Application access control method and device, equipment, medium and product

Abstract

The invention discloses an application access control method and device, equipment, a medium and a product. The method comprises the following steps: determining a target access control strategy according to predetermined user corresponding information and an original access control strategy; and performing policy migration on the original access control policy based on the target access control policy, so as to switch a target network control policy based on which the corresponding application is accessed based on the cloud desktop into the target access control policy from the original access control policy. According to the technical scheme provided by the embodiment of the invention, the target access control strategy for performing access control according to the user identifier is configured based on the original access control strategy for performing access control according to the source address, and the original access control strategy is effectively switched to the target access control strategy, so that the access control efficiency is improved. And access control is performed based on the target access control strategy, so that the control accuracy and control efficiency of network access control are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data access control, and in particular to an application access control method, device, equipment, medium and product. Background Art

[0002] With the popularity of cloud computing technology, cloud desktops have become the first choice for many companies and organizations due to their flexibility and convenience. A cloud desktop environment is a virtual desktop environment where desktop operating systems, applications, and user data are all hosted on cloud servers. Users can access and use these virtual desktops from any device through a network connection.

[0003] In the related art, traditional access control is implemented based on firewall security policies. This access control method performs access control based on the source and destination addresses and their port setting rules. However, in the cloud desktop application scenario, the access source address changes dynamically, and it is difficult to perform network access control on application access requests for application access based on the cloud desktop operating system based on the firewall policy. In addition, the control relationship in the firewall policy may be complicated and difficult to adjust dynamically, which increases the difficulty of managing the firewall policy and security risks. Summary of the invention

[0004] The present invention provides an application access control method, apparatus, device, medium and product to realize the effect of configuring a target access control policy that performs access control based on a user identifier based on an original access control policy that performs access control based on a source address, and effectively switching the original access control policy to the target access control policy. Furthermore, access control is performed based on the target access control policy, effectively solving the problem of difficulty in performing access control on a dynamically changing source address.

[0005] According to one aspect of the present invention, there is provided an application access control method, the method comprising:

[0006] Determine the target access control policy according to the predetermined user corresponding information and the original access control policy; wherein the user corresponding information is used to indicate the mapping relationship between the access source address and the user identification of the access user; the address type of the access source address is a cloud desktop address; the original access control policy is used to determine the access rights according to the access source address and the access destination address; the target access control policy is used to determine the access rights according to the user identification of the access user and the access destination address;

[0007] The original access control policy is migrated based on the target access control policy, so as to switch the target network control policy based on which the cloud desktop accesses the corresponding application from the original access control policy to the target access control policy.

[0008] According to another aspect of the present invention, there is provided an application access control device, the device comprising:

[0009] A policy configuration module, used to determine a target access control policy according to predetermined user corresponding information and an original access control policy; wherein the user corresponding information is used to indicate a mapping relationship between an access source address and a user identifier of an access user; the address type of the access source address is a cloud desktop address; the original access control policy is used to determine access rights according to an access source address and an access destination address; the target access control policy is used to determine access rights according to the user identifier of the access user and the access destination address;

[0010] The policy migration module is used to perform policy migration on the original access control policy based on the target access control policy, so as to switch the target network control policy based on which the cloud desktop accesses the corresponding application from the original access control policy to the target access control policy.

[0011] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0012] at least one processor; and

[0013] a memory communicatively connected to the at least one processor; wherein,

[0014] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the application access control method described in any embodiment of the present invention.

[0015] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the application access control method described in any embodiment of the present invention when executed.

[0016] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the application access control method according to any embodiment of the present invention is implemented.

[0017] The technical solution of the embodiment of the present invention determines the target access control policy according to the predetermined user corresponding information and the original access control policy, and further, based on the target access control policy, gradually migrates the original access control policy to switch the target network control policy based on which the cloud desktop accesses the corresponding application from the original access control policy to the target access control policy, thereby solving the problem that the access control method in the related art is difficult to perform access control on the dynamically changing source address, thereby increasing the difficulty of policy management and the access security risk, and effectively switches the target network control policy based on which the cloud desktop accesses the corresponding application from the original access control policy that performs access control based on the source address to the target access control policy that performs access control based on the user identification, thereby realizing seamless transition and efficient and smooth migration between the original access control policy and the target access control policy, and performing access control based on the target access control policy effectively solves the problem that it is difficult to perform access control on the dynamically changing source address, improves the control accuracy and control efficiency of network access control, and improves the security of network access control.

[0018] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 is a flowchart of an application access control method provided according to Embodiment 1 of the present invention;

[0021] Figure 2 is a flow chart of an application access control method provided according to Embodiment 2 of the present invention;

[0022] Figure 3 is a flowchart of an application access control method provided according to Embodiment 3 of the present invention;

[0023] Figure 4 is a structural diagram of an application access control device provided according to a fourth embodiment of the present invention;

[0024] Figure 5 It is a structural diagram of an electronic device that implements the application access control method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Embodiment 1

[0028] Figure 1 This is a flow chart of an application access control method provided by the first embodiment of the present invention. This embodiment is applicable to the case where access control is performed based on access requests for access to corresponding applications by a cloud desktop. The method can be executed by an application access control device, which can be implemented in the form of hardware and / or software, and can be configured in a terminal and / or server. Figure 1 As shown, the method includes:

[0029] S110: Determine a target access control policy according to predetermined user corresponding information and an original access control policy.

[0030] Among them, the user corresponding information is used to indicate the mapping relationship between the access source address and the user identification of the access user. The user corresponding information can be understood as information that characterizes the mapping relationship between the access source address and the user identification of the access user. In other words, the user corresponding information may include at least one pair of access source addresses and their corresponding user identifications of the access users. The access source address may be the Internet Protocol Address (IP address) of the device or user that initiates the application access request. In practical applications, by detecting and filtering the source address, it is possible to determine which devices or users have the right to access network resources. In this embodiment, the address type of the access source address may be a cloud desktop address. That is, when the application access request is initiated, it is initiated by the operating system of the access user based on the cloud desktop. It can be understood that the cloud desktop, also known as Desktop as a Service (DaaS), is a service provided based on cloud computing technology that allows users to access a personal desktop environment running on a cloud server through the Internet. The access user may be a user who accesses the corresponding application based on the service system of the cloud desktop. The user identification may be a set of data that uniquely identifies the user. Optionally, the user identification may include a user account name, a user name, a user authentication token, or other data that can uniquely identify the user.

[0031] Among them, the original access control policy can be the target network control policy based on which the corresponding application is accessed based on the cloud desktop before the target access control policy is configured. The original access control policy can be any predetermined network control policy, and optionally, the original access control policy can be a firewall policy. The original access control policy is used to determine the access rights of the access user to the application corresponding to the access destination address based on the access source address and the access destination address. The original access control policy includes at least one set of matching access source addresses and access destination addresses. The access destination address can be the IP address of the target device to which the application access request is to be sent. The access destination address can ensure that the application access request can be accurately transmitted to the target device. In actual applications, by detecting and filtering the access destination address, the network security device can implement the access control policy to limit or allow access to a specific IP address. The target access control policy can be used to control the entry and exit of network traffic by setting access rules and filtering policies. The target access control policy can prevent unauthorized network traffic from entering and exiting the network. In this embodiment, the target access control policy is used to determine the access rights of the access user to the application corresponding to the access destination address based on the user identifier of the access user and the access destination address. That is to say, the target access control policy may include at least one set of matching user identifiers and access destination addresses of access users. When an application access request is received, the user identifier and access destination address of the access user may be determined based on the application access request. Further, the target access control policy may be queried based on the user identifier and the access destination address, and when the target access control policy includes the user identifier and the access destination address corresponding to the user identifier is the access destination address, it may be determined that the target access control policy is hit. Furthermore, it may be determined that the access user's access permission for the application corresponding to the access destination address is allowed access. When the target access control policy does not include the user identifier or includes the user identifier and the access destination address corresponding to the user identifier is not the access destination address, it may be determined that the target access control policy is not hit. Furthermore, it may be determined that the access user's access permission for the application corresponding to the access destination address is denied access.

[0032] In actual applications, when performing network access control, firewall policies are usually used for network access control. Firewall policies determine the access rights of access users to applications corresponding to the access destination addresses based on the access source addresses and access destination addresses. However, in cloud desktop application scenarios, the access source addresses change dynamically, and it is difficult to perform network access control on application access requests for cloud desktop-based operating systems based on firewall policies. In addition, the control relationship in the firewall policy may be complicated and difficult to adjust dynamically, increasing the difficulty of managing firewall policies and security risks.

[0033] In view of the above situation, in this embodiment, a target access control policy that determines access rights based on the user ID of the accessing user and the access destination address can be configured according to the user corresponding information and the application corresponding information. Furthermore, network access control can be performed based on the target access control policy. Thus, the access control policy is optimized, unnecessary access rights are reduced, and security is enhanced.

[0034] As an optional implementation of this embodiment, historical access control information and original access control policies may be obtained. The historical access control information may include at least one historical access control record. The historical access control record may include the user ID of the accessing user, the access source address, and the access destination address. Further, data analysis may be performed on the historical access control information to determine the mapping relationship between the access source address and the user ID of the accessing user, and generate user corresponding information based on the mapping relationship. And, the mapping relationship between the access source address and the access destination address is determined based on the original access control policy. Further, the mapping relationship between the user ID of the accessing user and the access destination address may be determined based on the user corresponding information and the original access control policy, and the target access control policy may be generated based on the mapping relationship.

[0035] S120: Perform policy migration on the original access control policy based on the target access control policy, so as to switch the target network control policy based on which the cloud desktop accesses the corresponding application from the original access control policy to the target access control policy.

[0036] The policy migration may be performed in the process of applying the original access control policy and the target access control policy in parallel.

[0037] In this embodiment, after obtaining the target access control policy, the original access control policy can be gradually migrated based on the target access control policy to switch the target network control policy based on which the cloud desktop accesses the corresponding application from the original access control policy to the target access control policy. Further, when the migration is completed, the application access request sent by the cloud desktop to the corresponding application can be access controlled based on the target access control policy.

[0038] In actual applications, when the target access control policy is configured, the old original access control policy may be directly eliminated and the target access control policy may be applied. In this case, there may be business discontinuity, that is, the corresponding application can be accessed when the original access control policy is applied, but cannot be accessed when the target access control policy is applied.

[0039] In view of the above situation, in this embodiment, after obtaining the target access control policy, the target access control policy and the original access control policy can be applied in parallel. Further, in the process of applying the target access control policy and the original access control policy in parallel, the original access control policy is gradually migrated based on the target access control policy, so as to switch the target network control policy based on which the cloud desktop accesses the corresponding application from the original access control policy to the target access control policy.

[0040] In this embodiment, during the application of the target access control policy, the user access application log can also be recorded, and the access association information associated with the access user can be obtained based on the user access application log. The access association information can include access time, user location information (such as the physical location information of the user) and the device security status information of the terminal device used by the access user. Further, at least one access user is grouped according to the access destination address to obtain at least one access user corresponding to the access destination address. Further, the access association information corresponding to at least one access user is analyzed according to the clustering algorithm to obtain the normal access standard corresponding to the access destination address. Then, the normal access standard can be updated to the target access control policy to optimize the target access control policy. The advantage of such a setting is that when performing access control based on the target access control policy, not only the user identification is considered, but also the user's access time, user location information and the device security status information of the terminal device used by the user are dynamically evaluated, triggering stricter identity authentication or access control, realizing accurate detection and risk assessment of user access operations, effectively narrowing the scope of authorization and reducing security risks.

[0041] The technical solution of the embodiment of the present invention determines the target access control policy according to the predetermined user corresponding information and the original access control policy, and further, based on the target access control policy, gradually migrates the original access control policy to switch the target network control policy based on which the cloud desktop accesses the corresponding application from the original access control policy to the target access control policy, thereby solving the problem that the access control method in the related art is difficult to perform access control on the dynamically changing source address, thereby increasing the difficulty of policy management and the access security risk, and effectively switches the target network control policy based on which the cloud desktop accesses the corresponding application from the original access control policy that performs access control based on the source address to the target access control policy that performs access control based on the user identification, thereby realizing seamless transition and smooth migration between the original access control policy and the target access control policy, and performing access control based on the target access control policy effectively solves the problem that it is difficult to perform access control on the dynamically changing source address, improves the control accuracy and control efficiency of network access control, and improves the security of network access control.

[0042] Embodiment 2

[0043] Figure 2 It is a flowchart of an application access control method provided by the second embodiment of the present invention. On the basis of the above-mentioned embodiment, the configuration process of the target access control policy is further refined. Optionally, the target access control policy is determined according to the predetermined user corresponding information and the original access control policy, including: obtaining the user identifier and Internet Protocol address corresponding to the currently logged-in user corresponding to at least one cloud desktop system; determining the user corresponding information according to the user identifier and Internet Protocol address corresponding to at least one currently logged-in user and the user identifier of the access application user in the pre-acquired historical access control information and at least one access source address corresponding to the access application user; determining the user address corresponding information according to the user corresponding information and the original access control policy, and determining the target access control policy based on the user address corresponding information; wherein the original access control policy includes at least one set of matching access source addresses and access destination addresses. The specific implementation method can be referred to the technical solution of this embodiment. Among them, the technical terms that are the same or similar to the above-mentioned embodiments are not repeated here.

[0044] like Figure 2 As shown, the method includes:

[0045] S210. Obtain a user identifier and an Internet Protocol address corresponding to a currently logged-in user corresponding to at least one cloud desktop system.

[0046] The cloud desktop system may be an operating system of the cloud desktop, based on which users can remotely access applications and data running on the cloud server through the Internet. The currently logged-in user may be a user who is currently logged in to the cloud desktop system. The user identifier may be a set of data that uniquely identifies the currently logged-in user. Optionally, the user identifier may include a user account name, a user name, a user authentication token, or other data that can uniquely identify the user. The Internet Protocol address may be an IP address corresponding to the currently logged-in user.

[0047] In this embodiment, for at least one cloud desktop system being managed, the user ID of the currently logged-in user and the Internet Protocol address corresponding to the currently logged-in user corresponding to each cloud desktop system at the current moment can be obtained. Furthermore, the user ID and the Internet Protocol address of the currently logged-in user can be used as the data basis for constructing the user corresponding information.

[0048] S220, determining user corresponding information according to a user identifier and an Internet Protocol address corresponding to at least one currently logged-in user and a user identifier of an access requesting user in pre-acquired historical access control information and at least one access source address corresponding to the access requesting user.

[0049] The historical access control information can be understood as a network access control record for accessing the corresponding application based on the cloud desktop in a historical time period. The historical access control information can include at least one historical access control record, and the historical access control record can include the user ID, access source address, and access destination address of the access application user. The access application user can be a user who applies for access rights.

[0050] Optionally, user corresponding information is determined based on a user identifier and Internet Protocol address corresponding to at least one currently logged-in user and a user identifier of an access requesting user in pre-acquired historical access control information and at least one access source address corresponding to the access requesting user, including: for at least one access source address corresponding to the access requesting user in the historical access control information, determining an Internet Protocol address that matches the access source address from at least one Internet Protocol address, and determining the current logged-in user corresponding to the Internet Protocol address; sending the determined user identifier corresponding to the currently logged-in user to a terminal associated with the access requesting user based on the user identifier of the access requesting user, so that the access requesting user confirms the user identifier corresponding to the currently logged-in user; when confirmation feedback information is received indicating successful confirmation, treating the currently logged-in user as the accessing user, and establishing a mapping relationship between the user identifier of the accessing user and the access source address; generating user corresponding information based on at least one set of mapping relationships.

[0051] As an optional implementation of this embodiment, for at least one access source address corresponding to the access application user in the historical access control information, an Internet Protocol address consistent with the access source address is determined from the acquired Internet Protocol addresses corresponding to at least one currently logged-in user, and the Internet Protocol address is used as the target Internet Protocol address, and the current logged-in user corresponding to the target Internet Protocol address is determined. Further, in order to confirm whether the currently logged-in user is a user to whom the access application user has granted access rights, the terminal associated with the access application user can be determined based on the user identifier of the access application user, and the user identifier of the currently logged-in user is sent to the terminal associated with the access application user, so that the access application user can confirm the user identity of the currently logged-in user. Further, in the case where the received confirmation feedback information is a confirmed match, the currently logged-in user can be used as the access user, and a mapping relationship between the user identifier of the access user and the access source address can be established to obtain a set of mapping relationships. Further, user corresponding information can be generated based on at least one set of mapping relationships obtained.

[0052] In this embodiment, in order to establish a mapping relationship between the user identification of the access user and the access source address, historical access control information including at least one network access control record can be obtained. The historical access control information is obtained based on the access control log. In order to improve the data processing efficiency and the efficiency of constructing the user corresponding information, the initial historical access control information obtained from the access control log can be preprocessed, and the access control information obtained after the preprocessing is used as the historical access control information.

[0053] Based on this, on the basis of the above-mentioned technical solutions, it also includes: obtaining initial historical access control information and historical policy hit information corresponding to the original access control policy; wherein the initial historical access control information includes at least one network access control record; determining a network access control record with a hit count of a preset value based on the historical policy hit information and the initial historical access control information, and deleting the network access control record from the initial historical access control information to obtain historical access control information; and / or, filtering the initial historical access control information according to a preset data filtering standard to obtain the network access control record to be deleted, and deleting the network access control record to be deleted from the initial historical access control information to obtain historical access control information.

[0054] Among them, the initial historical access control information may be a historical access control record recorded in the access control log and not processed. The initial historical access control information includes at least one network access control record. The policy hit information may be information characterizing the hit situation of the original access control policy. The policy hit information may be used to characterize the number of times the application access request hits and misses the original access control policy in the process of performing access control based on the original access control policy. Hitting the original access control policy may characterize that the access source address and the access destination address included in the corresponding application access request match the access source address and the corresponding access destination address included in the original access control policy. On the contrary, missing the original access control policy may characterize that the access source address and the access destination address included in the corresponding application access request do not match the access source address and the corresponding access destination address included in the original access control policy. The preset value may be any value, and optionally, it is 0. The preset data screening criterion may be a predetermined screening condition for screening network access control records. The preset data screening criterion includes that the address type of the access source address corresponding to the network access control record is not a cloud desktop address.

[0055] As an optional implementation of this embodiment, the initial historical access control information within the historical time period and the historical policy hit information corresponding to the original access control policy can be obtained from the access control log. Further, the network access control record with a hit count of a preset value can be determined based on the historical policy hit information and the initial historical access control information, and the determined network access control record can be deleted from the initial historical access control information, and the information obtained after the deletion can be used as the historical access control information. And / or, the initial historical access control information can be filtered according to the preset data filtering standard, and the network access control records whose address type of the access source address in the initial historical access control information is not the cloud desktop address can be filtered out as the network access control records to be deleted. Further, the network access control records to be deleted are deleted from the initial historical access control information, and the information obtained after the deletion can be used as the historical access control information. And / or, the initial historical access control information is deduplicated, the duplicate network access control records are deleted, and the information obtained after the deletion can be used as the historical access control information.

[0056] S230: Determine user address corresponding information according to the user corresponding information and the original access control policy, and determine a target access control policy based on the user address corresponding information.

[0057] The original access control policy includes at least one set of matching access source addresses and access destination addresses. The user address corresponding information can be used to indicate the mapping relationship between the user identification of the access user and the access destination address. The user address corresponding information can be understood as information characterizing the mapping relationship between the user identification of the access user and the access destination address. In other words, the user address corresponding information can include at least one pair of matching user identification of the access user and the access destination address.

[0058] In this embodiment, after obtaining the user corresponding information, the mapping relationship between the access source address and the user identification of the access user can be determined according to the user corresponding information. And, the mapping relationship between the access source address and the access destination address can be determined according to the original access control policy. Further, the access source address, the user identification of the access user and the access destination address can be connected in series through the mapping relationship between the access source address and the access destination address to obtain the relationship of "user identification-access source address-access destination address". Furthermore, the mapping relationship between the user identification and the access destination address can be constructed according to the obtained relationship, and the user address corresponding information can be generated based on the mapping relationship. Further, the target access control policy can be configured according to the user address corresponding information.

[0059] S240: Perform policy migration on the original access control policy based on the target access control policy, so as to switch the target network control policy based on which the cloud desktop accesses the corresponding application from the original access control policy to the target access control policy.

[0060] The technical solution of the embodiment of the present invention obtains the user identification and Internet Protocol address corresponding to the currently logged-in user corresponding to at least one cloud desktop system; further, determines the user corresponding information according to the user identification and Internet Protocol address corresponding to the at least one currently logged-in user and the user identification of the access request user in the pre-acquired historical access control information and at least one access source address corresponding to the access request user; further, determines the user address corresponding information according to the user corresponding information and the original access control policy, and determines the target access control policy based on the user address corresponding information, thereby achieving the effect of configuring the target access control policy according to the original access control policy, and further, achieving an efficient and smooth transition between the original access control policy and the target access control policy, and further, improving the configuration efficiency of the target access control policy.

[0061] Embodiment 3

[0062] Figure 3 It is a flow chart of an application access control method provided in the third embodiment of the present invention. On the basis of the above-mentioned embodiment, the policy migration process of the target access control policy is further refined. Optionally, the original access control policy is migrated based on the target access control policy, including: performing parallel access control on the target zero-trust access control policy and the original access control policy; in the access control process, obtaining the first policy hit information corresponding to the original access control policy and the second policy hit information corresponding to the target access control policy; and migrating the original access control policy according to the first policy hit information and the second policy hit information. The specific implementation method can be found in the technical solution of this embodiment. Among them, the technical terms that are the same or similar to those in the above-mentioned embodiments are not repeated here.

[0063] like Figure 3 As shown, the method includes:

[0064] S310: Determine a target access control policy according to predetermined user corresponding information and an original access control policy.

[0065] S320: Perform parallel access control on the target access control policy and the original access control policy.

[0066] In this embodiment, when the target access control policy is obtained, the target access control policy can be imported into the corresponding gateway for application, and the target access control policy and the original access control policy can be used together as the target network control policy based on the cloud desktop access to the corresponding application, and the target access control policy and the original access control policy can be used in parallel for access control.

[0067] Optionally, the target access control policy and the original access control policy are subjected to access control in parallel, including: when an application access request with an access source address being a cloud desktop address is received, determining the user identification and the access destination address of the accessing user based on the application access request; determining whether the target access control policy is hit based on the user identification and the access destination address of the accessing user; when the target access control policy is hit, forwarding the application access request based on the gateway where the target access control policy is located, so as to access the application corresponding to the access destination address; when the target access control policy is not hit, determining whether the original access control policy is hit based on the access source address and the access destination address, and when the original access control policy is hit, forwarding the application access request based on the gateway where the original access control policy is located, so as to access the application corresponding to the access destination address.

[0068] In this embodiment, in the process of parallel application of the target access control policy and the original access control policy, the hit priority of the target access control policy can be set higher than the hit priority of the original access control policy. That is to say, when an application access request is received, it is first matched with the target access control policy. Then, when the match is successful, the application access request is directly forwarded. In the case of a match failure, it is matched with the original access control policy again. The gateway where the target access control policy is located can be the gateway that imports the target access control policy. Exemplarily, the gateway where the target access control policy is located can be a zero-trust gateway. The gateway where the original access control policy is located can be the gateway that imports the original access control policy. Exemplarily, the gateway where the original access control policy is located can be a firewall gateway.

[0069] As an optional implementation of this embodiment, after obtaining the target access control policy, the target access control policy can be imported into the corresponding gateway. Then, the target access control policy and the original access control policy can be used together as the target network control policy based on which the corresponding application is accessed based on the cloud desktop. Further, in the case of receiving an application access request whose address type of the access source address is a cloud desktop address, the application access request can be parsed to obtain the access source address, the user identifier of the access user, and the access destination address corresponding to the application access request. Further, it can be determined first whether there is a matching user control policy in the target access control policy according to the user identifier of the access user and the access destination address. Further, in the case of determining that there is a matching user control policy, it can be determined that the application access request hits the target access control policy. Then, the application access request is forwarded based on the gateway where the target access control policy is located to access the application corresponding to the access destination address. Further, in the case of determining that there is no matching user control policy, it can be determined that the application access request does not hit the target access control policy. Then, it can be determined whether there is a matching address control policy in the original access control policy according to the access source address and the access destination address. Further, when it is determined that there is a matching address control policy, it can be determined that the application access request hits the original access control policy, and the application access request is forwarded based on the gateway where the original access control policy is located to access the application corresponding to the access destination address.

[0070] S330. In the process of parallel access control, first policy hit information corresponding to the original access control policy and second policy hit information corresponding to the target access control policy are obtained.

[0071] Among them, the first policy hit information can be used to characterize the policy hit situation of each address control policy included in the original access control policy. The first policy hit information can include the policy hit result and / or the number of policy hits of each address control policy. The second policy hit information can be used to characterize the policy hit situation of each user control policy included in the target access control policy. The second policy hit information can include the policy hit result and / or the number of policy hits of each user control policy.

[0072] In this embodiment, in the process of performing parallel access control based on the target access control policy and the original access control policy, the policy hit situation of the original access control policy can be detected, and the first policy hit information corresponding to the original access control policy can be obtained. Also, the policy hit situation of the target access control policy can be detected, and the second policy hit information corresponding to the target access control policy can be obtained.

[0073] S340: Perform policy migration according to the first policy hit information and the second policy hit information, so as to switch the target network control policy based on which the cloud desktop accesses the corresponding application from the original access control policy to the target access control policy.

[0074] In this embodiment, after obtaining the first policy hit information and the second policy hit information, the hit status of the relevant address control policy and the user control policy can be determined according to the first policy hit information and the second policy hit information. Further, the policy migration can be performed according to the determined hit status.

[0075] Optionally, policy migration is performed based on the first policy hit information and the second policy hit information, including: determining, based on the first policy hit information, a policy hit result corresponding to at least one group of target address control policies whose address type of the access source address is a cloud desktop address; for at least one group of target address control policies, when the policy hit result corresponding to the target address control policy is a miss, determining, based on the access source address and user corresponding information in the target address control policy, a user identifier of the access user corresponding to the access source address; determining, in the target access control policy, a target user control policy based on the user identifier of the access user and the access destination address in the target address corresponding information; determining, based on the second policy hit information, a policy hit result corresponding to the target user control policy, and when the policy hit result is a hit, deleting the target address control policy from the original access control policy.

[0076] Among them, the target address control policy may be an address control policy in which the address type of the access source address is a cloud desktop address.

[0077] As an optional implementation of this embodiment, when the first policy hit information is obtained, the policy hit result corresponding to at least one target address control policy whose address type of the access source address is a cloud desktop address can be determined based on the first policy hit information. Further, for at least one target address control policy, when the policy hit result of the target address control policy is a miss, the access source address in the target address control policy can be obtained, and the user identifier of the access user corresponding to the access source address can be determined based on the access source address and the predetermined user corresponding information. Further, the matching target user control policy can be determined from the target access control policy based on the user identifier of the access user and the access destination address in the target address control policy. Further, the policy hit result corresponding to the target user control policy can be determined based on the second policy hit information. Further, when the policy hit result is a hit, the target address control policy can be deleted from the original access control policy, and the target user control policy can be used as the target network control policy based on which the access user accesses the application corresponding to the access destination address. Further, the target network control policy based on which the cloud desktop accesses the corresponding application can be switched from the original access control to the target access control policy.

[0078] The technical solution of the embodiment of the present invention performs access control in parallel with the target access control policy and the original access control policy; further, in the process of access control, obtains the first policy hit information corresponding to the original access control policy and the second policy hit information corresponding to the target access control policy; further, performs policy migration based on the first policy hit information and the second policy hit information, so as to switch the target network control policy based on which the cloud desktop accesses the corresponding application from the original access control policy to the target access control policy, thereby achieving the effect of policy migration when the original access control policy and the target access control policy are running in parallel, thereby ensuring business continuity during the migration process and reducing migration risks.

[0079] Embodiment 4

[0080] Figure 4 Schematic diagram of the structure of an application access control device provided by Embodiment 4 of the present invention. Figure 4 As shown, the device includes: a policy configuration module 410 and a policy migration module 420.

[0081] Among them, the policy configuration module 410 is used to determine the target access control policy based on predetermined user corresponding information and the original access control policy; wherein the user corresponding information is used to indicate the mapping relationship between the access source address and the user identification of the accessing user; the address type of the access source address is the cloud desktop address; the original access control policy is used to determine the access rights based on the access source address and the access destination address; the target access control policy is used to determine the access rights based on the user identification of the accessing user and the access destination address; the policy migration module 420 is used to perform policy migration on the original access control policy based on the target access control policy, so as to switch the target network control policy based on which the cloud desktop access to the corresponding application is based from the original access control policy to the target access control policy.

[0082] Optionally, the policy configuration module 410 includes: a login information acquisition unit, a user corresponding information determination unit and a policy configuration unit.

[0083] A login information acquisition unit, used to acquire a user identifier and an Internet Protocol address corresponding to a currently logged-in user corresponding to at least one cloud desktop system;

[0084] A user corresponding information determination unit, configured to determine user corresponding information according to a user identifier and the Internet Protocol address corresponding to at least one of the currently logged-in users and a user identifier of an access requesting user in the pre-acquired historical access control information and at least one access source address corresponding to the access requesting user;

[0085] A policy configuration unit is used to determine user address corresponding information according to the user corresponding information and the original access control policy, and determine the target access control policy based on the user address corresponding information; wherein the original access control policy includes at least one set of matching access source address and access destination address.

[0086] Optionally, the user corresponding information determination unit includes: a target protocol address determination subunit, an information confirmation subunit, a mapping relationship establishment subunit and a user corresponding information determination subunit.

[0087] a target protocol address determination subunit, for determining, for at least one access source address corresponding to the access application user in the historical access control information, a target Internet Protocol address consistent with the access source address from at least one Internet Protocol address, and determining a current logged-in user corresponding to the target Internet Protocol address;

[0088] An information confirmation subunit, configured to send the determined user identification corresponding to the currently logged-in user to a terminal associated with the access application user according to the user identification of the access application user, so that the access application user confirms the user identification corresponding to the currently logged-in user;

[0089] A mapping relationship establishing subunit, used for, when receiving confirmation feedback information that the match is confirmed, taking the currently logged-in user as the accessing user, and establishing a mapping relationship between the user identifier of the accessing user and the access source address;

[0090] The user corresponding information determining subunit is used to generate user corresponding information according to at least one set of the mapping relationships.

[0091] Optionally, the policy migration module 420 includes: a parallel access control unit, a policy hit information acquisition unit and a policy migration unit.

[0092] A parallel access control unit, used for performing parallel access control on the target access control policy and the original access control policy; wherein the target access control policy includes at least one user control policy, and the user control policy includes at least the matched user identification of the access user and the access destination address; the original access control policy includes at least one address control policy; the address control policy includes at least the matched access source address and the access destination address;

[0093] A policy hit information acquisition unit is used to acquire, during the parallel access control process, first policy hit information corresponding to the original access control policy and second policy hit information corresponding to the target access control policy:

[0094] A policy migration unit is used to perform policy migration according to the first policy hit information and the second policy hit information.

[0095] Optionally, the parallel access control unit includes: a request receiving subunit, a policy hit detecting subunit, a request first forwarding subunit, and a request second forwarding subunit.

[0096] A request receiving subunit, configured to determine, upon receiving an application access request whose address type of the access source address is a cloud desktop address, the access source address, a user identifier of an accessing user, and an access destination address based on the application access request;

[0097] A policy hit detection subunit, used to determine whether the target access control policy is hit based on the user identification of the access user and the access destination address;

[0098] Requesting a first forwarding subunit, for forwarding the application access request based on the gateway where the target access control policy is located, in the case of hitting the target access control policy, so as to access the application corresponding to the access destination address;

[0099] A second forwarding subunit is requested to determine whether the original access control policy is hit based on the access source address and the access destination address if the target access control policy is not hit, and to forward the application access request based on the gateway where the original access control policy is located to access the application corresponding to the access destination address if the original access control policy is hit.

[0100] Optionally, the policy migration unit includes: a hit result determination subunit, a user identification determination subunit, a control policy determination subunit and a policy deletion subunit.

[0101] A hit result determination subunit, configured to determine, according to the first policy hit information, a policy hit result corresponding to at least one target address control policy whose address type of the access source address is a cloud desktop address;

[0102] A user identification determination subunit is used to determine, for at least one of the target address control policies, a user identification of a visiting user corresponding to the access source address according to the access source address and the user corresponding information in the target address control policy when the policy hit result corresponding to the target address control policy is a miss;

[0103] A control policy determination subunit, configured to determine a target user control policy from the target access control policy according to the user identifier of the access user and the access destination address in the target address control policy;

[0104] The policy deletion subunit is used to determine the policy hit result corresponding to the target user control policy according to the second policy hit information, and when the policy hit result is hit, delete the target address control policy from the original access control policy.

[0105] The application access control device provided in the embodiment of the present invention can execute the application access control method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0106] Embodiment 5

[0107] Figure 5A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0108] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0109] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0110] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as an application access control method.

[0111] In some embodiments, the application access control method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the application access control method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the application access control method in any other appropriate manner (e.g., by means of firmware).

[0112] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0113] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0114] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0115] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0116] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0117] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0118] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0119] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An application access control method, characterized in that: include: Determine the target access control policy according to the predetermined user corresponding information and the original access control policy; wherein the user corresponding information is used to indicate the mapping relationship between the access source address and the user identification of the access user; the address type of the access source address is a cloud desktop address; the original access control policy is used to determine the access rights according to the access source address and the access destination address; the target access control policy is used to determine the access rights according to the user identification of the access user and the access destination address; The original access control policy is migrated based on the target access control policy, so as to switch the target network control policy based on which the cloud desktop accesses the corresponding application from the original access control policy to the target access control policy.

2. The application access control method according to claim 1, characterized in that: The step of determining the target access control policy according to the predetermined user corresponding information and the original access control policy includes: Obtaining a user identifier and an Internet Protocol address corresponding to a currently logged-in user corresponding to at least one cloud desktop system; Determine user corresponding information according to at least one user identifier and the Internet Protocol address corresponding to the currently logged-in user, as well as the user identifier of the access requesting user in the pre-acquired historical access control information and at least one access source address corresponding to the access requesting user; According to the user corresponding information and the original access control policy, the user address corresponding information is determined, and the target access control policy is determined based on the user address corresponding information; wherein the original access control policy includes at least one set of matching access source addresses and access destination addresses.

3. The application access control method according to claim 2, characterized in that: The determining of user corresponding information according to the user identification and the Internet Protocol address corresponding to at least one of the currently logged-in users and the user identification of the accessing user in the pre-acquired historical access control information and at least one access source address corresponding to the accessing user comprises: For at least one access source address corresponding to the access requesting user in the historical access control information, determine a target Internet Protocol address consistent with the access source address from at least one Internet Protocol address, and determine a current logged-in user corresponding to the target Internet Protocol address; Sending the determined user ID corresponding to the currently logged-in user to a terminal associated with the access application user according to the user ID of the access application user, so that the access application user confirms the user ID corresponding to the currently logged-in user; In the case where the confirmation feedback information is received to confirm the match, the currently logged-in user is used as the accessing user, and a mapping relationship between the user identifier of the accessing user and the access source address is established; User corresponding information is generated according to at least one set of the mapping relationships.

4. The application access control method according to claim 1, characterized in that: The performing policy migration on the original access control policy based on the target access control policy includes: The target access control policy and the original access control policy are subjected to parallel access control; wherein the target access control policy includes at least one user control policy, and the user control policy includes at least the matching user identification of the access user and the access destination address; the original access control policy includes at least one address control policy; the address control policy includes at least the matching access source address and the access destination address; In the process of parallel access control, first policy hit information corresponding to the original access control policy and second policy hit information corresponding to the target access control policy are obtained: Policy migration is performed according to the first policy hit information and the second policy hit information.

5. The application access control method according to claim 4, characterized in that: The performing parallel access control on the target access control policy and the original access control policy includes: In the case of receiving an application access request whose address type of the access source address is a cloud desktop address, determining the access source address, the user identifier of the accessing user, and the access destination address based on the application access request; Determining whether the target access control policy is hit based on the user identification of the access user and the access destination address; In the case of hitting the target access control policy, forwarding the application access request based on the gateway where the target access control policy is located, so as to access the application corresponding to the access destination address; In the case where the target access control policy is not hit, whether the original access control policy is hit is determined based on the access source address and the access destination address, and in the case where the original access control policy is hit, the application access request is forwarded based on the gateway where the original access control policy is located to access the application corresponding to the access destination address.

6. The application access control method according to claim 4, characterized in that: The performing policy migration according to the first policy hit information and the second policy hit information includes: Determine, according to the first policy hit information, a policy hit result corresponding to at least one target address control policy whose address type of the access source address is a cloud desktop address; For at least one of the target address control policies, when the policy hit result corresponding to the target address control policy is a miss, determining a user identifier of a visiting user corresponding to the access source address according to the access source address and the user corresponding information in the target address control policy; Determining a target user control policy from the target access control policy according to the user identifier of the access user and the access destination address in the target address control policy; A policy hit result corresponding to the target user control policy is determined according to the second policy hit information, and when the policy hit result is hit, the target address control policy is deleted from the original access control policy.

7. An application access control device, characterized in that: include: A policy configuration module, used to determine a target access control policy according to predetermined user corresponding information and an original access control policy; wherein the user corresponding information is used to indicate a mapping relationship between an access source address and a user identifier of an access user; the address type of the access source address is a cloud desktop address; the original access control policy is used to determine access rights according to an access source address and an access destination address; the target access control policy is used to determine access rights according to the user identifier of the access user and the access destination address; The policy migration module is used to perform policy migration on the original access control policy based on the target access control policy, so as to switch the target network control policy based on which the cloud desktop accesses the corresponding application from the original access control policy to the target access control policy.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the application access control method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the application access control method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed by a processor, implements the application access control method according to claims 1-6.

Images