Method and system for restricting access service through network domain, and storage medium

Abstract

The invention discloses a method and system for limiting access service through a network domain and a storage medium, and the method comprises the steps: a DMZ network domain receives a cross-domain access request, analyzes the cross-domain access request, and carries out the verification; if the check is passed, the DMZ network domain forwards the cross-domain access request to a target network domain for access, and if the check is not passed, the cross-domain access request is refused; and when the time for the cross-domain access request to access the target network domain reaches the access authorization time, refusing the cross-domain access request to continue to access the target network domain. The method for limiting the access service through the network domain is used for supporting temporary cross-domain access in a secure network domain control scene, and based on an auditing mechanism, only a cross-domain access request user passing the auditing is allowed to access a cross-domain target network domain within the access authorization time, so that the access efficiency is greatly improved. In this way, a finer-grained control mechanism is provided, and it is ensured that only authorized users can access authorized resources within authorized time.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and specifically provides a method, system and storage medium for penetrating network domain restricted access services. Background Art

[0002] In today's information technology field, network domain control is a common security mechanism used to limit users or systems' access to network resources. This mechanism ensures that only authorized users can access specific network resources, thereby protecting network security and data integrity. Network domains are usually divided according to security levels, organizational structures, or other criteria. Each domain may have different security policies and access control rules.

[0003] However, in some cases, users need to access specific services or resources across domains for a short period of time. For example, an employee may need to temporarily access services in the production network domain from the office network domain to locate or troubleshoot an online fault. In this case, traditional network domain control mechanisms may not be sufficient to meet the needs because they usually do not allow or are not designed to support cross-domain access.

[0004] Existing solutions to support cross-domain access usually involve opening specific ports or networks so that users can access resources across domains. The main problem with this approach is that it lacks sufficient control granularity. Once a port or network is opened, any user who can access that port or network can access the corresponding resources, regardless of whether they have permission to do so. This can lead to security vulnerabilities and data leaks because there is no way to ensure that only authorized users can access resources.

[0005] In addition, existing solutions often lack time-limit controls. Once ports or networks are opened, they may remain open until administrators manually close them. This means that users may access resources outside of authorized hours, increasing security risks.

[0006] At the same time, existing cross-domain access control solutions usually do not have an effective operation monitoring mechanism. While allowing users to access across domains, it is also necessary to record and audit users' operation behaviors in real time in order to promptly discover and respond to illegal or abnormal behaviors. This is often overlooked in existing solutions.

[0007] In view of this, the present invention patent is proposed. Summary of the invention

[0008] In order to solve the problems of security vulnerabilities and insufficient control granularity in supporting cross-domain access in the prior art, the present invention proposes a method, system and storage medium for penetrating network domain restricted access services.

[0009] Specifically, the following technical solutions are adopted:

[0010] In a first aspect, the present invention provides a method for penetrating network domain restricted access services, comprising:

[0011] The DMZ network domain receives the cross-domain access request, parses the cross-domain access request and performs an audit;

[0012] If the review is passed, the DMZ network domain forwards the cross-domain access request to the target network domain for access; if the review is not passed, the cross-domain access request is rejected;

[0013] When the time for the cross-domain access request to access the target network domain reaches the access authorization time, the cross-domain access request is denied to continue accessing the target network domain.

[0014] As an optional implementation of the present invention, in a method of penetrating network domain restricted access services of the present invention, the DMZ network domain receives a cross-domain access request, and parsing the cross-domain access request and conducting an audit includes:

[0015] The DMZ network domain receives the cross-domain access request, and parses the cross-domain access request to obtain the target network domain, the system in the target network domain, the requesting account, and the requested access authorization time;

[0016] Perform identity authentication and service access permission authentication of the cross-domain access requesting user based on the requesting account;

[0017] When the identity authentication and the access service authority authentication are passed at the same time, the audit is passed, otherwise, the audit is not passed.

[0018] As an optional implementation of the present invention, in a method of penetrating network domain restriction access services of the present invention, the identity authentication of the cross-domain access requesting user based on the requesting account includes:

[0019] According to the ID of the requesting account, determine whether there is an authenticated and valid session;

[0020] If it exists, the identity authentication is skipped and the identity authentication is passed;

[0021] If it does not exist, it will further determine whether the ID of the requesting account is valid. If it is valid, the identity authentication is successful. If it is invalid, the identity authentication fails.

[0022] As an optional implementation of the present invention, in a method of penetrating network domain restriction access services of the present invention, the access service authority authentication of the cross-domain access requesting user based on the requesting account includes:

[0023] After the identity authentication of the cross-domain access requesting user is passed, judging whether the cross-domain access requesting user has the authority to access the system in the target network domain according to the requesting account;

[0024] If the judgment result is yes, the access service authority authentication is passed; if the judgment result is no, the access service authority authentication is not passed;

[0025] Optionally, judging whether the cross-domain access requesting user has the authority to access the system in the target network domain according to the requesting account includes:

[0026] Determine whether the permission scope of the requesting account covers the systems in the target network domain;

[0027] and / or, determining whether the requesting account meets the account level requirements for accessing system permissions within the target network domain;

[0028] and / or, determining whether the requesting account has special authorization to access systems within the target network domain;

[0029] And / or, determine whether the requesting account is in the blacklist / whitelist of the system in the target network domain.

[0030] As an optional implementation manner of the present invention, in a method of penetrating network domain restricted access services of the present invention, the DMZ network domain forwarding the cross-domain access request to the target network domain for access includes:

[0031] The DMZ network domain converts the target network domain and the system in the target network domain in the cross-domain access request into a cross-domain domain name;

[0032] The cross-domain access request initiates a cross-domain access request through the cross-domain domain name to access a system in a target network domain.

[0033] As an optional implementation mode of the present invention, a method of penetrating network domain restricted access services of the present invention includes:

[0034] During the process of the cross-domain access request accessing the target network domain, real-time auditing is performed relying on the built-in sensitive data rule library;

[0035] When the sensitive data rule base is triggered during cross-domain access, the illegal access information is recorded, and an early warning is issued or the current cross-domain access is blocked.

[0036] As an optional implementation mode of the present invention, a method of penetrating network domain restricted access services of the present invention includes:

[0037] During the process of the cross-domain access request accessing the target network domain, logging the cross-domain access;

[0038] Cross-domain access activities are tracked based on the log records.

[0039] In a second aspect, the present invention provides a system for penetrating network domain restricted access services, comprising:

[0040] DMZ network domain module;

[0041] Multiple network domain modules are respectively connected to the DMZ network domain modules for communication;

[0042] The DMZ network domain module receives the cross-domain access request, parses the cross-domain access request and performs an audit;

[0043] If the audit is passed, the DMZ network domain module forwards the cross-domain access request to the target network domain module for access; if the audit is not passed, the cross-domain access request is rejected;

[0044] When the time for the cross-domain access request to access the target network domain module reaches the access authorization time, the cross-domain access request is denied to continue accessing the target network domain module.

[0045] As an optional implementation of the present invention, the DMZ network domain module includes a cross-domain authentication subsystem, a cross-domain authorization subsystem and a cross-domain proxy subsystem:

[0046] The DMZ network domain receives the cross-domain access request, and parses the cross-domain access request to obtain the target network domain, the system in the target network domain, the requesting account, and the requested access authorization time;

[0047] The cross-domain authentication subsystem performs identity authentication and service access authority authentication of the cross-domain access requesting user based on the requesting account;

[0048] After the identity authentication of the cross-domain access requesting user is passed, the cross-domain authorization subsystem determines whether the cross-domain access requesting user has the authority to access the system in the target network domain according to the requesting account, and performs cross-domain access authorization for the cross-domain access request according to the requested access authorization time;

[0049] The cross-domain proxy subsystem converts the target network domain and the system in the target network domain in the cross-domain access request into a cross-domain domain name;

[0050] The cross-domain access request initiates a cross-domain access request through the cross-domain domain name to access a system in a target network domain.

[0051] In a third aspect, the present invention provides a computer-readable recording medium storing a computer-executable program, which, when executed, implements a method for penetrating network domain restricted access services as described in any one of claims 1-7.

[0052] Compared with the prior art, the present invention has the following beneficial effects:

[0053] A method and system for penetrating network domain restricted access services of the present invention has the following functions:

[0054] Fine-grained access control: Since the control granularity of the prior art is coarse, the present invention proposes access control based on user identity and service level. Therefore, the present invention can control user access more accurately, allowing only specific users to access specific services at specific times. This reduces security risks because even if a user's rights are abused, it is limited to specific services and will not affect the entire network.

[0055] Time control: The existing technology lacks time control, and the present invention provides an automatic granting and revoking mechanism for temporary access rights. Therefore, the present invention can ensure that the user's cross-domain access rights are valid within a specific time period and automatically expire after that.

[0056] This further enhances security because even if permissions are granted, users cannot access resources outside of authorized hours.

[0057] Real-time auditing and logging: The prior art lacks detailed user operation records, and the present invention implements real-time auditing and logging functions. Therefore, the present invention can record all cross-domain access behaviors and provide transparent tracking and monitoring means. This helps detect and prevent unauthorized access and provides valuable data for post-analysis.

[0058] Through the above functions, we can derive the advantages of the present invention:

[0059] Enhanced security: The risk of unauthorized access is significantly reduced through fine-grained access control and time-limit control.

[0060] Improved monitoring capabilities: Real-time auditing and logging capabilities enable cross-domain access activities to be effectively monitored and tracked.

[0061] Better user experience: Users can access required services temporarily as needed, while the system is easy to operate.

[0062] Flexibility and controllability: System administrators can precisely control user access rights to adapt to different business needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 A flowchart of a method for penetrating network domain restrictions to access services according to a first embodiment of the present invention;

[0064] Figure 2 A system diagram of a system for penetrating network domain restricted access services according to a first embodiment of the present invention;

[0065] Figure 3 A schematic structural diagram of an electronic device according to a second embodiment of the present invention;

[0066] Figure 4 A schematic diagram of a computer-readable recording medium according to a second embodiment of the present invention. DETAILED DESCRIPTION

[0067] To make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be described clearly and completely in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them.

[0068] Therefore, the following detailed description of the embodiments of the present invention is not intended to limit the scope of the invention claimed for protection, but merely represents some embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0069] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features and technical solutions in the embodiments may be combined with each other.

[0070] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0071] In the description of the present invention, it should be noted that the orientation or positional relationship indicated by the terms "upper", "lower", etc. is based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the invention product is usually placed when in use, or the orientation or positional relationship commonly understood by those skilled in the art. Such terms are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0072] Embodiment 1

[0073] See also Figure 1 As shown, a method for penetrating network domain restriction access services in this embodiment includes:

[0074] The DMZ network domain receives the cross-domain access request, parses the cross-domain access request and performs an audit;

[0075] If the review is passed, the DMZ network domain forwards the cross-domain access request to the target network domain for access; if the review is not passed, the cross-domain access request is rejected;

[0076] When the time for the cross-domain access request to access the target network domain reaches the access authorization time, the cross-domain access request is denied to continue accessing the target network domain.

[0077] A method of penetrating a network domain to restrict access to a service in this embodiment is used to support temporary cross-domain access in a secure network domain control scenario. Based on an audit mechanism, the system only allows audited cross-domain access request users to access the cross-domain target network domain within the access authorization time. In this way, a method of penetrating a network domain to restrict access to a service in this embodiment provides a more fine-grained control mechanism to ensure that only authorized users can access authorized resources within the authorized time.

[0078] Through these functions, the present invention aims to solve the security vulnerabilities and insufficient control granularity problems existing in the prior art in supporting cross-domain access, and at the same time provide a safer and more flexible cross-domain access solution.

[0079] Furthermore, in a method for penetrating network domain restriction access services of this embodiment, the DMZ network domain receives a cross-domain access request, and parsing and reviewing the cross-domain access request includes:

[0080] The DMZ network domain receives the cross-domain access request, and parses the cross-domain access request to obtain the target network domain, the system in the target network domain, the requesting account, and the requested access authorization time;

[0081] Perform identity authentication and service access permission authentication of the cross-domain access requesting user based on the requesting account;

[0082] When the identity authentication and the access service authority authentication are passed at the same time, the audit is passed, otherwise, the audit is not passed.

[0083] In this embodiment, a method for restricting access to services through network domains is provided. The audit mechanism uses user identity authentication (Identity Proofing System, IPS) and service authorization, and only allows designated users to access designated services across domains within a designated time. In this way, the present invention provides a more fine-grained control mechanism to ensure that only authorized users can access authorized resources within the authorized time.

[0084] Specifically, in a method for penetrating network domain restrictions to access services in this embodiment, the identity authentication of the cross-domain access requesting user based on the requesting account includes:

[0085] According to the ID of the requesting account, determine whether there is an authenticated and valid session;

[0086] If it exists, the identity authentication is skipped and the identity authentication is passed;

[0087] If it does not exist, it will further determine whether the ID of the requesting account is valid. If it is valid, the identity authentication is successful. If it is invalid, the identity authentication fails.

[0088] Session is a container used by the server to store client information, which is implemented based on Cookie. When the client accesses the server for the first time, the server will create a Session object and store it in the client's Cookie. When the client accesses the server again, the browser will automatically send this Cookie to the server, and the server will obtain the session object by reading the information in the Cookie, thereby realizing the preservation of user status and data sharing. Therefore, when the present embodiment performs user identity authentication, if the user has been authenticated before and the session is valid, the authentication is skipped this time, thereby improving the efficiency of identity authentication.

[0089] Specifically, in a method for penetrating network domain restrictions to access services in this embodiment, the authentication of access service authority of the cross-domain access requesting user based on the requesting account includes:

[0090] After the identity authentication of the cross-domain access requesting user is passed, judging whether the cross-domain access requesting user has the authority to access the system in the target network domain according to the requesting account;

[0091] If the judgment result is yes, the access service authority authentication is passed, and if the judgment result is no, the access service authority authentication is not passed.

[0092] The method of penetrating network domain restrictions to access services in this embodiment can provide fine-grained control capabilities when authorizing users to access across domains through access service authority authentication, and can accurately specify which users can access which services, thereby enhancing security.

[0093] Optionally, judging whether the cross-domain access requesting user has the authority to access the system in the target network domain according to the requesting account includes:

[0094] Determine whether the permission scope of the requesting account covers the system in the target network domain. If the judgment result is yes, the cross-domain access requesting user has the permission to access the system in the target network domain. If the judgment result is no, the cross-domain access requesting user does not have the permission to access the system in the target network domain.

[0095] and / or, determining whether the requesting account meets the account level requirements for accessing the system in the target network domain; if the determination result is yes, the cross-domain access requesting user has the permission to access the system in the target network domain; if the determination result is no, the cross-domain access requesting user does not have the permission to access the system in the target network domain;

[0096] and / or, determining whether the requesting account has access to the target network domain system through special authorization, if the determination result is yes, the cross-domain access requesting user has the authority to access the target network domain system, if the determination result is no, the cross-domain access requesting user does not have the authority to access the target network domain system;

[0097] And / or, determine whether the requesting account is in the black / white list of the system in the target network domain. If it is in the white list, the cross-domain access requesting user has the authority to access the system in the target network domain. If it is in the black list, the cross-domain access requesting user does not have the authority to access the system in the target network domain.

[0098] In addition, the above judgment method of judging whether the cross-domain access requesting user has the authority to access the system in the target network domain according to the requesting account can be selected or combined.

[0099] In a method for penetrating network domain restricted access services of this embodiment, the DMZ network domain forwarding the cross-domain access request to the target network domain for access includes:

[0100] The DMZ network domain converts the target network domain and the system in the target network domain in the cross-domain access request into a cross-domain domain name;

[0101] The cross-domain access request initiates a cross-domain access request through the cross-domain domain name to access a system in a target network domain.

[0102] The DMZ network domain of this embodiment converts the cross-domain access request into a cross-domain domain name, thereby realizing cross-domain access.

[0103] A method for penetrating network domain restriction access services in this embodiment also includes:

[0104] During the process of the cross-domain access request accessing the target network domain, real-time auditing is performed relying on the built-in sensitive data rule library;

[0105] When the sensitive data rule base is triggered during cross-domain access, the illegal access information is recorded, and an early warning is issued or the current cross-domain access is blocked.

[0106] The method for penetrating network domain restricted access services of this embodiment also provides a real-time audit mechanism for real-time auditing of all operations of users, which helps to detect and prevent illegal operations of users and handle illegal operations in a timely manner.

[0107] A method for penetrating network domain restriction access services in this embodiment also includes:

[0108] During the process of the cross-domain access request accessing the target network domain, logging the cross-domain access;

[0109] Cross-domain access activities are tracked based on the log records.

[0110] The method of penetrating network domain restricted access services in this embodiment also provides log records of users' cross-domain access behaviors, thereby achieving transparency and traceability of cross-domain access activities. The log records of users' cross-domain access can be viewed at any time to timely detect abnormal behaviors and ensure the security and stability of the system.

[0111] As a specific implementation of a method for penetrating network domain restrictions to access services in this embodiment, a detailed description of a method for penetrating network domain restrictions to access services includes:

[0112] 1. The user applies for cross-domain access and submits a cross-domain access request. The cross-domain access request includes the target network domain, the system (IP port) within the target network domain, the requesting account, and the requested access authorization time.

[0113] 2. After the DMZ network domain is approved, the system allocates a cross-domain third-level domain name. Users use the allocated domain name to initiate a cross-domain access request to the target network domain system (IP port). For example, accessing the cross-domain address: http: / / 10.0.12.2:8080 / users is converted by the DMZ network domain into: http: / / test-testns.idmz.xxxxx.cc / users .

[0114] 3. Perform user identity authentication in the DMZ network domain. If the previous authentication session exists and is valid, the authentication is automatically skipped.

[0115] 4. The DMZ network domain checks whether the user has permission to access the system (IP port) in the target network domain and whether it is within the validity period. If it is in compliance, temporary access rights are granted; otherwise, they are denied.

[0116] 5. Users perform cross-domain access.

[0117] 6. The DMZ network domain records user operations and request response data, relying on a built-in sensitive data rule library for real-time auditing.

[0118] 7. Service authorization will be automatically revoked after the preset time expires.

[0119] In summary, the method for penetrating network domain restriction access services in this embodiment has the following functions:

[0120] Fine-grained access control: Since the control granularity of the prior art is coarse, the present invention proposes access control based on user identity and service level. Therefore, the present invention can control user access more accurately, allowing only specific users to access specific services at specific times. This reduces security risks because even if a user's rights are abused, it is limited to specific services and will not affect the entire network.

[0121] Time control: The existing technology lacks time control, and the present invention provides an automatic granting and revoking mechanism for temporary access rights. Therefore, the present invention can ensure that the user's cross-domain access rights are valid within a specific time period and automatically expire after that.

[0122] This further enhances security because even if permissions are granted, users cannot access resources outside of authorized hours.

[0123] Real-time auditing and logging: The prior art lacks detailed user operation records, and the present invention implements real-time auditing and logging functions. Therefore, the present invention can record all cross-domain access behaviors and provide transparent tracking and monitoring means. This helps detect and prevent unauthorized access and provides valuable data for post-analysis.

[0124] Through the above functions, we can derive the advantages of the present invention:

[0125] Enhanced security: The risk of unauthorized access is significantly reduced through fine-grained access control and time-limit control.

[0126] Improved monitoring capabilities: Real-time auditing and logging capabilities enable cross-domain access activities to be effectively monitored and tracked.

[0127] Better user experience: Users can access required services temporarily as needed, while the system is easy to operate.

[0128] Flexibility and controllability: System administrators can precisely control user access rights to adapt to different business needs.

[0129] See also Figure 2 As shown, this embodiment also provides a system for penetrating network domain restricted access services, including:

[0130] DMZ network domain module;

[0131] Multiple network domain modules are respectively connected to the DMZ network domain modules for communication;

[0132] The DMZ network domain module receives the cross-domain access request, parses the cross-domain access request and performs an audit;

[0133] If the audit is passed, the DMZ network domain module forwards the cross-domain access request to the target network domain module for access; if the audit is not passed, the cross-domain access request is rejected;

[0134] When the time for the cross-domain access request to access the target network domain module reaches the access authorization time, the cross-domain access request is denied to continue accessing the target network domain module.

[0135] A system for penetrating network domain restricted access services in this embodiment is used to support temporary cross-domain access in a secure network domain control scenario. Based on an audit mechanism, the system only allows audited cross-domain access request users to access the cross-domain target network domain within the access authorization time. In this way, a system for penetrating network domain restricted access services in this embodiment provides a more fine-grained control mechanism to ensure that only authorized users can access authorized resources within the authorized time.

[0136] Through these functions, the present invention aims to solve the security vulnerabilities and insufficient control granularity problems existing in the prior art in supporting cross-domain access, and at the same time provide a safer and more flexible cross-domain access solution.

[0137] Furthermore, the DMZ network domain module includes a cross-domain authentication subsystem, a cross-domain authorization subsystem and a cross-domain proxy subsystem:

[0138] The DMZ network domain receives the cross-domain access request, and parses the cross-domain access request to obtain the target network domain, the system in the target network domain, the requesting account, and the requested access authorization time;

[0139] The cross-domain authentication subsystem performs identity authentication and service access authority authentication of the cross-domain access requesting user based on the requesting account;

[0140] After the identity authentication of the cross-domain access requesting user is passed, the cross-domain authorization subsystem determines whether the cross-domain access requesting user has the authority to access the system in the target network domain according to the requesting account, and performs cross-domain access authorization for the cross-domain access request according to the requested access authorization time;

[0141] The cross-domain proxy subsystem converts the target network domain and the system in the target network domain in the cross-domain access request into a cross-domain domain name;

[0142] The cross-domain access request initiates a cross-domain access request through the cross-domain domain name to access a system in a target network domain.

[0143] In this embodiment, a system for penetrating network domain restricted access services, the cross-domain authentication subsystem audit mechanism adopts user identity authentication (Identity Proofing System, IPS) and service authorization, and only allows designated users to access designated cross-domain services within a specified time. In this way, the present invention provides a more fine-grained control mechanism to ensure that only authorized users can access authorized resources within the authorized time.

[0144] In this embodiment, a system for penetrating network domain restricted access services, the DMZ network domain module also includes a real-time audit subsystem:

[0145] During the process of the cross-domain access request accessing the target network domain, the real-time audit subsystem relies on the built-in sensitive data rule library to perform real-time audit;

[0146] When the sensitive data rule base is triggered during cross-domain access, the real-time audit subsystem records the illegal access information and issues an early warning or blocks the current cross-domain access.

[0147] The real-time audit subsystem of this embodiment also provides a real-time audit mechanism for real-time auditing all operations of users, which helps to detect and prevent illegal operations of users and handle illegal operations in a timely manner.

[0148] In this embodiment, a system for penetrating network domain restricted access services, the DMZ network domain module also includes a log recording subsystem:

[0149] During the process of the cross-domain access request accessing the target network domain, the logging subsystem performs logging of the cross-domain access;

[0150] Cross-domain access activities are tracked based on the log records.

[0151] The present embodiment is a system for penetrating network domain restricted access services. The logging subsystem provides logging of users' cross-domain access behaviors, thereby achieving transparency and traceability of cross-domain access activities. The log records of users' cross-domain access can be viewed at any time to promptly detect abnormal behaviors and ensure the security and stability of the system.

[0152] Embodiment 2

[0153] The following describes an electronic device embodiment of the present invention, which can be regarded as a specific physical implementation of the method and device embodiments of the present invention. The details described in the electronic device embodiment of the present invention should be regarded as a supplement to the above method or device embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above method or device embodiments.

[0154] Figure 3 It is a structural diagram of an electronic device of an embodiment of the present invention, the electronic device includes a processor and a memory, the memory is used to store a computer executable program, when the computer program is executed by the processor, the processor executes a method of penetrating network domain restricted access services in embodiment one.

[0155] like Figure 3As shown, the electronic device is presented in the form of a general computing device. The processor may be one or more and work in coordination. The present invention does not exclude distributed processing, that is, the processor may be dispersed in different physical devices. The electronic device of the present invention is not limited to a single entity, but may also be the sum of multiple physical devices.

[0156] The memory stores a computer executable program, which is usually a machine-readable code. The computer-readable program can be executed by the processor to enable the electronic device to perform the method of the present invention, or at least part of the steps in the method.

[0157] The memory includes a volatile memory, such as a random access memory unit (RAM) and / or a cache memory unit, and may also be a non-volatile memory, such as a read-only memory unit (ROM).

[0158] Optionally, in this embodiment, the electronic device further includes an I / O interface, which is used for the electronic device to exchange data with an external device. The I / O interface can represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.

[0159] It should be understood that Figure 3 The electronic device shown is only an example of the present invention, and the electronic device of the present invention may also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as display screens, and some electronic devices also include human-computer interaction elements such as buttons, keyboards, etc. As long as the electronic device can execute the computer-readable program in the memory to implement the method of the present invention or at least part of the steps of the method, it can be considered as an electronic device covered by the present invention.

[0160] Figure 4 Schematic diagram of a computer readable recording medium according to an embodiment of the present invention. Figure 4As shown, a computer executable program is stored in a computer-readable recording medium, and when the computer executable program is executed, a method for penetrating a network domain to restrict access to a service according to Embodiment 1 of the present invention is implemented. The computer-readable recording medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable recording medium may also be any readable medium other than a readable recording medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, apparatus, or device. The program code contained on the readable recording medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0161] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0162] Through the above description of the implementation mode, it is easy for those skilled in the art to understand that the present invention can be implemented by hardware capable of executing a specific computer program, such as the system of the present invention, and the electronic processing unit, server, client, mobile phone, control unit, processor, etc. contained in the system. The present invention can also be implemented by computer software that executes the method of the present invention, such as control software executed by a microprocessor, an electronic control unit, a client, a server, etc. However, it should be noted that the computer software that executes the method of the present invention is not limited to being executed by one or a specific hardware entity, and it can also be implemented in a distributed manner by unspecified specific hardware. For computer software, the software product can be stored in a computer-readable recording medium (which can be a CD-ROM, a USB flash drive, a mobile disk, etc.), and can also be distributed and stored on the network, as long as it enables the electronic device to execute the method according to the present invention.

[0163] The above embodiments are only used to illustrate the present invention and are not intended to limit the technical solutions described in the present invention. Although the present invention has been described in detail with reference to the above embodiments, the present invention is not limited to the above specific implementation methods. Therefore, any modification or equivalent replacement of the present invention; and all technical solutions and improvements thereof that do not depart from the spirit and scope of the invention are included in the scope of the claims of the present invention.

Claims

1. A method for penetrating network domain restricted access services, characterized in that: include: The DMZ network domain receives the cross-domain access request, parses the cross-domain access request and performs an audit; If the review is passed, the DMZ network domain forwards the cross-domain access request to the target network domain for access; if the review is not passed, the cross-domain access request is rejected; When the time for the cross-domain access request to access the target network domain reaches the access authorization time, the cross-domain access request is denied to continue accessing the target network domain.

2. A method for penetrating network domain restricted access services according to claim 1, characterized in that: The DMZ network domain receives the cross-domain access request, and the parsing and reviewing of the cross-domain access request includes: The DMZ network domain receives the cross-domain access request, and parses the cross-domain access request to obtain the target network domain, the system in the target network domain, the requesting account, and the requested access authorization time; Perform identity authentication and service access permission authentication of the cross-domain access requesting user based on the requesting account; When the identity authentication and the access service authority authentication are passed at the same time, the audit is passed, otherwise, the audit is not passed.

3. A method for penetrating network domain restricted access services according to claim 2, characterized in that: The identity authentication of the cross-domain access requesting user based on the requesting account includes: According to the ID of the requesting account, determine whether there is an authenticated and valid session; If it exists, the identity authentication is skipped and the identity authentication is passed; If it does not exist, it will further determine whether the ID of the requesting account is valid. If it is valid, the identity authentication is successful. If it is invalid, the identity authentication fails.

4. A method for penetrating network domain restriction access services according to claim 3, characterized in that: The cross-domain access request user's access service authority authentication based on the request account includes: After the identity authentication of the cross-domain access requesting user is passed, judging whether the cross-domain access requesting user has the authority to access the system in the target network domain according to the requesting account; If the judgment result is yes, the access service authority authentication is passed; if the judgment result is no, the access service authority authentication is not passed; Optionally, judging whether the cross-domain access requesting user has the authority to access the system in the target network domain according to the requesting account includes: Determine whether the permission scope of the requesting account covers the systems in the target network domain; and / or, determining whether the requesting account meets the account level requirements for accessing system permissions within the target network domain; and / or, determining whether the requesting account has special authorization to access systems within the target network domain; And / or, determine whether the requesting account is in the blacklist / whitelist of the system in the target network domain.

5. A method for penetrating network domain restriction access services according to any one of claims 1 to 4, characterized in that: The DMZ network domain forwarding the cross-domain access request to the target network domain for access includes: The DMZ network domain converts the target network domain and the system in the target network domain in the cross-domain access request into a cross-domain domain name; The cross-domain access request initiates a cross-domain access request through the cross-domain domain name to access a system in a target network domain.

6. A method for penetrating network domain restriction access services according to claim 5, characterized in that: During the process of the cross-domain access request accessing the target network domain, real-time auditing is performed relying on the built-in sensitive data rule library; When the sensitive data rule base is triggered during cross-domain access, the illegal access information is recorded, and an early warning is issued or the current cross-domain access is blocked.

7. A method for penetrating network domain restriction access services according to claim 5, characterized in that: During the process of the cross-domain access request accessing the target network domain, logging the cross-domain access; Cross-domain access activities are tracked based on the log records.

8. A system for penetrating network domain restricted access services, characterized in that: include: DMZ network domain module; Multiple network domain modules are respectively connected to the DMZ network domain modules for communication; The DMZ network domain module receives the cross-domain access request, parses the cross-domain access request and performs an audit; If the audit is passed, the DMZ network domain module forwards the cross-domain access request to the target network domain module for access; if the audit is not passed, the cross-domain access request is rejected; When the time for the cross-domain access request to access the target network domain module reaches the access authorization time, the cross-domain access request is denied to continue accessing the target network domain module.

9. A system for penetrating network domain restricted access services according to claim 8, characterized in that: The DMZ network domain module includes a cross-domain authentication subsystem, a cross-domain authorization subsystem and a cross-domain proxy subsystem: The DMZ network domain receives the cross-domain access request, and parses the cross-domain access request to obtain the target network domain, the system in the target network domain, the requesting account, and the requested access authorization time; The cross-domain authentication subsystem performs identity authentication and service access authority authentication of the cross-domain access requesting user based on the requesting account; After the identity authentication of the cross-domain access requesting user is passed, the cross-domain authorization subsystem determines whether the cross-domain access requesting user has the authority to access the system in the target network domain according to the requesting account, and performs cross-domain access authorization for the cross-domain access request according to the requested access authorization time; The cross-domain proxy subsystem converts the target network domain and the system in the target network domain in the cross-domain access request into a cross-domain domain name; The cross-domain access request initiates a cross-domain access request through the cross-domain domain name to access a system in a target network domain.

10. A computer-readable recording medium storing a computer-executable program, characterized in that: When the computer executable program is executed, a method for penetrating network domain restriction access services as described in any one of claims 1 to 7 is implemented.

Images