A remote secure access method, device and system based on cloud

Abstract

The present invention discloses a cloud-based remote security access method, device and system in the field of network access security verification technology, including an access device, the access device is used to send an access application to the cloud, the access application includes account information, device information and accessed device information of the access device, the cloud is used to receive the access application and send the access application to a user management module, the user management module is used to receive the access application and retrieve whether the account information in the access application exists in a first account storage unit or a second account storage unit. The present invention uses a verification module to check and filter out accounts with security problems for the accessed device, and marks each account in the cloud as two types of accounts, allowing the guest account to directly access the accessed device, providing a convenient way for visitors to access and at the same time, according to different types of accounts, different access time limits are imposed on them.

Description

Technical Field

[0001] The present invention relates to the technical field of network access security verification, and in particular to a cloud-based remote security access method, device and system. Background Art

[0002] Remote secure access involves using software tools to create a secure connection between two devices. Through a secure connection, users can access files, applications and data on other devices (such as home computers, laptops or mobile phones) as if they were in front of their work computers. It is a key measure to protect corporate data and assets from unauthorized access.

[0003] With the popularity of remote work and the development of cloud computing technology, cloud remote secure access has gradually become an indispensable part of modern enterprise operations. It allows employees, partners or customers to securely access cloud resources at any location and at any time, which not only improves employee work efficiency and flexibility, but also helps companies reduce costs and improve competitiveness.

[0004] However, cloud-based remote access also brings new security risks. Since the security of network accounts varies and the security mechanism is too simple, it is impossible to screen out accounts with security issues when facing new visitors. At the same time, it is impossible to control the visitor's access time, which seriously affects the convenience and timeliness of equipment and data services. Based on this, the present invention designs a cloud-based remote secure access method, device and system to solve the above-mentioned problem of not being able to screen out accounts with security issues and not being able to control the visitor's access duration when facing new visitors. Summary of the invention

[0005] The purpose of the present invention is to provide a cloud-based remote secure access method, device and system to solve the problem in the above-mentioned background technology that when facing new visitors, accounts with security issues cannot be screened out and the visit duration of visitors cannot be controlled.

[0006] To achieve the above object, the present invention provides the following technical solution: a cloud-based remote secure access method, comprising the following steps: The access device sends an access request to the cloud, wherein the access request includes the account information, device information and accessed device information of the access device; The cloud receives the access request and sends the access request to the user management module; The user management module receives the access application and searches whether the account information in the access application exists in the first account storage unit or the second account storage unit; If the user management module finds the account information in the first account storage unit or the second storage unit, the access device is allowed to directly access the accessed device; if the user management module does not find the account information in the first account storage unit or the second storage unit, the access request is sent to the verification module; The verification module receives the access application and checks whether there is a security problem based on the account information and device information in the access application. If there is a security problem, the access application is rejected. If there is no security problem, a binding request is sent to the access device through the cloud. After the access device accepts the binding request, the user management module sends the account information of the device to the first account storage unit and saves it, and then allows the access device to access the accessed device.

[0007] Preferably, the first account storage unit and the second account storage unit are used to store user account information, the account data stored in the first account storage unit and the account data stored in the second account storage unit are in an inclusion relationship, and the account data stored in the first account storage unit includes the account data stored in the second account storage unit.

[0008] Preferably, when the first account storage unit saves the account information, the cloud records the account information of the access device, and then the account information of the device is marked as a guest account and saved.

[0009] Preferably, when the cloud receives the access application of the access device, the cloud determines whether the device information of the access device exists in the cloud, and if so, allows the guest account to directly access the accessed device.

[0010] Preferably, the account information in the first account storage unit can be independently reviewed by the second account storage unit or manually reviewed by the management personnel. If the review is passed, the second account storage unit will save the account information and then send a change instruction to the cloud. The cloud receives the change instruction and uses the change instruction to change the guest account corresponding to the account information to a resident account.

[0011] Preferably, when the accessing device accesses the accessed device, if the account information of the accessing device is only stored in the first account storage unit, the cloud will configure and store the access duration of the account information, and record the access duration of the account information. Otherwise, the access to the account information will not be configured.

[0012] Preferably, when the access device accesses the accessed device, the supervision unit will always record and save the behavior operations of the access device, and the behavior operations include but are not limited to the transmission of software, browsing and transmission of files, etc.

[0013] A cloud-based remote secure access system includes an access device, the access device is used to send an access application to the cloud, the access application includes account information of the access device, device information and accessed device information, the cloud is used to receive the access application and send the access application to a user management module, the user management module is used to receive the access application and retrieve whether the account information in the access application exists in a first account storage unit or a second account storage unit; The first account storage unit and the second account storage unit are used to store user account information, the account data stored in the first account storage unit and the account data stored in the second account storage unit are in an inclusive relationship, and the account data stored in the first account storage unit includes the account data stored in the second account storage unit; If the user management module finds the account information in the first account storage unit or the second storage unit, allowing the access device to directly access the accessed device; If the user management module does not find the account information in the first account storage unit or the second storage unit, the access application is sent to the verification module. The verification module receives the access application and checks whether there is a security problem based on the account information and device information in the access application. If there is a security problem, the access application is rejected. If there is no security problem, a binding request is sent to the access device through the cloud. After the access device accepts the binding request, the user management module sends the account information of the device to the first account storage unit and saves it, and then allows the access device to access the accessed device. When the first account storage unit saves the account information, the cloud records the account information of the access device, and then the account information of the device is marked as a guest account and saved; When the cloud receives the access request of the access device, the cloud determines whether the device information of the access device exists in the cloud, and if so, allows the guest account to directly access the accessed device; The account information in the first account storage unit can be independently reviewed by the second account storage unit or manually reviewed by the management personnel. If the review is passed, the second account storage unit saves the account information and then sends a change instruction to the cloud. The cloud receives the change instruction and changes the guest account corresponding to the account information to a resident account according to the change instruction; When the access device accesses the accessed device, if the account information of the access device is only stored in the first account storage unit, the cloud will configure and store the access time of the account information and record the access time of the account information. Otherwise, the access to the account information will not be configured; When the access device accesses the accessed device, the supervision unit will always record and save the behavior operations of the access device, and the behavior operations include but are not limited to the transmission of software, browsing and transmission of files, etc.

[0014] A cloud-based remote secure access device includes a processor and a memory, wherein the memory is configured with a computer program executed by the processor, and the processor implements the above method when executing the computer program.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention sends the account information not stored in the first account storage unit or the second storage unit to the verification module, and checks and screens it through the verification module, so as to store the account information that does not have security issues and exclude those accounts that have security issues. At the same time, the cloud will configure and store the access time according to the account type corresponding to the account information of the device, and record the access time of the account information, thereby limiting the access time of the visitor.

[0016] 2. The present invention records the account information of the device in question in the cloud when the first account storage unit saves the account information, and marks the account information of the device as a guest account and saves it. Then, when the cloud receives an access application from the access device, the cloud determines whether the device information of the access device exists in the cloud. If so, the guest account is allowed to directly access the accessed device, providing a convenient way for visitors to access. At the same time, the first account storage unit and the second account storage unit are divided into corresponding guest accounts and resident accounts in the cloud, and the accounts are classified to facilitate management by management personnel. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0018] Figure 1 This is a schematic diagram of the flow chart of the first embodiment of the present invention; Figure 2 This is a schematic diagram of the relationship between account data of the present invention; Figure 3This is a flow chart of the second embodiment of the present invention; Figure 4 This is a schematic diagram of the flow chart of the third embodiment of the present invention; Figure 5 This is a schematic diagram of a fourth embodiment of the present invention; Figure 6 This is a schematic diagram of the fifth embodiment of the present invention; Figure 7 This is a flow chart of the sixth embodiment of the present invention; Figure 8 This is a flow chart of the seventh embodiment of the present invention. Fig. 9 Schematic diagram of the eighth embodiment of the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] The present invention provides a variety of embodiments, for details, please refer to Figure 1 and Figure 2 , Figure 1 and Figure 2 The first embodiment of the present invention comprises the following steps: S1. The access device sends an access request to the cloud. The access request includes the access device's account information, device information, and accessed device information. S2. The cloud receives the access request and sends the access request to the user management module; S3, the user management module receives the access application, and searches whether the account information in the access application exists in the first account storage unit or the second account storage unit; S4. If the user management module finds the account information in the first account storage unit or the second storage unit, the access device is allowed to directly access the accessed device. If the user management module does not find the account information in the first account storage unit or the second storage unit, the access request is sent to the verification module. S5. The verification module receives the access application and checks whether there is a security problem based on the account information and device information in the access application. If there is a security problem, the access application is rejected. If there is no security problem, a binding request is sent to the access device through the cloud. S6. After the accessed device accepts the binding request, the user management module sends the account information of the device to the first account storage unit and saves it, and then allows the accessing device to access the accessed device.

[0021] It should be noted that the account information of each accessed device must be stored in the first account storage unit. If it is not saved, the accessed device cannot be accessed, thereby ensuring the data security of the accessed device.

[0022] like Figure 2 As shown, the first account storage unit and the second account storage unit are used to store user account information. The account data stored in the first account storage unit and the account data stored in the second account storage unit are in an inclusion relationship. The account data stored in the first account storage unit includes the account data stored in the second account storage unit.

[0023] See also Figure 3 , Figure 3 This is the second embodiment of the present invention. Based on the first embodiment, S61 is differentiated from S6. S61, the first account storage unit stores the account information; S7. The cloud records the account information of the accessed device, and then marks the account information of the device as a guest account and saves it.

[0024] See also Figure 4 , Figure 4 This is the third embodiment of the present invention. Based on the first embodiment, S21 is differentiated from S2. S21, the cloud receives an access request for accessing the device; S8, the cloud determines whether the device information of the access device exists in the cloud; S9. If it exists, the guest account is allowed to directly access the accessed device.

[0025] See also Figure 5 , Figure 5 This is the fourth embodiment of the present invention. On the basis of the first embodiment, it further includes account review. The account information in the first account storage unit can be independently reviewed by the second account storage unit or manually reviewed by the management personnel. If the review is passed, the second account storage unit will save the account information and then send a change instruction to the cloud. The cloud receives the change instruction and uses the change instruction to change the guest account corresponding to the account information to a resident account.

[0026] See also Figure 6 , Figure 6 The fifth embodiment of the present invention further includes access duration configuration based on the first embodiment, and further includes S62 and S63 based on S6. S62, the accessing device is accessing the accessed device; S63. If the account information of the access device is only stored in the first account storage unit, the cloud will configure and store the access duration of the account information and record the access duration of the account information. Otherwise, the access to the account information will not be configured.

[0027] It should be noted that the access time is set by the administrator and the access time threshold is corrected for each account information through the cloud to ensure the security of the device.

[0028] See also Figure 7 , Figure 7 The sixth embodiment of the present invention further comprises a supervision unit based on the first embodiment, and further comprises S62 and S64 based on S6. S62, the accessing device is accessing the accessed device; S64. The monitoring unit will always record and save the behavior operations of accessing the device, including but not limited to the transmission of software, browsing and transmission of files, etc.

[0029] See also Figure 8 , Figure 8 As a seventh embodiment of the present invention, a cloud-based remote secure access system is provided, including an access device, the access device is used to send an access application to the cloud, the access application includes account information of the access device, device information and accessed device information, the cloud is used to receive the access application, and send the access application to a user management module, the user management module is used to receive the access application, and retrieve whether the account information in the access application exists in the first account storage unit or the second account storage unit; The first account storage unit and the second account storage unit are used to store the user's account information. The account data stored in the first account storage unit and the account data stored in the second account storage unit are in an inclusive relationship. The account data stored in the first account storage unit includes the account data stored in the second account storage unit. If the user management module finds the account information in the first account storage unit or the second storage unit, the access device is allowed to directly access the accessed device; If the user management module does not find the account information in the first account storage unit or the second storage unit, the access application is sent to the verification module. The verification module receives the access application and checks whether there is a security problem based on the account information and device information in the access application. If there is a security problem, the access application is rejected. If there is no security problem, a binding request is sent to the access device through the cloud. After the access device accepts the binding request, the user management module sends the account information of the device to the first account storage unit and saves it, and then allows the access device to access the accessed device; When the first account storage unit saves the account information, the cloud records the account information of the access device, and then the account information of the device is marked as a guest account and saved; When receiving an access request from an access device in the cloud, the cloud determines whether the device information of the access device exists in the cloud. If so, the guest account is allowed to directly access the accessed device; The account information in the first account storage unit can be independently reviewed by the second account storage unit or manually reviewed by the management personnel. If the review is passed, the second account storage unit will save the account information and then send a change instruction to the cloud. The cloud receives the change instruction and changes the guest account corresponding to the account information to a resident account according to the change instruction; When the access device accesses the accessed device, if the account information of the access device is only stored in the first account storage unit, the cloud will configure and store the access time of the account information and record the access time of the account information. Otherwise, the access to the account information will not be configured. When the access device accesses the accessed device, the supervision unit will always record and save the behavior operations of the access device, including but not limited to the transmission of software, browsing and transmission of files, etc.

[0030] See also Fig. 9 , Fig. 9 As the eighth embodiment of the present embodiment, a cloud-based remote security access device is provided, including a processor and a memory, wherein the memory is configured with a computer program executed by the processor, and when the processor executes the computer program, the above-mentioned cloud-based remote security access method is implemented.

[0031] It should be noted that the above computer program can be divided into one or more modules and executed by a processor to complete the above embodiments.

[0032] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0033] The preferred embodiments of the present invention disclosed above are only used to help illustrate the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A cloud-based remote secure access method, characterized in that: The following steps are included: The access device sends an access request to the cloud, wherein the access request includes the account information, device information and accessed device information of the access device; The cloud receives the access request and sends the access request to the user management module; The user management module receives the access application and searches whether the account information in the access application exists in the first account storage unit or the second account storage unit; If the user management module finds the account information in the first account storage unit or the second storage unit, the access device is allowed to directly access the accessed device; if the user management module does not find the account information in the first account storage unit or the second storage unit, the access request is sent to the verification module; The verification module receives the access application and checks whether there is a security problem based on the account information and device information in the access application. If there is a security problem, the access application is rejected. If there is no security problem, a binding request is sent to the access device through the cloud. After the access device accepts the binding request, the user management module sends the account information of the device to the first account storage unit and saves it, and then allows the access device to access the accessed device.

2. The cloud-based remote secure access method according to claim 1, characterized in that: The first account storage unit and the second account storage unit are used to store user account information. The account data stored in the first account storage unit and the account data stored in the second account storage unit are in an inclusion relationship. The account data stored in the first account storage unit includes the account data stored in the second account storage unit.

3. The cloud-based remote secure access method according to claim 1, characterized in that: When the first account storage unit saves the account information, the cloud records the account information of the access device, and then the account information of the device is marked as a guest account and saved.

4. The cloud-based remote secure access method according to claim 3, characterized in that: When the cloud receives the access request of the access device, the cloud determines whether the device information of the access device exists in the cloud. If so, the guest account is allowed to directly access the accessed device.

5. The cloud-based remote secure access method according to claim 1, characterized in that: The account information in the first account storage unit can be independently reviewed by the second account storage unit or manually reviewed by the management personnel. If the review is passed, the second account storage unit will save the account information and then send a change instruction to the cloud. The cloud receives the change instruction and uses the change instruction to change the guest account corresponding to the account information to a resident account.

6. A cloud-based remote secure access method according to any one of claims 1 to 5, characterized in that: When the accessing device accesses the accessed device, if the account information of the accessing device is only stored in the first account storage unit, the cloud will configure and store the access duration of the account information, and record the access duration of the account information. Otherwise, the access to the account information will not be configured.

7. A cloud-based remote secure access method according to any one of claims 1 to 5, characterized in that: When the access device accesses the accessed device, the supervision unit will always record and save the behavior operations of the access device, and the behavior operations include but are not limited to the transmission of software, browsing and transmission of files, etc.

8. A cloud-based remote secure access system, characterized by: The access device includes an access device, the access device is used to send an access application to the cloud, the access application includes account information of the access device, device information and accessed device information, the cloud is used to receive the access application and send the access application to the user management module, the user management module is used to receive the access application and retrieve whether the account information in the access application exists in the first account storage unit or the second account storage unit; The first account storage unit and the second account storage unit are used to store user account information, the account data stored in the first account storage unit and the account data stored in the second account storage unit are in an inclusive relationship, and the account data stored in the first account storage unit includes the account data stored in the second account storage unit; If the user management module finds the account information in the first account storage unit or the second storage unit, allowing the access device to directly access the accessed device; If the user management module does not find the account information in the first account storage unit or the second storage unit, the access application is sent to the verification module. The verification module receives the access application and checks whether there is a security problem based on the account information and device information in the access application. If there is a security problem, the access application is rejected. If there is no security problem, a binding request is sent to the access device through the cloud. After the access device accepts the binding request, the user management module sends the account information of the device to the first account storage unit and saves it, and then allows the access device to access the accessed device. When the first account storage unit saves the account information, the cloud records the account information of the access device, and then the account information of the device is marked as a guest account and saved; When the cloud receives the access request of the access device, the cloud determines whether the device information of the access device exists in the cloud, and if so, allows the guest account to directly access the accessed device; The account information in the first account storage unit can be independently reviewed by the second account storage unit or manually reviewed by the management personnel. If the review is passed, the second account storage unit saves the account information and then sends a change instruction to the cloud. The cloud receives the change instruction and changes the guest account corresponding to the account information to a resident account according to the change instruction; When the access device accesses the accessed device, if the account information of the access device is only stored in the first account storage unit, the cloud will configure and store the access time of the account information and record the access time of the account information. Otherwise, the access to the account information will not be configured; When the access device accesses the accessed device, the supervision unit will always record and save the behavior operations of the access device, and the behavior operations include but are not limited to the transmission of software, browsing and transmission of files, etc.

9. A cloud-based remote secure access device, characterized in that: The method comprises a processor and a memory, wherein the memory is configured with a computer program executed by the processor, and the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

Images