether the client is logged in to the account, the real IP of the operation request can be obtained according to the X-Forwarded-For field containing the source in the http / https request, so that the operation request can be judged according to the real IP whether it meets the IP segment requirements of the business scenario, and further judged whether the operation request exceeds the authority. Furthermore, the setting of IP rules can be applicable to internal networks and whitelist scenarios, and can also be applied to blacklist policies.

[0041] As an optional implementation method, the actual offline region information initiated by the reverse query request based on the IP address can be used. For example, the address reverse query can be performed in a combination of offline mode and online mode, and the correspondence between IP and region database can be imported, and the address query can be performed in offline mode. In the case that the offline mode cannot be resolved, the online query of the correspondence between IP and region is adopted. This combination of offline mode and online mode can take into account both the efficiency and accuracy of the query.

[0042] Based on the queried regional information, determine whether the regional information of the business operation request meets the regional scope requirements of the business scenario. If not, reject the business operation request, mark the business operation request as unauthorized, and record it in the business operation log. For example, set a business scenario to be operated within a certain city, or prohibit operations within certain regions. Based on these rules, it can be determined whether the origin of the business operation request is unauthorized. Mark unauthorized business operation requests and record them in the business operation log for subsequent audit personnel to review.

[0043] As an optional implementation, the business security audit method provided in the embodiment of the present application further includes: in response to the business operation request complying with the business operation authority rule, determining whether the business operation request complies with the business compliance rule; If it is determined that the business operation request does not comply with the business compliance rules, the business operation request is marked as non-compliant and recorded in the business operation log; The business operation log marked as non-compliant is pushed to the internal audit role for audit. If the internal audit determines that the business operation request is compliant, the operation log records and marks the business operation request as compliant.

[0044] According to the above description, the business security audit method provided in this application can realize the internal audit role's review and audit of business operation logs, including confirmation of business operation requests marked as non-compliant, and modification of the markings of business operation requests marked as non-compliant.

[0045] As an optional implementation method, auditors can view logs by time range or filter queries by conditions. For example, they can query logs by IP information, region information, login status, role identity, operator, fuzzy matching of operation content, etc.

[0046] As an optional implementation, the method provided by the present application further includes: configuring alarm notification rules, including determining whether unauthorized operations in at least some business scenarios require alarm notification; In response to the business operation request being marked as unauthorized, the business operation request is judged according to the alarm notification rule, and if it meets the alarm notification rule, relevant personnel are notified.

[0047] Specifically, it is possible to configure alarm notification rules to determine whether unauthorized operations in at least some business scenarios require alarm notifications. For example, an alarm can be pushed for multiple unauthorized operations in a certain business scenario within a certain time range, and the push content includes: the business scenario involving unauthorized operations, the time range in which the unauthorized operations occurred, the total number of people involved, and the total number of unauthorized operations. Alternatively, an alarm can be pushed for multiple unauthorized operations by a certain operator within a certain time range, and the push content includes: the business scenario involving unauthorized operations, the time range in which the unauthorized operations occurred, the operator, and the total number of unauthorized operations. Alternatively, an alarm can be pushed for multiple unauthorized operations within a certain time range with the same source IP, and the push content includes: the business scenario involving unauthorized operations, the time range in which the unauthorized operations occurred, the source IP, geographic information, and the total number of unauthorized operations.

[0048] As an optional implementation method, the business security audit method provided by the present application also includes: monitoring external audit-related operations (including external security audit-related operations and external business audit-related operations), configuring alarm rules, and issuing alarms when external audit-related operations meet the configured alarm rules, and notifying relevant personnel.

[0049] For example, you can configure alarm rules to push alarms for multiple unauthorized operations within a certain time range in a business scenario related to external audit. The push content includes: the business scenario involving the unauthorized operation, the time range in which the unauthorized operation occurred, the total number of people involved, and the total number of unauthorized operations.

[0050] Alternatively, an alert can be pushed for multiple unauthorized operations by external audit roles (including external security audit roles and external business audit roles) within a certain time range. The push content includes: the business scenario involving the unauthorized operation, the time range in which the unauthorized operation occurred, the total number of people involved, and the total number of unauthorized operations.

[0051] Alternatively, for a business scenario related to an external audit, an alarm can be pushed for multiple unauthorized operations with the same source IP within a certain time range. The push content includes: the business scenario involving the unauthorized operation, the time range where the unauthorized operation occurred, the source IP, geographic information, and the total number of unauthorized operations.

[0052] In order to further illustrate the business security audit method provided by the embodiment of the present application, the following describes the processing flow of business operation requests. Figure 2 As shown, including: Step S11, parse the business operation request, obtain the IP address and business information of the business operation request, obtain the login credentials, and obtain the personnel information and role identity based on the login credentials; if the login credentials cannot be obtained, it is deemed that the account is not logged in.

[0053] Step S12, query the business operation authority rules, and determine whether the operation request exceeds the authority based on the information obtained in step S11. If it exceeds the authority, go to step S13, otherwise jump to step S15.

[0054] The business operation authority rules in step S12 include one or more of the following rules: whether the business scenario requires login, and whether the requested login status meets the requirements; whether the IP address meets the requirements; whether the area meets the requirements; whether the role identity meets the requirements; whether the operator is on a specific list. If any of the above business operation rules is not met, it can be judged that the operation is unauthorized.

[0055] Step S13: Mark the business operation request as unauthorized and record it in the business operation log, and then proceed to step S14.

[0056] Step S14: the business operation request is judged according to the alarm notification rule, and if it meets the alarm notification rule, the relevant personnel are notified.

[0057] Step S15: Determine whether the business operation request complies with business compliance rules; If it is determined that the business operation request does not comply with the business compliance rules, go to step S16, otherwise jump to step S17.

[0058] Step S16: Mark the business operation request as non-compliant and record it in the business operation log. Push the marked non-compliant business operation log to the internal audit role for audit. If the internal audit determines that the business operation request is compliant, jump to step S17; otherwise, determine that the business operation request is non-compliant and end the audit of the operation request.

[0059] Step S17: The operation log records and marks the business operation request as compliant.

[0060] The present application also provides a business security audit system 100, which is applied to a server. Figure 3 As shown, the business security audit system 100 includes: Login port 11, which is configured to receive an account login application initiated by a client and generate login credentials; The role determination module 12 is configured to obtain the personnel information and role identity corresponding to the login account based on the login credentials, wherein the role identity includes a non-audit role, an internal audit role, an external security audit role, and an external business security audit role; The authority setting module 13 is configured to establish audit operation authority based on the role identity of the login account.

[0061] According to the business security audit system 100 provided in this application, internal audit roles and external audit roles are distinguished, and some permissions related to external audit are provided, so that external audit roles can view information online without offline retrieval, thereby improving the efficiency of external audit work.

[0062] As an optional implementation, the permission setting module 13 is configured as follows: In response to the role identity of the login account being an external security audit role, the audit operation permissions of the login account are configured to include: security rule viewing, alarm notification record viewing, and business operation log viewing marked as unauthorized; In response to the login account's role identity being an external business audit role, the audit operation permissions configured for the login account include: Mark compliance and non-compliance business operation logs for review, and security audit records for non-compliant business operations; Among them, based on the preset business operation authority rules and business compliance rules, the business operation requests initiated by the login account of the non-audit role identity are judged, and the judgment results are marked and recorded to obtain a marked business operation log; the marked non-compliant business operations are pushed to the internal audit role, and the internal audit role generates a security audit record of the non-compliant business operations after auditing.

[0063] According to the business security audit system 100 provided by the present application, operation marks (overauthorization, compliance, non-compliance) are made in the business operation log, and the external security audit role is provided with the permission to view the business operation log marked as "overauthorization", and the external business audit role is provided with the permission to view the business operation log marked as "compliance" and "non-compliance". In this way, the needs of external audit can be met while avoiding the leakage of internal business information, thereby improving the efficiency of external audit.

[0064] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document does not limit this.

[0065] In the description of this application, the terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. "Multiple" means two or more, unless otherwise clearly and specifically defined.

[0066] The above disclosure is only the preferred embodiment of the present application, but it is not intended to limit the scope of rights of the present application. A person of ordinary skill in the art can understand that without departing from the spirit and scope of the present application and the appended claims, changes, modifications, substitutions, combinations, and simplifications should all be equivalent replacement methods and still fall within the scope of the invention.

[0067] Although the preferred embodiments of the present application have been disclosed for illustrative purposes, those skilled in the art will appreciate that various modifications, additions and substitutions are possible, without departing from the scope and spirit of the application as disclosed in the accompanying claims.

Claims

1. A business security audit method, the method is applied to a server, characterized in that: The method comprises the following steps: Provide a login port, receive account login applications initiated by clients, and generate login credentials; Based on the login credentials, obtain the personnel information and role identity corresponding to the login account, wherein the role identity includes a non-audit role, an internal audit role, an external security audit role, and an external business audit role; Audit operation permissions are established based on the role identity of the login account.

2. The business security audit method according to claim 1, characterized in that: The method further comprises: In response to the role identity of the login account being an external security audit role, the audit operation permissions of the login account include: security rule viewing, alarm notification record viewing, and business operation log viewing marked as unauthorized; In response to the role identity of the login account being an external business audit role, the audit operation permissions of the login account include: Mark compliance and non-compliance business operation logs for review, and security audit records for non-compliant business operations; Among them, based on the preset business operation authority rules and business compliance rules, the business operation requests initiated by the login account of the non-audit role identity are judged, and the judgment results are marked and recorded to obtain the marked business operation log; the marked non-compliant business operations are pushed to the internal audit role, and the internal audit role generates a security audit record of the non-compliant business operations after auditing.

3. The business security audit method according to claim 1, characterized in that: The method further comprises: Configure business operation permission rules, including determining whether at least some business scenarios are allowed to be operated in the non-logged-in state; Providing a business operation request receiving port to receive business operation requests; Parsing the business operation request to obtain business information of the business operation request, and determining whether there is a login credential; Based on the business information and in combination with the business operation authority rules, determine whether the business scenario corresponding to the business operation request allows operation in a non-logged-in state; if operation in a non-logged-in state is not allowed and the business operation request has no login credentials, reject the business operation request, mark the business operation request as unauthorized and record it in the business operation log.

4. The business security audit method according to claim 3 is characterized in that: The method further comprises: Configure business operation permission rules, including establishing the role types that are allowed to operate in at least some business scenarios; If the business operation request contains the login credentials, then the role identity corresponding to the login account is obtained based on the login credentials, In combination with the business operation authority rules, determine whether the role identity of the initiator of the business operation request meets the role type requirements of the business scenario. If not, reject the business operation request, mark the business operation request as unauthorized and record it in the business operation log.

5. The business security audit method according to claim 4 is characterized in that: The method further comprises: Configure business operation permission rules, including establishing a list of personnel who are allowed to operate at least some business scenarios; If the business operation request contains the login credentials, obtaining the personnel information corresponding to the login account based on the login credentials; In combination with the business operation authority rules, determine whether the personnel information of the initiator of the business operation request meets the personnel list requirements of the business scenario. If not, reject the business operation request, mark the business operation request as unauthorized and record it in the business operation log.

6. The business security audit method according to any one of claims 3 to 5, characterized in that: The method further comprises: Configure business operation permission rules, including establishing the IP segments and regional scopes that are allowed to operate in at least some business scenarios; In response to receiving the service operation request, parsing the service operation request to obtain an IP address of the service operation request; Querying the region information where the service operation request is initiated based on the IP address; In combination with the business operation authority rule, determine whether the IP address of the business operation request meets the IP segment requirement of the business scenario; if not, reject the business operation request, mark the business operation request as unauthorized and record it in the business operation log; It is determined whether the region information of the business operation request meets the region range requirement of the business scenario. If not, the business operation request is rejected, the business operation request is marked as unauthorized and recorded in the business operation log.

7. The business security audit method according to claim 6, characterized in that: The method further comprises: In response to the business operation request complying with the business operation authority rule, determining whether the business operation request complies with the business compliance rule; If it is determined that the business operation request does not comply with the business compliance rule, marking the business operation request as non-compliant and recording it in the business operation log; The business operation log marked as non-compliant is pushed to the internal audit role for audit by the internal audit role. If the internal audit determines that the business operation request is compliant, the operation log records and marks the business operation request as compliant.

8. The business security audit method according to claim 6, characterized in that: The method further comprises: Configure alarm notification rules, including determining whether unauthorized operations in at least some business scenarios require alarm notifications; In response to the business operation request being marked as unauthorized, the business operation request is judged according to an alarm notification rule, and if it meets the alarm notification rule, relevant personnel are notified.

9. A business security audit system, the business security audit system is applied to a server, characterized in that: The business security audit system includes: A login port, wherein the login port is configured to receive an account login application initiated by a client and generate login credentials; A role determination module, wherein the role determination module is configured to obtain the personnel information and role identity corresponding to the login account based on the login credentials, wherein the role identity includes a non-audit role, an internal audit role, an external security audit role, and an external business security audit role; A permission setting module is configured to establish audit operation permissions based on the role identity of the login account.

10. The business security audit system according to claim 9, characterized in that: The permission setting module is configured as follows: In response to the role identity of the login account being an external security audit role, configuring the audit operation permissions of the login account to include: security rule viewing, alarm notification record viewing, and business operation log viewing marked as unauthorized; In response to the role identity of the login account being an external business audit role, configuring the audit operation authority of the login account includes: Mark compliance and non-compliance business operation logs for review, and security audit records for non-compliant business operations; Among them, based on the preset business operation authority rules and business compliance rules, the business operation requests initiated by the login account of the non-audit role identity are judged, and the judgment results are marked and recorded to obtain the marked business operation log; the marked non-compliant business operations are pushed to the internal audit role, and the internal audit role generates a security audit record of the non-compliant business operations after auditing.

Images