Processing method and device for accessing white list by application, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a processing method and device for accessing a white list by an application, electronic equipment and a storage medium, and can be widely applied to the technical field of Internet. According to the application, after the architecture information of the to-be-accessed service is acquired, the access control agent layer of each to-be-accessed service is determined according to the architecture information, and then the acquired white list access rule is deployed in the access control agent layer, so that after the current access information is acquired, the access of each to-be-accessed service is completed. The application access white list management and control processing can be performed according to the current access information and the white list access rule, so that the white list access rule does not need to be configured at each service access entrance, the service resources occupied by the white list access rule are effectively reduced, and the utilization rate of the service resources can be improved.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a method and device for processing an application access whitelist, an electronic device, and a storage medium. Background Art

[0002] In the related technology, during the application access process, the corresponding whitelist rules are pre-deployed at each traffic entrance of the corresponding service, so that access control is performed through the whitelist rules of each entrance when the service is accessed. When the list of simultaneous accesses is more complicated, the existing whitelist control method needs to occupy more network resources, which leads to low utilization rate of the currently accessed service data.

[0003] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a method and device for processing an application access whitelist, an electronic device and a storage medium, which can effectively improve the utilization rate of service resources.

[0005] To achieve the above purpose, one aspect of an embodiment of the present application provides a method for processing an application access whitelist, the method comprising the following steps:

[0006] Get the architecture information of the service to be accessed;

[0007] Determine the access control proxy layer of each service to be accessed according to the architecture information;

[0008] Get all whitelist access rules;

[0009] Deploy all the whitelist access rules in the access control proxy layer;

[0010] Get current access information;

[0011] Application access whitelist control processing is performed according to the current access information and the whitelist access rules.

[0012] In some embodiments, obtaining all whitelist access rules includes:

[0013] Obtain all application configuration information of the service to be accessed;

[0014] The whitelist access rule is generated according to the application configuration information.

[0015] In some embodiments, performing application access whitelist control processing according to the current access information and the whitelist access rule includes:

[0016] Analyzing a first service type corresponding to the current access information, where the first service type includes an internal access service type and an external access service type of the service to be accessed;

[0017] Determining a first target access rule from all the whitelist access rules according to the first service type;

[0018] Application access whitelist control processing is performed according to the current access information and the first target access rule.

[0019] In some embodiments, performing application access whitelist control processing according to the current access information and the first target access rule includes:

[0020] Obtaining an access identifier for the current access information;

[0021] It is determined that the access identifier exists in the first target access rule, and the application access process corresponding to the current access information is allowed to access the service to be accessed.

[0022] In some embodiments, performing application access whitelist control processing according to the current access information and the whitelist access rule includes:

[0023] Analyzing a second service type of the current access information, where the second service type includes an interface access service type and a preset protocol access service type of the service to be accessed;

[0024] Determining a second target access rule from all the whitelist access rules according to the second service type;

[0025] Application access whitelist control processing is performed according to the current access information and the second target access rule.

[0026] In some embodiments, performing application access whitelist control processing according to the current access information and the second target access rule includes:

[0027] Obtaining current interface configuration information or preset protocol configuration information in current access information;

[0028] It is determined that the current interface configuration information or the preset protocol configuration information exists in the second target access rule, and the application access process corresponding to the current access information is allowed to access the service to be accessed.

[0029] In some embodiments, determining the access control proxy layer of each service to be accessed according to the architecture information includes:

[0030] Perform aspect programming for each of the services to be accessed according to the architecture information to obtain aspect programming code;

[0031] Apply the aspect programming code to the service to be accessed to obtain the access control proxy layer.

[0032] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application provides a device for processing an application access whitelist, the device comprising:

[0033] The first module is used to obtain the architecture information of the service to be accessed;

[0034] The second module is used to determine the access control proxy layer of each service to be accessed according to the architecture information;

[0035] The third module is used to obtain all whitelist access rules;

[0036] The fourth module is used to deploy all the whitelist access rules in the access control proxy layer;

[0037] The fifth module is used to obtain current access information;

[0038] The sixth module is used to perform application access whitelist control processing according to the current access information and the whitelist access rules.

[0039] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-mentioned application access whitelist processing method when executing the computer program.

[0040] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned application access whitelist processing method is implemented.

[0041] The present application proposes a method and device for processing an application access whitelist, an electronic device, and a storage medium. After obtaining the architecture information of the service to be accessed, the scheme determines the access control proxy layer of each service to be accessed according to the architecture information, and then deploys the obtained whitelist access rules in the access control proxy layer, so that after obtaining the current access information, the application access whitelist control processing can be performed according to the current access information and the whitelist access rules, thereby eliminating the need to configure whitelist access rules at each service access entrance, effectively reducing the service resources occupied by the whitelist access rules, and thus improving the utilization of service resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 is a flowchart of a method for processing an application access whitelist provided in an embodiment of the present application;

[0043] Figure 2 It is an interactive schematic diagram of application access services in the prior art;

[0044] Figure 3 is a flowchart of step S120 provided in an embodiment of the present application;

[0045] Figure 4 is a flowchart of step S130 provided in an embodiment of the present application;

[0046] Figure 5 is a specific implementation flow chart of step S160 provided in an embodiment of the present application;

[0047] Figure 6 is another specific implementation flow chart of step S160 provided in an embodiment of the present application;

[0048] Figure 7 It is a schematic diagram of an application interaction scenario of a method for processing an application access whitelist provided in an embodiment of the present application;

[0049] Figure 8 It is a structural diagram of a processing device for application access whitelist provided in an embodiment of the present application;

[0050] Fig. 9 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0054] First, some nouns involved in this application are analyzed:

[0055] The Internet (i nternet) is also known as the Internet, which is an international computer network composed of wide area networks, metropolitan area networks, local area networks and single machines according to certain communication protocols. The Internet refers to the result of connecting two computers or more than two computer terminals, clients, and servers through computer information technology. Users can send emails to each other, complete a task together, and have fun together with friends thousands of miles away. At the same time, the Internet is also an important part of the Internet of Things. According to the definition of the Internet of Things School-Enterprise Alliance, the Internet of Things is the combination of almost all current technologies and computer Internet technologies, allowing information to be collected, transmitted, processed and executed faster and more accurately.

[0056] Network services are the core components of modern computer networks. They greatly enrich the computing experience of users by providing various functions and applications, and promote the development of Internet applications. Services in computer networks refer to various functions and applications provided through the network, which enable users to interact, communicate, and share resources and data conveniently. Services can be user-oriented, such as providing information query and mail services, or system management-oriented, such as resource allocation and security management.

[0057] A network interface is a hardware and software component that enables communication between a computer or other network device and a network. A network interface allows data to be transmitted between a device and a network, supporting the sending and receiving of data. At the software level, a network interface interacts with the network through the network protocol stack and drivers provided by the operating system.

[0058] IP (interconnection protocol between the Internet) is a protocol for packet switching data networks, whose task is only to transmit data based on the addresses of the source host and the destination host. The Internet Protocol defines the addressing method and the encapsulation structure of the datagram.

[0059] TCP (Transmission Control Protocol) is a connection-oriented, reliable, byte-stream-based transport layer communication protocol. TCP is located at the fourth layer (transport layer) in the OSI (Open Systems Interconnection) model. The main function of the TCP protocol is to establish a reliable data transmission connection on the Internet to ensure the integrity, orderliness and reliability of the data.

[0060] HTTP (HyperText Transfer Protocol) is an application layer protocol used to transmit hypertext data (such as HTML) on the World Wide Web. The HTTP protocol works based on the TCP / IP protocol and is also a client-server model. The client is usually the user's web browser, and the server is the remote host that stores the website content.

[0061] FTP (File Transfer Protocol) is an application layer protocol for transferring files on a computer network. FTP allows users to connect to a remote server through a client program to upload files (transfer files from the client to the server) and download files (transfer files from the server to the client).

[0062] DNS (Domain Name System) is a distributed database used in TCP / IP networks to convert easy-to-remember domain names (such as www.example.com) into IP addresses (such as 192.0.2.1) that computers and network devices can understand. Based on the function of DNS, users can access websites by entering domain names instead of having to remember complex IP addresses. DNS servers act as translators between domain names and IP addresses, helping users quickly find and access resources on the Internet.

[0063] DHCP (Dynamic Host Configuration Protocol) is a network protocol used to dynamically assign IP addresses and other network configuration information to devices connected to the network. DHCP simplifies the network management process, improves the efficiency of network resource use, and allows network administrators to centrally manage the allocation of IP addresses.

[0064] VPN (Virtual Private Network) is a network technology that allows users to create a secure, private connection through a public network (such as the Internet). VPN technology ensures the security, privacy, and integrity of data transmission by establishing an encrypted communication tunnel over a public network.

[0065] A gateway is a device or functional module used to connect two different networks in a network. It acts as a bridge for cross-network communication. The gateway not only makes communication between different networks possible, but also provides important functions such as protocol conversion, data filtering and security protection.

[0066] A proxy is a network service that allows a network terminal (such as a client) to connect indirectly to another network terminal (such as a server) through a proxy server. The proxy service acts as an intermediary between the client and the server and can be used for a variety of purposes, such as increasing access speed, enhancing privacy protection, and bypassing network restrictions.

[0067] Aspect-Oriented Programming (AOP) is a programming paradigm that aims to improve the modularity and maintainability of code by separating cross-cutting concerns from business logic.

[0068] In the related art, during the application service access process, a corresponding gateway service is deployed at each traffic entrance, and access whitelist rules are configured on the gateway service to control each traffic entrance through the configured whitelist rules, thereby achieving secure access to the service. Figure 2 As shown, for application service A, it is necessary to set up a separate traffic entrance, such as setting up a separate Internet entrance gateway, an office network entrance gateway, and a traffic entrance for application service B, and configuring access whitelist rules at each traffic entrance, so that when accessing the application service, the accessed service can be controlled through the whitelist rules at each traffic entrance. This application service whitelist control method has the following problems:

[0069] First, since it is necessary to deploy corresponding gateways and configure relevant whitelist rules at each traffic entrance, more resources and data need to be prepared in more complex network scenarios, which requires a lot of management manpower and resources.

[0070] Second, the management and interception capabilities are implemented at the traffic entry level of all services. When there are many services, the whitelist rule set will become very large, resulting in poor performance of the whitelist rule judgment logic. Splitting multiple gateways will lead to a sharp increase in resources and thus an increase in costs.

[0071] Based on this, an embodiment of the present application provides a method and device for processing an application access whitelist, an electronic device and a storage medium. After obtaining the architecture information of the service to be accessed, the present application determines the access control proxy layer of each service to be accessed according to the architecture information, and then deploys the obtained whitelist access rules in the access control proxy layer, so that after obtaining the current access information, application access whitelist control processing can be performed according to the current access information and the whitelist access rules, thereby eliminating the need to configure whitelist access rules at each service access entrance, effectively reducing the service resources occupied by whitelist access rules, thereby improving the utilization of service resources and reducing the control cost of service access.

[0072] The application access whitelist processing method and device, electronic device and storage medium provided in the embodiments of the present application are specifically described through the following embodiments. First, the application access whitelist processing method in the embodiments of the present application is described.

[0073] The method for processing an application access whitelist provided in the embodiment of the present application relates to the field of Internet technology. The method for processing an application access whitelist provided in the embodiment of the present application can be applied to a terminal, can be applied to a server side, or can be software running in a terminal or a server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or can be configured as a server cluster or a distributed system composed of multiple physical servers, or can be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the method for processing an application access whitelist, etc., but is not limited to the above forms.

[0074] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0075] Figure 1 is an optional flowchart of a method for processing an application access whitelist provided in an embodiment of the present application. Figure 1 The method may include but is not limited to steps S110 to S160:

[0076] Step S110, obtaining architecture information of the service to be accessed;

[0077] It can be understood that the service to be accessed refers to the application service that the target object can access. Exemplarily, assuming that there are currently application services 1, 2, and 3, if the target object is located in an area where only application service 2 can be accessed, application service 2 will be used as the service to be accessed; if the target object is located in an area where only application service 2 and application service 3 can be used, application service 2 or application service 3 can be used as the service to be accessed. Since application service 1 cannot be accessed in the area, there is no need to consider the architecture information of application service 1. Assuming that there are currently application services 4, 5, and 6, if the software used by the target object can only access application service 4, application service 4 will be used as the service to be accessed; if the software used by the target object can access application service 5 and application service 6 at the same time, application service 5 and application service 6 can be used as the services to be accessed at the same time. Specifically, this embodiment can also determine the service to be accessed based on other access permission information, which is not specifically limited in this embodiment.

[0078] It is understood that the network architecture may include, but is not limited to, a technical blueprint for designing, building, and managing a communication network. The technical blueprint is used to define various aspects of a data communication system in a network, including user interface types, network protocols, wiring types, etc. In an embodiment of the present application, the architecture information in this embodiment is used to determine the structure of the network architecture, wherein the network architecture of this embodiment may be a hierarchical structure, so that the communication task may be divided into multiple subtasks to be completed by network components at different layers, and each layer may interact with other layers or other application services through a clearly defined interface.

[0079] In the embodiment of the present application, the components of the network architecture determined by the embodiment of the present application through the architecture information include but are not limited to network devices, network protocols, network topology and network services. Specifically, network devices include but are not limited to routers, switches, firewalls, load balancers, etc., which are responsible for data transmission, forwarding and security protection; network protocols include but are not limited to TCP / IP, HTTP, FTP protocols, etc., which are used to achieve effective communication processes between different devices; network topology is used to describe the physical and logical layout of devices in the network, such as star layout, ring layout, bus layout and mesh layout, etc.; network services include but are not limited to DNS, DHCP, VPN, etc., which are used to provide advanced network functions required by the target object. By obtaining the architecture information of the service to be accessed, the embodiment of the present application can effectively improve the accuracy of subsequent processing steps.

[0080] Step S120: Determine the access control proxy layer of each service to be accessed according to the architecture information;

[0081] It can be understood that the network architecture constructed based on the architecture information in the embodiment of the present application can be a hierarchical structure, and each layer can define and implement different service functions. Specifically, the network architecture of the present embodiment can include but is not limited to the service mesh architecture, and the access control proxy layer corresponding to each service is set in the form of a service grid of the service mesh architecture, so that all access lists of the service can be controlled through the access control proxy layer. Exemplarily, assuming that there are several services in the service mesh architecture, and each service calls, analyzes and runs the service through a small grid resource in the service mesh architecture, then the present embodiment can set a network proxy (proxy) as an access control proxy layer before the application service in the grid, so that other application services can access the application service. The access list control can be performed through the access control proxy layer, that is, analyze whether the access application is qualified to access the application service. If it is not qualified to access the application service, the access process of the access application is directly rejected; if it is qualified to access the application service, the access process of the access application is released, so as to improve the access security of the accessed application while ensuring the normal access process of the access application.

[0082] In an embodiment of the present application, the access management proxy layer can be a small area in the corresponding network architecture, which is used to specifically perform application access control to improve access security. Specifically, the access management proxy layer can be set in a small front-end area of ​​the corresponding application service execution layer, and the remaining area is used to implement the calling, analysis and operation functions of the application service. Exemplarily, when there is a grid 1 in the network architecture 1 for managing all functions of the application service 1, the front-end area of ​​the grid 1 can be divided as the access control proxy layer. When it is determined based on the request information that application service 1 needs to be accessed, the request information will first enter the access control proxy layer. The access control proxy layer determines whether the current request is allowed to access application service 1 by analyzing the identification information or protocol information carried in the request information. If it is determined based on the identification information or protocol information that the current request is allowed to access application service 1, the request information is run through the access control proxy layer, so that subsequent services in the grid can execute corresponding processes based on the request information; if it is determined based on the identification information or protocol information that the current request is not allowed to access application service 1, the request information will not be run through the access control proxy layer, so that subsequent services in the grid cannot start corresponding processes based on the request, which can effectively improve the security of access.

[0083] Step S130, obtaining all whitelist access rules;

[0084] It is understandable that, since many application services can be deployed in a network architecture, each application service can run independently or call each other. Therefore, in the present embodiment, the process of obtaining whitelist access rules requires obtaining all whitelist access rules. Specifically, each whitelist access rule is used to proofread the access list of an application service. In the present embodiment, the whitelist access rules include but are not limited to information such as interface identifiers and communication protocols that can be used to access the service. The specific information contained in each whitelist access rule may be the same or different. Exemplarily, assuming that application service 1, application service 2, application service 3, and application service 4 are deployed in the current network architecture, it is necessary to obtain whitelist access rule 1 corresponding to application service 1, whitelist access rule 2 corresponding to application service 2, whitelist access rule 3 corresponding to application service 3, and whitelist access rule 4 corresponding to application service 4, respectively. Specifically, whitelist access rule 1 may include interface information 1, interface information 2, and Internet protocol 1; whitelist access rule 2 may include interface information 3, interface information 4, and Internet protocol 2; whitelist access rule 3 may include interface information 3, Internet protocol 3, and Internet protocol 4; whitelist access rule 4 may include interface information 5, Internet protocol 4, and Internet protocol 5. This embodiment does not limit the overlap rate of all whitelist access rules, so that different application services can implement some of the same functions.

[0085] Step S140: deploy all whitelist access rules in the access control proxy layer;

[0086] It can be understood that after obtaining all whitelist access rules, this embodiment deploys all whitelist access rules to the corresponding access control proxy layer so that each access control proxy layer can effectively perform access list control. Exemplarily, assuming that there are whitelist access rule 1, whitelist access rule 2, whitelist access rule 3 and whitelist access rule 4, this embodiment may have 1 access control proxy layer, 2 access control proxy layers, 3 access control proxy layers, or 4 access control proxy layers. Specifically, when there is 1 access control proxy layer, whitelist access rule 1, whitelist access rule 2, whitelist access rule 3 and whitelist access rule 4 can all be deployed in the access control proxy layer so that the access control proxy layer can control the access lists of 4 application services. When there are 2, 3 or 4 access control proxy layers, they can be deployed according to the application services corresponding to the whitelist access rules. Specifically, the whitelist access rules can be deployed according to the relationship between the area where the application service is deployed and the access control proxy layer. Taking two access control proxy layers as an example, if the application service deployment area corresponding to whitelist access rule 1 corresponds to the first access control proxy layer, whitelist access rule 1 is deployed to the first access control proxy layer; if the application service deployment areas corresponding to whitelist access rule 2 and whitelist access rule 3 both correspond to the second access control proxy layer, whitelist access rule 2 and whitelist access rule 3 are both deployed to the second access control proxy layer. This embodiment can improve the accuracy of access list control performed by the access control proxy layer by deploying whitelist access rules accordingly.

[0087] Step S150, obtaining current access information;

[0088] It is understandable that when the target object needs to access the application service, the request information for application access can be input as the current access information through the human-computer interaction interface corresponding to the target. For example, when the target object needs to access the school library, the "Introduction to the library of school A" can be input in the web query input position of the human-computer interaction interface, and the back-end can generate the current access information based on the "Introduction to the library of school A" and the interface identifier or access protocol information of the human-computer interaction interface. Specifically, the current access information can be composed of interface input information and interface identifier, or interface input information and access protocol information. Among them, the interface identifier is used to indicate whether the access rights of the current network interface and application service have been opened in advance; the access protocol information is used to indicate whether the application service allows the protocol to access. This embodiment can effectively improve the timeliness of access control by obtaining the information input by the target object in real time as the current access information.

[0089] Step S160: perform application access whitelist control processing according to current access information and whitelist access rules.

[0090] It is understandable that after obtaining the current access information, the embodiment of the present application can control the current access list through the access control proxy layer. Specifically, the present embodiment determines whether the current access list belongs to the whitelist access object by judging whether the interface identification or protocol information carried in the current access information exists in the whitelist access rule. Among them, if the current access information does not carry interface identification information or does not carry protocol information, it can be directly determined that the current access object does not belong to the whitelist object; if the current access information carries interface identification information or carries protocol information, it may be necessary to combine the whitelist access rule to determine whether the current access object belongs to the whitelist object. Exemplarily, assuming that the current access information carries port information 1, after determining that the current access information is sent to the access control proxy layer, the access control proxy layer will start the whitelist control function to determine whether the current access information is entered into the whitelist access in combination with the whitelist access rules in the access control proxy layer. If the whitelist access rule contains port information 1, the current access information will be released to the next layer to perform application service access based on the current access information in the next layer; if the whitelist access rule does not contain port information 1, the current access information will be blocked in the access control proxy layer to prevent the current access information from flowing to the next layer, thereby shortening the data processing process and saving service resources.

[0091] From the above content, it can be seen that the embodiment of the present application obtains the architecture information of the service to be accessed, determines the area where each service to be accessed is located based on the architecture information, and determines the access control proxy layer in the area, and then deploys all whitelist access rules in the area to the access control proxy layer. When the current access information is obtained, the access whitelist control processing is performed in the access control proxy layer according to the current access information and the whitelist access rules, thereby effectively saving the usage of service resources and effectively improving the utilization rate of service resources.

[0092] In the embodiments of the present application, Figure 3 As shown, the process of determining the access control proxy layer of each service to be accessed according to the architecture information includes but is not limited to steps S310 to S320:

[0093] Step S310: Perform aspect programming for each service to be accessed according to the architecture information to obtain aspect programming code;

[0094] Step S320: Apply the aspect programming code to the service to be accessed to obtain an access control proxy layer.

[0095] It can be understood that the architecture information can determine the network architecture of the current application. In an embodiment of the present application, the network structure can adopt a layered structure, and different application services can be executed in each layer. Specifically, multiple different application services can be deployed in the same layer, and there can be a logical relationship between these application services, or they can be independent of each other. For example, assuming that there are application service 1, application service 2 and application service 3 in the same layer, if there is a logical relationship between application service 1, application service 2 and application service 3, the logical relationship can be that application service 2 or application service 3 can only be started after application service 1 is executed. In this process, the application service plays a role of logical judgment; if there is no logical relationship between application service 1, application service 2 and application service 3, then when the application is performed, application service 1, application service 2 and application service 3 work independently of each other and do not affect each other.

[0096] In an embodiment of the present application, by performing slice programming of the application service to be accessed in the network architecture determined by the architecture information, a code program capable of realizing the whitelist control function of the application service to be accessed is obtained as the aspect programming code, and then the aspect programming code is deployed to the service to be accessed, so that an access control proxy layer for whitelist control of the application service can be obtained. Exemplarily, after obtaining the encoding program 2 of the service to be accessed 2, the encoding program 2 is deployed to the network architecture determined based on the architecture information, and aspect programming for access control is performed based on the encoding program 2 of the service to be accessed 2 to obtain the corresponding aspect programming code 2, and when the aspect programming code 2 is deployed in the encoding program 2 deployment area, the access control proxy layer corresponding to the aspect programming code 2 is used, so that the access list control of the service to be accessed 2 can be performed through the access control proxy layer to improve the access security of the service to be accessed 2.

[0097] It can be understood that after completing the deployment of the aspect programming code 2 and the encoding program 2 of the service 2 to be accessed, the present embodiment can establish a logical relationship between the aspect programming code 2 and the encoding program 2. Exemplarily, a sequential execution relationship between the aspect programming code 2 and the encoding program 2 is established. For example, the aspect programming code 2 is executed first and then the encoding program 2 is executed. The encoding program 2 is executed only when the aspect programming code 2 is executed and the request is judged as passed, so that the aspect programming code 2 in the access control proxy layer can be used for whitelist control, effectively reducing the occupancy rate of service resources.

[0098] From the above content, it can be seen that the embodiment of the present application can modularize the coding codes of different services by performing aspect programming to facilitate the calling of different services, thereby effectively completing the access list management of application services, while effectively reducing the programming amount of the code program and improving the maintainability of the code program.

[0099] In the embodiments of this application, refer to Figure 4 , the process of obtaining all whitelist access rules includes but is not limited to steps S410 to S420:

[0100] Step S410: Obtain all application configuration information of the service to be accessed;

[0101] Step S420: Generate whitelist access rules according to application configuration information.

[0102] It is understandable that the application configuration information may include but is not limited to server information, software and network parameter information. Among them, the server information includes but is not limited to the configuration information such as the server's operating system, network interface card, storage device and security settings. Specifically, different services to be accessed can be set in different servers, so that the application configuration information corresponding to different services to be accessed is different; or the operation process of different services to be accessed depends on different application servers, so that the application configuration information corresponding to different services to be accessed is different. Exemplarily, it is assumed that there are services to be accessed 1, 2 and 3 to be accessed, and service 1 to be accessed is set in the local area network 1 to which server 1 belongs, service 2 to be accessed is set in the Internet of Things 1 to which server 2 belongs, and service 3 to be accessed is set in the office network 1 to which server 3 belongs. Since the configuration information between different servers and different networks is different, the application configurations corresponding to different services to be accessed are also different.

[0103] In the embodiment of the present application, in order to improve the access security of the service to be accessed, the embodiment generates a corresponding whitelist access rule based on the application configuration information of each service to be accessed, so as to judge the access process through the whitelist access rule. For example, assuming that there are services 1 to be accessed, services 2 to be accessed, and services 3 to be accessed, for service 1 to be accessed, the embodiment generates a corresponding whitelist access rule 1 according to the application configuration information of service 1 to be accessed, generates a corresponding whitelist access rule 2 according to the application configuration information of service 2 to be accessed, and generates a corresponding whitelist access rule 3 according to the application configuration information of service 3 to be accessed, so that during the access process, after determining the application service that is currently being accessed normally, the access list can be controlled according to the corresponding whitelist access rule, thereby effectively improving the access security.

[0104] In the embodiments of the present application, Figure 5 As shown, the process of performing application access whitelist control processing according to the current access information and whitelist access rules includes but is not limited to steps S510 to S530:

[0105] Step S510: Analyze the first service type corresponding to the current access information, wherein the first service type includes an internal access service type and an external access service type of the service to be accessed;

[0106] Step S520: determining a first target access rule from all whitelist access rules according to the first service type;

[0107] Step S530: perform application access whitelist control processing according to the current access information and the first target access rule.

[0108] It is understandable that in an access application service, there may be one or more access application sub-services, and multiple access application sub-services may access each other to call resources between services to run application services. For example, assuming that there are access application sub-service 1, access application sub-service 2, and access application sub-service 3 in access application service 1, if the access and running process of access application sub-service 1 needs to use the service resources of access application sub-service 3, when running access application sub-service 1, the service resources of access application sub-service 3 may be called through the access interface or access protocol between application services to run access application sub-service 1 using the service resources of access application sub-service 3, thereby improving the running stability of access application sub-service 1.

[0109] In the embodiment of the present application, for a large category of application services, it can contain many small categories of application services, and the service resources between these small categories of application services can be shared; for multiple large categories of application services, the application services between the multiple large categories can share resources or be independent of resources. Since the similarity between the application configuration information between the large categories of application services is different from that between the small categories, this embodiment classifies these application services to obtain the first service type, and then combines the whitelist access rules to perform application access list management. Exemplarily, assuming that it is determined according to the current access information that the service to be accessed is the application sub-service B in the application service 1 accessing the application sub-service A, then it can be determined that the first service type corresponding to the current access information is the internal access service type of the service to be accessed, therefore, the corresponding rule can be obtained from all the whitelist access rules set in the application service 1 as the first target access rule, and then the access process of the current access information is managed based on the first target access rule in the access management proxy layer in the application sub-service A, thereby improving the access security of the application sub-service A.

[0110] For another example, assuming that it is determined based on the current access information that the service to be accessed is application service 1 accessing application service 2, it can be determined that the first service type corresponding to the current access information is the external access service type of the service to be accessed. Therefore, the rule for accessing application service 2 can be obtained from all whitelist access rules as the first target access rule, and then the access process of the current access information can be list-controlled based on the first target access rule in the access control proxy layer in accessing application service 2, thereby improving the access security of accessing application service 2.

[0111] It is understandable that when performing access control processing, after obtaining the access identifier of the current access information, when it is determined that the access identifier exists in the first target access rule, the application access process corresponding to the current access information is allowed to access the service to be accessed. Among them, the access identifier is used to indicate whether the access service information corresponding to the current access information is pre-set in the first target access rule. If it is pre-set in the first target access rule, it means that the access service corresponding to the current access information can access the application service belonging to the first target access rule. Exemplarily, assuming that the access identifier of the current access information is 001, and the preset identification information in the first target access rule includes but is not limited to 100, 110, and 001, it can be seen by comparison that the access identifier of the current access information exists in the first target access rule, so the application access process corresponding to the current access information can be allowed to access the service to be accessed. Assuming that the access identifier of the current access information is 111, and the preset identification information in the first target access rule includes but is not limited to 100, 110, and 001, it can be seen by comparison that the access identifier of the current access information does not exist in the first target access rule, so the application access process corresponding to the current access information is not allowed to access the service to be accessed. This embodiment performs access list control through access identifiers, thereby effectively reducing the workload of the access judgment process and improving the accuracy of whitelist control results.

[0112] In the embodiments of the present application, Figure 6 As shown, the process of performing application access whitelist control processing according to the current access information and whitelist access rules includes but is not limited to steps S610 to S630:

[0113] Step S610: Analyze the second service type of the current access information, wherein the second service type includes the interface access service type and the preset protocol access service type of the service to be accessed;

[0114] Step S620: Determine a second target access rule from all whitelist access rules according to the second service type;

[0115] Step S630: perform application access whitelist control processing according to the current access information and the second target access rule.

[0116] It is understandable that the access process between different application services can be based on a preset interface or a preset protocol. The access process on each service can include both interface access and protocol access, or only interface access or protocol access. For example, assuming that there are service 1 to be accessed and service 2 to be accessed, the access service type that service 1 to be accessed can accept is interface access, and the access service type that service 2 to be accessed can accept is interface access type and protocol access service type. If the second service type of the current access information is a preset protocol access service type, then only the whitelist access rules in service 2 to be accessed may contain access rules that meet the whitelist judgment corresponding to the current access information. Therefore, the second target access rule can be determined from all whitelist access rules in service 2 to be accessed, so as to determine whether the preset protocol corresponding to the current access information falls into the second target access rule based on the second target access rule. If it falls into, the application access process corresponding to the current access information is allowed to access service 2 to be accessed; if it does not fall into, the application access process corresponding to the current access information is not allowed to access service 2 to be accessed.

[0117] If the second service type of the current access information is an interface access service type, then the whitelist access rules in the service to be accessed 1 and the service to be accessed 2 may contain access rules that meet the whitelist judgment corresponding to the current access information. Therefore, this embodiment further determines the request identifier of the current access information. The request identifier is used to characterize the type of field to be accessed by the current access information, such as scientific and technological information, medical information, political and economic information, etc. Based on the request identifier, it is determined that the service to be accessed 1 can provide the field information corresponding to the request identifier, and then the second target access rule can be determined from all whitelist access rules in the service to be accessed 1, so as to determine whether the interface information corresponding to the current access information falls into the second target access rule based on the second target access rule. If it does, the application access process corresponding to the current access information is allowed to access the service to be accessed 1; if it does not, the application access process corresponding to the current access information is not allowed to access the service to be accessed 1.

[0118] From the above content, it can be seen that the embodiment of the present application can effectively improve the accuracy of whitelist control and improve the security of application service access by screening target access rules in combination with the service type of the current access information.

[0119] In the embodiments of the present application, when the method of the present application is applied to Figure 7 In the interactive scenario shown, due to Figure 7In the interactive scenario shown, an access control proxy layer (proxy) is provided in the service A to be accessed. Assuming that the method of the present application is to control the access whitelist of the service A to be accessed, all whitelist access rules in the method of the present application can be deployed in the proxy. When the access requester sends the current access information through an interface call, the Internet entry gateway will send the current access information to the proxy, so that the Internet access whitelist control can be completed in the proxy; when the office network sends the current access information through an interface call, the office network entry gateway will send the current access information to the proxy, so that the office network access whitelist control can be completed in the proxy; when the service B to be accessed sends the current access information through the preset protocol between services, the current access information will be received by the proxy, so that the access whitelist control of the service B to be accessed can be completed in the proxy. It can be seen from this that the method of the embodiment of the present application does not need to divide and process the whitelist control for each traffic entrance separately, thereby effectively improving the utilization rate of service resources.

[0120] Reference Figure 8 , an embodiment of the present application provides a device for processing an application access whitelist, the device comprising:

[0121] The first module 810 is used to obtain architecture information of the service to be accessed;

[0122] The second module 820 is used to determine the access control proxy layer of each service to be accessed according to the architecture information;

[0123] The third module 830 is used to obtain all whitelist access rules;

[0124] The fourth module 840 is used to deploy all whitelist access rules in the access control proxy layer;

[0125] The fifth module 850 is used to obtain current access information;

[0126] The sixth module 860 is used to perform application access whitelist control processing according to current access information and whitelist access rules.

[0127] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0128] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned application access whitelist processing method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0129] See also Fig. 9 , Fig. 9 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0130] The processor 910 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0131] The memory 920 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 920 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 920, and the processor 910 calls and executes the processing method of the application access whitelist in the embodiment of this application;

[0132] Input / output interface 930, used to implement information input and output;

[0133] Communication interface 940, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WI FI, Bluetooth, etc.);

[0134] bus 950 , which transmits information between the various components of the device (e.g., processor 910 , memory 920 , input / output interface 930 , and communication interface 940 );

[0135] The processor 910 , the memory 920 , the input / output interface 930 , and the communication interface 940 are connected to each other in communication within the device via a bus 950 .

[0136] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned application access whitelist processing method.

[0137] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0138] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0139] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0140] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0141] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0142] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0143] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0144] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0145] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0146] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0147] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0148] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for processing an application access whitelist, characterized in that: The method comprises the following steps: Get the architecture information of the service to be accessed; Determine the access control proxy layer of each service to be accessed according to the architecture information; Get all whitelist access rules; Deploy all the whitelist access rules in the access control proxy layer; Get current access information; Application access whitelist control processing is performed according to the current access information and the whitelist access rules.

2. The method according to claim 1, characterized in that The method of obtaining all whitelist access rules includes: Obtain all application configuration information of the service to be accessed; The whitelist access rule is generated according to the application configuration information.

3. The method according to claim 1, characterized in that The performing application access whitelist control processing according to the current access information and the whitelist access rule includes: Analyzing a first service type corresponding to the current access information, where the first service type includes an internal access service type and an external access service type of the service to be accessed; Determining a first target access rule from all the whitelist access rules according to the first service type; Application access whitelist control processing is performed according to the current access information and the first target access rule.

4. The method according to claim 3, characterized in that The performing application access whitelist control processing according to the current access information and the first target access rule includes: Obtaining an access identifier for the current access information; It is determined that the access identifier exists in the first target access rule, and the application access process corresponding to the current access information is allowed to access the service to be accessed.

5. The method according to claim 1, characterized in that The performing application access whitelist control processing according to the current access information and the whitelist access rule includes: Analyzing a second service type of the current access information, where the second service type includes an interface access service type and a preset protocol access service type of the service to be accessed; Determining a second target access rule from all the whitelist access rules according to the second service type; Application access whitelist control processing is performed according to the current access information and the second target access rule.

6. The method according to claim 5, characterized in that The performing application access whitelist control processing according to the current access information and the second target access rule includes: Obtaining current interface configuration information or preset protocol configuration information in current access information; It is determined that the current interface configuration information or the preset protocol configuration information exists in the second target access rule, and the application access process corresponding to the current access information is allowed to access the service to be accessed.

7. The method according to claim 1, characterized in that The determining, according to the architecture information, the access control proxy layer of each service to be accessed includes: Perform aspect programming for each of the services to be accessed according to the architecture information to obtain aspect programming code; Apply the aspect programming code to the service to be accessed to obtain the access control proxy layer.

8. A device for processing an application access whitelist, characterized in that: The device comprises: The first module is used to obtain the architecture information of the service to be accessed; The second module is used to determine the access control proxy layer of each service to be accessed according to the architecture information; The third module is used to obtain all whitelist access rules; The fourth module is used to deploy all the whitelist access rules in the access control proxy layer; The fifth module is used to obtain current access information; The sixth module is used to perform application access whitelist control processing according to the current access information and the whitelist access rules.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the method for processing an application access whitelist according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for processing an application access whitelist according to any one of claims 1 to 7 is implemented.

Images