Access control method and device, equipment, storage medium and program product

Abstract

The invention provides an access control method and device, equipment, a storage medium and a program product, and relates to the field of network security, and the method can dynamically update an access control strategy. The method comprises the following steps: acquiring state and behavior information of target access equipment, wherein the target access equipment is access equipment distributed with an accessible range after passing identity verification; based on the state and behavior information of the target access device, updating the accessible range of the target access device to obtain an updated accessible range; and sending the updated accessible range to the plurality of micro-isolation systems, so that the plurality of micro-isolation systems control the access of the target access device based on the updated accessible range.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to an access control method, apparatus, device, storage medium and program product. Background Art

[0002] Currently, zero-trust security access control solutions combine software defined perimeter (SDP) technology, identity and access management (IAM) technology and micro-isolation technology to replace traditional network security solutions.

[0003] Micro-isolation technology can virtually divide a network (such as an enterprise intranet) into multiple small, isolated micro-network nodes, each of which can be regarded as a micro-isolation system. When an access device attempts to access a micro-isolation system, it must first pass the identity authentication of the IAM system using IAM technology. After the identity authentication is passed, the SDP system using SDP technology can issue the access control policy of the access device to the micro-isolation system, and the micro-isolation system can perform access control on the access device according to the access control policy issued by the SDP system.

[0004] However, current access control policies are less flexible. Summary of the invention

[0005] The present application provides an access control method, apparatus, device, storage medium and program product, which can dynamically update the accessible range of an access device according to the status and behavior information of the access device, thereby improving the flexibility of the access control policy.

[0006] In the first aspect, the present application provides an access control method, which is applied to a security management and control platform; the security management and control platform is communicatively connected to multiple micro-isolation systems; the method includes: obtaining the status and behavior information of a target access device; the target access device is an access device assigned an accessible range after identity authentication; the accessible range includes at least one micro-isolation system among multiple micro-isolation systems; based on the status and behavior information of the target access device, the accessible range of the target access device is updated to obtain an updated accessible range; the updated accessible range is sent to multiple micro-isolation systems, so that the multiple micro-isolation systems control access to the target access device based on the updated accessible range.

[0007] In the access control method provided by the present application, the security management and control platform can update the accessible range of the target access device based on the status and behavior information of the target access device to which the accessible range is assigned, obtain the updated accessible range, and send the updated accessible range to multiple micro-isolation systems. Multiple micro-isolation systems can control the access to the target access device based on the updated accessible range, thereby realizing dynamic update of the access control policy for the access device and improving the flexibility of the access control policy.

[0008] In addition, a less flexible or static access control strategy may result in the target access device being attacked or controlled after obtaining authorization for a larger accessible range, causing damage to the micro-isolation system within the larger accessible range. After the target access device is attacked or controlled after obtaining authorization for a larger accessible range, its state and behavior information will change. The access control method provided in the embodiment of the present application can dynamically update the accessible range based on the state and behavior information, which can prevent the target access device from damaging the micro-isolation system within the larger accessible range according to the original larger accessible range, thereby improving the security of the network defense process.

[0009] In a possible implementation, the status and behavior information includes at least one of the following: whether the target access device has the target software installed, the network where the target access device is located, and the access behavior record of the target access device.

[0010] Another possible implementation method is to update the accessible range of the target device based on the status and behavior information of the target access device to obtain an updated accessible range, including: determining the security status score of the target access device based on preset scoring rules and the status and behavior information of the target access device; updating the accessible range of the target device based on the security status score of the target access device to obtain an updated accessible range.

[0011] Another possible implementation method is to update the accessible range of the target access device based on the security status score of the target access device to obtain an updated accessible range, including: updating the user group to which the target access device belongs based on the group correspondence and the security score of the target access device to obtain an updated user group of the target access device; the group correspondence is used to represent the correspondence between the security score and the user group, each user group corresponds to an accessible range; based on the updated user group of the target access device, the accessible range of the target device is updated to obtain an updated accessible range.

[0012] Another possible implementation method is to determine the security status score of the target access device based on preset scoring rules and the status and behavior information of the target access device, including: obtaining a standard security status score of the target access device; when it is determined that the target access device has abnormal behavior based on the status and behavior information, deducting the reference score corresponding to the abnormal behavior from the standard security status score to obtain a security status score.

[0013] In another possible implementation, abnormal behavior includes: status and behavior information indicating that the target access device does not have the target software installed; status and behavior information indicating that the network where the target access device is located is a preset abnormal network; and access behavior records in the status and behavior information indicating that the target access device accesses a micro-isolation system outside the accessible range.

[0014] Another possible implementation method, the method also includes: in response to the target access device login status change event, generating event notification information accordingly; the type of login status change event includes login or logout; the event notification information includes the identity of the target access device, the address information assigned to the target access device by the security management and control platform, the accessible range of the target access device and the type of login status change event; and sending the event notification information to multiple micro-isolation systems.

[0015] In another possible implementation, the method also includes: receiving subscription request information from the micro-isolation system; the subscription request information includes a service list of the micro-isolation system and an event type requested for subscription; the event type requested for subscription includes a login status change event; in response to the subscription request information, sending interface configuration information to the micro-isolation system; receiving subscription confirmation information from the micro-isolation system, the subscription confirmation information is generated after the micro-isolation system completes the configuration of the internal listener based on the interface configuration information; the internal listener is used to obtain event notification information; in response to the subscription confirmation information, sending subscription response information to the micro-isolation system; the subscription response information is used to indicate successful registration and / or successful subscription.

[0016] In a second aspect, the present application provides an access control device, which is applied to a security management and control platform; the security management and control platform is communicatively connected with multiple micro-isolation systems, and the device includes: an acquisition module, a processing module and a sending module.

[0017] An acquisition module is used to obtain the status and behavior information of a target access device; the target access device is an access device that is assigned an accessible range after identity authentication; the accessible range includes at least one micro-isolation system among multiple micro-isolation systems.

[0018] The processing module is used to update the accessible range of the target access device based on the state and behavior information of the target access device to obtain the updated accessible range.

[0019] The sending module is used to send the updated accessible range to multiple micro-isolation systems so that the multiple micro-isolation systems can control the access to the target access device based on the updated accessible range.

[0020] In a possible implementation, the status and behavior information includes at least one of the following: whether the target access device has the target software installed, the network where the target access device is located, and the access behavior record of the target access device.

[0021] Another possible implementation method is that the processing module is specifically used to determine the security status score of the target access device based on preset scoring rules and the status and behavior information of the target access device; based on the security status score of the target access device, the accessible range of the target device is updated to obtain an updated accessible range.

[0022] Another possible implementation method is a processing module that is specifically used to update the user group to which the target access device belongs based on the group correspondence and the security score of the target access device to obtain the updated user group of the target access device; the group correspondence is used to represent the correspondence between the security score and the user group, and each user group corresponds to an accessible range; based on the updated user group of the target access device, the accessible range of the target device is updated to obtain an updated accessible range.

[0023] Another possible implementation method is that the processing module is specifically used to obtain a standard security status score of the target access device; when it is determined that the target access device has abnormal behavior based on the status and behavior information, the standard security status score is deducted from the reference score corresponding to the abnormal behavior to obtain a security status score.

[0024] In another possible implementation, abnormal behavior includes: status and behavior information indicating that the target access device does not have the target software installed; status and behavior information indicating that the network where the target access device is located is a preset abnormal network; and access behavior records in the status and behavior information indicating that the target access device accesses a micro-isolation system outside the accessible range.

[0025] In another possible implementation method, the processing module is also used to respond to the target access device login status change event and generate corresponding event notification information; the types of login status change events include login or logout; the event notification information includes the identity of the target access device, the address information assigned to the target access device by the security management and control platform, the accessible range of the target access device, and the type of login status change event; the sending module is used to send event notification information to multiple micro-isolation systems.

[0026] In another possible implementation, the acquisition module is also used to receive subscription request information from the micro-isolation system; the subscription request information includes the service list of the micro-isolation system and the event type requested for subscription; the event type requested for subscription includes a login status change event; the sending module is also used to send interface configuration information to the micro-isolation system in response to the subscription request information; the acquisition module is also used to receive subscription confirmation information from the micro-isolation system, and the subscription confirmation information is generated after the micro-isolation system completes the configuration of the internal listener based on the interface configuration information; the internal listener is used to obtain event notification information; the sending module is also used to send subscription response information to the micro-isolation system in response to the subscription confirmation information; the subscription response information is used to indicate successful registration and / or successful subscription.

[0027] In a third aspect, the present application provides an electronic device, comprising: a processor and a memory; the memory stores instructions executable by the processor; when the processor is configured to execute the instructions, the electronic device implements the method of the first aspect above.

[0028] In a fourth aspect, the present application provides a readable storage medium, which includes: software instructions; when the software instructions are executed in an electronic device, the electronic device implements the method of the first aspect above.

[0029] In a fifth aspect, the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the steps of the related method described in the first aspect to implement the method of the first aspect.

[0030] The beneficial effects of the second to fifth aspects mentioned above refer to the corresponding description of the first aspect and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 A schematic diagram of an application environment of an access control method provided by this application;

[0033] Figure 2 A flowchart of an access control method provided by this application;

[0034] Figure 3 A flowchart of another access control method provided for this application;

[0035] Figure 4 A flowchart of another access control method provided by this application;

[0036] Figure 5 A flowchart of another access control method provided by this application;

[0037] Figure 6 A schematic diagram of the composition of an access control device provided in this application;

[0038] Figure 7 A schematic diagram of the composition of an electronic device provided in this application. DETAILED DESCRIPTION

[0039] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0040] It should be noted that, in the embodiments of the present application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplarily" or "for example" is intended to present related concepts in a specific way.

[0041] In order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first", "second", etc. are used to distinguish the same items or similar items with basically the same functions and effects. Those skilled in the art can understand that the words "first", "second", etc. are not limiting the quantity and execution order.

[0042] Currently, zero-trust security access control solutions combine software defined perimeter (SDP) technology, identity and access management (IAM) technology and micro-isolation technology to replace traditional network security solutions.

[0043] Micro-isolation technology can virtually divide a network (such as an enterprise intranet) into multiple small, isolated micro-network nodes, each of which can be regarded as a micro-isolation system. When an access device attempts to access a micro-isolation system, it must first pass the identity authentication of the IAM system using IAM technology. After the identity authentication is passed, the SDP system using SDP technology can issue the access control policy of the access device to the micro-isolation system, and the micro-isolation system can perform access control on the access device according to the access control policy issued by the SDP system.

[0044] However, current access control policies are less flexible.

[0045] Based on this, an embodiment of the present application provides an access control method, which can dynamically adjust the access control policy of the access device according to the status and behavior information of the access device, thereby improving the flexibility of the access control policy and the security of the network defense process.

[0046] The access control method provided by this application can be applied to Figure 1 In the access control system shown in Figure 1 As shown, the access control system includes: an access device 100, a security management and control platform 200, and a micro-isolation network 300.

[0047] The access device 100 may be a computer, a mobile phone, a tablet, or a self-service terminal device, etc. The embodiment of the present application does not limit the specific form of the access device 100.

[0048] The access device 100 can access the security management and control platform 200 through SDP and perform identity authentication. After the identity authentication is passed, the access device 100 can access the micro-isolation network 300.

[0049] For example, when performing identity authentication, the access device 100 can obtain user identity information and send it to the security management and control platform 200.

[0050] The user identity information may include: account password, fingerprint or face image, etc. The embodiment of the present application does not limit the specific content of the user identity information.

[0051] Optionally, taking the micro-isolation network 300 as an enterprise intranet, that is, dividing an enterprise intranet into multiple micro-isolation systems, the access device 100 may access the micro-isolation network 300 through the intranet or through the extranet. This embodiment of the application does not limit this.

[0052] The security management and control platform 200 can be deployed on electronic devices with computing and processing capabilities, such as computers or servers.

[0053] Among them, the server can be a single server, or it can be a server cluster consisting of multiple servers. In some implementations, the server cluster can also be a distributed cluster. Optionally, the server can also be implemented on a cloud platform, for example, the cloud platform can include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an inter-cloud, and a multi-cloud, etc., or any combination thereof. The embodiments of the present application are not limited to this.

[0054] The security management and control platform 200 can be used to authenticate the access device 100, and after the authentication is passed, send the accessible scope (or access control policy) of the access device 100 to the micro-isolation network 300.

[0055] The accessible range is used to indicate the micro-isolation systems accessible to the access device 100 in the micro-isolation network 300 .

[0056] For example, the security management and control platform 200 may include an administrator operation interface, a permission information database, an SDP module, an IAM module, and a micro-isolation module.

[0057] The administrator operation interface can be used to receive the accessible ranges corresponding to different users input by the administrator.

[0058] The permission information database can be used to store the accessible scopes corresponding to different users.

[0059] The SDP module may be used to access the access device 100 .

[0060] The IAM module may be used to perform identity authentication based on user identity information sent from the access device 100 after the access device 100 accesses.

[0061] The micro-isolation module can be used to retrieve the accessible scope corresponding to the user of the access device 100 from the permission information database and send it to the micro-isolation network 300 after the access device 100 passes the identity authentication.

[0062] In some embodiments, the security management and control platform 200 can dynamically update the accessible range of the access device according to the state and behavior information of the access device. The specific process can be referred to in the access control method provided in the following embodiment, and will not be repeated here.

[0063] The micro-isolation network 300 includes multiple micro-isolation systems. Figure 1 A total of three micro-isolation systems, namely micro-isolation system 301 , micro-isolation system 302 , and micro-isolation system 303 , are used as an example.

[0064] The micro-isolation system can be used to receive the accessible range sent from the security management and control platform 200, and control the access to the access device 100 based on the accessible range.

[0065] Exemplarily, taking the accessible scope of the access device 100 sent by the security management and control platform 200 as the micro-isolation system 301, the micro-isolation system 301 can allow access to the access device 100, and the micro-isolation system 302 and the micro-isolation system 303 can deny access to the access device 100.

[0066] The execution subject of the access control method provided in the embodiment of the present application is a security control platform (such as the above-mentioned security control platform 200). Optionally, the execution subject of the method may also be an electronic device deployed with the above-mentioned security control platform; or, a processor (such as a central processing unit (CPU)) in the above-mentioned electronic device; or, an application (APP) in the above-mentioned electronic device; or, a functional module for executing the access control method in the above-mentioned electronic device, etc. The embodiment of the present application does not limit this.

[0067] For the sake of simplicity, the following description will be uniformly introduced using the security management and control platform as an example of the execution subject of the access control method provided in the embodiment of the present application.

[0068] Figure 2 A flowchart of an access control method provided in an embodiment of the present application. Figure 2 As shown, the method specifically comprises the following steps:

[0069] S101. Obtain status and behavior information of a target access device.

[0070] Among them, the target access device is an access device assigned an accessible range after identity authentication; the accessible range includes at least one micro-isolation system among multiple micro-isolation systems; the access device status and behavior information includes at least one or more of the following: whether the target access device has the target software installed, the network where the target access device is located, and the access behavior record of the target device.

[0071] In some embodiments, when a user logs in, the security management and control platform can automatically obtain network information (such as the Internet Protocol (IP) address of the target access device) and installed software information through vulnerability scanning tools and network exploration tools, and store the above information in the security management and control platform. The security management and control platform can determine whether the target access device has installed the target software and the network where the target access device is located based on the network information and installed software information of the target access device.

[0072] Optionally, before obtaining and storing the network information and installed software information of the target access device, the security management and control platform can also obtain the authorization of the target access device to obtain and store the network information and installed software information. For example, before the target user device accesses the micro-isolation system, an authorization request interface for obtaining and storing the network information and installed software information can be displayed. In response to the user's authorization operation on the authorization request interface (such as checking the box of the authorization option), the authorization information is sent to the security management and control platform, so that the security management and control platform obtains the authorization to obtain and store the network information and installed software information of the target access device.

[0073] In some other embodiments, when an access device accesses a micro-isolated system in a micro-isolated network (such as the above-mentioned micro-isolated network 300), the security management and control platform can continuously monitor the access behavior of the target access device and generate an access behavior record of the target access device. The access behavior record of the target device includes: access time, access resources, operation type, and permission usage.

[0074] Optionally, before monitoring the access behavior of the target access device, the security management and control platform can also obtain the authorization of the target access device to monitor the access behavior. For example, before the target user device accesses the micro-isolation system, it can also display the authorization request interface for monitoring the access behavior, and in response to the user's authorization operation on the authorization request interface (such as checking the box of the authorization option), send authorization information to the security management and control platform, so that the security management and control platform obtains the authorization to monitor the access behavior.

[0075] S102: Based on the state and behavior information of the target access device, update the accessible range of the target access device to obtain an updated accessible range.

[0076] For example, when it is determined that the network in which the target access device is located is a preset abnormal network based on the network information of the above-mentioned target access device and / or it is determined that the target access device does not have the target software installed based on the software information installed on the above-mentioned target access device, the security management and control platform can update the accessible range of the target access device to empty (that is, prohibiting the target access device from accessing any micro-isolation system).

[0077] For another example, when it is determined based on the access behavior record of the target device that the target access device attempts to access the micro-isolation system outside the accessible range, the security management and control platform can narrow the accessible range of the target access device.

[0078] S103. Send the updated accessible range to multiple micro-isolation systems, so that the multiple micro-isolation systems control the access to the target access device based on the updated accessible range.

[0079] As an example, the security management and control platform can broadcast the updated accessible range of the target access device to multiple micro-isolated systems in the micro-isolated network.

[0080] The process of the micro-isolation system controlling access to the target access device based on the updated accessible scope can refer to the above Figure 1 The micro-isolation network 300 is described above and will not be repeated here.

[0081] In the access control method provided in the embodiment of the present application, the security management and control platform can update the accessible range of the target access device according to the status and behavior information of the target access device to which the accessible range is assigned, obtain the updated accessible range, and send the updated accessible range to multiple micro-isolation systems. Multiple micro-isolation systems can control the access to the target access device based on the updated accessible range, thereby realizing dynamic update of the access control policy of the access device and improving the flexibility of the access control policy.

[0082] In addition, a less flexible or static access control strategy may result in the target access device being attacked or controlled after obtaining authorization for a larger accessible range, causing damage to the micro-isolation system within the larger accessible range. After the target access device is attacked or controlled after obtaining authorization for a larger accessible range, its state and behavior information will change. The access control method provided in the embodiment of the present application can dynamically update the accessible range based on the state and behavior information, which can prevent the target access device from damaging the micro-isolation system within the larger accessible range according to the original larger accessible range, thereby improving the security of the network defense process.

[0083] The specific process of the above S102 is introduced below.

[0084] In some possible embodiments, the security management and control platform can determine the security status score of the target access device based on the status and behavior information, and then update the accessible range based on the security status score. Figure 3 As shown, S102 may include S1021 - S1022 .

[0085] S1021. Determine a security status score of the target access device based on preset scoring rules and the status and behavior information of the target access device.

[0086] The preset scoring rule may be a scoring mechanism corresponding to the status type and behavior information of the target access device, which is flexibly configured by an administrator who manages the target user according to system security requirements.

[0087] In a possible implementation, the above S1021 may specifically include the following steps:

[0088] Step 1a: Obtain the standard security status score of the target access device.

[0089] For example, under the deduction mechanism, the security management and control platform can set a preset standard security status score for each access device. The standard security status score can be set to 100, 90, or 80, etc. The embodiment of the present application does not limit the specific value of the standard security status score under the deduction mechanism.

[0090] Step 2a: When it is determined based on the status and behavior information that the target access device has abnormal behavior, the reference score corresponding to the abnormal behavior is deducted from the standard security status score (according to a preset scoring rule) to obtain a security status score.

[0091] Optionally, abnormal behavior may include: status and behavior information (such as the above-mentioned installed software information) indicating that the target access device does not have the target software installed, status and behavior information (such as the above-mentioned network information) indicating that the network where the target access device is located is a preset abnormal network, and the access behavior record in the status and behavior information indicating that the target access device (attempts to) access network resources outside the accessible range, etc.

[0092] Exemplarily, when the target access device exhibits abnormal behavior, for example, the target access device attempts to access a micro-isolation system outside the accessible range, the security management and control platform may use a preset scoring rule: the standard security status score of the user device is 90, and the reference score corresponding to the abnormal behavior is 10, then the security status score of the user device is obtained by deducting the reference score corresponding to the abnormal behavior from the standard security status score, and the score is 80.

[0093] In another possible implementation, as described above, the preset scoring rule may also be a scoring mechanism. In this case, the above S1021 may specifically include the following steps:

[0094] Step 1b: Obtain the standard security status score of the target access device.

[0095] For example, under the scoring mechanism, the security management and control platform can set a preset standard security status score for each access device. The standard security status score can be set to 0, 20, or 50, etc. The embodiment of the present application does not limit the specific value of the standard security status score under the scoring mechanism.

[0096] Step 2b: When it is determined based on the status and behavior information that the target access device does not have a certain abnormal behavior, the standard security status score is added to the reference score corresponding to the abnormal behavior (according to a preset scoring rule) to obtain a security status score.

[0097] The details of step 2b may refer to the above step 2a, which will not be repeated here.

[0098] S1022: Based on the security status score of the target access device, update the accessible range of the target access device to obtain an updated accessible range.

[0099] Optionally, the security management and control platform may update the accessible range of the target access device by adjusting the user group to which the target access device belongs. In this case, the above S1022 may specifically include:

[0100] Step 1c: based on the group correspondence and the security score of the target access device, the user group to which the target access device belongs is updated to obtain an updated user group of the target access device.

[0101] The group correspondence is used to represent the correspondence between the security score and the user group, and each user group corresponds to an accessible range.

[0102] For example, the security management and control platform may use the security score of the target access device as an index, traverse the group correspondence relationship, and use the user group corresponding to the security score of the target access device in the group correspondence relationship as the updated user group of the target access device.

[0103] Step 2c: based on the updated user grouping of the target access device, update the accessible range of the target access device to obtain an updated accessible range.

[0104] Exemplarily, the group correspondence relationship may be: the security score corresponding to group one is above 80 points, and the user devices of group one can access micro-isolation system 301 and micro-isolation system 302; the security score corresponding to group two is 60 to 79 points, and the user devices of group two can only access micro-isolation system 301. For example, if the security score of the current target access device is updated from 90 to 70, the security management and control platform may update the group of the target user device from the original group one to group two based on the group correspondence relationship and the security score of the target access device, and update the accessible range of the target access device from the original micro-isolation system 301 and micro-isolation system 302 to micro-isolation system 301. In some possible embodiments, the micro-isolation system (such as micro-isolation system 301) may also receive the accessible range assigned by the security management and control platform 200 to the target access device. Figure 4 Another flow chart of the access control method provided in the embodiment of the present application. Figure 4 As shown, before the above S101, the method may further include the following steps:

[0105] S201. In response to a target access device login status change event, corresponding event notification information is generated.

[0106] The types of login status change events include login or logout. The event notification information includes the identity of the target access device, the address information assigned by the security management and control platform to the target access device (for example, if the micro-isolation network is the enterprise intranet, the address information assigned by the security management and control platform can be understood as the intranet IP), the accessible range of the target access device, and the type of login status change event.

[0107] S202. Send event notification information to multiple micro-isolation systems.

[0108] It should be understood that in the related technology, when the access device accesses the micro-isolation system, it sends an access request to the micro-isolation system through the SDP gateway. The micro-isolation system cannot perceive the identity and address of the access device corresponding to the access request, which reduces the auditability and traceability of the network defense system. In the access control method provided in the embodiment of the present application, the security management and control platform can respond to the target access device login status change event, generate event notification information and send it to the micro-isolation system. The event notification information includes the identity of the target access device, the assigned address information, the accessible range and the type of login status change event. In this way, the micro-isolation system can perceive the identity and address of the target access device and other related information based on the event notification information, and can review and trace the information security issues that arise based on the identity and address and other related information, thereby improving the auditability and traceability of the network defense system.

[0109] In some possible embodiments, all micro-isolation systems included in the micro-isolation network 300 (such as micro-isolation system 301, micro-isolation system 302 or micro-isolation system 303, etc.) can establish a data transmission channel with the security management and control platform 200 and subscribe to login status change events. Figure 5 Another flow chart of the access control method provided in the embodiment of the present application. Before the above 201, the method may include the following steps:

[0110] S301. Receive subscription request information from the micro-isolation system.

[0111] Among them, the subscription request information includes a list of services that the micro-isolation system (can provide) and the event type requested for subscription; the event type requested for subscription includes a login status change event.

[0112] S302. In response to the subscription request information, send interface configuration information to the micro-isolation system.

[0113] Among them, the received configuration information may include configuration parameters such as the application program interface (API) address of the micro-isolation module in the security management and control platform and the supported message formats.

[0114] S303. Receive subscription confirmation information from the micro-isolation system.

[0115] The subscription confirmation information is generated by the micro-isolation system after the internal listener is configured based on the interface configuration information. The internal listener is used to obtain event notification information.

[0116] S304. In response to the subscription confirmation information, a subscription response information is sent to the micro-isolation system.

[0117] The subscription response information is used to indicate a successful registration and / or a successful subscription.

[0118] In some possible embodiments, before the micro-isolation system sends a subscription request message to the security management and control platform, it can also configure and save corresponding connection information and establish an initial connection.

[0119] The configuration of the corresponding connection information includes the following parts:

[0120] 1) Key: Specifically, the administrator generates a unique registration key for different micro-isolation systems on the security management and control platform, which is used for identity authentication when the micro-isolation system requests a subscription.

[0121] 2) Subscription content, which is used to specify the message types that different micro-isolation systems can subscribe to, specifically, including user authentication events, user group information, user online and offline notifications, and the IP and port range assigned to users online.

[0122] 3) Interaction mode and parameters: This interaction mode is used to set the encryption method and protocol type for communication between the security control platform and the micro-isolation system. This parameter ensures the accurate transmission and reception of information during the interaction process.

[0123] Optionally, the interaction method may be a Transmission Control Protocol (TCP) protocol based on Transport Layer Security (TLS) encryption, and the parameters may be a port, a Uniform Resource Locator (URL) path, and a message format.

[0124] Exemplarily, saving the corresponding connection information includes: saving the above-mentioned keys, subscription content, interaction methods and parameters to the security management and control platform, and assigning a unique identifier to the connection information of each micro-isolation system (such as micro-isolation system 301, etc.) to manage and identify different micro-isolation systems.

[0125] Exemplarily, establishing an initial connection includes: in the administrator operation interface of the security management and control platform, entering the URL path, port and key configured above, authenticating the micro-isolation system (such as micro-isolation system 301, etc.), and based on the successful verification result, the micro-isolation system (such as micro-isolation system 301, etc.) establishes an initial connection with the security management and control platform 200.

[0126] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to realize the above functions, the security management and control platform includes hardware structures and / or software modules corresponding to the execution of each function. It should be easy to realize that the technical goals in this field are combined with the units and algorithm steps of each example described in the embodiments disclosed in this article, and the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional technical goals can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0127] In an exemplary embodiment, the present application further provides an access control device. The access control device can be applied to a security management and control platform, and the access control device can include one or more functional modules for implementing the access control method of the above method embodiment.

[0128] For example, Figure 6 A schematic diagram of the composition of an access control device provided in an embodiment of the present application. Figure 6 As shown, the access control device includes: an acquisition module 601 , a processing module 602 and a sending module 603 .

[0129] The acquisition module 601 is used to obtain the status and behavior information of the target access device; the target access device is an access device assigned an accessible range after identity authentication; the accessible range includes at least one micro-isolation system among multiple micro-isolation systems.

[0130] The processing module 602 is used to update the accessible range of the target access device based on the state and behavior information of the target access device to obtain an updated accessible range.

[0131] The sending module 603 is used to send the updated accessible range to multiple micro-isolation systems, so that the multiple micro-isolation systems control the access to the target access device based on the updated accessible range.

[0132] In some possible embodiments, the status and behavior information includes at least one of the following: whether the target access device has the target software installed, the network where the target access device is located, and the access behavior record of the target access device.

[0133] In some other possible embodiments, the processing module 602 is specifically used to determine the security status score of the target access device based on preset scoring rules and the status and behavior information of the target access device; based on the security status score of the target access device, update the accessible range of the target device to obtain an updated accessible range.

[0134] In some other possible embodiments, the processing module 602 is specifically used to update the user group to which the target access device belongs based on the group correspondence and the security score of the target access device, so as to obtain the updated user group of the target access device; the group correspondence is used to represent the correspondence between the security score and the user group, and each user group corresponds to an accessible range; based on the updated user group of the target access device, the accessible range of the target device is updated to obtain the updated accessible range.

[0135] In some other possible embodiments, the processing module 602 is specifically used to obtain a standard security status score of the target access device; when it is determined that the target access device has abnormal behavior based on the status and behavior information, the standard security status score is deducted from the reference score corresponding to the abnormal behavior to obtain a security status score.

[0136] In some other possible embodiments, abnormal behavior includes: status and behavior information indicating that the target access device does not have the target software installed; status and behavior information indicating that the network where the target access device is located is a preset abnormal network; and access behavior records in the status and behavior information indicating that the target access device accesses a micro-isolation system outside the accessible range.

[0137] In some other possible embodiments, the processing module 602 is also used to respond to the target access device login status change event and generate corresponding event notification information; the types of login status change events include login or logout; the event notification information includes the identity of the target access device, the address information assigned to the target access device by the security management and control platform, the accessible range of the target access device, and the type of login status change event; the sending module 603 is also used to send event notification information to multiple micro-isolation systems.

[0138] In some other possible embodiments, the acquisition module 601 is also used to receive subscription request information from the micro-isolation system; the subscription request information includes a service list of the micro-isolation system and an event type requested for subscription; the event type requested for subscription includes a login status change event; the sending module 603 is also used to send interface configuration information to the micro-isolation system in response to the subscription request information; the acquisition module 601 is also used to receive subscription confirmation information from the micro-isolation system, and the subscription confirmation information is generated after the micro-isolation system completes the configuration of the internal listener based on the interface configuration information; the internal listener is used to obtain event notification information; the sending module 603 is also used to send subscription response information to the micro-isolation system in response to the subscription confirmation information; the subscription response information is used to indicate successful registration and / or successful subscription.

[0139] It should be noted that Figure 6 The division of modules in the example is schematic and is only a logical function division. There may be other division methods in actual implementation. For example, two or more functions may be integrated into one processing module. The above integrated modules may be implemented in the form of hardware or software function modules.

[0140] In an exemplary embodiment, the embodiment of the present application further provides an electronic device, in which the above-mentioned security management and control platform can be deployed. Figure 7 The following is a schematic diagram of the composition of an electronic device provided in an embodiment of the present application. Figure 7 As shown, the electronic device may include: a memory 701 and a processor 702; the memory 701 stores instructions executable by the processor 702; when the processor 702 is configured to execute the instructions, the electronic device or network device or manager implements the method described in the aforementioned method embodiment.

[0141] It should be noted that Figure 7 The structure shown in the figure does not constitute a limitation on the electronic device, except Figure 7 In addition to the components shown, the electronic device may include more or fewer components than shown, or a combination of certain components, or a different arrangement of components.

[0142] In an exemplary embodiment, the present application also provides a readable storage medium, which includes software instructions; when the software instructions are executed in an electronic device, the electronic device implements the method described in the aforementioned embodiment. The computer-readable storage medium can be a non-temporary computer-readable storage medium, for example, a non-temporary computer-readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device.

[0143] In an exemplary embodiment, the embodiment of the present application further provides a computer program product, which includes: computer instructions; when the computer program product is executed in an electronic device, the electronic device executes the above-mentioned related method steps to implement the access control method in the above-mentioned embodiment.

[0144] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other variations of the disclosed embodiments by viewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple situations. A single processor or other unit may implement several functions listed in a claim. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0145] Although the present application has been described in conjunction with specific features and embodiments thereof, it is obvious that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely exemplary illustrations of the present application as defined by the appended claims, and are deemed to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

[0146] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto, and any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An access control method, characterized in that: The method is applied to a security management and control platform; The security management and control platform is communicatively connected with a plurality of micro-isolation systems; the method comprises: Acquire the status and behavior information of the target access device; the target access device is an access device that is assigned an accessible range after identity authentication; the accessible range includes at least one micro-isolated system among the multiple micro-isolated systems; Based on the state and behavior information of the target access device, updating the accessible range of the target access device to obtain an updated accessible range; The updated accessible scope is sent to the multiple micro-isolation systems so that the multiple micro-isolation systems control access to the target access device based on the updated accessible scope.

2. The method according to claim 1, characterized in that The status and behavior information includes at least one of the following: whether the target access device has installed the target software, the network where the target access device is located, and the access behavior record of the target access device.

3. The method according to claim 1, characterized in that The updating of the accessible range of the target device based on the state and behavior information of the target access device to obtain the updated accessible range includes: Determine the security status score of the target access device based on preset scoring rules and the status and behavior information of the target access device; Based on the security status score of the target access device, the accessible range of the target device is updated to obtain an updated accessible range.

4. The method according to claim 3, characterized in that The updating of the accessible range of the target access device based on the security status score of the target access device to obtain the updated accessible range includes: Based on the group correspondence and the security score of the target access device, the user group of the target access device is updated to obtain the updated user group of the target access device; the group correspondence is used to represent the correspondence between the security score and the user group, and each user group corresponds to an accessible range; Based on the updated user grouping of the target access device, the accessible range of the target device is updated to obtain the updated accessible range.

5. The method according to claim 3, characterized in that: The step of determining the security status score of the target access device based on a preset scoring rule and the status and behavior information of the target access device includes: Obtaining a standard security status score of the target access device; In the case where it is determined based on the status and behavior information that the target access device has abnormal behavior, the reference score corresponding to the abnormal behavior is deducted from the standard security status score to obtain the security status score.

6. The method according to claim 5, characterized in that The abnormal behaviors include: The state and behavior information indicates that the target access device does not have the target software installed; The state and behavior information indicates that the network where the target access device is located is a preset abnormal network; The access behavior record in the status and behavior information indicates that the target access device accesses the micro-isolation system outside the accessible scope.

7. The method according to claim 1, characterized in that The method further comprises: In response to the target access device login status change event, corresponding event notification information is generated; the type of the login status change event includes login or logout; the event notification information includes the identity of the target access device, the address information assigned by the security management and control platform to the target access device, the accessible range of the target access device and the type of the login status change event; The event notification information is sent to the multiple micro-isolation systems.

8. The method according to claim 7, characterized in that The method further comprises: Receive subscription request information from a micro-isolation system; the subscription request information includes a service list of the micro-isolation system and an event type requested for subscription; the event type requested for subscription includes the login status change event; In response to the subscription request information, sending interface configuration information to the micro-isolation system; Receiving subscription confirmation information from the micro-isolation system, where the subscription confirmation information is generated by the micro-isolation system after completing configuration of an internal listener based on the interface configuration information; the internal listener is used to obtain the event notification information; In response to the subscription confirmation information, a subscription response information is sent to the micro-isolation system; the subscription response information is used to indicate successful registration and / or successful subscription.

9. An access control device, characterized in that: The device is applied to a security management and control platform; The security management and control platform is communicatively connected with a plurality of micro-isolation systems; the device comprises: an acquisition module, a processing module and a sending module; The acquisition module is used to acquire the status and behavior information of the target access device; the target access device is an access device that is assigned an accessible range after identity authentication; the accessible range includes at least one micro-isolation system among the multiple micro-isolation systems; The processing module is used to update the accessible range of the target device based on the state and behavior information of the target access device to obtain an updated accessible range; The sending module is used to send the updated accessible range to the multiple micro-isolation systems, so that the multiple micro-isolation systems control the access to the target access device based on the updated accessible range.

10. An electronic device, characterized in that: The electronic device comprises: a processor and a memory; The memory stores instructions executable by the processor; When the processor is configured to execute the instructions, the electronic device implements the method according to any one of claims 1 to 8.

11. A readable storage medium, characterized in that: The readable storage medium includes: software instructions; When the software instructions are executed in an electronic device, the electronic device implements the method according to any one of claims 1 to 8.

12. A computer program product, characterized in that The computer program product comprises: computer instructions; When the computer instructions are executed in an electronic device, the electronic device is enabled to implement the method according to any one of claims 1 to 8.

Images