Intranet asset vulnerability scanning method, electronic equipment, storage medium and program product

Abstract

The invention provides an intranet asset vulnerability scanning method, electronic equipment, a storage medium and a program product. The method comprises the steps of receiving a vulnerability scanning request; the vulnerability scanning request comprises to-be-scanned asset information, and assets corresponding to the to-be-scanned asset information are intranet assets; determining an access terminal based on the to-be-scanned asset information; the access terminal is used for realizing communication connection between the cloud service platform and the intranet; determining a vulnerability scanner on the cloud service platform according to the access terminal; the vulnerability scanning flow is sent to the access terminal through the vulnerability scanner, so that the access terminal forwards the vulnerability scanning flow to assets corresponding to the to-be-scanned asset information, and vulnerability scanning of the assets is achieved. According to the embodiment of the invention, a communication channel between the cloud service platform and the intranet assets is opened through the access terminal, so that the purpose of performing vulnerability scanning on the intranet assets by using the vulnerability scanner on the cloud service platform is achieved.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to an intranet asset vulnerability scanning method, electronic device, storage medium and program product. Background Art

[0002] As enterprises' demand for digital transformation grows, cloud services meet their needs for efficient and convenient services with their flexibility, scalability, and cost-effectiveness. Based on the development of the cloud service industry, the cloud service business model is becoming the mainstream trend in the security service industry.

[0003] However, due to the particularity of the security industry, such as the vulnerability scanning business on the intranet, pure cloud solutions are limited by the network environment and cannot provide vulnerability scanning services. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide an intranet asset vulnerability scanning method, electronic device, storage medium and program product, so as to realize the scanning of vulnerabilities of intranet assets through a vulnerability scanning device on a cloud service platform.

[0005] In a first aspect, an embodiment of the present application provides an intranet asset vulnerability scanning method, which is applied to a cloud service platform. The method includes:

[0006] Receive a vulnerability scanning request; the vulnerability scanning request includes information about assets to be scanned, and the assets corresponding to the information about assets to be scanned are intranet assets;

[0007] Determine the access terminal based on the asset information to be scanned; the access terminal is used to achieve communication connection between the cloud service platform and the intranet;

[0008] Determine the vulnerability scanner on the cloud service platform based on the access terminal;

[0009] The vulnerability scanner sends vulnerability scanning traffic to the access terminal, so that the access terminal forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned, thereby realizing vulnerability scanning of the asset.

[0010] The embodiment of the present application opens up a communication channel between the cloud service platform and the intranet assets through an access terminal, thereby achieving the purpose of using the vulnerability scanner on the cloud service platform to scan the intranet assets for vulnerabilities.

[0011] In any embodiment, the method further comprises:

[0012] Receive a registration request sent by the waiting terminal, the registration request including an access code;

[0013] Verify the access code, and if the verification is passed, open the socks 5 proxy channel, and open the permission of the MQTT publish / subscribe topic between the terminal to be accessed and the server socks 5 proxy in the cloud service platform, so as to realize the communication between the server socks 5 proxy and the terminal to be accessed through the MQTT protocol;

[0014] Receive registration completion information of the waiting terminal, the registration completion information includes basic information of the waiting terminal and address information of the server socks 5 proxy corresponding to the waiting terminal;

[0015] The registration completion information is stored.

[0016] The embodiment of the present application standardizes the communication protocol between the access terminal and the cloud service platform through the MQTT protocol, and adopts the socks5 proxy to encrypt and forward the traffic between the access terminal and the cloud service platform, thereby improving the security during the vulnerability scanning process.

[0017] In any embodiment, sending vulnerability scanning traffic to the access terminal through the vulnerability scanner so that the access terminal forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned includes:

[0018] The vulnerability scanner sends vulnerability scanning traffic to the access terminal through the server-side socks5 proxy based on the MQTT protocol, so that the access terminal subscribes to the vulnerability scanning traffic through MQTT and forwards the vulnerability scanning traffic to the client-side socks 5 proxy, so that the client-side socks 5 proxy forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned.

[0019] The embodiment of the present application standardizes the communication protocol between the access terminal and the cloud service platform through the MQTT protocol, and adopts the socks5 proxy to encrypt and forward the traffic between the access terminal and the cloud service platform, thereby improving the security during the vulnerability scanning process.

[0020] In any embodiment, the method further comprises:

[0021] Receive heartbeat information sent by successfully registered access terminals.

[0022] In the embodiment of the present application, the access terminal periodically sends heartbeat information to the cloud service platform, so that the cloud service platform knows which access terminals are in normal working state. When performing vulnerability scanning, the access terminals in normal working state can be selected to improve the stability of vulnerability scanning.

[0023] In any embodiment, determining an access terminal based on the asset information to be scanned includes:

[0024] Based on the received heartbeat information, one terminal is selected from the terminals in the online state as an access terminal.

[0025] The embodiment of the present application determines the online access terminal through the heartbeat information. When performing vulnerability scanning, the access terminal in normal working state can be selected to improve the stability of vulnerability scanning.

[0026] In any embodiment, the method further comprises:

[0027] Obtain vulnerability scanner resources on the cloud service platform and terminal information of the terminal to be bound;

[0028] receiving a target vulnerability scanner selected from a vulnerability scanner resource;

[0029] Associate and store target vulnerability scanners with endpoint information.

[0030] The embodiment of the present application pre-binds the terminal with the vulnerability scanner, and once the access terminal is determined, the vulnerability scanner for performing vulnerability scanning on the intranet assets can be quickly determined.

[0031] In any embodiment, determining a vulnerability scanner on a cloud service platform according to an access terminal includes:

[0032] A vulnerability scanner having a binding relationship with the access terminal is determined from a pre-stored binding relationship table.

[0033] The embodiment of the present application can conveniently and quickly determine the vulnerability scanner through the pre-stored binding relationship table.

[0034] In a second aspect, an embodiment of the present application provides an intranet asset vulnerability scanning method, which is applied to an access terminal, where the access terminal and the intranet asset to be scanned are in the same local area network; the method includes:

[0035] Receive vulnerability scanning traffic sent by the cloud service platform through the vulnerability scanner; the access terminal is determined by the cloud service platform based on the received vulnerability scanning request; the vulnerability scanner and the access terminal have a binding relationship;

[0036] Send vulnerability scanning traffic to the intranet assets to be scanned to perform vulnerability scanning on the intranet assets to be scanned;

[0037] Receive the response information returned by the intranet assets to be scanned, and send the response information to the vulnerability scanner.

[0038] The embodiment of the present application opens up a communication channel between the cloud service platform and the intranet assets through an access terminal, thereby achieving the purpose of using the vulnerability scanner on the cloud service platform to scan the intranet assets for vulnerabilities.

[0039] In any embodiment, the method further comprises:

[0040] Send a registration request to the cloud service platform, the registration request includes an access code, so that the cloud service platform can open the socks 5 proxy channel after passing the verification based on the access code, and open the permission of the MQTT publish / subscribe topic between the waiting terminal and the server-side socks 5 proxy in the cloud service platform, so as to realize the communication between the server-side socks 5 proxy and the waiting terminal through the MQTT protocol;

[0041] After completing the registration, send the registration completion information to the cloud service platform, which includes the basic information of the waiting terminal and the address information of the server-side socks 5 proxy corresponding to the waiting terminal, so that the cloud service platform can store the registration completion information;

[0042] Receive the successful access information sent by the cloud service platform.

[0043] The embodiment of the present application standardizes the communication protocol between the access terminal and the cloud service platform through the MQTT protocol, and adopts the socks5 proxy to encrypt and forward the traffic between the access terminal and the cloud service platform, thereby improving the security during the vulnerability scanning process.

[0044] In any embodiment, receiving vulnerability scanning traffic sent by the cloud service platform through a vulnerability scanner includes:

[0045] Receive vulnerability scanning traffic sent by the vulnerability scanner through the server-side socks 5 proxy based on the MQTT protocol through the client-side socks 5 proxy;

[0046] Send vulnerability scanning traffic to the intranet assets to be scanned, including:

[0047] Send vulnerability scanning traffic to the intranet assets to be scanned through the client-side socks 5 proxy.

[0048] The embodiment of the present application standardizes the communication protocol between the access terminal and the cloud service platform through the MQTT protocol, and adopts the socks5 proxy to encrypt and forward the traffic between the access terminal and the cloud service platform, thereby improving the security during the vulnerability scanning process.

[0049] In either embodiment, the access terminal is a lightweight access terminal.

[0050] The embodiment of the present application opens up a communication channel between a cloud service platform and intranet assets through a lightweight access terminal, thereby reducing user costs and improving service experience.

[0051] In a third aspect, an embodiment of the present application provides an intranet asset vulnerability scanning device, which is applied to a cloud service platform. The device includes:

[0052] A request receiving module is used to receive a vulnerability scanning request; the vulnerability scanning request includes asset information to be scanned, and the asset corresponding to the asset information to be scanned is an intranet asset;

[0053] The terminal determination module is used to determine the access terminal based on the asset information to be scanned; the access terminal is used to realize the communication connection between the cloud service platform and the intranet;

[0054] A scanner determination module, used to determine the vulnerability scanner on the cloud service platform according to the access terminal;

[0055] The traffic sending module is used to send vulnerability scanning traffic to the access terminal through the vulnerability scanner, so that the access terminal forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned, so as to realize vulnerability scanning of the asset.

[0056] In a fourth aspect, an embodiment of the present application provides another intranet asset vulnerability scanning device, which is applied to an access terminal, and the access terminal and the intranet asset to be scanned are in the same local area network; the device includes:

[0057] The traffic receiving module is used to receive the vulnerability scanning traffic sent by the cloud service platform through the vulnerability scanner; the access terminal is determined by the cloud service platform based on the received vulnerability scanning request; the vulnerability scanner and the access terminal have a binding relationship;

[0058] Traffic forwarding module, used to send vulnerability scanning traffic to the intranet assets to be scanned, so as to implement vulnerability scanning for the intranet assets to be scanned;

[0059] The response information receiving module is used to receive the response information returned by the intranet asset to be scanned, and send the response information to the vulnerability scanner.

[0060] In a fifth aspect, an embodiment of the present application provides an electronic device, including: a processor, a memory, and a bus, wherein:

[0061] The processor and the memory communicate with each other via the bus;

[0062] The memory stores program instructions that can be executed by the processor, and the processor can execute the method of the first aspect or the second aspect by calling the program instructions.

[0063] In a sixth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium, including:

[0064] The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the method of the first aspect or the second aspect.

[0065] In a seventh aspect, an embodiment of the present application provides a computer program product, comprising computer program instructions, which, when read and executed by a processor, execute the method of the first aspect or the second aspect.

[0066] In an eighth aspect, an embodiment of the present application provides an intranet asset vulnerability scanning system, comprising a cloud service platform and an access terminal; the cloud service platform and the access terminal are in communication connection; the access terminal and the intranet asset to be scanned are in the same local area network;

[0067] The cloud service platform is used to execute the method described in the first aspect;

[0068] The access terminal is used to execute the method described in the second aspect.

[0069] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the embodiments of the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0071] Figure 1 A schematic diagram of a flow chart of an intranet asset vulnerability scanning method provided in an embodiment of the present application;

[0072] Figure 2 A schematic diagram of a process of accessing a cloud service platform by an access terminal provided in an embodiment of the present application;

[0073] Figure 3 A schematic diagram of vulnerability scanning traffic forwarding provided in an embodiment of the present application;

[0074] Figure 4 A schematic diagram of a method for binding an access terminal and a vulnerability scanner provided in an embodiment of the present application;

[0075] Figure 5 A schematic diagram of another intranet asset vulnerability scanning method provided in an embodiment of the present application;

[0076] Figure 6 A flowchart of another intranet asset vulnerability scanning method provided in an embodiment of the present application;

[0077] Figure 7A schematic diagram of a method for scanning vulnerabilities of intranet assets in a specific scenario provided by an embodiment of the present application;

[0078] Figure 8 A schematic diagram of the structure of an intranet asset vulnerability scanning device provided in an embodiment of the present application;

[0079] Fig. 9 A schematic diagram of the structure of another intranet asset vulnerability scanning device provided in an embodiment of the present application;

[0080] Fig.10 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0081] The following embodiments of the technical solution of the present application are described in detail in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present application, and are therefore only used as examples, and cannot be used to limit the scope of protection of the present application.

[0082] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0083] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0084] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0085] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0086] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).

[0087] In the description of the embodiments of the present application, unless otherwise clearly specified and limited, technical terms such as "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the embodiments of the present application can be understood according to the specific circumstances.

[0088] In order to facilitate the understanding of the solution of this application, the relevant terms involved are now explained:

[0089] MQTT protocol (Message Queuing Telemetry Transport): is a "lightweight" messaging protocol based on the publish / subscribe paradigm, which is built on the TCP / IP protocol.

[0090] The working principle of the MQTT protocol is based on a publish / subscribe model, where devices (clients) publish data to specific topics, and other devices (servers) can subscribe to these topics to receive data. The three key roles in the MQTT protocol include:

[0091] Publisher: Responsible for publishing messages to a specific Topic.

[0092] Subscriber: Receives messages by subscribing to a specific Topic.

[0093] Broker: Located between the publisher and the subscriber, it is responsible for receiving messages from the publisher and forwarding the messages to the corresponding subscribers based on the subscriber's subscription information.

[0094] Access specifications: specifications for implementing terminal device access to the cloud based on the MQTT protocol, describing the transmission data format, MQTT Topic specifications, etc.

[0095] Proxy specification: Implement the Socks 5 proxy specification based on the MQTT protocol, describing the transmission data format, MQTT Topic specification, etc.

[0096] Cloud service platform: An online service platform that provides security business capabilities, with characteristics such as ultra-large scale, high reliability and versatility. A vulnerability scanning resource pool is set up in the cloud service platform.

[0097] Vulnerability scanning resource pool: A resource pool consisting of multiple vulnerability scanners, located in the cloud, can provide comprehensive scanning capabilities, covering different types of security vulnerability detection to improve the overall security protection level.

[0098] Vulnerability scanning resource group: You can select multiple vulnerability scanners from the vulnerability scanning resource pool.

[0099] Vulnerability scanner: A security tool used to automatically detect security vulnerabilities in computer systems, networks, or web applications, helping users identify and fix potential security threats. The scanner needs to support Socks 5 proxy.

[0100] Lightweight vulnerability scanning terminal: A lightweight vulnerability scanning terminal whose main function is to establish a secure communication channel between the cloud and intranet assets, realize encrypted data transmission through the Socks 5 proxy function, and ensure communication security, but it does not have direct scanning capabilities.

[0101] Socks 5 (Socket Secure version 5) proxy: is a protocol for proxy servers to handle data traffic, routing Internet traffic through proxy servers. The proxy server generates a random IP address before reaching the destination, acting as an intermediary between the client and the server, forwarding the client's request to the server on the Internet, thereby achieving data relay transmission. In this process, the user's real IP address is hidden, enhancing privacy protection.

[0102] Considering the security of intranet assets, cloud service platforms can usually only perform vulnerability scans on assets on the public network, but cannot perform vulnerability scans on intranet assets. To address this problem, an embodiment of the present application provides a method for scanning vulnerabilities of intranet assets, which opens up a communication channel between the cloud service platform and the intranet assets through an access terminal in the same local area network as the intranet, thereby realizing vulnerability scanning of intranet assets using the cloud service platform.

[0103] Figure 1 A schematic diagram of a method for scanning vulnerabilities of intranet assets provided in an embodiment of the present application is shown in FIG. Figure 1As shown, the method is applied to a cloud service platform. A cloud service platform is an Internet-based computing service that helps enterprises and individuals quickly build, deploy, and manage applications and data by providing computing, storage, network, and other infrastructure and services. The embodiment of the present application can provide customers with network resources, storage resources, computing resources, vulnerability scanning resources, and the like based on SaaS cloud services. Customers only need to access applications over the network without having to install and maintain software locally. It should be noted that the embodiment of the present application can also be applied to other types of cloud service platforms, such as IaaS, PaaS, and the like.

[0104] The method includes:

[0105] Step 101: Receive a vulnerability scanning request.

[0106] The vulnerability scanning request includes the asset information to be scanned. The asset to be scanned corresponds to the intranet asset. The asset information to be scanned is used to indicate which intranet asset the cloud service platform is to scan. For example, it can be a web address, or the IP address or MAC address of a host. Users can log in to the cloud service platform and enter the asset information to be scanned in the vulnerability scanning task management of the cloud service platform, and then the cloud service platform generates a vulnerability scanning request for it.

[0107] Step 102: Determine an access terminal based on the asset information to be scanned; the access terminal is used to achieve communication connection between the cloud service platform and the intranet.

[0108] The access terminal is connected to the intranet and is in the same LAN as the assets to be scanned. The access terminal can be an ordinary terminal, such as a PC, laptop, tablet, wearable device, etc.; it can also be a lightweight terminal, such as a USB flash drive, or even an executable file. If it is a USB flash drive, it can be plugged into one of the servers or hosts in the intranet. If it is an executable file, it can be run on one of the servers or hosts in the intranet. The lightweight terminal implements the Socks 5 proxy according to the communication access specification of the cloud service platform. The specific protocol specification will be introduced in the terminal access sub-process. The lightweight terminal can be in the form of a pluggable USB flash drive or an executable file. The terminal size is controlled as much as possible. It can be implemented in languages ​​such as python and go. The terminal itself does not have scanning capabilities, but only maintains a secure and reliable socks 5 proxy channel based on the MQTT protocol. The channel is used to proxy and forward vulnerability scanning requests from the cloud scanner to break the separation between the cloud and the intranet.

[0109] Since there may be multiple access terminals connected to the intranet, and the access terminal may be removed from the intranet at any time, after receiving the vulnerability scanning request, the cloud service platform determines the intranet corresponding to the asset to be scanned and obtains the access terminal that is online in the intranet. If there are multiple online access terminals, any one can be selected.

[0110] It should be noted that the access terminal is pre-security verified and registered by the cloud service platform. The access terminal that has passed the security verification and completed the registration can communicate with the cloud service platform, receive data from the cloud service platform, and forward it to the intranet, and can also forward the data of the intranet to the cloud service platform.

[0111] Step 103: Determine a vulnerability scanner on the cloud service platform according to the access terminal.

[0112] In the specific implementation process, the vulnerability scanner resource pool is a collection of vulnerability scanners built in the cloud. This resource pool is used to provide vulnerability scanning services to users. Its main features are sufficient computing power, centralized cloud management, and distributed vulnerability scanning capabilities, which avoid the use of local computing resources and reduce the user's own operating and maintenance costs.

[0113] The vulnerability scanner can be a separate vulnerability scanner in the vulnerability scanning resource pool, or one of the vulnerability scanners in the vulnerability scanning resource group in the vulnerability scanning resource pool. Each access terminal can be pre-bound with a vulnerability scanner or vulnerability scanning resource group in the cloud service platform. After the access terminal is determined, the vulnerability scanner used to scan vulnerabilities of intranet assets can be located based on the binding relationship.

[0114] The cloud service platform may also temporarily allocate a vulnerability scanner to the access terminal after receiving a vulnerability scanning request and determining the access terminal, and bind the allocated vulnerability scanner to the access terminal. When allocating a vulnerability scanner, the selection may be based on the type of vulnerability to be scanned, the scanning load of the vulnerability scanner, etc. After completing the scanning of the intranet assets, the binding relationship between the access terminal and the vulnerability scanner may be released.

[0115] Step 104: Send vulnerability scanning traffic to the access terminal through the vulnerability scanner, so that the access terminal forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned, so as to implement vulnerability scanning of the asset.

[0116] After the vulnerability scanner is determined, the vulnerability scanner sends the vulnerability scanning traffic to the access terminal. After receiving the vulnerability scanning traffic, the access terminal forwards the vulnerability scanning traffic to the corresponding intranet assets to implement vulnerability scanning of the intranet assets.

[0117] The embodiment of the present application opens up a communication channel between the cloud service platform and the intranet assets through an access terminal, thereby achieving the purpose of using the vulnerability scanner on the cloud service platform to scan vulnerabilities in the intranet assets. In addition, since the access terminal and the intranet assets are in the same local area network, the access terminal is considered to be trustworthy, thereby meeting the security requirements of the intranet assets.

[0118] Based on the above embodiment, the method further includes:

[0119] Receive a registration request sent by the waiting terminal, the registration request including an access code;

[0120] Verify the access code, and if the verification is passed, open the socks 5 proxy channel, and open the permission of the MQTT publish / subscribe topic between the terminal to be accessed and the server socks 5 proxy in the cloud service platform, so as to realize the communication between the server socks 5 proxy and the terminal to be accessed through the MQTT protocol;

[0121] Receive registration completion information of the waiting terminal, the registration completion information includes basic information of the waiting terminal and address information of the server socks 5 proxy corresponding to the waiting terminal;

[0122] The registration completion information is stored.

[0123] Among them, the MQTT protocol constraints are as follows:

[0124] 1. MQTT needs to be encrypted using TLS / SSL security protocol. By using encryption algorithms, network communications are protected from eavesdropping and tampering to ensure the security of data transmission.

[0125] 2. Use certificates to implement two-way authentication between the client and the server to ensure the credibility of the terminal; both parties have a pair of public and private keys. When establishing a connection, the two parties exchange certificates and verify each other's certificates to ensure that both parties in the communication are authenticated and trusted entities.

[0126] 3. The data transmission service quality must be QoS2 to ensure the reliability of data transmission. QoS2 is the service quality specified by the MQTT protocol, and 2 is the best level to ensure successful data release.

[0127] 4. The MQTT channel transmits data in Protocol Buffers (v3) format, which effectively reduces the transmission volume (90% space saving compared to JSON and binary after serialization), and the structure is platform-independent and applicable.

[0128] Figure 2 A schematic diagram of a process of accessing a cloud service platform provided by an access terminal in an embodiment of the present application is as follows: Figure 2 As shown, including:

[0129] Step 201: Initialize the terminal and start the socks5 proxy service;

[0130] Step 202: The terminal initiates a registration request; after the terminal to be entered completes initialization, a lightweight executable program implemented in Python or Go language can be used. The user applies for a terminal access code (i.e., authentication information) on the cloud service platform. The terminal access code has a validity period and is bound to the user information (using the user's work number, etc.). The terminal to be entered carries the authentication information and the collected basic information of the server where the terminal to be entered is located (terminal type, mac address, server type, terminal unique code, etc., the terminal unique code is to distinguish terminals from duplication) and initiates a registration request to the cloud service platform through the MQTT protocol, and starts the local Socks 5 proxy service.

[0131] Step 203: The cloud service platform performs access authentication; after the registration request reaches the cloud service platform, the cloud service terminal authentication module verifies whether the access code is legal. The verification includes checking the access code format, whether the access code is within the validity period, whether the terminal type is compliant, etc., to ensure that the terminal to be entered is legal and valid. If it is illegal, the registration fails. If it is legal, it enters the Socks 5 proxy dedicated channel opening process.

[0132] Step 204: Open the dedicated channel of socks5 proxy; after the access verification is successful, the cloud service platform releases the MQTT Topic publish / subscribe permissions required by the waiting terminal and the server-side Socks 5 proxy; the waiting terminal and the server-side Socks 5 proxy are allowed to access the corresponding Topic to publish and subscribe to data. The Topic naming specification carries the unique code of the waiting terminal to distinguish the Topics of different waiting terminals and realize Topic isolation of data transmission.

[0133] Step 205: Enable the socks5 service. After the MQTT Socks 5 Topic permission is enabled, the server will start a Socks 5 proxy with a random port to expose the Socks 5 service. Since the number of ports is limited, you can use K8s and other technical solutions to implement multiple IPs.

[0134] Step 206: The server starts listening to the socks5 MQTT topic. After Socks 5 is started, the cloud needs to start publishing / subscribing to the MQTT topic that the Socks 5 proxy needs to use, so as to forward the traffic of the server's Socks 5 service interface to the incoming terminal through MQTT, and return the response traffic sent by the terminal to the server's Socks 5 service. In this way, the Socks 5over MQTT protocol is implemented, and the users of Socks 5 cannot perceive the existence of MQTT.

[0135] Step 207: Terminal registration: The waiting terminal records basic terminal information and exclusive channel information, and sends registration completion information to the cloud service platform.

[0136] Step 208: The cloud service platform notifies the terminal to open the MQTT socks5 channel; the cloud service platform notifies the waiting terminal through the MQTT protocol that it has been successfully admitted, and can open the MQTT Topic publish / subscribe required by the client Socks 5 proxy. At this time, the waiting terminal can be called an access terminal. In this way, the client socks5 on the access terminal can subscribe to the socks 5 traffic sent by the cloud service platform to the client socks5 proxy service, and send the response of the client socks5 proxy service to the server socks5 proxy service through MQTT.

[0137] Step 209: Continuously maintain the terminal online status: the access terminal periodically sends heartbeat information to the cloud service platform to determine whether the access terminal is online. If the cloud service platform does not receive the heartbeat information sent by the access terminal within a preset time, the access terminal is considered offline.

[0138] The embodiment of the present application standardizes the communication protocol between the access terminal and the cloud service platform through the MQTT protocol, and adopts the socks5 proxy to encrypt and forward the traffic between the access terminal and the cloud service platform, thereby improving the security during the vulnerability scanning process.

[0139] Based on the above embodiment, the vulnerability scanner sends vulnerability scanning traffic to the access terminal, so that the access terminal forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned, including:

[0140] The vulnerability scanner sends vulnerability scanning traffic to the access terminal through the server-side sock5 proxy based on the MQTT protocol, so that the access terminal subscribes to the vulnerability scanning traffic through MQTT and forwards the vulnerability scanning traffic to the client socks 5 proxy, so that the client socks 5 proxy forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned.

[0141] In the specific implementation process, Figure 3 A schematic diagram of vulnerability scanning traffic forwarding provided in an embodiment of the present application is shown in FIG. Figure 3As shown. After the access terminal completes registration, the client socks5 proxy service is turned on on the intranet side, and the server socks5 proxy service is turned on on the cloud service platform side. The vulnerability scanner forwards the vulnerability scanning traffic to the access terminal through the server socks5 proxy. Among them, during the forwarding process, the specifications of the MQTT protocol are followed. The access terminal subscribes to relevant traffic through MQTT, sends the vulnerability scanning traffic to the client socks5 proxy service, and the client socks5 proxy service then sends the vulnerability scanning traffic to the intranet resources to perform vulnerability scans on the intranet resources. It can be understood that the scan result data is also forwarded to the server socks5 proxy service through the client socks5 proxy, and then the server socks5 proxy sends the scan result data to the vulnerability scanner.

[0142] The embodiment of the present application standardizes the communication protocol between the access terminal and the cloud service platform through the MQTT protocol, adopts the socks5 proxy to encrypt and forward the traffic between the access terminal and the cloud service platform, improves the security during the vulnerability scanning process, and adopts a cloud service model that focuses on the cloud and light on the client to realize vulnerability scanning of intranet assets, reduce user costs, and improve cloud service experience.

[0143] Based on the above embodiment, the method further includes:

[0144] Obtain vulnerability scanner resources on the cloud service platform and terminal information of the terminal to be bound;

[0145] receiving a target vulnerability scanner selected from a vulnerability scanner resource;

[0146] Associate and store target vulnerability scanners with endpoint information.

[0147] In the specific implementation process, the binding of the access terminal and the vulnerability scanner is to associate and bind the lightweight terminal with the resource group in the vulnerability scanner resource pool in the cloud or the specific scanner. The bound scanner can use the Socket5 channel of the terminal to realize intranet vulnerability scanning. Figure 4 A schematic diagram of a method for binding an access terminal and a vulnerability scanner provided in an embodiment of the present application is shown in FIG. Figure 4 shown.

[0148] include:

[0149] Step 401: Obtain scanner resources; obtain cloud vulnerability scanning resource groups, vulnerability scanners, and terminal information, wherein vulnerability scanning resource groups and vulnerability scanners are differentiated by type, some vulnerability scanning resource groups and vulnerability scanners are used to scan web assets, and some vulnerability scanning resource groups and vulnerability scanners are used to scan host assets, etc. The vulnerability scanning resource group is composed of multiple independent vulnerability scanners, which can exert parallel capabilities and improve the efficiency of vulnerability scanning.

[0150] Step 402: Obtain terminal information: Obtain basic information of the access terminal and the corresponding server socks 5 address, which is one-to-one with the access terminal. The basic information of the access terminal may include terminal type, MAC address, terminal unique code, etc.

[0151] Step 403: Determine whether the terminal is online; the cloud service platform determines whether the access terminal is online based on the received heartbeat information. If the access terminal to be bound is online, step 404 may be executed; otherwise, the binding process ends.

[0152] Step 404: Bind the relationship between the terminal and the scanner: the user logs in to the cloud service platform, selects the vulnerability scanner bound to the access terminal, and binds the two. Specifically, the binding method can associate the primary key through the relationship table. The binding relationship between the two can also be stored in the binding relationship table.

[0153] Step 405: Monitor the terminal status to determine whether the binding relationship is available; if the terminal is offline, it indicates that the binding relationship cannot be used, and the vulnerability scanner cannot forward the vulnerability scanning traffic to the intranet assets through the access terminal.

[0154] The embodiment of the present application pre-binds the terminal with the vulnerability scanner, and once the access terminal is determined, the vulnerability scanner for performing vulnerability scanning on the intranet assets can be quickly determined.

[0155] After the binding between the access terminal and the vulnerability scanner is completed, when the access terminal is determined, the vulnerability scanner having a binding relationship with the access terminal can be determined from the pre-stored binding relationship table. The embodiment of the present application can conveniently and quickly determine the vulnerability scanner through the pre-stored binding relationship table.

[0156] Figure 5 A flowchart of another intranet asset vulnerability scanning method provided in an embodiment of the present application is shown as follows: Figure 5 As shown, the method is applied to an access terminal, which is in the same local area network as the intranet asset to be scanned, and the access terminal is pre-registered on the cloud service platform. It can be understood that the access terminal can be a common terminal or a lightweight terminal. The method includes:

[0157] Step 501: receiving vulnerability scanning traffic sent by the cloud service platform through the vulnerability scanner; the access terminal is determined by the cloud service platform based on the received vulnerability scanning request; the vulnerability scanner and the access terminal have a binding relationship;

[0158] Step 502: Send vulnerability scanning traffic to the intranet asset to be scanned, so as to perform vulnerability scanning on the intranet asset to be scanned;

[0159] Step 503: Receive response information returned by the intranet asset to be scanned, and send the response information to the vulnerability scanner.

[0160] In the specific implementation process, the user enters the asset information to be scanned in the vulnerability scanning task management of the cloud service platform, and then the cloud service platform generates a vulnerability scanning request for it. Based on the vulnerability scanning request, the cloud service platform screens the available access terminals, and after determining the access terminal, it determines the vulnerability scanner that has a binding relationship with the access terminal. The cloud service platform sends a vulnerability scanning task to the vulnerability scanner, and the vulnerability scanner sends vulnerability scanning traffic to the intranet assets to be scanned. The vulnerability scanning traffic is used to scan vulnerabilities in the intranet assets. When sending vulnerability scanning traffic, the vulnerability scanner first sends the vulnerability scanning traffic to the access terminal, and the access terminal forwards the vulnerability scanning traffic to the intranet assets. In addition, the receiving terminal can also forward the response information of the intranet assets to the vulnerability scanner.

[0161] The embodiment of the present application opens up a communication channel between the cloud service platform and the intranet assets through an access terminal, thereby achieving the purpose of using the vulnerability scanner on the cloud service platform to scan the intranet assets for vulnerabilities.

[0162] On the basis of the above embodiment, a registration request is sent to the cloud service platform, and the registration request includes an access code, so that the cloud service platform can open the socks 5 proxy channel after the access code verification is passed, and open the permission of the MQTT publish / subscribe topic between the waiting terminal and the server-side socks 5 proxy in the cloud service platform, so as to realize the communication between the server-side socks 5 proxy and the waiting terminal through the MQTT protocol;

[0163] After completing the registration, send the registration completion information to the cloud service platform, which includes the basic information of the waiting terminal and the address information of the server-side socks 5 proxy corresponding to the waiting terminal, so that the cloud service platform can store the registration completion information;

[0164] Receive the successful access information sent by the cloud service platform.

[0165] It should be noted that the specific process of the terminal accessing the cloud service platform can be found in the above embodiment and will not be repeated here.

[0166] The embodiment of the present application standardizes the communication protocol between the access terminal and the cloud service platform through the MQTT protocol, and adopts the socks5 proxy to encrypt and forward the traffic between the access terminal and the cloud service platform, thereby improving the security during the vulnerability scanning process.

[0167] Based on the above embodiment, receiving vulnerability scanning traffic sent by the cloud service platform through the vulnerability scanner includes:

[0168] Receive vulnerability scanning traffic sent by the vulnerability scanner through the server-side socks 5 proxy based on the MQTT protocol through the client-side socks 5 proxy;

[0169] Send vulnerability scanning traffic to the intranet assets to be scanned, including:

[0170] Send vulnerability scanning traffic to the intranet assets to be scanned through the client-side socks 5 proxy.

[0171] It should be noted that the specific process of the access terminal receiving vulnerability scanning traffic can be found in the above embodiment and will not be repeated here.

[0172] The embodiment of the present application standardizes the communication protocol between the access terminal and the cloud service platform through the MQTT protocol, and adopts the socks5 proxy to encrypt and forward the traffic between the access terminal and the cloud service platform, thereby improving the security during the vulnerability scanning process.

[0173] Figure 6 A flowchart of another intranet asset vulnerability scanning method provided in an embodiment of the present application is shown as follows: Figure 6 As shown, the method includes:

[0174] Step 601: Create a scanning task: the user logs in to the cloud service platform and enters the asset information to be scanned in the cloud service platform, such as the web address of the intranet, and creates a scanning task based on the entered asset information to be scanned.

[0175] Step 602: Select a vulnerability scanning terminal; obtain registered terminal data, verify whether the terminal device is online, whether it is bound to a vulnerability scanner, and determine whether the server-side socks 5 service is available. Select an access terminal that is online, bound to a vulnerability scanner, and has an available server-side socks5 service.

[0176] Step 603: Send the scanning task to the vulnerability scanner and specify the proxy export address; the cloud service platform will match the bound vulnerability scanner or scanner resource group according to the selected terminal device to send the task, and when sending the task, specify the scanner to use the server-side Socks5 proxy associated with the terminal for scanning. Among them, the scanner resource group can use a distributed method to select a specific vulnerability scanner to achieve task load and improve scanning performance.

[0177] Step 604: Perform vulnerability scanning through the terminal proxy channel; the vulnerability scanning traffic will be forwarded to the access terminal through the server-side Socks 5 based on the MQTT protocol. The access terminal subscribes to the relevant traffic through MQTT and forwards the traffic to the client-side Socks 5 service, thereby enabling the cloud-based vulnerability scanner to perform vulnerability scanning on the user's intranet.

[0178] Step 605: Scan result management; the scan result is forwarded to the Socks5 service on the server side through MQTT via the client Socks 5 response traffic, and finally returned to the vulnerability scanning server and stored in the cloud service platform.

[0179] Figure 7 A schematic diagram of a method for scanning vulnerabilities of intranet assets in a specific scenario provided by an embodiment of the present application is shown in FIG. Figure 7 As shown, the embodiment of the present application can be applied to provide a cloud service version of vulnerability scanning business, using the SaaS cloud service method to reduce local computing resources and realize the user intranet vulnerability scanning service.

[0180] In the cloud service vulnerability scanning business, users can install a lightweight access terminal A in the intranet environment. The access terminal can be a small executable program. The access code is obtained through the cloud service terminal management, and the access terminal is registered and accessed based on the access code. After successful registration, the user can view terminal A in the terminal management. At this time, terminal A has a built-in client Socks 5 service that only the terminal can access. Correspondingly, there is a server-side Socks 5 service corresponding to access terminal A on the server side.

[0181] The user binds access terminal A to vulnerability scanner resources in terminal management, and binds access terminal A to vulnerability scanner B (or vulnerability scanner resource group) through logical association. The specific vulnerability scanner can be quickly determined through the access terminal. If it is a resource group, load balancing or polling strategies can be used to determine a vulnerability scanner.

[0182] The user enters the intranet assets to be scanned in the vulnerability scanning task management and creates a scanning task. When issuing the task, select access terminal A. At this time, the platform quickly locates vulnerability scanner B based on the selected terminal, and obtains the corresponding server Socks 5 address based on terminal A, and sends it to the vulnerability scanner with the above parameters (the vulnerability scanner needs to support Socks5 proxy).

[0183] The vulnerability scanner scanning task traffic will pass through the server Socks 5->MQTT->client Socks5, and finally forwarded to the intranet, so as to use the cloud vulnerability scanning resources to scan the assets of the intranet. After the scan, the results will be summarized to the cloud service platform, and users can view the scan results through the cloud service platform.

[0184] The embodiments of the present application have the following beneficial effects:

[0185] Unified communication protocol: The network channel required for vulnerability scanning can be built based on the cloud service IoT MQTT communication protocol, and the protocol remains unchanged;

[0186] Lightweight access terminal: Lightweight access terminal is used to quickly and easily open the network channel between cloud service and intranet, which reduces the cost of user use.

[0187] Low local resource consumption: Use the cloud to build a vulnerability scanning server resource pool for service. The cloud is responsible for providing computing resources, reducing user-side usage and resource costs, and providing users with a true cloud service experience.

[0188] Intranet vulnerability scanning service based on cloud service: It breaks through the barriers between the intranet and the Internet and can provide intranet vulnerability scanning services for the cloud service platform.

[0189] Figure 8 The following is a schematic diagram of the structure of an intranet asset vulnerability scanning device provided in an embodiment of the present application. The device may be a module, program segment or code on an electronic device. It should be understood that the device is similar to the above-mentioned Figure 1 The method embodiment corresponds to and can be executed Figure 1 The various steps involved in the method embodiment and the specific functions of the device can be found in the above description. To avoid repetition, detailed description is appropriately omitted here. The device includes: a request receiving module 801, a terminal determination module 802, a scanner determination module 803 and a traffic sending module 804, wherein:

[0190] The request receiving module 801 is used to receive a vulnerability scanning request; the vulnerability scanning request includes asset information to be scanned, and the asset corresponding to the asset information to be scanned is an intranet asset;

[0191] The terminal determination module 802 is used to determine the access terminal based on the asset information to be scanned; the access terminal is used to realize the communication connection between the cloud service platform and the intranet;

[0192] The scanner determination module 803 is used to determine the vulnerability scanner on the cloud service platform according to the access terminal;

[0193] The traffic sending module 804 is used to send vulnerability scanning traffic to the access terminal through the vulnerability scanner, so that the access terminal forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned, so as to realize vulnerability scanning of the asset.

[0194] Based on the above embodiment, the device further includes a first registration module, which is used to:

[0195] Receiving a registration request sent by a waiting terminal, wherein the registration request includes an access code;

[0196] Verify the access code, and if the verification is passed, open the socks 5 proxy channel, and open the permission of the MQTT publish / subscribe topic between the terminal to be entered and the server-side socks 5 proxy in the cloud service platform, so as to realize the communication between the server-side socks 5 proxy and the terminal to be entered through the MQTT protocol;

[0197] Receive registration completion information of the waiting terminal, wherein the registration completion information includes basic information of the waiting terminal and address information of a server-side socks 5 proxy corresponding to the waiting terminal;

[0198] The registration completion information is stored.

[0199] Based on the above embodiment, the traffic sending module 804 is specifically used for:

[0200] The vulnerability scanner sends the vulnerability scanning traffic to the access terminal through the server-side sock5 proxy based on the MQTT protocol, so that the access terminal subscribes to the vulnerability scanning traffic through MQTT and forwards the vulnerability scanning traffic to the client-side socks 5 proxy, so that the client-side socks 5 proxy forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned.

[0201] On the basis of the above embodiment, the device further includes a heartbeat information receiving module, which is used to:

[0202] Receive heartbeat information sent by successfully registered access terminals.

[0203] Based on the above embodiment, the terminal determination module 802 is specifically used for:

[0204] Based on the received heartbeat information, one terminal is selected from the terminals in the online state as the access terminal.

[0205] Based on the above embodiment, the device further includes a binding module, which is used to:

[0206] Obtain vulnerability scanner resources on the cloud service platform and terminal information of the terminal to be bound;

[0207] receiving a target vulnerability scanner selected from the vulnerability scanner resource;

[0208] The target vulnerability scanner is associated with the terminal information and stored.

[0209] Based on the above embodiment, the scanner determination module 803 is specifically used for:

[0210] The vulnerability scanner having a binding relationship with the access terminal is determined from a pre-stored binding relationship table.

[0211] Fig. 9 This is a schematic diagram of another intranet asset vulnerability scanning device provided in an embodiment of the present application. The device may be a module, program segment or code on an electronic device. It should be understood that the device is similar to the above-mentioned Figure 5 The method embodiment corresponds to and can be executed Figure 5 The various steps involved in the method embodiment and the specific functions of the device can be found in the above description. To avoid repetition, detailed description is appropriately omitted here. The device includes: a traffic receiving module 901, a traffic forwarding module 902 and a response information receiving module 903, wherein:

[0212] The traffic receiving module 901 is used to receive vulnerability scanning traffic sent by the cloud service platform through the vulnerability scanner; the access terminal is determined by the cloud service platform based on the received vulnerability scanning request; the vulnerability scanner and the access terminal have a binding relationship;

[0213] The traffic forwarding module 902 is used to send vulnerability scanning traffic to the intranet assets to be scanned, so as to implement vulnerability scanning for the intranet assets to be scanned;

[0214] The response information receiving module 903 is used to receive the response information returned by the intranet asset to be scanned, and send the response information to the vulnerability scanner.

[0215] Based on the above embodiment, the device further includes a second registration module, which is used to:

[0216] Sending a registration request to the cloud service platform, wherein the registration request includes an access code, so that the cloud service platform opens a socks 5 proxy channel after passing the verification based on the access code, and opens the permission of the MQTT publish / subscribe topic between the terminal to be connected and the server-side socks 5 proxy in the cloud service platform, so as to realize the communication between the server-side socks 5 proxy and the terminal to be connected through the MQTT protocol;

[0217] After completing the registration, send the registration completion information to the cloud service platform, the registration completion information includes the basic information of the waiting terminal and the address information of the server-side socks 5 proxy corresponding to the waiting terminal, so that the cloud service platform stores the registration completion information;

[0218] Receive the access success information sent by the cloud service platform.

[0219] Based on the above embodiment, the traffic receiving module 901 is specifically used for:

[0220] Receiving the vulnerability scanning traffic sent by the vulnerability scanner through the server-side socks 5 proxy based on the MQTT protocol through the client-side socks 5 proxy;

[0221] Sending the vulnerability scanning traffic to the intranet asset to be scanned includes:

[0222] The vulnerability scanning traffic is sent to the intranet assets to be scanned through the client socks 5 proxy.

[0223] Based on the above embodiment, the access terminal is a lightweight access terminal.

[0224] Fig.10 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present application, such as Fig.10 As shown, the electronic device includes: a processor (processor) 1001, a memory (memory) 1002 and a bus 1003; wherein,

[0225] The processor 1001 and the memory 1002 communicate with each other via the bus 1003;

[0226] The processor 1001 is used to call the program instructions in the memory 1002 to execute the methods provided by the above-mentioned method embodiments, for example, including: receiving a vulnerability scanning request; the vulnerability scanning request includes asset information to be scanned, and the asset corresponding to the asset information to be scanned is an intranet asset; determining an access terminal based on the asset information to be scanned; the access terminal is used to realize the communication connection between the cloud service platform and the intranet; determining the vulnerability scanner on the cloud service platform according to the access terminal; sending vulnerability scanning traffic to the access terminal through the vulnerability scanner, so that the access terminal forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned, so as to realize vulnerability scanning of the asset. Or,

[0227] Receive vulnerability scanning traffic sent by the cloud service platform through the vulnerability scanner; the access terminal is determined by the cloud service platform based on the received vulnerability scanning request; the vulnerability scanner and the access terminal have a binding relationship; send the vulnerability scanning traffic to the intranet assets to be scanned to realize vulnerability scanning of the intranet assets to be scanned; receive response information returned by the intranet assets to be scanned, and send the response information to the vulnerability scanner.

[0228] The processor 1001 may be an integrated circuit chip with signal processing capabilities. The processor 1001 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. It may implement or execute various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0229] The memory 1002 may include but is not limited to random access memory (RAM), read only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable read-only memory (EEPROM), etc.

[0230] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments, for example, including: receiving a vulnerability scanning request; the vulnerability scanning request includes asset information to be scanned, and the asset corresponding to the asset information to be scanned is an intranet asset; determining an access terminal based on the asset information to be scanned; the access terminal is used to achieve a communication connection between the cloud service platform and the intranet; determining a vulnerability scanner on the cloud service platform according to the access terminal; and sending vulnerability scanning traffic to the access terminal through the vulnerability scanner, so that the access terminal forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned, so as to achieve vulnerability scanning of the asset. Or,

[0231] Receive vulnerability scanning traffic sent by the cloud service platform through the vulnerability scanner; the access terminal is determined by the cloud service platform based on the received vulnerability scanning request; the vulnerability scanner and the access terminal have a binding relationship; send the vulnerability scanning traffic to the intranet assets to be scanned to realize vulnerability scanning of the intranet assets to be scanned; receive response information returned by the intranet assets to be scanned, and send the response information to the vulnerability scanner.

[0232] This embodiment provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions enable the computer to execute the methods provided by the above-mentioned method embodiments, for example, including: receiving a vulnerability scanning request; the vulnerability scanning request includes asset information to be scanned, and the asset corresponding to the asset information to be scanned is an intranet asset; determining an access terminal based on the asset information to be scanned; the access terminal is used to achieve a communication connection between the cloud service platform and the intranet; determining a vulnerability scanner on the cloud service platform according to the access terminal; sending vulnerability scanning traffic to the access terminal through the vulnerability scanner, so that the access terminal forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned, so as to achieve vulnerability scanning of the asset. Or,

[0233] Receive vulnerability scanning traffic sent by the cloud service platform through the vulnerability scanner; the access terminal is determined by the cloud service platform based on the received vulnerability scanning request; the vulnerability scanner and the access terminal have a binding relationship; send the vulnerability scanning traffic to the intranet assets to be scanned to realize vulnerability scanning of the intranet assets to be scanned; receive response information returned by the intranet assets to be scanned, and send the response information to the vulnerability scanner.

[0234] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0235] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0236] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0237] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0238] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for scanning vulnerabilities of intranet assets, characterized in that: Applied to a cloud service platform, the method includes: Receive a vulnerability scanning request; the vulnerability scanning request includes asset information to be scanned, and the asset corresponding to the asset information to be scanned is an intranet asset; Determining an access terminal based on the asset information to be scanned; the access terminal is used to achieve a communication connection between the cloud service platform and the intranet; Determining a vulnerability scanner on the cloud service platform according to the access terminal; The vulnerability scanner sends vulnerability scanning traffic to the access terminal, so that the access terminal forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned, so as to realize vulnerability scanning of the asset.

2. The method according to claim 1, characterized in that The method further comprises: Receiving a registration request sent by a waiting terminal, wherein the registration request includes an access code; Verify the access code, and if the verification is passed, open the socks 5 proxy channel, and open the permission of the MQTT publish / subscribe topic between the terminal to be entered and the server-side socks 5 proxy in the cloud service platform, so as to realize the communication between the server-side socks 5 proxy and the terminal to be entered through the MQTT protocol; Receive registration completion information of the waiting terminal, wherein the registration completion information includes basic information of the waiting terminal and address information of a server-side socks 5 proxy corresponding to the waiting terminal; The registration completion information is stored.

3. The method according to claim 2, characterized in that The step of sending vulnerability scanning traffic to the access terminal through the vulnerability scanner so that the access terminal forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned includes: The vulnerability scanner sends the vulnerability scanning traffic to the access terminal through the server-side sock5 proxy based on the MQTT protocol, so that the access terminal subscribes to the vulnerability scanning traffic through MQTT and forwards the vulnerability scanning traffic to the client-side socks 5 proxy, so that the client-side socks 5 proxy forwards the vulnerability scanning traffic to the asset corresponding to the asset information to be scanned.

4. The method according to claim 2, characterized in that: The method further comprises: Receive heartbeat information sent by successfully registered access terminals.

5. The method according to claim 4, characterized in that The determining of the access terminal based on the asset information to be scanned includes: Based on the received heartbeat information, one terminal is selected from the terminals in the online state as the access terminal.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Obtain vulnerability scanner resources on the cloud service platform and terminal information of the terminal to be bound; receiving a target vulnerability scanner selected from the vulnerability scanner resource; The target vulnerability scanner is associated with the terminal information and stored.

7. The method according to claim 6, characterized in that The step of determining a vulnerability scanner on a cloud service platform according to the access terminal includes: The vulnerability scanner having a binding relationship with the access terminal is determined from a pre-stored binding relationship table.

8. A method for scanning vulnerabilities of intranet assets, characterized in that: Applied to an access terminal, the access terminal and the intranet asset to be scanned are in the same local area network; the method comprises: Receiving vulnerability scanning traffic sent by the cloud service platform through a vulnerability scanner; the access terminal is determined by the cloud service platform based on the received vulnerability scanning request; the vulnerability scanner and the access terminal have a binding relationship; Sending the vulnerability scanning traffic to the intranet asset to be scanned, so as to implement vulnerability scanning for the intranet asset to be scanned; Receive response information returned by the intranet asset to be scanned, and send the response information to the vulnerability scanner.

9. The method according to claim 8, characterized in that The method further comprises: Sending a registration request to the cloud service platform, wherein the registration request includes an access code, so that the cloud service platform opens a socks 5 proxy channel after passing the verification based on the access code, and opens the permission of the MQTT publish / subscribe topic between the terminal to be connected and the server-side socks 5 proxy in the cloud service platform, so as to realize the communication between the server-side socks 5 proxy and the terminal to be connected through the MQTT protocol; After completing the registration, send the registration completion information to the cloud service platform, the registration completion information includes the basic information of the waiting terminal and the address information of the server-side socks 5 proxy corresponding to the waiting terminal, so that the cloud service platform stores the registration completion information; Receive the access success information sent by the cloud service platform.

10. The method according to claim 9, characterized in that The receiving vulnerability scanning traffic sent by the cloud service platform through the vulnerability scanner includes: Receiving the vulnerability scanning traffic sent by the vulnerability scanner through the server-side socks 5 proxy based on the MQTT protocol through the client-side socks 5 proxy; Sending the vulnerability scanning traffic to the intranet asset to be scanned includes: The vulnerability scanning traffic is sent to the intranet assets to be scanned through the client socks 5 proxy.

11. The method according to any one of claims 8 to 10, characterized in that: The access terminal is a lightweight access terminal.

12. An electronic device, characterized in that: include: processor, memory and bus, wherein, The processor and the memory communicate with each other via the bus; The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the method according to any one of claims 1 to 11.

13. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, which, when executed by a computer, cause the computer to perform the method according to any one of claims 1 to 11.

14. A computer program product, characterized in that The method comprises computer program instructions, and when the computer program instructions are read and executed by a processor, the method according to any one of claims 1 to 11 is executed.

15. An intranet asset vulnerability scanning system, characterized in that: It includes a cloud service platform and an access terminal; the cloud service platform and the access terminal are in communication connection; the access terminal and the intranet assets to be scanned are in the same local area network; The cloud service platform is used to execute the method according to any one of claims 1 to 7; The access terminal is used to execute the method according to any one of claims 8 to 10.

Images