Client access management method and device, electronic equipment and readable storage medium
By using preset authentication methods and threat detection to securely manage the client when the server is connected to the client, the problem of low security on the server is solved and effective protection of the server is achieved.
Patent Information
- Application Number
- CN202411827474.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-12
- Publication Date
- 2025-03-11
AI Technical Summary
When the server is connected to the client, how to improve the security of the server and prevent illegal users and malware from intrusion, data leakage, data tampering and server system attacks.
When the client access requests, the client is authenticated by using a preset authentication method, obtains the client's request data, and threat detection is performed on the client based on the request data. If a threat is detected on the client, the requested data is filtered to avoid potential threat data being transferred to the server.
Through authentication and threat detection, the trustworthiness of the client is initially determined and filtered when a threat is detected, effectively improving the security of the server and preventing potential threats from causing damage to the server.
Smart Images
Figure CN119603062A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data processing technology, and in particular to a client access management method, device, electronic device and readable storage medium. Background Art
[0002] In the related art, when the server is connected to the client, the server often faces various threats, such as intrusion by illegal users and malicious software, data leakage, data tampering, server system attacks, etc. Therefore, when the server is connected to the client, how to improve the security of the server has become a technical problem that needs to be solved urgently. Summary of the invention
[0003] The present application aims to at least solve the technical problem of how to improve the security of the server in the prior art.
[0004] To this end, the first aspect of the present application is to propose a client access management method.
[0005] A second aspect of the present application is to provide an access management device for a client.
[0006] A third aspect of the present application is to provide an electronic device.
[0007] A fourth aspect of the present application is to provide a readable storage medium.
[0008] In view of this, according to the first aspect of the present application, a client access management method is proposed, including: upon receiving an access request from the client, authenticating the client according to a preset authentication method; if the client authentication is passed, connecting the client to the server; obtaining request data sent by the client to the server; performing threat detection on the client based on the request data; and filtering the request data when a threat is detected in the client.
[0009] The client access management method provided in the present application firstly needs to authenticate the client according to a preset authentication method when an access request from the client is received, so as to preliminarily determine the degree of trustworthiness of the client.
[0010] Specifically, the preset authentication methods may include username and password authentication, digital certificate authentication, biometric (fingerprint or facial recognition) authentication, etc. Furthermore, for some scenarios with high security requirements, multi-factor authentication may be used to authenticate the client, that is, to combine multiple different authentication methods to achieve authentication, such as password plus SMS verification code, password plus biometrics, etc.
[0011] Further, if the client authentication is passed, the client can be connected to the server, at which time the request data sent by the client can be obtained. It is understandable that after the client accesses the server, the client usually obtains the service data of the server by sending request data, such as data query, business processing and other services.
[0012] After the user sends the request data, the request data is first obtained, and the client is tested for threats based on the request data. That is, after the client sends the request data, in order to avoid threats to the server, the client's request data is not sent directly to the server, but the client is tested for threats based on the client's request data, that is, whether the client is a potential threat to the server. For example, structured query language (SQL) injection, cross-site scripting attack, distributed denial of service attack (DDoS), etc. Only when it is determined that there is no threat to the client, the request data will be sent to the server to implement the service process required by the client, thereby ensuring the security of the server.
[0013] Specifically, threat detection can be achieved by deploying intrusion detection systems (IDS) and intrusion prevention systems (IPS).
[0014] When a threat is detected on the client, the client's request data must be filtered first, that is, threatening data in the request data, such as malicious scripts, special characters, SQL statements, etc. After filtering the threatening data, the user's request data is sent to the server. In this way, the user's service needs can be met as much as possible, and the security of the server can be guaranteed.
[0015] The client access management method provided by the present application authenticates the client through a preset authentication method upon receiving the client's access request, thereby preliminarily determining the degree of trustworthiness of the client. When the client authentication is passed, the client's request data is first obtained, and then threat detection is performed on the client based on the request data. When a threat is detected in the client, the request data sent by the client is filtered to prevent the transmission of threatening data to the server from damaging the security of the server, thereby improving the security of the server during operation.
[0016] In addition, the client access management method in the above technical solution provided by the present invention may also have the following additional technical features: In some technical solutions, optionally, threat detection is performed on the client based on the request data, including: obtaining target data in the request data; and determining that a threat is detected on the client when the target data is obtained.
[0017] In some technical solutions, optionally, threat detection is performed on the client based on the request data, including: inputting the request data into a pre-trained network model to determine the behavior pattern of the client; and performing threat detection on the client based on the behavior pattern.
[0018] In some technical solutions, optionally, there are multiple servers, and the access management method further includes: determining multiple servers corresponding to the request data based on the request data; and distributing the request data to the multiple servers.
[0019] In some technical solutions, optionally, before obtaining the request data sent by the client to the server, the access management method also includes: establishing a key management system between the client and the server; wherein the key management system is used to encrypt the request data according to the encryption key.
[0020] In some technical solutions, optionally, the access management method further includes: updating the encryption key according to a preset time interval.
[0021] In some technical solutions, optionally, the access management method further includes: generating an interaction log according to the interaction data between the client and the server.
[0022] In some technical solutions, optionally, upon receiving an access request from a client, before authenticating the client according to a preset authentication method, the access management method also includes: obtaining the type of the client's operating system; developing an application corresponding to the client according to the type of the operating system; wherein the application is used to implement a connection between the client and the server.
[0023] According to the second aspect of the present application, a client access management device is proposed, including: an authentication unit, which is used to authenticate the client according to a preset authentication method when an access request from the client is received; an access unit, which is used to connect the client to the server when the client authentication is successful; an acquisition unit, which is used to acquire request data sent by the client to the server; a detection unit, which is used to perform threat detection on the client based on the request data; and a filtering unit, which is used to filter the request data when a threat is detected in the client.
[0024] The client access management device provided by the present application authenticates the client through a preset authentication method when receiving an access request from the client, thereby preliminarily determining the trustworthiness of the client. When the client authentication is passed, the client's request data is first obtained, and then threat detection is performed on the client based on the request data. When a threat is detected in the client, the request data sent by the client is filtered to prevent the transmission of threatening data to the server and damage the security of the server, thereby improving the security of the server during operation.
[0025] In some technical solutions, optionally, the detection unit is specifically used to: obtain target data in the request data; and when the target data is obtained, determine that a threat to the client is detected.
[0026] In some technical solutions, optionally, the detection unit is specifically used to: input the request data into a pre-trained network model to determine the behavior pattern of the client; and perform threat detection on the client based on the behavior pattern.
[0027] In some technical solutions, optionally, the access management device of the client further includes an allocation unit, which is used to determine multiple server ends corresponding to the request data according to the request data; and allocate the request data to the multiple server ends.
[0028] In some technical solutions, optionally, the access management device of the client also includes an establishment unit for establishing a key management system between the client and the server; wherein the key management system is used to encrypt the request data according to the encryption key.
[0029] In some technical solutions, optionally, the establishing unit is also used to update the encryption key according to a preset time interval.
[0030] In some technical solutions, optionally, the access management device of the client further includes a generating unit, which is used to generate an interaction log according to the interaction data between the client and the server.
[0031] In some technical solutions, optionally, the access management device of the client also includes a development unit for obtaining the type of the client's operating system; developing an application corresponding to the client according to the type of the operating system; wherein the application is used to realize the connection between the client and the server.
[0032] According to the third aspect of the present application, an electronic device is proposed, comprising: a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the client access management method in any of the above technical solutions are implemented. Therefore, the electronic device has all the beneficial effects of the client access management method in any of the above technical solutions, which will not be repeated here.
[0033] According to the fourth aspect of the present application, a readable storage medium is provided, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the client access management method in any of the above technical solutions is implemented. Therefore, the readable storage medium has all the beneficial effects of the client access management method in any of the above technical solutions, which will not be repeated here.
[0034] Additional aspects and advantages of the present application will become apparent in the following description or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which: Figure 1 A schematic diagram showing a flow chart of a method for managing access to a client according to an embodiment of the present application; Figure 2 A topology diagram showing the access management method of a client in an embodiment of the present application is shown; Figure 3 A structural block diagram of an access management device for a client in an embodiment of the present application is shown; Figure 4 A structural block diagram of an electronic device according to an embodiment of the present application is shown.
[0036] Reference numerals: 300 client access management device, 302 authentication unit, 304 access unit, 306 acquisition unit, 308 detection unit, 310 filtering unit, 400 electronic device, 402 processor, 404 memory. DETAILED DESCRIPTION
[0037] In order to more clearly understand the above-mentioned purposes, features and advantages of the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.
[0038] In the following description, many specific details are set forth to facilitate a full understanding of the present application. However, the present application may also be implemented in other ways different from those described herein. Therefore, the scope of protection of the present application is not limited to the specific embodiments disclosed below.
[0039] Combine the following Figures 1 to 4 , the client access management method, device, electronic device and readable storage medium provided in the embodiments of the present application are described in detail through specific embodiments and their application scenarios.
[0040] like Figure 1 As shown, an embodiment of the present application provides a method for managing access to a client, wherein the inverter includes a plurality of switch tubes, and the method for managing access to the client includes: Step 102, upon receiving an access request from a client, authenticating the client according to a preset authentication method; Step 104, when the client authentication is passed, the client is connected to the server; Step 106, obtaining the request data sent by the client to the server; Step 108, performing threat detection on the client according to the request data; Step 110: When a threat is detected on the client, the request data is filtered.
[0041] The client access management method provided in the present application firstly needs to authenticate the client according to a preset authentication method when an access request from the client is received, so as to preliminarily determine the degree of trustworthiness of the client.
[0042] Specifically, the preset authentication methods may include username and password authentication, digital certificate authentication, biometric (fingerprint or facial recognition) authentication, etc. Furthermore, for some scenarios with high security requirements, multi-factor authentication may be used to authenticate the client, that is, to combine multiple different authentication methods to achieve authentication, such as password plus SMS verification code, password plus biometrics, etc.
[0043] Further, if the client authentication is passed, the client can be connected to the server, at which time the request data sent by the client can be obtained. It is understandable that after the client accesses the server, the client usually obtains the service data of the server by sending request data, such as data query, business processing and other services.
[0044] After the user sends the request data, the request data is first obtained, and the client is tested for threats based on the request data. That is, after the client sends the request data, in order to avoid threats to the server, the client's request data is not sent directly to the server, but the client is tested for threats based on the client's request data, that is, whether the client is a potential threat to the server. For example, structured query language (SQL) injection, cross-site scripting attack, distributed denial of service attack (DDoS), etc. Only when it is determined that there is no threat to the client, the request data will be sent to the server to implement the service process required by the client, thereby ensuring the security of the server.
[0045] Specifically, threat detection can be achieved by deploying intrusion detection systems (IDS) and intrusion prevention systems (IPS).
[0046] When a threat is detected on the client, the client's request data must be filtered first, that is, threatening data in the request data, such as malicious scripts, special characters, SQL statements, etc. After filtering the threatening data, the user's request data is sent to the server. In this way, the user's service needs can be met as much as possible, and the security of the server can be guaranteed.
[0047] In addition, clients can be managed by establishing a whitelist and blacklist mechanism. Specifically, known safe clients can be put on the whitelist and given fast access; suspicious or malicious clients can be put on the blacklist and intercepted.
[0048] The client access management method provided by the present application authenticates the client through a preset authentication method upon receiving the client's access request, thereby preliminarily determining the degree of trustworthiness of the client. When the client authentication is passed, the client's request data is first obtained, and then threat detection is performed on the client based on the request data. When a threat is detected in the client, the request data sent by the client is filtered to prevent the transmission of threatening data to the server from damaging the security of the server, thereby improving the security of the server during operation.
[0049] In some embodiments, optionally, threat detection is performed on the client based on the request data, including: obtaining target data in the request data; and determining that a threat is detected on the client when the target data is obtained.
[0050] In this embodiment, threat detection for the client can be determined by analyzing the target data in the request data sent by the client. Specifically, the request data sent by the client can be analyzed to obtain all the data contained in the request data, and then the target data can be obtained from all the data. The target data is the data that poses a threat to the client. When these target data are obtained in the request data of the client, it can be determined that the client is under threat.
[0051] The target data may be malicious scripts, special characters, SQL statements, etc., that is, when malicious scripts, special characters, SQL statements, etc. are obtained in the request data sent by the client, it can be determined that the client is a threat. Furthermore, when the client's request data is sent to the server, these threatening data can be filtered out, thereby preventing the server from being attacked.
[0052] In some embodiments, optionally, threat detection is performed on the client based on the request data, including: inputting the request data into a pre-trained network model to determine a behavior pattern of the client; and performing threat detection on the client based on the behavior pattern.
[0053] In this embodiment, a pre-trained network model can also be used to detect whether there is a threat to the client. Specifically, the request data sent by the client can be input into the pre-trained network model, so that the behavior pattern of the client can be determined by using the network model, and then, based on the behavior pattern of the client, it can be realized to detect whether there is a threat to the client. That is, when it is identified that the client has abnormal behavior, it can be determined that the client may pose a threat to the server.
[0054] By using pre-trained network models to perform threat detection on the client, the efficiency of client threat detection can be effectively improved, thereby improving the efficiency of client access management and ensuring the security of the server.
[0055] In some embodiments, optionally, there are multiple servers, and the access management method further includes: determining multiple servers corresponding to the request data according to the request data; and distributing the request data to the multiple servers.
[0056] In this embodiment, when there are multiple servers, the multiple servers corresponding to the request data can also be determined based on the request data, so that the request data can be sent to the multiple servers respectively according to the multiple servers corresponding to the request data, thereby achieving load balancing of the server, and further determining the stability of the server system operation.
[0057] Specifically, a load balancer can be deployed in the server system to evenly distribute client requests to multiple server nodes. The load balancer can dynamically adjust the request distribution strategy according to the server load to ensure stable operation of the system.
[0058] In some embodiments, optionally, before obtaining the request data sent by the client to the server, the access management method further includes: establishing a key management system between the client and the server; wherein the key management system is used to encrypt the request data according to the encryption key.
[0059] In this embodiment, before obtaining the request data sent by the client, a key management system can also be established between the client and the server. Through the key management system, the data transmitted between the client and the server can be encrypted, thereby ensuring the security of data transmission between the client and the server.
[0060] Specifically, the key management system can be used to generate, store, distribute and update encryption keys, thereby realizing encryption of data transmission between the client and the server. The key management system can use encryption protocols, such as secure socket layer (SSL), transport layer security (TLS) and other encryption protocols to realize encrypted data transmission between the client and the server.
[0061] Furthermore, the access management method also includes: updating the encryption key according to a preset time interval.
[0062] Specifically, the key management system can also regularly replace the encryption key between the client and the server, thereby reducing the risk of the key being cracked, so as to further improve the security of data transmission between the client and the server.
[0063] In some embodiments, optionally, the access management method further includes: generating an interaction log according to the interaction data between the client and the server.
[0064] In this embodiment, the interactive data between the client and the server can also be recorded and audited during the data interaction between the client and the server. Specifically, during the data interaction between the client and the server, an interactive log is generated based on the interactive data between the client and the server, thereby recording the client's access request, the server's processing process, and security events.
[0065] Furthermore, the interaction logs can be audited regularly to analyze the security status of the system. When potential security issues and vulnerabilities are discovered, measures such as intercepting the data interaction between the client and the server can be taken in a timely manner to ensure the security of the server.
[0066] In addition, a real-time monitoring system can be established to detect client access conditions, server performance indicators, and security events. When an abnormal situation is found, an alert can be issued in time and appropriate measures can be taken to deal with the abnormal situation to ensure the security of the server.
[0067] In some embodiments, optionally, upon receiving an access request from a client, before authenticating the client according to a preset authentication method, the access management method further includes: obtaining the type of operating system of the client; developing an application corresponding to the client according to the type of operating system; wherein the application is used to implement a connection between the client and the server.
[0068] In this embodiment, before authenticating the client, it is first necessary to obtain the type of the client's operating system and develop an application corresponding to the client based on the type of the client's operating system, thereby ensuring that the client can access the server through the corresponding application.
[0069] The client operating systems may include Windows, Mac, Linux, Android, iOS, etc. For the above client operating systems, corresponding applications are developed to ensure that they can meet the access needs of various clients.
[0070] In addition, for web clients, a responsive design can be used to enable the web clients to achieve good display and operation on monitors of different sizes.
[0071] In a specific embodiment, Figure 2As shown, the client access management system may include a client, an access layer, an application layer (client) and a storage layer, wherein the client may include a mobile phone, a computer and other terminals. The client may initiate an access request and may use different authentication methods for authentication, and may establish an encrypted transmission channel with the server to achieve data encryption transmission. The access layer is used to implement pre-interception processing, which may specifically include: judging whether to allow the client's request to enter according to preset rules, such as IP address, user role, device type, business signature, timestamp, etc.; performing threat detection on the client; filtering the request data sent by the client; and communicating securely with the client to ensure the security of data during transmission. The application layer (server) may receive the request data from the user to provide corresponding services to the user, such as data storage, business logic processing, result feedback, etc. The application layer (server) relies on the security provided by the access layer and focuses on the realization of business functions. The storage layer may store the interaction data between the client and the server, and store the interaction data in the database for subsequent calls.
[0072] In some embodiments, optionally, Figure 3 As shown, a client access management device 300 is provided, including: an authentication unit 302, which is used to authenticate the client according to a preset authentication method when an access request from the client is received; an access unit 304, which is used to connect the client to the server when the client authentication is passed; an acquisition unit 306, which is used to acquire request data sent by the client to the server; a detection unit 308, which is used to perform threat detection on the client according to the request data; and a filtering unit 310, which is used to filter the request data when a threat is detected in the client.
[0073] The client access management device 300 provided in the present application, upon receiving the access request from the client, authenticates the client through a preset authentication method, thereby preliminarily determining the degree of trustworthiness of the client. When the client authentication is passed, the client's request data is first obtained, and then threat detection is performed on the client according to the request data. When a threat is detected in the client, the request data sent by the client is filtered to prevent the transmission of threatening data to the server and damage the security of the server, thereby improving the security of the server during operation.
[0074] Furthermore, the detection unit 308 is specifically configured to: obtain target data from the request data; and when the target data is obtained, determine that a threat to the client is detected.
[0075] Furthermore, the detection unit 308 is specifically used to: input the request data into a pre-trained network model to determine the behavior pattern of the client; and perform threat detection on the client according to the behavior pattern.
[0076] Furthermore, the access management device 300 of the client also includes an allocating unit, which is used to determine multiple service ends corresponding to the request data according to the request data; and allocate the request data to the multiple service ends.
[0077] Furthermore, the access management device 300 of the client also includes an establishing unit, which is used to establish a key management system between the client and the server; wherein the key management system is used to encrypt the request data according to the encryption key.
[0078] Furthermore, the establishing unit is also used to update the encryption key according to a preset time interval.
[0079] Furthermore, the access management device 300 of the client also includes a generating unit, which is used to generate an interaction log according to the interaction data between the client and the server.
[0080] Furthermore, the access management device 300 of the client also includes a development unit, which is used to obtain the type of the operating system of the client; and develop an application corresponding to the client according to the type of the operating system; wherein the application is used to realize the connection between the client and the server.
[0081] In some embodiments, optionally, Figure 4 As shown, an electronic device 400 is proposed, including: a processor 402 and a memory 404, the memory 404 stores a program or instruction that can be run on the processor 402, and the program or instruction is executed by the processor 402 to implement the steps of the client access management method in any of the above technical solutions. Therefore, the electronic device 400 has all the beneficial effects of the client access management method in any of the above technical solutions, which will not be repeated here.
[0082] In some embodiments, optionally, a readable storage medium is provided on which a program is stored. When the program is executed by a processor, the client access management method in any of the above embodiments is implemented, thereby having all the beneficial technical effects of the client access management method in any of the above embodiments.
[0083] The readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.
[0084] It should be clarified that in the claims, specification and drawings of the present application, the term "multiple" refers to two or more than two. Unless otherwise clearly defined, the orientation or position relationship indicated by the terms "upper" and "lower" is based on the orientation or position relationship shown in the drawings, which is only for the purpose of more conveniently describing the present application and making the description process easier, rather than indicating or implying that the device or element referred to must have the specific orientation described, be constructed and operated in a specific orientation, so these descriptions cannot be understood as limitations on the present application; the terms "connect", "install", "fix" and the like should be understood in a broad sense. For example, "connection" can be a fixed connection between multiple objects, or a detachable connection between multiple objects, or an integral connection; it can be a direct connection between multiple objects, or an indirect connection between multiple objects through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood based on the specific circumstances of the above data.
[0085] In the claims, specification and drawings of the present application, the description of the terms "one embodiment", "some embodiments", "specific embodiments" and the like means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In the claims, specification and drawings of the present application, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.
[0086] The above are only preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims
1. A method for managing access to a client, characterized in that: include: Upon receiving an access request from the client, authenticating the client according to a preset authentication method; If the client is authenticated successfully, connecting the client to the server; Obtaining request data sent by the client to the server; Performing threat detection on the client according to the request data; When a threat is detected on the client, the request data is filtered.
2. The access management method according to claim 1, characterized in that: The performing threat detection on the client according to the request data includes: Acquire target data from the request data; When the target data is acquired, it is determined that a threat to the client is detected.
3. The access management method according to claim 1, characterized in that: The performing threat detection on the client according to the request data includes: Inputting the request data into a pre-trained network model to determine the behavior pattern of the client; Perform threat detection on the client according to the behavior pattern.
4. The access management method according to claim 1, characterized in that: The number of the server is multiple, and the access management method further includes: According to the request data, determining a plurality of the server ends corresponding to the request data; The request data is distributed to the plurality of service ends.
5. The access management method according to claim 1, characterized in that: Before obtaining the request data sent by the client to the server, the access management method further includes: Establishing a key management system between the client and the server; The key management system is used to encrypt the request data according to the encryption key.
6. The access management method according to claim 5, characterized in that: The access management method further includes: The encryption key is updated according to a preset time interval.
7. The access management method according to claim 1, characterized in that: The access management method further includes: Generate an interaction log based on the interaction data between the client and the server.
8. The access management method according to claim 1, characterized in that: In the case of receiving the access request of the client, before authenticating the client according to the preset authentication method, the access management method further includes: Obtaining the type of the operating system of the client; Developing an application corresponding to the client according to the type of the operating system; The application is used to realize the connection between the client and the server.
9. A client access management device, characterized in that: include: an authentication unit, configured to authenticate the client according to a preset authentication method when receiving an access request from the client; An access unit, used to connect the client to the server if the client is authenticated; An acquisition unit, used to acquire request data sent by the client to the server; A detection unit, configured to perform threat detection on the client according to the request data; The filtering unit is used to filter the request data when a threat is detected on the client.
10. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the method according to any one of claims 1 to 8 are implemented.
11. A readable storage medium, characterized in that: The readable storage medium stores a program or an instruction, and when the program or the instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.