On-premise audit protection method and system for azure cloud hybrid deployment

Abstract

The application provides a local region audit protection method and system for Azure cloud hybrid deployment, which comprises a hybrid deployment state exploration process, a key data audit process and a threat protection process; after entering the hybrid deployment state exploration process, the key data audit process is entered; after entering the key data audit process, the threat protection process is entered, and whether the judgment rule verification passes is judged; if yes, the process is ended; if no, a security strategy is executed, and the process is ended. Through the front hybrid deployment state exploration subsystem, the application realizes the integration and analysis of the local region hybrid deployment environment, improves the user's grasp of the current domain hybrid deployment configuration, and provides information support for subsequent audit and protection.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and specifically relates to a local domain audit protection method and system for Azure cloud hybrid deployment. BACKGROUND

[0002] Hybrid deployment is a service provided by Microsoft Azure to enterprises. Through hybrid deployment, enterprises can extend the local domain environment to the cloud to achieve unified access and management. User identities in the local domain are synchronized to Azure AD, and these identities are referred to as hybrid identities, which can access cloud resources through local hybrid identity user credentials to achieve identity interworking.

[0003] To support hybrid deployment, Azure provides three identity verification methods: password hash synchronization, referred to as PHS, pass-through authentication, referred to as PTA, and active directory federation service, referred to as ADFS; and an additional feature, single sign-on, referred to as SSO, which can be applied to PHS and PTA.

[0004] Hybrid deployment provides convenience for enterprises in terms of management and resource access, but also increases security risks; identity interworking between the local domain and the cloud allows attackers to expand their access to the cloud after gaining access to the local domain, and vice versa. Therefore, it is necessary to audit and evaluate the security situation in this scenario.

[0005] Currently, existing host audit systems usually take logs and events generated on the host as the main monitoring target, and analyze the overall security status of the host based on these contents.

[0006] Patent document CN117692156A discloses a host audit method, system, storage medium and computer device, which collects audit events of system calls and file system operations by receiving audit policies issued by a background server, generates security analysis and corresponding security policies, and dynamically updates the audit policies of the host. This technology has certain defects when monitoring related risks in a hybrid deployment scenario. Since the local domain has some additional resources in the hybrid deployment scenario, such as newly added privileged servers, privileged users, host states and confidential credentials, the conventional audit strategy for host events and logs may miss related risk operations; and some resources themselves have security risks, which are difficult to discover through the analysis of logs and events. SUMMARY

[0007] In view of the defects in the prior art, the purpose of the present application is to provide a local domain audit protection method and system for Azure cloud hybrid deployment.

[0008] The application provides a local region audit protection method for Azure cloud hybrid deployment, which comprises a hybrid deployment state exploration process, a key data audit process and a threat protection process.

[0009] After entering the hybrid deployment state exploration process, the key data audit process is entered; after entering the key data audit process, the threat protection process is entered, and it is judged whether the rule verification is passed or not; if the result is yes, the process is ended; if the result is no, a security policy is executed, and the process is ended.

[0010] Preferably, the hybrid deployment state exploration process comprises:

[0011] Step A1: searching a service to obtain a server positioning result;

[0012] Step A2: querying a service account through the server positioning result;

[0013] Step A3: querying configuration information through the credentials of the service account to determine an identity verification mode;

[0014] In the step A1, the service comprises an AdSync service, a PTA agent service and an ADFS service; and the server positioning result comprises an Azure AD Connect server, a PTA agent server and an ADFS server.

[0015] In the step A2, the service account of the AdSync service is queried on the server through the positioning result of the Azure AD Connect server.

[0016] In the step A3, the configuration information is queried by accessing the Azure AD through the credentials of the service account.

[0017] The configuration information comprises an identity verification mode and a type of domain hosting.

[0018] The identity verification mode comprises PHS, PTA, ADFS or SSO.

[0019] Preferably, the key data audit process comprises:

[0020] Step B1: collecting a privileged user condition;

[0021] Step B2: monitoring and recording data through the identity verification mode and collecting logs based on the privileged user condition.

[0022] In the step B1, the privileged user case includes: member information of the AdSync service administrator group, user information of the PTA agent service, member information of the ADFS service administrator group, and account information of the SSO service account AZUREADSSOACC;

[0023] In the step B2, the identity verification mode is PHS mode, and information of the LocalDB database AdSync table is recorded; the identity verification mode is PTA mode, and information of the PTA agent certificate is recorded; the identity verification mode is ADFS mode, and information of the WID database ServiceSetting table is recorded; whether SSO is enabled is determined, and if yes, information of the SSO device authentication certificate and the communication certificate is recorded; if no, nothing is recorded.

[0024] In the step B2, the log collection, the identity verification mode is PHS mode, and privileged user login logs of the Azure AD Connect server, access logs of the LocalDB database, MSOL user directory replication logs, and login events of the Sync account in the Azure AD are collected.

[0025] The identity verification mode is PTA mode, and privileged user login logs of the PTA agent server, start-stop records of the PTA agent service, DLL loading conditions of the running PTA agent service, and export events of the PTA agent certificate are collected.

[0026] The identity verification mode is ADFS mode, and privileged user login logs of the ADFS server and access logs of the WID database are collected.

[0027] If SSO is enabled, attribute change logs of the AZUREADSSOACC account, export events of the authentication certificate and the communication certificate are collected.

[0028] Preferably, the threat prevention process includes:

[0029] Step C1: based on the log and event information obtained in the step B2, security verification is performed;

[0030] Step C2: for a rule that fails the security verification, a security policy is executed.

[0031] Preferably, in the step C1:

[0032] Step C1.1: based on the data, whether the database file and the certificate file are consistent is determined, and if yes, the verification is passed, and no processing is performed; if no, the step C2 is executed.

[0033] Step C1.2: Based on the logs and event information obtained in step B2, determine whether there is any suspicious access, login, or loading. If the result is yes, proceed to step C2; if the result is no, do not process it.

[0034] In step C2, the security policy includes: issuing warnings for redundant privileged users, restoring the user ownership of the PTA agent service and restarting the PTA agent service, and updating the AZUREADSSOACC system account credentials; issuing warnings for abnormal changes to confidential files and forcibly updating credentials and certificates in the database; issuing warnings for access to important resources and privileged user login events; and determining whether the PTA agent service is loading a suspicious DLL. If yes, the service needs to be restarted; otherwise, no action is taken. "Suspicious" refers to DLLs that are different from those loaded during the normal operation of the service, meaning those whose names or behaviors indicate a suspicious purpose and could interfere with the normal operation of the service.

[0035] According to the present invention, a local domain audit protection system for Azure cloud hybrid deployment includes: a hybrid deployment status detection subsystem, a critical data audit subsystem, and a threat protection subsystem;

[0036] After the hybrid deployment status probing subsystem is triggered, the critical data auditing subsystem is triggered; after the critical data auditing subsystem is triggered, the threat protection subsystem is triggered to determine whether the rule verification passes. If the result is yes, the process ends; if the result is no, the security policy is executed and the process ends.

[0037] Preferably, the hybrid deployment status detection subsystem includes:

[0038] Hybrid Deployment Critical Service Query Module: Searches for services and obtains server location results;

[0039] Hybrid Deployment Service Account Query Module: Queries service accounts based on server location results;

[0040] Hybrid deployment configuration query module: Query configuration information and determine the authentication mode using the credentials of the service account;

[0041] In the hybrid deployment critical service query module, the services include: AdSync service, PTA proxy service, and ADFS service; the server location results include: Azure AD Connect server, PTA proxy server, and ADFS server.

[0042] In the hybrid deployment service account query module, the service account for the AdSync service is queried on the Azure AD Connect server using the server's location results.

[0043] In the mixed deployment configuration query module, the configuration information is queried by accessing the Azure AD through the credentials of the service account.

[0044] The configuration information includes an authentication mode and a type of domain hosting.

[0045] The authentication mode includes PHS, PTA, ADFS or SSO.

[0046] Preferably, the key data audit subsystem includes:

[0047] A privileged user detection module that collects privileged user conditions.

[0048] A confidential data monitoring module that monitors data according to the authentication mode based on the privileged user conditions.

[0049] A log event recording module that records data and collects logs according to the authentication mode.

[0050] In the privileged user detection module, the privileged user conditions include member information of an AdSync service administrator group, user information of a PTA agent service, member information of an ADFS service administrator group, and account information of an SSO service account AZUREADSSOACC.

[0051] In the log event recording module, when the authentication mode is PHS, information of an AdSync table of a LocalDB database is recorded; when the authentication mode is PTA, information of a PTA agent certificate is recorded; when the authentication mode is ADFS, information of a ServiceSetting table of a WID database is recorded; whether SSO is enabled is determined, and if the result is yes, information of an SSO device authentication certificate and a communication certificate is recorded; if the result is no, no information is recorded.

[0052] In the log event recording module, when the authentication mode is PHS, privileged user login logs of an Azure AD Connect server, access logs of a LocalDB database, MSOL user directory replication logs, and login events of a Sync account in the Azure AD are collected.

[0053] When the authentication mode is PTA, privileged user login logs of a PTA agent server, start-stop records of a PTA agent service, DLL loading conditions of a running PTA agent service, and export events of a PTA agent certificate are collected.

[0054] When the authentication mode is ADFS, privileged user login logs of an ADFS server and access logs of a WID database are collected.

[0055] Enabling SSO, then collect the attribute change log of AZUREADSSOACC account, authentication certificate and communication certificate export event.

[0056] Preferably, the threat protection subsystem comprises:

[0057] Rule verification module: based on the log and event information recorded by the log event recording module, security verification is carried out;

[0058] Policy execution module: for the rules that do not pass the security verification, the security policy is executed.

[0059] Preferably, in the rule verification module, it comprises:

[0060] Rule verification unit one: based on the data, it is judged whether the database file and the certificate file are consistent, and the result is yes, then the verification is passed, and no processing is carried out; the result is no, then the policy execution module is triggered;

[0061] Rule verification unit two: based on the log and event information recorded by the log event recording module, it is judged whether there is suspicious access, login and loading, the result is yes, then the policy execution module is triggered; the result is no, then no processing is carried out;

[0062] In the policy execution module, the security policy is to issue a warning to the redundant privilege user, restore the user of the PTA agent service and restart the PTA agent service, update the AZUREADSSOACC system account credential; issue a warning for abnormal change of confidential files, and forcibly update the credentials and certificates in the database; issue a warning for important resource access and privilege user login event, judge whether the PTA agent service loads suspicious DLL, the result is yes, then the service needs to be restarted; the result is no, then no processing is carried out.

[0063] Compared with the prior art, the present application has the following beneficial effects:

[0064] 1、The present application realizes the integration and analysis of the local region mixed deployment environment through the preposed mixed deployment state exploration subsystem, improves the user's grasp of the current domain mixed deployment configuration, provides information support for subsequent audit and protection, in other words, the present application realizes more perfect and accurate local region audit and protection in the mixed deployment scene, can be used for comprehensive detection of whether the mixed deployment of the local region environment exists security hidden danger, and executes warning and protection measures according to the risk items, improves the security of the local region when mixed deployment is enabled.

[0065] 2、The application can monitor important resources in a hybrid deployment scenario by auditing privileged users, confidential data and log events, solve the problem of the previous host audit technology in the hybrid deployment scenario, especially in the specific identity verification mode, such as the audit of the AdSync database table of the LocalDB in the PHS mode, the audit of the PTA agent service in the PTA mode, and the audit of the service account AZUREADSSOACC in the SSO mode, so that the audit coverage of the key data of the hybrid deployment of the application is improved by 52% compared with the existing comprehensive host audit technology, reaching about 85%.

[0066] 3、The application can cover 80% of the abnormal conditions of the hybrid deployment by providing default rules and policy sets to check and protect the collected audit data, and by combining the warning and refreshing data protection strategies, the intervention ability of the audit system to the actual environment is improved, the effectiveness of the audit and protection is guaranteed, and the response rate of the user to the audit system is improved by 27%, which can reach about 71%.

[0067] 4、The application can improve the applicability and flexibility of the system by opening the custom rule policy configuration function, so that the user can adjust the protection range and intensity of the local region according to the actual situation, and further improve the coverage range by 15% based on the default rule policy set. BRIEF DESCRIPTION OF DRAWINGS

[0068] Other features, objects and advantages of the application will become more apparent from the following detailed description of non-limiting embodiments with reference to the attached drawings:

[0069] Figure 1 The structural schematic diagram provided by the application is shown in the figure;

[0070] Figure 2 The flowchart provided by the application is shown in the figure. DETAILED DESCRIPTION

[0071] The application will be described in detail below with reference to specific embodiments. The following embodiments will help those skilled in the art to further understand the application, but do not limit the application in any form. It should be pointed out that those skilled in the art can make some changes and improvements without departing from the concept of the application. These all belong to the protection scope of the application.

[0072] To solve the problems of audit omission and narrow analysis in the prior art, the application provides a novel local region audit protection method and system in a hybrid deployment scenario. The application collects data and audit logs more specifically in the hybrid deployment scenario, comprehensively monitors the hybrid deployment state, privileged users and confidential data of the local region, and takes corresponding protection measures according to the built-in strategy, so as to realize more perfect and accurate local region audit and protection in the hybrid deployment scenario. In other words, the application is applicable to a local region enabled with hybrid deployment and associated to the cloud, and the security of the local region is monitored through data audit and threat protection based on local region data and supplemented by cloud data, and the existing risks are alleviated.

[0073] According to the application, a local region audit protection method for Azure cloud hybrid deployment is provided, which includes a hybrid deployment state exploration process, a key data audit process and a threat protection process.

[0074] After entering the hybrid deployment state exploration process, the key data audit process is entered. After entering the key data audit process, the threat protection process is entered, and it is judged whether the rule verification is passed. If the result is yes, the process is ended. If the result is no, the security policy is executed, and the process is ended.

[0075] The hybrid deployment state exploration process includes:

[0076] Step A1: search the service to obtain a server positioning result;

[0077] Step A2: query the service account through the server positioning result;

[0078] Step A3: query the configuration information through the credentials of the service account to determine the identity verification mode;

[0079] The key data audit process includes:

[0080] Step B1: collect the privileged user condition;

[0081] Step B2: monitor and record the data through the identity verification mode based on the privileged user condition, and collect the logs;

[0082] The threat protection process includes:

[0083] Step C1: perform security verification based on the logs and event information obtained in step B2;

[0084] Step C2: execute the security policy for the rules that do not pass the security verification.

[0085] In other words, the application provides a local domain audit protection system for Azure cloud hybrid deployment, comprising a hybrid deployment state exploration subsystem, a key data audit subsystem and a threat protection subsystem.

[0086] The hybrid deployment state exploration subsystem is configured to obtain detailed configuration information and key server locations of the local domain hybrid deployment; the subsystem comprises a hybrid deployment key service query module, a hybrid deployment service account query module and a hybrid deployment configuration query module.

[0087] Firstly, the hybrid deployment state exploration subsystem comprehensively analyzes whether the current domain environment is in a hybrid deployment mode in the local domain, and if so, further determines the identity verification mode adopted by the hybrid deployment, i.e. password hash synchronization PHS, pass-through authentication PTA, federated services ADFS and single sign-on SSO, as well as the key server locations corresponding to different modes.

[0088] Secondly, after the identity verification mode adopted by the hybrid deployment is determined, the key data audit subsystem collects key data and state information from the local domain, and collects logs and events for sensitive resources.

[0089] Finally, different identity verification modes have different characteristics and security risks, and the threat protection subsystem assesses whether there is a security risk in the current domain environment according to these information, and executes corresponding alarm and protection measures according to the built-in audit strategy.

[0090] Specifically, the hybrid deployment state exploration subsystem comprises a hybrid deployment key service query module, a hybrid deployment service account query module and a hybrid deployment configuration query module.

[0091] The hybrid deployment key service query module queries a plurality of key services involved in the hybrid deployment in the local domain, for determining whether the current domain enables hybrid deployment and locating the positions of important servers in the domain; in other words, the key services of the hybrid deployment, i.e. AdSync service, PTA agent service and ADFS service, are searched in the local domain to determine whether the current domain enables hybrid deployment and locate the positions of important servers in the domain. In short, the hybrid deployment state exploration subsystem analyzes whether the current environment enables hybrid deployment in the local domain, locates the positions of related servers and determines the identity verification mode adopted by the hybrid deployment.

[0092] The hybrid deployment service account query module queries the account names and plaintext passwords of MSOL and Sync accounts on the Azure AD Connect server; in other words, the information of the related service accounts of AdSync is queried.

[0093] The hybrid deployment configuration query module queries the detailed configuration information of the on-premises hybrid deployment from the Azure AD through the permissions of the MSOL and Sync accounts, including the primary authentication mode, the domain hosting type, and the hybrid deployment mode used; in other words, the detailed configuration information of the on-premises hybrid deployment is queried from the Azure AD, which is used to determine the authentication mode adopted by the on-premises hybrid deployment.

[0094] The key data auditing subsystem is configured to collect the privileged users, confidential data, and log event information related to the on-premises hybrid deployment; in other words, the key data auditing subsystem collects the privileged users, important data, and state information, and records the operation logs and events of sensitive resources.

[0095] Specifically, the key data auditing subsystem includes a privileged user detection module, a confidential data monitoring module, and a log event recording module.

[0096] The privileged user detection module collects the user list synchronized from the on-premises to the cloud, and detects whether there are different privileged users corresponding to the hybrid deployment authentication mode in the domain; in other words, the user list synchronized from the on-premises to the cloud is collected on the Azure AD Connect server, and whether there are corresponding privileged users in the domain according to the different authentication modes of the hybrid deployment is detected.

[0097] The confidential data monitoring module checks the corresponding database files, cache files, certificate files, and encrypted private key files in the on-premises domain according to the different authentication modes of the hybrid deployment, which store important data such as user credentials, access tokens, and digital certificates, and monitors the access permissions of these files.

[0098] The log event recording module records the sensitive operation logs, service running logs, access events of sensitive resources, and user login events according to the different authentication modes of the hybrid deployment; in other words, the abnormal operation logs, service running logs, sensitive resource access events, and user login events for the hybrid deployment are recorded.

[0099] The threat protection subsystem is configured to verify the auditing results of the key data, assess whether there are security risks in the on-premises domain, and execute corresponding mitigation strategies; in other words, the threat protection subsystem performs rule verification according to the key data auditing results, assesses the security risks in the on-premises domain, and executes corresponding mitigation strategies.

[0100] Specifically, the threat protection subsystem includes a rule policy configuration module, a rule verification module, and a policy execution module.

[0101] The information collected by the key data auditing subsystem is received, and internal configured security rules are checked, and corresponding strategies are executed according to the checking results of the rules.

[0102] The rule strategy configuration module provides a customized rule configuration function, and different checking rules and execution strategies can be configured for the collected key data in different hybrid deployment authentication modes; in other words, the rules to be checked and the strategies to be executed are formulated according to the collected data.

[0103] The rule checking module checks the information collected by the key data auditing subsystem according to the preconfigured checking rules, and returns the checking results of all rules.

[0104] The strategy execution module executes corresponding security strategies for the rules that do not pass the checking according to the preconfigured execution strategies, so as to realize threat protection and security improvement.

[0105] In other words, according to the on-premises audit protection method for the Azure cloud hybrid deployment provided by the application, the hybrid deployment state exploration method, the key data auditing method and the log event recording method are executed in sequence, that is, the hybrid deployment state exploration process, the key data auditing process and the threat protection process are entered in sequence;

[0106] The hybrid deployment state exploration process comprises:

[0107] The hybrid deployment key service query step, referred to as step A1: searching for the AdSync service, the PTA agent service and the ADFS service in the on-premises region, and locating the Azure AD Connect server, the PTA agent server and the ADFS server through the corresponding search results, respectively;

[0108] The PTA agent service, that is, the key service running on the PTA agent server in the PTA authentication mode. The full name of PTA is Pass-Through Authentication, that is, straight-through authentication. The full name of the PTA agent service is AzureADConnectAuthenticationAgentService.

[0109] The hybrid deployment service account query, referred to as step A2: querying the service account of the AdSync service on the Azure AD Connect server through the locating result of the server; the service account is the name and plaintext credentials, that is, plaintext password, of the MSOL account and the Sync account.

[0110] Hybrid deployment configuration query, step A3: access Azure AD with Sync account's credential, query the detailed configuration information of the on-premise hybrid deployment from Azure AD, to determine the authentication mode of the hybrid deployment is PHS, PTA or ADFS, and whether SSO is additionally enabled. The configuration information includes: the primary authentication mode, the type of domain hosting.

[0111] The key data audit process includes:

[0112] Privileged user detection, step B1: collect the list of users synchronized from on-premise to cloud on the Azure AD Connect server, and collect the information of the members of the AdSync service administrator group, the information of the users belonging to the PTA agent service, the information of the members of the ADFS service administrator group, and the account information of the SSO service account AZUREADSSOACC, to collect the privileged user information in the on-premise hybrid deployment.

[0113] In other words, different privileged users are recorded according to different authentication modes that the on-premise domain is currently in: if in PHS mode, record the information of the members of the AdSync service administrator group; if in PTA mode, record the information of the users belonging to the PTA agent service; if in ADFS mode, record the information of the members of the ADFS service administrator group; if SSO is additionally enabled, record the account information of the SSO service account AZUREADSSOACC.

[0114] The service account AZUREADSSOACC is a computer account automatically created in the active directory by the Azure AD Connect server after seamless SSO is enabled in the on-premise domain.

[0115] This account is also the service account of the service https: / / autologon.microsoftazuread-sso.com represented by seamless SSO, and the credential controlling this account can be considered as controlling the seamless SSO service.

[0116] Secret data monitoring, step B2: monitor different data according to different authentication modes that the on-premise domain is currently in.

[0117] If in PHS mode, record the file basic information and changes of the AdSync table of the LocalDB database; if in PTA mode, record the basic information and changes of the PTA agent certificate; if in ADFS mode, record the file basic information and changes of the ServiceSetting table of the WID database; if SSO is additionally enabled, record the basic information and changes of the SSO device authentication certificate and communication certificate; in other words, record the basic information and changes of the LocalDB database, the WID database, the PTA agent certificate, the SSO device authentication and communication certificate.

[0118] Log event recording collects different logs and events according to different identity authentication modes in which the local region is currently located, referred to as step B3: if in PHS mode, collect the privileged user login logs of the Azure AD Connect server, collect the access logs of the LocalDB database, collect the logs generated when the MSOL user performs directory replication, and record the login events of the Sync account in the Azure AD;

[0119] If in PTA mode, collect the privileged user login logs of the PTA agent server, collect the start-stop records of the PTA agent service, record the DLL loading of the PTA agent service that is running, and record the export events of the PTA agent certificate.

[0120] If in ADFS mode, collect the privileged user login logs of the ADFS server, and collect the access logs of the WID database; if SSO is additionally enabled, collect the change logs of the AZUREADSSOACC account, and record the export events of the device authentication certificate and the communication certificate; in other words, collect the user login events of the Azure AD Connect server, the PTA agent server and the ADFS server, collect the access logs of the LocalDB and the WID database, and collect the operation logs of the AdSync service account, the PTA agent service and the SSO service account.

[0121] The threat prevention process comprises:

[0122] Based on the collected privileged user information, check whether the local administrator and the cloud administrator exist in the user synchronization list, check whether the non-default privileged user exists in the administrator group of the key service, check whether the user to which the PTA agent service belongs is a custom user, and check whether the attribute of the SSO service account AZUREADSSOACC is changed.

[0123] Rule check, check the collected key data through pre-configured security rules, simply step C1: check whether there are administrators with too high permissions and non-default custom users in privileged users, check the consistency of confidential data and whether there are abnormal changes, check whether there are suspicious operations and use records in log events.

[0124] Based on the collected confidential data, check the consistency of the database file and the certificate file, and check whether there are abnormal changes.

[0125] Based on the collected log and event information, check whether there are suspicious access to important resources, check whether there are suspicious login and use events of privileged users, and check whether the PTA agent service loads suspicious DLL.

[0126] Policy execution, simply step C2: for the rules that do not pass the check, execute the security policy, including issuing a warning for abnormal phenomena, restoring or updating important data for abnormal transactions, and restoring the local security state.

[0127] For each rule that does not pass the security check, execute the corresponding security policy.

[0128] Based on the check of privileged user information, issue a warning for redundant privileged users, restore the user of the PTA agent service and restart the PTA agent service, and update the AZUREADSSOACC system account credentials.

[0129] Based on the check of confidential data, issue a warning for abnormal changes of confidential files, and force update the credentials and certificates in the database.

[0130] Based on the check of log events, issue a warning for important resource access and privileged user login events, and restart the PTA agent service that loads suspicious DLL.

[0131] Step one: the hybrid deployment state exploration subsystem runs in the local region with certain permissions, collects hybrid deployment key service information, hybrid deployment service account information, and hybrid deployment detailed configuration information, and transmits the information to the key data audit subsystem.

[0132] Step two: the key data audit subsystem runs in the local region with certain permissions according to the received information. According to the hybrid deployment key service information, collect synchronization user information and privileged user list on the corresponding server; according to the hybrid deployment key service information and detailed configuration information, collect important file data on the corresponding server and monitor file access permissions; according to the hybrid deployment detailed configuration information, record sensitive operation logs and key events in the local region; finally, transmit the data to the threat protection subsystem.

[0133] Step three: the threat protection subsystem provides a customized rule policy configuration function, and the user can pre-configure additional necessary rules and policies; then, the threat protection subsystem checks the audit data according to the received data by using the defined rules to obtain the checking result of each rule; finally, according to the result obtained by checking, for the rules that do not pass the checking, the pre-defined security policy is executed.

[0134] The local region audit protection method for the Azure cloud hybrid deployment provided by the application has a method flow as shown in the figure Figure 2 When the hybrid deployment identity verification mode used by the local region is different, the specific implementation is as follows.

[0135] Step one: the hybrid deployment state exploration method is executed in the local region.

[0136] 1.1, the key service query sub-method, important services are scanned in the local region, and the servers where the AdSync service, the PTA agent service and the ADFS service are located are located, which are the Azure AD Connect server, the PTA agent server and the ADFS server; according to the hybrid deployment identity verification method used by the local region, the PTA agent server and the ADFS server do not necessarily exist, but the Azure AD Connect server must exist.

[0137] 1.2, the hybrid deployment service account query sub-method, connecting to the LocalDB database on the Azure AD Connect server, querying the plaintext credentials of the AdSync service account, that is, the MSOL account and the Sync account.

[0138] 1.3, the hybrid deployment configuration query sub-method, logging in to the Azure cloud through the credentials of the Sync service account, obtaining the hybrid deployment detailed configuration information of the local region from the Azure AD, and determining the identity verification mode used by the hybrid deployment.

[0139] Step two: the key data audit method is executed in the local region, first, the user list synchronized from the local region to the cloud is collected on the Azure AD Connect server. Then, according to the hybrid deployment mode used by the local region, the method will have different execution processes.

[0140] In particular, when the hybrid deployment mode used by the local region is PHS:

[0141] a, the privileged user detection sub-method, records the member information of the AdSync service administrator group;

[0142] b, the confidential data monitoring sub-method, records the file basic information and change of the AdSync table of the LocalDB database;

[0143] c. Log event recording sub-method, collecting privileged user login logs of the Azure AD Connect server, collecting access logs of the LocalDB database, collecting logs generated when the MSOL user performs directory replication, and recording login events of the Sync account in the Azure AD.

[0144] In particular, when the hybrid deployment mode used by the local region is PTA:

[0145] a. Privileged user detection sub-method, recording information of users belonging to the PTA agent service;

[0146] b. Confidential data monitoring sub-method, recording basic information and changes of the PTA agent certificate;

[0147] c. Log event recording sub-method, collecting privileged user login logs of the PTA agent server, collecting start-stop records of the PTA agent service, recording DLL loading of the PTA agent service running, and recording export events of the PTA agent certificate.

[0148] In particular, when the hybrid deployment mode used by the local region is ADFS:

[0149] a. Privileged user detection sub-method, recording member information of the ADFS service administrator group;

[0150] b. Confidential data monitoring sub-method, recording basic information and changes of the WID database ServiceSetting table file;

[0151] c. Log event recording sub-method, collecting privileged user login logs of the ADFS server, and collecting access logs of the WID database;

[0152] In particular, when the local region additionally enables SSO:

[0153] a. Privileged user detection sub-method, recording account information of the SSO service account AZUREADSSOACC;

[0154] b. Confidential data monitoring sub-method, recording basic information and changes of the SSO device authentication certificate and communication certificate;

[0155] c. Log event recording sub-method, collecting attribute change logs of the AZUREADSSOACC account, and recording export events of the device authentication certificate and communication certificate.

[0156] Step three: threat protection method is executed based on the audit data above. If the rule check is successful, the built-in rule policy set is used for rule check and policy execution; if the rule check fails, the corresponding policy is executed. There is a basic rule policy set by default, and additional custom rules or policies are added or modified.

[0157] 3.1 Custom rules and policies

[0158] a. When customizing rules, the following three are performed: first, specify the data type for which the rule checks, which is one of the data types returned by the key data audit method in step two; second, specify the data range allowed by the rule, for privileged user information, specify the reasonable user range, for confidential data information, specify the reasonable basic attributes and whether attribute changes are supported, for log event information, specify the reasonable log operator and whether event occurrence is supported; third, set the expected check result of the rule according to the data range, the rule check returns a binary result, when the check fails, the corresponding policy is triggered for execution.

[0159] b. When customizing policies, the following two are performed: first, specify the rule corresponding to the policy; second, specify the execution content of the policy, such as issuing a warning for abnormal data, or resetting the state of abnormal data, etc.

[0160] The following is an example of the default rule and policy set provided by the application, which gives the subsequent implementation of the threat protection method.

[0161] 3.2 Based on the privileged user information collected in step two

[0162] a. Check if there is a local or cloud administrator in the user synchronization list, and if there is a non-default privileged user in the administrator group of each identity verification key service; if so, the check fails. When the check fails, a warning is issued for the redundant privileged user;

[0163] b. In particular, when the PTA mode is used in the local region, check if the user belonging to the PTA agent service is a custom user; if so, the check fails. When the check fails, a warning is issued for the PTA agent service, the user belonging to the PTA agent service is restored, and the PTA agent service is restarted;

[0164] c. In particular, when the SSO mode is used in the local region, check if the AZUREADSSOACC account has attribute changes; if not, the check is successful; if so, the check fails. When the check fails, a warning is issued for the AZUREADSSOACC account, and the AZUREADSSOACC system account credentials are forced to update.

[0165] 3.3, based on the confidential data collected in step two, check the consistency of the database file, the certificate file itself, check whether there is an abnormal change; if so, the check fails. When the check fails, a warning is issued for the abnormal change of the confidential file, and the corresponding user credentials and certificates are forced to update.

[0166] 3.4, based on the log events collected in step two

[0167] a, check whether there is suspicious access to important resources, and check whether there is suspicious login of privileged users on important servers; if so, the check fails. When the check fails, a warning is issued for important resource access and privileged user login events;

[0168] b, in particular, when the local domain uses the PTA mode, check whether the PTA agent service loads suspicious DLL; if so, the check fails. When the check fails, a warning is issued for the PTA agent service, and the PTA agent service loaded with suspicious DLL is restarted.

[0169] The application also provides a local domain audit protection system for Azure cloud hybrid deployment, which can be realized by executing the process steps of the local domain audit protection method for Azure cloud hybrid deployment, that is, the local domain audit protection method for Azure cloud hybrid deployment can be understood by those skilled in the art as the preferred embodiment of the local domain audit protection system for Azure cloud hybrid deployment.

[0170] According to the application, a local domain audit protection system for Azure cloud hybrid deployment is provided, which comprises a hybrid deployment state exploration subsystem, a key data audit subsystem and a threat protection subsystem.

[0171] After triggering the hybrid deployment state exploration subsystem to work, the key data audit subsystem is triggered to work; after triggering the key data audit subsystem to work, the threat protection subsystem is triggered to work, and it is judged whether the rule check is passed, and the result is yes, then it is ended; the result is no, then the security policy is executed, and it is ended.

[0172] Those skilled in the art know that, in addition to implementing the system provided by the present application and each device, module and unit thereof in the form of pure computer readable program code, the system provided by the present application and each device, module and unit thereof can also be implemented in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers and embedded microcontrollers, etc. by logically programming the method steps to achieve the same functions. Therefore, the system provided by the present application and each device, module and unit thereof can be considered as a hardware component, and the devices, modules and units included therein for achieving various functions can also be considered as structures within the hardware component; the devices, modules and units for achieving various functions can also be considered as both software modules implementing methods and structures within hardware components.

[0173] The specific embodiments of the present application are described above. It needs to be understood that the present application is not limited to the specific embodiments described above, and various changes or modifications can be made by those skilled in the art within the scope of the claims, which does not affect the essential content of the present application. The embodiments of the present application and the features in the embodiments can be combined with each other in any manner without conflict.

Claims

1. A method for local domain audit protection for Azure cloud hybrid deployment, characterized in that, The method comprises the following steps: a hybrid deployment state exploration process, a key data audit process and a threat prevention process are included; after entering the hybrid deployment state exploration process, the key data audit process is entered; after entering the key data audit process, the threat prevention process is entered, and it is judged whether the rule verification is passed, and the result is yes, and the method ends; the result is no, and a security policy is executed, and the method ends; the hybrid deployment state exploration process comprises the following steps: step A1: searching a service to obtain a server positioning result; step A2: querying a service account through the server positioning result; step A3: querying configuration information through credentials of the service account to determine an identity verification mode; the key data audit process comprises the following steps: step B1: collecting a privileged user condition; step B2: monitoring and recording data through the identity verification mode based on the privileged user condition, and collecting logs; the threat prevention process comprises the following steps: step C1: performing security verification based on logs and event information obtained in the step B2; step C2: executing a security policy for a rule that does not pass the security verification.

2. The method for on-premise audit protection for Azure cloud hybrid deployment of claim 1, wherein, in the step A1, the service comprises an AdSync service, a PTA agent service and an ADFS service; and the server positioning result comprises an Azure AD Connect server, a PTA agent server and an ADFS server; in the step A2, the service account of the AdSync service is queried on the server through the positioning result of the Azure AD Connect server; in the step A3, configuration information is queried by accessing the Azure AD through the credentials of the service account; the configuration information comprises an identity verification mode and a type of domain hosting; the identity verification mode comprises PHS, PTA, ADFS or SSO.

3. The method for on-premise audit protection for Azure cloud hybrid deployment of claim 2, wherein, in the step B1, the privileged user condition comprises member information of an AdSync service administrator group, user information of a PTA agent service, member information of an ADFS service administrator group and account information of an SSO service account AZUREADSSOACC; in the step B2, when the identity verification mode is a PHS mode, information of a LocalDB database AdSync table is recorded; when the identity verification mode is a PTA mode, information of a PTA agent certificate is recorded; when the identity verification mode is an ADFS mode, information of a WID database ServiceSetting table is recorded; whether SSO is enabled is judged, and the result is yes, and information of SSO device authentication certificates and communication certificates is recorded; the result is no, and no record is made; in the step B2, when the identity verification mode is the PHS mode, privileged user login logs of the Azure AD Connect server, access logs of the LocalDB database, MSOL user directory replication logs and login events of a Sync account in the Azure AD are collected. The identity authentication mode is the PTA mode, and privilege user login logs of a PTA agent server, start-stop records of a PTA agent service, DLL loading of a running PTA agent service and export events of a PTA agent certificate are collected; The identity authentication mode is the ADFS mode, and privilege user login logs of an ADFS server and access logs of a WID database are collected; When SSO is enabled, attribute change logs of an AZUREADSSOACC account, export events of authentication certificates and communication certificates are collected.

4. The method for on-premise audit protection for Azure cloud hybrid deployment of claim 1, wherein, In the step C1: Step C1.1: Based on the data, it is judged whether the database file and the certificate file are consistent, and the result is yes, then it is verified, and no processing is performed; The result is no, and step C2 is performed; Step C1.2: Based on the log and event information obtained in step B2, it is judged whether there is suspicious access, login and loading, and the result is yes, then step C2 is performed; the result is no, and no processing is performed; In the step C2, the security policy is to issue a warning to the redundant privilege user, restore the user of the PTA agent service and restart the PTA agent service, update the AZUREADSSOACC system account credential; issue a warning for abnormal change of confidential files, and forcibly update the credentials and certificates in the database; issue a warning for important resource access and privilege user login events, and judge whether the PTA agent service loads suspicious DLL, and the result is yes, then the service needs to be restarted; The result is no, and no processing is performed.

5. A local domain audit protection system for Azure cloud hybrid deployment, characterized in that, It includes: A hybrid deployment state exploration subsystem, a key data audit subsystem and a threat protection subsystem; After triggering the hybrid deployment state exploration subsystem to work, the key data audit subsystem is triggered to work; After triggering the key data audit subsystem to work, the threat protection subsystem is triggered to work, and it is judged whether the rule verification passes, and the result is yes, then it is ended; The result is no, and the security policy is executed, and it is ended; The hybrid deployment state exploration subsystem includes: A hybrid deployment key service query module: search the service to obtain a server positioning result; A hybrid deployment service account query module: query the service account through the server positioning result; A hybrid deployment configuration query module: query the configuration information through the credential of the service account to determine the identity authentication mode; The key data audit subsystem includes: A privilege user detection module: collect the privilege user situation; A confidential data monitoring module: monitor the data according to the identity authentication mode based on the privilege user situation; A log event recording module: record the data according to the identity authentication mode and collect the log; The threat protection subsystem includes: A rule verification module: perform security verification based on the log and event information recorded by the log event recording module; A policy execution module: execute the security policy for the rule that does not pass the security verification.

6. The on-premise audit protection system for Azure cloud hybrid deployment of claim 5, wherein, In the hybrid deployment key service query module, the service includes an AdSync service, a PTA agent service and an ADFS service; and the server positioning result includes an Azure AD Connect server, a PTA agent server and an ADFS server. In the hybrid deployment service account query module, the service account of the AdSync service is queried on the Azure AD Connect server through the positioning result of the server; In the hybrid deployment configuration query module, the configuration information is queried by accessing the Azure AD through the credentials of the service account; The configuration information includes: authentication mode, type of domain hosting; The authentication mode includes: PHS, PTA, ADFS or SSO.

7. The on-premise audit protection system for Azure cloud hybrid deployment of claim 6, wherein, In the privileged user detection module, the privileged user situation includes: member information of the AdSync service administrator group, user information of the PTA agent service, member information of the ADFS service administrator group, and account information of the SSO service account AZUREADSSOACC; In the log event recording module, if the authentication mode is PHS mode, the information of the LocalDB database AdSync table is recorded; if the authentication mode is PTA mode, the information of the PTA agent certificate is recorded; if the authentication mode is ADFS mode, the information of the WID database ServiceSetting table is recorded; if SSO is enabled, the information of the SSO device authentication certificate and the communication certificate is recorded; if SSO is not enabled, no record is made; In the log event recording module, the collection of the log, if the authentication mode is PHS mode, the privileged user login log of the Azure AD Connect server, the access log of the LocalDB database, the MSOL user directory replication log and the login event of the Sync account in the Azure AD are collected; If the authentication mode is PTA mode, the privileged user login log of the PTA agent server, the start-stop record of the PTA agent service, the DLL loading situation of the running PTA agent service and the export event of the PTA agent certificate are collected; If the authentication mode is ADFS mode, the privileged user login log of the ADFS server and the access log of the WID database are collected; If SSO is enabled, the attribute change log of the AZUREADSSOACC account, the export event of the authentication certificate and the communication certificate are collected.

8. The on-premise audit protection system for Azure cloud hybrid deployment of claim 5, wherein, In the rule checking module, it includes: Rule checking unit one: based on the data, it is judged whether the database file and the certificate file are consistent, if the result is yes, it is passed, and no processing is performed; if the result is no, the policy execution module is triggered; Rule checking unit two: based on the log and event information recorded by the log event recording module, it is judged whether there is suspicious access, login and loading, if the result is yes, the policy execution module is triggered; if the result is no, no processing is performed; In the policy execution module, the security policy is used to issue a warning to the redundant privileged user, restore the user of the PTA agent service and restart the PTA agent service, update the AZUREADSSOACC system account credential, issue a warning to the abnormal change of the confidential file, and force to update the credential and the certificate in the database; issue a warning to the important resource access and the privileged user login event, judge whether the PTA agent service loads the suspicious DLL, and if the result is yes, the service needs to be restarted; if the result is no, it is not processed.

Images