Security protection method, protection system and storage medium

Abstract

The invention discloses a security protection method, a protection system and a storage medium, which are used for solving the technical problems of high cost of customer security protection and long deployment period of security equipment in the prior art, and are applied to a cloud proxy server in the protection system. The client is deployed in an intranet of a tenant and forwards data between the proxy server and an application service in the intranet, the cloud proxy server is exposed in a public network, the application service provides services to the outside through the cloud proxy server, the application service is not exposed in the public network, and the method comprises the following steps: receiving interaction data between a public network user and the application service; detecting whether a network attack exists in the interactive data by using a security service strategy customized for the application service; and if the network attack exists, blocking the interaction data, and if the network attack does not exist, forwarding the interaction data to the application service through the client, or sending the interaction data to the public network user.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security protection method, a protection system and a storage medium. Background Art

[0002] Currently, when enterprises, institutions, and even individuals provide external application services, in order to allow users to access the applications, they not only need to set up service equipment locally, such as servers and computers, but also need to purchase a public IP (Internet Protocol Address) that can expose the service equipment to the public Internet.

[0003] Exposing service devices directly to the public Internet will make them vulnerable to attacks from attackers on the network. If security devices (software / hardware) are installed for service devices, the relevant costs will increase, especially for customers with large service device scales, who have higher requirements for security device deployment and longer deployment cycles.

[0004] In view of this, how to reduce the security protection costs of customers while shortening the deployment cycle of security equipment has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The present invention provides a security protection method, a protection system and a storage medium, which are used to solve the technical problems existing in the prior art of high cost of customer security protection and long deployment cycle of security equipment.

[0006] In the first aspect, in order to solve the above technical problems, an embodiment of the present invention provides a security protection method, which is applied to a cloud proxy server in a protection system, wherein the protection system also includes a client, which is deployed in the tenant's intranet and forwards data between the proxy server and the application service in the intranet, and the cloud proxy server is exposed to the public network, and the application service provides services to the outside through the cloud proxy server, and the application service is not exposed to the public network. The technical solution of the method is as follows:

[0007] Receiving interaction data between the public network user and the application service;

[0008] Using a security service policy customized for the application service, detecting whether there is a network attack in the interaction data;

[0009] If there is a network attack, the interactive data is blocked; if there is no network attack, the interactive data is forwarded to the application service through the client, or the interactive data is sent to the public network user.

[0010] Since the cloud proxy service can not only provide external services on behalf of the application service, but also use security service policies in the proxy process to detect whether there are network attacks in the interaction data between the application service and public network users, and the application service communicates with the cloud proxy server through the client deployed on the tenant side, there is no need to deploy security equipment on the tenant side, nor to purchase a public network IP separately for the application service, which can effectively save tenant costs and deployment cycle.

[0011] In one possible implementation, the security service strategy is to arrange a security service chain for performing security checks on the interactive data according to the security requirements of the application service; the security service chain is composed of multiple security network elements of different types arranged in sequence, the security network elements are security protection mechanisms provided for a type of network attacks, and the security network elements are deployed based on Software as a Service (SaaS).

[0012] Since the security service policies used by different types of application services can be orchestrated according to actual needs, the cloud proxy server can provide personalized services for application services, and tenants can also adjust security service policies in a timely manner according to their service scale to avoid resource waste. Compared with the traditional private deployment model, it truly realizes the rapid delivery of network security capabilities, the rapid opening of network security services, and professional services for network security operation and maintenance.

[0013] A possible implementation method is to use a security service policy customized for the application service to detect whether there is a network attack in the interaction data, including:

[0014] According to the arrangement order of the multiple security network elements in the security service policy, the interaction data is sequentially pulled or mirrored to the multiple security network elements in the arrangement order for security detection until a network attack is detected or the last security network element completes the detection; wherein the first security network element among the multiple security network elements obtains the interaction data from the cloud service end, and the remaining security network elements obtain the interaction data from the previous security network element in the arrangement order;

[0015] Receive the detection result returned by the security service policy; wherein, if there is a network attack, the detection result is that there is a network attack; if there is no network attack, the detection result is the interaction data.

[0016] In a possible implementation manner, before the interactive data is sequentially pulled or mirrored to the plurality of security network elements in the arrangement order for security detection, the method further includes:

[0017] Detecting whether the multiple security network elements fail;

[0018] If any safety network element among the multiple safety network elements fails, the failed safety network element is replaced with another safety network element having the same function as the failed safety network element.

[0019] In a possible implementation manner, before receiving the interaction data between the public network user and the application service, the method further includes:

[0020] Based on the operation of the tenant, configure a service port and a proxy port for the application service;

[0021] The service port, the proxy port and the public network address of the cloud proxy server are sent to the email address or mobile phone used by the tenant when registering; wherein, the service port is exposed to the public network through the public network address for the public network user to indirectly access the application service, and the proxy port is used by the cloud proxy server to establish a mapping relationship between the application service to transmit the interaction data.

[0022] In a possible implementation manner, the interaction data includes:

[0023] An access request from the public network user to access the application service;

[0024] Or, the application service responds to the access request with response information.

[0025] In a possible implementation manner, the interaction data is the access request, and after receiving the interaction data between the public network user and the application service, the method further includes:

[0026] Obtaining the service domain name in the access request;

[0027] Matching the service domain name with the pre-stored domain names of various application services, and determining the application service corresponding to the domain name that successfully matches the service domain name as the application service to which the access request belongs;

[0028] Obtain the security service policy of the application service to which the access request belongs.

[0029] In a second aspect, an embodiment of the present invention provides a protection system, including:

[0030] The client is deployed in the tenant's intranet, which includes application services that provide services to the outside world, and the application services are not exposed to the public network;

[0031] A cloud proxy server is connected to the client for communication, and the cloud proxy server is exposed to the public network; the cloud proxy server is used to send and receive interactive data between the public network user and the application service, and forward the interactive data between the cloud proxy server and the application service through the client; the cloud proxy server is also used to use a security service policy customized for the application service to detect whether there is a network attack in the interactive data; if there is a network attack, the interactive data is blocked; if there is no network attack, the interactive data is forwarded to the application service through the client, or the interactive data is sent to the public network user;

[0032] At least one security capability pool, the security capability pool is used to store multiple security network elements composed of security protection mechanisms used for different types of network attacks, and the security protection strategy includes at least one of the security network elements.

[0033] In a possible implementation manner, the protection system further includes:

[0034] A management platform for managing the security capability pool; a security knowledge base is provided in the management platform, and the security knowledge base is used to capture and record network attacks and corresponding security protection mechanisms;

[0035] The management platform is also used to update the protection mechanism of the security network elements in the security capability pool according to the updated content of the security knowledge base.

[0036] In a third aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is used to enable the computer to execute the method described in the first aspect.

[0037] Through the technical solutions in one or more of the above embodiments of the embodiments of the present invention, the embodiments of the present invention have at least the following technical effects:

[0038] In the embodiment provided by the present invention, the application service that is not exposed to the public network is allowed to provide services to the outside through the cloud proxy server, so that the application service can provide services to the outside without being exposed to the public network; while acting as an agent for the application service, the cloud proxy server can also use the service strategy customized for the application service to detect the interaction data between the public network user and the application service to determine whether there is a network attack in the interaction data; when there is a network attack in the interaction data, the interaction data is blocked to ensure the security of the application service; when there is no network attack in the interaction data, the interaction data is sent to the application service or the public network user, so as to ensure that the application service provides normal services to the public network user under the premise of security. Since the cloud proxy service can not only act as an agent for the application service to provide services to the outside, but also use the security service strategy to detect whether there is a network attack in the interaction data between the application service and the public network user during the proxy process, and the application service communicates with the cloud proxy server through the client arranged on the tenant side, there is no need to arrange security equipment on the tenant side, and there is no need to purchase a public network IP separately for the application service, which can effectively save tenant costs and deployment cycles. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 Schematic diagram for privatization deployment of security equipment;

[0040] Figure 2 An embodiment of the present invention provides a structural schematic diagram of a protection system;

[0041] Figure 3 A schematic diagram of the structure of another protection system provided by an embodiment of the present invention;

[0042] Figure 4 A flowchart of a security protection method provided by an embodiment of the present invention;

[0043] Figure 5 An interactive schematic diagram of a security protection method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In the embodiments of the present invention, the term "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent three situations: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0045] In the embodiments of the present application, the term "plurality" refers to two or more than two, and other quantifiers are similar.

[0046] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0047] In the existing technology, for the security protection of customer demilitarized zone (DMZ) services, the access method of security products is as follows: Figure 1 As shown, Figure 1 Schematic diagram of private deployment access for security devices.

[0048] Figure 1 In the private deployment of security devices shown in the figure, customers need to purchase hardware devices (such as firewall devices or software), and then connect the security devices in series or in a single-arm manner to the front end of the protected web application service. All traffic accessing the web application service must pass through the security device ( Figure 1 In this case, the firewall is used to monitor and protect the web application services. If customers need to deploy a large number of devices that provide application services, the requirements for security devices will be higher and the deployment cycle will be longer.

[0049] In addition, since the customer's web application service needs to provide services to the outside world, it is also necessary to purchase a public IP so that users in the public network (such as mobile phone users) can access the customer's application service through the customer's public IP, which will further increase the customer's cost. If the customer does not deploy security equipment for the application service, it will not be able to intercept the attacker's attack, reducing the security of the application service.

[0050] To solve the above problems, the embodiments of the present application provide a security protection method, a protection system and a storage medium to solve the problems of high cost of customer security protection and long deployment cycle of security equipment in the prior art.

[0051] Among them, the method and the system are based on the same application concept. Since the principles of solving problems by the method and the system are similar, the implementation of the system and the method can refer to each other, and the repeated parts will not be repeated.

[0052] Please refer to Figure 2 , an embodiment of the present invention provides a structural schematic diagram of a protection system, the protection system comprising:

[0053] Client 1 is deployed in the intranet of the tenant (i.e., the customer). The intranet includes application services that provide services to the outside world, and the application services are not exposed to the public network. Figure 2As shown, the tenant side may have a public network access area and an intranet, the intranet may include an isolation area, an internal service area, and an office area, the tenant's application service is set in the isolation area, and the client 1 is set between the public network access area and the isolation area. The client 1 can be software or hardware. When the client 1 is software, the client 1 can be installed in the tenant's device (such as a server).

[0054] The cloud proxy server 2 is connected to the client 1 in communication, and the cloud proxy server 2 is exposed to the public network; the cloud proxy server 2 is used to send and receive interactive data between the public network user and the application service, and forward the interactive data between the cloud proxy server 2 and the application service through the client 1; the cloud proxy server 2 is also used to use the security service policy customized for the application service to detect whether there is a network attack in the interactive data; if there is a network attack, the interactive data is blocked; if there is no network attack, the interactive data is forwarded to the application service through the client 1, or the interactive data is sent to the public network user; the cloud proxy server 2 has a public network address, so that the cloud proxy server 2 is exposed to the public network

[0055] At least one security capability pool 3, the security capability pool 3 is used to store multiple security network elements composed of security protection mechanisms used for different types of network attacks, and the security protection strategy includes at least one security network element.

[0056] Security network elements can be traffic-type security network elements, such as firewalls, website application-level intrusion prevention systems (Web Application Firewall, WAF), intrusion detection and prevention systems (Intrusion Detection and Prevention Systems, IDPS), network detection and response (Network Detection Response, NDR), network traffic analysis (Network Traffic Analysis, NTA), etc.

[0057] The security network elements in security capability pool 3 are all deployed based on SaaS, which makes it easy for the security network elements to provide services to different tenants.

[0058] like Figure 2 As shown, a client 1 capable of accessing a cloud proxy server 2 through a public network is installed in the intranet of tenants 1 to n (that is, customers 1 to n). It is assumed that a public network user needs to access application service n provided by tenant 1 to the outside world, and application service 1-application service n have no public network addresses. Cloud proxy server 2 acts as an agent for the application services of tenants 1 to n.

[0059] A public network user sends an access request to application service n of tenant 1. The access request carries the domain name of application service n of tenant 1. The domain name of the access request is resolved in the public network, and the resolution result points to the public network IP of cloud proxy server 2 and the service port corresponding to application service n of tenant 1 in cloud proxy server 2. After receiving the access request, cloud proxy server 2 determines that the access request is a request to access application service n of tenant 1 according to the service port corresponding to the access request, and then queries the security policy adopted by application service n of tenant 1 to use security network element k, security network element 2, and security network element (k-1) to detect whether there is a network attack in the access request in sequence. If any of these security network elements detects the existence of a network attack, the access request is blocked (that is, the access request is discarded and the access request is not sent to application service n of tenant 1). If none of these security network elements detects the existence of a network attack in the access request, the access request is forwarded to application service n of tenant 1 through client 1 in tenant 1. In this way, the cloud proxy server 2 connects to and acts as a proxy for the application services in the tenant's intranet through the client 1, so that the tenant does not have to purchase a public network address for the application service, and the application service in the tenant's intranet can provide services to the outside world without being exposed to the public network; at the same time, the business traffic (i.e., interaction data) of the application service is pulled to the security capability pool 3 for security testing, so that the tenant does not have to purchase and deploy security equipment separately to ensure the security of the application service, thereby effectively saving the tenant's cost and saving the time of deploying security equipment on the tenant side.

[0060] It should be understood that the above tenant-side functional area division is not limited to Figure 1 The division method shown may also be performed without dividing into functional areas.

[0061] In some embodiments, the protection system includes multiple security capability pools 3, and different security capability pools 3 are located in different geographical locations. For example, a municipal security capability pool 3 may be set up, or a provincial security capability pool 3 may be set up. For example, region A includes 3 provinces and 10 cities in total. A security capability pool 3 may be set up in each province, or a security capability pool 3 may be set up in each city. The security network element classes included in different security capability pools 3 may be the same or different; in the same security capability pool 3, there may be one or more security network elements for the same type of network attacks, without specific limitation.

[0062] See also Figure 3 A schematic diagram of the structure of another protection system provided by an embodiment of the present invention, the protection system further includes:

[0063] The management platform 4 is used to manage the security capability pool 3. The management platform 4 is provided with a security knowledge base, which is used to capture and record network attacks and corresponding security protection mechanisms.

[0064] The management platform 4 is also used to update the protection mechanism of the security network elements in the security capability pool 3 according to the updated content of the security knowledge base.

[0065] By setting up a security knowledge base in the protection system to capture and record network attacks and corresponding security protection mechanisms, and a management platform 4 for managing the security capability pool 3, it is convenient to use the security knowledge base to timely update the protection mechanism of the security network elements in the security capability pool, provide each tenant with the latest security protection, realize full network linkage protection, and improve the real-time and effectiveness of security response to application services.

[0066] After introducing the basic structure of the protection system, the working process of the cloud server in the protection system will be introduced in detail.

[0067] Based on the same inventive concept, an embodiment of the present invention provides a security protection method, which is applied to a cloud proxy server in a protection system. The protection system also includes a client, which is deployed in the tenant's intranet and forwards data between the proxy server and the application service in the intranet. The cloud proxy server is exposed to the public network, and the application service provides services to the outside world through the cloud proxy server, and the application service is not exposed to the public network. The specific implementation method of the protection system can be found in the description of the aforementioned protection system embodiment part, and the repeated parts will not be repeated. Please refer to Figure 4 , methods include:

[0068] S11: receiving interaction data between public network users and application services;

[0069] Interaction data, including:

[0070] Access requests from public network users to application services;

[0071] Or, the response information of the application service in response to the access request.

[0072] For example, when a public network user sends an access request to an application service, the interaction data is the access request; when the application service receives the access request and returns response information corresponding to the access request, the interaction data is the response information.

[0073] Before receiving the interaction data between the public network user and the application service, it also includes:

[0074] Configure service ports and proxy ports for application services based on tenant operations;

[0075] The service port, proxy port and the public network address of the cloud proxy server are sent to the email or mobile phone used by the tenant when registering; among them, the service port is exposed to the public network through the public network address for public network users to indirectly access the application service, and the proxy port is used by the cloud proxy server to establish a mapping relationship between the application service to transmit interactive data.

[0076] For example, when a tenant registers on the cloud proxy server, the cloud proxy server will configure the service port and proxy port for the tenant's application service based on the tenant's operation, and send the service port, proxy port and the public network address of the cloud proxy server to the email or mobile phone used by the tenant when registering. The tenant can set the proxy port and service port for the application service in the local client based on the above information. The client can use the public network to establish a communication connection with the cloud proxy server through the above proxy port, and report relevant information about the application service, including the above service port, proxy port, domain name of the application service, etc. After receiving the relevant information about the application service sent by the client, the cloud proxy server stores the domain name, service port, and proxy port corresponding to the application service locally, and listens to the proxy port configured for the application service.

[0077] In addition, tenants also need to modify the domain name resolution address of the application service to the public network address of the cloud proxy server and the service port configured for the application service. In this way, when public network users request to access the application service through the domain name of the application service, the Domain Name System (DNS) will resolve the domain name of the application service to the public network address of the cloud proxy server and the service port configured for the application service, and then send the access request to the cloud proxy server.

[0078] In some embodiments, the client and the cloud proxy server may establish a persistent connection, so that the client and the cloud proxy server maintain real-time communication.

[0079] It should be understood that the tenant's intranet may include at least one application service. When multiple application services are included, the types of the multiple application services may be the same or different. For example, multiple application services may all be web-type application services, or they may all be mailbox-type application services, or some may be web-type application services and the other may be other types of application services, without specific limitations. For application services of the same type, the same proxy port and service port may be used; for application services of different types, different proxy ports and service ports may be used, or the same proxy port and service port may be used. When different types of application services use different types of proxy ports and service ports, load balancing or other technologies (such as traffic layer forwarding technology) may be used to forward different types of traffic data to application services of the corresponding type.

[0080] After the cloud proxy server receives the interaction data of the application service, step S12 may be executed.

[0081] S12: Use the security service policy customized for the application service to detect whether there is a network attack in the interaction data;

[0082] S13: If there is a network attack, the interactive data is blocked; if there is no network attack, the interactive data is forwarded to the application service through the client, or the interactive data is sent to the public network user.

[0083] The security service strategy is a security service chain that is used to perform security checks on interactive data based on the security requirements of the application service. The security service chain is composed of multiple security network elements of different types arranged in sequence. The security network element is a security protection mechanism provided against a type of network attack. The security network element is deployed based on Software as a Service (SaaS).

[0084] For example, when registering, a tenant can customize a security service policy for its application service. Assuming that the tenant's application service is a web-type application service, multiple security network elements for web-type network attacks can be selected as needed, and these security network elements can be arranged into a security service chain in the order of detecting interactive data, thus forming a security service policy for the application service. Of course, other security network elements for routine security testing can also be incorporated into the security service chain. In addition, during the use process after registration, the security service chain can also be rearranged, modified, or expanded, etc., without specific restrictions.

[0085] In some embodiments, the interaction data is an access request, and after receiving the interaction data between the public network user and the application service, the method further includes:

[0086] Obtain the service domain name in the access request; match the service domain name with the pre-stored domain names of each application service, and determine the application service corresponding to the domain name that successfully matches the service domain name as the application service to which the access request belongs; obtain the security service policy of the application service to which the access request belongs.

[0087] Taking the interactive data as an access request as an example, the cloud proxy server receives the access request, matches the service domain name carried in the access request and the service port entered by the access request with the pre-stored domain names of each application service, and determines that the application service corresponding to the domain name that successfully matches the service domain name and service port corresponding to the access request is the application service that the access request needs to access, and then obtains the security service policy corresponding to the application service that the access request needs to access, and then uses this security to detect whether there is a network attack in the access request.

[0088] Taking the interactive data as the response data of the access request as an example, the cloud proxy server monitors the proxy port of the application service and receives the response information sent by the client. The cloud proxy server matches this proxy port with the locally stored application services and proxy ports, obtains the security service policy corresponding to the application service corresponding to the successfully matched proxy port, and uses the security service policy to detect whether there is a network attack in the response data.

[0089] In some embodiments, using a security service policy customized for an application service to detect whether there is a network attack in the interaction data includes:

[0090] According to the arrangement order of multiple security network elements in the security service strategy, the interaction data is pulled or mirrored to multiple security network elements in the arrangement order for security detection, until a network attack is detected or the last security network element completes the detection; wherein, the first security network element among the multiple security network elements obtains the interaction data from the cloud service end, and the remaining security network elements obtain the interaction data from the previous security network element in the arrangement order;

[0091] Receive the detection result returned by the security service policy; if there is a network attack, the detection result is that there is a network attack; if there is no network attack, the detection result is interaction data.

[0092] For example, a security service strategy includes 10 security network elements (recorded as security network element 1 to security network element 10) arranged in sequence. The cloud proxy server sends the interaction data to security network element 1. Security network element 1 detects the interaction data and determines that there is no network attack corresponding to security network element 1. After that, security network element 1 sends the interaction data to security network element 2. Security network element 2 detects the interaction data and determines that there is no network attack corresponding to security network element 2. After that, security network element 2 sends the interaction data to security network element 3. Security network element 3 detects the interaction data and determines that there is no network attack corresponding to security network element 3. Assume that security network element 3 to security network element 10 are connected to the security network element 2. Element 7 fails to detect the presence of a network attack in the interactive data. When the interactive data flows to security network element 8, security network element 8 detects the interactive data and determines that there is a network attack corresponding to security network element 3. Then security network element 8 terminates the security detection and returns to the cloud proxy server that there is a network attack in the interactive data, and discards the interactive data (i.e., blocks the interactive data). Assuming that security network elements 3 to 10 fail to detect the presence of a network attack in the interactive data, since security network element 10 is the last security network element to detect the interactive data, after security network element 10 determines that there is no network attack in the interactive data, it sends the interactive data to the cloud proxy server.

[0093] If the interaction data is an access request, the cloud proxy server will send the access request after detection to the client installed in the tenant through the proxy port corresponding to the application service, and the client will then forward the access request to the corresponding application service in the tenant's intranet.

[0094] If the interactive data is response information, the cloud proxy server will send the response information after completing the detection to the corresponding public network user.

[0095] In some embodiments, the geographical location of the security network element in the security service policy is closest to the location of the tenant.

[0096] like, Figure 2 The protection system includes multiple security capability pools. Different security capability pools are arranged in different geographical locations. Assuming that the tenant's geographical location is closest to the location of security capability pool 1, when using the security service policy, the security network elements in security capability pool 1 are preferentially provided to the tenant for use.

[0097] In some other embodiments, before the interactive data is sequentially pulled or mirrored to multiple security network elements in the arrangement order for security detection, the method further includes:

[0098] Detect whether multiple safety network elements fail; if any of the multiple safety network elements fails, replace the failed safety network element with another safety network element having the same function as the failed safety network element.

[0099] For example, after determining multiple security network elements used by the security service policy, detect whether multiple security network elements included in the security service policy in the security capability pool closest to the tenant are faulty. If any of them is faulty, replace the faulty security network element with another security network element in other security capability pools that is not faulty and has the same function as the faulty security network element. The other security capability pool may be the second closest security capability pool to the tenant.

[0100] By detecting whether multiple security network elements have faults; if any of the multiple security network elements fails, the failed security network element will be replaced with another security network element with the same function as the failed security network element, it can be ensured that the interactive data can be securely checked at any time and the security of application services can be guaranteed in real time.

[0101] In order to enable those skilled in the art to fully understand the above scheme, a specific example will be provided below for illustration.

[0102] See also Figure 5 An interactive schematic diagram of a security protection method provided by an embodiment of the present invention.

[0103] S21, generating an access request for an application service;

[0104] A public network user generates an access request to access an application service provided by a tenant. The access request carries the domain name of the application service, which is called the service domain name in the access request.

[0105] S22, receiving an access request;

[0106] The DNS resolution service domain name determines that the corresponding address is the public network address of the cloud proxy server, and the corresponding service port is the service port assigned to the application service by the cloud proxy server. The cloud proxy server receives access requests from this service port.

[0107] S23. Determine the corresponding application service according to the service domain name in the access request;

[0108] The cloud proxy server determines the corresponding application service based on the service domain name carried in the access request and the service port for receiving the access request.

[0109] S24, obtaining a security service policy for the application service;

[0110] The cloud proxy server obtains the security service policy corresponding to the determined application service.

[0111] S25, allowing the access request to flow and be detected in the security network element included in the security service policy;

[0112] The cloud proxy server sends the access request to the first security network element in the security service policy, and allows the access request to flow and be detected in the security network elements included in the security service policy. The way in which the access request flows and is detected in the security network elements included in the security service policy can be referred to the implementation method of "using a security service policy customized for application services to detect whether there is a network attack in the interactive data" in the aforementioned embodiment, which will not be repeated here.

[0113] S26. Determine that there is no network attack in the access request;

[0114] The cloud proxy server receives the access request sent by the last security network element in the security service policy and determines that there is no network attack in the access request.

[0115] S27, sending the access request to the client;

[0116] The cloud proxy service sends the access request to the client through the proxy port corresponding to the application service.

[0117] S28, determining the application service corresponding to the access request;

[0118] The client determines the corresponding application service based on the proxy port corresponding to the received access request.

[0119] S29, the client sends the access request to the corresponding application service;

[0120] S30, receiving an access request;

[0121] The application service receives the access request sent by the client.

[0122] S31, generating and sending response information corresponding to the access request;

[0123] The application service generates corresponding response information based on the access request, and the response information carries the address information of the public network user.

[0124] S32, receiving and forwarding response information;

[0125] The client forwards the response information to the cloud proxy server through the proxy port corresponding to the application service.

[0126] S33, receiving the response information and determining the corresponding security service policy;

[0127] The cloud proxy server monitors the proxy port corresponding to the application service and receives the response information, and determines the corresponding security service policy according to the application service corresponding to the proxy port.

[0128] S34, allowing the response information to flow and be detected in the security network element included in the security service policy;

[0129] The cloud proxy server sends the response information to the first security network element in the security service policy, and allows the response information to circulate and be detected in the security network elements included in the security service policy. The way in which the response information circulates and is detected in the security network elements included in the security service policy can be referred to the implementation method of "using a security service policy customized for application services to detect whether there is a network attack in the interactive data" in the aforementioned embodiment, which will not be repeated here.

[0130] S35, determining that there is no network attack in the response information, and forwarding the response information to the public network user;

[0131] The cloud proxy server receives the response information returned by the last security network element in the security service policy, and sends the response information to the public network user according to the address of the public network user in the response information.

[0132] S36: The public network user receives the response information.

[0133] In the embodiment provided by the present invention, the application service that is not exposed to the public network is allowed to provide services to the outside through the cloud proxy server, so that the application service can provide services to the outside without being exposed to the public network; while acting as an agent for the application service, the cloud proxy server can also use the service strategy customized for the application service to detect the interaction data between the public network user and the application service to determine whether there is a network attack in the interaction data; when there is a network attack in the interaction data, the interaction data is blocked to ensure the security of the application service; when there is no network attack in the interaction data, the interaction data is sent to the application service or the public network user, so as to ensure that the application service provides normal services to the public network user under the premise of security. Since the cloud proxy service can not only act as an agent for the application service to provide services to the outside, but also use the security service strategy to detect whether there is a network attack in the interaction data between the application service and the public network user during the proxy process, and the application service communicates with the cloud proxy server through the client arranged on the tenant side, there is no need to arrange security equipment on the tenant side, and there is no need to purchase a public network IP separately for the application service, which can effectively save tenant costs and deployment cycles.

[0134] Furthermore, since the cloud proxy server can provide services to different tenants, different tenants can reuse the security network elements on the cloud proxy server side, thereby reducing the cost of using the cloud proxy server.

[0135] Furthermore, since the security service policies used by different types of application services can be orchestrated according to actual needs, the cloud proxy server can provide personalized services for application services, and tenants can also adjust security service policies in a timely manner according to their service scale to avoid waste of resources.

[0136] Based on the same inventive concept, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is used to enable the computer to execute the security protection method as described above.

[0137] The processor-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD)), etc.

[0138] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0139] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer executable instructions. These computer executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0140] These processor executable instructions may also be stored in a processor readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0141] These processor-executable instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0142] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A security protection method, applied to a cloud proxy server in a protection system, wherein the protection system further comprises a client, wherein the client is deployed in a tenant's intranet and forwards data between the proxy server and an application service in the intranet, wherein the cloud proxy server is exposed to the public network, wherein the application service provides services to the outside through the cloud proxy server, and wherein the application service is not exposed to the public network, wherein: The method comprises: Receiving interaction data between the public network user and the application service; Using a security service policy customized for the application service, detecting whether there is a network attack in the interaction data; If there is a network attack, the interactive data is blocked; if there is no network attack, the interactive data is forwarded to the application service through the client, or the interactive data is sent to the public network user.

2. The method according to claim 1, characterized in that The security service strategy is a security service chain used to perform security checks on the interactive data according to the security requirements of the application service; the security service chain is composed of multiple security network elements of different types arranged in sequence, and the security network element is a security protection mechanism provided for a type of network attack, and the security network element is deployed based on Software as a Service (SaaS).

3. The method according to claim 2, characterized in that Using a security service policy customized for the application service, detecting whether there is a network attack in the interaction data includes: According to the arrangement order of the multiple security network elements in the security service policy, the interaction data is sequentially pulled or mirrored to the multiple security network elements in the arrangement order for security detection until a network attack is detected or the last security network element completes the detection; wherein the first security network element among the multiple security network elements obtains the interaction data from the cloud service end, and the remaining security network elements obtain the interaction data from the previous security network element in the arrangement order; Receive the detection result returned by the security service policy; wherein, if there is a network attack, the detection result is that there is a network attack; if there is no network attack, the detection result is the interaction data.

4. The method according to claim 3, characterized in that Before the interactive data is sequentially pulled or mirrored to the plurality of security network elements in the arrangement order for security detection, the method further includes: Detecting whether the multiple security network elements fail; If any safety network element among the multiple safety network elements fails, the failed safety network element is replaced with another safety network element having the same function as the failed safety network element.

5. The method according to any one of claims 1 to 4, characterized in that: Before receiving the interaction data between the public network user and the application service, the method further includes: Based on the operation of the tenant, configure a service port and a proxy port for the application service; The service port, the proxy port and the public network address of the cloud proxy server are sent to the email address or mobile phone used by the tenant when registering; wherein, the service port is exposed to the public network through the public network address for the public network user to indirectly access the application service, and the proxy port is used by the cloud proxy server to establish a mapping relationship between the application service to transmit the interaction data.

6. The method according to any one of claims 1 to 4, characterized in that: The interaction data includes: An access request from the public network user to access the application service; Or, the application service responds to the access request with response information.

7. The method according to claim 6, characterized in that The interaction data is the access request. After receiving the interaction data between the public network user and the application service, the method further includes: Obtaining the service domain name in the access request; Matching the service domain name with the pre-stored domain names of various application services, and determining the application service corresponding to the domain name that successfully matches the service domain name as the application service to which the access request belongs; Obtain the security service policy of the application service to which the access request belongs.

8. A protection system, characterized in that: include: The client is deployed in the tenant's intranet, which includes application services that provide services to the outside world, and the application services are not exposed to the public network; A cloud proxy server, connected to the client for communication, and the cloud proxy server is exposed to the public network; The cloud proxy server is used to send and receive interactive data between the public network user and the application service, and forward the interactive data between the cloud proxy server and the application service through the client; the cloud proxy server is also used to use a security service policy customized for the application service to detect whether there is a network attack in the interactive data; If there is a network attack, the interactive data is blocked; if there is no network attack, the interactive data is forwarded to the application service through the client, or the interactive data is sent to the public network user; At least one security capability pool, the security capability pool is used to store multiple security network elements composed of security protection mechanisms used for different types of network attacks, and the security protection strategy includes at least one of the security network elements.

9. The protection system according to claim 8, characterized in that: Also includes: A management platform, used to manage the security capability pool; The management platform is provided with a security knowledge base, which is used to capture and record network attacks and corresponding security protection mechanisms; The management platform is also used to update the protection mechanism of the security network elements in the security capability pool according to the updated content of the security knowledge base.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is used to cause the computer to execute the method according to any one of claims 1 to 7.

Images