Method and device for processing access request, equipment, storage medium and program product

Abstract

The invention provides a method and device for processing an access request, equipment, a storage medium and a program product, and relates to the technical field of network security. The method comprises the following steps: according to a received access request, determining a target IP corresponding to the access request; determining a first user name corresponding to the target IP; wherein a corresponding relationship between different user names and different IPs is pre-established, and one user name corresponds to at least one IP; and forwarding the access request to a corresponding preset destination address based on an access request processing rule corresponding to the first user name. According to the method and the device, the user account, the terminal equipment and the like which initiate the access request are processed based on the user name, loopholes caused by IP address changes of the user terminal equipment and the like can be avoided, the flexibility is better, and the safety of operation environments such as a network accessed by a user can be effectively improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer network technology, specifically to the field of network security technology, and in particular to a method, apparatus, device, storage medium and program product for processing an access request. Background Art

[0002] Traditional network security technologies often rely on traditional security protection measures such as firewalls and intrusion detection systems. These measures can prevent external network attacks to a certain extent, but for internal security threats, such as malicious behavior of internal employees, malicious traffic in the internal network, and gray release management of business systems, traditional network security technologies are often difficult to effectively deal with. In addition, currently firewalls can only achieve defense capabilities for the network access information of terminal devices (such as IP), but when most devices connect to the intranet across network segments, the device network access information may change, and users' access requests cannot be processed in a timely manner. Summary of the invention

[0003] The embodiments of the present disclosure provide a method, apparatus, device, storage medium and program product for processing an access request.

[0004] In a first aspect, an embodiment of the present disclosure proposes a method for processing an access request, comprising: determining a target IP corresponding to the access request based on a received access request; determining a first user name corresponding to the target IP; wherein a correspondence between different second user names and different IPs is pre-established, a second user name corresponds to at least one IP, and the second user name includes the first user name; based on an access request processing rule corresponding to the first user name, forwarding the access request to a corresponding preset destination address.

[0005] In the second aspect, an embodiment of the present disclosure proposes a device for processing an access request, comprising: a target IP determination module, configured to determine the target IP corresponding to the access request based on the received access request; a first user name determination module, configured to determine the first user name corresponding to the target IP; wherein a correspondence between different second user names and different IPs is pre-established, one second user name corresponds to at least one IP, and the second user name includes the first user name; an access forwarding module, configured to forward the access request to the corresponding preset destination address based on the access request processing rule corresponding to the first user name.

[0006] In a third aspect, an embodiment of the present disclosure provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can implement the method for processing access requests as described in any implementation method in the first aspect when executing the instructions.

[0007] In a fourth aspect, an embodiment of the present disclosure provides a non-transitory computer-readable storage medium storing computer instructions, which are used to enable a computer to implement the method for processing an access request as described in any implementation manner in the first aspect when executed.

[0008] In a fifth aspect, an embodiment of the present disclosure provides a computer program product comprising a computer program, which, when executed by a processor, can implement the method for processing an access request as described in any implementation manner in the first aspect.

[0009] The method for processing access requests provided by the embodiment of the present disclosure can trace the corresponding user name information through the IP information of the access request initiated by the terminal device, and process the user account, terminal device, etc. that initiates the access request based on the user name, thereby avoiding loopholes caused by changes in the IP address of the user's terminal device, etc., and has better flexibility, and can effectively improve the security of the network and other operating environments accessed by the user. In addition, by forwarding the access request of the target user, the access request is isolated from the network and other operating environments accessed by the user, thereby improving the security of the network and other operating environments accessed by the user.

[0010] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Other features, objects and advantages of the present disclosure will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0012] Figure 1 is an exemplary system architecture in which the present disclosure may be applied;

[0013] Figure 2 A flowchart of a method for processing an access request provided by an embodiment of the present disclosure;

[0014] Figure 3 A flowchart of establishing a correspondence between a user name and an IP address provided in an embodiment of the present disclosure;

[0015] Figure 4A flowchart of another method for processing an access request provided by an embodiment of the present disclosure;

[0016] Figure 5 A schematic diagram of a method for processing an access request in an application scenario provided by an embodiment of the present disclosure;

[0017] Figure 6 A flowchart of a method for processing an access request in another application scenario provided by an embodiment of the present disclosure;

[0018] Figure 7 A structural block diagram of a device for processing access requests provided by an embodiment of the present disclosure;

[0019] Figure 8 A structural block diagram of another device for processing access requests provided by an embodiment of the present disclosure;

[0020] Fig. 9 A schematic diagram of the structure of an electronic device suitable for executing a method for processing an access request provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0021] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description. It should be noted that the embodiments in the present disclosure and the features in the embodiments may be combined with each other without conflict.

[0022] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0023] Figure 1 An exemplary system architecture 100 is shown to which embodiments of the method, apparatus, electronic device, and computer-readable storage medium for processing access requests disclosed in the present disclosure can be applied.

[0024] like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0025] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various applications for realizing information communication between the terminal devices 101, 102, 103 and server 105 can be installed, such as security protection applications, firewall applications, instant messaging applications, etc.

[0026] Terminal devices 101, 102, 103 and server 105 can be hardware or software. When terminal devices 101, 102, 103 are hardware, they can be various electronic devices with display screens, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, etc.; when terminal devices 101, 102, 103 are software, they can be installed in the electronic devices listed above, which can be implemented as multiple software or software modules, or as a single software or software module, and no specific limitation is made here. When server 105 is hardware, it can be implemented as a distributed server cluster composed of multiple servers, or as a single server; when the server is software, it can be implemented as multiple software or software modules, or as a single software or software module, and no specific limitation is made here.

[0027] The server 105 can provide various services through various built-in applications. Since the operation of the network environment requires more computing resources and stronger computing power, the methods for processing access requests provided in the subsequent embodiments of the present disclosure are generally performed by the server 105 with stronger computing power and more computing resources. Correspondingly, the device for processing access requests is generally also set in the server 105. However, it should also be pointed out that when the terminal devices 101, 102, and 103 also have computing power and computing resources that meet the requirements, the terminal devices 101, 102, and 103 can also complete the above-mentioned various operations that are handed over to the server 105 through the security protection applications installed thereon, and then output the same results as the server 105. Especially in the case where there are multiple terminal devices with different computing powers at the same time, but when the security protection application determines that the terminal device where it is located has stronger computing power and more remaining computing resources, it can allow the terminal device to perform the above-mentioned operations, thereby appropriately reducing the computing pressure of the server 105. Correspondingly, the device for processing access requests can also be set in the terminal devices 101, 102, and 103. In this case, the exemplary system architecture 100 may also not include the server 105 and the network 104 .

[0028] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0029] Please refer to Figure 2 , Figure 2 A flowchart of a method for processing an access request provided by an embodiment of the present disclosure, wherein process 200 includes the following steps:

[0030] Step 201: According to the received access request, determine the target IP corresponding to the access request.

[0031] This step is intended to be performed by the execution entity of the method for processing the access request (e.g. Figure 1 The server 105 shown in the figure obtains the information of the user through the terminal device (for example Figure 1 The access request may be, for example, a request to obtain network resources (e.g., HTML files, pictures, videos, etc.) (e.g., a GET request), a request to send data to a server (e.g., submit a form for login, registration, comment submission, etc.) (e.g., a POST request), etc. For the access request sent by the user, the execution subject may at least obtain information such as the IP address of the terminal device used by the user to send the access request.

[0032] Step 202: Determine the first user name corresponding to the target IP.

[0033] On the basis of step 201, this step is intended for the above-mentioned execution subject to determine the information of the first user name corresponding to the target IP through the target IP. In this embodiment, the execution subject can obtain the first user name corresponding to the target IP through the pre-established correspondence between different second user names and different IPs. In actual applications, when the same user name logs in or makes other access requests through different devices, different networks, and different areas, the IP address used may change. Therefore, in order to better manage the security of the account used by the user, in the established correspondence, a second user name can correspond to one or more IP address information, and the second user name includes the first user name.

[0034] Step 203: Based on the access request processing rule corresponding to the first user name, forward the access request to the corresponding preset destination address.

[0035] In this embodiment, the access request processing rule is mainly used to process various access requests initiated by the user based on the first user name, check the legality and security of the access request, and directly forward the access request to the corresponding preset destination address for access requests that may pose risks to the execution subject or the network and other operating environments. The preset destination address is mainly used to direct the access request to a relatively safe or independent server, network environment or gateway, etc., so as to isolate the access request from the network environment where the execution subject is located.

[0036] The method for processing access requests provided by the embodiment of the present disclosure can trace the corresponding user name information through the IP information of the access request initiated by the terminal device, and process the user account, terminal device, etc. that initiates the access request based on the user name, thereby avoiding loopholes caused by changes in the IP address of the user's terminal device, etc., and has better flexibility, and can effectively improve the security of the network and other operating environments accessed by the user. In addition, by forwarding the access request of the target user, the access request is isolated from the network and other operating environments accessed by the user, thereby improving the security of the network and other operating environments accessed by the user.

[0037] In some optional implementations of this embodiment, the above step 201, based on the received access request, determines the target IP corresponding to the access request, mainly including: extracting information in the field from the IP information field of the access request, the information in the field including the IP address; determining the target IP according to the IP address. For the access request initiated by the terminal device, the execution subject can obtain the user name, IP address and other information of the user account that initiated the access request, thereby extracting the specific fields in the IP information to obtain the IP address, and determining the target IP according to the IP address. In this embodiment, the process of determining the target IP address is implemented under the condition of ensuring that the corresponding operations comply with laws, regulations and privacy protection principles. Specifically, the access request header usually contains the IP address and port number of the target server, so the target IP address can be determined by viewing the header information of the access request. Alternatively, some network tools (such as Wireshark, tcpdump, etc.) can also be used to capture and analyze network data packets to determine the target IP address.

[0038] In some optional implementations of this embodiment, the above step 202, the process of determining the first user name corresponding to the target IP, mainly includes: obtaining the first user name to which the target IP belongs according to a preset correspondence table; wherein the correspondence table includes the correspondence. In the correspondence table, the same user name can be configured to correspond to one IP or multiple different IPs. And it is understandable that the correspondence table can update the user name, IP address, and IP address corresponding to the user name in real time according to the needs of actual applications, and update the IP address corresponding to the user name according to the different IPs used by the user name.

[0039] In actual applications, when a user accesses through a terminal device, the same user name may change the IP address used by the user name because of logging in through different devices, different networks, and different areas or initiating other access requests. In other words, the correspondence between different user names and different IPs described in the above embodiment is a correspondence that needs to be updated in real time, and the correspondence table also needs to be updated in real time. The correspondence and the correspondence table are updated for the user names and corresponding IP addresses obtained at different stages or in different states. In some optional implementations of this embodiment, the correspondence between the user name and the IP address can be first constructed when the user logs in to initiate a device access request.

[0040] For example, Figure 3 As shown, the device access request initiated by the user through the terminal device is mainly sent to the network controller. The network controller receives the device access request and initiates an authentication request to the network access authentication server. The network access authentication server can be a general network protocol server, such as a Radius (Remote Authentication Dial-InUser Service) server. After receiving the authentication request, the network access authentication server authenticates the user's username, password and other information. After the authentication is passed, the network access authentication server generates an authentication acceptance message with the username and the current IP address of the network, and sends the authentication acceptance message to send the username and the current IP address of the network. After obtaining the username and the current IP address of the network, the execution subject binds the username with the current IP address of the network, thereby establishing a corresponding relationship between the username and the IP address. It should be noted that the process of obtaining information such as username and password described in this embodiment can be obtained by the user logging into the application or web page. In addition, users have confirmed and checked the user login agreement when logging in, indicating that users have understood and agreed that for security reasons, their user names, passwords and other related information will be legally obtained.

[0041] In some optional implementations of this embodiment, the access request processing rules described in the above step 203 are rules for specifically processing access requests initiated by a user name, and may include: at least one of: preset field rules, preset operation rules, and preset traffic rules. Among them, the preset field rules are mainly used to characterize that the user name contains sensitive fields, or fields of user names that have been identified as risky users or malicious users. The preset operation rules are mainly used to characterize that the access request or operation initiated by the user name involves risk operations such as malicious attack operations, for example, including: forged address resolution protocol spoofing operations, distributed denial of service attack operations (DDoS attacks), malware attacks, illegal access, etc. At least one of the following. The preset traffic rules are mainly used to characterize that the traffic used by the access request initiated by the user name reaches or exceeds the warning value, etc.

[0042] Correspondingly, the execution subject forwards the access request to the corresponding preset destination address based on the access request processing rule corresponding to the first user name, which may include at least one of the following situations:

[0043] When the execution subject detects that the field in the user name meets the preset field rule (i.e., contains a sensitive field, or contains a field of a user name that has been identified as a risky user or a malicious user), the access request is forwarded to the corresponding preset destination address;

[0044] When the execution subject detects that the access behavior initiated by the user name meets the preset operation rules (i.e., it is a malicious operation or risky operation such as a forged address resolution protocol spoofing operation, a distributed denial of service attack operation (DDoS attack), a malware attack, or illegal access), the access request is forwarded to the corresponding preset destination address;

[0045] When the execution subject detects that the field in the user name meets the preset traffic rule (that is, the traffic used by the initiated access request reaches or exceeds the warning value), the access request is forwarded to the corresponding preset destination address.

[0046] Through the above process, access requests initiated by key user names (such as risky users, malicious users, etc.) can be processed more specifically and forwarded, thereby isolating malicious behaviors that may be generated by the key user names and improving the security of the network and other operating environments accessed by users.

[0047] In practical applications, the process of forwarding the access request to the corresponding preset destination address implemented by the execution subject can be implemented based on the pre-configured destination address conversion rules using the configured configuration rule tool (for example, iptables component). The iptables component is a widely used firewall tool, which is a user space application based on the Netfilter framework (a traffic processing framework provided by the Linux kernel) and can configure the firewall rules of the operating system kernel. In this embodiment, the destination address conversion function (Destination Network Address Translation, DNAT) of iptables is mainly used to redirect the user's access request destination address to other IPs or servers.

[0048] Exemplarily, the execution subject may forward the access request to a preset domain name system server (DNS server), for example, a common user name can access the production environment service of xxx.com, and a focused user name can access the test environment service of xxx.com. Furthermore, the execution subject may configure xxx.com to resolve to a test IP (e.g. 127.0.0.1) on the DNS service to block the access request of the focused user name.

[0049] Exemplarily, the execution entity may also forward the access request to a zero-trust gateway to perform a more comprehensive identity authentication on the user name through the zero-trust gateway, thereby improving the reliability of network security detection.

[0050] Please refer to Figure 4 , Figure 4 A flowchart of another method for processing an access request provided by an embodiment of the present disclosure, wherein process 400 includes the following steps:

[0051] Step 401: According to the received access request, determine the target IP corresponding to the access request.

[0052] Step 402: Determine a first user name corresponding to the target IP; wherein a correspondence between different second user names and different IPs is pre-established, one second user name corresponds to at least one IP, and the second user name includes the first user name.

[0053] Step 403: Based on the access request processing rule corresponding to the first user name, forward the access request to the corresponding preset destination address.

[0054] The above steps 401-403 are similar to Figure 2 Steps 201-203 shown are consistent, and for the same contents, please refer to the corresponding parts of the previous embodiment, which will not be repeated here.

[0055] Step 404: In response to detecting that the IP information corresponding to the second user name has changed, updating the corresponding relationship.

[0056] After the corresponding relationship described in any of the above embodiments is created, if only the current corresponding relationship is saved in the corresponding relationship table, if the IP address of the terminal device used by the subsequent user changes, the corresponding change cannot be detected in time, which easily leads to omissions in the management of user access requests. Therefore, correspondingly, when it is detected that the IP address corresponding to the second user name has changed, the corresponding relationship also needs to be updated in real time. Specifically, the information in the corresponding relationship table can be updated. The IP address corresponding to the second user name can be replaced with the changed IP address, or the IP address corresponding to the second user name can be extended, that is, the second user name can correspond to both the original IP address and the new IP address.

[0057] Exemplarily, the execution entity may be that when a user initiates an access request through a terminal device, the first user name and the IP address used are extracted, and when it is detected that the IP address is a new IP address, the new IP address is added to the correspondence, for example, the list of IP addresses corresponding to the first user name is updated in the correspondence table.

[0058] Exemplarily, based on detecting the online and offline events of the user account used by the user, the IP address used by the first user name of the user account when it is newly online can be obtained, and the IP address corresponding to the first user name can be further updated, thereby updating the correspondence between the first user name and the IP address and the correspondence table.

[0059] In this embodiment, by realizing real-time update of the correspondence between user names and IP addresses, access requests to user accounts can be processed more promptly and effectively from the user name dimension. Regardless of the user using different terminal devices, network environments, etc. to log in, access, etc., the new IP address can be bound and associated with the user name, thereby performing more comprehensive detection, which can expand the scope of application of detection and processing of user access requests, improve flexibility, and further improve the security of the operating environment such as the network accessed by the user.

[0060] To deepen understanding, the present disclosure also provides a specific implementation solution in combination with a specific application scenario, see Figure 5 shown.

[0061] In this implementation scheme, the execution subject can be specifically implemented as a firewall. The firewall includes at least an agent component (agent component) and an iptables component. Among them, the agent component is used to implement the main function of the firewall, that is, to execute the process of any of the above-mentioned method embodiments. The iptables component is used to configure the destination address conversion rules. Furthermore, the firewall can be configured with an ipset collection to store a collection of multiple IP addresses, network addresses or port numbers to improve network processing efficiency. The agent component can detect whether the current user name is online. If online, the current user name and IP address are added to the ipset collection for management. When an online event or a lower limit event of a user name is detected, the relevant information in the ipset collection can be dynamically updated. In addition, the correspondence between user names and IP addresses can also be managed through the ipset collection.

[0062] In actual applications, a server can also be provided, which can be connected to one or more firewalls to manage the destination address conversion rules of the firewalls. For example, for firewall X, a destination address conversion rule for username X1 can be issued, that is, once an access request from username X1 is detected, it is directly forwarded according to the destination address conversion rule; for firewall Y, a destination address conversion rule for username Y1 can be issued, that is, once an access request from username Y1 is detected, it is directly forwarded according to the destination address conversion rule, and so on. It can be understood that the server is not limited to configuring one destination address conversion rule for one firewall, and multiple destination address conversion rules can also be configured as needed so that the firewall can detect and process access requests from multiple usernames.

[0063] To deepen understanding, the present disclosure also provides a specific implementation solution in combination with a specific application scenario, see Figure 6 shown.

[0064] A user named A initiates a network access request through a terminal device. After authentication, the network access server sends the user name and current IP address to the server.

[0065] The server binds the user name and the current IP address to establish a corresponding relationship. The server obtains the user access request of the user named A as: the traffic with the original destination address 10.0.0.1 and port 8080. In addition, the iptables component is configured with a preset destination address conversion rule: forward the traffic with the destination address 10.0.0.1 and port 8080 to 10.0.0.2 port 9090. In addition, the server detects that the user name of user A is a user name that meets the access request processing rules, so the access request of the user name A can be forwarded to 10.0.0.2 port 9090.

[0066] Furthermore, the server can also detect the online and offline events of the current user A. If the user is online, the new IP of the user A can be obtained, and the new IP is added to the corresponding relationship table corresponding to the user name A.

[0067] Further references Figure 7 As an implementation of the methods shown in the above figures, the present disclosure provides an embodiment of a device for processing an access request. Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0068] like Figure 7 As shown, the device 700 for processing access requests in this embodiment may include: a target IP determination module 701, a first user name determination module 702 and an access forwarding module 703. The target IP determination module 701 is configured to determine the target IP corresponding to the access request according to the received access request. The first user name determination module 702 is configured to determine the first user name corresponding to the target IP; wherein a correspondence between different second user names and different IPs is pre-established, a second user name corresponds to at least one IP, and the second user name includes the first user name. The access forwarding module 703 is configured to forward the access request to the corresponding preset destination address based on the access request processing rule corresponding to the first user name.

[0069] In the present embodiment, in the apparatus 700 for processing access requests, the specific processing of the target IP determination module 701, the first user name determination module 702 and the access forwarding module 703 and the technical effects thereof can be referred to in Figure 2 The relevant descriptions of steps 201 - 203 in the corresponding embodiment are not repeated here.

[0070] This embodiment exists as a device embodiment corresponding to the above method embodiment. The device for processing access requests provided by this embodiment traces the corresponding user name information through its IP information for the access request initiated by the terminal device, and processes the user account, terminal device, etc. that initiates the access request based on the user name, which can avoid vulnerabilities caused by changes in the IP address of the user's terminal device, has better flexibility, and can effectively improve the security of the network and other operating environments accessed by the user. In addition, by forwarding the access request of the target user, the access request is isolated from the network and other operating environments accessed by the user, thereby improving the security of the network and other operating environments accessed by the user.

[0071] In some optional implementations of this embodiment, the target IP determination module 701 is further configured to: extract information in the field from the IP information field of the access request, the information in the field includes the IP address; determine the target IP according to the IP address. For the access request initiated by the terminal device, the execution subject can obtain the user name, IP address and other information of the user account that initiated the access request, thereby extracting the specific fields in the IP information to obtain the IP address, and determining the target IP according to the IP address. In this embodiment, the process of determining the target IP address is implemented under the condition of ensuring that the corresponding operations comply with laws, regulations and privacy protection principles. Specifically, the access request header usually contains the IP address and port number of the target server, so the target IP address can be determined by viewing the header information of the access request. Alternatively, some network tools (such as Wireshark, tcpdump, etc.) can also be used to capture and analyze network data packets to determine the target IP address.

[0072] In some optional implementations of this embodiment, the first user name determination module 702 is further configured to obtain the first user name to which the target IP belongs according to a preset correspondence table; wherein the correspondence table includes the correspondence. The same user name can be configured to correspond to one IP or multiple different IPs. Moreover, it is understandable that the correspondence table can update the user name, IP address, and IP address corresponding to the user name in real time according to the needs of actual applications, and update the IP address corresponding to the user name according to the different IPs used by the user name.

[0073] In some optional implementations of this embodiment, the device 700 for processing access requests also includes: a corresponding relationship determination module (not shown in the figure), which is configured to obtain the network access information and the current network access IP corresponding to the device network access request sent by the network access authentication server; the corresponding relationship is obtained by binding the second user name contained in the network access information with the current network access IP. The corresponding relationship determination module is mainly used to first build the corresponding relationship between the user name and the IP address when the user logs in to initiate the device network access request. The device network access request initiated by the user through the terminal device is mainly sent to the network controller. The network controller receives the device network access request and initiates an authentication request to the network access authentication server. The network access authentication server can be a general network protocol server (such as a Radius server). After receiving the authentication request, the network access authentication server authenticates the user's username, password and other information. After the authentication is passed, the network access authentication server generates an authentication acceptance message with the username and the current network access IP address, and sends the authentication acceptance message to send the username and the current network access IP address and other information therein. After obtaining the user name and the current IP address, the execution subject binds the user name to the current IP address, thereby establishing a corresponding relationship between the user name and the IP address.

[0074] In some optional implementations of this embodiment, the access request processing rules are rules for specifically processing access requests initiated by user names, and may include: at least one of preset field rules, preset operation rules, and preset traffic rules. Correspondingly, the access forwarding module 703 is further configured to perform at least one of the following processes:

[0075] When the execution subject detects that the field in the user name meets the preset field rule (i.e., contains a sensitive field, or contains a field of a user name that has been identified as a risky user or a malicious user), the access request is forwarded to the corresponding preset destination address;

[0076] When the execution subject detects that the access behavior initiated by the user name meets the preset operation rules (i.e., it is a malicious operation or risky operation such as a forged address resolution protocol spoofing operation, a distributed denial of service attack operation (DDoS attack), a malware attack, or illegal access), the access request is forwarded to the corresponding preset destination address;

[0077] When the execution subject detects that the field in the user name meets the preset traffic rule (that is, the traffic used by the initiated access request reaches or exceeds the warning value), the access request is forwarded to the corresponding preset destination address.

[0078] Through the above process, access requests initiated by key user names (such as risky users, malicious users, etc.) can be processed more specifically and forwarded, thereby isolating malicious behaviors that may be generated by the key user names and improving the security of the network and other operating environments accessed by users.

[0079] In practical applications, the process of forwarding the access request to the corresponding preset destination address implemented by the access forwarding module 703 can be implemented based on the pre-configured destination address conversion rules using the configured configuration rule tool (e.g., iptables component). The iptables component is a widely used firewall tool, which is a user space application based on the Netfilter framework and can configure the firewall rules of the operating system kernel. In this embodiment, the destination address translation function (DNAT) of iptables is mainly used to redirect the user's access request destination address to other IPs or servers.

[0080] Exemplarily, the access forwarding module 703 may forward the access request to a preset domain name system server (DNS server). Alternatively, the access forwarding module 703 may also forward the access request to a zero-trust gateway to perform a more comprehensive identity authentication on the user name through the zero-trust gateway, thereby improving the reliability of network security detection.

[0081] In some optional implementations of this embodiment, such as Figure 8 As shown, the apparatus 700 for processing access requests may further include a corresponding relationship updating module 704, which is configured to update the corresponding relationship in response to detecting a change in the IP information corresponding to the second user name.

[0082] After the corresponding relationship described in any of the above embodiments is created, if only the current corresponding relationship is saved in the corresponding relationship table, if the IP address of the terminal device used by the subsequent user changes, the corresponding change cannot be detected in time, which easily leads to omissions in the management of user access requests. Therefore, correspondingly, when it is detected that the IP address corresponding to the second user name changes, the corresponding relationship also needs to be updated in real time. Specifically, the information in the corresponding relationship table can be updated. The IP address corresponding to the second user name can be replaced with the changed IP address, or the IP address corresponding to the second user name can be extended, that is, the second user name can correspond to both the original IP address and the new IP address.

[0083] Exemplarily, the correspondence update module 704 may be configured to extract the first user name and the IP address used when the user initiates an access request through a terminal device, and when it is detected that the IP address is a new IP address, add the new IP address to the correspondence, for example, by updating the IP address list corresponding to the first user name in the correspondence table.

[0084] Exemplarily, the correspondence update module 704 can also obtain the IP address used by the first user name of the user account when it is newly online based on detecting the online and offline events of the user account used by the user, and further update the IP address corresponding to the first user name, thereby updating the correspondence between the first user name and the IP address and the correspondence table.

[0085] In this embodiment, by realizing real-time update of the correspondence between user names and IP addresses, access requests to user accounts can be processed more promptly and effectively from the user name dimension. Regardless of the user using different terminal devices, network environments, etc. to log in, access, etc., the new IP address can be bound and associated with the user name, thereby performing more comprehensive detection, which can expand the scope of application of detection and processing of user access requests, improve flexibility, and further improve the security of the operating environment such as the network accessed by the user.

[0086] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can implement the method for processing access requests described in any of the above embodiments when executing.

[0087] According to an embodiment of the present disclosure, the present disclosure further provides a readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to implement the method for processing an access request described in any of the above embodiments when executed.

[0088] According to an embodiment of the present disclosure, the present disclosure further provides a computer program product, which, when executed by a processor, can implement the method for processing an access request described in any of the above embodiments.

[0089] Fig. 9A schematic block diagram of an example electronic device 900 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0090] like Fig. 9 As shown, the device 900 includes a computing unit 901, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 902 or a computer program loaded from a storage unit 908 into a random access memory (RAM) 903. In the RAM 903, various programs and data required for the operation of the device 900 can also be stored. The computing unit 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0091] A number of components in the device 900 are connected to the I / O interface 905, including: an input unit 906, such as a keyboard, a mouse, etc.; an output unit 907, such as various types of displays, speakers, etc.; a storage unit 908, such as a disk, an optical disk, etc.; and a communication unit 909, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 909 allows the device 900 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0092] The computing unit 901 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 901 performs the various methods and processes described above, such as a method for processing access requests. For example, in some embodiments, the method for processing access requests may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 908. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 900 via the ROM 902 and / or the communication unit 909. When the computer program is loaded into the RAM 903 and executed by the computing unit 901, one or more steps of the method for processing access requests described above may be performed. Alternatively, in other embodiments, the computing unit 901 may be configured to execute the method for processing access requests in any other appropriate manner (e.g., by means of firmware).

[0093] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0094] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0095] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0096] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0097] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0098] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and virtual private servers (VPS) services.

[0099] According to the technical solution of the embodiment of the present disclosure, for the access request initiated by the terminal device, the corresponding user name information is traced back through its IP information, and the user account, terminal device, etc. that initiates the access request are processed based on the user name, which can avoid loopholes caused by changes in the IP address of the user's terminal device, etc., has better flexibility, and can effectively improve the security of the network and other operating environments accessed by the user. In addition, by forwarding the access request of the target user, the access request is isolated from the network and other operating environments accessed by the user, thereby improving the security of the network and other operating environments accessed by the user.

[0100] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0101] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for processing an access request, comprising: Determine, according to the received access request, a target IP corresponding to the access request; Determine a first user name corresponding to the target IP; wherein a correspondence between different second user names and different IPs is pre-established, one second user name corresponds to at least one IP, and the second user name includes the first user name; Based on the access request processing rule corresponding to the first user name, the access request is forwarded to the corresponding preset destination address.

2. The method according to claim 1, wherein: The step of determining a target IP address corresponding to the access request according to the received access request includes: Extracting information in the field from the IP information field of the access request, wherein the information in the field includes an IP address; The target IP address is determined according to the IP address.

3. The method according to claim 1, wherein determining the first user name corresponding to the target IP comprises: The first user name to which the target IP belongs is obtained according to a preset correspondence table; wherein the correspondence table includes the correspondence.

4. The method according to claim 1, wherein: The method further comprises: Obtain the network access information and current network access IP corresponding to the device network access request sent by the network access authentication server; The corresponding relationship is obtained by binding the second user name included in the network access information with the current network access IP.

5. The method according to claim 4, wherein: The second user name and the current network IP sent by the network authentication server are sent by the network authentication server after generating an authentication acceptance message based on the second user name and the current network IP in response to determining that the second user name authentication is successful.

6. The method according to claim 1, further comprising: In response to detecting that the IP information corresponding to the second user name changes, the corresponding relationship is updated.

7. The method according to claim 6, wherein: In response to detecting that the IP information corresponding to the second user name changes, updating the corresponding relationship includes: In response to obtaining the first user name and the new IP from the access request, the new IP is added to the IP list corresponding to the first user name in the corresponding relationship.

8. The method according to claim 1, wherein: The access request processing rule includes: at least one of a preset field rule, a preset operation rule, and a preset flow rule. The forwarding the access request to a corresponding preset destination address based on the access request processing rule corresponding to the first user name includes: In response to determining that the field in the first user name complies with the preset field rule, forwarding the access request to a corresponding preset destination address; or In response to determining that the access behavior initiated by the first user name complies with the preset operation rule, forwarding the access request to a corresponding preset destination address; or In response to determining that the request traffic initiated by the first user name complies with the preset traffic rule, the access request is forwarded to the corresponding preset destination address.

9. The method according to claim 8, wherein: The preset operation rules include: at least one of: forged address resolution protocol spoofing operation, distributed denial of service attack operation, malware attack, and illegal access.

10. The method according to any one of claims 1 to 9, wherein: The forwarding the access request to the corresponding preset destination address includes: By configuring a rule tool and based on a pre-configured destination address conversion rule, the access request is forwarded to the preset destination address.

11. The method according to any one of claims 1 to 9, wherein: The preset destination address is used to point to a preset domain name system server or a zero-trust gateway.

12. A device for processing an access request, comprising: A target IP determination module is configured to determine a target IP corresponding to the access request according to the received access request; A first user name determination module is configured to determine a first user name corresponding to the target IP; wherein a correspondence between different second user names and different IPs is pre-established, one second user name corresponds to at least one IP, and the second user name includes the first user name; The access forwarding module is configured to forward the access request to a corresponding preset destination address based on an access request processing rule corresponding to the first user name.

13. The device according to claim 12, wherein: The target IP determination module is further configured to: Extracting information in the field from the IP information field of the access request, wherein the information in the field includes an IP address; The target IP address is determined according to the IP address.

14. The apparatus according to claim 12, wherein the first user name determination module is further configured to: The first user name to which the target IP belongs is obtained according to a preset correspondence table; wherein, The correspondence table includes the correspondence.

15. The device according to claim 12, wherein: The device also includes: The corresponding relationship determination module is configured to obtain the network access information and current network access IP corresponding to the device network access request sent by the network access authentication server; and obtain the corresponding relationship by binding the second user name contained in the network access information with the current network access IP.

16. The device according to claim 15, wherein: The second user name and the current network IP sent by the network authentication server are sent by the network authentication server after generating an authentication acceptance message based on the second user name and the current network IP in response to determining that the second user name authentication is successful.

17. The apparatus according to claim 12, further comprising: The corresponding relationship updating module is configured to update the corresponding relationship in response to detecting a change in the IP information corresponding to the second user name.

18. The device according to claim 17, wherein: The correspondence updating module is further configured to: In response to obtaining the first user name and the new IP from the access request, the new IP is added to the IP list corresponding to the first user name in the corresponding relationship.

19. The device according to claim 12, wherein: The access request processing rule includes: at least one of a preset field rule, a preset operation rule, and a preset flow rule. The access forwarding module is further configured to: In response to determining that the field in the first user name complies with the preset field rule, forwarding the access request to a corresponding preset destination address; or In response to determining that the access behavior initiated by the first user name complies with the preset operation rule, forwarding the access request to a corresponding preset destination address; or In response to determining that the request traffic initiated by the first user name complies with the preset traffic rule, the access request is forwarded to the corresponding preset destination address.

20. The device according to claim 19, wherein The preset operation rules include: at least one of: forged address resolution protocol spoofing operation, distributed denial of service attack operation, malware attack, and illegal access.

21. The device according to any one of claims 12 to 20, wherein: The access forwarding module is further configured to: By configuring a rule tool and based on a pre-configured destination address conversion rule, the access request is forwarded to the preset destination address.

22. The device according to any one of claims 12 to 20, wherein: The preset destination address is used to point to a preset domain name system server or a zero-trust gateway.

23. An electronic device, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method for processing an access request according to any one of claims 1 to 11.

24. A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to execute the method for processing an access request according to any one of claims 1 to 11.

25. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the steps of the method for processing an access request according to any one of claims 1 to 11.

Images