Access control method, device and equipment

Abstract

The invention provides an access control method, device and equipment, and the method comprises the steps: determining a first object type of an access object and a second object type of a to-be-accessed object under the condition of monitoring that the access object sends a first access request to the to-be-accessed object, and carrying out the access control of the to-be-accessed object according to the first object type; determining first description information and first identification information of an access object, determining second description information of a to-be-accessed object according to a second object type, determining third description information of an environment where the access object is located, and determining access risk degree information according to the first identification information, the first description information, the second description information and the third description information; and according to the access risk degree information, the target access permission level of the access object is generated, so that access risk assessment can be performed based on three dimensions of the access object, the object to be accessed and the access environment, and finer-grained access control can be realized based on the access risk degree information.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to an access control method, apparatus and device. Background Art

[0002] Zero trust refers to the verification of anyone, anything, or anything that attempts to access the network and network resources before authorization. In practice, the zero-trust network uses identity as the basis for network access control, continuously evaluates trust levels based on multi-source data, formulates access control policies based on the principle of least privilege, and performs mandatory identity recognition and authorization, authentication, and channel encryption, thereby achieving controlled and secure access to network resources. Summary of the invention

[0003] The present disclosure proposes an access control method, device, electronic device, storage medium and computer program product, aiming to solve the technical problems in the related technologies at least to a certain extent.

[0004] The first aspect of the present disclosure proposes an access control method, comprising: in a case where it is monitored that an access object sends a first access request to an object to be accessed, determining a first object type of the access object, and a second object type of the object to be accessed; determining first description information and first identification information of the access object based on the first object type, and determining second description information of the object to be accessed based on the second object type; determining third description information of the environment in which the access object is located; determining access risk level information based on the first identification information, the first description information, the second description information and the third description information; and generating a target access permission level for the access object based on the access risk level information.

[0005] The second aspect of the present disclosure proposes an access control device, including: a first determination module, used to determine the first object type of the access object and the second object type of the object to be accessed when monitoring that the access object sends a first access request to the object to be accessed; a second determination module, used to determine the first description information and the first identification information of the access object according to the first object type, and determine the second description information of the object to be accessed according to the second object type; a third determination module, used to determine the third description information of the environment in which the access object is located; a fourth determination module, used to determine the access risk level information according to the first identification information, the first description information, the second description information and the third description information; a generation module, used to generate a target access permission level for the access object according to the access risk level information.

[0006] An embodiment of a third aspect of the present disclosure proposes an electronic device, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement an access control method.

[0007] A fourth aspect of the present disclosure provides a computer-readable storage medium. When instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform an access control method.

[0008] The fifth aspect of the present disclosure provides a computer program product, including a computer program, characterized in that the computer program is executed by a processor to perform an access control method.

[0009] The access control method, apparatus, electronic device, storage medium and computer program product proposed in this embodiment have at least the following beneficial effects: by determining the first object type of the access object and the second object type of the object to be accessed when monitoring that the access object sends a first access request to the object to be accessed, and then determining the first description information and the first identification information of the access object according to the first object type, and determining the second description information of the object to be accessed according to the second object type, and then determining the third description information of the environment in which the access object is located, and then determining the access risk level information according to the first identification information, the first description information, the second description information and the third description information, and then generating the target access permission level of the access object according to the access risk level information, thereby enabling access risk assessment to be performed based on the three dimensions of the access object, the object to be accessed and the access environment, so that more fine-grained access control can be achieved based on the access risk level information.

[0010] Additional aspects and advantages of the present disclosure will be given in part in the following description and in part will be obvious from the following description or learned through practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above and / or additional aspects and advantages of the present disclosure will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0012] Figure 1 is a flowchart of an access control method according to the first embodiment of the present disclosure;

[0013] Figure 2 is a flowchart of an access control method according to a second embodiment of the present disclosure;

[0014] Figure 3 is a flowchart of an access control method according to the third embodiment of the present disclosure;

[0015] Figure 4A It is a schematic diagram of a process for determining an operational risk level value proposed in an embodiment of the present disclosure;

[0016] Figure 4B is a schematic diagram of a process for determining an operational risk level value proposed in another embodiment of the present disclosure;

[0017] Figure 4C is a schematic diagram of a process for determining an operational risk level value proposed in another embodiment of the present disclosure;

[0018] Figure 4D It is a schematic diagram of a process for determining a geographical environment score proposed in an embodiment of the present disclosure;

[0019] Figure 4E is a schematic diagram of a process for determining a computing environment score proposed in an embodiment of the present disclosure;

[0020] Figure 4F It is a schematic diagram of a process for determining a network environment score proposed in an embodiment of the present disclosure;

[0021] Figure 5 is a block diagram of an access control device according to the present disclosure;

[0022] Figure 6 A block diagram of an exemplary electronic device suitable for implementing embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0023] Embodiments of the present disclosure are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present disclosure, and are not to be construed as limitations of the present disclosure. On the contrary, the embodiments of the present disclosure include all changes, modifications, and equivalents that fall within the spirit and connotation of the appended claims.

[0024] It should be noted that the executor of the access control method of this embodiment may be an access control device, which may be implemented by software and / or hardware, and may be configured in an electronic device, which may include but is not limited to a terminal, a server, etc.

[0025] It should be noted that the process of obtaining, storing, using, and processing information in the disclosed technical solution complies with the relevant provisions of national laws and regulations and does not violate public order and good morals.

[0026] Figure 1 is a flowchart of an access control method according to the first embodiment of the present disclosure, such as Figure 1 As shown, the method includes:

[0027] S101: When monitoring that an access object sends a first access request to an object to be accessed, determining a first object type of the access object and a second object type of the object to be accessed.

[0028] The access object may be, for example, a person, equipment, etc., and there is no limitation on this.

[0029] The object to be accessed may be, for example, data, an interface, a function, etc., which is not limited.

[0030] The request made by the access object at the current moment to request access to the object to be accessed is the first access request, and no restriction is imposed on this.

[0031] The access object may be divided into a plurality of first object types according to different division criteria. The first object type may be, for example, a device type, a personnel type, etc., and there is no limitation to this.

[0032] The object to be accessed may be divided into a plurality of second object types according to different division criteria. The second object type may be, for example, a data type, an interface type, a function type, etc., without limitation.

[0033] S102: Determine first description information and first identification information of an access object according to the first object type, and determine second description information of an object to be accessed according to the second object type.

[0034] Among them, the first identification information of the access object can be used to identify the unique access object. Taking the access object as a person as an example, the first identification information can be, for example, the ID number, telephone number, name, etc. of the access object, and there is no limitation on this.

[0035] Among them, the first description information and the first identification information of the access object are different. The first description information can be used to describe other attributes of the access object. For example, the first description information may refer to information used to describe the business sensitivity, business type, security, etc. of the access object.

[0036] The second description information of the object to be accessed may refer to information used to describe the service type and function of the object to be accessed, and there is no limitation to this.

[0037] It can be understood that the object type of the access object is different, and the corresponding identification information and description information are also different. For example, when the object type of the access object is a personnel type, the first identification information can be, for example, the ID number or telephone number of the access object. When the object type of the access object is a device type, the first identification information can be, for example, the device serial number, asset registration certificate number, etc., without limitation.

[0038] Therefore, in the embodiment of the present disclosure, after determining the first object type of the access object and the second object type of the object to be accessed, the first description information and first identification information of the access object can be determined according to the first object type, and the second description information of the object to be accessed can be determined according to the second object type.

[0039] For example, in the embodiments of the present disclosure, when it is determined that the first object type of the access object is a personnel type, the first description information of the access object is determined to be the personnel's technical grade, position, etc., and the first identification information is determined to be the ID number, name, etc. of the access object. Alternatively, when it is determined that the first object type of the access object is a device type, the first description information of the access object is determined to be the device function, device value, etc., and the first identification information of the access object is determined to be the device serial number, device asset registration number, etc., and there is no limitation on this.

[0040] For example, in the disclosed embodiments, when it is determined that the second object type of the object to be accessed is a data type, the second description information of the object to be accessed is determined to be the data type, the department to which the data belongs, etc., and there is no limitation to this.

[0041] In the embodiment of the present disclosure, the first identification information of the access object can also be generated based on multiple information of the access object, that is, a unique identification can be generated as the first identification information based on the digital identification of the access object (system account of a person, device serial number of a device, etc.) and the physical identification of the access object (personnel's ID number, telephone number, ID number, etc.). The composition of the first identification information is shown in Table 1:

[0042]

[0043] S103: Determine third description information of the environment where the access object is located.

[0044] Among them, the third description information can be used to describe the environment in which the access object is located, and the environment can be, for example, a geographical environment, a network environment, a computing environment, etc. The third description information can be, for example, geographical environment information, network environment information, computing environment information, etc., and there is no limitation on this.

[0045] In the embodiment of the present disclosure, the third description information may be environmental information of the environment where the access object is located collected by a camera device, or the network environment information of the access device may be read by a third-party tool or a command line tool, and there is no limitation to this.

[0046] S104: Determine access risk level information according to the first identification information, the first description information, the second description information, and the third description information.

[0047] After determining the first description information and the first identification information of the access object according to the first object type and determining the second description information of the object to be accessed according to the second object type, the embodiment of the present disclosure can determine the access risk level information according to the first identification information, the first description information, the second description information and the third description information.

[0048] The access risk level information may be used to describe the risk level of the current access process of the access object to the access object. The access risk level information may be, for example, an access risk level, which is not limited.

[0049] In some embodiments, access risk level information is determined based on the first identification information, the first description information, the second description information and the third description information. This may be by obtaining sample data (the sample data includes: reference identification information, the first reference description information, the second reference description information and the third reference description information), and a reference access risk level corresponding to the sample data, and training an initial access risk level determination model based on the sample data and the reference access risk level corresponding to the sample object until the initial access risk level determination model converges, and then inputting the first identification information, the first description information, the second description information and the third description information together into the trained initial access risk level determination model to obtain the access risk level information output by the model. There is no limitation on this.

[0050] In some other embodiments, the access risk level information is determined based on the first identification information, the first description information, the second description information and the third description information. It can also be that the identification information and description information of the access object, the description information of the accessed object, and the description information of the environment in which the access object is located are obtained during the access process in the historical time period, and then the access risk level determined in the historical access process is determined, and then the first identification information, the first description information, the second description information and the third description information are compared with the identification information and description information of the access object, the description information of the accessed object, and the description information of the environment in which the access object is located during the historical access process, and when the comparison result indicates that the information in the current access process matches the information in the historical access process, the access risk level determined in the historical access process is used as the access risk level information, and there is no limitation on this.

[0051] S105: Generate a target access permission level for the access object according to the access risk level information.

[0052] Among them, the target access permission level is used to describe the size of the access object's access permission during this access process. The higher the target access permission level, the higher the access object's permission during this access process. Conversely, the lower the target access permission level, the lower the access object's permission during this access process. There is no restriction on this.

[0053] In some embodiments, a target access permission level for an access object is generated based on access risk level information. This may be accomplished by pre-acquiring reference access risk level information and a reference access permission level corresponding to the reference access risk level information, and comparing the access risk level information with the reference access risk level information. When the access risk level information and the reference access risk level information are the same, the reference access permission level corresponding to the reference access risk level information is used as the target access permission level for the access object. There is no limitation on this.

[0054] In the embodiment of the present disclosure, the correspondence between the target access permission level and the specific access policy can be shown in Table 2:

[0055]

[0056] That is to say, in the embodiment of the present disclosure, the access control policy corresponding to the target access permission level can be determined based on the corresponding relationship between the target access permission level and the specific access policy as shown in Table 2 above.

[0057] In the embodiment of the present disclosure, by monitoring that the access object sends a first access request to the object to be accessed, determining the first object type of the access object and the second object type of the object to be accessed, then determining the first description information and the first identification information of the access object based on the first object type, and determining the second description information of the object to be accessed based on the second object type, then determining the third description information of the environment in which the access object is located, then determining the access risk level information based on the first identification information, the first description information, the second description information and the third description information, and then generating the target access permission level of the access object based on the access risk level information, thereby enabling access risk assessment to be performed based on the three dimensions of the access object, the object to be accessed and the access environment, thereby enabling more fine-grained access control to be achieved based on the access risk level information.

[0058] Figure 2 is a flow chart of an access control method according to a second embodiment of the present disclosure, such as Figure 2 As shown, the method includes:

[0059] S201: When monitoring that an access object sends a first access request to an object to be accessed, determine a first object type of the access object and a second object type of the object to be accessed.

[0060] The specific description of S201 can be found in the above embodiment, which will not be repeated here.

[0061] S202: If the first object type is a personnel type, obtain the job description information and / or technical rank information of the access object, and use the job description information and / or technical rank information as the first description information.

[0062] In the embodiment of the present disclosure, the first object type includes any one of the following: personnel type; equipment type; business type.

[0063] In the embodiment of the present disclosure, the second object type includes any one of the following: a data type; a function type; an interface type.

[0064] The job description information may be, for example, the administrative level of the visit object, and the administrative level may be, for example, senior, middle, junior, etc., and there is no limitation to this.

[0065] The technical rank information may be, for example, the technical level of the access object, and the technical level may be, for example, senior, intermediate, junior, etc., and there is no limitation on this.

[0066] That is to say, in the embodiment of the present disclosure, when the first object type is a personnel type, the job description information and / or technical grade information of the access object can be obtained, and the job description information and / or technical grade information can be used as the first description information.

[0067] S203: If the first object type is a device type, obtain function description information and / or security requirement information of the access object, and use the function description information and / or security requirement information as the first description information.

[0068] The function description information may refer to the function importance level of the access object, and the function importance level may be, for example, high, medium, low, etc., and there is no limitation to this.

[0069] The security requirement information may refer to the level of security requirement for accessing the object. The level of security requirement may be, for example, high, medium, low, etc., and there is no limitation to this.

[0070] That is to say, in the embodiment of the present disclosure, when the first object type is a device type, functional description information and / or security requirement information of the access object can be obtained and the functional description information and / or security requirement information can be used as the first description information.

[0071] S204: If the first object type is a business type, sensitivity information and / or business relevance information of the access object is obtained, and the sensitivity information and / or the business relevance information are used together as the first description information.

[0072] The sensitivity information of the access object may be classified into high, medium, low, etc. according to the business sensitivity of the access object, and there is no restriction on this.

[0073] The business relevance information of the access object may be classified into high, medium, low, etc. according to the business relevance of the access object, and there is no limitation on this.

[0074] That is to say, in the embodiments of the present disclosure, when the first object type is a business type, sensitivity information and / or business relevance information of the access object can be obtained, and the sensitivity information and / or business relevance information can be used together as the first description information.

[0075] S205: If the second object is a data type, obtain the data subtype of the object to be accessed, and use the data subtype as the second description information.

[0076] Among them, data can be divided into multiple data subtypes. For example, data can be divided into three data subtypes, namely, departmental, cross-departmental and cross-unit, according to the source of the data.

[0077] That is to say, in the embodiment of the present disclosure, when the second object is a data type, the data subtype of the object to be accessed may be obtained, and the data subtype may be used as the second description information.

[0078] S206: If the second object is of a function type, obtain a function subtype of the object to be accessed, and use the function subtype as the second description information.

[0079] Among them, functions can be divided into multiple function subtypes. For example, functions can be divided into three data subtypes, namely core, common and external, according to function weights.

[0080] That is to say, in the embodiment of the present disclosure, when the second object is of a function type, the function subtype of the object to be accessed may be obtained, and the function subtype may be used as the second description information.

[0081] S207: If the second object is of an interface type, obtain the interface subtype of the object to be accessed, and use the interface subtype as the second description information.

[0082] The interface may be divided into a plurality of interface subtypes, and the interface subtypes may specifically include, for example, a core interface, a common interface, and an external interface, etc., without limitation.

[0083] That is to say, in the embodiment of the present disclosure, when the second object is of interface type, the interface subtype of the object to be accessed is obtained, and the interface subtype is used as the second description information.

[0084] S208: Determine first description information and first identification information of the access object according to the first object type, and determine second description information of the object to be accessed according to the second object type.

[0085] S209: Determine third description information of the environment where the access object is located.

[0086] S210: Determine access risk level information according to the first identification information, the first description information, the second description information and the third description information.

[0087] S211: Generate a target access permission level for the access object according to the access risk level information.

[0088] The specific description of S208-S211 can be found in the above embodiment, which will not be repeated here.

[0089] In the embodiment of the present disclosure, by monitoring that the access object sends a first access request to the object to be accessed, the first object type of the access object and the second object type of the object to be accessed are determined, and then when the first object type is a personnel type, the job description information and / or technical rank information of the access object are obtained, and the job description information and / or technical rank information are used as the first description information, and then when the first object type is a device type, the function description information and / or security requirement information of the access object are obtained, and the function description information and / or security requirement information are used as the first description information, and then when the first object type is a business type, the sensitivity information and / or business relevance information of the access object are obtained, and the sensitivity information and / or business relevance information are used together as the first description information, and when the second object is a data type, the data subtype of the object to be accessed is obtained, and the data subtype is used as For the second description information, when the second object is a function type, the function subtype of the object to be accessed is obtained, and the function subtype is used as the second description information; when the second object is an interface type, the interface subtype of the object to be accessed is obtained, and the interface subtype is used as the second description information; then, according to the first object type, the first description information and the first identification information of the access object are determined; and according to the second object type, the second description information of the object to be accessed is determined; then, the third description information of the environment in which the access object is located is determined; and according to the first identification information, the first description information, the second description information and the third description information, the access risk degree information is determined; and according to the access risk degree information, the target access permission level of the access object is generated; thereby, access risk assessment can be performed based on the three dimensions of access object, object to be accessed and access environment, so that more fine-grained access control can be achieved based on the access risk degree information.

[0090] Figure 3 is a flowchart of an access control method according to the third embodiment of the present disclosure, such as Figure 3As shown, the method includes:

[0091] S301: When monitoring that an access object sends a first access request to an object to be accessed, determine a first object type of the access object and a second object type of the object to be accessed.

[0092] S302: Determine first description information and first identification information of an access object according to the first object type, and determine second description information of an object to be accessed according to the second object type.

[0093] S303: Determine third description information of the environment where the access object is located.

[0094] The specific description of S301 - S303 can be found in the above embodiment, which will not be repeated here.

[0095] S304: Determine a first risk score according to the first identification information and the third description information.

[0096] The first risk score refers to a score preliminarily determined based on the first identification information and the third description information and used to perform a quantitative risk assessment on the current visit of the access object.

[0097] After determining the third description information of the environment in which the access object is located, the embodiment of the present disclosure may determine the first risk score according to the first identification information and the third description information.

[0098] Optionally, in some embodiments, the first risk score is determined based on the first identification information and the third description information. The environmental risk score corresponding to each environmental type can be determined based on the third description information corresponding to different environmental types, and then the first risk score is determined based on the environmental risk score corresponding to each environmental type and the first identification information.

[0099] In the disclosed embodiment, the environment type includes: a physical environment type, a geographical environment type, a computing environment type, and a network environment type.

[0100] Among them, the third descriptive information corresponding to the physical environment type can be, for example, the operation information in the environment (operation subject, operation content and operation location). This information may include: whether there is human operation, whether the personnel are compliant, whether the system self-operation is compliant, whether the content displayed on the screen is consistent with the preset value, the points for judging whether it is consistent include LOGO and watermark, whether the picture behind the screen is consistent with the preset value, etc., and there is no restriction on this.

[0101] The third description information corresponding to the geographical environment type may be, for example, whether the user is in a designated location, whether the user is roaming, whether the user is connected to a VPN, etc., and there is no limitation on this.

[0102] Among them, the third descriptive information corresponding to the computing environment type may be, for example, whether a legal account is logged in, whether a face or fingerprint is matched, whether a specified software is operated, etc., and there is no restriction on this.

[0103] Among them, the third description information corresponding to the network environment type can be, for example, whether it is intranet access, whether it is virtual private network access, whether it is overseas access, etc., and there is no limitation on this.

[0104] That is to say, in the embodiments of the present disclosure, the environmental risk score corresponding to each environmental type can be determined based on the third description information corresponding to different environmental types, and then the first risk score can be determined based on the environmental risk score corresponding to each environmental type and the first identification information.

[0105] Optionally, in some embodiments, the environmental risk score corresponding to each environment type is determined according to the third descriptive information corresponding to different environment types. The operational risk level value in the environment can be determined according to the third descriptive information corresponding to the physical environment type, wherein the operational risk level value belongs to the environmental risk score, and the operational risk level value is used to describe whether the operation in the environment meets the standards. Then, according to the third descriptive information corresponding to the geographical environment type, the geographical environment score corresponding to the access object is determined, wherein the geographical environment score belongs to the environmental risk score, and the geographical environment score is used to describe whether the geographical environment of the access object meets the standards. Then, according to the third descriptive information corresponding to the computing environment type, the computing environment score corresponding to the access object is determined, wherein the computing environment score belongs to the environmental risk score, and the computing environment score is used to describe whether the computing environment of the access object meets the standards. And according to the third descriptive information corresponding to the network environment type, the network environment score corresponding to the access object is determined, wherein the network environment score belongs to the environmental risk score, and the network environment score is used to describe whether the network environment of the access object meets the standards.

[0106] For example, see Figure 4A , Figure 4A It is a schematic diagram of the process of determining the operational risk level value proposed in an embodiment of the present disclosure, that is, in the embodiment of the present disclosure, the operational risk level value in the environment is determined according to the third descriptive information corresponding to the physical environment type, and it can be that based on the third descriptive information, it is judged whether there is human operation, and if it is determined that there is human operation, it is further judged whether the operator is compliant, and when it is determined that the operator is compliant, the operational risk level value is determined to be 0, and when it is determined that the operator is not compliant, the operational risk level value is determined to be 1, and when it is determined that there is no human operation, it is determined whether the self-operation of the equipment is compliant, and when the self-operation of the equipment is not compliant, the operational risk level value is determined to be 2, and when the self-operation of the equipment is compliant, the operational risk level value is determined to be 0, and there is no restriction on this.

[0107] Among them, the operational risk level value of 0 represents low risk, the operational risk level value of 1 represents local risk, and the operational risk level value of 2 represents global risk.

[0108] For example, see Figure 4B , Figure 4B It is a schematic diagram of the process of determining the operational risk level value proposed in another embodiment of the present disclosure, that is, in the embodiment of the present disclosure, the operational risk level value in the environment is determined according to the third description information corresponding to the physical environment type, and it can also be determined whether the LOGO is correct according to the third description information, and if the LOGO is incorrect, the operational risk level value is determined to be 2, and if the LOGO is correct, it is determined whether the watermark is correct, and if the watermark is correct, the operational risk level value is determined to be 0, and if the watermark is incorrect, the operational risk level value is determined to be 1, and there is no limitation to this.

[0109] For example, see Figure 4C , Figure 4C It is a schematic diagram of the process of determining the operational risk level value proposed in another embodiment of the present disclosure, that is, in the embodiment of the present disclosure, the operational risk level value in the environment is determined according to the third description information corresponding to the physical environment type, and it can also be determined whether the operational background is correct according to the third description information, and if the operational background is determined to be incorrect, the operational risk level value is determined to be 2, if the operational background is determined to be correct, it is determined whether the operational background changes dynamically, and if it is determined that the operational background changes dynamically, the operational risk level value is determined to be 0, and if it is determined that the operational background does not change dynamically, the operational risk level value is determined to be 1, and there is no restriction on this.

[0110] For example, see Figure 4D , Figure 4D It is a schematic diagram of the process of determining the geographical environment score proposed in an embodiment of the present disclosure, that is, in the embodiment of the present disclosure, the geographical environment score in the environment is determined according to the third descriptive information corresponding to the geographical environment type, which can be to determine whether the access object is in the specified location. If the access object is in the specified location, continue to determine whether the MAC address is compliant, and when it is determined that the MAC address is compliant, determine the geographical environment score to be 0, and when it is determined that the MAC address is not compliant, determine the geographical environment score to be 1. When it is determined that the access object is not in the specified location, continue to determine whether roaming occurs. If roaming does not occur, determine the geographical environment score to be 2. When it is determined that roaming occurs, it is automatically determined whether to access a VPN. When a VPN is accessed, the geographical environment score is determined to be 0. When a VPN is not accessed, the geographical environment score is determined to be 1. There is no restriction on this.

[0111] For example, see Figure 4E , Figure 4EIt is a schematic diagram of the process of determining the computing environment score proposed in an embodiment of the present disclosure, that is, in the embodiment of the present disclosure, the computing environment score in the environment is determined according to the third descriptive information corresponding to the computing environment type, that is, it can be determined whether the access object has logged in to a legal account, and when it is determined that the access object has not logged in to the legal account, the computing environment score is determined to be 1, and when it is determined that the access object has logged in to the legal account, continue to determine whether it matches the face\fingerprint, and when it is determined that the face\fingerprint is not matched, determine the computing environment score to be 2, and when it is determined that the face\fingerprint is matched, continue to determine whether the specified software is operated, and when it is determined that the specified software is operated, determine the computing environment score to be 1, and when it is determined that the specified software is not operated, determine the computing environment score to be 1, and there is no restriction on this.

[0112] For example, participating in Figure 4F , Figure 4F It is a schematic diagram of the process of determining the network environment score proposed in an embodiment of the present disclosure, that is, in the embodiment of the present disclosure, the network environment score in the environment is determined according to the third description information corresponding to the network environment type, that is, it can be determined whether the access object is intranet access, and when it is determined that the access object is intranet access, the network environment score is determined to be 0, and when it is determined that the access object is not intranet access, continue to determine whether it is virtual private network access, and when it is determined that it is virtual private network access, determine the network environment score to be 0, and when it is determined that it is not virtual private network access, continue to determine whether it is overseas access, and when it is determined that it is overseas access, determine the network environment score to be 2, and when it is determined that it is not overseas access, determine the network environment score to be 1, and there is no restriction on this.

[0113] In the disclosed embodiment, the environmental risk score corresponding to each environmental type is determined based on the third description information corresponding to different environmental types, and then the first risk score is determined based on the environmental risk score corresponding to each environmental type and the first identification information.

[0114] Optionally, in some embodiments, the first risk score is determined based on the environmental risk score corresponding to each environmental type and the first identification information. The environmental risk score corresponding to each environmental type can be pooled to obtain a first matrix, and the first identification information is then pooled to obtain a second matrix. The modular multiplication value of the first matrix and the second matrix is ​​determined, and the first matrix and the second matrix are processed based on a convolutional neural network to obtain a convolution feature map output by the convolutional neural network, and the ratio between the modular multiplication value and the volume of the convolution feature map is determined, and the ratio is used as the first risk score.

[0115] In the disclosed embodiment, the environmental risk scores corresponding to each environment type may be pooled to obtain a first matrix, and the rows of the first matrix may be the environmental risk scores corresponding to each environment type. The first identification information may then be pooled, that is, the physical mark, digital mark, timestamp and check value in the first identification information may be filled into the access object identification matrix, and 0 may be filled at the end to obtain a second matrix.

[0116] In this embodiment, the environmental risk score corresponding to each environmental type is pooled to obtain a first matrix, and then the first identification information is pooled to obtain a second matrix. The modular multiplication value M of the first matrix and the second matrix can be determined. The determination process can be expressed as:

[0117]

[0118] Among them, X, Y, Z are the first identification information corresponding to different access objects respectively, subscripts 0, 1, 2, 3 are the segment values ​​of the identification, A, B, C, D are the environmental risk scores corresponding to different environmental types, subscripts 0, 1, 2 are variable values, modulus R is the control parameter, and the recommended value is 100.

[0119] In the embodiment of the present disclosure, the first matrix and the second matrix may be further processed based on the convolutional neural network to obtain a convolutional feature map output by the convolutional neural network, and the volume N of the convolutional feature map may be determined. The determination process may be expressed as:

[0120]

[0121] The size of the second matrix is ​​set to a×b, and the number of layers of data padding before convolution is c; the scale of the environment boundary as the convolution kernel is d, and the moving step is e.

[0122] In the disclosed embodiment, after pooling the environmental risk scores corresponding to each environment type to obtain a first matrix, pooling the first identification information to obtain a second matrix, determining the modular multiplication value of the first matrix and the second matrix, and processing the first matrix and the second matrix based on a convolutional neural network to obtain a convolutional feature map output by the convolutional neural network, the ratio S=M / N between the modular multiplication value and the volume of the convolutional feature map can be used as the first risk score.

[0123] S305: Determine access risk level information according to the first risk score, the first description information, and the second description information.

[0124] In the disclosed embodiment, after the first risk score is determined according to the first identification information and the third description information, access risk level information may be determined according to the first risk score, the first description information and the second description information.

[0125] In the embodiments of the present disclosure, when the first risk value satisfies \(0 < S < 1\), it is considered normal; when \(1\leq S < 10\), it is considered suspicious; when \(S\geq10\), it is considered malicious. When a service is executed repeatedly, the risk analysis of the behavior will be superimposed, and the result of the previous time is used as the input of the next time. The formula is as follows:

[0126]

[0127] That is, the first behavior risk value \(S\) of the \(i\)th behavior i′ is the current calculated value \(S\) i and the average value of the previous \(i - 1\) cumulative values.

[0128] Optionally, in some embodiments, according to the first risk score, the first description information, and the second description information, the access risk degree information is determined. It may be that when it is detected that the access object sends a second access request to the object to be accessed, the sending interval time between the first access request and the second access request is determined, and then according to the sending interval time, the first risk score, the first description information, and the second description information, the second risk score is determined, and the second risk score is used as the access risk degree information.

[0129] In the embodiments of the present disclosure, to determine the second risk score according to the sending interval time, the first risk score, the first description information, and the second description information, it may be to determine the corresponding score according to the first description information, and then determine the corresponding score according to the second description information. For example, when the degree level indicated by the description information is high, the corresponding score is determined to be 100; when the degree level indicated by the description information is medium, the corresponding score is determined to be 60; when the degree level indicated by the description information is low, the corresponding score is determined to be 30.

[0130] In the embodiments of the present disclosure, after determining the score corresponding to the first description information and the score corresponding to the second description information, the second risk score may be determined based on the following formula:

[0131] Second risk score = log(first risk score) × interval time × weight × (score corresponding to the first description information + score corresponding to the second description information) / 2;

[0132] where the weight is a weighting coefficient, which is adjusted according to business needs, and the recommended value is 1.

[0133] S306: Generate the target access permission level of the access object according to the access risk degree information.

[0134] In the embodiments of the present disclosure, after determining the access risk degree information according to the first risk score, the first description information, and the second description information, the target access permission level of the access object may be generated according to the access risk degree information.

[0135] Optionally, in some embodiments, a target access permission level for an access object is generated based on access risk level information, which may be accomplished by obtaining multiple score intervals, each score interval having a corresponding candidate access permission level, and then when the second risk score falls into the score interval, the candidate access permission level corresponding to the score interval is used as the target access permission level.

[0136] In the embodiment of the present disclosure, the correspondence between the score intervals and the candidate access permission levels is shown in Table 3:

[0137] Score 100 90-99 80-89 70-79 60-69 Below 60 Candidate access level Level 1 Level 2 Level 3 Level 4 Level 5 Level 5

[0138] The greater the candidate access permission level is, the smaller the access permission is.

[0139] That is to say, in the embodiment of the present disclosure, after determining the second risk score, the candidate access permission level corresponding to the second risk score may be determined according to the above Table 3.

[0140] In the embodiment of the present disclosure, by monitoring that the access object sends a first access request to the object to be accessed, determining the first object type of the access object and the second object type of the object to be accessed, and then determining the first description information and the first identification information of the access object based on the first object type, and determining the second description information of the object to be accessed based on the second object type, determining the third description information of the environment in which the access object is located, and then determining the first risk score based on the first identification information and the third description information, and then determining the access risk level information based on the first risk score, the first description information and the second description information, and then generating the target access permission level for the access object based on the access risk level information, thereby achieving a more fine-grained access control mechanism based on fine-grained information about personnel, equipment, and environment, thereby improving the accuracy of zero-trust access control.

[0141] Figure 5 is a block diagram of an access control device according to the present disclosure, such as Figure 5 As shown, the access control device 50 includes:

[0142] A first determination module 501 is used to determine a first object type of the access object and a second object type of the object to be accessed when monitoring that the access object sends a first access request to the object to be accessed;

[0143] A second determination module 502, configured to determine first description information and first identification information of an access object according to a first object type, and to determine second description information of an object to be accessed according to a second object type;

[0144] A third determining module 503, used to determine third description information of the environment where the access object is located;

[0145] The fourth determination module 504 is used to determine the access risk level information according to the first identification information, the first description information, the second description information and the third description information;

[0146] The generating module 505 is used to generate a target access permission level of the access object according to the access risk level information.

[0147] In some embodiments of the present disclosure, the first object type includes any of the following:

[0148] Type of person;

[0149] Type of device;

[0150] Type of business;

[0151] The second object type includes any of the following:

[0152] Data type;

[0153] Function type;

[0154] Interface type.

[0155] In some embodiments of the present disclosure, the second temperature influencing factor includes at least one of the following:

[0156] First device model;

[0157] First rated power consumption;

[0158] First installation position.

[0159] In some embodiments of the present disclosure, the second determining module 502 is further configured to:

[0160] If the first object type is a personnel type, obtaining the job description information and / or technical rank information of the access object, and using the job description information and / or technical rank information as the first description information;

[0161] If the first object type is a device type, obtaining function description information and / or security requirement information of the access object, and using the function description information and / or security requirement information as the first description information;

[0162] If the first object type is a business type, sensitivity information and / or business relevance information of the access object is obtained, and the sensitivity information and / or business relevance information are used together as the first description information.

[0163] In some embodiments of the present disclosure, the second determining module 502 is further configured to:

[0164] If the second object is a data type, obtaining a data subtype of the object to be accessed, and using the data subtype as the second description information;

[0165] If the second object is of a function type, obtaining a function subtype of the object to be accessed, and using the function subtype as the second description information;

[0166] If the second object is of an interface type, the interface subtype of the object to be accessed is obtained, and the interface subtype is used as the second description information.

[0167] In some embodiments of the present disclosure, the third determining module 504 is further configured to:

[0168] Determining a first risk score according to the first identification information and the third description information;

[0169] Access risk level information is determined based on the first risk score, the first description information, and the second description information.

[0170] In some embodiments of the present disclosure, the third description information includes: third description information corresponding to different environment types respectively;

[0171] The third determining module 504 is further configured to:

[0172] Determine the environmental risk score corresponding to each environmental type according to the third description information corresponding to the different environmental types;

[0173] A first risk score is determined based on the environmental risk score corresponding to each environmental type and the first identification information.

[0174] In some embodiments of the present disclosure, the environment type includes: a physical environment type, a geographic environment type, a computing environment type, and a network environment type;

[0175] The third determining module 504 is further configured to:

[0176] Determine, according to the third description information corresponding to the physical environment type, an operation risk level value in the environment, wherein the operation risk level value belongs to the environmental risk score, and the operation risk level value is used to describe whether the operation in the environment meets the standard;

[0177] Determine the geographical environment score corresponding to the access object according to the third description information corresponding to the geographical environment type, wherein the geographical environment score belongs to the environmental risk score and is used to describe whether the geographical environment of the access object meets the standard;

[0178] Determine, according to the third description information corresponding to the computing environment type, a computing environment score corresponding to the access object, wherein the computing environment score belongs to the environmental risk score, and the computing environment score is used to describe whether the computing environment of the access object meets the standard;

[0179] According to the third description information corresponding to the network environment type, the network environment score corresponding to the access object is determined, wherein the network environment score belongs to the environmental risk score, and the network environment score is used to describe whether the network environment of the access object meets the standards.

[0180] In some embodiments of the present disclosure, the third determining module 504 is further configured to:

[0181] Pooling the environmental risk scores corresponding to each environmental type to obtain a first matrix;

[0182] Performing pooling processing on the first identification information to obtain a second matrix;

[0183] Determine a modular multiplication value of the first matrix and the second matrix;

[0184] Processing the first matrix and the second matrix based on the convolutional neural network to obtain a convolutional feature map output by the convolutional neural network;

[0185] A ratio between the modular multiplication value and the volume of the convolution feature map is determined, and the ratio is used as a first risk score.

[0186] In some embodiments of the present disclosure, the generating module 505 is further configured to:

[0187] Acquire multiple score intervals, wherein each score interval has a corresponding candidate access permission level;

[0188] If the second risk score falls within the score interval, the candidate access permission level corresponding to the score interval is used as the target access permission level.

[0189] In this embodiment, by monitoring that the access object sends a first access request to the object to be accessed, the first object type of the access object and the second object type of the object to be accessed are determined, and then the first description information and the first identification information of the access object are determined based on the first object type, and the second description information of the object to be accessed is determined based on the second object type, and then the third description information of the environment in which the access object is located is determined, and then the access risk level information is determined based on the first identification information, the first description information, the second description information and the third description information, and then the target access permission level of the access object is generated based on the access risk level information. As a result, access risk assessment can be performed based on the three dimensions of the access object, the object to be accessed and the access environment, so that more fine-grained access control can be achieved based on the access risk level information.

[0190] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a computer-readable storage medium, and a computer program product.

[0191] Figure 6 A block diagram of an exemplary electronic device suitable for implementing embodiments of the present disclosure is shown.

[0192] Figure 6 The electronic device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0193] like Figure 6 As shown, the electronic device 12 is in the form of a general purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, a memory 28, and a bus 18 that connects various system components (including the memory 28 and the processing unit 16).

[0194] The bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor or a local bus using any of a variety of bus structures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnection (PCI) bus.

[0195] The electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0196] The memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 6 Not shown, often called a "hard drive").

[0197] although Figure 6Not shown in the figure, a disk drive for reading and writing a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing a removable non-volatile optical disk (e.g., a compact disc read only memory (hereinafter referred to as: CD-ROM), a digital versatile disc read only memory (hereinafter referred to as: DVD-ROM) or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present disclosure.

[0198] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in the memory 28, such program modules 42 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 42 generally perform the functions and / or methods of the embodiments described in the present disclosure.

[0199] The electronic device 12 may also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, etc.), may also communicate with one or more devices that enable the human body to interact with the electronic device 12, and / or communicate with any device that enables the electronic device 12 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed through an input / output (I / O) interface 22. In addition, the electronic device 12 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 20. As shown, the network adapter 20 communicates with other modules of the electronic device 12 through a bus 18. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0200] The processing unit 16 executes various functional applications and parameter information determination by running the program stored in the memory 28, such as implementing the business data storage method mentioned in the above embodiment, or implementing the business data acquisition method mentioned in the above embodiment.

[0201] It should be noted that, in the description of the present disclosure, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of the present disclosure, unless otherwise specified, the meaning of "plurality" is two or more.

[0202] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present disclosure includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present disclosure belong.

[0203] It should be understood that the various parts of the present disclosure can be implemented in hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0204] A person of ordinary skill in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0205] In addition, each functional unit in each embodiment of the present disclosure may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0206] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0207] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0208] Although the embodiments of the present disclosure have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present disclosure. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present disclosure.

Claims

1. An access control method, characterized in that: The method comprises: In the case of monitoring that the access object sends a first access request to the object to be accessed, determining a first object type of the access object and a second object type of the object to be accessed; Determine first description information and first identification information of the access object according to the first object type, and determine second description information of the object to be accessed according to the second object type; Determining third description information of the environment in which the access object is located; Determine access risk level information according to the first identification information, the first description information, the second description information and the third description information; A target access permission level for the access object is generated according to the access risk level information.

2. The method according to claim 1, characterized in that The first object type includes any of the following: Type of person; Type of device; Type of business; The second object type includes any one of the following: Data type; Function type; Interface type.

3. The method according to claim 2, characterized in that The determining, according to the first object type, first description information of the access object includes: If the first object type is the personnel type, obtaining the job description information and / or technical rank information of the access object, and using the job description information and / or the technical rank information as the first description information; If the first object type is the device type, obtaining function description information and / or security requirement information of the access object, and using the function description information and / or security requirement information as the first description information; If the first object type is the business type, sensitivity information and / or business relevance information of the access object is obtained, and the sensitivity information and / or the business relevance information are used together as the first description information.

4. The method according to claim 2, characterized in that The determining, according to the second object type, second description information of the object to be accessed includes: If the second object is of the data type, obtaining the data subtype of the object to be accessed, and using the data subtype as the second description information; If the second object is of the functional type, obtaining a functional subtype of the object to be accessed, and using the functional subtype as the second description information; If the second object is of the interface type, the interface subtype of the object to be accessed is obtained, and the interface subtype is used as the second description information.

5. The method according to claim 1, characterized in that The determining the access risk level information according to the first identification information, the first description information, the second description information and the third description information includes: Determining a first risk score according to the first identification information and the third description information; Access risk level information is determined according to the first risk score, the first description information, and the second description information.

6. The method according to claim 5, characterized in that The third description information includes: third description information corresponding to different environment types respectively; The step of determining a first risk score according to the first identification information and the third description information includes: Determine the environmental risk score corresponding to each of the environmental types according to the third description information corresponding to the different environmental types; The first risk score is determined according to the environmental risk score corresponding to each of the environmental types and the first identification information.

7. The method according to claim 6, characterized in that The environment types include: physical environment type, geographical environment type, computing environment type and network environment type; The determining of the environmental risk score corresponding to each of the environmental types according to the third description information corresponding to the different environmental types respectively includes: Determining, according to third description information corresponding to the physical environment type, an operation risk level value in the environment, wherein the operation risk level value belongs to the environmental risk score, and the operation risk level value is used to describe whether the operation in the environment meets the standard; Determine, according to the third description information corresponding to the geographical environment type, a geographical environment score corresponding to the access object, wherein the geographical environment score belongs to the environmental risk score and is used to describe whether the geographical environment of the access object meets the standard; Determine, according to the third description information corresponding to the computing environment type, a computing environment score corresponding to the access object, wherein the computing environment score belongs to the environmental risk score, and the computing environment score is used to describe whether the computing environment of the access object meets the standard; According to the third description information corresponding to the network environment type, the network environment score corresponding to the access object is determined, wherein the network environment score belongs to the environmental risk score, and the network environment score is used to describe whether the network environment of the access object meets the standard.

8. An access control device, characterized in that: The device comprises: A first determining module is used to determine a first object type of the access object and a second object type of the object to be accessed when monitoring that the access object sends a first access request to the object to be accessed; A second determination module, configured to determine first description information and first identification information of the access object according to the first object type, and to determine second description information of the object to be accessed according to the second object type; A third determining module, used to determine third description information of the environment where the access object is located; a fourth determination module, configured to determine access risk level information according to the first identification information, the first description information, the second description information and the third description information; A generating module is used to generate a target access permission level of the access object according to the access risk level information.

9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images