Data security auditing method and system for azure cloud

Abstract

This invention provides a data security auditing method and system for Azure cloud, comprising: Step S1: Obtaining an access token and a refresh token based on the credentials provided by the user; Step S2: Reading log information based on the access token, processing it, and matching it with predefined rules to detect potentially abnormal records. The system then audits the tenant's identity management, access management, and services that may contain backdoors, obtaining audit results; Step S3: Generating a security audit report based on the audit results. This invention enables comprehensive auditing of the security status of Azure tenants, achieving 90% coverage of common risk configuration items, a 35% improvement compared to existing Azure security auditing tools, thus realizing a more comprehensive Azure data security audit.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a data security auditing method and system for Azure cloud. Background Technology

[0002] With the rapid development and widespread application of cloud computing technology, more and more enterprises are choosing to migrate their services and data to public cloud platforms. Azure cloud platform, favored by numerous enterprises for its flexibility, scalability, and diverse services, has become one of the world's largest cloud vendors. However, as more and more critical services and privacy data move to the cloud, data security issues are becoming increasingly prominent. For enterprises, ensuring data security in their public cloud environment has become a crucial task.

[0003] As a large public cloud platform, Azure's security infrastructure is mature, offering a rich set of security mechanisms to protect user data resources, such as multi-factor authentication, role-based access control (RBAC), log monitoring, and threat detection. However, the effectiveness of these security mechanisms largely depends on the correct use and proper configuration by tenants. Improper configuration or use can still lead to security vulnerabilities or potential risks. Therefore, the introduction of Azure data security auditing is essential. It helps users comprehensively assess the security status of their cloud environment, automatically identify potential risks and configuration vulnerabilities, improve visibility into security incidents, and help tenants develop reasonable security policies to ensure the continuous secure operation of the cloud environment.

[0004] Currently, most Azure security products on the market typically focus on specific modules, such as log analysis or identity management, failing to cover the security needs of the entire Azure cloud environment. These tools often have limited functionality and struggle to provide users with comprehensive security assessments and improvement recommendations.

[0005] Patent document CN117714160A discloses an attack surface detection system and method for Azure cloud. Specifically, this solution discloses an authentication subsystem, an information collection subsystem, and a threat analysis subsystem. The authentication subsystem authenticates Azure cloud tenants, acquires and caches required tokens, and switches token types when necessary. The information collection subsystem uses tokens to collect information from Azure tenants and Azure subscriptions, storing the collected information in a database. The threat analysis subsystem performs threat analysis and attack surface detection on the collected information. It can be used to quickly detect permission allocation, service configuration, and defense deployment in Azure cloud tenants, detecting tenant vulnerabilities from several levels, including directory configuration, data acquisition, privilege escalation, and privilege maintenance, thus providing a relatively comprehensive and accurate rapid security detection and risk discovery for the Azure cloud environment. However, this solution aims to accelerate security detection efficiency and cannot cover the entire security needs of the Azure cloud environment.

[0006] Therefore, enterprises urgently need an integrated, secure, and easy-to-use Azure data security auditing system that can cover multiple levels from identity authentication and access control to log analysis, helping enterprises to more comprehensively protect the security of their Azure tenant environments. Summary of the Invention

[0007] In view of the deficiencies in the prior art, the purpose of this invention is to provide a data security auditing method and system for Azure cloud.

[0008] A data security auditing method for Azure cloud provided by the present invention includes:

[0009] Step S1: Request tokens based on the credentials provided by the user, and obtain access tokens and refresh tokens;

[0010] Step S2: Read log information based on the access token, process it and match it with predefined rules to detect potentially abnormal records. Then, the system audits the identity management, access management and services that may have backdoors in the tenant and obtains the audit results.

[0011] Step S3: Based on the audit results, generate a production safety audit report.

[0012] Preferably, in step S1, the credentials include: a password, a certificate, and a confidential value;

[0013] In step S1, the token information is read. The token is stored in JSON format under a specified path. It is determined whether the target token is found in the local cache. If the result is yes, the token in the cache is returned directly. If the result is no, an access token is requested from Azure AD according to the credentials specified by the user, and the access token is written to the local cache to obtain the cached access token.

[0014] After the access token is read by the identity authentication subsystem, it is parsed according to the JWT format to obtain the token expiration time. Based on the token expiration time, it is determined whether the access token has expired. If the result is yes, that is, the token has expired, a refresh token is used to request a new access token and write it to the local cache. If the result is no, that is, the token has not expired, the access token is returned directly.

[0015] Preferably, in step S2, the process involves matching predefined rules to detect abnormal records, i.e., determining whether there is abnormal activity through logs. If the result is yes, it is marked as a potential risk; if the result is no, no processing is performed.

[0016] The abnormal activities include: frequent login failures, abnormal login times, unauthorized resource access, and abnormal traffic fluctuations;

[0017] Frequent login failures refer to providing incorrect credentials more than 20 times consecutively within 5 minutes, resulting in login failure.

[0018] The abnormal login time refers to the login time occurring outside of working hours; the non-working hours include late at night or weekends.

[0019] Unauthorized resource access refers to a user frequently accessing resources or data outside their authorized scope; frequent access refers to accessing resources more than a preset number of times within a preset time period.

[0020] The abnormal traffic fluctuation refers to a change in traffic exceeding a preset threshold within a unit of time; the preset threshold is set based on experience; the unit of time is 5 minutes.

[0021] Preferably, in step S2, the audit of tenant identity management, access management, and services that may contain backdoors is performed, including:

[0022] Examine identity management for potential risks; the audit content of identity management includes:

[0023] Check the number of global administrators within a tenant. Determine if the number of global administrators within a tenant exceeds 5. If the result is yes, mark it as a potential risk and prohibit the addition of new global administrators; if the result is no, do not take any action.

[0024] Check if the global administrator has enabled multi-factor authentication. If yes, do nothing; if no, mark it as a potential risk.

[0025] Check if any user has more than three administrator roles simultaneously. If yes, mark it as a potential risk; if no, do not take any action.

[0026] The administrator roles include: User Administrator, Application Impersonation Administrator, and Application Administrator;

[0027] Check the service provider's credential configuration to determine if the number of credentials exceeds 5. If yes, mark it as a potential risk and prohibit configuring credentials for Microsoft-provided service providers; if no, do not take any action.

[0028] To check for potential backdoors, the steps include:

[0029] Step Q1: Check the email service, that is, check the spam outbound policy in the tenant and determine whether the outbound policy is enabled. If the result is yes, it means that the emails in the tenant can be forwarded to the third-party mailbox and are marked as potential backdoors; if the result is no, do not take any action.

[0030] Step Q2: Check the rule configuration and forwarding settings in each mailbox to determine if there are any email forwarding rules or configurations. If yes, mark it as a potential backdoor; if no, do not take any action.

[0031] Step Q3: Check the configuration of delegated permissions in the tenant to determine if there is a configuration where a high-privilege user delegates email permissions to a low-privilege user. If the result is yes, mark it as a potential backdoor; if the result is no, do not take any action.

[0032] Step Q4: Check the OneDrive sharing status of the tenant to determine if there are any publicly accessible shared connections without an expiration time. If yes, mark them as potential backdoors; if no, do not take any action.

[0033] Step Q5: Check if there is a publicly accessible serverless computing service whose corresponding hosting identifier has permission to access other resources. If yes, mark it as a potential backdoor; if no, do not take any action.

[0034] Step Q6: Check if the Runbook code contains a reverse shell. If yes, mark it as a potential backdoor; if no, do not take any action.

[0035] Check for risks in access control management, including:

[0036] Step K1: Determine whether the target tenant has configured access control policies for the Key Vault service separately. If yes, do not process; if no, mark it as a potential risk.

[0037] Step K2: Audit the target tenant's storage bucket to determine if there is data in token or key format. If yes, mark it as a potential risk; if no, do not process it.

[0038] Step K3: Determine whether the service access conditions are only authorized for user access. If the result is yes, no action is taken; if the result is no, it is marked as a potential risk. The services include: storage services, serverless computing services, database services, and virtual machine services.

[0039] Preferably, in step S3, the security audit report includes: "the overall data security level of the target tenant", "recent abnormal behavior of the tenant", "risk points in identity management of the tenant", "risk points in access control configuration of critical services in the tenant", "potential backdoors in the tenant", "potential data leakage paths of the tenant" and "security recommendations for existing security risks".

[0040] A data security auditing system for Azure cloud provided by the present invention includes:

[0041] Identity authentication subsystem: Requests a token based on the credentials provided by the user and obtains an access token and a refresh token;

[0042] Data security audit subsystem: Reads log information based on access tokens, processes it and matches it with predefined rules to detect potentially abnormal records. Then the system audits the identity management, access management and services that may contain backdoors in the tenant and obtains the audit results.

[0043] Audit report generation subsystem: Generates production safety audit reports based on audit results.

[0044] Preferably, in the identity authentication subsystem, the credentials include: a password, a certificate, and a confidential value;

[0045] In the identity authentication subsystem, token information is read. The token is stored in JSON format under a specified path. It is determined whether the target token is found in the local cache. If the result is yes, the token in the cache is returned directly. If the result is no, an access token is requested from Azure AD based on the credentials specified by the user, and the access token is written to the local cache to obtain the cached access token.

[0046] After the access token is read by the identity authentication subsystem, it is parsed according to the JWT format to obtain the token expiration time. Based on the token expiration time, it is determined whether the access token has expired. If the result is yes, that is, the token has expired, a refresh token is used to request a new access token and write it to the local cache. If the result is no, that is, the token has not expired, the access token is returned directly.

[0047] Preferably, in the data security audit subsystem, the process involves matching predefined rules to detect abnormal records, i.e., determining whether there is abnormal activity through logs. If the result is yes, it is marked as a potential risk; if the result is no, no action is taken.

[0048] The abnormal activities include: frequent login failures, abnormal login times, unauthorized resource access, and abnormal traffic fluctuations;

[0049] Frequent login failures refer to providing incorrect credentials more than 20 times consecutively within 5 minutes, resulting in login failure.

[0050] The abnormal login time refers to the login time occurring outside of working hours; the non-working hours include late at night or weekends.

[0051] Unauthorized resource access refers to a user frequently accessing resources or data outside their authorized scope; frequent access refers to accessing resources more than a preset number of times within a preset time period.

[0052] The abnormal traffic fluctuation refers to a change in traffic exceeding a preset threshold within a unit of time; the preset threshold is set based on experience; the unit of time is 5 minutes.

[0053] Preferably, in the data security audit subsystem, auditing is performed on tenant identity management, access management, and services that may contain backdoors, including:

[0054] Examine identity management for potential risks; the audit content of identity management includes:

[0055] Check the number of global administrators within a tenant. Determine if the number of global administrators within a tenant exceeds 5. If the result is yes, mark it as a potential risk and prohibit the addition of new global administrators; if the result is no, do not take any action.

[0056] Check if the global administrator has enabled multi-factor authentication. If yes, do nothing; if no, mark it as a potential risk.

[0057] Check if any user has more than three administrator roles simultaneously. If yes, mark it as a potential risk; if no, do not take any action.

[0058] The administrator roles include: User Administrator, Application Impersonation Administrator, and Application Administrator;

[0059] Check the service provider's credential configuration to determine if the number of credentials exceeds 5. If yes, mark it as a potential risk and prohibit configuring credentials for Microsoft-provided service providers; if no, do not take any action.

[0060] The potential backdoor scanning module of the data security audit subsystem checks for the presence of potential backdoors, including:

[0061] Potential backdoor scanning unit 1: Check email service, that is, check the spam outbound policy in the tenant and determine whether the outbound policy is enabled. If the result is yes, it means that the emails in the tenant can be forwarded to the third-party mailbox and are marked as potential backdoors; if the result is no, no action is taken.

[0062] Potential backdoor scanning unit two: Check the rule configuration and forwarding settings in each mailbox to determine if there are any email forwarding rules or configurations. If yes, mark it as a potential backdoor; if no, do not process it.

[0063] Potential backdoor scanning unit three: Check the configuration of delegated permissions in the tenant to determine whether there is a configuration where a high-privilege user delegates email permissions to a low-privilege user. If the result is yes, mark it as a potential backdoor; if the result is no, do not process it.

[0064] Potential backdoor scanning unit four: Check the OneDrive sharing status of tenants to determine if there are any publicly accessible shared connections without an expiration time. If the result is yes, mark it as a potential backdoor; if the result is no, do not process it.

[0065] Potential backdoor scanning unit five: Check if there is a publicly accessible serverless computing service whose corresponding hosting identifier has permission to access other resources. If the result is yes, mark it as a potential backdoor; if the result is no, do not process it.

[0066] Potential backdoor scanning unit six: Check if the Runbook code contains a reverse shell. If yes, mark it as a potential backdoor; if no, do not process it.

[0067] The access management audit submodule of the data security audit subsystem checks for risks in access control management, including:

[0068] Access Management Review Unit 1: Determine whether the target tenant has configured a separate access control policy for the Key Vault service, i.e., the Key Vault access policy. If the result is yes, no action is taken; if the result is no, it is marked as a potential risk.

[0069] Access Management Audit Unit 2: Audit the target tenant's storage bucket to determine if there is data in token or key format. If yes, mark it as a potential risk; if no, do not process it.

[0070] Access Management Review Unit 3: Determines whether the access conditions for the service are only authorized for user access. If the result is yes, no action is taken; if the result is no, it is marked as a potential risk. The services include: storage services, serverless computing services, database services, and virtual machine services.

[0071] Preferably, in the audit report generation subsystem, the security audit report includes: "the overall data security level of the target tenant", "recent abnormal behavior of the tenant", "risk points in identity management of the tenant", "risk points in access control configuration of critical services in the tenant", "potential backdoors in the tenant", "potential data leakage paths of the tenant" and "security recommendations for existing security risks".

[0072] Compared with the prior art, the present invention has the following beneficial effects:

[0073] 1. This invention can perform a comprehensive audit of the security status of Azure tenants. The audit coverage of common risk configuration items is improved by 35% compared to existing Azure security audit tools, reaching 90%, thus achieving a more comprehensive Azure data security audit.

[0074] 2. This invention uses an automated token management mechanism to update access tokens in real time, automatically audit target Azure tenants, and automatically generate audit reports, reducing manual operations by more than 90% and significantly reducing the complexity of human intervention. Furthermore, the automated operation also reduces the learning cost before use by about 80%, allowing users to master and apply the system in a short time.

[0075] 3. This invention can provide targeted security improvement suggestions based on audit results, helping users improve the security policies of their Azure platforms; specifically, after the target tenant optimizes its security configuration by referring to the relevant security suggestions, it can avoid more than 95% of common security attacks, and significantly improve the overall security of the target tenant's cloud environment. Attached Figure Description

[0076] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0077] Figure 1 This is a schematic diagram of the structure provided by the present invention;

[0078] Figure 2 This is a flowchart provided for the present invention;

[0079] Figure 3 This is a schematic diagram of the identity verification process provided by the present invention. Detailed Implementation

[0080] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0081] This invention integrates multiple functions such as log collection and analysis, identity management, access management, and potential backdoor scanning.

[0082] According to the present invention, a data security auditing method for Azure cloud includes the following software system process:

[0083] Step S1: Request tokens based on the credentials provided by the user, and obtain access tokens and refresh tokens;

[0084] Step S2: Read log information based on the access token, process it and match it with predefined rules to detect potentially abnormal records. Then, the system audits the identity management, access management and services that may have backdoors in the tenant and obtains the audit results.

[0085] Step S3: Based on the audit results, generate a production safety audit report.

[0086] In step S1, the credentials include: a password, a certificate, and a confidential value;

[0087] In step S1, the token information is read. The token is stored in JSON format under a specified path. It is determined whether the target token is found in the local cache. If the result is yes, the token in the cache is returned directly. If the result is no, an access token is requested from Azure AD according to the credentials specified by the user, and the access token is written to the local cache to obtain the cached access token.

[0088] After the access token is read by the identity authentication subsystem, it is parsed according to the JWT format to obtain the token expiration time. Based on the token expiration time, it is determined whether the access token has expired. If the result is yes, that is, the token has expired, a refresh token is used to request a new access token and write it to the local cache. If the result is no, that is, the token has not expired, the access token is returned directly.

[0089] In step S2, the process of matching with predefined rules and detecting abnormal records is implemented as follows:

[0090] Specifically, logs are analyzed using predefined security rules to identify potential security risks or abnormal activities; in other words, the logs are used to determine if abnormal activities exist. If yes, they are marked as potential risks; if no, no action is taken.

[0091] The abnormal activities include: frequent login failures, abnormal login times, unauthorized resource access, and abnormal traffic fluctuations;

[0092] Frequent login failures refer to providing incorrect credentials more than 20 times consecutively within 5 minutes, resulting in login failure.

[0093] The abnormal login time refers to the login time occurring outside of working hours; the non-working hours include late at night or weekends.

[0094] Unauthorized access to resources refers to a user frequently accessing resources or data outside their authorized scope; "frequently" means more than 20 times within 5 minutes.

[0095] The abnormal traffic fluctuation refers to a change in traffic exceeding a preset threshold within a unit of time; the preset threshold is set based on experience; the unit of time is 5 minutes.

[0096] Abnormal traffic fluctuations mainly refer to significant changes in traffic within a unit of time, indicating that users have made a large number of requests and transmitted data.

[0097] In step S2, the audit of identity management, access management, and services that may contain backdoors within the tenant is carried out as follows:

[0098] Specifically, logs are analyzed using predefined security rules to identify potential security risks or abnormal activities. In other words, the logs are used to determine if abnormal activity exists; if yes, it is marked as a potential risk; otherwise, no action is taken. Abnormal activities include: frequent login failures, abnormal login times, unauthorized resource access, or abnormal traffic fluctuations.

[0099] Specifically, check for potential risks associated with switching to access management, including:

[0100] Check the number of global administrators within a tenant. Determine if the number of global administrators within a tenant exceeds 5. If the result is yes, mark it as a potential risk and prohibit the addition of new global administrators; if the result is no, do not take any action.

[0101] Check if the global administrator has enabled multi-factor authentication. If yes, do nothing; if no, mark it as a potential risk.

[0102] Check if any user is authorized to hold more than three administrator roles simultaneously, including: User Administrator, Application Impersonation Administrator, and Application Administrator. If yes, mark it as a potential risk; if no, do not take any action.

[0103] Check the credential configuration of the service provider to determine if the number of credentials exceeds 5. If yes, mark it as a potential risk and prohibit the configuration of credentials for the service provider provided by Microsoft; if no, do not take any action.

[0104] Specifically, checking for potential backdoors includes:

[0105] Step Q1: Check the email service, that is, check the spam outbound policy in the tenant and determine whether the outbound policy is enabled. If the result is yes, it means that the emails in the tenant can be forwarded to the third-party mailbox and are marked as potential backdoors; if the result is no, do not take any action.

[0106] Step Q2: Check the rule configuration and forwarding settings in each mailbox to determine if there are any email forwarding rules or configurations. If yes, mark it as a potential backdoor; if no, do not take any action.

[0107] Step Q3: Check the configuration of delegated permissions in the tenant to determine if there is a configuration where a high-privilege user delegates email permissions to a low-privilege user. If yes, mark it as a potential backdoor; if no, do not take any action.

[0108] Step Q4: Check the OneDrive sharing status of the tenant to determine if there are any publicly accessible shared connections without an expiration time. If yes, mark them as potential backdoors; if no, do not take any action.

[0109] Step Q5: Check if there is a publicly accessible serverless computing service whose corresponding hosting identifier has permission to access other resources. If yes, mark it as a potential backdoor; if no, do not take any action.

[0110] Step Q6: Check if the Runbook code contains a reverse shell. If yes, mark it as a potential backdoor; if no, do not take any action.

[0111] Specifically, check for risks in access control management, including:

[0112] Step K1: Determine whether the target tenant has configured access control policies for the Key Vault service separately. If yes, do not process; if no, mark it as a potential risk.

[0113] Step K2: Audit the target tenant's storage bucket to determine if there is data in token or key format. If yes, mark it as a potential risk; if no, do not process it.

[0114] Step K3: Audit whether the access conditions of the audit service are only authorized to users. If the result is yes, no action is taken; if the result is no, it is marked as a potential risk. The services include: storage services, serverless computing services, database services, and virtual machine services.

[0115] In step S3, the security audit report includes: "overall data security level of the target tenant", "recent abnormal behavior of the tenant", "risk points in identity management of the tenant", "risk points in access control configuration of critical services in the tenant", "potential backdoors in the tenant", "potential data leakage paths of the tenant" and "security recommendations for existing security risks".

[0116] In other words, this invention discloses a data security auditing system for Azure cloud, designed to help users address security vulnerabilities in existing environments.

[0117] First, authentication is performed by requesting a token from Azure AD based on the user's credentials, and the obtained access token and refresh token are cached locally.

[0118] Subsequently, the system uses the access token to read the tenant's log information, processes it, and matches it against predefined rules to detect potentially abnormal records. Afterward, the system audits the tenant's identity management, access management, and services that may contain backdoors, storing the results in a local database.

[0119] Ultimately, the system will generate a security audit report based on the audit results, showcasing potential risks and providing relevant security recommendations.

[0120] like Figure 1 As shown, the present invention provides a data security auditing system for the Azure cloud platform, including an identity authentication subsystem, a data security auditing subsystem, and an audit report generation subsystem;

[0121] The identity authentication subsystem is used to acquire and store access tokens, and to provide available access tokens to other subsystems;

[0122] The identity verification subsystem is the initial part of the entire audit system, and other systems are built on top of it.

[0123] The identity authentication subsystem includes a token acquisition module and a token storage module;

[0124] The token acquisition module is mainly used to request tokens from Azure AD using the login credentials provided by the user. Users can choose to use credentials such as password, certificate, secret value, master refresh token, etc. to authenticate their identity and obtain tokens, ensuring that the system can access the target tenant's resources. In other words, the token acquisition module is mainly used to request access tokens and refresh tokens from Azure AD based on different applications and resources using user credentials.

[0125] The token storage module is mainly responsible for caching the acquired access tokens and refresh tokens locally, providing access tokens to other subsystems, and using refresh tokens to re-request access tokens when necessary to ensure availability.

[0126] The token storage module is used to securely store and manage the acquired access tokens and refresh tokens. The module periodically checks the validity of the access tokens and obtains new access tokens by refreshing the tokens when necessary, ensuring that the access tokens are always available throughout the audit process and preventing access interruption due to expiration or invalidation.

[0127] like Figure 3 As shown, when other subsystems access resources in the target Azure tenant, they obtain access tokens from the authentication subsystem. The authentication subsystem first reads token information from its local cache, which is stored in JSON format at a specified path. If the authentication subsystem does not find the relevant token in its local cache, it triggers the token acquisition module, which requests a token from Azure AD based on the user-specified credentials and writes the result to its local cache.

[0128] If the authentication subsystem reads the access token, it will parse the access token according to the JWT format to obtain the token's expiration time. If the token has expired, it will use a refresh token to request a new access token and write it to the local cache. If the token has not expired, it will directly return the cached access token.

[0129] The data security audit subsystem is the most critical subsystem of the entire audit system.

[0130] The data security audit subsystem is primarily responsible for conducting comprehensive audits of target tenant data security, involving log information, critical services, identity management, and access control configurations. The data security audit subsystem mainly includes a log collection and analysis module, an identity and access management audit module, and a potential backdoor scanning module. In other words, the data security audit subsystem is used to collect various log information, detect identity authentication and access control configurations and potential backdoor services in tenants, and store the detection results in a local database.

[0131] The data security audit subsystem includes a log collection and analysis module, an identity and access management audit module, and a potential backdoor scanning module.

[0132] The log collection and analysis module is used to collect and analyze different types of logs in the target tenant and detect possible abnormal operations.

[0133] The identity and access management audit module is used to audit the identity authentication and access control configuration information of the target tenant; the identity management audit submodule audits the role and permission configuration information of the target tenant, and the access management audit submodule audits the condition information for accessing the target tenant's services.

[0134] The potential backdoor scanning module is used to scan sensitive services in the target tenant and discover potential backdoor information.

[0135] The log collection and analysis module periodically collects login logs, activity logs, and other relevant information from Azure tenants. It preprocesses the collected results, including noise reduction, classification, and storage. After collection, the module analyzes the logs according to predefined security rules. The system has a built-in set of pre-configured security policies and rule bases. These rules are designed based on common security events, threat patterns, and known attack methods, effectively detecting potential security risks or abnormal activity. For example, the system can detect frequent login failures, abnormal login times, unauthorized resource access, or abnormal traffic fluctuations. Once these abnormal activities are detected, the system marks them as potential security threats. Through the analysis and matching of log data, the module helps users identify potential security risks and abnormal activity within their tenants.

[0136] In other words, the log collection and analysis module is used to periodically collect login logs, activity logs and other relevant information from Azure tenants, preprocess the collected results including noise reduction, classification and storage, and analyze the logs through predefined security rules to identify potential security risks or abnormal activities.

[0137] The Identity and Access Management Audit module primarily audits identity management and access control within a tenant, and includes an Identity Management Audit submodule and an Access Management Audit submodule.

[0138] The Identity Management Audit submodule is used to audit identity configuration information in Azure tenants. This submodule can perform detailed statistical analysis and review of user and service principal permission configurations, check whether high-privilege users have enabled multi-factor authentication, and examine the key and certificate configurations of high-privilege service principals to ensure compliance with security standards.

[0139] Specifically, the identity management audit submodule checks the number of all administrators and regular administrators within a tenant to confirm whether there is an excessive number of global administrators or an over-concentration of administrator roles. In addition, the submodule marks administrator users who have not enabled multi-factor authentication as threats.

[0140] The identity management auditing submodule checks the permission allocation of all service entities within the tenant. For service entities with higher permissions, especially those with more application permissions, the submodule checks the configuration of confidentiality values ​​and certificates and reminds users to change them regularly.

[0141] The identity management audit submodule records recent assignments of sensitive roles to tenants. Sensitive roles include global administrators, user administrators, and application impersonation administrators. Users need to confirm the necessity of assigning sensitive administrator roles and cancel any unnecessary assignments.

[0142] The Access Management Audit submodule is used to audit access control configuration information in Azure tenants.

[0143] Specifically, the access management audit submodule checks the access control status of the Key Vault service, i.e., the access permission configuration, to ensure that access is restricted to authorized users or service entities. It also conducts a detailed review of access policies for resources such as storage buckets to prevent unauthorized access and ensure the security and rationality of resource access policies. The Key Vault service is primarily used to store sensitive information such as confidential values, keys, and certificates. If a target tenant has not configured access control policies for the Key Vault service separately, the module will mark it as a potential risk.

[0144] The access management audit submodule audits the contents of the target tenant's bucket and matches them with common token, key, and other formats. If a field with a relevant format appears, the module marks it as a potential risk.

[0145] The access management audit submodule audits the access conditions of common services within the target tenant, primarily including storage services, serverless computing services, database services, and virtual machine services. By analyzing the permission configurations of various storage types, the submodule ensures that resources within the tenant are accessible only to authorized users, avoiding the risk of data leakage from public access.

[0146] The Potential Backdoor Scanning module scans configuration items in Azure tenants to identify potential backdoor services.

[0147] Specifically, the potential backdoor scanning module is used to scan configuration items in Azure tenants to identify potential backdoor services. This module mainly examines the rule delegation settings of the email service, the outbound spam configuration, publicly accessible cloud files and buckets, the key certificates added by the service entity, and the configuration of the managed identity to identify configurations that may be maliciously exploited.

[0148] Specifically, the potential backdoor scanning module examines the email service in Azure. First, it checks the outbound spam policy within each tenant. If the outbound policy is enabled, it means emails within the tenant can be forwarded to third-party mailboxes. Second, it checks the rule configurations and forwarding settings in each mailbox. If any email forwarding rules or configurations are found, they are marked as potential backdoors. Next, the module checks the delegated permissions configuration within each tenant. If unreasonable configurations are found, such as high-privilege users delegating mailbox permissions to low-privilege users, this could lead to unauthorized email data flow, and the module will mark this as a potential backdoor.

[0149] The potential backdoor scanning module checks for public access to the OneDrive file storage service within a tenant's premises. The module reviews the validity period of public access permissions to ensure that public access is limited to a secure and controllable timeframe, preventing security risks from prolonged exposure. Simultaneously, the module checks for shared folders to prevent unauthorized access to the entire file structure and its contained sensitive data.

[0150] The potential backdoor scanning module examines the configurations of tenant services such as serverless computing and webhooks to detect potential backdoors. For serverless computing services, the module checks their access control configurations and the permissions held by the corresponding managed identifier. Serverless computing services that are publicly accessible and have high-level permissions held by the corresponding managed identifier are marked as potential backdoors, as such services could lead to unauthorized users performing high-privilege operations. For webhook services within a tenant, the module analyzes their associated runbook code, detecting whether there are backdoor-like operations such as reverse shells.

[0151] The module checks the service principal configuration within the tenant. It retrieves the credential configurations of all service principals and determines if the number of credentials they possess exceeds the normal limit. Simultaneously, the module prohibits the configuration of credentials for first-party service principals provided by Microsoft.

[0152] The audit report generation subsystem generates security audit reports for Azure tenants, showcasing the results of the data security audit subsystem's detection, identifying potential security risks to target tenants, and providing corresponding security recommendations. The report primarily includes: the overall data security level of the target tenant, recent abnormal behavior of the tenant, risks in identity management within the tenant, risks in access control configurations for critical services within the tenant, potential backdoors within the tenant, potential data leakage paths within the tenant, and security recommendations for addressing the existing security risks. The audit report is displayed to users as a web page for easy access. Users can use the audit results and security recommendations to eliminate potential security threats and optimize their security strategies.

[0153] The present invention also provides a data security auditing system for Azure cloud, which can be implemented by executing the process steps of the data security auditing method for Azure cloud. That is, those skilled in the art can understand the data security auditing method for Azure cloud as a preferred implementation of the data security auditing system for Azure cloud.

[0154] A data security auditing system for Azure cloud provided by the present invention includes:

[0155] Identity authentication subsystem: Requests a token based on the credentials provided by the user and obtains an access token and a refresh token;

[0156] Data security audit subsystem: Reads log information based on access tokens, processes it and matches it with predefined rules to detect potentially abnormal records. Then the system audits the identity management, access management and services that may contain backdoors in the tenant and obtains the audit results.

[0157] Audit report generation subsystem: Generates production safety audit reports based on audit results.

[0158] Those skilled in the art will understand that, besides implementing the system and its various devices, modules, and units provided by this invention in the form of purely computer-readable program code, the same functions can be achieved entirely through logical programming of the method steps, making the system and its various devices, modules, and units of this invention function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by this invention can be considered as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; alternatively, the devices, modules, and units for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0159] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A data security auditing method for Azure cloud, characterized in that, The method comprises the following steps: Step S1: Request a token according to the user-provided credentials to obtain an access token and a refresh token; Step S2: Read log information according to the access token, process and match with predefined rules, detect records that may exist abnormities, and then the system audits the identity management, access management and services that may exist backdoors in the tenant to obtain an audit result; Step S3: Produce a security audit report according to the audit result; In the step S1, the credentials include a password, a certificate and a secret value; In the step S1, read the token information, the token is stored in a specified path in JSON format; determine whether the target token is found in the local cache, the result is yes, then directly return the token in the cache; the result is no, then request an access token from Azure AD according to the user-specified credentials, and write the access token into the local cache to obtain the cached access token; After reading the access token by the identity authentication subsystem, parse the access token according to the JWT format to obtain the token expiration time; according to the token expiration time, determine whether the access token is expired, the result is yes, that is, the token has expired, then request a new access token using the refresh token and write it into the local cache; the result is no, that is, the token has not expired, then directly return the access token; In the step S2, the processing and the predefined rule matching detect records that exist abnormities, that is, determine whether there is abnormal activity by the log, the result is yes, then mark as potential risk; the result is no, then do not process; The abnormal activity includes frequent login failure, login time abnormity, unauthorized resource access and abnormal traffic fluctuation; The frequent login failure refers to providing error credentials for more than 20 times in 5 minutes, resulting in login failure; The login time abnormity refers to the login time being non-working time; the non-working time includes late night or weekend; The unauthorized resource access refers to that a user frequently accesses resources or data outside the scope of his / her authority; the frequent access refers to accessing more than a preset number of times within a preset time; The abnormal traffic fluctuation refers to that the traffic in a unit time exceeds a preset threshold; the preset threshold is set according to experience; the unit time is 5 minutes.

2. The method for data security auditing for Azure cloud according to claim 1, characterized in that, In the step S2, auditing the identity management, access management and services that may exist backdoors in the tenant includes: Check whether the identity management exists potential risk; The audit content of the identity management includes: Check the number of global administrators in the tenant, determine whether the number of global administrators in the tenant is more than 5, the result is yes, then mark as potential risk and prohibit adding new global administrators; the result is no, then do not process; Check whether the global administrator has enabled multi-factor authentication, the result is yes, then do not process; the result is no, then mark as potential risk; Check whether there is a consent user who has more than three administrator roles, the result is yes, then mark as potential risk; the result is no, then do not process; The administrator role includes: user administrator, Application Impersonation administrator and application administrator; Check the credential configuration of the service principal, determine whether the number of credentials exceeds 5, and the result is yes, mark as potential risk, and prohibit the configuration of credentials for Microsoft provided service principal; The result is no, then do not process; Check if there is a potential backdoor, the steps include: Step Q1: Check the mail service, that is, check the junk mail outbound policy in the tenant, determine whether the outbound policy is on, the result is yes, which means that the mail in the tenant can be forwarded to the third-party mailbox, and is marked as a potential backdoor; The result is no, then do not process; Step Q2: Check the rule configuration and forwarding setting of each mailbox, determine whether there is a rule or configuration of mail forwarding, the result is yes, mark as potential backdoor; The result is no, then do not process; Step Q3: Check the configuration of the delegated permissions in the tenant, determine whether there is a configuration of a high-privilege user delegating mailbox permissions to a low-privilege user, the result is yes, mark as potential backdoor; The result is no, then do not process; Step Q4: Check the OneDrive sharing situation in the tenant, determine whether there is a shared connection that can be accessed publicly and has no expiration time set, the result is yes, mark as potential backdoor; The result is no, then do not process; Step Q5: Check if there is a serverless computing service corresponding to the hosting identifier that can access other resources, the result is yes, mark as potential backdoor; The result is no, then do not process; Step Q6: Check if the Runbook code contains a reverse shell, the result is yes, mark as potential backdoor; The result is no, then do not process; Check if there is a risk in access control management, including: Step K1: Determine whether the target tenant separately configures the access control policy of the Key Vault service, the result is yes, then do not process; The result is no, then mark as potential risk; Step K2: Audit the target tenant storage bucket, determine whether there is data in the format of token or key, the result is yes, mark as potential risk, the result is no, then do not process; Step K3: Determine whether the access condition of the service is authorized user access only, the result is yes, then do not process, the result is no, then mark as potential risk; The service includes: storage service, serverless computing service, database service and virtual machine service.

3. The method for data security auditing for Azure cloud according to claim 1, characterized in that, In the step S3, the security audit report includes: "the overall data security level of the target tenant", "the abnormal behavior of the tenant in recent period", "the risk point of identity management in the tenant", "the risk point of access control configuration of key service in the tenant", "the potential backdoor in the tenant", "the potential data leakage path of the tenant" and "the security suggestion for the existing security risk".

4. A data security auditing system for Azure cloud characterized in that, Including: Identity authentication subsystem: request token according to user provided credentials, get access token and refresh token; Data security audit subsystem: read log information according to access token, process and match with predefined rules, detect records that may exist abnormity, then the system audits identity management, access management and services that may exist backdoor in the tenant, and obtains audit results; Audit report generation subsystem: generate security audit report according to audit results; In the identity authentication subsystem, the credentials include: password, certificate and secret value; In the identity authentication subsystem, read token information, the token is stored in JSON format in a specified path; judge whether the target token is found in the local cache, the result is yes, then directly return the token in the cache; the result is no, then request access token from Azure AD according to the user specified credentials, and write the access token into the local cache, and obtain the cached access token; After reading the access token through the identity authentication subsystem, parse the access token according to the format of JWT, obtain the token expiration time; according to the token expiration time, judge whether the access token is expired, the result is yes, that is, the token has expired, then use the refresh token to request a new access token, and write it into the local cache; the result is no, that is, the token has not expired, then directly return the access token; In the data security audit subsystem, the process and the predefined rule matching detect records that exist abnormity, that is, judge whether there is abnormal activity through the log, the result is yes, then mark as potential risk; the result is no, then do not process; The abnormal activity includes: frequent login failure, login time abnormity, unauthorized resource access and abnormal traffic fluctuation; The frequent login failure refers to providing error credentials for more than 20 times in 5 minutes, resulting in login failure; The login time abnormity refers to the login time is in non-working time; the non-working time includes late night or weekend; The unauthorized resource access refers to that the user frequently accesses resources or data outside the scope of his / her authority; the frequent access refers to access more than a preset number of times within a preset time; The abnormal traffic fluctuation refers to the traffic in a unit time changes more than a preset threshold; the preset threshold is set according to experience; the unit time is 5 minutes.

5. The data security auditing system for Azure cloud of claim 4, wherein, In the data security audit subsystem, auditing identity management, access management and services that may exist backdoor in the tenant includes: Check whether there is potential risk in identity management; the audit content of the identity management includes: Check the number of global administrators in the tenant, judge whether the number of global administrators in the tenant is more than 5, the result is yes, then mark as potential risk, and prohibit adding new global administrator; the result is no, then do not process; Check whether the global administrator has enabled multi-factor authentication, the result is yes, then do not process; the result is no, then mark as potential risk; Check whether there is a consent user who has more than three administrator roles, the result is yes, then mark as potential risk; the result is no, then do not process; The administrator role includes: user administrator, Application Impersonation administrator and application administrator; Check the credential configuration of the service principal, determine whether the number of credentials exceeds 5, and the result is yes, mark as potential risk, and prohibit the configuration of credentials for Microsoft provided service principal; The result is no, then do not process; Check whether there is a potential backdoor through the potential backdoor scanning module of the data security audit subsystem, including: Potential backdoor scanning unit one: check the mail service, that is, check the junk mail outbound policy in the tenant, determine whether the outbound policy is on, the result is yes, which means that the mail in the tenant can be forwarded to the third-party mailbox, and is marked as a potential backdoor; The result is no, then do not process; Potential backdoor scanning unit two: check the rule configuration and forwarding setting of each mailbox, determine whether there is a rule or configuration for mail forwarding, the result is yes, mark as potential backdoor; The result is no, then do not process; Potential backdoor scanning unit three: check the configuration of the delegated permissions in the tenant, determine whether there is a configuration of a high-privilege user delegating mailbox permissions to a low-privilege user, the result is yes, mark as potential backdoor; The result is no, then do not process; Potential backdoor scanning unit four: check the OneDrive sharing situation in the tenant, determine whether there is a shared connection that can be publicly accessed and has no expiration time set, the result is yes, mark as potential backdoor; The result is no, then do not process; Potential backdoor scanning unit five: check whether there is a serverless computing service corresponding to the hosting identifier that can access other resources, the result is yes, mark as potential backdoor; The result is no, then do not process; Potential backdoor scanning unit six: check whether the Runbook code contains a reverse shell, the result is yes, mark as potential backdoor; The result is no, then do not process; Check whether there is a risk in access control management through the access management audit submodule of the data security audit subsystem, including: Access management audit unit one: determine whether the target tenant separately configures the access control policy of the Key Vault service, the result is yes, then do not process; The result is no, then mark as potential risk; Access management audit unit two: audit the target tenant storage bucket, determine whether there is token or key format data, the result is yes, mark as potential risk, the result is no, then do not process; Access management audit unit three: determine whether the access condition of the service is only authorized user access, the result is yes, then do not process, the result is no, then mark as potential risk; The service includes: storage service, serverless computing service, database service and virtual machine service.

6. The data security auditing system for Azure cloud of claim 5, wherein, In the audit report generation subsystem, the security audit report includes: "the overall data security level of the target tenant", "the recent abnormal behavior of the tenant", "the risk points of identity management in the tenant", "the risk points of access control configuration of key services in the tenant", "the potential backdoor in the tenant", "the potential data leakage path of the tenant" and "the security suggestions for the existing security risks".

Images