Data security access method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of data security, and discloses a data security access method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining an access request sent by any user side to a cloud data center based on a load balancing service; mapping the access request to a preset strategy engine through a traffic mirroring module between the load balancing service and the preset strategy engine; based on a preset strategy engine, determining a target response strategy of the access request according to the security authentication information represented by the access request; and responding to the access request according to the target response strategy. According to the method provided by the scheme, the access request obtained by the load balancing service is mapped to the preset strategy engine, and the data security access controller of the cloud data center is performed based on the preset strategy engine, so that the flexibility and compatibility of data security access configuration of the cloud data center are improved; and a foundation is laid for improving the security of cloud data access of the user side.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a data security access method, device, electronic device and storage medium. Background Art

[0002] At present, with the continuous development of cloud computing technology, cloud data centers provide customers with more and more services, such as cloud data storage, etc. Cloud data can be shared and accessed by multiple users. Therefore, how to achieve secure access to cloud data by each user has become a key research topic.

[0003] In related technologies, data security access control is usually implemented based on professional security access hardware devices. However, the deployment of security access hardware devices lacks flexibility, and cloud data centers generally provide data services through load balancing devices. Current security access hardware devices are not compatible with load balancing devices. Therefore, there is an urgent need for a data security access method that can be flexibly configured in a cloud data center, which is of great significance to improving the security of cloud data access. Summary of the invention

[0004] The present application provides a data security access method, device, electronic device and storage medium to solve the defects of the related art such as reduced flexibility and compatibility of data security access configuration of cloud data centers.

[0005] The first aspect of the present application provides a data security access method, comprising:

[0006] Obtain access requests sent by any user end to the cloud data center based on the load balancing service;

[0007] Mapping the access request to the preset policy engine through a traffic mirroring module between the load balancing service and the preset policy engine;

[0008] Based on the preset policy engine, determining a target response policy for the access request according to the security authentication information represented by the access request;

[0009] The access request is responded to according to the target response policy.

[0010] In an optional implementation, the determining, based on the preset policy engine and according to the security authentication information represented by the access request, a target response policy for the access request includes:

[0011] Performing authentication feature extraction on the access request to obtain an authentication feature extraction result of the access request;

[0012] Based on the preset policy engine, and according to the authentication feature extraction result of the access request, determine the security authentication information of the access request;

[0013] A target response strategy for the access request is determined according to the security authentication information of the access request.

[0014] In an optional implementation, the extracting authentication features from the access request to obtain an authentication feature extraction result of the access request includes:

[0015] Performing user identity feature extraction and request action feature extraction on the access request to obtain an authentication feature extraction result of the access request;

[0016] The authentication features include the user identity features and the request action features.

[0017] In an optional implementation, the target response strategy for the access request is divided into at least three types: release response, blocking response and desensitization response.

[0018] In an optional implementation manner, responding to the access request according to the target response strategy includes:

[0019] Based on the traffic mirroring module, read the initial response data obtained by the load balancing service from the cloud data center in response to the access request;

[0020] According to the initial response data, initial tunnel information is encapsulated to obtain an initial response data packet; wherein the initial response data packet includes the initial response data and the initial tunnel information;

[0021] Mapping the initial response data packet to the preset policy engine;

[0022] Based on the preset policy engine and in accordance with the target response policy, the initial response data packet is subjected to data security processing to obtain a target response data packet; wherein the target response data packet includes target response data and target tunnel information.

[0023] In an optional implementation, the performing data security processing on the initial response data packet based on the preset policy engine and in accordance with the target response policy to obtain a target response data packet includes:

[0024] In the case where the target response strategy is a desensitized response, based on the preset strategy engine, data replacement processing is performed on the sensitive data in the initial response data to obtain target impact data;

[0025] Modify the initial tunnel information according to the target impact data to obtain target tunnel information;

[0026] The target impact data and target tunnel information are encapsulated to obtain a target response data packet.

[0027] In an optional embodiment, the method further includes:

[0028] Based on the load balancing service, the target response data packet is forwarded to the user end.

[0029] A second aspect of the present application provides a data security access device, comprising:

[0030] An acquisition module, used to acquire an access request sent by any user terminal to the cloud data center based on the load balancing service;

[0031] A mapping module, used to map the access request to a preset policy engine through a traffic mirroring module between the load balancing service and the preset policy engine;

[0032] An authentication module, configured to determine a target response strategy for the access request based on the preset policy engine and the security authentication information represented by the access request;

[0033] A response module is used to respond to the access request according to the target response strategy.

[0034] In an optional implementation, the authentication module is specifically used to:

[0035] Performing authentication feature extraction on the access request to obtain an authentication feature extraction result of the access request;

[0036] Based on the preset policy engine, and according to the authentication feature extraction result of the access request, determine the security authentication information of the access request;

[0037] A target response strategy for the access request is determined according to the security authentication information of the access request.

[0038] In an optional implementation, the authentication module is specifically used to:

[0039] Performing user identity feature extraction and request action feature extraction on the access request to obtain an authentication feature extraction result of the access request;

[0040] The authentication features include the user identity features and the request action features.

[0041] In an optional implementation, the target response strategy for the access request is divided into at least three types: release response, blocking response and desensitization response.

[0042] In an optional implementation, the response module is specifically used to:

[0043] Based on the traffic mirroring module, read the initial response data obtained by the load balancing service from the cloud data center in response to the access request;

[0044] According to the initial response data, initial tunnel information is encapsulated to obtain an initial response data packet; wherein the initial response data packet includes the initial response data and the initial tunnel information;

[0045] Mapping the initial response data packet to the preset policy engine;

[0046] Based on the preset policy engine and in accordance with the target response policy, the initial response data packet is subjected to data security processing to obtain a target response data packet; wherein the target response data packet includes target response data and target tunnel information.

[0047] In an optional implementation, the response module is specifically used to:

[0048] In the case where the target response strategy is a desensitized response, based on the preset strategy engine, data replacement processing is performed on the sensitive data in the initial response data to obtain target impact data;

[0049] Modify the initial tunnel information according to the target impact data to obtain target tunnel information;

[0050] The target impact data and target tunnel information are encapsulated to obtain a target response data packet.

[0051] In an optional implementation, the response module is further used to:

[0052] Based on the load balancing service, the target response data packet is forwarded to the user end.

[0053] A third aspect of the present application provides an electronic device, comprising: at least one processor and a memory;

[0054] The memory stores computer-executable instructions;

[0055] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method described in the first aspect and various possible designs of the first aspect.

[0056] A fourth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions. When a processor executes the computer-executable instructions, the method described in the first aspect and various possible designs of the first aspect are implemented.

[0057] A fifth aspect of the present application provides a computer program product, including computer instructions, which are used to enable a computer to execute the method described in the first aspect and various possible designs of the first aspect.

[0058] The technical solution of this application has the following advantages:

[0059] The present application provides a data security access method, device, electronic device and storage medium, the method comprising: obtaining an access request sent by any user terminal to a cloud data center based on a load balancing service; mapping the access request to a preset policy engine through a traffic mirroring module between the load balancing service and a preset policy engine; determining a target response policy for the access request based on the preset policy engine according to security authentication information represented by the access request; responding to the access request according to the target response policy. The method provided by the above scheme improves the flexibility and compatibility of the data security access configuration of the cloud data center by mapping the access request obtained by the load balancing service to a preset policy engine, so as to perform a data security access controller for the cloud data center based on the preset policy engine, and lays a foundation for improving the security of user terminal access to cloud data. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the following is a brief introduction to the drawings required for use in the embodiments or the related technical descriptions. Obviously, the drawings described below are some embodiments of the present application, and a person skilled in the art can also obtain other drawings based on these drawings.

[0061] Figure 1 A schematic diagram of the structure of a data security access system based on an embodiment of the present application;

[0062] Figure 2 A flowchart of a data security access method provided in an embodiment of the present application;

[0063] Figure 3 A schematic diagram of the structure of an exemplary data security access system provided in an embodiment of the present application;

[0064] Figure 4 A schematic diagram of the structure of the preset strategy engine provided in the embodiment of the present application;

[0065] Figure 5 A schematic diagram of a connection establishment process provided in an embodiment of the present application;

[0066] Figure 6 A schematic diagram of a response data transmission process provided in an embodiment of the present application;

[0067] Figure 7 A schematic diagram of the structure of a data security access device provided in an embodiment of the present application;

[0068] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0069] The above drawings have shown clear embodiments of the present application, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present disclosure in any way, but to illustrate the concepts of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0071] In addition, the terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. In the description of the following embodiments, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0072] In related technologies, data access control is a crucial part of data security and can be understood as a basic mechanism of security. Access control authorizes access to legitimate users based on the specified security policies and security models, and prevents unauthorized users and legitimate authorized users from illegally accessing. The objects involved usually include access subjects, resource objects, access policies, policy enforcement and other components.

[0073] With the development of digital transformation, enterprise services are increasingly migrating to cloud-native architecture and cloud-based architecture. Existing technical solutions generally use professional equipment to achieve data security access control, lacking security control for cloud-native scenarios and business cloud data access, and lacking flexible deployment mechanisms. It cannot be flexibly deployed in cloud-native and cloud-based data access scenarios, and lacks a security access control mechanism based on ABAC (attribute-based access control). In addition, many of the user's existing data services are based on general nginx for load balancing. Switching to traditional security access control equipment will increase unnecessary hardware costs and also lead to adjustments to the service architecture.

[0074] In response to the above problems, the embodiments of the present application provide a data security access method, device, electronic device and storage medium, the method comprising: obtaining an access request sent by any user terminal to a cloud data center based on a load balancing service; mapping the access request to a preset policy engine through a traffic mirroring module between the load balancing service and a preset policy engine; determining a target response policy for the access request based on the preset policy engine according to security authentication information represented by the access request; and responding to the access request according to the target response policy. The method provided by the above scheme improves the flexibility and compatibility of the data security access configuration of the cloud data center by mapping the access request obtained by the load balancing service to a preset policy engine, so as to perform a data security access controller for the cloud data center based on the preset policy engine, and lays a foundation for improving the security of user terminal access to cloud data.

[0075] The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments. The embodiments of the present invention will be described below in conjunction with the accompanying drawings.

[0076] First, the structure of the data security access system on which this application is based is described:

[0077] The data security access method, device, electronic device and storage medium provided in the embodiments of the present application are suitable for responding securely to a cloud data center access request sent by a user terminal. Figure 1 As shown, it is a structural diagram of the data security access system based on the embodiment of the present application, which mainly includes a user terminal, a cloud data center and a data security access device. The user terminal first sends an access request to the data security access device, and the data security access device determines the target response strategy for the access request, and finally responds to the access request according to the target response strategy.

[0078] The embodiment of the present application provides a data security access method for securely responding to a cloud data center access request sent by a user terminal. The execution subject of the embodiment of the present application is an electronic device, such as a server, a desktop computer, a laptop computer, a tablet computer, and other electronic devices that can be used to securely respond to a cloud data center access request sent by a user terminal.

[0079] like Figure 2 FIG. 1 is a flow chart of a data security access method provided in an embodiment of the present application, the method comprising:

[0080] Step 201: Obtain an access request sent by any user terminal to a cloud data center based on a load balancing service.

[0081] Among them, the load balancing service can specifically refer to nginx. Nginx is a high-performance HTTP and reverse proxy server, which is often used to provide load balancing services in network services.

[0082] Step 202, mapping the access request to the preset policy engine through the traffic mirroring module between the load balancing service and the preset policy engine.

[0083] Among them, the traffic mirror module can be called tcp / http_stream_mirror module, and the traffic mirror module is developed through the flexible third-party module extension mechanism provided by nginx.

[0084] Step 203: Based on a preset policy engine and according to the security authentication information represented by the access request, a target response policy for the access request is determined.

[0085] Specifically, based on a preset policy engine, the security authentication information represented by the access request may be analyzed and matched to determine a target response policy for the access request.

[0086] Among them, the target response strategy of the access request is divided into at least three types: release response, blocking response and desensitization response.

[0087] Step 204: respond to the access request according to the target response policy.

[0088] Specifically, when the target impact policy is a release response, nginx directly forwards the response data returned by the preset policy engine without doing anything. When the target impact policy is a blocking response, nginx disconnects the current connection and discards the data. When the target impact policy is a desensitized response, nginx forwards the desensitized data to the user end. Modify the returned content, add more restrictions, or remove the invisible part of the returned content.

[0089] Specifically, Figure 3As shown, it is a structural diagram of an exemplary data security access system provided in an embodiment of the present application. The user end sends an access request to the database service of the cloud data center through the application container engine. The application container application engine includes a load balancing service (nginx), a traffic mirroring module (tcp / http_stream_mirror) and a preset policy engine (Policy Engine). The load balancing service Nginx and the preset policy engine Policy Engine can be independently and flexibly expanded, and can be losslessly elastically scaled according to the business and load of the cloud data center to ensure the availability of the service. The module developed based on the nginx module can be directly loaded as a module component into the existing nginx cluster of the user-side service to provide lossless service online expansion.

[0090] Based on the above embodiment, as an implementable manner, in one embodiment, based on a preset policy engine, according to the security authentication information represented by the access request, a target response policy for the access request is determined, including:

[0091] Step 2031, extracting authentication features from the access request to obtain an authentication feature extraction result of the access request;

[0092] Step 2032, based on a preset policy engine, according to the authentication feature extraction result of the access request, determine the security authentication information of the access request;

[0093] Step 2033: Determine a target response strategy for the access request based on the security authentication information of the access request.

[0094] Specifically, in one embodiment, user identity feature extraction and request action feature extraction may be performed on the access request to obtain an authentication feature extraction result of the access request.

[0095] Among them, the authentication features include user identity features and request action features.

[0096] Specifically, the preset policy engine can identify the user's identity and role, as well as the access action of the access request based on the authentication feature extraction results of the access request, analyze the content of the data traffic, and perform ABAC policy analysis based on the extracted keywords and the combination of the extracted features and the identified content. Based on the analysis results (security authentication information), the target response strategy for the access request is determined, and the corresponding operations are subsequently executed to perform data processing and control the rationality of the access data in real time.

[0097] Specifically, Figure 4As shown, it is a schematic diagram of the structure of the preset policy engine provided by the embodiment of the present application. The PolicyEngine pulls the information of the third party or the user's internal identity authority management system (IPAM) through the OPA PolicyAgent (policy execution component), converts it into a general PolicyEngine data interface after internal data processing, and compiles it into a high-performance matching engine (OPA Engine) through the Compile compilation method. The matching engine performs security authentication on the authentication feature extraction results of the access request (SQL statement) to determine the security authentication information of the access request, and further determine the target response strategy.

[0098] When the access request is an SQL statement, Nginx forwards the traffic to PolicyEngine in real time through stream based on mirror Module. PolicyEngine identifies the access SQL type according to the traffic characteristics, parses the SQL statement, extracts the user's token, IP and other information as ABAC user identity characteristics, extracts the SQL statement action and select, where, etc., converts it into the internal ABAC data interface, and calls the OPA Engine for matching processing. According to the matching result (target response strategy), the action is executed: release, desensitization, blocking, etc., and the matching result can be further returned to the traffic mirror module, which performs the corresponding processing according to the returned result.

[0099] Based on the above embodiment, as an implementable manner, in one embodiment, responding to the access request according to the target response strategy includes:

[0100] Step 2041, based on the traffic mirroring module, read the initial response data obtained by the load balancing service from the cloud data center in response to the access request;

[0101] Step 2042, encapsulating the initial tunnel information according to the initial response data to obtain an initial response data packet;

[0102] Step 2043, mapping the initial response data packet to a preset policy engine;

[0103] Step 2044, based on the preset policy engine and in accordance with the target response policy, the initial response data packet is subjected to data security processing to obtain a target response data packet.

[0104] Among them, the initial response data packet includes initial response data and initial tunnel information; the target response data packet includes target response data and target tunnel information. The initial response data is data directly read from the back-end database service according to the access request, and the tunnel information includes at least data transmission length and data offset, etc.

[0105] It should be noted that the embodiment of the present application combines the third-party module extension interface provided by nginx to develop a tcp / http_stream_mirror module (traffic mirror module). This module is developed based on the nginx third-party extension structure, and new configuration items and processing modules are added. When a user accesses the database through nginx, tcp / http_stream_mirror reuses the nginx upstream mechanism (load balancing service upper mechanism), based on the processing module, and realizes flexible expansion and configuration of PolicyEngine (preset policy engine) according to the configuration items.

[0106] Among them, Figure 5 As shown, it is a schematic diagram of the connection establishment process provided by the embodiment of the present application. When the user terminal accesses the back-end database service through nginx, nginx will establish a TCP connection with the user terminal. After the connection is established (1)(2), nginx will enter the proxy / upstream module and establish a TCP connection with the back-end database service (3)(4). After the connection is established, the user terminal sends a normal data access request. After nginx and the back-end database have established a connection, when the current connection has data exchange, it will simultaneously establish a connection with the Policy Engine (5)(6). The connection supports both unix / tcp modes.

[0107] Specifically, in one embodiment, when the target response strategy is a desensitized response, based on a preset policy engine, data replacement processing is performed on the sensitive data in the initial response data to obtain target impact data; according to the target impact data, the initial tunnel information is modified to obtain the target tunnel information; the target impact data and the target tunnel information are encapsulated to obtain a target response data packet.

[0108] Furthermore, in one embodiment, the target response data packet may be forwarded to the user end based on the load balancing service.

[0109] Specifically, Figure 6As shown, it is a schematic diagram of the response data transmission process provided by the embodiment of the present application. When there is data transmission in the connection (1)(5), tcp / http_stream_mirror (traffic mirror module) will cache the data (initial response data) read from the cache area socket of the load balancing service, and encapsulate the private tunnel information (initial tunnel information), and map the data (initial data packet) to the Policy Engine (2, 6). After the Policy Engine completes the processing, it encapsulates the processed data (target response data) and the action to be executed with the private tunnel information (target tunnel information) to obtain the target response data packet, and sends the target response data packet back to the traffic mirror module (3, 7). The traffic mirror module Mirror Module processes the data according to the returned result. If the data does not need to be replaced, the corresponding cached data is directly forwarded, that is, the initial response data is returned to the user end. If the original data needs to be modified, the cached data is released, and the data processed by the PolicyEngine (target response data) is forwarded to realize the asynchronous processing of the entire security business (4)(8).

[0110] The data security access method provided in the embodiment of the present application obtains the access request sent by any user terminal to the cloud data center based on the load balancing service; maps the access request to the preset policy engine through the traffic mirroring module between the load balancing service and the preset policy engine; based on the preset policy engine, determines the target response policy of the access request according to the security authentication information represented by the access request; responds to the access request according to the target response policy. The method provided by the above scheme improves the flexibility and compatibility of the data security access configuration of the cloud data center by mapping the access request obtained by the load balancing service to the preset policy engine, and performs the data security access controller of the cloud data center based on the preset policy engine, which lays the foundation for improving the security of the user terminal's access to cloud data. In addition, the entire architecture solution supports flexible deployment and can be deployed in cloud native scenarios, combining K8s's ABAC, ingress controller, CRD and other mechanisms to achieve non-invasive deployment of microservices. It can also be deployed as a separate service in the cloud VPC to achieve security control of data access on the VPC.

[0111] An embodiment of the present application provides a data security access device for executing the data security access method provided in the above embodiment.

[0112] like Figure 7 , which is a schematic diagram of the structure of a data security access device provided in an embodiment of the present application. The data security access device 70 comprises: an acquisition module 701 , a mapping module 702 , an authentication module 703 and a response module 704 .

[0113] Among them, the acquisition module is used to obtain the access request sent by any user terminal to the cloud data center based on the load balancing service; the mapping module is used to map the access request to the preset policy engine through the traffic mirroring module between the load balancing service and the preset policy engine; the authentication module is used to determine the target response strategy of the access request based on the preset policy engine and the security authentication information represented by the access request; the response module is used to respond to the access request according to the target response strategy.

[0114] Specifically, in one embodiment, the authentication module is specifically used to:

[0115] Extracting authentication features from the access request to obtain an authentication feature extraction result of the access request;

[0116] Based on a preset policy engine, the security authentication information of the access request is determined according to the authentication feature extraction result of the access request;

[0117] Determine the target response strategy for the access request based on the security authentication information of the access request.

[0118] Specifically, in one embodiment, the authentication module is specifically used to:

[0119] Perform user identity feature extraction and request action feature extraction on the access request to obtain an authentication feature extraction result of the access request;

[0120] Among them, the authentication features include user identity features and request action features.

[0121] Specifically, in one embodiment, the target response strategy for the access request is divided into at least three types: release response, blocking response, and desensitization response.

[0122] Specifically, in one embodiment, the response module is specifically used to:

[0123] Based on the traffic mirroring module, read the initial response data obtained by the load balancing service from the cloud data center in response to the access request;

[0124] Encapsulating the initial tunnel information according to the initial response data to obtain an initial response data packet; wherein the initial response data packet includes the initial response data and the initial tunnel information;

[0125] Mapping the initial response data packet to a preset policy engine;

[0126] Based on the preset policy engine and in accordance with the target response policy, the initial response data packet is subjected to data security processing to obtain a target response data packet; wherein the target response data packet includes target response data and target tunnel information.

[0127] Specifically, in one embodiment, the response module is specifically used to:

[0128] When the target response strategy is a desensitized response, based on the preset strategy engine, data replacement processing is performed on the sensitive data in the initial response data to obtain the target impact data;

[0129] According to the target impact data, the initial tunnel information is modified to obtain the target tunnel information;

[0130] Encapsulate the target impact data and target tunnel information to obtain a target response data packet.

[0131] Specifically, in one embodiment, the response module is further used to:

[0132] Based on the load balancing service, the target response data packet is forwarded to the user end.

[0133] Regarding the data security access device in this embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0134] The data security access device provided in the embodiment of the present application is used to execute the data security access method provided in the above embodiment. Its implementation method and principle are the same and will not be repeated here.

[0135] An embodiment of the present application provides an electronic device for executing the data security access method provided in the above embodiment.

[0136] like Figure 8 FIG. 8 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device 80 includes: at least one processor 81 and a memory 82.

[0137] The memory stores computer-executable instructions; at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the data security access method provided in the above embodiment.

[0138] The electronic device provided in the embodiment of the present application is used to execute the data security access method provided in the above embodiment. Its implementation method and principle are the same and will not be repeated here.

[0139] An embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, a data security access method provided in any of the above embodiments is implemented.

[0140] The storage medium containing computer executable instructions provided in the embodiments of the present application can be used to store computer executable instructions of the data security access method provided in the aforementioned embodiments. The implementation method and principle are the same and will not be repeated here.

[0141] An embodiment of the present application provides a computer program product, including computer instructions, which are used to enable a computer to execute the data security access method provided in the aforementioned embodiment.

[0142] The embodiments of the present application provide a computer program product that can be used to execute computer instructions of the data security access method provided in the aforementioned embodiments. The implementation method and principle are the same and will not be repeated here.

[0143] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0144] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0145] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0146] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0147] A part of the present application may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0148] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example for illustration. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0149] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data security access method, characterized in that: include: Obtain access requests sent by any user end to the cloud data center based on the load balancing service; Mapping the access request to the preset policy engine through a traffic mirroring module between the load balancing service and the preset policy engine; Based on the preset policy engine, determining a target response policy for the access request according to the security authentication information represented by the access request; The access request is responded to according to the target response policy.

2. The method according to claim 1, characterized in that The determining, based on the preset policy engine and according to the security authentication information represented by the access request, a target response policy for the access request includes: Performing authentication feature extraction on the access request to obtain an authentication feature extraction result of the access request; Based on the preset policy engine, and according to the authentication feature extraction result of the access request, determine the security authentication information of the access request; A target response strategy for the access request is determined according to the security authentication information of the access request.

3. The method according to claim 2, characterized in that The extracting authentication features from the access request to obtain an authentication feature extraction result of the access request includes: Performing user identity feature extraction and request action feature extraction on the access request to obtain an authentication feature extraction result of the access request; The authentication features include the user identity features and the request action features.

4. The method according to claim 2, characterized in that: The target response strategy of the access request is divided into at least three types: release response, blocking response and desensitization response.

5. The method according to claim 1, characterized in that The responding to the access request according to the target response strategy includes: Based on the traffic mirroring module, read the initial response data obtained by the load balancing service from the cloud data center in response to the access request; According to the initial response data, initial tunnel information is encapsulated to obtain an initial response data packet; wherein the initial response data packet includes the initial response data and the initial tunnel information; Mapping the initial response data packet to the preset policy engine; Based on the preset policy engine and in accordance with the target response policy, the initial response data packet is subjected to data security processing to obtain a target response data packet; wherein the target response data packet includes target response data and target tunnel information.

6. The method according to claim 5, characterized in that The performing data security processing on the initial response data packet based on the preset policy engine and in accordance with the target response policy to obtain a target response data packet includes: In the case where the target response strategy is a desensitized response, based on the preset strategy engine, data replacement processing is performed on the sensitive data in the initial response data to obtain target impact data; Modify the initial tunnel information according to the target impact data to obtain target tunnel information; The target impact data and target tunnel information are encapsulated to obtain a target response data packet.

7. The method according to claim 5, characterized in that The method further comprises: Based on the load balancing service, the target response data packet is forwarded to the user end.

8. A data security access device, characterized in that: include: An acquisition module, used to acquire an access request sent by any user terminal to the cloud data center based on the load balancing service; A mapping module, used to map the access request to a preset policy engine through a traffic mirroring module between the load balancing service and the preset policy engine; An authentication module, configured to determine a target response strategy for the access request based on the preset policy engine and the security authentication information represented by the access request; A response module is used to respond to the access request according to the target response strategy.

9. An electronic device, characterized in that: include: at least one processor and memory; The memory stores computer-executable instructions; The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when a processor executes the computer-executable instructions, the method according to any one of claims 1 to 7 is implemented.

Images