Access control method and device and computer readable medium

Abstract

The invention provides an access control method and device and a computer readable medium, the scheme supports compliance requirements under different access policies for different users or devices, the compliance requirements associated with the access policies are judged firstly, and then corresponding access control is carried out for different application access requests. The compliance requirements of enterprises for different users or devices can be finely and flexibly met, and the management and control flexibility is improved while the safety is ensured.

Description

Technical Field

[0001] The present application relates to the field of information technology, and in particular to an access control method, device and computer-readable medium. Background Art

[0002] With the development of Internet technology, employees need to use more and more terminal devices to access the internal network of the enterprise in their daily office work. The operation of terminal devices by enterprise employees will be affected by their compliance awareness. Since the compliance awareness of enterprise employees varies, they may inadvertently bring compliance risks to the enterprise when using terminal devices to access the internal network of the enterprise. For enterprise managers, there is currently no good way to timely identify compliance risks when employees use terminal devices. At the same time, enterprises have different compliance requirements for employees in different departments. When these employees connect to the internal network of the enterprise and access resources in the internal network of the enterprise, the enterprise needs to decide whether the employee's terminal device can access the network and access it based on whether the employee meets the corresponding compliance requirements.

[0003] The main solution currently adopted is for the enterprise to configure unified compliance testing conditions and distribute them to all terminal devices of the enterprise's employees. After the terminal device completes the test, the test results are notified to the employees and administrators. The administrator guides the employees or the employees independently change the configuration of the terminal device to meet the compliance requirements for accessing intranet resources.

[0004] However, this solution can only configure unified compliance requirements for all enterprise terminal devices, and cannot flexibly formulate different policies according to the actual needs of different employees. In addition, after discovering compliance risks, administrators cannot directly intervene in terminal devices, and cannot restrict these terminal devices from accessing enterprise intranet resources. They can only guide employees or employees to change the configuration of terminal devices on their own to resolve the risks of terminal devices. Therefore, the existing solutions cannot achieve fine and flexible management and control, and lack security. Summary of the invention

[0005] One purpose of the present application is to provide an access control method, device and computer-readable medium, at least to solve the problem that existing solutions cannot achieve precise and flexible management and control and lack security.

[0006] An embodiment of the present application provides an access control method, which is applied to an edge device and includes:

[0007] Obtain terminal compliance information detected and reported by terminal devices;

[0008] Determining the access policy hit by the terminal device, and detecting the compliance policy associated with the access policy;

[0009] Matching the terminal compliance information with the compliance policy;

[0010] If the terminal compliance information complies with the compliance policy, confirming that the terminal device is compliant, and allowing the terminal device to initiate an application access request;

[0011] Obtaining an application access request initiated by the terminal device;

[0012] Determine the access control policy hit by the application access request;

[0013] According to the access control policy, determining whether the terminal device initiating the application access request has access rights and meets security attribute requirements;

[0014] If the terminal device that initiates the application access request has access rights and meets the security attribute requirements, the application access request is released.

[0015] The embodiment of the present application also provides another access control method, which is applied to a terminal device and includes:

[0016] Detect and report terminal compliance information to the edge device, so that the edge device determines the access policy hit by the terminal device, detects the compliance policy associated with the access policy, matches the terminal compliance information with the compliance policy, and confirms that the terminal device is compliant when the terminal compliance information complies with the compliance policy, and allows the terminal device to initiate an application access request;

[0017] An application access request is initiated to the edge device so that the edge device determines the access control policy hit by the application access request, and judges whether the terminal device that initiates the application access request has access rights and meets the security attribute requirements based on the access control policy, and releases the application access request when the terminal device that initiates the application access request has access rights and meets the security attribute requirements.

[0018] The embodiment of the present application also provides another access control method, which is applied to a control center and includes:

[0019] Obtain the admission policy, compliance policy, and access control policy configured by the administrator;

[0020] The admission policy, compliance policy and access control policy are issued to the edge device, so that after obtaining the terminal compliance information detected and reported by the terminal device, the edge device determines the admission policy hit by the terminal device, detects the compliance policy associated with the admission policy, matches the terminal compliance information with the compliance policy, confirms that the terminal device is compliant when the terminal compliance information complies with the compliance policy, allows the terminal device to initiate an application access request, obtains the application access request initiated by the terminal device, determines the access control policy hit by the application access request, determines whether the terminal device initiating the application access request has access rights and meets the security attribute requirements according to the access control policy, and releases the application access request when the terminal device initiating the application access request has access rights and meets the security attribute requirements.

[0021] The embodiment of the present application also provides an edge device for implementing access control, the edge device comprising:

[0022] A data receiving module, used to obtain terminal compliance information detected and reported by a terminal device, and to obtain an application access request initiated by the terminal device;

[0023] A compliance detection module, used to determine the access policy hit by the terminal device, and detect the compliance policy associated with the access policy; match the terminal compliance information with the compliance policy; and when the terminal compliance information complies with the compliance policy, confirm that the terminal device is compliant and allow the terminal device to initiate an application access request;

[0024] An access control module is used to determine the access control policy hit by the application access request; based on the access control policy, determine whether the terminal device initiating the application access request has access rights and meets the security attribute requirements; and release the application access request when the terminal device initiating the application access request has access rights and meets the security attribute requirements.

[0025] The embodiment of the present application further provides a terminal device for implementing access control, the terminal device comprising:

[0026] A detection and reporting module, used to detect and report terminal compliance information to an edge device, so that the edge device determines the access policy hit by the terminal device, detects the compliance policy associated with the access policy, matches the terminal compliance information with the compliance policy, and confirms that the terminal device is compliant when the terminal compliance information complies with the compliance policy, and allows the terminal device to initiate an application access request;

[0027] A request module is used to initiate an application access request to the edge device so that the edge device determines the access control policy hit by the application access request, and judges whether the terminal device that initiates the application access request has access rights and meets the security attribute requirements according to the access control policy, and releases the application access request when the terminal device that initiates the application access request has access rights and meets the security attribute requirements.

[0028] The embodiment of the present application further provides a control center for implementing access control, the control center comprising:

[0029] Configuration module, used to obtain the admission policy, compliance policy and access control policy configured by the administrator;

[0030] A sending module is used to send the admission policy, compliance policy and access control policy to the edge device, so that the edge device can determine the admission policy hit by the terminal device after obtaining the terminal compliance information detected and reported by the terminal device, detect the compliance policy associated with the admission policy, match the terminal compliance information with the compliance policy, and confirm that the terminal device is compliant when the terminal compliance information conforms to the compliance policy, allow the terminal device to initiate an application access request, obtain the application access request initiated by the terminal device, determine the access control policy hit by the application access request, judge whether the terminal device that initiates the application access request has access rights and meets the security attribute requirements according to the access control policy, and release the application access request when the terminal device that initiates the application access request has access rights and meets the security attribute requirements.

[0031] An embodiment of the present application also provides a computing device, which includes a memory for storing computer program instructions and a processor for executing the computer program instructions, wherein when the computer program instructions are executed by the processor, the device is triggered to execute the access control method.

[0032] In addition, an embodiment of the present application further provides a computer-readable medium on which computer program instructions are stored. The computer program instructions can be executed by a processor to implement the access control method.

[0033] Compared with the prior art, in an access control scheme provided in an embodiment of the present application, first, the terminal compliance information detected and reported by the terminal device is obtained, the access policy hit by the terminal device is determined, and the compliance policy associated with the access policy is detected, and the terminal compliance information is matched with the compliance policy. When the terminal compliance information meets the compliance policy and the terminal device is confirmed to be compliant, the terminal device is allowed to initiate an application access request. Then, the application access request initiated by the terminal device is obtained, and the access control policy hit by the application access request is determined. According to the access control policy, it is determined whether the terminal device initiating the application access request has access rights and meets the security attribute requirements, and when the terminal device initiating the application access request has access rights and meets the security attribute requirements, the application access request is released. This scheme supports compliance requirements under different access policies for different users or devices. After completing the compliance requirement judgment associated with the access policy, corresponding access control is performed for different application access requests, which can finely and flexibly meet the compliance requirements of enterprises for different users or devices, and improve the flexibility of management and control while ensuring security. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A schematic diagram of the overall architecture of the devices related to the access control method provided in the embodiment of the present application;

[0035] Figure 2 The access control method provided in the embodiment of the present application is a schematic diagram of the interaction process between relevant devices;

[0036] Figure 3 A schematic diagram of an interactive process for identifying security risks of access behaviors in the solution of an embodiment of the present application;

[0037] Figure 4 A schematic diagram of the structure of an edge device for implementing access control provided in an embodiment of the present application;

[0038] Figure 5 A schematic diagram of the structure of a terminal device for implementing access control provided in an embodiment of the present application;

[0039] Figure 6 A schematic diagram of the structure of a control center for implementing access control provided in an embodiment of the present application;

[0040] Figure 7 A schematic diagram of the structure of a computing device for implementing an access control method in an embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0042] In a typical configuration of the present application, the terminal and the equipment of the service network each include one or more processors (CPU), input / output interface, network interface and memory.

[0043] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0044] Computer readable media include permanent and non-permanent, removable and non-removable media, and can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

[0045] The embodiment of the present application provides an access control method, which first obtains the terminal compliance information detected and reported by the terminal device, determines the access policy hit by the terminal device, detects the compliance policy associated with the access policy, matches the terminal compliance information with the compliance policy, and allows the terminal device to initiate an application access request when the terminal compliance information meets the compliance policy and confirms that the terminal device is compliant. Then, the application access request initiated by the terminal device is obtained, the access control policy hit by the application access request is determined, and according to the access control policy, it is judged whether the terminal device that initiates the application access request has access rights and meets the security attribute requirements, and when the terminal device that initiates the application access request has access rights and meets the security attribute requirements, the application access request is released. This solution supports compliance requirements under different access policies for different users or devices. After completing the compliance requirement judgment associated with the access policy, corresponding access control is performed for different application access requests, which can finely and flexibly meet the compliance requirements of enterprises for different users or devices, and improve the flexibility of management and control while ensuring security.

[0046] Figure 1The overall architecture between the related devices for implementing the access control method provided by the embodiment of the present application is shown, including a terminal device 110, an edge device 120 and a control center 130, wherein the user 140 can use the terminal device 110 to access the edge device 120 and initiate an application access request. In the process of accessing and initiating an application access request, the edge device can control the process, thereby achieving fine and flexible management and control, and improving security. In addition, the administrator 150 can uniformly configure the access policy, compliance policy and access control policy required for implementing the access control method in the control center, and issue them to each edge device to ensure that any edge device accessed by the terminal device 110 can implement the access control method. Among them, the specific implementation of the terminal device 110 can be various electronic devices used by the user to access the application, including but not limited to computers, mobile phones, tablet computers, smart watches, etc. The specific implementation of the edge device 120 and the control center 130 can include but is not limited to network hosts, single network servers, servers concentrated in multiple network servers, or servers in a distributed cloud network. The distributed cloud network described here is composed of a large number of hosts or network servers based on cloud computing (Cloud Computing). The distributed cloud network can be an edge cloud network, which can be based on the core of cloud computing technology and the ability of edge computing, and build a cloud computing platform on the edge infrastructure to form an elastic cloud platform with comprehensive computing, network, storage, security, application and other capabilities at the edge. It should be noted that the embodiments of the present application do not limit the specific type of distributed network, and any distributed architecture network composed of multiple computing devices is applicable to the present application.

[0047] Figure 2 The interactive process of an access control method provided by an embodiment of the present application is shown, which at least includes the following processing steps:

[0048] Step S201: The control center obtains the admission policy, compliance policy, and access control policy configured by the administrator.

[0049] In step S202, the control center sends the access policy, compliance policy, and access control policy to the edge device, so that the edge device obtains the access policy, compliance policy, and access control policy sent by the control center. After obtaining the access policy, compliance policy, and access control policy, the edge device can control the access process of the terminal device according to the specific content of the access policy, compliance policy, and access control policy. By sending the policy uniformly from the control center, the configuration of the policy can be more convenient and flexible.

[0050] Among them, the access policies all correspond to their respective effective objects, and are associated with one or more compliance policies, which are used to determine whether the effective objects meet the compliance requirements required for initiating application access requests. The effective objects may refer to users or devices on which the access policies are effective, and can be determined by means of user identity information or device identity information. For example, in actual scenarios, when a user can use a terminal device to access an edge device, it can be implemented through a client program running on the terminal device. At this time, when the user logs in to the client program through a user name, password or other authentication method, there will be corresponding user identity information, such as the user name, the group to which the user belongs, the department, the mobile phone number associated with the user, etc. At the same time, the terminal device used by the user also has corresponding device identity information, such as the IMEI code (International Mobile Equipment Identity), the group and department bound to the terminal device, etc. After the terminal device is connected to the edge device, the edge device can obtain the user identity information or device identity information used to determine the identity of the edge device, thereby determining which access policies the accessed terminal device hits.

[0051] The compliance policy includes the compliance requirements for initiating application access requests configured by the administrator in the control center. For example, a compliance baseline test can be used, and its specific test content may include blacklist software, whitelist software, blacklist processes, whitelist processes, firewall status, terminal operating system version number, client software running permissions, lock screen time, disk encryption status, etc. In actual scenarios, any of the above test content can be combined through and / or matching logic to construct a compliance policy that meets actual test needs.

[0052] The access control policy is used to determine whether the terminal device that initiates the application access request has access rights and meets the security attribute requirements. In actual scenarios, the access control policy can be configured for the application that needs to be protected, so as to determine whether the terminal device that initiates the application access request to the application has access rights and meets the security attribute requirements, and perform corresponding processing according to the judgment result. Taking applications app1 and app2 as examples, the administrator can configure different access control policies for each application respectively. For example, for application app1, its corresponding access control policy can be configured as s1; and for application app2, its corresponding access control policy can be configured as s2. In this way, each application that needs to be protected can be configured with its own independent access control policy according to user needs, making the protection of different applications more refined and flexible.

[0053] Step S203: The terminal device detects and reports the terminal compliance information to the edge device, so that the edge device can obtain the terminal compliance information detected and reported by the terminal device.

[0054] After the terminal device is connected to the edge device, it detects and reports the terminal compliance information to the edge device. Among them, the terminal compliance information refers to the relevant information used to determine whether the terminal device is currently compliant, and its specific content can be determined according to the needs of the actual scenario. For example, in some embodiments of the present application, the terminal device detects the specific content of the terminal compliance information, which can be determined according to the compliance policy associated with the access policy hit by the terminal device, and the terminal compliance information is detected for the content involved in the compliance policy. After determining the access policy hit by the connected terminal device, the edge device can send the compliance policy associated with the access policy or the specific content that needs to be detected by the compliance policy to the terminal device, so that the terminal device can detect the terminal compliance information required for subsequent processing and report it to the edge device.

[0055] In some embodiments of the present application, in order to further improve the security of the access process, when the terminal device accesses the edge device, the edge device may require the terminal device to perform identity authentication, and after the terminal device completes the identity authentication, obtain the terminal compliance information detected and reported by the terminal device. If the terminal device fails the identity authentication, it means that there are certain security risks in the terminal device, and the edge device will not allow the terminal device to access, and will disconnect the connection between the terminal device and the edge device, thereby avoiding affecting the security of the access process.

[0056] In actual scenarios, the identity authentication method may include an identity authentication method of username and password or an authentication method using biometric recognition technology, or other third-party identity authentication service methods, etc. The terminal device can only be allowed to access the edge device after completing the identity authentication. Taking the identity authentication service method as an example, the terminal device can pre-configure the corresponding identity authentication service, so that when the user uses the terminal device to request access to the edge device, it will jump to the identity authentication service according to the response content returned by the edge device to perform identity authentication processing. After completing the identity authentication, the edge device can be notified by the identity authentication service or the terminal device, so that the edge device confirms that the terminal device has completed the identity authentication after receiving the notification of the completion of the identity authentication.

[0057] In step S204, the edge device determines the access policy hit by the terminal device, detects the compliance policy associated with the access policy, matches the terminal compliance information with the compliance policy, and determines whether the terminal compliance information complies with the compliance policy. After the terminal device accesses the edge device, the edge device can obtain the user identity information or device identity information related to the terminal device, and can match it with the pre-configured access policy to determine which access policies are hit by this access.

[0058] In the solution of the embodiment of the present application, when the edge device determines the access policy hit by the terminal device and detects the compliance policy associated with the access policy, it can first match the user identity information and / or device identity information corresponding to the terminal device with the effective object information in the access policy. If the user identity information and / or device identity information corresponding to the terminal device meets the effective object information in the access policy, the access policy is determined as the access policy hit by the terminal device.

[0059] For example, in this embodiment, if the user identity information of the terminal device A1 includes the department described by the user as D1, the administrator has pre-configured the access policy P1-1 for the users of the department, that is, the effective objects of the access policy P1-1 include the users of the department D1. The compliance policies associated with the access policy P1-1 include P2-1 and P2-5, thereby meeting the compliance requirements for the users of the department. Therefore, after the terminal device A1 accesses the edge device, the edge device can match the effective object information in the access policy according to the user identity information corresponding to the terminal device, and query the access policy whose effective object is the user department D1. At this time, it can be queried that the hit access policy is P1-1.

[0060] Then, the edge device can obtain the compliance policy associated with the access policy according to the compliance baseline linkage configuration information in the access policy. Among them, the compliance baseline linkage configuration information in the access policy is used to determine the compliance policy associated with the access policy. Taking the aforementioned access policy P1-1 as an example, its compliance baseline linkage configuration information includes compliance policies P2-1 and P2-5. Therefore, the edge device can detect the required compliance policies P2-1 and P2-5 based on the compliance baseline linkage configuration information in the hit access policy P1-1 for subsequent compliance detection.

[0061] Through the above method, administrators can configure different compliance requirements for users and devices with different identities, meet the company's various compliance requirements for different application access scenarios, make the configuration more refined, and improve the flexibility of compliance configuration.

[0062] Taking the above two compliance policies P2-1 and P2-5 as examples, if the compliance condition corresponding to compliance policy P2-1 is that the firewall status is on and the terminal operating system version number is at least higher than a certain version number xx, the corresponding compliance condition in compliance policy P2-5 is that any process in the blacklist is not running in the terminal device. When matching, the detected terminal compliance information can be compared with the compliance conditions corresponding to the compliance policy. If these compliance conditions are met, it can be determined that the terminal compliance information complies with the compliance policy. In actual scenarios, the compliance conditions corresponding to each compliance policy can be combined with and / or logic according to the needs of the actual scenario, so as to achieve more flexible compliance policy settings, support compliance requirements under different access policies for different users or devices, and meet the compliance requirements of enterprises for different users or devices in a more refined and flexible manner.

[0063] Step S205: If the terminal compliance information complies with the compliance policy, the edge device confirms that the terminal device is compliant and allows the terminal device to initiate an application access request.

[0064] If the terminal compliance information does not comply with the compliance policy, the edge device confirms that the terminal device is non-compliant and triggers the terminal device to perform corresponding disposal actions based on the access policy. The disposal actions when the access policy is not met may include but are not limited to: alarm, secondary authentication, connection prohibition, etc., which can be set according to the needs of the actual application scenario.

[0065] In addition, when the terminal compliance information does not comply with the compliance policy and the edge device confirms that the terminal device is non-compliant, the edge device can send a first prompt information about the compliance policy matching result to the terminal device, so that the terminal device prompts the user according to the first prompt information. For example, it prompts that the terminal operating system version number is too low and the operating system version needs to be upgraded, so that the user can be reminded and required to meet the compliance requirements in time, thereby quickly solving the problem of the terminal device being unable to access.

[0066] In actual scenarios, if the administrator can configure the corresponding handling actions of the compliance policy according to the degree of impact on security, for example, when the impact of non-compliance with a certain compliance policy on the overall security is small, the handling action of the alarm can be used to inform the user of the terminal device that the compliance requirements are not met, and the user of the terminal device can be notified of the corresponding problem, so that the user can make adjustments according to the prompt information. For example, when the version number of the terminal operating system is too low, the edge device can inform the user of the terminal device that the compliance requirements are not met through an alarm, and at the same time inform the user of the compliance problem, and prompt the user to upgrade the operating system version. When the impact of non-compliance with a certain compliance policy on the overall security is relatively large, handling actions such as secondary authentication or prohibition of connection can be adopted. For example, when a blacklist process is running in the terminal device, the edge device disconnects the current connection with the terminal device, and at the same time notifies the user of the terminal device that the process needs to be closed and then re-authenticated, or notifies the user of the terminal device that he has been prohibited from accessing the edge device again.

[0067] Therefore, this solution can realize real-time automated control of terminal devices. After the administrator configures relevant policies in advance, when compliance risks are detected in terminal devices, disposal actions can be taken on the terminal devices in real time and automatically, such as prohibiting connection, re-authentication, etc., thereby improving the security of the access process.

[0068] Step S206: The terminal device initiates an application access request to the edge device, so that the edge device can obtain the application access request initiated by the terminal device. After the edge device confirms that the terminal device is compliant, the terminal device can initiate an application access request according to the user's needs and access the application in the intranet through the edge device.

[0069] Step S207 , the edge device determines the access control policy hit by the application access request, and judges, based on the access control policy, whether the terminal device initiating the application access request has access rights and meets security attribute requirements.

[0070] For example, the application access request needs to access application app1. The administrator pre-configures the corresponding access control policy p3-1 for application app1 in the control center and sends it to the edge device. After receiving the application access request, the edge device can query all received access control policies and determine that the access control policy it hits is p3-1.

[0071] Among them, the access control policy includes the access permission information of the application, which is used to determine the user identity information or device identity information with access permission, as well as the specific content of the access permission. For example, for application app1, users from departments D1 and D2 are allowed to access, where users from department D1 have write and read permissions, while users from department D2 only have read permissions. Therefore, the access control policy of application app1 can set corresponding access permission information in p3-1, so that when a user from department D1 uses a terminal device to initiate an application access request, the edge device can determine, based on the access control policy, that the terminal device that initiates the application access request has write and read access permissions. When a user from department D2 uses a terminal device to initiate an application access request, the edge device can determine, based on the access control policy, that the terminal device that initiates the application access request only has read access permissions.

[0072] In addition, the security attribute requirements include other requirements related to access security, such as whether the compliance requirements corresponding to a certain compliance policy are met, whether the terminal device is authenticated, whether there are compliance / security risks in the terminal device, whether the terminal device is from a trusted network, etc., thereby ensuring the security of access and avoiding security risks to the enterprise intranet caused by application access behavior.

[0073] Step S208, if the terminal device that initiates the application access request has access rights and meets the security attribute requirements, the edge device releases the application access request. In another case, if the terminal device that initiates the application access request has access rights or does not meet the security attribute requirements, the application access request is blocked to ensure the security of the enterprise intranet. Therefore, the solution of the embodiment of the present application supports compliance requirements under different access policies for different users or devices. After completing the compliance requirement judgment associated with the access policy, corresponding access control is performed for different application access requests. It can finely and flexibly meet the compliance requirements of the enterprise for different users or devices, and improve the flexibility of management and control while ensuring security.

[0074] In addition, if the terminal device that initiates the application access request has access rights or does not meet the security attribute requirements, after blocking the application access request, the edge device can also send a second prompt information about the judgment result of the access control policy to the terminal device, so that the terminal device prompts the user according to the second prompt information. As a result, after receiving the corresponding second prompt information, the user can make adjustments according to the second prompt information and try to access again after the adjustment, thereby ensuring the security of the intranet while providing convenience for the user's normal access and improving the user's experience.

[0075] In some embodiments of the present application, the security attribute requirements may also include whether the access behavior of the terminal device poses a security risk. When determining whether the access behavior of the terminal device poses a security risk, the edge device may identify whether the access behavior of the terminal device poses a security risk based on the access behavior of the terminal device initiating the application access request this time, combined with the historical access behavior of the terminal device. As a result, this solution can further evaluate the user's access behavior and identify security risks based on abnormal behavior, thereby solving the problem that the existing solution can only judge security risks based on static data, so that this solution can accurately identify security issues in user access behavior and further improve security.

[0076] When the edge device identifies whether the access behavior of the terminal device has a security risk, the following method can be used: Figure 3 The specific processing flow shown includes the following processing steps:

[0077] Step S301: The edge device records the historical access behavior of the terminal device and provides it to a data analysis device, and the data analysis device generates an evaluation baseline model of the terminal device according to the historical access behavior.

[0078] The historical access behavior may be any behavior data generated by the edge device during the previous application access process, which may be recorded in the form of logs, and may specifically include the identity information of the accessed terminal, the identity information of the accessed user, the access time, the access location, the access frequency, the type of resource accessed, the size of the accessed file, etc. After providing the data on the historical access behavior to the data analysis device, the data analysis device may periodically perform analysis and calculation based on the latest historical access behavior to generate an evaluation baseline model of the terminal device for calculating the security risk score of subsequent access behaviors.

[0079] Step S302: When the edge device obtains the application access request initiated by the terminal device, it provides the access behavior of the application access request initiated this time to the data analysis device, and the data analysis device calculates the security risk score based on the access behavior of the application access request initiated this time in combination with the evaluation baseline model, and pushes the security risk score to the edge device. The security risk score can be used to indicate the security of the access behavior of the application access request initiated this time. In actual scenarios, the higher the value of the security risk score, the safer the access behavior is. Conversely, if the value of the security risk score is lower, the more dangerous the access behavior is.

[0080] In actual scenarios, the access behavior of terminal devices recorded by edge nodes can be uploaded to the big data center for storage. When needed, data analysis equipment can use a scheduled or real-time method to pull the required data on access behavior from the big data center for corresponding calculations and processing.

[0081] In step S303, the edge device determines whether there is a security risk in the access behavior of the terminal device based on the security risk score. When making a security risk judgment, a reasonable judgment threshold can be set according to the security requirements of the actual application scenario, and then the calculated security risk score is compared with the judgment threshold. If the security risk score is higher than or equal to the judgment threshold, it means that the access behavior is safe and the corresponding application access request can be released. On the contrary, if the security risk score is lower than the judgment threshold, it means that there is a high security risk in the access behavior and the application access request can be blocked. Through the above-mentioned specific judgment method, this solution can use dynamic access behavior data to more accurately detect the security risks that may exist when terminal devices access intranet applications, further improving the security of the solution.

[0082] The embodiment of the present application also provides an edge device for implementing access control. The structure of the edge device is as follows: Figure 4 As shown, it includes a data receiving module 410, a compliance detection module 420 and an access control module 430. Among them, the data receiving module 410 is used to obtain the terminal compliance information detected and reported by the terminal device, and obtain the application access request initiated by the terminal device; the compliance detection module 420 is used to determine the access policy hit by the terminal device, and detect the compliance policy associated with the access policy; match the terminal compliance information with the compliance policy; and when the terminal compliance information complies with the compliance policy, confirm that the terminal device is compliant and allow the terminal device to initiate an application access request; the access control module 430 is used to determine the access control policy hit by the application access request; according to the access control policy, determine whether the terminal device initiating the application access request has access rights and meets the security attribute requirements; and when the terminal device initiating the application access request has access rights and meets the security attribute requirements, release the application access request.

[0083] The embodiment of the present application also provides a terminal device for implementing access control, the structure of the terminal device is as follows: Figure 5As shown, it includes a detection and reporting module 510 and a request module 520. Among them, the detection and reporting module 510 is used to detect and report the terminal compliance information to the edge device, so that the edge device determines the access policy hit by the terminal device, and detects the compliance policy associated with the access policy, matches the terminal compliance information with the compliance policy, and when the terminal compliance information complies with the compliance policy, confirms that the terminal device is compliant and allows the terminal device to initiate an application access request; the request module 520 is used to initiate an application access request to the edge device, so that the edge device determines the access control policy hit by the application access request, and according to the access control policy, determines whether the terminal device that initiates the application access request has access rights and meets the security attribute requirements, and releases the application access request when the terminal device that initiates the application access request has access rights and meets the security attribute requirements.

[0084] The embodiment of the present application also provides a control center for implementing access control. The structure of the control center is as follows: Figure 6 As shown, it includes a configuration module 610 and a delivery module 620. Among them, the configuration module 610 is used to obtain the access policy, compliance policy and access control policy configured by the administrator; the delivery module 620 is used to deliver the access policy, compliance policy and access control policy to the edge device, so that the edge device determines the access policy hit by the terminal device after obtaining the terminal compliance information detected and reported by the terminal device, detects the compliance policy associated with the access policy, matches the terminal compliance information with the compliance policy, confirms that the terminal device is compliant when the terminal compliance information meets the compliance policy, allows the terminal device to initiate an application access request, obtains the application access request initiated by the terminal device, determines the access control policy hit by the application access request, determines whether the terminal device initiating the application access request has access rights and meets the security attribute requirements according to the access control policy, and releases the application access request when the terminal device initiating the application access request has access rights and meets the security attribute requirements.

[0085] In addition, the present application also provides a computing device, the structure of which is as follows: Figure 7 As shown, it includes a memory 710 for storing computer program instructions and a processor 720 for executing the computer program instructions, wherein when the computer program instructions are executed by the processor, the processor is triggered to execute the access control method.

[0086] The methods and / or embodiments in the embodiments of the present application may be implemented as computer software programs. For example, the embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program code for executing the method shown in the flowchart. When the computer program is executed by the processing unit, the above functions defined in the method of the present application are executed.

[0087] It should be noted that the computer-readable medium described in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device.

[0088] In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0089] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0090] The flow chart or block diagram in the accompanying drawings shows the possible architecture, function and operation of the equipment, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated system for hardware that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0091] As another aspect, the embodiments of the present application further provide a computer-readable medium, which may be included in the device described in the above embodiments; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more computer program instructions, which may be executed by a processor to implement the steps of the methods and / or technical solutions of the above multiple embodiments of the present application.

[0092] In addition, an embodiment of the present application further provides a computer program, which is stored in a computer device, so that the computer device executes the access control method.

[0093] It should be noted that the present application can be implemented in software and / or a combination of software and hardware, for example, can be implemented using an application specific integrated circuit (ASIC), a general purpose computer or any other similar hardware device. In certain embodiments, the software program of the present application can be executed by a processor to implement the above steps or functions. Similarly, the software program of the present application (including related data structures) can be stored in a computer-readable recording medium, for example, a RAM memory, a magnetic or optical drive or a floppy disk and similar devices. In addition, some steps or functions of the present application can be implemented using hardware, for example, as a circuit that cooperates with a processor to perform each step or function.

[0094] It is obvious to those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, and that the present application can be implemented in other specific forms without departing from the spirit or basic features of the present application. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-restrictive, and the scope of the present application is defined by the appended claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present application. Any figure mark in the claims should not be regarded as limiting the claims involved. In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the device claim can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

Claims

1. An access control method, characterized in that: The method is applied to an edge device, comprising: Obtain terminal compliance information detected and reported by terminal devices; Determining the access policy hit by the terminal device, and detecting the compliance policy associated with the access policy; Matching the terminal compliance information with the compliance policy; If the terminal compliance information complies with the compliance policy, confirming that the terminal device is compliant, and allowing the terminal device to initiate an application access request; Obtaining an application access request initiated by the terminal device; Determine the access control policy hit by the application access request; According to the access control policy, determining whether the terminal device initiating the application access request has access rights and meets security attribute requirements; If the terminal device that initiates the application access request has access rights and meets the security attribute requirements, the application access request is released.

2. The method according to claim 1, characterized in that The security attribute requirements include: whether the access behavior of the terminal device has security risks; The edge device identifies whether there is a security risk in the access behavior of the terminal device based on the access behavior of the terminal device initiating the application access request this time and the historical access behavior of the terminal device.

3. The method according to claim 2, characterized in that The edge device identifies whether the access behavior of the terminal device has a security risk based on the access behavior of the terminal device initiating the application access request this time and in combination with the historical access behavior of the terminal device, including: The edge device records the historical access behavior of the terminal device and provides it to the data analysis device, and the data analysis device generates an evaluation baseline model of the terminal device according to the historical access behavior; When the edge device obtains the application access request initiated by the terminal device, the access behavior of the application access request initiated this time is provided to the data analysis device, and the data analysis device calculates the security risk score based on the access behavior of the application access request initiated this time in combination with the evaluation baseline model, and pushes the security risk score to the edge device; The edge device determines whether the access behavior of the terminal device poses a security risk according to the security risk score.

4. The method according to claim 1, characterized in that: The method further comprises: Obtain the admission policy, compliance policy, and access control policy issued by the control center.

5. The method according to claim 1, characterized in that Obtain terminal compliance information detected and reported by terminal devices, including: When the terminal device accesses the edge device, the terminal device is required to perform identity authentication; After the terminal device completes identity authentication, terminal compliance information detected and reported by the terminal device is obtained.

6. The method according to claim 1, characterized in that Determining the access policy hit by the terminal device, and detecting the compliance policy associated with the access policy; Matching the user identity information and / or device identity information corresponding to the terminal device with the effective object information in the access policy; If the user identity information and / or device identity information corresponding to the terminal device matches the effective object information in the access policy, the access policy is determined as the access policy hit by the terminal device; According to the compliance baseline linkage configuration information in the admission policy, the compliance policy associated with the admission policy is obtained.

7. The method according to claim 1, characterized in that After matching the terminal compliance information with the compliance policy, the method further includes: If the terminal compliance information does not comply with the compliance policy, the terminal device is confirmed to be non-compliant, and the terminal device is triggered to perform corresponding disposal actions based on the access policy.

8. The method according to claim 7, characterized in that If the terminal compliance information does not comply with the compliance policy, after confirming that the terminal device is non-compliant, the method further includes: Sending first prompt information about the compliance policy matching result to the terminal device, so that the terminal device prompts the user according to the first prompt information.

9. The method according to claim 1, characterized in that: After determining, according to the access control policy, whether the terminal device initiating the application access request has access rights and meets the security attribute requirements, the method further includes: If the terminal device that initiates the application access request has access rights or does not meet the security attribute requirements, the application access request is blocked.

10. The method according to claim 9, characterized in that If the terminal device initiating the application access request has access rights or does not meet the security attribute requirements, after blocking the application access request, the method further includes: Sending second prompt information about the judgment result of the access control policy to the terminal device, so that the terminal device prompts the user according to the second prompt information.

11. An access control method, characterized in that: The method is applied to a terminal device, comprising: Detect and report terminal compliance information to the edge device, so that the edge device determines the access policy hit by the terminal device, detects the compliance policy associated with the access policy, matches the terminal compliance information with the compliance policy, and confirms that the terminal device is compliant when the terminal compliance information complies with the compliance policy, and allows the terminal device to initiate an application access request; An application access request is initiated to the edge device so that the edge device determines the access control policy hit by the application access request, and judges whether the terminal device that initiates the application access request has access rights and meets the security attribute requirements based on the access control policy, and releases the application access request when the terminal device that initiates the application access request has access rights and meets the security attribute requirements.

12. An access control method, characterized in that: The method is applied to a control center and comprises: Obtain the admission policy, compliance policy, and access control policy configured by the administrator; The admission policy, compliance policy and access control policy are issued to the edge device, so that after obtaining the terminal compliance information detected and reported by the terminal device, the edge device determines the admission policy hit by the terminal device, detects the compliance policy associated with the admission policy, matches the terminal compliance information with the compliance policy, confirms that the terminal device is compliant when the terminal compliance information complies with the compliance policy, allows the terminal device to initiate an application access request, obtains the application access request initiated by the terminal device, determines the access control policy hit by the application access request, determines whether the terminal device initiating the application access request has access rights and meets the security attribute requirements according to the access control policy, and releases the application access request when the terminal device initiating the application access request has access rights and meets the security attribute requirements.

13. An edge device for implementing access control, characterized in that: The edge device includes: A data receiving module, used to obtain terminal compliance information detected and reported by a terminal device, and to obtain an application access request initiated by the terminal device; A compliance detection module, used to determine the access policy hit by the terminal device, and detect the compliance policy associated with the access policy; match the terminal compliance information with the compliance policy; and when the terminal compliance information complies with the compliance policy, confirm that the terminal device is compliant and allow the terminal device to initiate an application access request; An access control module is used to determine the access control policy hit by the application access request; based on the access control policy, determine whether the terminal device initiating the application access request has access rights and meets the security attribute requirements; and release the application access request when the terminal device initiating the application access request has access rights and meets the security attribute requirements.

14. A terminal device for implementing access control, characterized in that: The terminal device comprises: A detection and reporting module, used to detect and report terminal compliance information to an edge device, so that the edge device determines the access policy hit by the terminal device, detects the compliance policy associated with the access policy, matches the terminal compliance information with the compliance policy, and confirms that the terminal device is compliant when the terminal compliance information complies with the compliance policy, and allows the terminal device to initiate an application access request; A request module is used to initiate an application access request to the edge device so that the edge device determines the access control policy hit by the application access request, and judges whether the terminal device that initiates the application access request has access rights and meets the security attribute requirements according to the access control policy, and releases the application access request when the terminal device that initiates the application access request has access rights and meets the security attribute requirements.

15. A control center for implementing access control, characterized in that: The control center comprises: Configuration module, used to obtain the admission policy, compliance policy and access control policy configured by the administrator; A sending module is used to send the admission policy, compliance policy and access control policy to the edge device, so that the edge device can determine the admission policy hit by the terminal device after obtaining the terminal compliance information detected and reported by the terminal device, detect the compliance policy associated with the admission policy, match the terminal compliance information with the compliance policy, and confirm that the terminal device is compliant when the terminal compliance information conforms to the compliance policy, allow the terminal device to initiate an application access request, obtain the application access request initiated by the terminal device, determine the access control policy hit by the application access request, judge whether the terminal device that initiates the application access request has access rights and meets the security attribute requirements according to the access control policy, and release the application access request when the terminal device that initiates the application access request has access rights and meets the security attribute requirements.

16. A computing device comprising a memory for storing computer program instructions and a processor for executing the computer program instructions, wherein: When the computer program instructions are executed by the processor, the device is triggered to execute the method according to any one of claims 1 to 12.

17. A computer readable medium having computer program instructions stored thereon, wherein the computer program instructions can be executed by a processor to implement the method according to any one of claims 1 to 12.

Images