Gateway management method and system

Abstract

The invention provides a gateway management method and system, and when the method is applied to a server, the method comprises the steps: obtaining the feature information of a data access request in response to the data access request sent by a client; determining attribute information of the data access request based on the feature information of the data access request; and returning a data access response to the client based on the attribute information of the data access request.

Description

Technical Field

[0001] The present application relates to the field of computer network technology, and in particular to a gateway management method and system. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the application that are recited in the claims. The description herein is not admitted to be prior art by inclusion in this section.

[0003] With the widespread adoption of technologies such as cloud computing, big data, and mobile office, the boundaries of the network are gradually blurring, and data concentration and integration have brought new challenges to data security protection. Existing zero-trust gateway management solutions have the following technical problems: On the one hand, most of the existing zero-trust gateway management solutions are based on traditional software integration solutions, so there are technical problems such as high deployment, operation and maintenance, and compatibility costs; on the other hand, the security components designed by the existing zero-trust gateway management solutions have low integration and the standards between systems are not unified, which will lead to a high system failure rate; on the other hand, the existing zero-trust gateway management solutions are difficult to update and iterate, and have low security.

[0004] In view of this, the present application urgently needs to propose a gateway management method and system that effectively solves the above technical problems. Summary of the invention

[0005] Multiple aspects of the present application provide a gateway management method and system to solve the technical problems of high gateway management cost, poor stability and low safety factor existing in the prior art.

[0006] In one aspect of the present application, a gateway management method is provided, the method being applied to a server, the method comprising:

[0007] In response to a data access request sent by a client, acquiring characteristic information of the data access request;

[0008] Determining attribute information of the data access request based on the characteristic information of the data access request;

[0009] Based on the attribute information of the data access request, a data access response is returned to the client.

[0010] Furthermore, the characteristic information of the data access request includes client IP, client request protocol, client uniform resource locator, client access host, client UA and client cookie.

[0011] Further, based on the characteristic information of the data access request, determining the attribute information of the data access request includes: based on the characteristic information of the data access request, identifying whether the client has data access rights.

[0012] Furthermore, based on the attribute information of the data access request, returning a data access response to the client includes: if the client has data access rights, obtaining the data to be accessed included in the data access request; processing the data to be accessed according to preset data processing rules to generate compliant data; generating a data access response based on the compliant data and returning it to the client.

[0013] Furthermore, based on the attribute information of the data access request, returning a data access response to the client includes: generating an authentication prompt if the client does not have data access rights; and generating a data access response based on the authentication prompt and returning it to the client.

[0014] Furthermore, the data to be accessed is processed according to preset data processing rules to generate compliant data, including: identifying sensitive information of the data to be accessed, desensitizing the sensitive information, and generating first data; identifying the data format of the data to be accessed, and if the data format is HTML format, adding a watermark to the data to be accessed to generate second data; generating compliant data based on the first data and the second data.

[0015] Furthermore, after responding to the data access request sent by the client, the method further includes: generating a log file based on the data access request; and acquiring characteristic information of the data access request based on the log file.

[0016] In another aspect of the present application, a gateway management method is provided, the method being applied to a client, the method comprising:

[0017] Send data access request to the server;

[0018] A data access response returned by the server is received, where the data access response includes compliance data or an authentication prompt.

[0019] In another aspect of the present application, a gateway management system is provided, the system is applied to a server, and the system includes:

[0020] A response unit, configured to respond to a data access request sent by a client and obtain characteristic information of the data access request;

[0021] a determining unit, configured to determine attribute information of the data access request based on the characteristic information of the data access request;

[0022] A returning unit is used to return a data access response to the client based on the attribute information of the data access request.

[0023] In another aspect of the present application, a gateway management system is provided, the system is applied to a client, and the system includes:

[0024] A sending unit, used for sending a data access request to a server;

[0025] The receiving unit is used to receive a data access response returned by the server, wherein the data access response includes compliance data or an authentication prompt.

[0026] The present application proposes a gateway management method and system, the method is applied to a server, the method includes: in response to a data access request sent by a client, obtaining characteristic information of the data access request; based on the characteristic information of the data access request, determining the attribute information of the data access request; based on the attribute information of the data access request, returning a data access response to the client. The gateway management method provided by the present application builds a multi-level three-dimensional security protection system through a variety of security mechanisms and technical means such as authentication, certification, watermarking and data auditing, ensures the security of the network and data, and makes the server's gateway have a higher resistance capability;

[0027] Furthermore, the gateway management method provided by the present application also proposes a technical solution for identifying sensitive information of the data to be accessed, desensitizing the sensitive information, and generating first data; identifying the data format of the data to be accessed, and if the data format is HTML format, adding a watermark to the data to be accessed to generate second data; and generating compliant data based on the first data and the second data. The present application improves the security of the system by accurately identifying the backend data type and adding a watermark to the backend HTML format;

[0028] In summary, the solution is effectively integrated with various security mechanisms through the basic image and plug-in system, and dynamically expanded to achieve more complete and diversified security measures, improve the security of the system, and ensure that data will not be leaked. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0030] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0031] Figure 1A schematic diagram of a flow chart of a gateway management method provided in an embodiment of the present application;

[0032] Figure 2 A schematic diagram of a flow chart of a gateway management method provided in another embodiment of the present application;

[0033] Figure 3 A schematic diagram of a flow chart of a gateway management method provided in another embodiment of the present application;

[0034] Figure 4 A schematic diagram of the structure of a gateway management system provided in yet another embodiment of the present application;

[0035] Figure 5 A schematic diagram of the structure of a gateway management system provided in yet another embodiment of the present application;

[0036] Figure 6 It is a schematic diagram of the structure of an electronic device suitable for implementing the solution in the embodiment of the present application;

[0037] The same or similar reference numerals in the drawings represent the same or similar components. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0039] In a typical configuration of the present application, the terminal and the equipment of the service network each include one or more processors (CPU), input / output interface, network interface and memory.

[0040] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0041] Computer readable media include permanent and non-permanent, removable and non-removable media, and can be implemented by any method or technology to store information. Information can be computer program instructions, data structures, modules of programs or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0042] The embodiment of the present application provides a gateway management method, which is applied to a server and includes:

[0043] In response to a data access request sent by a client, acquiring characteristic information of the data access request;

[0044] Determining attribute information of the data access request based on the characteristic information of the data access request;

[0045] Based on the attribute information of the data access request, a data access response is returned to the client.

[0046] In actual scenarios, the execution subject of the method can be a user device, or a device formed by integrating a user device and a network device through a network, or an application running on the above device. The user device includes but is not limited to various terminal devices such as computers, mobile phones, tablet computers, smart watches, and bracelets. The network device includes but is not limited to network hosts, single network servers, multiple network server sets, or cloud computing-based computer sets, which can be used to implement some processing functions when setting an alarm. Here, the cloud is composed of a large number of hosts or network servers based on cloud computing, where cloud computing is a type of distributed computing, a virtual computer composed of a group of loosely coupled computer sets.

[0047] Embodiment 1

[0048] Figure 1 The processing flow of a gateway management method provided in an embodiment of the present application is shown. The method is applied to a server and includes at least the following processing steps:

[0049] Step S101: In response to a data access request sent by a client, obtain characteristic information of the data access request;

[0050] Step S102: determining attribute information of the data access request based on the characteristic information of the data access request;

[0051] Step S103: Return a data access response to the client based on the attribute information of the data access request.

[0052] The gateway management method proposed in this embodiment verifies the identity information of the client by requesting a password from the client and performing multi-factor authentication, thereby ensuring that the client is legitimate and authorized.

[0053] In one implementation manner, the characteristic information of the data access request includes client IP, client request protocol, client uniform resource locator, client access host, client UA and client cookie.

[0054] Specifically, this solution ensures the accuracy of data audit results by obtaining characteristic information of various data access requests.

[0055] In one embodiment, determining the attribute information of the data access request based on the characteristic information of the data access request includes: identifying whether the client has data access rights based on the characteristic information of the data access request.

[0056] In one embodiment, based on the attribute information of the data access request, returning a data access response to the client includes: if the client has data access rights, obtaining the data to be accessed included in the data access request; processing the data to be accessed according to preset data processing rules to generate compliant data; generating a data access response based on the compliant data and returning it to the client.

[0057] like Figure 2 As shown, specifically, when the client sends a data access request to the server through the zero-trust gateway, the data access request sent by the client will first be authenticated by the authentication component. When the client has a data access request and it is identified that the data or service the client wants to access is at a protected level, the zero-trust gateway will report the client to the authentication component in the form of a log. The authentication component will generate an authentication result based on the preset data processing rules, and input the authentication structure into the authentication management platform of the server. After an alarm is issued according to the early warning mechanism of the authentication management platform, the data or server at the above-mentioned protected level will be processed according to the preset data processing rules, and compliant data will be generated and returned to the client.

[0058] In one embodiment, based on the attribute information of the data access request, returning a data access response to the client includes: generating an authentication prompt if the client does not have data access rights; generating a data access response based on the authentication prompt and returning it to the client.

[0059] In one of the embodiments, the method further includes: responding to an authentication request sent by the client; and returning an authentication response to the client based on the authentication request.

[0060] In one embodiment, the data to be accessed is processed according to preset data processing rules to generate compliant data, including: identifying sensitive information of the data to be accessed, desensitizing the sensitive information, and generating first data; identifying the data format of the data to be accessed, and if the data format is HTML format, adding a watermark to the data to be accessed to generate second data; generating compliant data based on the first data and the second data.

[0061] Specifically, when the authentication component recognizes that the data or service that the client wants to access is a protected data platform on the intranet, the MIME sniffing algorithm is used to determine whether the data the client is accessing is a web page. If it is a web page, that is, data in HTML format, the zero-trust gateway will add a watermark to the returned web page data to ensure that sensitive data is not leaked. By adding a watermark to the data during transmission and using the MIME sniffing algorithm before adding the watermark to ensure full coverage of the web page, ensure the traceability of the data, prevent data leakage and theft, and make data leakage prevention more comprehensive and convenient.

[0062] It should be understood that if the data to be accessed is data in HTML format containing sensitive information, the data format of the compliant data is that the sensitive information has been desensitized and is displayed with a watermark.

[0063] In one of the implementation modes, after responding to a data access request sent by a client, the method further includes: generating a log file based on the data access request; and acquiring characteristic information of the data access request based on the log file.

[0064] The gateway management method proposed in this real-time example can audit and record the data accessed by the client, accurately to the interface dimension accessed by the client, and based on the audit results, record and summarize them to the authentication management platform. When the client accesses sensitive information and triggers the alarm rules, a real-time alarm is issued.

[0065] The gateway management method described in this embodiment is based on a containerized integration method, which simplifies the service deployment cost of the gateway management method, improves the efficiency of operation and maintenance, and improves device compatibility. With the cloud native architecture as the technical foundation, it provides a unified standard for dynamic expansion and contraction and continuous iteration, effectively improves the availability of gateway management services, and has higher update and iteration efficiency.

[0066] Embodiment 2

[0067] Figure 3 The processing flow of a gateway management method provided in an embodiment of the present application is shown. The method is applied to a client and includes at least the following processing steps:

[0068] Step S301, sending a data access request to a server;

[0069] Step S302: Receive a data access response returned by the server, where the data access response includes compliance data or an authentication prompt.

[0070] In one embodiment, the method described in the present application further includes: sending an authentication request to the server in response to an authentication prompt returned by the server; and receiving an authentication response returned by the server.

[0071] Embodiment 3

[0072] Figure 4 A gateway management system provided in an embodiment of the present application is shown, the system is applied to a server, and the system includes:

[0073] A response unit, configured to respond to a data access request sent by a client and obtain characteristic information of the data access request;

[0074] a determining unit, configured to determine attribute information of the data access request based on the characteristic information of the data access request;

[0075] A returning unit is used to return a data access response to the client based on the attribute information of the data access request.

[0076] Embodiment 4

[0077] like Figure 5 As shown, another aspect of the present application provides a gateway management system, the system is applied to a client, and the system includes:

[0078] A sending unit, used for sending a data access request to a server;

[0079] The receiving unit is used to receive a data access response returned by the server, wherein the data access response includes compliance data or an authentication prompt.

[0080] Embodiment 5

[0081] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present application, and the method corresponding to the electronic device may be the gateway management method in the aforementioned embodiment, and its principle of solving the problem is similar to that of the method. The electronic device provided in an embodiment of the present application includes: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the methods and / or technical solutions of the aforementioned multiple embodiments of the present application.

[0082] The electronic device may be a user device, or a device formed by integrating a user device and a network device through a network, or may be an application running on the above device. The user device includes but is not limited to various terminal devices such as computers, mobile phones, tablet computers, smart watches, and bracelets. The network device includes but is not limited to network hosts, single network servers, multiple network server sets, or cloud computing-based computer sets, which can be used to implement some processing functions when setting an alarm. Here, the cloud is composed of a large number of hosts or network servers based on cloud computing, where cloud computing is a type of distributed computing, a virtual computer composed of a group of loosely coupled computer sets.

[0083] Figure 6 The structure of an electronic device suitable for implementing the method and / or technical solution in the embodiment of the present application is shown, and the device 600 includes a central processing unit (CPU, Central Processing Unit) 601, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM, Read Only Memory) 602 or the program loaded from the storage part 608 to the random access memory (RAM, Random Access Memory) 603. In RAM603, various programs and data required for system operation are also stored. CPU 601, ROM 602 and RAM 603 are connected to each other through bus 604. Input / output (I / O, Input / Output) interface 605 is also connected to bus 604.

[0084] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, a touch screen, a microphone, an infrared sensor, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), an LED display, an OLED display, etc., and a speaker, etc.; a storage section 608 including one or more computer-readable media such as a hard disk, an optical disk, a magnetic disk, a semiconductor memory, etc.; and a communication section 609 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet.

[0085] In particular, the methods and / or embodiments in the embodiments of the present application may be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program code for executing the method shown in the flowchart. When the computer program is executed by the central processing unit (CPU) 601, the above functions defined in the method of the present application are executed.

[0086] Embodiment 6

[0087] Another embodiment of the present application further provides a computer-readable storage medium having computer program instructions stored thereon, wherein the computer program instructions can be executed by a processor to implement the methods and / or technical solutions of any one or more embodiments of the present application described above.

[0088] Specifically, the present embodiment can adopt any combination of one or more computer-readable media. Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this document, computer-readable storage media can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0089] Computer readable signal media may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer readable program code. Such propagated data signals may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than a computer readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device.

[0090] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0091] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0092] The flow chart or block diagram in the accompanying drawings shows the possible architecture, function and operation of the equipment, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated system for hardware that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0093] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0094] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or page components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0095] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0096] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0097] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0098] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

[0099] In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in a device claim can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

Claims

1. A gateway management method, characterized in that: The method is applied to a server, and the method comprises: In response to a data access request sent by a client, acquiring characteristic information of the data access request; Determining attribute information of the data access request based on the characteristic information of the data access request; Based on the attribute information of the data access request, a data access response is returned to the client.

2. The gateway management method according to claim 1, characterized in that: The characteristic information of the data access request includes the client IP, client request protocol, client uniform resource locator, client access host, client UA and client cookie.

3. The gateway management method according to claim 1, characterized in that: Determining the attribute information of the data access request based on the characteristic information of the data access request includes: Based on the characteristic information of the data access request, it is identified whether the client has data access rights.

4. The gateway management method according to claim 3, characterized in that: Based on the attribute information of the data access request, returning a data access response to the client includes: If the client has data access rights, obtaining the data to be accessed included in the data access request; Process the data to be accessed according to preset data processing rules to generate compliant data; A data access response is generated based on the compliance data and returned to the client.

5. The gateway management method according to claim 3, characterized in that: Based on the attribute information of the data access request, returning a data access response to the client includes: If the client does not have data access rights, generating an authentication prompt; A data access response is generated based on the authentication prompt and returned to the client.

6. The gateway management method according to claim 4, characterized in that: Processing the data to be accessed according to preset data processing rules to generate compliant data includes: Identifying sensitive information of the data to be accessed, desensitizing the sensitive information, and generating first data; Identify the data format of the data to be accessed, and if the data format is HTML format, add a watermark to the data to be accessed to generate second data; Compliance data is generated based on the first data and the second data.

7. The gateway management method according to claim 6, characterized in that: After responding to the data access request sent by the client, the method further includes: generating a log file based on the data access request; Based on the log file, characteristic information of the data access request is obtained.

8. A gateway management method, characterized in that: The method is applied to a client, and the method comprises: Send data access request to the server; A data access response returned by the server is received, where the data access response includes compliance data or an authentication prompt.

9. A gateway management system, characterized in that: The system is applied to a server, and the system comprises: A response unit, configured to respond to a data access request sent by a client and obtain characteristic information of the data access request; a determining unit, configured to determine attribute information of the data access request based on the characteristic information of the data access request; A returning unit is used to return a data access response to the client based on the attribute information of the data access request.

10. A gateway management system, characterized in that: The system is applied to a client, and the system includes: A sending unit, used for sending a data access request to a server; The receiving unit is used to receive a data access response returned by the server, wherein the data access response includes compliance data or an authentication prompt.

Images