Security access method, system and device for multi-user online education platform and medium

Abstract

The invention discloses a security access method, system and device for a multi-person online education platform and a medium, and the method comprises the steps that a client sends an access request to the education platform, and the education platform is a cloud platform; the education platform performs zero-trust authentication processing on the client according to the received access request, and after the zero-trust authentication processing is passed, the education platform sends authorization information to the client and injects a monitoring script into the authorization information; the client runs a monitoring script according to the received authorization information and establishes communication connection with the education platform, and when the monitoring script monitors that the client performs malicious operation, the monitoring script intercepts operation information sent by the client to the education platform and sends corresponding alarm information to the education platform; and after receiving the alarm information, the education platform processes the client according to the alarm information. According to the technical scheme of the invention, the multi-user online education platform can be accessed more safely and reliably, and malicious access is reduced.

Description

Technical Field

[0001] The present invention relates to the field of secure access technology, and in particular to a secure access method, system, device and medium for a multi-person online education platform. Background Art

[0002] With the rapid development of network technology, multi-person online education platforms are widely used in the field of education and learning. It is an education and learning platform that allows multiple users to participate and interact at the same time through Internet technology. Such platforms usually provide virtual classrooms, course management, real-time interaction, multimedia content, personalized learning, cross-platform support and other functions, which brings great convenience to the learning process.

[0003] However, due to the increasing number of registered users, the number of visits to multi-person online education platforms has also increased rapidly, including a considerable number of malicious visits, such as illegal access to databases, crawling teaching videos on web pages, stealing user information, and so on. The existing registration and login mode cannot effectively block malicious visits, and there is also a lack of effective supervision mechanism during the client access process, and the data security of the platform is worrying. Summary of the invention

[0004] The main purpose of the present invention is to provide a method, system, device and medium for secure access to a multi-person online education platform, aiming to enable safer and more reliable access to the multi-person online education platform and reduce the occurrence of malicious access.

[0005] To achieve the above-mentioned purpose, the present invention proposes a method for securely accessing a multi-person online education platform, comprising:

[0006] The client sends an access request to the education platform, where the education platform is a cloud platform;

[0007] The education platform performs zero-trust authentication processing on the client according to the received access request. After the zero-trust authentication processing is passed, the education platform sends authorization information to the client and injects a monitoring script into the authorization information, wherein the authorization information is used to establish a communication connection with the client, and the monitoring script is used to monitor malicious operation behaviors of the client;

[0008] The client runs the monitoring script according to the received authorization information and establishes a communication connection with the education platform, wherein when the monitoring script detects malicious operations by the client, it intercepts the operation information sent by the client to the education platform and sends corresponding alarm information to the education platform;

[0009] After receiving the alarm information, the education platform processes the client according to the alarm information.

[0010] In one embodiment of the present invention, the step of performing zero-trust authentication processing on the client by the education platform according to the received access request includes:

[0011] In response to the received access request, the education platform constructs a SPA authentication package, encrypts it, and then sends it to the client;

[0012] The client decrypts the SPA authentication package, obtains the authentication code, and initiates a communication request to the education platform;

[0013] The education platform verifies the authentication code, and if the verification is successful, sends authorization information to the client.

[0014] In one embodiment of the present invention, the client runs the monitoring script according to the received authorization information and establishes a communication connection with the education platform, including:

[0015] After receiving the authorization information, the client installs and runs the monitoring script in the authorization information;

[0016] The monitoring script establishes a heartbeat connection with the education platform to ensure the continuous activation and updating of the monitoring script;

[0017] After the test monitoring script runs successfully, the education platform completes the communication connection with the client.

[0018] In one embodiment of the present invention, the monitoring script is a Service Worker script.

[0019] In one embodiment of the present invention, after the education platform receives the alarm information, the step of processing the client according to the alarm information includes:

[0020] The education platform compares and analyzes the received alarm information with the preset security policy, and processes the client according to the analysis results, including disconnecting the communication connection, prohibiting access to the database, and sending a warning message;

[0021] The education platform records the processed information as log data.

[0022] In one embodiment of the present invention, after the step of recording the processed information as log data, the education platform further includes:

[0023] The education platform records the identity information of the client, analyzes all log data corresponding to the client, and determines whether the client is a malicious client based on the analysis results;

[0024] The identity information of malicious clients is added to a blacklist, and the clients in the blacklist are prohibited from establishing a communication connection with the education platform.

[0025] In one embodiment of the present invention, the step of analyzing all log data corresponding to the client and determining whether the client is a malicious client according to the analysis result includes:

[0026] The ratio of the number of malicious operations of the client to the number of communication establishments is calculated, and the ratio is compared with a preset threshold, and the client whose ratio exceeds the preset threshold is determined to be a malicious client.

[0027] The present invention also provides a secure access system for a multi-person online education platform, comprising:

[0028] Client side;

[0029] Educational platform;

[0030] A zero-trust authentication unit, used to perform zero-trust authentication processing on the client according to the received client access request;

[0031] A script running unit, used to inject a monitoring script into the authorization information sent by the education platform to the client, and establish a connection after the monitoring script is installed and run. When the monitoring script detects malicious operations by the client, it intercepts the operation information sent by the client to the education platform and sends corresponding alarm information to the education platform;

[0032] The alarm processing unit is used to process the client according to the alarm information after the education platform receives the alarm information.

[0033] The present invention also provides an electronic device, comprising:

[0034] Memory, used to store computer programs;

[0035] A processor is used to execute the computer program to implement the secure access method for a multi-person online education platform as described in any one of the above items.

[0036] The present invention also provides a computer-readable storage medium, characterized in that it is used to store a computer program, and when the computer program is executed by a processor, the method for securely accessing a multi-person online education platform as described in any one of the above items is executed.

[0037] The technical solution of the present invention provides double protection by performing zero-trust authentication when the client applies for access to the education platform, and using monitoring scripts to monitor malicious operations during the client access process, thereby making the client's access to the education platform safer and reducing the possibility of malicious access. For online education platforms that are visited a large number of times every day, the security of their databases and user information is undoubtedly guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0039] Figure 1 A schematic flow chart of the steps of a method for securely accessing a multi-person online education platform according to the present invention;

[0040] Figure 2 A flowchart of the steps for performing zero-trust authentication on a client;

[0041] Figure 3 A flowchart of the steps for running the monitoring script and establishing a communication connection with the education platform;

[0042] Figure 4 A flowchart showing the steps for an education platform to handle malicious client operations.

[0043] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0045] Reference Figure 1 The present invention proposes a method for securely accessing a multi-person online education platform, comprising:

[0046] S100, the client sends an access request to the education platform, which is a cloud platform;

[0047] S200, the education platform performs zero-trust authentication processing on the client according to the received access request. After the zero-trust authentication processing is passed, the education platform sends authorization information to the client and injects a monitoring script into the authorization information, wherein the authorization information is used to establish a communication connection with the client, and the monitoring script is used to monitor malicious operations of the client;

[0048] S300, the client runs the monitoring script according to the received authorization information and establishes a communication connection with the education platform, wherein the monitoring script intercepts the operation information sent by the client to the education platform when detecting malicious operation by the client, and sends corresponding alarm information to the education platform;

[0049] S400, after receiving the alarm information, the education platform processes the client according to the alarm information.

[0050] Understandably, when the client wants to establish a communication connection with the education platform, it first sends an access request to the education platform, and the education platform initiates zero-trust authentication to the client. Zero trust is a security concept that assumes that the internal network is no more trustworthy than the external network. Therefore, all users who attempt to access resources need to be authenticated and authorized, no matter where they are located, thereby increasing the security of access. Common zero-trust access technologies include zero-trust gateways, zero-trust security models, SPA single-package knocking technology, etc. When the client passes the authentication, the education platform allows the client to establish a connection, sends authorization information to the client, and injects a monitoring script into the authorization information. The monitoring script can be Service Worker, Background Sync API, Web Socket, etc., which can intercept all requests initiated by the client, make judgments, and then forward the request to the education platform, thereby monitoring the client's operations. When the client is detected to illegally access the database, capture web videos, steal resource information, and other malicious operations, the operation is immediately intercepted and an alarm message is sent to the education platform. The education platform warns the client, disconnects, prohibits access, and other operations based on the alarm information.

[0051] Through the dual protection of zero-trust authentication and monitoring scripts, the client's access to the education platform is relatively safe, reducing the possibility of malicious access. For online education platforms that receive a large number of visits every day, this undoubtedly ensures the security of their databases and user information.

[0052] Reference Figure 2 In one embodiment of the present application, the steps of performing zero-trust authentication processing on the client by the education platform according to the received access request include:

[0053] S210, in response to the received access request, the education platform constructs a SPA authentication package, encrypts it, and then sends it to the client;

[0054] S220, the client decrypts the SPA authentication package, obtains the authentication code, and initiates a communication request to the education platform;

[0055] S230, the education platform verifies the authentication code, and if the verification is successful, sends authorization information to the client.

[0056] It can be understood that steps S210 to S230 are the process of zero-trust authentication between the education platform and the client using SPA single package knocking technology. SPA single package authorization (Single Page Application SinglePackageAuthorization) is a management method for application authorization, which is particularly suitable for front-end single-page applications. Its basic principle is to package the front-end resources into a static file package (single package) and embed the authentication information into this static file during the packaging process. This information can be a license key or other authorization identifier, in this case, an authentication code, which is used to verify the user's access rights. When the application is loaded, the front-end code will parse the authentication information embedded in the static file, and determine whether the current client is authorized to access the education platform by comparing the current time, the license type and validity period in the authentication information, etc.

[0057] To enhance security, the embedded authentication information is usually encrypted or protected in other ways to prevent malicious tampering or leakage. When the authentication code is successfully verified, the education platform sends authorization information to the client, which may include license key, license type, validity period, etc.

[0058] Reference Figure 3 In one embodiment of the present application, the steps of the client running the monitoring script according to the received authorization information and establishing a communication connection with the education platform include:

[0059] S310, after receiving the authorization information, the client installs and runs the monitoring script in the authorization information;

[0060] S320, the monitoring script establishes a heartbeat connection with the education platform to ensure continuous activation and updating of the monitoring script;

[0061] S330, after the test monitoring script runs successfully, the education platform completes the communication connection with the client.

[0062] It can be understood that the heartbeat connection is to periodically send a custom structure (heartbeat packet or heartbeat frame) to let the education platform know that the monitoring script is "online" to ensure the validity of the connection. The monitoring script sends a fixed message to the education platform at regular intervals. After receiving it, the education platform replies with a fixed message. If the education platform does not receive the information sent by the monitoring script within the specified time, the script is deemed to be disconnected. The monitoring script establishes a heartbeat connection with the education platform to ensure its continuous activation and updating. This connection mechanism helps to maintain real-time communication between the monitoring script and the education platform, so as to respond to and process user-side behavior in a timely manner.

[0063] In one embodiment of the present application, the monitoring script is a Service Worker script.

[0064] Understandably, using Service Worker as a monitoring script has the following advantages: Service Worker acts as a proxy server between the education platform and the client, and is able to intercept and process network requests issued by the client, allowing developers to control the client's network communications; by caching resources locally, Service Worker enables the client to run offline, it can intercept network requests and return responses from the cache, thereby providing an offline experience; Service Worker is able to receive push notifications from the education platform and display notifications even if the user has not opened the client, and this feature enables the client to push instant messages; Service Worker can perform tasks in the background, such as periodically synchronizing data or updating script status, without the need for active user action; since Service Worker runs in an HTTPS environment and is subject to strict security restrictions of the education platform, it can provide a higher level of security to ensure that transmitted data and executed code are protected; Service Worker is based on an event-driven model that can listen to and respond to a variety of events, such as requests, responses, installations, activations, etc., thereby executing corresponding logic and operations in specific application scenarios.

[0065] Reference Figure 4 In one embodiment of the present application, after the education platform receives the alarm information, the steps of processing the client according to the alarm information include:

[0066] S410, the education platform compares and analyzes the received alarm information with the preset security policy, and processes the client according to the analysis result, including disconnecting the communication connection, prohibiting access to the database, and sending a warning message;

[0067] S420, the education platform records the processing information as log data.

[0068] It can be understood that the preset security policy includes different processing behaviors for different malicious operations. After receiving the alarm information, the education platform compares and processes the client malicious operation type in the alarm information with the security policy, and records the processing information as log data. These data include user access records, security policy execution status, reports of abnormal behavior, etc., which are important bases for security monitoring and incident response.

[0069] Reference Figure 4 In one embodiment of the present application, after the step of recording the processing information as log data, the education platform further includes:

[0070] S430, the education platform records the identity information of the client, analyzes all log data corresponding to the client, and determines whether the client is a malicious client according to the analysis result;

[0071] S440, adding the identity information of the malicious client to a blacklist, and the clients in the blacklist are prohibited from establishing a communication connection with the education platform.

[0072] It can be understood that for clients that have successfully established a connection with the education platform, all their log data is analyzed to determine whether they are malicious clients. For example, the total number of malicious operations of the client, the frequency of malicious operations, and other data can be analyzed to make a judgment, and then the malicious client is added to the blacklist, prohibiting the client from accessing the education platform again, which can further protect the education platform from malicious operation attacks.

[0073] In one embodiment of the present application, the steps of analyzing all log data corresponding to the client and determining whether the client is a malicious client according to the analysis result include:

[0074] S431, calculating the ratio of the number of malicious operations of the client to the number of communication establishments, and comparing the ratio with a preset threshold, and determining the client whose ratio exceeds the preset threshold as a malicious client.

[0075] It can be understood that step S431 determines malicious clients by calculating the ratio of the number of malicious operations of the client to the number of communications established, that is, the frequency of malicious operations of the client, thereby reducing the possibility of misjudgment, providing better security for the education platform and not affecting the client's user experience.

[0076] The technical solution of the present invention provides double protection by performing zero-trust authentication when the client applies for access to the education platform, and using monitoring scripts to monitor malicious operations during the client access process, thereby making the client's access to the education platform safer and reducing the possibility of malicious access. For online education platforms that are visited a large number of times every day, the security of their databases and user information is undoubtedly guaranteed.

[0077] This application also proposes a secure access system for a multi-person online education platform, including:

[0078] Client side;

[0079] Educational platform;

[0080] A zero-trust authentication unit, used to perform zero-trust authentication processing on the client according to the received client access request;

[0081] The script running unit is used to inject the monitoring script into the authorization information sent by the education platform to the client, and establish a connection after the monitoring script is installed and run. When the monitoring script detects malicious operations by the client, it intercepts the operation information sent by the client to the education platform and sends corresponding alarm information to the education platform;

[0082] The alarm processing unit is used to process the client according to the alarm information after the education platform receives the alarm information.

[0083] Furthermore, it also includes:

[0084] The blacklist unit is used to record the identity information of the client and analyze all log data corresponding to the client, and determine whether the client is a malicious client based on the analysis results; the identity information of the malicious client is added to the blacklist, and the clients in the blacklist are prohibited from establishing communication connections with the education platform.

[0085] Various objects such as various messages / information / equipment / network elements / systems / devices / actions / operations / processes / concepts that may appear in this application are named. It can be understood that these specific names do not constitute a limitation on the relevant objects. The names assigned may change with factors such as scenarios, contexts or usage habits. The understanding of the technical meaning of the technical terms in this application should be mainly determined from the functions and technical effects embodied / executed in the technical scheme.

[0086] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0087] In the embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0088] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0089] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0090] It should also be understood that in various embodiments of the present application, the first, second, etc. are only used to indicate that multiple objects are different. For example, the first time window and the second time window are only used to indicate different time windows. They should not have any impact on the time window itself, and the first, second, etc. mentioned above should not impose any limitations on the embodiments of the present application.

[0091] It should also be understood that in the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0092] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a computer-readable storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned computer-readable storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0093] The present application also provides a computer program product, which includes instructions. When the instructions are executed, the network switch and the network system perform operations of the network switch and the network system corresponding to the above method.

[0094] The present application also provides a network system, the system comprising:

[0095] one or more memories for storing instructions; and

[0096] One or more processors are used to call and run the instructions from the memory to execute the method as described above.

[0097] The present application also provides a chip system, which includes a processor for implementing the functions involved in the above content, such as generating, receiving, sending, or processing the data and / or information involved in the above method.

[0098] The chip system may be composed of chips, or may include chips and other discrete devices.

[0099] The processor mentioned in any of the above places can be a CPU, a microprocessor, an ASIC, or one or more integrated circuits for executing programs for controlling the above-mentioned feedback information transmission method.

[0100] In a possible design, the chip system also includes a memory, which is used to store necessary program instructions and data. The processor and the memory can be decoupled and respectively set on different devices, connected by wire or wireless means to support the chip system to implement various functions in the above embodiments. Alternatively, the processor and the memory can also be coupled on the same device.

[0101] Optionally, the computer instructions are stored in a memory.

[0102] Optionally, the memory is a storage unit within the chip, such as a register, a cache, etc. The memory can also be a storage unit within the terminal located outside the chip, such as a ROM or other types of static storage devices that can store static information and instructions, RAM, etc.

[0103] It can be understood that the memory in the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories.

[0104] The non-volatile memory may be a ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), or a flash memory.

[0105] The volatile memory may be a RAM, which is used as an external cache. There are many different types of RAM, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory.

[0106] The embodiments of this specific implementation method are all preferred embodiments of the present application, and are not intended to limit the protection scope of the present application. Therefore, all equivalent changes made based on the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A method for secure access to a multi-person online education platform, characterized in that: include: The client sends an access request to the education platform, where the education platform is a cloud platform; The education platform performs zero-trust authentication processing on the client according to the received access request. After the zero-trust authentication processing is passed, the education platform sends authorization information to the client and injects a monitoring script into the authorization information, wherein the authorization information is used to establish a communication connection with the client, and the monitoring script is used to monitor malicious operation behaviors of the client; The client runs the monitoring script according to the received authorization information and establishes a communication connection with the education platform, wherein when the monitoring script detects malicious operations by the client, it intercepts the operation information sent by the client to the education platform and sends corresponding alarm information to the education platform; After receiving the alarm information, the education platform processes the client according to the alarm information.

2. The secure access method for a multi-person online education platform according to claim 1, characterized in that: The steps of performing zero-trust authentication processing on the client by the education platform according to the received access request include: In response to the received access request, the education platform constructs a SPA authentication package, encrypts it, and then sends it to the client; The client decrypts the SPA authentication package, obtains the authentication code, and initiates a communication request to the education platform; The education platform verifies the authentication code, and if the verification is successful, sends authorization information to the client.

3. The secure access method for a multi-person online education platform according to claim 1, characterized in that: The client runs the monitoring script according to the received authorization information and establishes a communication connection with the education platform, including: After receiving the authorization information, the client installs and runs the monitoring script in the authorization information; The monitoring script establishes a heartbeat connection with the education platform to ensure the continuous activation and updating of the monitoring script; After the test monitoring script runs successfully, the education platform completes the communication connection with the client.

4. The secure access method for a multi-person online education platform according to claim 3, characterized in that: The monitoring script is a Service Worker script.

5. The secure access method for a multi-person online education platform according to claim 1, characterized in that: After the education platform receives the alarm information, the step of processing the client according to the alarm information includes: The education platform compares and analyzes the received alarm information with the preset security policy, and processes the client according to the analysis results, including disconnecting the communication connection, prohibiting access to the database, and sending a warning message; The education platform records the processed information as log data.

6. The secure access method for a multi-person online education platform according to claim 5, characterized in that: After the step of recording the processed information as log data, the education platform further includes: The education platform records the identity information of the client, analyzes all log data corresponding to the client, and determines whether the client is a malicious client based on the analysis results; The identity information of malicious clients is added to a blacklist, and the clients in the blacklist are prohibited from establishing a communication connection with the education platform.

7. The secure access method for a multi-person online education platform according to claim 6, characterized in that: The step of analyzing all log data corresponding to the client and determining whether the client is a malicious client according to the analysis result includes: The ratio of the number of malicious operations of the client to the number of communication establishments is calculated, and the ratio is compared with a preset threshold, and the client whose ratio exceeds the preset threshold is determined to be a malicious client.

8. A secure access system for a multi-person online education platform, characterized in that: include: Client side; Educational platform; A zero-trust authentication unit, used to perform zero-trust authentication processing on the client according to the received client access request; A script running unit, used to inject a monitoring script into the authorization information sent by the education platform to the client, and establish a connection after the monitoring script is installed and run. When the monitoring script detects malicious operations by the client, it intercepts the operation information sent by the client to the education platform and sends corresponding alarm information to the education platform; The alarm processing unit is used to process the client according to the alarm information after the education platform receives the alarm information.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the secure access method for a multi-person online education platform as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, executes the method for securely accessing a multi-person online education platform as described in any one of claims 1 to 7.

Images