Data security auditing method and system for Azure cloud

Abstract

The invention provides a data security auditing method and system for Azure cloud, and the method comprises the steps: S1, obtaining an access token and a refreshing token according to a credential request token provided by a user; s2, reading log information according to the access token, processing the log information, matching the log information with a predefined rule, detecting records which may have abnormalities, and then auditing identity management, access management and services which may have backdoors in the tenants by the system to obtain an auditing result; and S3, producing a safety audit report according to the audit result. According to the Azure data security auditing method and system, the security condition of the Azure tenant can be audited comprehensively, the audit coverage rate of common risk configuration items is increased by 35% and reaches 90% compared with that of an existing Azure security auditing tool, and comprehensive Azure data security auditing is achieved.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular, relates to a data security audit method and system for Azure cloud. Background Art

[0002] With the rapid development and widespread application of cloud computing technology, more and more companies choose to migrate their services and data to public cloud platforms. Azure cloud platform is favored by many companies due to its flexibility, scalability and diversified services, and has now become one of the world's largest cloud vendors. However, as more and more critical services and privacy data are migrated to the cloud, data security issues are becoming increasingly prominent. For enterprises, ensuring data security in their public cloud environments has become a vital task.

[0003] As a large-scale shared cloud platform, Azure's security construction has become mature and provides a wealth of security mechanisms to protect the security of users' data resources, such as multi-factor authentication, role-based access control (RBAC), log monitoring and threat detection. However, the effectiveness of these security mechanisms depends largely on the correct use and reasonable configuration of tenants. If improperly configured or used, it may still lead to security vulnerabilities or potential risks. Therefore, the introduction of Azure data security audit is very necessary. It can help users comprehensively evaluate the security status of the cloud environment, automatically identify potential risks and configuration vulnerabilities, improve visibility into security incidents, and help tenants formulate reasonable security policies to ensure the continued safe operation of the cloud environment.

[0004] Currently, most Azure security products on the market usually focus on specific modules, such as log analysis or identity management, and cannot cover the security needs of the entire Azure cloud environment. These tools often have single functions and it is difficult to provide users with comprehensive security assessments and improvement suggestions.

[0005] Patent document CN117714160A discloses an attack surface detection system and method for Azure cloud. The scheme specifically discloses an identity authentication subsystem, an information collection subsystem and a threat analysis subsystem; the identity authentication subsystem authenticates Azure cloud tenants, obtains and caches required tokens, and switches token types when necessary; the information collection subsystem uses tokens to collect information in Azure tenants, uses tokens to collect information in Azure subscriptions, and stores the collected information in a database; the threat analysis subsystem performs threat analysis and attack surface detection on the collected information. It can be used to quickly detect the permission allocation, service configuration and defense deployment in Azure cloud tenants, and can detect tenant vulnerabilities from the aspects of directory configuration, data acquisition, permission escalation and permission maintenance, so as to conduct rapid security detection and risk discovery of Azure cloud environment in a relatively comprehensive and accurate manner; the scheme aims to speed up the efficiency of security detection, but cannot cover the security requirements of the entire Azure cloud environment.

[0006] Therefore, enterprises are in urgent need of an integrated, secure, and easy-to-use Azure data security audit system that can cover multiple levels from identity authentication, access control to log analysis, to help enterprises more comprehensively protect the security of their Azure tenant environment. Summary of the invention

[0007] In view of the defects in the prior art, the object of the present invention is to provide a data security audit method and system for Azure cloud.

[0008] A data security audit method for Azure cloud provided by the present invention includes:

[0009] Step S1: Request a token based on the credentials provided by the user and obtain an access token and a refresh token;

[0010] Step S2: Read the log information according to the access token, process it and match it with the predefined rules to detect possible abnormal records. Then the system audits the identity management, access management and services that may have backdoors in the tenant to obtain the audit results;

[0011] Step S3: Produce a safety audit report based on the audit results.

[0012] Preferably, in step S1, the credentials include: a password, a certificate and a confidential value;

[0013] In the step S1, the token information is read, and the token is stored in the specified path in JSON format; it is determined whether the target token is found in the local cache, and if the result is yes, the token in the cache is directly returned; if the result is no, an access token is requested from Azure AD according to the credentials specified by the user, and the access token is written into the local cache to obtain a cached access token;

[0014] After reading the access token through the identity authentication subsystem, the access token is parsed according to the JWT format to obtain the token expiration time; based on the token expiration time, it is determined whether the access token is expired. If the result is yes, that is, the token has expired, a refresh token is used to request a new access token and write it to the local cache; if the result is no, that is, the token has not expired, the access token is directly returned.

[0015] Preferably, in step S2, the processing is performed and predefined rules are matched to detect abnormal records, that is, whether there is abnormal activity is determined through the log, and if the result is yes, it is marked as a potential risk; if the result is no, it is not processed;

[0016] The abnormal activities include: frequent login failures, abnormal login times, unauthorized resource access, and abnormal traffic fluctuations;

[0017] Frequent login failures refer to providing incorrect credentials more than 20 times in a row within 5 minutes, resulting in login failures;

[0018] The abnormal login time refers to the login time being during non-working hours; the non-working hours include late night or weekends;

[0019] Unauthorized resource access refers to a user frequently accessing resources or data outside of his or her authority; frequent access refers to accessing more than a preset number of times within a preset time;

[0020] The abnormal flow fluctuation refers to a change in flow within a unit time that exceeds a preset threshold; the preset threshold is set based on experience; and the unit time is 5 minutes.

[0021] Preferably, in step S2, auditing the identity management, access management and services that may have backdoors in the tenant includes:

[0022] Check whether there are potential risks in identity management; the audit content of identity management includes:

[0023] Check the number of global administrators in the tenant to determine whether there are more than 5 global administrators in the tenant. If yes, mark it as a potential risk and prohibit adding new global administrators. If no, do not process it.

[0024] Check whether the global administrator has enabled multi-factor authentication. If yes, do not process it. If no, mark it as a potential risk.

[0025] Check whether there is a user who has more than three administrator roles at the same time. If yes, mark it as a potential risk; if no, do not process it.

[0026] The administrator roles include: user administrator, application impersonation administrator and application administrator;

[0027] Check the credential configuration of the service principal to determine whether the number of credentials exceeds 5. If the result is yes, mark it as a potential risk and prohibit the configuration of credentials for the service principal provided by Microsoft; if the result is no, do not process it;

[0028] Check for potential backdoors. The steps include:

[0029] Step Q1: Check the mail service, that is, check the outbound spam policy in the tenant to determine whether the outbound policy is enabled. If yes, it means that the emails in the tenant can be forwarded to a third-party mailbox and marked as a potential backdoor. If no, no processing;

[0030] Step Q2: Check the rule configuration and forwarding settings in each mailbox to determine whether there are rules or configurations for email forwarding. If yes, mark it as a potential backdoor; if no, do not process it;

[0031] Step Q3: Check the configuration of delegated permissions in the tenant to determine whether a high-privileged user delegates mailbox permissions to a low-privileged user. If yes, mark it as a potential backdoor; if no, do not process it.

[0032] Step Q4: Check the OneDrive sharing in the tenant to determine whether there is a shared connection that is publicly accessible and has no expiration time set. If the result is yes, mark it as a potential backdoor; if the result is no, do not process it;

[0033] Step Q5: Check whether the corresponding managed identity of the publicly accessible serverless computing service has the permission to access other resources. If the result is yes, mark it as a potential backdoor; if the result is no, do not process it;

[0034] Step Q6: Check whether the Runbook code has a reverse shell. If yes, mark it as a potential backdoor. If no, do not process it.

[0035] Check access control management for risks, including:

[0036] Step K1: Determine whether the target tenant has configured a separate access control policy for the Key Vault service. If yes, do not process it; if no, mark it as a potential risk.

[0037] Step K2: Audit the target tenant storage bucket to determine whether there is data in token or key format. If yes, mark it as a potential risk. If no, do not process it.

[0038] Step K3: Determine whether the access conditions of the service only authorize users to access. If the result is yes, do not process it. If the result is no, mark it as a potential risk. The services include: storage services, serverless computing services, database services and virtual machine services.

[0039] Preferably, in step S3, the security audit report includes: "the overall data security level of the target tenant", "the recent abnormal behavior of the tenant", "the risk points of identity management in the tenant", "the risk points of key service access control configuration in the tenant", "the potential backdoors in the tenant", "the potential data leakage path of the tenant" and "security recommendations for existing security risks".

[0040] A data security audit system for Azure cloud provided by the present invention includes:

[0041] Authentication subsystem: Requests a token based on the credentials provided by the user and obtains an access token and a refresh token;

[0042] Data security audit subsystem: reads log information based on the access token, processes it and matches it with predefined rules to detect records that may be abnormal. The system then audits the tenant's identity management, access management, and services that may have backdoors to obtain audit results.

[0043] Audit report generation subsystem: produces safety audit reports based on audit results.

[0044] Preferably, in the identity authentication subsystem, the credentials include: a password, a certificate and a confidential value;

[0045] In the identity authentication subsystem, the token information is read, and the token is stored in the specified path in JSON format; it is determined whether the target token is found in the local cache, and if the result is yes, the token in the cache is directly returned; if the result is no, an access token is requested from Azure AD according to the credentials specified by the user, and the access token is written to the local cache to obtain a cached access token;

[0046] After reading the access token through the identity authentication subsystem, the access token is parsed according to the JWT format to obtain the token expiration time; based on the token expiration time, it is determined whether the access token is expired. If the result is yes, that is, the token has expired, a refresh token is used to request a new access token and write it to the local cache; if the result is no, that is, the token has not expired, the access token is directly returned.

[0047] Preferably, in the data security audit subsystem, the processing is performed and predefined rules are matched to detect abnormal records, that is, whether there is abnormal activity is determined through the log, and if the result is yes, it is marked as a potential risk; if the result is no, it is not processed;

[0048] The abnormal activities include: frequent login failures, abnormal login times, unauthorized resource access, and abnormal traffic fluctuations;

[0049] Frequent login failures refer to providing incorrect credentials more than 20 times in a row within 5 minutes, resulting in login failures;

[0050] The abnormal login time refers to the login time being during non-working hours; the non-working hours include late night or weekends;

[0051] Unauthorized resource access refers to a user frequently accessing resources or data outside of his or her authority; frequent access refers to accessing more than a preset number of times within a preset time;

[0052] The abnormal flow fluctuation refers to a change in flow within a unit time that exceeds a preset threshold; the preset threshold is set based on experience; and the unit time is 5 minutes.

[0053] Preferably, in the data security audit subsystem, the identity management, access management and services that may have backdoors in the tenant are audited, including:

[0054] Check whether there are potential risks in identity management; the audit content of identity management includes:

[0055] Check the number of global administrators in the tenant to determine whether there are more than 5 global administrators in the tenant. If yes, mark it as a potential risk and prohibit adding new global administrators. If no, do not process it.

[0056] Check whether the global administrator has enabled multi-factor authentication. If yes, do not process it. If no, mark it as a potential risk.

[0057] Check whether there is a user who has more than three administrator roles at the same time. If yes, mark it as a potential risk; if no, do not process it.

[0058] The administrator roles include: user administrator, application impersonation administrator and application administrator;

[0059] Check the credential configuration of the service principal to determine whether the number of credentials exceeds 5. If the result is yes, mark it as a potential risk and prohibit the configuration of credentials for the service principal provided by Microsoft; if the result is no, do not process it;

[0060] The potential backdoor scanning module of the data security audit subsystem is used to check whether there are potential backdoors, including:

[0061] Potential backdoor scanning unit 1: Check the mail service, that is, check the spam outbound policy in the tenant to determine whether the outbound policy is enabled. If the result is yes, it means that the emails in the tenant can be forwarded to a third-party mailbox and marked as a potential backdoor; if the result is no, it will not be processed;

[0062] Potential backdoor scanning unit 2: Check the rule configuration and forwarding settings in each mailbox to determine whether there are rules or configurations for email forwarding. If the result is yes, mark it as a potential backdoor; if the result is no, do not process it;

[0063] Potential backdoor scanning unit 3: Check the configuration of delegated permissions in the tenant to determine whether there is a configuration in which a high-privileged user delegates mailbox permissions to a low-privileged user. If the result is yes, mark it as a potential backdoor; if the result is no, do not process it;

[0064] Potential backdoor scanning unit 4: Check the OneDrive sharing status in the tenant to determine whether there is a shared connection that can be publicly accessed and has no expiration time set. If the result is yes, it is marked as a potential backdoor; if the result is no, it is not processed;

[0065] Potential backdoor scanning unit 5: Check whether there is a situation where the corresponding managed identity of the publicly accessible serverless computing service has the permission to access other resources. If the result is yes, it is marked as a potential backdoor; if the result is no, it is not processed;

[0066] Potential backdoor scanning unit 6: Check whether the runbook code has a reverse shell. If the result is yes, it is marked as a potential backdoor; if the result is no, it is not processed;

[0067] Check whether there are risks in access control management through the access management audit submodule of the data security audit subsystem, including:

[0068] Access management review unit 1: Determine whether the target tenant has configured the access control policy of the Key Vault service separately, that is, the Key Vault access policy. If the result is yes, no processing will be done; if the result is no, it will be marked as a potential risk;

[0069] Access management audit unit 2: Audit the target tenant storage bucket to determine whether there is data in token or key format. If the result is yes, mark it as a potential risk. If the result is no, do not process it.

[0070] Access management review unit three: Determine whether the access conditions of the service are only for authorized users. If the result is yes, no processing will be done. If the result is no, it will be marked as a potential risk. The services include: storage services, serverless computing services, database services and virtual machine services.

[0071] Preferably, in the audit report generation subsystem, the security audit report includes: "the overall data security level of the target tenant", "the recent abnormal behavior of the tenant", "the risk points of identity management in the tenant", "the risk points of key service access control configuration in the tenant", "the potential backdoors in the tenant", "the potential data leakage path of the tenant" and "security recommendations for existing security risks".

[0072] Compared with the prior art, the present invention has the following beneficial effects:

[0073] 1. The present invention can conduct a comprehensive audit of the security status of Azure tenants. The audit coverage of common risk configuration items is increased by 35% to 90% compared with existing Azure security audit tools, thus realizing a more comprehensive Azure data security audit.

[0074] 2. The present invention uses an automated token management mechanism to update access tokens in real time, automatically audit target Azure tenants, and automatically generate audit reports, thereby reducing more than 90% of manual operations and significantly reducing the complexity of manual intervention; in addition, automated operations also reduce the learning cost before use by about 80%, allowing users to master and apply the system in a short time.

[0075] 3. The present invention can provide targeted security improvement suggestions based on the audit results to help users improve the security strategy of their Azure platform; specifically, after the target tenant optimizes the security configuration with reference to the relevant security suggestions, more than 95% of common security attacks can be avoided, greatly improving the overall security of the target tenant's cloud environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0077] Figure 1 A schematic diagram of the structure provided by the present invention;

[0078] Figure 2 A schematic diagram of the process provided by the present invention;

[0079] Figure 3 A schematic diagram of the identity authentication process provided by the present invention. DETAILED DESCRIPTION

[0080] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0081] The present invention integrates multiple functions such as log collection and analysis, identity management, access management, and potential backdoor scanning.

[0082] According to a data security audit method for Azure cloud provided by the present invention, the process of its software system includes:

[0083] Step S1: Request a token based on the credentials provided by the user and obtain an access token and a refresh token;

[0084] Step S2: Read the log information according to the access token, process it and match it with the predefined rules to detect possible abnormal records. Then the system audits the identity management, access management and services that may have backdoors in the tenant to obtain the audit results;

[0085] Step S3: Produce a safety audit report based on the audit results.

[0086] In the step S1, the credentials include: a password, a certificate and a confidential value;

[0087] In the step S1, the token information is read, and the token is stored in the specified path in JSON format; it is determined whether the target token is found in the local cache, and if the result is yes, the token in the cache is directly returned; if the result is no, an access token is requested from Azure AD according to the credentials specified by the user, and the access token is written into the local cache to obtain a cached access token;

[0088] After the access token is read by the identity authentication subsystem, the access token is parsed according to the JWT format to obtain the token expiration time; based on the token expiration time, it is determined whether the access token is expired. If the result is yes, that is, the token has expired, a new access token is requested using the refresh token and written to the local cache; if the result is no, that is, the token has not expired, the access token is directly returned;

[0089] In the step S2, the processing and matching with predefined rules to detect abnormal records is specifically implemented as follows:

[0090] Specifically, the logs are analyzed using predefined security rules to identify potential security risks or abnormal activities. In other words, the logs are used to determine whether there are abnormal activities. If yes, they are marked as potential risks; if no, they are not processed.

[0091] The abnormal activities include: frequent login failures, abnormal login times, unauthorized resource access, and abnormal traffic fluctuations;

[0092] Frequent login failures refer to providing incorrect credentials more than 20 times in a row within 5 minutes, resulting in login failures;

[0093] The abnormal login time refers to the login time being during non-working hours; the non-working hours include late night or weekends;

[0094] Unauthorized resource access refers to users frequently accessing resources or data outside their authority; frequent refers to more than 20 times in a row within 5 minutes.

[0095] The abnormal flow fluctuation refers to a change in flow within a unit time that exceeds a preset threshold; the preset threshold is set based on experience; and the unit time is 5 minutes.

[0096] Abnormal traffic fluctuations mainly refer to significant changes in traffic within a unit time, where users make a large number of requests and transmit data;

[0097] In step S2, the identity management, access management and services that may have backdoors in the tenant are audited, which is specifically implemented as follows:

[0098] Specifically, the logs are analyzed using predefined security rules to identify potential security risks or abnormal activities. In other words, the logs are used to determine whether there are abnormal activities. If yes, they are marked as potential risks; if no, they are not processed. The abnormal activities include: frequent login failures, abnormal login times, unauthorized resource access, or abnormal traffic fluctuations.

[0099] Specifically, check whether there are potential risks in changing to access management, including:

[0100] Check the number of global administrators in the tenant to determine whether there are more than 5 global administrators in the tenant. If yes, mark it as a potential risk and prohibit adding new global administrators. If no, do not process it.

[0101] Check whether the global administrator has enabled multi-factor authentication. If yes, do not process it. If no, mark it as a potential risk.

[0102] Check whether the user is allowed to have more than three administrator roles at the same time, including: user administrator, application impersonation administrator, and application administrator. If the result is yes, mark it as a potential risk; if the result is no, do not process it;

[0103] Check the credential configuration of the service principal to determine whether the number of credentials exceeds 5. If the result is yes, mark it as a potential risk and prohibit configuring credentials for the service principal provided by Microsoft; if the result is no, do not process it.

[0104] Specifically, check for potential backdoors, including:

[0105] Step Q1: Check the mail service, that is, check the outbound spam policy in the tenant to determine whether the outbound policy is enabled. If yes, it means that the emails in the tenant can be forwarded to a third-party mailbox and marked as a potential backdoor. If no, no processing;

[0106] Step Q2: Check the rule configuration and forwarding settings in each mailbox to determine whether there are rules or configurations for email forwarding. If yes, mark it as a potential backdoor; if no, do not process it;

[0107] Step Q3: Check the configuration of delegated permissions in the tenant to determine whether a high-privileged user delegates mailbox permissions to a low-privileged user. If yes, mark it as a potential backdoor; if no, do not process it.

[0108] Step Q4: Check the OneDrive sharing in the tenant to determine whether there is a shared connection that is publicly accessible and has no expiration time set. If the result is yes, mark it as a potential backdoor; if the result is no, do not process it;

[0109] Step Q5: Check whether the corresponding managed identity of the publicly accessible serverless computing service has the permission to access other resources. If the result is yes, mark it as a potential backdoor; if the result is no, do not process it;

[0110] Step Q6: Check whether the Runbook code has a reverse shell. If yes, mark it as a potential backdoor. If no, do not process it.

[0111] Specifically, check whether there are risks in access control management, including:

[0112] Step K1: Determine whether the target tenant has configured a separate access control policy for the Key Vault service. If yes, do not process it; if no, mark it as a potential risk.

[0113] Step K2: Audit the target tenant storage bucket to determine whether there is data in token or key format. If yes, mark it as a potential risk. If no, do not process it.

[0114] Step K3: Check whether the access conditions of the audit service only authorize users to access. If yes, do not process it. If no, mark it as a potential risk. The services include storage services, serverless computing services, database services and virtual machine services.

[0115] In step S3, the security audit report includes: "the overall data security level of the target tenant", "the recent abnormal behavior of the tenant", "the risk points of identity management in the tenant", "the risk points of key service access control configuration in the tenant", "the potential backdoors in the tenant", "the potential data leakage path of the tenant" and "security recommendations for existing security risks".

[0116] In other words, the present invention discloses a data security audit system for the Azure cloud, aiming to help users solve security defects in the existing environment.

[0117] First, authentication is performed, a token is requested from Azure AD based on the credentials provided by the user, and the obtained access token and refresh token are cached locally.

[0118] The system then uses the access token to read the log information in the tenant, processes it and matches it with predefined rules to detect records that may be abnormal. The system then audits the tenant's identity management, access management, and services that may have backdoors, and stores the results in the local database.

[0119] Finally, the system will generate a security audit report based on the audit results, showing potential risks and providing relevant security recommendations.

[0120] like Figure 1 As shown, the present invention provides a data security audit system for the Azure cloud platform, including an identity authentication subsystem, a data security audit subsystem, and an audit report generation subsystem;

[0121] The identity authentication subsystem is used to obtain and store access tokens and provide available access tokens to other subsystems;

[0122] The identity authentication subsystem is the initial part of the entire audit system, and other systems are built on the identity authentication subsystem.

[0123] The identity authentication subsystem includes a token acquisition module and a token storage module;

[0124] The token acquisition module is mainly used to request a token from Azure AD using the login credentials provided by the user. The user can choose to use passwords, certificates, secret values, primary refresh tokens and other types of credentials for identity authentication and token acquisition to ensure that the system can access the target tenant resources. In other words, the token acquisition module is mainly used to request access tokens and refresh tokens based on different applications and resources from Azure AD using user credentials.

[0125] The token storage module is mainly responsible for caching the obtained access token and refresh token locally, and providing access tokens to other subsystems. When necessary, the refresh token will be used to re-request the access token to ensure availability.

[0126] The token storage module is used to securely store and manage the obtained access tokens and refresh tokens. The module periodically checks the validity of the access tokens and obtains new access tokens through refresh tokens when necessary to ensure that the access tokens are always available throughout the audit process to prevent access interruption due to expiration or invalidation.

[0127] like Figure 3 As shown in the figure, other subsystems obtain access tokens from the authentication subsystem when accessing resources in the target Azure tenant. The authentication subsystem first reads token information from the local cache, which is stored in the specified path in JSON format. If the authentication subsystem does not find the relevant token in the local cache, it triggers the token acquisition module to request a token from Azure AD based on the credentials specified by the user and writes the result to the local cache.

[0128] If the authentication subsystem reads the access token, it will parse the access token according to the JWT format and obtain the token expiration time; if the token has expired, it will use the refresh token to request a new access token and write it to the local cache. If the token has not expired, the cached access token will be returned directly.

[0129] The data security audit subsystem is the core subsystem of the entire audit system.

[0130] The data security audit subsystem is mainly responsible for conducting a comprehensive audit of the target tenant's data security, involving log information, key services, identity management, and access control configuration. The data security audit subsystem mainly includes a log collection and analysis module, an identity and access management audit module, and a potential backdoor scanning module. In other words, the data security audit subsystem is used to collect various types of log information, detect the identity authentication and access control configuration and potential backdoor services in the tenant, and store the detection results in the local database.

[0131] The data security audit subsystem includes a log collection and analysis module, an identity and access management audit module, and a potential backdoor scanning module;

[0132] The log collection and analysis module is used to collect and analyze different types of logs in the target tenant to detect possible abnormal operations;

[0133] The identity and access management audit module is used to audit the identity authentication and access control configuration information of the target tenant; wherein the identity management audit submodule audits the target tenant role permission configuration information, and the access management audit submodule audits the condition information for accessing the target tenant service.

[0134] The potential backdoor scanning module is used to scan sensitive services in the target tenant and discover potential backdoor information.

[0135] The log collection and analysis module is used to regularly collect login logs, activity logs and other related information from Azure tenants, and pre-process the collected results, including denoising, classification and storage. After the collection is completed, the module will analyze the logs through predefined security rules. The system has a set of pre-set security policies and rule libraries. These rules are designed based on common security events, threat patterns and known attack methods, and can effectively detect potential security risks or abnormal activities. For example, the system can detect frequent login failures, abnormal login times, unauthorized resource access, or abnormal traffic fluctuations. Once these abnormal activities are found, the system will mark them as potential security threats. By analyzing and matching log data, it helps users identify potential security risks and abnormal activities in tenants.

[0136] In other words, the log collection and analysis module is used to regularly collect login logs, activity logs and other related information from Azure tenants, pre-process the collected results, including denoising, classification and storage, and analyze the logs through predefined security rules to identify potential security risks or abnormal activities.

[0137] The identity and access management audit module mainly audits the identity management and access control in the tenant, including the identity management audit submodule and the access management audit submodule.

[0138] The identity management audit submodule is used to audit the identity configuration information in the Azure tenant. The identity management audit submodule can count and review the permission configuration of users and service subjects in detail, check whether high-authority users have enabled multi-factor authentication, and the key and certificate configuration of high-authority service subjects to ensure that they meet security standards.

[0139] Specifically, the identity management audit submodule will check the number of full administrators and general administrators in the tenant to confirm whether there are too many global administrators or too concentrated administrator roles. In addition, the submodule will mark administrator users who have not enabled multi-factor authentication as threats.

[0140] The identity management audit submodule will check the permission allocation of all service subjects in the tenant. For service subjects with higher permissions, especially those with more application permissions, the submodule will check the configuration of confidential values ​​and certificates, and remind users to change them regularly.

[0141] The identity management audit submodule records the recent allocation of sensitive roles in the tenant, including global administrators, user administrators, and application impersonation administrators. Users need to confirm the necessity of allocating sensitive administrator roles and cancel some unnecessary allocations.

[0142] The access management audit submodule is used to audit access control configuration information in Azure tenants.

[0143] Specifically, the access management audit submodule will check the access control of the Key Vault service, that is, the access permission configuration, to ensure that it is limited to authorized users or service entities, and conduct a detailed review of the access policies of resources such as storage buckets to prevent unauthorized access and ensure the security and rationality of resource access policies. The Key Vault service is mainly used to store sensitive information such as confidential values, keys, certificates, etc. If the target tenant does not configure the access control policy of the Key Vault service separately, the module will mark it as a potential risk.

[0144] The access management audit submodule audits the contents of the target tenant's bucket and matches them with common formats such as tokens and keys. If fields in related formats appear, the module will mark them as potential risks.

[0145] The access management audit submodule audits the access conditions of common services in the target tenant, mainly including storage services, serverless computing services, database services, virtual machine services, etc. The submodule analyzes the permission configuration of various types to ensure that the resources in the tenant are only accessible to authorized users, avoiding the risk of data leakage caused by public access.

[0146] The potential backdoor scanning module is used to scan configuration items in Azure tenants and identify possible backdoor services.

[0147] Specifically, the potential backdoor scanning module is used to scan the configuration items in the Azure tenant to identify possible backdoor services. This module mainly checks the rule delegation settings of the mail service, the spam outbound configuration, the publicly accessible cloud files and storage buckets, the key certificates newly added by the service principal, and the configuration of the managed identity to identify the configuration that may be maliciously exploited.

[0148] Specifically, the potential backdoor scanning module will check the mail service in Azure. First, the module will check the outbound spam policy in the tenant. If the outbound policy is turned on, it means that the mail in the tenant can be forwarded to a third-party mailbox. Secondly, the module will check the rule configuration and forwarding settings in each mailbox. If there is a rule or configuration for mail forwarding, it will be marked as a potential backdoor. After that, the module will check the configuration of delegated permissions in the tenant. If there is an unreasonable configuration such as a high-privileged user delegating mailbox permissions to a low-privileged user, it may lead to the illegal flow of mail data, and the module will mark it as a potential backdoor.

[0149] The potential backdoor scanning module checks the public access of OneDrive, the file storage service within the tenant. The module reviews the validity period of public access to ensure that public access is limited to a safe and controllable time frame to prevent security risks caused by long-term exposure. At the same time, the module also checks whether there are folders that have been shared to prevent the entire file structure and the sensitive data it contains from being accessed by unauthorized users.

[0150] The potential backdoor scanning module checks the configuration of tenants' serverless computing, Webhook and other services to detect potential backdoors. For serverless computing services, the module checks their access control configuration and the permissions held by the corresponding managed identity. The potential backdoor scanning module marks serverless computing services that are publicly accessible and have high permissions held by the corresponding managed identity as potential backdoors. Such services may cause unauthorized users to perform high-privilege operations. For the Webhook service in the tenant, the module analyzes its associated Runbook code and detects whether there are backdoor operations such as rebound shells in the code.

[0151] The module checks the configuration of service principals in the tenant. The module retrieves the credential configuration of all service principals to determine whether the number of credentials they have exceeds the normal value. At the same time, the module prohibits the configuration of credentials for first-party service principals provided by Microsoft.

[0152] The audit report generation subsystem is used to generate security audit reports for Azure tenants, display the results of the data security audit subsystem detection, identify potential security risks of target tenants, and provide corresponding security recommendations. The content of the report mainly includes: the overall data security level of the target tenant, the recent abnormal behavior of the tenant, the risk points of identity management in the tenant, the risk points of key service access control configuration in the tenant, the potential backdoors in the tenant, the potential data leakage path of the tenant, and security recommendations for existing security risks. The audit report will be displayed to the user in the form of a web page for the user to view at any time. Users can eliminate potential security threats and optimize security policies based on the audit results and security recommendations.

[0153] The present invention also provides a data security audit system for the Azure cloud. The data security audit system for the Azure cloud can be implemented by executing the process steps of the data security audit method for the Azure cloud, that is, those skilled in the art can understand the data security audit method for the Azure cloud as a preferred implementation of the data security audit system for the Azure cloud.

[0154] A data security audit system for Azure cloud provided by the present invention includes:

[0155] Authentication subsystem: Requests a token based on the credentials provided by the user and obtains an access token and a refresh token;

[0156] Data security audit subsystem: reads log information based on the access token, processes it and matches it with predefined rules to detect records that may be abnormal. The system then audits the tenant's identity management, access management, and services that may have backdoors to obtain audit results.

[0157] Audit report generation subsystem: produces safety audit reports based on audit results.

[0158] Those skilled in the art know that, in addition to realizing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, it is entirely possible to realize the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0159] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A data security audit method for Azure cloud, characterized in that: include: Step S1: Request a token based on the credentials provided by the user and obtain an access token and a refresh token; Step S2: Read the log information according to the access token, process it and match it with the predefined rules to detect possible abnormal records. Then the system audits the identity management, access management and services that may have backdoors in the tenant to obtain the audit results; Step S3: Produce a safety audit report based on the audit results.

2. The data security audit method for Azure cloud according to claim 1, characterized in that: In the step S1, the credentials include: a password, a certificate and a confidential value; In the step S1, the token information is read, and the token is stored in the specified path in JSON format; it is determined whether the target token is found in the local cache, and if the result is yes, the token in the cache is directly returned; if the result is no, an access token is requested from Azure AD according to the credentials specified by the user, and the access token is written into the local cache to obtain a cached access token; After reading the access token through the identity authentication subsystem, the access token is parsed according to the JWT format to obtain the token expiration time; based on the token expiration time, it is determined whether the access token is expired. If the result is yes, that is, the token has expired, a refresh token is used to request a new access token and write it to the local cache; if the result is no, that is, the token has not expired, the access token is directly returned.

3. The data security audit method for Azure cloud according to claim 2, characterized in that: In step S2, the processing is performed and predefined rules are matched to detect abnormal records, that is, whether there is abnormal activity is determined through the log, and if the result is yes, it is marked as a potential risk; If the result is no, no processing will be done; The abnormal activities include: frequent login failures, abnormal login times, unauthorized resource access, and abnormal traffic fluctuations; Frequent login failures refer to providing incorrect credentials more than 20 times in a row within 5 minutes, resulting in login failures; The abnormal login time refers to the login time being during non-working hours; the non-working hours include late night or weekends; Unauthorized resource access refers to a user frequently accessing resources or data outside of his or her authority; frequent access refers to accessing more than a preset number of times within a preset time; The abnormal flow fluctuation refers to a change in flow within a unit time that exceeds a preset threshold; the preset threshold is set based on experience; and the unit time is 5 minutes.

4. The data security audit method for Azure cloud according to claim 3 is characterized in that: In step S2, identity management, access management and services that may have backdoors in the tenant are audited, including: Check identity management for potential risks; The audit contents of identity management include: Check the number of global administrators in the tenant to determine whether there are more than 5 global administrators in the tenant. If yes, mark it as a potential risk and prohibit adding new global administrators. If no, do not process it. Check whether the global administrator has enabled multi-factor authentication. If yes, do not process it. If no, mark it as a potential risk. Check whether there is a user who has more than three administrator roles at the same time. If yes, mark it as a potential risk; if no, do not process it. The administrator roles include: user administrator, application impersonation administrator and application administrator; Check the credential configuration of the service principal to determine whether the number of credentials exceeds 5. If the result is yes, mark it as a potential risk and prohibit the configuration of credentials for the service principal provided by Microsoft; if the result is no, do not process it; Check for potential backdoors. The steps include: Step Q1: Check the mail service, that is, check the outbound spam policy in the tenant to determine whether the outbound policy is enabled. If yes, it means that the emails in the tenant can be forwarded to a third-party mailbox and marked as a potential backdoor. If no, no processing; Step Q2: Check the rule configuration and forwarding settings in each mailbox to determine whether there are rules or configurations for email forwarding. If yes, mark it as a potential backdoor; if no, do not process it; Step Q3: Check the configuration of delegated permissions in the tenant to determine whether a high-privileged user delegates mailbox permissions to a low-privileged user. If yes, mark it as a potential backdoor; if no, do not process it. Step Q4: Check the OneDrive sharing in the tenant to determine whether there is a shared connection that is publicly accessible and has no expiration time set. If the result is yes, mark it as a potential backdoor; if the result is no, do not process it; Step Q5: Check whether the corresponding managed identity of the publicly accessible serverless computing service has the permission to access other resources. If the result is yes, mark it as a potential backdoor; if the result is no, do not process it; Step Q6: Check whether the Runbook code has a reverse shell. If yes, mark it as a potential backdoor. If no, do not process it. Check access control management for risks, including: Step K1: Determine whether the target tenant has configured a separate access control policy for the Key Vault service. If yes, do not process it; if no, mark it as a potential risk. Step K2: Audit the target tenant storage bucket to determine whether there is data in token or key format. If yes, mark it as a potential risk. If no, do not process it. Step K3: Determine whether the access conditions of the service only authorize users to access. If the result is yes, do not process it. If the result is no, mark it as a potential risk. The services include: storage services, serverless computing services, database services and virtual machine services.

5. The data security audit method for Azure cloud according to claim 4, characterized in that: In step S3, the security audit report includes: "the overall data security level of the target tenant", "the recent abnormal behavior of the tenant", "the risk points of identity management in the tenant", "the risk points of key service access control configuration in the tenant", "the potential backdoors in the tenant", "the potential data leakage path of the tenant" and "security recommendations for existing security risks".

6. A data security audit system for Azure cloud, characterized in that: include: Authentication subsystem: Requests a token based on the credentials provided by the user and obtains an access token and a refresh token; Data security audit subsystem: reads log information based on the access token, processes it and matches it with predefined rules to detect records that may be abnormal. The system then audits the tenant's identity management, access management, and services that may have backdoors to obtain audit results. Audit report generation subsystem: produces safety audit reports based on audit results.

7. The data security audit system for Azure cloud according to claim 6, characterized in that: In the identity authentication subsystem, the credentials include: a password, a certificate, and a confidential value; In the identity authentication subsystem, the token information is read, and the token is stored in the specified path in JSON format; it is determined whether the target token is found in the local cache, and if the result is yes, the token in the cache is directly returned; if the result is no, an access token is requested from Azure AD according to the credentials specified by the user, and the access token is written to the local cache to obtain a cached access token; After reading the access token through the identity authentication subsystem, the access token is parsed according to the JWT format to obtain the token expiration time; based on the token expiration time, it is determined whether the access token is expired. If the result is yes, that is, the token has expired, a refresh token is used to request a new access token and write it to the local cache; if the result is no, that is, the token has not expired, the access token is directly returned.

8. The data security audit system for Azure cloud according to claim 7, characterized in that: In the data security audit subsystem, the processing is performed and predefined rules are matched to detect abnormal records, that is, whether there is abnormal activity through the log, and if the result is yes, it is marked as a potential risk; If the result is no, no processing will be done; The abnormal activities include: frequent login failures, abnormal login times, unauthorized resource access, and abnormal traffic fluctuations; Frequent login failures refer to providing incorrect credentials more than 20 times in a row within 5 minutes, resulting in login failures; The abnormal login time refers to the login time being during non-working hours; the non-working hours include late night or weekends; Unauthorized resource access refers to a user frequently accessing resources or data outside of his or her authority; frequent access refers to accessing more than a preset number of times within a preset time; The abnormal flow fluctuation refers to a change in flow within a unit time that exceeds a preset threshold; the preset threshold is set based on experience; and the unit time is 5 minutes.

9. The data security audit system for Azure cloud according to claim 8, characterized in that: In the data security audit subsystem, the tenant's identity management, access management, and services that may have backdoors are audited, including: Check whether there are potential risks in identity management; the audit content of identity management includes: Check the number of global administrators in the tenant to determine whether there are more than 5 global administrators in the tenant. If yes, mark it as a potential risk and prohibit adding new global administrators. If no, do not process it. Check whether the global administrator has enabled multi-factor authentication. If yes, do not process it. If no, mark it as a potential risk. Check whether there is a user who has more than three administrator roles at the same time. If yes, mark it as a potential risk; if no, do not process it. The administrator roles include: user administrator, application impersonation administrator and application administrator; Check the credential configuration of the service principal to determine whether the number of credentials exceeds 5. If the result is yes, mark it as a potential risk and prohibit the configuration of credentials for the service principal provided by Microsoft; if the result is no, do not process it; The potential backdoor scanning module of the data security audit subsystem is used to check whether there are potential backdoors, including: Potential backdoor scanning unit 1: Check the mail service, that is, check the spam outbound policy in the tenant to determine whether the outbound policy is enabled. If the result is yes, it means that the emails in the tenant can be forwarded to a third-party mailbox and marked as a potential backdoor; if the result is no, it will not be processed; Potential backdoor scanning unit 2: Check the rule configuration and forwarding settings in each mailbox to determine whether there are rules or configurations for email forwarding. If the result is yes, mark it as a potential backdoor; if the result is no, do not process it; Potential backdoor scanning unit 3: Check the configuration of delegated permissions in the tenant to determine whether there is a configuration in which a high-privileged user delegates mailbox permissions to a low-privileged user. If the result is yes, mark it as a potential backdoor; if the result is no, do not process it; Potential backdoor scanning unit 4: Check the OneDrive sharing status in the tenant to determine whether there is a shared connection that can be publicly accessed and has no expiration time set. If the result is yes, it is marked as a potential backdoor; if the result is no, it is not processed; Potential backdoor scanning unit 5: Check whether there is a situation where the corresponding managed identity of the publicly accessible serverless computing service has the permission to access other resources. If the result is yes, it is marked as a potential backdoor; if the result is no, it is not processed; Potential backdoor scanning unit 6: Check whether the runbook code has a reverse shell. If the result is yes, it is marked as a potential backdoor; if the result is no, it is not processed; Check whether there are risks in access control management through the access management audit submodule of the data security audit subsystem, including: Access management review unit 1: Determine whether the target tenant has configured a separate access control policy for the Key Vault service. If yes, no processing will be done; if no, it will be marked as a potential risk. Access management audit unit 2: Audit the target tenant storage bucket to determine whether there is data in token or key format. If the result is yes, mark it as a potential risk. If the result is no, do not process it. Access management review unit three: Determine whether the access conditions of the service are only for authorized users. If the result is yes, no processing will be done. If the result is no, it will be marked as a potential risk. The services include: storage services, serverless computing services, database services and virtual machine services.

10. The data security audit system for Azure cloud according to claim 9, characterized in that: In the audit report generation subsystem, the security audit report includes: "the overall data security level of the target tenant", "the recent abnormal behavior of the tenant", "the risk points of identity management in the tenant", "the risk points of key service access control configuration in the tenant", "the potential backdoors in the tenant", "the potential data leakage path of the tenant" and "security recommendations for existing security risks".

Images