Intra-domain security detection method, device, equipment, medium and program product

Abstract

The invention provides an intra-domain security detection method which can be applied to the technical field of network security. The intra-domain security detection method comprises the following steps: collecting all data related to an access control strategy in a domain; all the data are classified according to subjects to which the data belong, a classification result is obtained, and the subjects comprise users, computers and groups; and determining whether security risks exist in the domain or not according to classification results of the users, the computers and the groups. The invention further provides an intra-domain security detection device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of network security, and in particular to a method, device, equipment, medium and program product for intra-domain security detection. Background Art

[0002] With the development of the information age, the workgroup model that manages each host independently is gradually unable to meet business needs. More and more companies and institutions use Windows domains to build office networks. While providing convenience, it also brings huge security risks.

[0003] In a Windows domain, all hosts in the domain have the permission to interact with the domain controller. Each domain account usually has the management permission for multiple domain hosts. If the domain is improperly configured and attackers can easily obtain high-privilege accounts in the domain, attackers will be able to completely penetrate the entire domain. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a method, apparatus, device, medium and program product for intra-domain security detection.

[0005] According to the first aspect of the present disclosure, a method for security detection within a domain is provided, comprising: collecting all data related to access control policies within the domain; classifying all the data according to their subjects to obtain classification results, wherein the subjects include users, computers, and groups; and determining whether there is a security risk within the domain according to the classification results, respectively, according to the classification of the users, computers, and groups.

[0006] According to an embodiment of the present disclosure, the collection of all data related to access control policies within the domain includes: acquiring lightweight directory access protocol data and registry data of the domain controller; enumerating machine sessions within the domain, local security policies within the domain, trust relationships between multiple domains, and a distributed component object model.

[0007] According to an embodiment of the present disclosure, the classification result includes attribute information of the user, attribute information of the computer, and attribute information of the group; the attribute information of the user includes node information, group member identity information, local administrator authority information, and object control information; the attribute information of the computer includes node information, local administrator information, group member identity information, local administrator authority information, and object control information; the attribute information of the group includes node information, group member information, group member identity information, local administrator authority information, and object control information.

[0008] According to an embodiment of the present disclosure, the method includes: determining the user's node information, the user's group membership information, the user's local administrator authority information, the computer's node information, the computer's group membership information, the group's node information, and the group member information of the group based on the registry data of the domain controller; determining the user's object control information and the computer's local administrator authority information based on the lightweight directory access protocol data; determining the computer's local administrator information based on the intra-domain machine session and the lightweight directory access protocol data; determining the computer's object control information based on the local security policy and the lightweight directory access protocol data; determining the group's object control information based on the trust relationship between the multiple domains, the distributed component object model, and the lightweight directory access protocol data.

[0009] According to an embodiment of the present disclosure, the classification of the users and determining whether there is a security risk in the domain according to the classification result include: obtaining high-privileged users in the domain, wherein the operation authority of the high-privileged users is higher than that of the low-privileged users; judging whether there is a low-privileged user in the group of users to which the high-privileged user belongs according to the classification result; in a case where there is no low-privileged user in the group of users to which the high-privileged user belongs, judging whether a device logged in by a high-privileged user account allows login by a low-privileged account according to the classification result; in a case where the device logged in by a high-privileged user account does not allow login by a low-privileged account, judging whether an object to which the high-privileged user account belongs can be called by a low-privileged account according to the classification result; and in a case where the object to which the high-privileged user account belongs cannot be called by a low-privileged account, determining that there is no security risk to the high-privileged account.

[0010] According to an embodiment of the present disclosure, the classification of the groups and determining whether there is a security risk in the domain according to the classification result include: obtaining a high-authority group in the domain, the operation authority of the high-authority group being higher than that of the low-authority group; judging whether there are low-authority users among the group members to which the high-authority group belongs according to the classification result; in the case that there are no low-authority users among the group members to which the high-authority group belongs, judging whether an administrator device to which the high-authority group belongs allows a low-authority account to log in according to the classification result; in the case that the administrator device to which the high-authority group belongs does not allow a low-authority account to log in, judging whether an object to which the high-authority group belongs can be called by a low-authority account according to the classification result; in the case that the object to which the high-authority group belongs cannot be called by a low-authority user, determining that there is no security risk to the high-authority group.

[0011] According to an embodiment of the present disclosure, the classification of the computers and determining whether there is a security risk in the domain according to the classification results include: obtaining a high-authority computer in the domain, the access control authority of the high-authority computer being higher than the access control authority of the low-authority computer; judging whether there are low-authority users among the users and administrators who can log in on the high-authority computer according to the classification results; in the case where there are no low-authority users among the users and administrators who can log in on the high-authority computer, judging whether the local access control list of the high-authority computer is correctly configured according to the classification results; in the case where the local access control list of the high-authority computer is correctly configured, judging whether the high-authority computer certificate is correctly trusted according to the classification results; in the case where the high-authority computer certificate is correctly trusted, determining that there is no security risk to the high-authority group.

[0012] The second aspect of the present disclosure provides a domain security detection device, including: a collection module, used to collect all data related to access control policies in the domain; a classification module, used to classify all the data according to the subjects to which they belong, and obtain classification results, wherein the subjects include users, computers and groups; a determination module, used to determine whether there is a security risk in the domain according to the classification results according to the classification of the users, computers and groups respectively.

[0013] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0015] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0017] Figure 1 The application scenario diagram of the intra-domain security detection method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0018] Figure 2 The flowchart of the intra-domain security detection method according to an embodiment of the present disclosure is schematically shown.

[0019] Figure 3 The flowchart of the security detection method based on user classification within a domain according to an embodiment of the present disclosure is schematically shown.

[0020] Figure 4 The flowchart of the security detection method based on group classification within a domain according to an embodiment of the present disclosure is schematically shown.

[0021] Figure 5 The flowchart of the computer classification-based security detection method within a domain according to an embodiment of the present disclosure is schematically shown.

[0022] Figure 6 The structural block diagram of the intra-domain security detection device according to an embodiment of the present disclosure is schematically shown.

[0023] Figure 7 A block diagram of an electronic device suitable for implementing intra-domain security detection according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0025] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0026] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0027] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0028] It should be noted that the intra-domain security detection methods, devices, equipment, media and program products provided by the present disclosure can be used in the field of network security technology in the field of financial technology, and can also be used in any field outside the field of financial technology. The present disclosure does not limit the application field of the provided intra-domain security detection methods, devices, equipment, media and program products.

[0029] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0030] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0031] The embodiment of the present disclosure provides a method for detecting security in a domain, which includes: collecting all data related to access control policies in the domain, classifying all data according to the subjects to which they belong, and obtaining classification results, wherein the subjects include users, computers, and groups, and determining whether there is a security risk in the domain according to the classification results according to the classification of users, computers, and groups. The security risks in the Windows domain can be detected to protect the security of the intranet.

[0032] Figure 1 The application scenario diagram of the intra-domain security detection method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0033] like Figure 1As shown, the application scenario according to this embodiment may include a Windows domain 100, and the domain 100 includes a first terminal device 101, a second terminal device 102, a third terminal device 103, a fourth terminal device 104, and a fifth terminal device 105. The network 106 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, the fourth terminal device 104, and the fifth terminal device 105. The network 106 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0034] Windows domain 100 is an independently operated unit in Windows network. A trust relationship needs to be established for mutual access between domains. In Windows network operating system, domain is a security boundary used for a group of computers to share a common security database.

[0035] The first terminal device 101, the second terminal device 102, the third terminal device 103, the fourth terminal device 104, and the fifth terminal device 105 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, etc.

[0036] It should be noted that the intra-domain security detection method provided by the embodiment of the present disclosure can generally be executed by a server. Accordingly, the intra-domain security detection device provided by the embodiment of the present disclosure can generally be set in a server. The intra-domain security detection method provided by the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103, the fourth terminal device 104, the fifth terminal device 105 and / or the server. Correspondingly, the intra-domain security detection device provided by the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103, the fourth terminal device 104, the fifth terminal device 105 and / or the server.

[0037] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices and networks may be provided according to implementation requirements.

[0038] The following will be based on Figure 1 The scene described by Figure 2~Figure 4 The intra-domain security detection method of the disclosed embodiment is described in detail.

[0039] Figure 2 The flowchart of the intra-domain security detection method according to an embodiment of the present disclosure is schematically shown.

[0040] like Figure 2 As shown, the intra-domain security detection method of this embodiment includes operations S210 to S230, and the intra-domain security detection method can be executed by the server.

[0041] In operation S210, all data related to the access control policy in the domain is collected.

[0042] In operation S220, all data are classified according to the subjects to which they belong, and classification results are obtained. The subjects include users, computers, and groups.

[0043] In operation S230, it is determined whether there is a security risk in the domain according to the classification results based on the classification of users, computers and groups.

[0044] In the disclosed embodiments, a Windows domain is an independently operated unit in a Windows network. Subjects within a Windows domain may include user accounts, computers, printers, and other security subjects. All user accounts, computers, printers, and other security subjects are registered in a central database located on one or more central computer clusters called domain controllers (DCs). Authentication is performed on the DC, and each user receives a unique user account, which can then be assigned access rights to resources within the domain. In the disclosed embodiments, a Windows domain is referred to as a domain for illustration.

[0045] In some embodiments of the present disclosure, all data are classified by user, computer, and group, and the classification results obtained include attribute information of the user, attribute information of the computer, and attribute information of the group.

[0046] User attribute information includes node information, group membership information, local administrator authority information, and object control information.

[0047] Node information: the user's unique identification or location information in the system.

[0048] Group membership information: One or more organizations or permission groups to which the user belongs.

[0049] Local administrator privilege information: whether the user has administrator privileges on a system node or resource.

[0050] Object control information: user access control rights to objects or data within the system.

[0051] The computer's attribute information includes node information, local administrator information, group membership information, local administrator permission information, and object control information.

[0052] Node information: identification information of a computer in a network or system.

[0053] Local administrator information: Users and groups with administrator privileges on the computer.

[0054] Group membership information: The security groups or policy groups to which the computer belongs.

[0055] Local administrator permission information: Administrator-level permissions granted on the computer.

[0056] Object control information: The computer's access control rights to certain resources or objects.

[0057] The attribute information of a group includes node information, group member information, group member identity information, local administrator authority information, and object control information.

[0058] Node Information: The unique identifier or name of the group in the system.

[0059] Group member information: The user or computer members included in the group.

[0060] Group membership information: The relationships between a group and other groups or the membership hierarchy.

[0061] Local administrator privilege information: Administrator privileges granted by group members.

[0062] Object control information: The group's management and access control rights to objects or data within the system.

[0063] In some embodiments of the present disclosure, all data related to access control policies within a domain include: Lightweight Directory Access Protocol (LDAP) data and DC registry data, machine sessions within the domain, local security policies within the domain, trust relationships between multiple domains, and a distributed component object model.

[0064] LDAP data provides key functions such as authentication, authorization, centralized management, and directory services, allowing administrators to efficiently manage user and computer accounts in the domain and ensure that users can securely access required resources. In some embodiments of the present disclosure, user object control information and computer local administrator authority information can be determined based on LDAP data.

[0065] In a domain, DC plays a vital role. It manages user and computer accounts in the domain and is responsible for tasks such as identity authentication, authorization, and policy distribution. The registry is an important database used to store system and application configuration information in the Windows operating system. In the DC registry, configuration information related to domain services, DNS services, certificate services, etc. can be found. In some embodiments of the present disclosure, the user's node information, the user's group membership information, the user's local administrator authority information, the computer's node information, the computer's group membership information, the group's node information, and the group member information of the group can be determined based on the DC registry data.

[0066] Among them, obtaining the DC registry Kdc\StrongCertificateBindingEnforcement and Schannel\CertificateMappingMethods values ​​can determine the certificate mapping methods allowed in the domain for certificate service authentication.

[0067] In some embodiments of the present disclosure, local administrator information of a computer can be determined based on machine sessions and LDAP data within a domain. Object control information of a computer can be determined based on local security policies and lightweight directory access protocol data. Object control information of a group can be determined based on trust relationships between multiple domains, a distributed component object model, and lightweight directory access protocol data.

[0068] Figure 3 The flowchart of the security detection method based on user classification within a domain according to an embodiment of the present disclosure is schematically shown.

[0069] like Figure 3 As shown, the intra-domain user classification-based security detection method of this embodiment includes operations S310 to S350.

[0070] In operation S310, high-authority users in the domain are acquired.

[0071] The operation authority of a high-authority user is higher than the operation authority of a low-authority user. The operation authority may include at least one of access authority, execution authority, etc.

[0072] Regarding access rights. High-privilege users usually have extensive access rights to system resources, including but not limited to files, folders, printers, network devices, etc. They can access and modify system-level settings such as the registry and group policies. In some cases, high-privilege users can even manage and control the entire domain. Low-privilege users have relatively limited access rights and can usually only access and operate explicitly authorized resources. They cannot access or modify system-level settings such as the registry, etc. Administrator approval or entering an administrator password may be required when performing certain operations.

[0073] Regarding execution permissions. High-privilege users can install and uninstall software, drivers, etc., can back up and restore the system, can create, delete and manage user accounts and groups, and can perform advanced functions such as remote desktop connection and remote assistance. Low-privilege users can usually only run verified applications, cannot install or uninstall software, and cannot back up and restore the system. They cannot create, delete and manage user accounts and groups, and may be restricted when performing functions such as remote desktop connection and remote assistance.

[0074] For user management permissions. High-privilege users typically have the ability to manage user accounts, including creating, modifying, and deleting user accounts, and assigning or changing user permissions. Low-privilege users typically cannot manage other user accounts. They can only view their own account information and may not be able to change their own permission levels.

[0075] In operation S320, based on the classification result, it is determined whether there is a low-authority user in the group to which the high-authority user belongs.

[0076] In some implementations, it may be determined whether there is a low-authority user in the group to which the high-authority user belongs based on the attribute information of the high-authority user and the attribute information of the group.

[0077] In operation S330 , if there is no low-authority user in the group of users to which the high-authority user belongs, it is determined according to the classification result whether the device logged in by the high-authority user account allows low-authority accounts to log in.

[0078] In some implementations, it may be determined whether the device logged in by the high-privilege user account allows login by a low-privilege account based on attribute information of the device logged in by the high-privilege user account and attribute information of a low-privilege account.

[0079] In operation S340, when the device logged in by the high-authority user account does not allow low-authority accounts to log in, it is determined according to the classification result whether the object belonging to the high-authority user account can be called by the low-authority account.

[0080] In some implementations, it may be determined whether an object to which a high-authority user account belongs can be called by a low-authority account based on the attribute information of the high-authority user and the attribute information of the group.

[0081] In operation S350 , when the object to which the high-authority user account belongs cannot be called by the low-authority account, it is determined that there is no security risk for the high-authority account.

[0082] In some implementations, if there are low-authorized users in the group of users to which the high-authorized user belongs, operation S360 is performed to give a security warning. If the device to which the high-authorized user account is logged in allows low-authorized accounts to log in, operation S360 is performed to give a security warning. If the object to which the high-authorized user account belongs can be called by a low-authorized account, operation S360 is performed to give a security warning.

[0083] In some embodiments of the present disclosure, after receiving a security warning, configuration modifications can be made based on the judgment result. For example, if there are low-privileged users in the group of users to which the high-privileged user belongs, the group policy can be enhanced. For another example, if the object to which the high-privileged user account belongs can be called by a low-privileged account, the permissions of the low-privileged user can be changed.

[0084] Figure 4 The flowchart of the security detection method based on group classification within a domain according to an embodiment of the present disclosure is schematically shown.

[0085] like Figure 4 As shown, the intra-domain group classification-based security detection method of this embodiment includes operations S410 to S450.

[0086] In operation S410, a high-authority group in a domain is acquired.

[0087] The operation authority of the high-authority group is higher than the operation authority of the low-authority group. The operation authority may include at least one of access authority, execution authority, etc.

[0088] In operation S420, based on the classification result, it is determined whether there is a low-authority user among the group members of the high-authority group.

[0089] In some implementations, it may be determined whether there are any low-authority users among the group members of the high-authority group based on the user's attribute information and the group's attribute information.

[0090] In operation S430, if there is no low-authority user among the group members of the high-authority group, it is determined according to the classification result whether the administrator device of the high-authority group allows login by a low-authority account.

[0091] In some implementations, it may be determined whether the administrator device to which the high-authority group belongs allows low-authority accounts to log in based on the user's attribute information, the computer's attribute information, and the group's attribute information.

[0092] In operation S440, when the administrator device to which the high-authority group belongs does not allow low-authority accounts to log in, it is determined whether the object to which the high-authority group belongs can be called by the low-authority account according to the classification result.

[0093] In some implementations, it may be determined whether an object belonging to a high-authority group can be called by a low-authority account based on user attribute information, computer attribute information, and group attribute information.

[0094] In operation S450, when the object to which the high-authority group belongs cannot be called by the low-authority user, it is determined that there is no security risk for the high-authority group.

[0095] In some embodiments, if there are low-authorized users among the members of the group to which the high-authorized user belongs, operation S460 is performed to give a security warning. If the administrator device to which the high-authorized group belongs allows low-authorized accounts to log in, operation S460 is performed to give a security warning. If the object to which the high-authorized group belongs can be called by a low-authorized user, operation S460 is performed to give a security warning.

[0096] In some embodiments of the present disclosure, after receiving a security warning, configuration modifications can be made based on the results of the judgment. For example, if there are low-privileged users among the members of the group to which the high-privileged user belongs, the group policy can be enhanced to strengthen the account security of the high-privileged account. For another example, if the administrator device to which the high-privileged group belongs allows a low-privileged account to log in, the excessive permissions of the low-privileged user can be removed.

[0097] Figure 5 The flowchart of the computer classification-based security detection method within a domain according to an embodiment of the present disclosure is schematically shown.

[0098] like Figure 5 As shown, the intra-domain computer classification-based security detection method of this embodiment includes operations S510 to S550.

[0099] In operation S510, a high-authority computer in the domain is acquired.

[0100] The access control permissions of a high-privilege computer are higher than those of a low-privilege computer.

[0101] A high-privilege computer can centrally manage and control other computers and users in the domain. It can create, modify, and delete user accounts and groups. It can implement and manage group policies to control the behavior of computers and users in the domain. It can access and modify sensitive data and configurations in the domain.

[0102] Low-privilege computers can usually only access and use network resources and services assigned to them. They cannot manage and control other computers and users in the domain. User accounts on them can usually only perform limited operations, such as accessing files, printing documents, etc. Access to sensitive data and configurations is limited.

[0103] In operation S520, based on the classification result, it is determined whether there is a low-authority user among the users and administrators who can log in on the high-authority computer.

[0104] In some implementations, it may be determined whether there are any low-authority users among the group members of the high-authority group based on the attributes of the computer, the attribute information of the user, and the attribute information of the group.

[0105] In operation S530, when there is no low-authority user among the log-in users and administrators on the high-authority computer, it is determined whether the local access control list configuration of the high-authority computer is correct according to the classification result.

[0106] In some implementations, whether the local access control list of the high-authority computer is correctly configured may be determined based on the properties of the computer.

[0107] In operation S540, when the local access control list of the high-authority computer is incorrectly configured, it is determined whether the high-authority computer certificate trust is correct according to the classification result.

[0108] In some implementations, whether the high-authority computer certificate trust is correct can be determined based on the computer's attributes.

[0109] In operation S550, when the high-authority computer certificate is trusted correctly, it is determined that there is no security risk for the high-authority group.

[0110] In some embodiments, if there are low-authority users among the log-in users and administrators on the high-authority computer, operation S560 is performed to give a security warning. If the local access control list of the high-authority computer is not configured correctly, operation S560 is performed to give a security warning. If the certificate trust of the high-authority computer is not correct, operation S560 is performed to give a security warning.

[0111] Based on the above-mentioned intra-domain security detection method, the present disclosure also provides an intra-domain security detection device. Figure 6 The device is described in detail.

[0112] Figure 6 The structural block diagram of the intra-domain security detection device according to an embodiment of the present disclosure is schematically shown.

[0113] like Figure 6As shown, the intra-domain security detection device 600 of this embodiment includes a collection module 610 , a classification module 620 and a determination module 630 .

[0114] The collection module 610 is used to collect all data related to the access control policy in the domain. In one embodiment, the collection module 610 can be used to perform the operation S210 described above, which will not be described in detail here.

[0115] The classification module 620 is used to classify all data according to the subject to which it belongs, and obtain the classification result. The subject includes users, computers and groups. In one embodiment, the classification module 620 can be used to perform the operation S220 described above, which will not be repeated here.

[0116] The determination module 630 is used to determine whether there is a security risk in the domain according to the classification results of users, computers and groups respectively. In one embodiment, the determination module 630 can be used to perform the operation S230 described above, which will not be repeated here.

[0117] According to an embodiment of the present disclosure, collecting all data related to access control policies within a domain includes: acquiring lightweight directory access protocol data and registry data of a domain controller; enumerating machine sessions within the domain, local security policies within the domain, trust relationships between multiple domains, and a distributed component object model.

[0118] According to an embodiment of the present disclosure, the classification results include attribute information of the user, attribute information of the computer, and attribute information of the group; the attribute information of the user includes node information, group member identity information, local administrator authority information, and object control information; the attribute information of the computer includes node information, local administrator information, group member identity information, local administrator authority information, and object control information; the attribute information of the group includes node information, group member information, group member identity information, local administrator authority information, and object control information.

[0119] According to an embodiment of the present disclosure, the intra-domain security detection device 600 also includes: a first determination submodule, which is used to determine the user's node information, the user's group membership information, the user's local administrator authority information, the computer's node information, the computer's group membership information, the group's node information, and the group member information of the group based on the registry data of the domain controller; a second determination submodule, which is used to determine the user's object control information and the computer's local administrator authority information based on the lightweight directory access protocol data; a third determination submodule, which is used to determine the computer's local administrator information based on the intra-domain machine session and the lightweight directory access protocol data; a fourth determination submodule, which is used to determine the computer's object control information based on the local security policy and the lightweight directory access protocol data; a fifth determination submodule, which is used to determine the group's object control information based on the trust relationship between multiple domains, the distributed component object model and the lightweight directory access protocol data.

[0120] According to an embodiment of the present disclosure, according to the classification of users, determining whether there is a security risk in the domain according to the classification result includes: obtaining high-authority users in the domain, the operation authority of the high-authority account is higher than the operation authority of the low-authority account; judging whether there is a low-authority user in the group of users to which the high-authority user belongs according to the classification result; in the case that there is no low-authority user in the group of users to which the high-authority user belongs, judging whether the device logged in by the high-authority user account allows low-authority accounts to log in according to the classification result; in the case that the device logged in by the high-authority user account does not allow low-authority accounts to log in, judging whether the object to which the high-authority user account belongs can be called by the low-authority account according to the classification result; in the case that the object to which the high-authority user account belongs cannot be called by the low-authority account, determining that there is no security risk for the high-authority account.

[0121] According to an embodiment of the present disclosure, according to the classification of groups, determining whether there is a security risk in the domain according to the classification results includes: obtaining a high-authority group in the domain, the operation authority of the high-authority group being higher than the operation authority of the low-authority group; judging whether there are low-authority users among the group members to which the high-authority group belongs according to the classification results; in the case that there are no low-authority users among the group members to which the high-authority group belongs, judging whether the administrator device to which the high-authority group belongs allows low-authority accounts to log in according to the classification results; in the case that the administrator device to which the high-authority group belongs does not allow low-authority accounts to log in, judging whether the objects to which the high-authority group belongs can be called by low-authority accounts according to the classification results; in the case that the objects to which the high-authority group belongs cannot be called by low-authority users, determining that there is no security risk to the high-authority group.

[0122] According to an embodiment of the present disclosure, according to the classification of computers, determining whether there is a security risk in the domain according to the classification results includes: obtaining high-authority computers in the domain, the access control permissions of the high-authority computers being higher than the access control permissions of low-authority computers; judging whether there are low-authority users among the users and administrators who can log in on the high-authority computers according to the classification results; in the case where there are no low-authority users among the users and administrators who can log in on the high-authority computers, judging whether the local access control list of the high-authority computers is correctly configured according to the classification results; in the case where the local access control list of the high-authority computers is correctly configured, judging whether the high-authority computer certificate trust is correct according to the classification results; in the case where the high-authority computer certificate trust is correct, determining that there is no security risk to the high-authority group.

[0123] According to an embodiment of the present disclosure, any multiple modules of the collection module 610, the classification module 620 and the determination module 630 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the collection module 610, the classification module 620 and the determination module 630 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the collection module 610, the classification module 620 and the determination module 630 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be performed.

[0124] Figure 7 A block diagram of an electronic device suitable for implementing the intra-domain security detection method according to an embodiment of the present disclosure is schematically shown.

[0125] like Figure 7As shown, the electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 to a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include an onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0126] In RAM 703, various programs and data required for the operation of electronic device 700 are stored. Processor 701, ROM 702 and RAM 703 are connected to each other via bus 704. Processor 701 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 702 and / or RAM 703. It should be noted that the program can also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0127] According to an embodiment of the present disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to the bus 704. The electronic device 700 may further include one or more of the following components connected to the input / output (I / O) interface 705: an input portion 706 including a keyboard, a mouse, etc.; an output portion 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 708 including a hard disk, etc.; and a communication portion 709 including a network interface card such as a LAN card, a modem, etc. The communication portion 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the input / output (I / O) interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage portion 708 as needed.

[0128] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0129] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 702 and / or RAM 703 described above and / or one or more memories other than ROM 702 and RAM 703.

[0130] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the intra-domain security detection method provided by the embodiment of the present disclosure.

[0131] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 701. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0132] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 709, and / or installed from the removable medium 711. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0133] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0134] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0135] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0136] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0137] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for intra-domain security detection, characterized in that: The method comprises: Collect all data related to access control policies within the domain; Classify all the data according to the subjects to which they belong to obtain classification results, wherein the subjects include users, computers and groups; According to the classification of the users, computers and groups respectively, it is determined whether there is a security risk in the domain according to the classification results.

2. The method according to claim 1, characterized in that All data related to the access control policy in the collection domain includes: Collect Lightweight Directory Access Protocol data and domain controller registry data; Enumerates machine sessions within a domain, local security policies within a domain, trust relationships between multiple domains, and the Distributed Component Object Model.

3. The method according to claim 1, characterized in that The classification result includes attribute information of the user, attribute information of the computer, and attribute information of the group; The user's attribute information includes node information, group membership information, local administrator authority information, and object control information; The computer's attribute information includes node information, local administrator information, group membership information, local administrator authority information, and object control information; The attribute information of the group includes node information, group member information, group member identity information, local administrator authority information and object control information.

4. The method according to claim 1, characterized in that: The method comprises: Determine, according to the registry data of the domain controller, the node information of the user, the group membership information of the user, the local administrator authority information of the user, the node information of the computer, the group membership information of the computer, the node information of the group, and the group membership information of the group; Determining object control information of the user and local administrator authority information of the computer according to the lightweight directory access protocol data; Determining local administrator information of the computer according to the intra-domain machine session and the lightweight directory access protocol data; Determining object control information of the computer according to the local security policy and the lightweight directory access protocol data; Object control information of the group is determined based on the trust relationships between the multiple domains, the distributed component object model and the lightweight directory access protocol data.

5. The method according to claim 3, characterized in that: The determining whether there is a security risk in the domain according to the classification of the user and the classification result includes: Acquire a high-authority user in the domain, wherein the operation authority of the high-authority user is higher than the operation authority of the low-authority user; According to the classification result, determining whether there is a low-authority user in the group to which the high-authority user belongs; In the case that there is no low-authority user in the group to which the high-authority user belongs, judging whether the device logged in by the high-authority user account allows low-authority accounts to log in according to the classification result; In the case that the device logged in by the high-authority user account does not allow low-authority accounts to log in, judging whether the object to which the high-authority user account belongs can be called by the low-authority account according to the classification result; In the case that the object to which the high-authority user account belongs cannot be called by a low-authority account, it is determined that there is no security risk for the high-authority account.

6. The method according to claim 1, characterized in that The determining whether there is a security risk in the domain according to the classification of the group and the classification result includes: Acquire a high-authority group in the domain, wherein the operation authority of the high-authority group is higher than the operation authority of the low-authority group; According to the classification result, determining whether there is a low-authority user among the group members to which the high-authority group belongs; In the case that there is no low-authority user among the group members of the high-authority group, judging whether the administrator device of the high-authority group allows low-authority accounts to log in according to the classification result; In the case that the administrator device to which the high-authority group belongs does not allow low-authority accounts to log in, judging whether the object to which the high-authority group belongs can be called by the low-authority account according to the classification result; In the case that the objects belonging to the high-authority group cannot be called by low-authority users, it is determined that there is no security risk for the high-authority group.

7. The method according to claim 1, characterized in that The determining, according to the classification of the computer and the classification result, whether there is a security risk in the domain includes: Acquire a high-authority computer in the domain, wherein the access control authority of the high-authority computer is higher than the access control authority of the low-authority computer; According to the classification result, determining whether there is a low-authority user among the users and administrators who can log in on the high-authority computer; In the case that there are no low-authority users among the users and administrators who can log in on the high-authority computer, judging whether the local access control list configuration of the high-authority computer is correct according to the classification result; In the case where the local access control list of the high-authority computer is correctly configured, judging whether the trust of the certificate of the high-authority computer is correct according to the classification result; When the high-authority computer certificate is trusted correctly, it is determined that there is no security risk for the high-authority group.

8. A domain security detection device, characterized in that: The device comprises: The collection module is used to collect all data related to the access control policy in the domain; A classification module, used to classify all the data according to the subject to which they belong, and obtain classification results, wherein the subject includes users, computers and groups; The determination module is used to determine whether there is a security risk in the domain according to the classification results of the users, computers and groups respectively.

9. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images