Security control method and device and computer readable medium

Abstract

According to the security control method and device and the computer readable medium provided by the invention, the application access strategy and the security configuration information in the scheme are specifically configured according to different applications, so that more refined authority control can be carried out; meanwhile, safety related information including the terminal information is used during access control judgment, and the attention point of safety control is placed on each client device instead of a network boundary, so that the access authority can be controlled according to the requirements of a terminal user and the characteristics of the terminal device, and the access control efficiency is improved. Therefore, a more refined access control strategy is realized, a stronger security defense system is created, and the security is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of information technology, and in particular to a security management method, device, and computer-readable medium. Background Art

[0002] In recent years, the multi-cloud, hybrid cloud environment and various devices used by enterprises have made security management more complicated. The traditional security management model is mainly based on border defense, that is, establishing network boundaries by establishing firewalls, intrusion detection systems, etc., and checking and filtering the access network traffic. The security management and control capabilities mainly rely on the performance of the software and hardware devices that make up the network boundary. Therefore, in order to ensure security, a large number of software and hardware devices are required when building the network boundary, such as firewalls, VPN (Virtual Private Network) gateways and many other security devices.

[0003] As the network environment becomes more complex and the means of network attacks continue to escalate, the existing security management and control model requires a lot of time and energy to manage and maintain various software and hardware devices, making the operation and maintenance costs high. Devices with defects on the network boundary may also become a breakthrough for attackers. At the same time, the existing security management and control model generally relies on network attributes such as the visitor's IP address to manage the access rights of the application, but does not consider whether the access terminal itself is compliant, whether there are vulnerabilities or viruses, etc., and these factors will also have a great impact on the security within the network in the current network environment. Therefore, the traditional security management and control model is obviously unable to meet the current complex network security needs. Summary of the invention

[0004] One purpose of the present application is to provide a security management method, device and computer-readable medium, at least to solve the problem that existing solutions do not consider relevant factors of access terminals when performing security management and cannot meet complex network security requirements.

[0005] The present application provides a method for security management and control, which is applied to a security gateway device and includes:

[0006] Obtain application access policies and security configuration information about the target application issued by the security management platform;

[0007] After the client device completes identity authentication, sending the security configuration information to the client device, and obtaining terminal information reported by the client device according to the security configuration information;

[0008] When receiving an access request for the target application sent by a client device that has completed identity authentication, determine whether it complies with the application access policy based on the security-related information of the client device, and release or reject the access request based on the judgment result; wherein the security-related information includes the terminal information.

[0009] The present application embodiment provides a security management method, which is applied to a security management platform and includes:

[0010] Obtaining application access policy and security configuration information about the target application configured by an administrator;

[0011] The application access policy and security configuration information are issued to the security gateway device, so that after the client device completes identity authentication, the security gateway device sends the security configuration information to the client device, obtains the terminal information reported by the client device based on the security configuration information, and when receiving an access request for the target application sent by the client device that has completed identity authentication, determines whether it complies with the application access policy based on the security-related information of the client device, and releases or rejects the access request based on the judgment result; wherein the security-related information includes the terminal information.

[0012] The present application provides a method for security management and control, which is applied to a client device and includes:

[0013] After completing identity authentication, obtaining security configuration information from the security gateway device;

[0014] According to the security configuration information, the corresponding terminal information is reported to the security gateway device, so that when the security gateway device receives an access request for the target application sent by a client device that has completed identity authentication, it determines whether it complies with the application access policy based on the security-related information of the client device, and releases or rejects the access request based on the judgment result, wherein the security-related information includes the terminal information.

[0015] The present invention provides a security gateway device for security management and control, and the security gateway device includes:

[0016] A data transceiver module, used to obtain application access policies and security configuration information about target applications issued by a security management platform, and after the client device completes identity authentication, send the security configuration information to the client device, and obtain terminal information reported by the client device according to the security configuration information;

[0017] A management and control processing module is used to determine whether an access request for the target application sent by a client device that has completed identity authentication complies with the application access policy based on the security-related information of the client device, and to release or reject the access request based on the judgment result; wherein the security-related information includes the terminal information.

[0018] The present application embodiment provides a security management platform for security management and control, the security management platform comprising:

[0019] A configuration acquisition module, used to acquire application access policy and security configuration information about the target application configured by an administrator;

[0020] A configuration sending module is used to send the application access policy and security configuration information to the security gateway device, so that the security gateway device sends the security configuration information to the client device after the client device completes identity authentication, and obtains the terminal information reported by the client device based on the security configuration information, and when receiving an access request for the target application sent by the client device that has completed identity authentication, determines whether it complies with the application access policy based on the security-related information of the client device, and releases or rejects the access request based on the judgment result, wherein the security-related information includes the terminal information.

[0021] The present application provides a client device for security management and control, and the client device includes:

[0022] A configuration acquisition module, used to obtain security configuration information from the security gateway device after completing identity authentication;

[0023] An information reporting module is used to report corresponding terminal information to the security gateway device according to security configuration information, so that when the security gateway device receives an access request for the target application sent by a client device that has completed identity authentication, it can judge whether it complies with the application access policy based on the security-related information of the client device, and release or reject the access request based on the judgment result, and the security-related information includes the terminal information.

[0024] An embodiment of the present application also provides a computing device, which includes a memory for storing computer program instructions and a processor for executing computer program instructions, wherein when the computer program instructions are executed by the processor, the device is triggered to execute the security management method.

[0025] In addition, an embodiment of the present application also provides a computer-readable medium on which computer program instructions are stored, and the computer program instructions can be executed by a processor to implement the security management and control method.

[0026] Compared with the prior art, in the security control scheme provided by the embodiment of the present application, the security management platform can obtain the application access policy and security configuration information about the target application configured by the administrator, and send it to the security gateway device. After the client device completes the identity authentication, the security gateway device can send the security configuration information to the client device, so that the client device reports the terminal information according to the security configuration information. When the client device accesses the target application, the security gateway device can judge whether it complies with the application access policy according to the security-related information of the client device, and release or reject the access request according to the judgment result. Since the application access policy can be configured according to different applications, more refined permission control can be performed. At the same time, the security-related information including the terminal information is used when making the access control judgment, and the focus of security control is placed on each client device, not just the network boundary. Therefore, the access rights can be controlled according to the needs of the terminal user and the characteristics of the terminal device, which can not only realize a more refined access control strategy, but also avoid the compliance problems, vulnerabilities, viruses and other problems of the terminal itself, which have a greater impact on the security of the network in the current network environment, thereby creating a stronger security defense system and effectively improving security. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A schematic diagram of the overall architecture of the devices related to the security management and control method provided in the embodiment of the present application;

[0028] Figure 2 A flowchart of the interaction between relevant devices in the security management and control method provided in the embodiment of the present application;

[0029] Figure 3 A schematic diagram of the interaction process of the solution of an embodiment of the present application when displaying the terminal management list;

[0030] Figure 4 A schematic diagram of the structure of a security gateway device for security management and control provided in an embodiment of the present application;

[0031] Figure 5 A schematic diagram of the structure of a security management platform for security management provided in an embodiment of the present application;

[0032] Figure 6 A schematic diagram of the structure of a customer safety device for security management provided in an embodiment of the present application;

[0033] Figure 7 A schematic diagram of the structure of a computing device for implementing a security management and control method in an embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0035] In a typical configuration of the present application, the terminal and the equipment of the service network each include one or more processors (CPU), input / output interface, network interface and memory.

[0036] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0037] Computer readable media include permanent and non-permanent, removable and non-removable media, and can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

[0038] In the security control method provided in the embodiment of the present application, application access policies can be configured specifically according to different applications, and more refined permission control can be performed. At the same time, security-related information including the terminal information is used when making access control judgments, and the focus of security control is placed on each client device, rather than just the network boundary. Therefore, access rights can be controlled according to the needs of terminal users and the characteristics of terminal devices, which not only implements more refined access control policies, but also avoids compliance issues, vulnerabilities, viruses, and other problems in the terminal itself, which have a greater impact on the security of the network in the current network environment, thereby creating a stronger security defense system and effectively improving security.

[0039] Figure 1The overall structure between the related devices for implementing the method of security management and control provided by the embodiment of the present application is shown, including a client device 110, a security gateway device 120 and a security management platform 130, wherein the user 140 can use the client device 110 to access the target application 160 protected by the security gateway device, the security gateway device 120 performs access control on the process of the user accessing the target application 160, and the administrator 150 configures the policy information related to the access control process on the security management platform. Among them, the specific implementation of the client device 110 can be various terminal devices used by the user to access the application, including but not limited to various devices such as computers, mobile phones, tablet computers, smart watches, etc., and the user 140 can use the client device to access the target application. The specific implementation of the security gateway device 120 and the security management platform 130 can include but not limited to network hosts, single network servers, servers concentrated by multiple network servers, or servers in a distributed cloud network. The distributed cloud network described here is composed of a large number of hosts or network servers based on cloud computing (Cloud Computing). The distributed cloud network can be an edge cloud network, which can be based on the core of cloud computing technology and the ability of edge computing, and build a cloud computing platform on the edge infrastructure to form an elastic cloud platform with comprehensive computing, network, storage, security, application and other capabilities at the edge. It should be noted that the embodiments of the present application do not limit the specific type of distributed network, and any distributed architecture network composed of multiple computing devices is applicable to the present application.

[0040] Figure 2 The interactive process of a security management method provided in an embodiment of the present application is shown, which at least includes the following steps:

[0041] Step S201: The security management platform obtains application access policy and security configuration information about the target application configured by the administrator.

[0042] The target application is an application program that is accessed by a user through a client device and is located inside a secure network and protected by a secure gateway device. The administrator can set corresponding application access policies and security configuration information for different applications inside the secure network. For example, in an actual scenario, the secure network can be an enterprise intranet, and the target application can be various enterprise applications in the enterprise intranet, deployed in an application server in the enterprise intranet.

[0043] Taking applications app1 and app2 as examples, the administrator can configure different application access policies and security configuration information for each application. For example, for application app1, its corresponding application access policy can be configured as s1 and its security configuration information can be configured as p1; and for application app2, its corresponding application access policy can be configured as s2 and its security configuration information can be configured as p2, etc.; thus, each application that needs to be protected can be configured with its own independent application access policy and security configuration information according to the needs of the user, and each application can be individually configured according to the functional characteristics of the application itself, making the protection more refined. Among them, the application access policy and security configuration information are both used to be sent to the security gateway device, so that the security gateway device can collect corresponding information from the client device according to the security configuration information, and judge whether to release or reject the access request for the target application initiated by the client device according to the application access policy combined with the collected information.

[0044] Step S202: The security management platform sends the application access policy and security configuration information to the security gateway device, so that the security gateway device can obtain the application access policy and security configuration information about the target application sent by the security management platform.

[0045] Step S203: After the client device completes identity authentication, the security gateway device sends the security configuration information to the client device, so that the client device can obtain the security configuration information from the security gateway device.

[0046] Before actually accessing the target application inside the secure network, the client device can complete identity authentication in any way. Among them, the identity authentication method can include the identity authentication method of username and password or the authentication method using biometric recognition technology, or other third-party identity authentication service methods. Only after the client device completes the identity authentication in a pre-configured manner can it be allowed to access the protected application inside the secure network. Taking the identity authentication service as an example, the secure network where the security gateway device is located can be associated with the identity authentication service to provide identity authentication services for client devices accessing the secure network. The user can register identity information in the secure network in advance, and the registered identity information can be provided to the identity authentication service. Therefore, when the user uses the client device to log in to the secure network, the identity authentication service can interact with it to complete the identity authentication. After completing the identity authentication, the identity authentication service or the client device can notify the secure gateway device, so that the secure gateway device sends the security configuration information to the client device after receiving the notification of the completion of the identity authentication.

[0047] Step S204: The client device reports corresponding terminal information to the security gateway device according to the security configuration information, so that the security gateway device can obtain the terminal information reported by the client device according to the security configuration information.

[0048] The security configuration information may be in the form of a configuration file, and may include various terminal information that the client device needs to report. For example, the terminal information corresponding to the security configuration information in this embodiment may include current operation information related to the security baseline, such as essential processes, essential applications, illegal processes, illegal applications, illegal ports, firewall status, operating system version number, whether there are vulnerabilities, whether there are viruses, etc. For different client devices, such as terminal devices with different operating systems, different security baseline-related information can be configured respectively, and different operating systems can configure different baseline items (such as Mac OS, support essential / illegal applications, Gatekeeper status; Windows, support illegal ports, anti-virus / anti-ransomware status). According to the different terminal information of different terminal devices, they are configured separately, so that the configuration can be more flexible, so that the security configuration information can better adapt to different application scenarios.

[0049] In addition, in some embodiments of the present application, the terminal information may also include the user identity information of the client device. For example, after a user user1 uses a client program or browser running on a client device to log in to a secure network and completes identity authentication, the identity attributes of user user1 (such as tenant ID, tenant domain name, user name, email, mobile phone number, department, user group, most recent login identity authentication source, etc.) are the user identity information of the client device. As a result, the solution of the embodiment of the present application can obtain terminal information with more diverse content, and then configure a more refined permission control strategy based on this terminal information to achieve more flexible and refined security management and control.

[0050] Step S205, when the security gateway device receives the access request for the target application sent by the client device that has completed identity authentication, it determines whether it complies with the application access policy based on the security-related information of the client device, and releases or rejects the access request based on the judgment result.

[0051] For client devices that have completed identity authentication, they can initiate access requests to the target application to the secure network. The access request will first reach the secure gateway device, which will process it and determine whether it complies with the application access policy corresponding to the target application. Each protected application can be configured with a corresponding application access policy. The administrator can pre-configure it in the application management platform and configure the access policy for the application. Among them, the application access policy can include a series of matching rules. After matching the security-related information of the client device with the matching rules, it can be determined whether it complies with the application access policy based on the matching results.

[0052] The security-related information used to match the matching rule may at least include the current operation information related to the security baseline reported by the client device based on the security configuration information in the aforementioned step S204. At this time, the matching rule may include the following items: whether the terminal is compliant, whether the terminal has a vulnerability risk, whether the terminal has a virus risk, etc.

[0053] Among them, whether the terminal is compliant refers to whether the processes, applications, ports, firewalls, and operating systems in the client device meet the pre-set compliance requirements. For example, if the client device runs the necessary processes and necessary applications, does not run the illegal processes and illegal applications, does not open the illegal ports, and the firewall is in the open state, and the operating system version number meets the preset requirements, then it can be determined that the terminal is compliant. Whether the terminal has a vulnerability risk refers to whether there is a vulnerability in the program currently running on the client device; whether the terminal has a virus risk refers to whether there is a virus in the client device. If the current running information of the client device meets the corresponding matching rules, it means that the client device meets the security baseline. Since the application access policy can be configured according to different applications, more refined permission control can be performed. At the same time, security-related information including the terminal information is used when making access control judgments, the focus of security management and control is placed on each client device, not just the network boundary. Therefore, access rights can be controlled according to the needs of terminal users and the characteristics of terminal devices, which can not only achieve more refined access control strategies, but also avoid compliance issues, vulnerabilities, viruses, etc. in the terminal itself, which have a greater impact on the security of the network in the current network environment. Access is restricted for non-compliant terminals or terminals with vulnerabilities or virus risks, thereby creating a stronger security defense system and effectively improving security.

[0054] In some embodiments of the present application, the security-related information also includes the terminal authentication status. The terminal authentication status can be set by the security management platform, that is, the security management platform can set the terminal authentication status of the client device and send the terminal authentication status of the client device to the security gateway device, so that the security gateway device can obtain the terminal authentication status of the client device from the security management platform.

[0055] In actual scenarios, the default terminal authentication status of client devices can be set to unauthenticated, and then the administrator of the security management platform can adjust the terminal authentication status of client devices that meet the requirements to authenticated after evaluation. For example, when the administrator conducts an evaluation, it can be based on the terminal information reported by the client device. If the terminal information reported each time meets the security baseline, the client device can be considered trustworthy, and its terminal authentication status can be changed to authenticated. In addition, when the terminal information reported by the client device does not meet the security baseline, the administrator can also readjust its terminal authentication status to unauthenticated.

[0056] Here, those skilled in the art should understand that the above-mentioned specific setting method for the terminal authentication status is only an example. If other existing or future forms based on similar principles are applicable to this application, they should also be included in the protection scope of this application and included here by reference. For example, in addition to whether it meets the security baseline, it can also be combined with the historical access behavior of the client device. If there is no abnormal access behavior in the historical access behavior, and the terminal information reported each time also meets the security baseline, the terminal authentication status of the client device can be set to authenticated. In addition, in addition to the evaluation by the administrator, an automatic evaluation method can also be set to regularly obtain the terminal information and / or security-related information of the client device. If it meets the requirements, its terminal authentication status can be automatically set to authenticated. In addition, the client device that has passed the authentication can be configured to avoid secondary authentication and multi-factor authentication, can directly access the protected application, can simplify the authentication process, and achieve quick login / access.

[0057] Since the terminal authentication status can indicate the degree of trust of the client device, the security of the access behavior of the authenticated client device is generally higher than that of the unauthenticated client device. Therefore, after the client device passes the identity authentication, the security gateway device combines the terminal authentication status in the judgment of the application access policy, which can realize in-depth identity authentication and authentication management of network terminal devices and users, reduce the risk of data leakage, have higher security, and can further strengthen the security control capability of access behavior, thereby more effectively improving security.

[0058] In some embodiments of the present application, the application access policy may include one or more of the following: security baseline indicators corresponding to the target application, terminal authentication status, and user identity information. Therefore, when determining whether the security-related information of the client device complies with the application access policy, a more flexible management and control method can be configured based on a combination of one or more of the above information.

[0059] Based on the above-mentioned multiple optional application access strategies, when the solution of the embodiment of the present application receives an access request for the target application sent by a client device that has completed identity authentication, it can use at least one or more of the following to make a judgment: whether the current operation information of the client device complies with the security baseline indicators in the application access policy; whether the user identity information of the client device complies with the user identity information in the application access policy; whether the terminal authentication status of the client device complies with the terminal authentication status in the application access policy.

[0060] Taking the security baseline indicator as an example, when the protected application app1 requires a client device with a specific operating environment to access it, the security baseline indicator can be used as the judgment standard for the application access policy. For example, if the operating environment of the client device that the protected application requires to access must have a certain necessary process running, the firewall must be turned on, and the operating system version number must be a specific version. After the client device reports the above current operating information related to the security baseline according to the security configuration information, the security gateway device can determine whether the current operating information of the client device a1 meets the corresponding security baseline indicator when receiving the access request req1 from the client device a1 to access app1. If it meets the security baseline indicator, the judgment result this time is that it meets the application access policy, and the security gateway device will release the access request req1. Since the security baseline indicator can be used to determine whether the current operating environment of the client device is safe, for example, it can detect compliance issues, vulnerabilities, viruses, etc. of the client device itself and then implement access control. Therefore, using the security baseline indicator as a judgment condition of the application access policy can prevent the problems in the current operating environment of the terminal from affecting the security within the network.

[0061] Taking the terminal authentication status as an example, when the protected application app1 requires a client device with a specific terminal authentication status to access it, the terminal authentication status can be used as a judgment standard for the application access policy. For example, if the protected application requires that the client device to access it must be an authenticated client device, the security gateway device can obtain the terminal authentication status of the client device from the security management platform to determine whether it complies with the terminal authentication status in the application access policy. If it does, the judgment result is that it complies with the application access policy. At this time, the security gateway device will release the access request req1. The terminal authentication status can be set by the administrator based on the status information set for the client device. After using the terminal authentication status as a judgment condition for the application access policy, the administrator can flexibly adjust the terminal authentication status of the client device according to the actual needs of security management and control, making the security access policy more flexible and reducing the risk of application data leakage.

[0062] Taking user identity information as an example, when the protected application app1 requires client devices with specific user identity information to access it, user identity information can be used as the judgment standard for the application access policy. For example, if the protected application requires that the user identity of the client device to be accessed must belong to a certain user group, the client device reports the user identity information based on the security configuration information, and the security gateway device can determine whether the user identity information of the client device a1 meets the user identity information in the application access policy when receiving the access request req1 from the client device a1 to access app1. If it does, the judgment result this time is that it meets the application access policy, and the security gateway device will release the access request req1. Since user identity information can be used to detect the identity of the user accessing the target application, using user identity information as a judgment condition for the application access policy can implement access control based on user identity, ensuring that only users who meet the identity requirements can access the target application, reducing the risk of data leakage, and making the solution more secure.

[0063] In actual scenarios, the above-mentioned application access policies can be judged individually or in combination. For example, based on the security baseline indicators, it can be combined with the terminal authentication status or user identity information for judgment, or other combinations can be used. For example, in addition to requiring the accessing client device to meet the security baseline indicators, the protected application can also require that the terminal authentication status of the client device must be authenticated, or it can also require that the current user identity information of the client device belongs to a certain department, etc. Therefore, through the combination of the above-mentioned multiple application access policies, the access rights of the application can be controlled more flexibly according to the needs of the user and the characteristics of the terminal device, thereby achieving more refined access control.

[0064] In some embodiments of the present application, the security gateway device reports the terminal information to the security management platform. After the security management platform obtains the terminal information reported by the security gateway device, it can generate a terminal management list based on the terminal information and display the terminal management list to the administrator.

[0065] Among them, the terminal management list includes relevant information about the client device, which may include terminal details, terminal authentication status, connection status, etc. Among them, terminal details refer to the basic device information and user basic information of the client device. For example, the basic device information may include the terminal name, operating system, MAC address, hardware feature code, etc., and the basic user information may include the user name, the department to which the user belongs, the identity authentication service used for the last login, the last login IP, the login geographic location, the login time, etc. Through the above-mentioned terminal management list containing various types of relevant information, the administrator can more intuitively understand the details of the client device currently accessing the security network, which is convenient for the administrator to adjust the terminal authentication status of the client device. The terminal authentication status can be divided into two types, including authenticated and unauthenticated. The administrator can authenticate or cancel the terminal, thereby setting the terminal authentication of the client device to authenticated or unauthenticated. The connection status can include connected and unconnected, which respectively indicate that the client device is online or offline.

[0066] Figure 3 The interactive process of the scheme of an embodiment of the present application when displaying the terminal management list is shown. The client device 110 collects its own terminal information based on the security configuration information issued by the security gateway device 120 and reports it to the security gateway device. The security gateway device then stores the acquired terminal information in the security management platform. After being summarized by the security management platform 130, a terminal management list is generated and displayed to the administrator 150. The administrator can quickly view the detailed information of each client device through the displayed terminal management list, which is convenient for the administrator to control the overall information of the current access to the security network, thereby better realizing terminal management and control.

[0067] In other embodiments of the present application, the security gateway device may record an access log regarding the access request and / or a login log generated when the client device performs identity authentication.

[0068] The access log may record relevant information generated when the client device initiates an access request, such as the time when the access request is initiated, the IP address of the client device that initiates the access request, the target application requested for access, the user identity information at the time of access, the processing result (release or rejection) of the access request by the security gateway device, and the reason for rejection, etc. The login log may record relevant information generated when the client device performs identity authentication, such as the login time, login IP address, the identity authentication method at the time of login, the login user identity information, the login result, etc.

[0069] Based on the above access logs and / or login logs, the historical behavior of the client device can be analyzed to determine whether the client device has abnormal behavior that may affect network security during the login access process. In order to further improve the security of the solution, when abnormal behavior of a client device is detected, certain restriction measures can be taken on the client device, such as rejecting subsequent access requests from the client device or limiting the traffic of its access requests.

[0070] In addition, the security gateway device can report the recorded access log and / or login log to the security management platform, so that the security management platform can obtain the access log reported by the security gateway device about the access request and / or the login log generated when the client device performs identity authentication. In this way, the storage and audit analysis of the log can be handed over to the security management platform to reduce the processing load of the security gateway device and avoid affecting the normal business processing of the security gateway device.

[0071] In some embodiments of the present application, after the client device completes identity authentication, the security gateway device or security management platform can issue a login token to the client device. The login token is used to provide the client device with the authority to initiate access requests to the target application, that is, the client device with the login token can normally initiate access requests to the protected target application, while the client device without the login token cannot initiate access requests to the protected target application. Therefore, by managing the login token, the authority of the client device to initiate access can be uniformly controlled, making the authority management more convenient.

[0072] When the security management platform can obtain the access log reported by the security gateway device about the access request and / or the login log generated when the client device performs identity authentication, the security management platform can perform log auditing based on the access log and / or login log to determine whether the corresponding client device has abnormal behavior. For example, the geographical location at the time of the login can be obtained based on the login IP address in the login log, and by comparing with the historical geographical location information, it is detected whether the user is logging in from a different location. If it is a different location, the login is determined as abnormal behavior. For example, based on the access time in the access log, if the access time initiated by the access request belongs to a pre-set abnormal time period, the access behavior can also be determined as abnormal behavior. When there is abnormal behavior, the security management platform can revoke the login token of the client device through the security gateway device, thereby canceling the permission of the client device to initiate an access request to the target application. By implementing management and control of the terminal on the security management platform, not only can the security of terminal device access be improved, but also the security management cost can be saved.

[0073] When an issued login token is revoked, the security gateway device can control the client device to log out the current user who has completed identity authentication, ending the life cycle of the user's login verification, which can effectively reduce security risks and prevent the user from performing other abnormal operations by using the login status that has completed identity authentication.

[0074] For example, in actual scenarios, there are two forms of user login, namely client mode and browser mode. Among them, the client mode refers to the user interacting with the security network through the client application running on the client device. In the client mode, user user1 logs in with the corresponding account in the client application. After completing the identity authentication, the security gateway device can issue a login token, and the user user1 is allowed to access the protected application. When the login token is revoked, the account corresponding to the user user1 will be forcibly logged out in the client application, and will be required to re-authenticate later. The browser mode refers to the user interacting with the security network through the browser on the client device. After the user user1 completes the identity authentication through the browser, the security gateway device will issue a login token, and the user user1 is allowed to access the protected application. When the login token is revoked, the user who has completed the identity authentication will be logged out in the browser, and will be required to re-authenticate later. In this way, it can be prevented that the user uses the login state that has completed the identity authentication to perform other abnormal operations, thereby effectively reducing security risks.

[0075] The present application also provides a security gateway device for security management and control. The structure of the security gateway device is as follows: Figure 4As shown, it includes a data transceiver module 410 and a control processing module 420. The data transceiver module 410 is used to obtain the application access policy and security configuration information about the target application issued by the security management platform, and after the client device completes the identity authentication, send the security configuration information to the client device, and obtain the terminal information reported by the client device according to the security configuration information. The control processing module 420 is used to determine whether the access request about the target application sent by the client device that has completed the identity authentication complies with the application access policy based on the security-related information of the client device, and release or reject the access request based on the judgment result; wherein the security-related information includes the terminal information.

[0076] The present application also provides a security management platform for security control. The structure of the security management platform is as follows: Figure 5 As shown, it includes a configuration acquisition module 510 and a configuration delivery module 520. Among them, the configuration acquisition module 510 is used to obtain the application access policy and security configuration information about the target application configured by the administrator. The configuration delivery module 520 is used to deliver the application access policy and security configuration information to the security gateway device, so that the security gateway device sends the security configuration information to the client device after the client device completes the identity authentication, and obtains the terminal information reported by the client device according to the security configuration information, and when receiving the access request about the target application sent by the client device that has completed the identity authentication, it determines whether it complies with the application access policy according to the security-related information of the client device, and releases or rejects the access request according to the judgment result, and the security-related information includes the terminal information.

[0077] The present application also provides a client device for security management and control, the structure of which is as follows: Figure 6 As shown, it includes a configuration acquisition module 610 and an information reporting module 620. Among them, the configuration acquisition module 610 is used to obtain security configuration information from the security gateway device after completing identity authentication. The information reporting module 620 is used to report corresponding terminal information to the security gateway device according to the security configuration information, so that when the security gateway device receives an access request for the target application sent by a client device that has completed identity authentication, it determines whether it complies with the application access policy according to the security-related information of the client device, and releases or rejects the access request according to the judgment result, and the security-related information includes the terminal information.

[0078] In the security control scheme provided in the embodiment of the present application, in addition to configuring different application access policies and security configuration information for different applications, security-related information including the terminal information is used when making access control judgments, and the focus of security control is placed on each client device, not just the network boundary, so that access rights can be controlled according to the needs of terminal users and the characteristics of terminal devices, thereby achieving more refined access control strategies, creating a stronger security defense system, and effectively improving security. In addition, by making relevant configurations on the security management platform, unified management and control of terminals and applications can be achieved, saving security management costs.

[0079] In addition, the present application also provides a computing device, the structure of which is as follows: Figure 7 As shown, it includes a memory 710 for storing computer program instructions and a processor 720 for executing computer program instructions, wherein when the computer program instructions are executed by the processor, the processor is triggered to execute the security management and control method.

[0080] The methods and / or embodiments in the embodiments of the present application may be implemented as computer software programs. For example, the embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program code for executing the method shown in the flowchart. When the computer program is executed by the processing unit, the above functions defined in the method of the present application are executed.

[0081] It should be noted that the computer-readable medium described in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device.

[0082] In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0083] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0084] The flow chart or block diagram in the accompanying drawings shows the possible architecture, function and operation of the equipment, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated system for hardware that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0085] As another aspect, the embodiments of the present application further provide a computer-readable medium, which may be included in the device described in the above embodiments; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more computer program instructions, which may be executed by a processor to implement the steps of the methods and / or technical solutions of the above multiple embodiments of the present application.

[0086] In addition, an embodiment of the present application further provides a computer program, which is stored in a computer device, so that the computer device executes the method for controlling code execution.

[0087] It should be noted that the present application can be implemented in software and / or a combination of software and hardware, for example, can be implemented using an application specific integrated circuit (ASIC), a general purpose computer or any other similar hardware device. In certain embodiments, the software program of the present application can be executed by a processor to implement the above steps or functions. Similarly, the software program of the present application (including related data structures) can be stored in a computer-readable recording medium, for example, a RAM memory, a magnetic or optical drive or a floppy disk and similar devices. In addition, some steps or functions of the present application can be implemented using hardware, for example, as a circuit that cooperates with a processor to perform each step or function.

[0088] It is obvious to those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, and that the present application can be implemented in other specific forms without departing from the spirit or basic features of the present application. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-restrictive, and the scope of the present application is limited by the attached claims rather than the above description, so it is intended to include all changes that fall within the meaning and scope of the equivalent elements of the claims in the present application. Any figure mark in the claims should not be regarded as limiting the claims involved. In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the device claim can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

Claims

1. A method for security management and control, characterized in that: The method is applied to a security gateway device, comprising: Obtain application access policies and security configuration information about the target application issued by the security management platform; After the client device completes identity authentication, sending the security configuration information to the client device, and obtaining terminal information reported by the client device according to the security configuration information; When receiving an access request for the target application sent by a client device that has completed identity authentication, determine whether it complies with the application access policy based on the security-related information of the client device, and release or reject the access request based on the judgment result; wherein the security-related information includes the terminal information.

2. The method according to claim 1, characterized in that The method further comprises: The terminal authentication status of the client device is obtained from the security management platform, wherein the security-related information also includes the terminal authentication status.

3. The method according to claim 1, characterized in that The application access policy includes one or more of the following: security baseline indicators corresponding to the target application, terminal authentication status and user identity information.

4. The method according to claim 1, characterized in that The method further comprises: Report the terminal information to the security management platform ， The terminal information includes the current operation information of the client device and / or the user identity information. 。 5. The method according to any one of claims 2 to 4, characterized in that When receiving an access request for the target application sent by a client device that has completed identity authentication, determining whether the access request complies with the application access policy based on security-related information of the client device includes: When receiving an access request for the target application sent by a client device that has completed identity authentication, at least one or more of the following is used for determination: Whether the current operation information of the client device meets the security baseline indicators in the application access policy; Whether the user identity information of the client device complies with the user identity information in the application access policy; Whether the terminal authentication status of the client device complies with the terminal authentication status in the application access policy.

6. The method according to claim 1, characterized in that The method further comprises: Record an access log about the access request and / or a login log generated when the client device performs identity authentication.

7. The method according to claim 1, characterized in that The method further comprises: After the client device completes identity authentication, a login token is issued to the client device, and the login token is used to provide the client device with permission to initiate an access request to the target application.

8. The method according to claim 7, characterized in that The method further comprises: When the client device has abnormal behavior, the issued login token is revoked.

9. The method according to claim 8, characterized in that The method further comprises: When the issued login token is revoked, the client device is controlled to log out the current user who has completed identity authentication.

10. A method for security management and control, characterized in that: The method is applied to a security management platform, and includes: Obtaining application access policy and security configuration information about the target application configured by an administrator; The application access policy and security configuration information are issued to the security gateway device, so that after the client device completes identity authentication, the security gateway device sends the security configuration information to the client device, obtains the terminal information reported by the client device based on the security configuration information, and when receiving an access request for the target application sent by the client device that has completed identity authentication, determines whether it complies with the application access policy based on the security-related information of the client device, and releases or rejects the access request based on the judgment result; wherein the security-related information includes the terminal information.

11. The method according to claim 10, characterized in that The method further comprises: The terminal authentication status of the client device is set, and the terminal authentication status of the client device is sent to the security gateway device.

12. The method according to claim 10, characterized in that The method further comprises: Obtaining terminal information reported by the security gateway device; A terminal management list is generated according to the terminal information, and the terminal management list is displayed to the administrator.

13. The method according to claim 10, characterized in that The method further comprises: The access log about the access request reported by the security gateway device and / or the login log generated when the client device performs identity authentication are obtained.

14. The method according to claim 13, characterized in that The method further comprises: Perform log auditing based on the access log and / or login log to determine whether the corresponding client device has abnormal behavior. If abnormal behavior exists, revoke the login token of the client device through the security gateway device.

15. A method for security management and control, characterized in that: The method is applied to a client device, comprising: After completing identity authentication, obtaining security configuration information from the security gateway device; According to the security configuration information, the corresponding terminal information is reported to the security gateway device, so that when the security gateway device receives an access request for the target application sent by a client device that has completed identity authentication, it determines whether it complies with the application access policy based on the security-related information of the client device, and releases or rejects the access request based on the judgment result, wherein the security-related information includes the terminal information.

16. A security gateway device for security management and control, characterized in that: The security gateway device comprises: A data transceiver module, used to obtain application access policies and security configuration information about target applications issued by a security management platform, and after the client device completes identity authentication, send the security configuration information to the client device, and obtain terminal information reported by the client device according to the security configuration information; A management and control processing module is used to determine whether an access request for the target application sent by a client device that has completed identity authentication complies with the application access policy based on the security-related information of the client device, and to release or reject the access request based on the judgment result; wherein the security-related information includes the terminal information.

17. A security management platform for security control, characterized in that: The security management platform includes: A configuration acquisition module, used to acquire application access policy and security configuration information about the target application configured by an administrator; A configuration sending module is used to send the application access policy and security configuration information to the security gateway device, so that the security gateway device sends the security configuration information to the client device after the client device completes identity authentication, and obtains the terminal information reported by the client device based on the security configuration information, and when receiving an access request for the target application sent by the client device that has completed identity authentication, determines whether it complies with the application access policy based on the security-related information of the client device, and releases or rejects the access request based on the judgment result, wherein the security-related information includes the terminal information.

18. A client device for security management, characterized in that: The client device comprises: A configuration acquisition module, used to obtain security configuration information from the security gateway device after completing identity authentication; An information reporting module is used to report corresponding terminal information to the security gateway device according to security configuration information, so that when the security gateway device receives an access request for the target application sent by a client device that has completed identity authentication, it can judge whether it complies with the application access policy based on the security-related information of the client device, and release or reject the access request based on the judgment result, and the security-related information includes the terminal information.

19. A computing device comprising a memory for storing computer program instructions and a processor for executing the computer program instructions, wherein: When the computer program instructions are executed by the processor, the device is triggered to execute the method according to any one of claims 1 to 15.

20. A computer readable medium having computer program instructions stored thereon, the computer program instructions being executable by a processor to implement the method of any one of claims 1 to 15.

Images