Access control method, device, equipment, storage medium and program product

Abstract

This application provides an access control method, apparatus, device, storage medium, and program product, relating to the field of network security. The method is capable of dynamically updating access control policies. The method includes: acquiring the status and behavior information of a target access device, wherein the target access device is an access device assigned an access range after authentication; updating the access range of the target access device based on the status and behavior information to obtain the updated access range; and sending the updated access range to multiple micro-segmentation systems, so that the multiple micro-segmentation systems control access to the target access device based on the updated access range.

Description

Technical Field

[0001] This application relates to the field of network security, and in particular to an access control method, apparatus, device, storage medium, and program product. Background Technology

[0002] Currently, zero-trust security access control solutions, which combine software-defined perimeter (SDP) technology, identity and access management (IAM) technology, and micro-segmentation technology, have replaced traditional network security solutions.

[0003] Micro-segmentation technology can virtually divide a network (such as an enterprise intranet) into multiple small, isolated network nodes, each of which can be viewed as a micro-segmentation system. When an access device attempts to access a micro-segmentation system, it first needs to authenticate with an IAM system using IAM technology. After successful authentication, an SDP system using SDP technology can issue access control policies for the accessing device to the micro-segmentation system. The micro-segmentation system can then control access to the accessing device according to the access control policies issued by the SDP system.

[0004] However, current access control policies are not very flexible. Summary of the Invention

[0005] This application provides an access control method, apparatus, device, storage medium, and program product, which can dynamically update the accessible scope of the access device based on the status and behavior information of the access device, thereby improving the flexibility of access control policies.

[0006] Firstly, this application provides an access control method applied to a security management platform; the security management platform is communicatively connected to multiple micro-segmentation systems; the method includes: acquiring the status and behavior information of a target access device; the target access device is an access device assigned an accessible range after authentication; the accessible range includes at least one micro-segmentation system among the multiple micro-segmentation systems; updating the accessible range of the target access device based on the status and behavior information of the target access device to obtain the updated accessible range; and sending the updated accessible range to the multiple micro-segmentation systems so that the multiple micro-segmentation systems control access to the target access device based on the updated accessible range.

[0007] In the access control method provided in this application, the security management platform can update the access range of the target access device based on the status and behavior information of the target access device with an allocated access range, obtain the updated access range, and send the updated access range to multiple micro-segmentation systems. The multiple micro-segmentation systems can control access to the target access device based on the updated access range, thereby realizing the dynamic updating of the access control policy for the access device and improving the flexibility of the access control policy.

[0008] Furthermore, inflexible or static access control policies may allow a target access device to be attacked or controlled after gaining authorization for a larger access range, thus damaging the micro-segmented system within that larger access range. After a target access device is attacked or controlled following authorization for a larger access range, its state and behavior information will change. The access control method provided in this application can dynamically update the access range based on state and behavior information, preventing the target access device from damaging the micro-segmented system within the larger access range by adhering to its original larger access range, thereby improving security during network defense.

[0009] One possible implementation is that the status and behavior information includes at least one of the following: whether the target access device has the target software installed, the network where the target access device is located, and the access behavior records of the target access device.

[0010] Another possible implementation involves updating the accessibility range of the target access device based on its status and behavior information, resulting in an updated accessibility range. This includes: determining the security status score of the target access device based on preset scoring rules and its status and behavior information; and updating the accessibility range of the target access device based on its security status score, resulting in an updated accessibility range.

[0011] Another possible implementation involves updating the accessibility range of the target access device based on its security status score, resulting in an updated accessibility range. This includes: updating the user group to which the target access device belongs based on the group mapping relationship and the security status score of the target access device, resulting in an updated user group for the target access device; the group mapping relationship is used to represent the correspondence between the security status score and the user group, with each user group corresponding to an accessibility range; and updating the accessibility range of the target access device based on the updated user group for the target access device, resulting in an updated accessibility range.

[0012] Another possible implementation involves determining the security status score of the target access device based on preset scoring rules and the status and behavior information of the target access device. This includes: obtaining the standard security status score of the target access device; and, if it is determined that the target access device has abnormal behavior based on the status and behavior information, subtracting the reference score corresponding to the abnormal behavior from the standard security status score to obtain the security status score.

[0013] Another possible implementation includes the following abnormal behaviors: status and behavior information indicating that the target access device does not have the target software installed; status and behavior information indicating that the network where the target access device is located is a preset abnormal network; and access behavior records in the status and behavior information indicating that the target access device accesses a micro-segmentation system outside the accessible range.

[0014] Another possible implementation method further includes: generating event notification information in response to a login status change event of the target access device; the types of login status change events include login or logout; the event notification information includes the identity identifier of the target access device, the address information assigned to the target access device by the security management platform, the accessible range of the target access device, and the type of login status change event; and sending the event notification information to multiple micro-segmentation systems.

[0015] Another possible implementation method further includes: receiving subscription request information from the micro-segmentation system; the subscription request information includes the service list of the micro-segmentation system and the event type to be subscribed to; the event type to be subscribed to includes a login state change event; in response to the subscription request information, sending interface configuration information to the micro-segmentation system; receiving subscription confirmation information from the micro-segmentation system, the subscription confirmation information being generated by the micro-segmentation system after configuring the internal listener based on the interface configuration information; the internal listener is used to obtain event notification information; in response to the subscription confirmation information, sending subscription response information to the micro-segmentation system; the subscription response information is used to indicate successful registration and / or successful subscription.

[0016] Secondly, this application provides an access control device applied to a security management platform; the security management platform is communicatively connected to multiple micro-segmentation systems, and the device includes: an acquisition module, a processing module, and a sending module.

[0017] The acquisition module is used to acquire the status and behavior information of the target access device; the target access device is an access device that has been assigned an access range after authentication; the access range includes at least one micro-segmentation system among multiple micro-segmentation systems.

[0018] The processing module is used to update the accessibility range of the target access device based on the status and behavior information of the target access device, and obtain the updated accessibility range.

[0019] The sending module is used to send updated access ranges to multiple micro-segmentation systems, so that the multiple micro-segmentation systems can control access to the target access device based on the updated access ranges.

[0020] One possible implementation is that the status and behavior information includes at least one of the following: whether the target access device has the target software installed, the network where the target access device is located, and the access behavior records of the target access device.

[0021] Another possible implementation involves a processing module that, based on preset scoring rules and the status and behavior information of the target access device, determines the security status score of the target access device; and updates the accessibility range of the target access device based on the security status score, thus obtaining the updated accessibility range.

[0022] Another possible implementation involves a processing module that updates the user group containing the target access device based on the group correspondence and the security status score of the target access device, thus obtaining the updated user group for the target access device. The group correspondence represents the relationship between the security status score and the user group, with each user group corresponding to an accessible range. Based on the updated user group for the target access device, the accessible range of the target access device is updated to obtain the updated accessible range.

[0023] Another possible implementation is a processing module, which is specifically used to obtain the standard security status score of the target access device; if it is determined that the target access device has abnormal behavior based on the status and behavior information, the standard security status score is subtracted from the reference score corresponding to the abnormal behavior to obtain the security status score.

[0024] Another possible implementation includes the following abnormal behaviors: status and behavior information indicating that the target access device does not have the target software installed; status and behavior information indicating that the network where the target access device is located is a preset abnormal network; and access behavior records in the status and behavior information indicating that the target access device accesses a micro-segmentation system outside the accessible range.

[0025] Another possible implementation is that the processing module is also used to respond to the login status change event of the target access device and generate corresponding event notification information; the types of login status change events include login or logout; the event notification information includes the identity identifier of the target access device, the address information assigned to the target access device by the security management platform, the accessible range of the target access device, and the type of login status change event; the sending module is used to send event notification information to multiple micro-segmentation systems.

[0026] Another possible implementation involves an acquisition module that receives subscription request information from the micro-segmentation system. This subscription request information includes the micro-segmentation system's service list and the event type to be subscribed to. The event type to be subscribed to includes login status change events. A sending module is also used to send interface configuration information to the micro-segmentation system in response to the subscription request information. The acquisition module further receives subscription confirmation information from the micro-segmentation system, which is generated by the micro-segmentation system after configuring its internal listener based on the interface configuration information. The internal listener is used to acquire event notification information. Finally, the sending module sends a subscription response information to the micro-segmentation system in response to the subscription confirmation information. The subscription response information indicates successful registration and / or successful subscription.

[0027] Thirdly, this application provides an electronic device comprising: a processor and a memory; the memory storing processor-executable instructions; when the processor is configured to execute the instructions, causing the electronic device to implement the method of the first aspect described above.

[0028] Fourthly, this application provides a readable storage medium comprising: software instructions; when the software instructions are executed in an electronic device, they cause the electronic device to implement the method described in the first aspect.

[0029] Fifthly, this application provides a computer program product that, when run on an electronic device, causes the electronic device to perform the steps of the relevant method described in the first aspect above, so as to implement the method of the first aspect above.

[0030] The beneficial effects of the second to fifth aspects mentioned above are described in the corresponding description of the first aspect and will not be repeated here. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 A schematic diagram illustrating the application environment of an access control method provided in this application;

[0033] Figure 2 A flowchart illustrating an access control method provided in this application;

[0034] Figure 3 A flowchart illustrating another access control method provided in this application;

[0035] Figure 4 A flowchart illustrating another access control method provided in this application;

[0036] Figure 5 A flowchart illustrating another access control method provided in this application;

[0037] Figure 6 A schematic diagram of the composition of an access control device provided in this application;

[0038] Figure 7 This is a schematic diagram of the composition of an electronic device provided in this application. Detailed Implementation

[0039] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0040] It should be noted that in the embodiments of this application, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplarily" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a specific manner.

[0041] To facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art can understand that the terms "first" and "second" are not intended to limit the quantity or execution order.

[0042] Currently, zero-trust security access control solutions, which combine software-defined perimeter (SDP) technology, identity and access management (IAM) technology, and micro-segmentation technology, have replaced traditional network security solutions.

[0043] Micro-segmentation technology can virtually divide a network (such as an enterprise intranet) into multiple small, isolated network nodes, each of which can be viewed as a micro-segmentation system. When an access device attempts to access a micro-segmentation system, it first needs to authenticate with an IAM system using IAM technology. After successful authentication, an SDP system using SDP technology can issue access control policies for the accessing device to the micro-segmentation system. The micro-segmentation system can then control access to the accessing device according to the access control policies issued by the SDP system.

[0044] However, current access control policies are not very flexible.

[0045] Based on this, embodiments of this application provide an access control method that can dynamically adjust the access control policy of the access device according to the status and behavior information of the access device, thereby improving the flexibility of the access control policy and the security in the network defense process.

[0046] This application provides an access control method that can be applied to, for example... Figure 1 In the access control system shown. For example... Figure 1 As shown, the access control system includes: access device 100, security management platform 200, and micro-segmentation network 300.

[0047] The access device 100 can be a computer, mobile phone, tablet, or self-service terminal device, etc. This application embodiment does not limit the specific form of the access device 100.

[0048] Access device 100 can access security management platform 200 via SDP and perform identity authentication. After successful identity authentication, access device 100 can access micro-segmentation network 300.

[0049] For example, during identity authentication, access device 100 can obtain user identity information and send it to security management platform 200.

[0050] The user identity information may include: account password, fingerprint, or facial image, etc. This application embodiment does not limit the specific content of the user identity information.

[0051] Optionally, taking the micro-segmentation network 300 as an enterprise intranet, that is, dividing an enterprise's intranet into multiple micro-segmentation systems as an example, the access device 100 can access the micro-segmentation network 300 through the intranet or through the extranet. This application embodiment does not limit this.

[0052] The security management platform 200 can be deployed on electronic devices with computing and processing capabilities, such as computers or servers.

[0053] The server can be a single server or a server cluster consisting of multiple servers. In some embodiments, the server cluster can also be a distributed cluster. Optionally, the server can also be implemented on a cloud platform, such as a private cloud, public cloud, hybrid cloud, community cloud, distributed cloud, inter-cloud, and multi-cloud, or any combination thereof. This application does not limit this aspect.

[0054] The security management platform 200 can be used to authenticate the access device 100, and after successful authentication, send the access scope (or access control policy) of the access device 100 to the micro-segmentation network 300.

[0055] The "accessible range" is used to indicate the micro-segmentation system that the access device 100 in the micro-segmentation network 300 can access.

[0056] For example, the security management platform 200 may include an administrator interface, a permission information database, an SDP module, an IAM module, and a micro-segmentation module.

[0057] The administrator interface can be used to receive the access permissions for different users as input by the administrator.

[0058] The permissions information database can be used to store the access permissions of different users.

[0059] The SDP module can be used to access device 100.

[0060] The IAM module can be used to authenticate the user's identity based on the user identity information sent by the access device 100 after the access device 100 is connected.

[0061] The micro-segmentation module can be used to retrieve the access range corresponding to the user of access device 100 from the permission information database after the access device 100 has been authenticated and send it to the micro-segmentation network 300.

[0062] In some embodiments, the security management platform 200 can dynamically update the accessibility scope of the accessing device based on the status and behavior information of the accessing device. The specific process can be referred to the access control method provided in the following embodiments, and will not be repeated here.

[0063] Micro-segmentation network 300 includes multiple micro-segmentation systems. Figure 1 The following example illustrates three micro-isolation systems: micro-isolation system 301, micro-isolation system 302, and micro-isolation system 303.

[0064] The micro-segmentation system can be used to receive the access range sent from the security management platform 200 and control access to the access device 100 based on the access range.

[0065] For example, taking the access range of the access device 100 sent by the security management platform 200 as the micro-segmentation system 301 as an example, the micro-segmentation system 301 can allow the access device 100 to access, while the micro-segmentation system 302 and the micro-segmentation system 303 can deny the access device 100 to access.

[0066] The execution entity of the access control method provided in this application embodiment is a security management platform (such as the security management platform 200 mentioned above). Optionally, the execution entity of the method may also be an electronic device on which the aforementioned security management platform is deployed; or, a processor (e.g., a central processing unit (CPU)) in the aforementioned electronic device; or, an application (APP) in the aforementioned electronic device; or, a functional module in the aforementioned electronic device used to execute the access control method, etc. This application embodiment does not impose any limitations on this.

[0067] For the sake of brevity, the following description will take the security management platform as the execution subject of the access control method provided in the embodiments of this application.

[0068] Figure 2 This is a flowchart illustrating an access control method provided in an embodiment of this application. Figure 2 As shown, the method specifically includes the following steps:

[0069] S101. Obtain the status and behavior information of the target access device.

[0070] The target access device is an access device that has been assigned an access range after authentication; the access range includes at least one micro-segmentation system among multiple micro-segmentation systems; the access device status and behavior information includes at least one or more of the following: whether the target access device has the target software installed, the network where the target access device is located, and the access behavior records of the target access device.

[0071] In some embodiments, when a user logs in, the security management platform can automatically obtain network information (such as the Internet Protocol (IP) address of the target access device) and installed software information through vulnerability scanning tools and network probing tools, and store the above information on the security management platform. The security management platform can determine whether the target access device has the target software installed and the network on which the target access device is located based on the network information and installed software information of the target access device.

[0072] Optionally, before acquiring and storing the network information and installed software information of the target access device, the security management platform can also obtain authorization from the target access device to acquire and store the network information and installed software information. For example, before the target user device accesses the micro-segmentation system, an authorization request interface for acquiring and storing network information and installed software information can be displayed. In response to the user's authorization operation on the authorization request interface (e.g., checking the box for the authorization option), authorization information is sent to the security management platform, thereby enabling the security management platform to obtain authorization to acquire and store the network information and installed software information of the target access device.

[0073] In other embodiments, when an access device accesses a micro-segmentation system within a micro-segmentation network (such as the micro-segmentation network 300 described above), the security management platform can continuously monitor the access behavior of the target access device and generate access behavior records for the target access device. These access behavior records include: access time, accessed resources, operation type, and permission usage.

[0074] Optionally, before monitoring the access behavior of the target access device, the security management platform can also obtain authorization from the target access device for the monitored access behavior. For example, before the target user device accesses the micro-segmentation system, an authorization request interface for monitoring access behavior can be displayed. In response to the user's authorization operation on the authorization request interface (such as checking the box for the authorization option), authorization information is sent to the security management platform, thereby enabling the security management platform to obtain authorization for the monitored access behavior.

[0075] S102. Based on the status and behavior information of the target access device, update the access range of the target access device to obtain the updated access range.

[0076] For example, if the target access device is located in an abnormal network based on the network information of the target access device and / or the target access device is not installed on the target software based on the software information of the target access device, the security management platform can update the access range of the target access device to empty (that is, prohibit the target access device from accessing any micro-segmentation system).

[0077] For example, if the access behavior records of the target access device indicate that the target access device is attempting to access a micro-segmentation system outside the accessible range, the security management platform can narrow down the accessible range of the target access device.

[0078] S103. Send the updated access range to multiple micro-segmentation systems so that the multiple micro-segmentation systems can control access to the target access device based on the updated access range.

[0079] As an example, a security management platform can broadcast the updated access range of a target access device to multiple micro-segmented systems in a micro-segmented network.

[0080] The process by which a micro-segmentation system controls access to a target access device based on the updated accessibility range can be referred to the above. Figure 1 The micro-isolation network 300 described above will not be repeated here.

[0081] In the access control method provided in this application embodiment, the security management platform can update the access range of the target access device based on the status and behavior information of the target access device with an allocated access range, obtain the updated access range, and send the updated access range to multiple micro-segmentation systems. The multiple micro-segmentation systems can control access to the target access device based on the updated access range, thereby realizing the dynamic updating of the access control policy for the access device and improving the flexibility of the access control policy.

[0082] Furthermore, inflexible or static access control policies may allow a target access device to be attacked or controlled after gaining authorization for a larger access range, thus damaging the micro-segmented system within that larger access range. After a target access device is attacked or controlled following authorization for a larger access range, its state and behavior information will change. The access control method provided in this application can dynamically update the access range based on state and behavior information, preventing the target access device from damaging the micro-segmented system within the larger access range by adhering to its original larger access range, thereby improving security during network defense.

[0083] The specific process of S102 described above is described below.

[0084] In some possible embodiments, the security management platform can determine the security status score of the target access device based on status and behavior information, and then update the accessible range based on the security status score. Specifically, such as Figure 3 As shown, S102 may include S1021-S1022.

[0085] S1021. Based on the preset scoring rules and the status and behavior information of the target access device, determine the security status score of the target access device.

[0086] Among them, the preset scoring rules can be flexibly configured by the administrator who manages the target user according to the system security requirements, and are a deduction mechanism corresponding to the status type and behavior information of the target access device.

[0087] In one possible implementation, S1021 above may specifically include the following steps:

[0088] Step 1a: Obtain the standard security status score of the target access device.

[0089] For example, under a point deduction mechanism, the security management platform can set a preset standard security status score for each accessing device. This standard security status score can be set to, for example, 100, 90, or 80. This application embodiment does not limit the specific value of the standard security status score under the point deduction mechanism.

[0090] Step 2a: If it is determined that the target access device has abnormal behavior based on the status and behavior information, (according to the preset scoring rules) the standard security status score is reduced by the reference score corresponding to the abnormal behavior to obtain the security status score.

[0091] Optionally, abnormal behavior may include: status and behavior information (such as the software information mentioned above) indicating that the target access device has not installed the target software; status and behavior information (such as the network information mentioned above) indicating that the network where the target access device is located is a preset abnormal network; and access behavior records in the status and behavior information indicating that the target access device (attempts) to access network resources outside the accessible range, etc.

[0092] For example, when a target access device exhibits abnormal behavior, such as attempting to access a micro-segmentation system outside its accessible range, the security management platform can, according to a preset scoring rule: the standard security status score of the user device is 90, and the reference score corresponding to the abnormal behavior is 10. Then, by subtracting the reference score corresponding to the abnormal behavior from the standard security status score, the security status score of the user device is obtained as 80.

[0093] In another possible implementation, as mentioned above, the preset scoring rules can also be a bonus mechanism. In this case, S1021 above can specifically include the following steps:

[0094] Step 1b: Obtain the standard security status score of the target access device.

[0095] For example, under a scoring mechanism, the security management platform can set a preset standard security status score for each accessing device. This standard security status score can be set to, for example, 0, 20, or 50. This application embodiment does not limit the specific value of the standard security status score under the scoring mechanism.

[0096] Step 2b: If it is determined that the target access device does not have a certain abnormal behavior based on the status and behavior information, (according to the preset scoring rules) the standard security status score is added to the reference score corresponding to the abnormal behavior to obtain the security status score.

[0097] Step 2b can be referred to in step 2a above, and will not be repeated here.

[0098] S1022. Based on the security status score of the target access device, update the access range of the target access device to obtain the updated access range.

[0099] Optionally, the security management platform can update the accessibility scope of the target access device by adjusting the user group to which the target access device belongs. In this case, S1022 above can specifically include:

[0100] Step 1c: Based on the group correspondence and the security status score of the target access device, update the user group to which the target access device belongs, and obtain the updated user group of the target access device.

[0101] The group correspondence is used to represent the correspondence between security status scores and user groups, with each user group corresponding to an accessible range.

[0102] For example, the security management platform can use the security status score of the target access device as an index to traverse the group correspondence and use the user group corresponding to the security status score of the target access device in the group correspondence as the updated user group of the target access device.

[0103] Step 2c: Based on the updated user groups of the target access device, update the access range of the target access device to obtain the updated access range.

[0104] For example, the grouping correspondence can be as follows: Group 1 corresponds to a security status score of 80 or above, and user equipment in Group 1 can access micro-segmentation systems 301 and 302; Group 2 corresponds to a security status score of 60 to 79, and user equipment in Group 2 can only access micro-segmentation system 301. For instance, if the security status score of the current target access device is updated from 90 to 70, the security management platform can, based on the grouping correspondence and the security status score of the target access device, update the target user device's group from Group 1 to Group 2, and update the target access device's access range from micro-segmentation systems 301 and 302 to micro-segmentation system 301. In some possible embodiments, the micro-segmentation system (such as micro-segmentation system 301) can also receive the access range allocated by the security management platform 200 to the target access device. Figure 4 This is another flowchart illustrating the access control method provided in an embodiment of this application. Figure 4 As shown, prior to S101 above, the method may further include the following steps:

[0105] S201. In response to the login status change event of the target access device, generate corresponding event notification information.

[0106] The types of login status change events include login or logout. The event notification information includes the identity of the target access device, the address information assigned to the target access device by the security management platform (for example, taking the micro-segmentation network mentioned above as an enterprise intranet, the address information assigned by the security management platform can be understood as the intranet IP), the accessible range of the target access device, and the type of login status change event.

[0107] S202. Send event notification information to multiple micro-isolation systems.

[0108] It should be understood that in related technologies, when accessing a micro-segmentation system, accessing devices send access requests to the micro-segmentation system through an SDP gateway. The micro-segmentation system cannot perceive the identity and address of the accessing device corresponding to the access request, which reduces the auditability and traceability of the network defense system. In the access control method provided in this application embodiment, the security management platform can respond to a login status change event of a target accessing device, generate corresponding event notification information, and send it to the micro-segmentation system. The event notification information includes the identity identifier of the target accessing device, the assigned address information, the accessible range, and the type of login status change event. In this way, the micro-segmentation system can perceive the identity and address of the target accessing device based on the event notification information, and can then review and trace the information security issues that arise based on the identity and address information, thereby improving the auditability and traceability of the network defense system.

[0109] In some possible embodiments, all micro-segmentation systems included in the micro-segmentation network 300 (such as micro-segmentation system 301, micro-segmentation system 302, or micro-segmentation system 303, etc.) can establish data transmission channels with the security management platform 200 and subscribe to login status change events. Figure 5 This is another flowchart illustrating an access control method provided in an embodiment of this application. Prior to step 201 above, the method may include the following steps:

[0110] S301, Receive subscription request information from the micro-segmentation system.

[0111] The subscription request information includes a list of services that the micro-segmentation system (can provide) and the event types for which subscription is requested; the event types for which subscription is requested include login status change events.

[0112] S302. In response to the subscription request information, send interface configuration information to the micro-segmentation system.

[0113] The configuration information received may include the application program interface (API) address of the micro-segmentation module in the security management platform and configuration parameters such as supported message formats.

[0114] S303, Receive subscription confirmation information from the micro-segmentation system.

[0115] The subscription confirmation message is generated by the micro-segmentation system after configuring the internal listener based on the interface configuration information. The internal listener is used to obtain event notification information.

[0116] S304. In response to the subscription confirmation message, send a subscription response message to the micro-segmentation system.

[0117] The subscription response information is used to indicate successful registration and / or successful subscription.

[0118] In some possible embodiments, before the micro-segmentation system sends subscription request information to the security management platform, the corresponding connection information can be configured and saved, and an initial connection can be established.

[0119] The configuration of the corresponding connection information includes the following parts:

[0120] 1) Key: Specifically, the administrator generates a unique registration key for each micro-segmentation system on the security management platform, which is used for authentication when the micro-segmentation system requests a subscription.

[0121] 2) Subscription content, which specifies the message types that different micro-segmentation systems can subscribe to. Specifically, it includes user authentication events, user grouping information, user online / offline notifications, and the IP and port range assigned to users upon online access.

[0122] 3) Interaction method and parameters: This interaction method is used to set the encryption method and protocol type for communication between the security management platform and the micro-segmentation system. This parameter ensures the accurate transmission and reception of information during the interaction process.

[0123] Optionally, the interaction method can be a Transmission Control Protocol (TCP) protocol encrypted with Transport Layer Security (TLS), and the parameters can be the port, Uniform Resource Locator (URL) path, and message format.

[0124] For example, saving the corresponding connection information includes: saving the above-mentioned key, subscription content, and interaction methods and parameters to the security management platform, and assigning a unique identifier to the connection information of each micro-segmentation system (such as micro-segmentation system 301, etc.) in order to manage and identify different micro-segmentation systems.

[0125] For example, establishing an initial connection includes: entering the URL path, port and key configured above in the administrator operation interface of the security management platform to authenticate the micro-segmentation system (such as micro-segmentation system 301, etc.). Based on the successful authentication result, the micro-segmentation system (such as micro-segmentation system 301, etc.) establishes an initial connection with the security management platform 200.

[0126] The foregoing primarily describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the aforementioned functions, the security management platform includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the units and algorithm steps of the various examples described in the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Experts may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0127] In an exemplary embodiment, this application also provides an access control device. This access control device can be applied to a security management platform and may include one or more functional modules for implementing the access control methods of the above method embodiments.

[0128] For example, Figure 6 This is a schematic diagram illustrating the composition of an access control device provided in an embodiment of this application. Figure 6 As shown, the access control device includes: an acquisition module 601, a processing module 602, and a sending module 603.

[0129] The acquisition module 601 is used to acquire the status and behavior information of the target access device; the target access device is an access device that has been assigned an access range after authentication; the access range includes at least one micro-segmentation system among multiple micro-segmentation systems.

[0130] The processing module 602 is used to update the accessibility range of the target access device based on the status and behavior information of the target access device, and obtain the updated accessibility range.

[0131] The sending module 603 is used to send the updated access range to multiple micro-segmentation systems so that the multiple micro-segmentation systems can control access to the target access device based on the updated access range.

[0132] In some possible embodiments, the status and behavior information includes at least one of the following: whether the target access device has the target software installed, the network where the target access device is located, and the access behavior records of the target access device.

[0133] In other possible embodiments, the processing module 602 is specifically used to determine the security status score of the target access device based on preset scoring rules and the status and behavior information of the target access device; and to update the accessibility range of the target access device based on the security status score of the target access device to obtain the updated accessibility range.

[0134] In some other possible embodiments, the processing module 602 is specifically used to update the user group to which the target access device belongs based on the group correspondence relationship and the security status score of the target access device, so as to obtain the updated user group of the target access device; the group correspondence relationship is used to represent the correspondence between the security status score and the user group, and each user group corresponds to an accessible range; based on the updated user group of the target access device, the accessible range of the target access device is updated to obtain the updated accessible range.

[0135] In some other possible embodiments, the processing module 602 is specifically used to obtain a standard security status score of the target access device; if it is determined that the target access device has abnormal behavior based on the status and behavior information, the standard security status score is subtracted from the reference score corresponding to the abnormal behavior to obtain a security status score.

[0136] In other possible embodiments, the abnormal behavior includes: status and behavior information indicating that the target access device does not have the target software installed; status and behavior information indicating that the network where the target access device is located is a preset abnormal network; and access behavior records in the status and behavior information indicating that the target access device accesses a micro-segmentation system outside the accessible range.

[0137] In some other possible embodiments, the processing module 602 is further configured to generate event notification information in response to a login status change event of the target access device; the types of login status change events include login or logout; the event notification information includes the identity identifier of the target access device, the address information assigned to the target access device by the security management platform, the accessible range of the target access device, and the type of login status change event; the sending module 603 is further configured to send event notification information to multiple micro-segmentation systems.

[0138] In some other possible embodiments, the acquisition module 601 is further configured to receive subscription request information from the micro-segmentation system; the subscription request information includes a service list of the micro-segmentation system and the event type to be subscribed to; the event type to be subscribed to includes a login status change event; the sending module 603 is further configured to send interface configuration information to the micro-segmentation system in response to the subscription request information; the acquisition module 601 is further configured to receive subscription confirmation information from the micro-segmentation system, the subscription confirmation information being generated by the micro-segmentation system after configuring the internal listener based on the interface configuration information; the internal listener is used to acquire event notification information; the sending module 603 is further configured to send subscription response information to the micro-segmentation system in response to the subscription confirmation information; the subscription response information is used to indicate successful registration and / or successful subscription.

[0139] It should be noted that, Figure 6 The module division shown is illustrative and represents only one logical functional division; in actual implementation, other division methods are possible. For example, two or more functions can be integrated into a single processing module. These integrated modules can be implemented either in hardware or as software functional modules.

[0140] In an exemplary embodiment, this application also provides an electronic device in which the above-mentioned security management platform can be deployed. Figure 7 This is a schematic diagram illustrating the composition of an electronic device provided in an embodiment of this application. For example... Figure 7 As shown, the electronic device may include: a memory 701 and a processor 702; the memory 701 stores instructions executable by the processor 702; when the processor 702 is configured to execute the instructions, it causes the electronic device, network device, or manager to implement the methods described in the foregoing method embodiments.

[0141] It should be noted that, Figure 7 The structures shown do not constitute a limitation on electronic devices, except... Figure 7 In addition to the components shown, electronic devices may include more or fewer components than illustrated, or combinations of certain components, or different component arrangements.

[0142] In an exemplary embodiment, this application also provides a readable storage medium including software instructions; when the software instructions are executed in an electronic device, they cause the electronic device to implement the methods described in the foregoing embodiments. The computer-readable storage medium can be a non-transitory computer-readable storage medium, such as a read-only memory (ROM), random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0143] In an exemplary embodiment, this application also provides a computer program product, which includes computer instructions; when the computer program product is run in an electronic device, it causes the electronic device to execute the above-described related method steps to implement the access control method in the above embodiments.

[0144] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple components. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0145] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely exemplary illustrations of this application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and modifications of this application fall within the scope of the claims of this application and their equivalents, this application is also intended to include such modifications and modifications.

[0146] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An access control method, characterized in that, The method is applied to a security management platform; The security management platform is communicatively connected to multiple micro-segmentation systems; the method includes: Obtain the status and behavior information of the target access device; the target access device is an access device that has been assigned an access range after authentication; the access range includes at least one of the multiple micro-segmentation systems; the status and behavior information includes at least one of the following: whether the target access device has the target software installed, the network where the target access device is located, and the access behavior record of the target access device; Based on preset scoring rules and the status and behavior information of the target access device, the security status score of the target access device is determined; Based on the group correspondence and the security status score of the target access device, the user group to which the target access device belongs is updated to obtain the updated user group of the target access device; the group correspondence is used to represent the correspondence between the security status score and the user group, and each user group corresponds to an accessible range; Based on the updated user groups of the target access device, the accessibility range of the target access device is updated to obtain the updated accessibility range; The updated access range is sent to the plurality of micro-segmentation systems so that the plurality of micro-segmentation systems control access to the target access device based on the updated access range.

2. The method according to claim 1, characterized in that, The process of determining the security status score of the target access device based on preset scoring rules and the status and behavior information of the target access device includes: Obtain the standard security status score of the target access device; If it is determined that the target access device has abnormal behavior based on the status and behavior information, the standard security status score is reduced by the reference score corresponding to the abnormal behavior to obtain the security status score.

3. The method according to claim 2, characterized in that, The abnormal behavior includes: The status and behavior information indicates that the target access device does not have the target software installed; The status and behavior information indicates that the network in which the target access device is located is a preset abnormal network; The access behavior record in the status and behavior information indicates that the target access device accesses a micro-segmentation system outside the accessible range.

4. The method according to claim 1, characterized in that, The method further includes: In response to the login status change event of the target access device, a corresponding event notification information is generated; the types of login status change events include login or logout; the event notification information includes the identity identifier of the target access device, the address information assigned to the target access device by the security management platform, the accessible range of the target access device, and the type of login status change event; Send the event notification information to the multiple micro-segmentation systems.

5. The method according to claim 4, characterized in that, The method further includes: Receive subscription request information from the micro-segmentation system; the subscription request information includes the service list of the micro-segmentation system and the event type to be subscribed to; the event type to be subscribed to includes the login status change event; In response to the subscription request information, interface configuration information is sent to the micro-segmentation system; The system receives subscription confirmation information from the micro-segmentation system, which is generated by the micro-segmentation system after configuring the internal listener based on the interface configuration information; the internal listener is used to obtain the event notification information. In response to the subscription confirmation information, a subscription response information is sent to the micro-segmentation system; the subscription response information is used to indicate successful registration and / or successful subscription.

6. An access control device, characterized in that, The device is used in a security management platform; The security management platform is communicatively connected to multiple micro-segmentation systems; the device includes: an acquisition module, a processing module, and a sending module; The acquisition module is used to acquire the status and behavior information of the target access device; the target access device is an access device that has been assigned an access range after authentication; the access range includes at least one of the multiple micro-segmentation systems; the status and behavior information includes at least one of the following: whether the target access device has the target software installed, the network where the target access device is located, and the access behavior record of the target access device; The processing module is configured to: determine the security status score of the target access device based on preset scoring rules and the status and behavior information of the target access device; update the user group to which the target access device belongs based on the group correspondence relationship and the security status score of the target access device to obtain the updated user group of the target access device; the group correspondence relationship is used to represent the correspondence between the security status score and the user group, with each user group corresponding to an accessible range; and update the accessible range of the target access device based on the updated user group of the target access device to obtain the updated accessible range. The sending module is used to send the updated access range to the plurality of micro-segmentation systems, so that the plurality of micro-segmentation systems can control access to the target access device based on the updated access range.

7. An electronic device, characterized in that, The electronic device includes: a processor and a memory; The memory stores instructions that the processor can execute; When the processor is configured to execute the instructions, the electronic device performs the method as described in any one of claims 1-5.

8. A readable storage medium, characterized in that, The readable storage medium includes: software instructions; When the software instructions are executed in an electronic device, the electronic device causes the electronic device to perform the method as described in any one of claims 1-5.

9. A computer program product, characterized in that, The computer program product includes: computer instructions; When the computer instructions are executed in an electronic device, the electronic device causes the electronic device to perform the method as described in any one of claims 1-5.

Images