Bastion host file access control method and device, computer equipment, medium and product

Abstract

The invention relates to a bastion host file access control method and device, computer equipment, a medium and a product. Comprising the following steps: matching an access control rule conforming to an access security standard for a current file access operation according to attribute feature information carried by the current file access operation received by a bastion host; determining a file access permission of the current file access operation under the access control rule according to behavior feature information carried by the current file access operation; and performing access control on the current file access operation according to the file access permission. By adopting the method, the limitation of fortress machine file access control is reduced.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a bastion server file access control method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] With the continuous development of science and technology, file management and access control within enterprises have also ushered in unprecedented challenges, which has also made the application of bastion hosts more and more extensive. Among them, the bastion host, as a permission management and audit system based on cloud computing and network security technology, provides safe and reliable remote access and management methods by centrally managing and controlling user access rights, and has become one of the indispensable security components of the enterprise.

[0003] Currently, in the process of bastion host file access control, file access operations are usually evaluated through a set blacklist or whitelist mechanism to ensure that the file access operations meet security standards. However, since the content in the blacklist or whitelist is relatively fixed, the file access control mechanism cannot match the evaluation requirements for operational security in complex scenarios, which makes access control errors prone to occur. Therefore, the current bastion host file access control has high limitations. Summary of the invention

[0004] Based on this, it is necessary to provide a bastion host file access control method, device, computer equipment, computer-readable storage medium and computer program product that reduce the limitations of bastion host file access control in response to the above technical problems.

[0005] In a first aspect, the present application provides a bastion host file access control method, comprising:

[0006] According to the attribute feature information carried by the current file access operation received by the bastion host, an access control rule that meets the access security standard is matched for the current file access operation;

[0007] Determining the file access permission of the current file access operation under the access control rule according to the behavior characteristic information carried by the current file access operation;

[0008] Access control is performed on the current file access operation according to the file access permission.

[0009] In one embodiment, the attribute characteristic information includes operation timeliness information; and matching the access control rule that meets the access security standard for the current file access operation according to the attribute characteristic information carried by the current file access operation received by the bastion host includes:

[0010] Build preset access control rules that meet security access standards for each historical file access operation;

[0011] Screening a plurality of preset access control rules to obtain a plurality of candidate access control rules that are within a valid period of time identified by the operation time limit information;

[0012] The access control rule is extracted from the plurality of candidate access control rules.

[0013] In one of the embodiments, extracting the access control rule from the multiple candidate access control rules includes:

[0014] Prioritizing the plurality of candidate access control rules according to the operational risk information of each of the historical file access operations to obtain a priority ranking result;

[0015] The access control rule is extracted from the plurality of candidate access control rules according to the priority sorting result.

[0016] In one embodiment, the behavior characteristic information includes behavior location information, behavior object information, and behavior type information; and determining the file access permission of the current file access operation under the access control rule according to the behavior characteristic information carried by the current file access operation includes:

[0017] According to the behavior location information, the behavior object information and the behavior type information, the behavior authority of the current file access operation in the access control rule is detected in sequence;

[0018] According to the plurality of behavior permissions, a file access permission for the current file access operation under the access control rule is generated.

[0019] In one embodiment, the access control rule includes a plurality of access control lists; and generating the file access rights of the current file access operation under the access control rule according to the plurality of behavior permissions includes:

[0020] Selecting step: selecting a target access control list from the multiple access control lists;

[0021] According to the multiple behavior permissions, detecting a behavior permission matching result of the current file access operation under the target access control list;

[0022] Return to execute the selection step until all access control lists are selected as the target access control lists, and obtain the file access results corresponding to the multiple behavior permission matching results;

[0023] The file access permission is generated according to the result type of the file access result.

[0024] In one embodiment, performing access control on the current file access operation according to the file access permission includes:

[0025] In a case where the file access permission is that the current file access operation has the access permission, detecting a behavior abnormality value of the current file access operation;

[0026] If the behavior abnormality value is greater than the preset behavior reference value, access control is performed on the current file access operation according to the behavior verification result of the current file access operation;

[0027] If the behavior abnormality value is less than or equal to the preset behavior reference value, the current file access operation is allowed to be executed.

[0028] In a second aspect, the present application also provides a bastion host file access control method device, including:

[0029] A matching module, used to match the access control rules that meet the access security standards for the current file access operation according to the attribute feature information carried by the current file access operation received by the bastion host;

[0030] A determination module, configured to determine the file access permission of the current file access operation under the access control rule according to the behavior characteristic information carried by the current file access operation;

[0031] The access control module performs access control on the current file access operation according to the file access permission.

[0032] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0033] According to the attribute characteristic information carried by the current file access operation received by the bastion host, the access control rules that meet the access security standards are matched for the current file access operation; according to the behavioral characteristic information carried by the current file access operation, the file access rights of the current file access operation under the access control rules are determined; according to the file access rights, access control is performed on the current file access operation.

[0034] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0035] According to the attribute characteristic information carried by the current file access operation received by the bastion host, the access control rules that meet the access security standards are matched for the current file access operation; according to the behavioral characteristic information carried by the current file access operation, the file access rights of the current file access operation under the access control rules are determined; according to the file access rights, access control is performed on the current file access operation.

[0036] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0037] According to the attribute characteristic information carried by the current file access operation received by the bastion host, the access control rules that meet the access security standards are matched for the current file access operation; according to the behavioral characteristic information carried by the current file access operation, the file access rights of the current file access operation under the access control rules are determined; according to the file access rights, access control is performed on the current file access operation.

[0038] The above-mentioned bastion host file access control method, device, computer equipment, computer-readable storage medium and computer program product first match the access control rules that meet the access security standards for the current file access operation according to the attribute feature information carried by the current file access operation after the bastion host receives the current file access operation, thereby dynamically matching the access control rules that meet the access security standards through the specific attribute features of the current file access operation, and then determining the file access rights of the current file access operation under the access control rules according to the behavioral feature information carried by the current file access operation, thereby achieving the purpose of determining the specific access rights of the current file access operation to the bastion host through the behavioral features of the current file access operation, and finally performing access control on the current file access operation through the file access rights. Since the file access rights of the current file access operation are within the current The file access operation is flexibly determined under the joint action of the attribute feature information and the behavior feature information of the file access operation. Therefore, in the process of access control on the bastion host file, it is realized to rely on the multi-dimensional feature information of the current file access operation, and dynamically set the specific access rights that meet the security access standards for the current file access operation, so that the file access rights can be adapted to the evaluation requirements for operational security in complex scenarios. Finally, the access control of the current file access operation is completed based on the file access rights, rather than relying on a single-dimensional blacklist or whitelist mechanism for bastion host file access control. Therefore, the technical defect that the access control mechanism cannot match the evaluation requirements for operational security in complex scenarios due to the relatively fixed content in the blacklist or whitelist is overcome, which makes it easy to make access control errors. Therefore, the limitations of bastion host file access control are reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A flowchart of a bastion server file access control method in one embodiment;

[0041] Figure 2 A flowchart of a bastion server file access control method in another embodiment;

[0042] Figure 3 A flowchart of an isolation forest algorithm of a bastion server file access control method in another embodiment;

[0043] Figure 4 A schematic diagram of the structure of a bastion server file management system of a bastion server file access control method in one embodiment;

[0044] Figure 5 A control flow chart of bastion machine file access control of a bastion machine file access control method in another embodiment;

[0045] Figure 6 This is a structural block diagram of the bastion host file access control device;

[0046] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0048] First of all, it should be understood that with the rapid development of information technology and the deepening of digital transformation, file management and access control within enterprises are facing unprecedented challenges. On the one hand, frequent cyber attacks and data leakage incidents have brought huge risks to the information security of enterprises. On the other hand, the access needs within enterprises are becoming increasingly complex. Traditional access control mechanisms can no longer meet the high control requirements under existing complex scenarios. In the process of bastion host file access control, traditional access control mechanisms usually control file access operations through the set blacklist or whitelist mechanism. For example, the blacklist and whitelist in a single dimension are usually as follows: 1) The blacklist denies a certain file operation while allowing other file operations; 2) The whitelist allows a certain file operation while denying other file operations. However, the above access control mechanism has certain limitations in file access control. , mainly relying on a single-dimensional blacklist or whitelist mechanism, lacks fine-grained control of access behavior and risk capability assessment, and lacks in-depth analysis of user behavior patterns. Especially when dealing with complex access rules, risk assessment, and operation auditing, it is difficult to meet increasingly complex security needs. For example, it is difficult to implement the operation of deleting files in a specific file directory for file access operations under a certain IP address. At the same time, other file operations outside this IP address and this file directory, such as upload and download, will be rejected. That is, since the content in the blacklist or whitelist is relatively fixed, the file access control mechanism cannot match the assessment requirements for operational security in complex scenarios, which makes it easy for access control errors to occur. Therefore, there is an urgent need for a bastion host file access control method that reduces the limitations of bastion host file access control.

[0049] In one embodiment, Figure 1As shown, a bastion host file access control method is provided. This embodiment takes the method applied to a terminal as an example. The terminal sets a bastion host file management system. The terminal includes but is not limited to a personal computer, a laptop computer, a smart phone, and a tablet computer. The bastion host file management system includes a matching module, a determination module, and an access control module. The matching module is used to match the current file access operation with an access control rule that meets the access security standard according to the attribute feature information carried by the current file access operation received by the bastion host. The determination module is used to determine the file access rights of the current file access operation under the access control rule according to the behavior feature information carried by the current file access operation. The access control module is used to perform access control on the current file access operation according to the file access rights. The information interaction between the control modules depends on the multi-dimensional attribute characteristics of the specific current file access operation, and dynamically sets the specific access rights that meet the security access standards for the current file access operation, so that the current file access operation can be adapted to the file access rights that meet the assessment requirements for operational security in complex scenarios. The access control of the current file access operation is completed, thereby overcoming the technical defect that the access control mechanism cannot match the assessment requirements for operational security in complex scenarios due to the relatively fixed content in the blacklist or whitelist, which makes it easy for access control errors to occur. Therefore, the limitations of bastion host file access control are reduced. The method can also be applied to servers, and can also be applied to systems including terminals and servers, and is implemented through the interaction between terminals and servers. In this embodiment, the method includes the following steps 202 to 206. Among them:

[0050] Step 202, according to the attribute feature information carried by the current file access operation received by the bastion host, an access control rule that meets the access security standard is matched for the current file access operation.

[0051] It should be noted that in the process of bastion host file access control, the explanations of relevant technical terms are as follows: 1) Bastion host: It is a permission management and auditing system based on cloud computing and network security technology. It provides a secure and reliable remote access and management method by centrally managing and controlling user access rights, and can audit and record user operations; 2) User and Entity Behavior Analytics (UEBA): It is a network security technology that aims to detect abnormal activities and potential threats by analyzing the behavior patterns of users and entities. UEBA technology usually uses anomaly detection algorithms to establish behavioral baselines for users and entities and monitor their activities in real time. By identifying abnormal patterns that deviate from normal behavior, it can effectively detect abnormal events; 3) SSH File Transfer Protocol (SFTP): It is a secure file transfer protocol that runs on top of the SSH protocol, uses encryption and password hash functions to protect data integrity, authenticates servers and users, and provides secure, reliable and easy-to-configure file transfer functions; 4) File transfer protocol (SFTP) FTP (File Transfer Protocol) is a communication protocol used to transfer files between remote devices and servers on a local LAN or wide area network (WAN). It assists in transferring files from one computer to another by providing access to directories or folders on remote computers, and allows software, data or text files to be transferred between different types of computers. It is understandable that in the process of bastion host file access control, if faced with the problem of dealing with complex access rules, risk assessment and operation audit, the above-mentioned technologies or environments can be used in combination.

[0052] It should be noted that the current file access operation is used to access the bastion host, that is, to access the bastion host file management system. It can be understood that since the bastion host itself acts as an intermediary management point, accessing the bastion host file management system is essentially accessing files on other systems or servers through the bastion host. Specifically, it can be done by running scripts or command lines on the bastion host to upload files on the remote server or delete specified files, etc. For example, in one implementable method, the current file access operation is issued by device A, and the bastion host receives the current file access operation as an intermediary. If access is allowed, the current file access operation deletes the file on device B, where A and B are different devices.

[0053] It should be noted that the attribute characteristic information is used to characterize the attribute characteristics of the current file access operation, which may specifically be the operation effective time, operation expiration time, and operation risk level, etc., wherein the operation effective time refers to the specific time point when the current file access operation begins to take effect, the operation expiration time refers to the specific time point when the current file access operation ends to take effect, and the operation risk level refers to the specific risk level of the current file access operation. For example, in one implementable method, if the attribute characteristic information carries the field "1", it means that the operation risk level of the current file access operation is level 1; if the attribute characteristic information carries the field "2", it means that the operation risk level of the current file access operation is level 2; if the attribute characteristic information carries the field "3", it means that the operation risk level of the current file access operation is level 3, wherein a higher operation risk level indicates a higher risk of the file access operation.

[0054] It should be noted that the access control rules are used to characterize the permissions and conditions for file access through the bastion host. Specifically, it can be to allow a specified IP address to delete files from a specific file directory. It can be understood that if the current file access operation is subject to the restrictions of the access control rules, then the access control process of the bastion host files complies with security standards. It can be understood that the access control rules can be generated instantly or pre-set, and obtained by index query using the attribute characteristics of the current file access operation.

[0055] As an example, step 202 includes: extracting attribute feature information from the current file access operation received by the bastion host, and matching the current file access operation with access control rules that meet security standards using the attribute feature information as an index.

[0056] Step 204: determine the file access permission of the current file access operation under the access control rule according to the behavior characteristic information carried by the current file access operation.

[0057] It should be noted that the behavioral characteristic information is used to characterize the operational behavior of the current file access operation, which may be specifically the operation source address, operation path, and operation type, etc., wherein the operation source address refers to the IP address of the device that initiates the current file access operation, which may be specifically xxx.xxx.x.xx; the operation path refers to the specific address to be accessed by the current file access operation, which may be specifically / data / public / 1.txt; the operation type refers to the mode of the current file access operation, which may be specifically read, write, delete, or append, etc. It can be understood that in order to achieve fine-grained control of file operations, multiple file access permissions may be set in the access control rules, and then in the process of bastion host file access control, the specific file access permissions that are adapted to each file access operation may be flexibly determined and applied according to the specific behavioral characteristics of each file access operation, wherein the file access permission refers to the detailed permission provisions for file access through the bastion host, for example, the file access permission can be used to know which users or roles can read, write, execute, or delete files.

[0058] As an example, step 204 includes: extracting behavior feature information from the current file access operation, and using the preset file access rights that match the behavior feature information in the access control rule as the file access rights for the current file access operation.

[0059] It can be understood that multiple preset file access permissions can be set in the access control rules, wherein each preset file access permission has a behavioral baseline feature, and then by comparing the behavioral feature of the current file access operation with multiple behavioral baseline features, and when the behavioral feature and the behavioral baseline feature are consistent, the preset file access permission corresponding to the behavioral baseline feature is used as the file access permission for the current file access operation.

[0060] Step 206: perform access control on the current file access operation according to the file access permission.

[0061] It should be noted that, based on the file access permission, it can be determined whether the current file access operation is allowed to be executed.

[0062] As an example, step 206 includes: executing the current file access operation under the file access permission, or refusing to execute the current file access operation according to the file access permission.

[0063] In the above-mentioned bastion host file access control method, first, after the bastion host receives the current file access operation, the access control rules that meet the access security standards are matched for the current file access operation according to the attribute feature information carried by the current file access operation, thereby dynamically matching the access control rules that meet the access security standards through the specific attribute features of the current file access operation, and then determining the file access rights of the current file access operation under the access control rules according to the behavioral feature information carried by the current file access operation, thereby achieving the purpose of determining the specific access rights of the current file access operation to the bastion host through the behavioral features of the current file access operation, and finally performing access control on the current file access operation through the file access rights, because the file access rights of the current file access operation are based on the attribute feature information of the current file access operation. It is flexibly determined under the joint action of the behavioral feature information, so that in the process of access control on the bastion host files, it is realized that the multi-dimensional feature information relying on the current file access operation is realized, and the specific access rights that meet the security access standards are dynamically set for the current file access operation, so that the file access rights can be adapted to the evaluation requirements for operational security in complex scenarios, and finally the access control of the current file access operation is completed based on the file access rights, rather than relying on a single-dimensional blacklist or whitelist mechanism for bastion host file access control. Therefore, the technical defect that the access control mechanism cannot match the evaluation requirements for operational security in complex scenarios due to the relatively fixed content in the blacklist or whitelist is overcome, which makes it easy to make access control errors. Therefore, the limitations of bastion host file access control are reduced.

[0064] In one embodiment, Figure 2 As shown, the attribute characteristic information includes operation timeliness information; according to the attribute characteristic information carried by the current file access operation received by the bastion host, the access control rules that meet the access security standards are matched for the current file access operation, including:

[0065] Step 302: construct a preset access control rule that meets the security access standard for each historical file access operation.

[0066] It should be noted that, in order to improve the efficiency of bastion host file access control, a construction module can be deployed in the bastion host file management system, and multiple preset access control rules can be constructed through the construction module. For example, in an implementable manner, any preset access control rule can be understood as a blacklist or whitelist constructed by the construction module, wherein the blacklist can be referred to as an enhanced blacklist, and the whitelist can be referred to as an enhanced whitelist. In the process of constructing an enhanced blacklist or an enhanced whitelist, the operation characteristic information of the historical file access operation can be referred to, wherein the operation characteristic information includes operation time information and operation information, and then through the operation path, operation type, operation risk level, operation source IP, operation effective time and operation expiration time of the historical file access operation, it can be understood that the operation characteristic information of the file access operation can also be called metadata. Through the above-mentioned operation characteristic information of the historical file access operation, more detailed access control can be performed on each historical file access operation, wherein multiple historical file access operations can be statistically obtained within the same observation period. Specifically, the operation characteristic information of the historical file operation can be described as Table 1, and Table 1 is as follows:

[0067]

[0068] Among them, during the set observation period, the user's file operation behavior can be continuously monitored and recorded, which may include information such as operation time, frequency, operation type and operation source IP, so as to build multiple preset control rules that meet security access standards based on the operation feature information of different historical file access operations.

[0069] As an example, step 302 includes: obtaining multiple operation feature information of each historical file access operation, generating preset access control rules that meet access security standards for each historical file access operation based on the multiple operation feature information, and obtaining multiple preset access control rules.

[0070] Step 304 , screening multiple preset access control rules to obtain multiple candidate access control rules that are within the effective period identified by the operation time limit information.

[0071] It should be noted that the candidate access control rules are used to represent the access control rules waiting to be used as the current file access operation. It can be understood that in the process of constructing multiple preset access control rules, the operation characteristic information of historical file access operations is refined, and then the screening of multiple preset access control rules can be completed through the time consistency between the effective period of the current file access operation identified by the multiple preset access control rules and the operation expiration information.

[0072] As an example, step 304 includes: extracting the preset effective periods corresponding to each of the multiple preset access control rules, selecting an access effective period from the multiple preset effective periods according to the effective period identified by the operation failure information, and taking the preset access control rule to which the access effective period belongs as a candidate access control rule.

[0073] Step 306: extract access control rules from multiple candidate access control rules.

[0074] It should be noted that, based on the access control accuracy of the bastion host file management system on the current file access operation, any candidate access control rule from multiple candidate access control rules can be extracted as the access control rule, wherein the candidate access control rules include allow access control rules and prohibit access control rules, the allow access control rules correspond to the white list, and the prohibit access control rules correspond to the black list. For example, in an implementable method, an allow access control rule and a prohibit access control rule can be randomly selected from multiple candidate access control rules as the access control rules.

[0075] As an example, step 306 includes: randomly selecting an allow access control rule and a prohibit access control rule from a plurality of candidate access control rules as the access control rules.

[0076] In an implementable manner, assume that the enhanced black and white lists constructed include: 1) Blacklist 1: (1) Deny logging into the bastion host file management system from IP address xxx.xxx.1.100 or xxx.xxx.1.1-xxx.xxx.1.20 or xx.0.0.0 / xx, and perform upload and delete operations to the path / data / secure or / file / *.txt between June 1, 2024 and June 9, 2024. The risk level of this operation is 5, where its operation feature information is as follows: 1. Type: blacklist; 2. File operation path: / data / secure, / file / *.txt; 3. File operation type: upload, delete; 4. Operation risk level: 5; 5. Operation source IP: 192.168.1.100, xxx.xxx.1.1-xxx.xxx.1.20, xx.0.0.0 / xx; 6. Effective time: 2024-06-01 00:00:00; 7. Expiration time: 2024-06-09 23:59:59; 2) Whitelist 1: (2) Allow IP addresses xxx.xxx.1.30-xxx.xxx.1.50 to log in to the bastion host file management system and perform upload, download and delete operations on the path / data / public between June 10, 2024 and June 30, 2024. The risk level of this operation is 4. The operation feature information is as follows: 1. Type: whitelist; 2. File operation path: / data / public; 3. File operation type: upload, download, delete; 4. Operation risk level: 4; 5. Operation source IP: xxx.xxx.1.30-xxx.xxx.1.50; 6. Effective time: 2024-06-10 00:00:00; 7. Expiration time: 2024-06-30 23:59:59; 3) Blacklist 2, (2) Allow IP addresses xxx.xxx.1.30-xxx.xxx.1.50 to log in to the bastion host file management system and perform upload, download, and delete operations on the path / data / public between June 10, 2024 and June 30, 2024. The risk level of this operation is 4.The construction is as follows: 1. Type: whitelist; 2. File operation path: / data / public; 3. File operation type: upload, download, delete; 4. Operation risk level: 4; 5. Operation source IP: xxx.xxx.1.30-xxx.xxx.1.50; 6. Effective time: 2024-06-10 00:00:00; 7. Expiration time: 2024-06-30 23:59:59; The screening results of the enhanced black and white lists can be shown as the following parallel examples: 1) Assuming that the effective period of the operation time limit information identification is between 2024-06-01 00:00:00 and 2024-06-09 23:59:59, since whitelist 1 has not reached the effective time, whitelist 1 is not used as an access control rule; 2) Assuming that the effective period of the operation time limit information identification is between 2024-06-10 During the period from 00:00:00 to 2024-06-19 23:59:59, since blacklist 1 has reached its expiration time, blacklist 1 is not used as an access control rule, and since whitelist 2 has reached its effective time, whitelist 1 is used as an access control rule; 3) Assuming that the effective period of the operation time information identifier is between 2024-06-20 00:00:00 and 2024-06-30 23:59:59, since blacklist 2 has reached its expiration time, blacklist 2 is not used as an access control rule.

[0077] In this embodiment, in the process of matching access control rules for the current file access operation, multiple preset access control rules that meet the security access standards are first constructed based on the construction module, and then the multiple preset access control rules are screened according to the effective period identified by the operation failure information. Finally, the access control rules are flexibly extracted from the multiple preset access control rules based on the access control requirement level, so that the current file access operation can be matched with access control rules that meet the security access standards with a more refined access control level. Therefore, while reducing the control limitations of the bastion host file access control, it lays a foundation for improving the control accuracy of the bastion host file access control.

[0078] In one embodiment, extracting an access control rule from a plurality of candidate access control rules includes:

[0079] According to the operational risk information of each historical file access operation, multiple candidate access control rules are prioritized to obtain a priority ranking result; and according to the priority ranking result, access control rules are extracted from the multiple candidate access control rules.

[0080] It should be noted that, since different candidate access control rules provide different access rights, multiple candidate access control rules can be sorted to avoid access control conflicts. For example, in one feasible method, during the sorting process, the sorting module of the bastion host file management system extracts the operational risk information of the black and white lists, thereby determining the operational risk level of each historical file access operation, and placing the black and white lists with higher risk levels in front; it is understandable that if the same operational risk level occurs, the system will give priority to the white list to reduce the processing volume; at the same time, the sorting module will dynamically manage the effective black and white lists according to the effective time and expiration time of the historical file access operation, remove the expired black and white lists, and add the effective black and white lists to ensure that only the black and white lists within the validity period will take effect, that is, the preset access control rules have been screened by the operational time information to obtain the access control rules within the validity period; the final sorting module will output the effective black and white lists sorted from high to low according to the risk level, so that the bastion host file management system can extract one or more black and white lists that are finally input into the decision module of the bastion host file management system according to the effective black and white lists sorted from high to low.

[0081] As an example, according to the operational risk level corresponding to the operational risk information of each historical file access operation, multiple candidate access control rules are sorted once to obtain a primary sorting result. If it is detected that the first target access control rule and the second target access control rule with the same risk level exist in the primary sorting result, then according to the rule identifiers corresponding to the first target access control rule and the second target access control rule respectively, the first target access control rule and the second target access control rule are sorted secondary in the primary sorting result to obtain a secondary sorting result, and the secondary sorting result is used as a priority sorting result of multiple candidate access control rules. If it is detected that the first target access control rule and the second target access control rule with the same risk level do not exist in the primary sorting result, then the primary sorting result is used as a priority sorting result, wherein the first target access control rule and the second target access control rule are different candidate access control rules.

[0082] In this embodiment, in the process of extracting access control rules from candidate access control rules, firstly, multiple candidate access control rules are prioritized depending on the operational risk information of each historical file access operation to obtain the priority sorting result, and finally, according to the priority sorting result, access control rules are finally extracted from multiple candidate access control rules, thereby giving different priorities to multiple candidate access control rules. Therefore, when matching access control rules, it can be based on the priority of the rules, thereby avoiding decision conflicts when using the access control rules to make subsequent access control decisions. Therefore, it further lays the foundation for improving the control accuracy of bastion host file access control.

[0083] In one embodiment, the behavior characteristic information includes behavior location information, behavior object information, and behavior type information; determining the file access rights of the current file access operation under the access control rule according to the behavior characteristic information carried by the current file access operation includes:

[0084] According to the behavior location information, behavior object information and behavior type information, the behavior permissions of the current file access operation in the access control rule are detected in sequence; according to multiple behavior permissions, the file access permissions of the current file access operation under the access control rule are generated.

[0085] It should be noted that in the process of determining the file access rights of the current file access operation, in order to improve the precision of access control, multi-level behavior feature information can be set to determine the behavior rights of the current file access operation. For example, in an implementable manner, the behavior location information can be the operation path, the behavior object information can be the operation source IP address, and the behavior type information can be the operation type. Then, the workflow of the decision module of the bastion host file management system can be as follows: The decision module first defaults to the multiple access control rules (all valid blacklists and whitelists) that are all within the valid period identified by the current file access operation, and then determines whether the file operation from the source IP is allowed according to the sourceIps in the blacklist and whitelist. Then, the path of the file operation is matched according to the paths in the blacklist and whitelist to determine whether the file operation under the path is allowed, and then the type of the file operation is matched according to the operations in the blacklist and whitelist to determine whether the file operation of this type is allowed; it can be understood that the blacklist denies the operation and the whitelist allows the operation.

[0086] As an example, based on the behavior location information, the first behavior permission of the current file access operation under the access control rule is detected, based on the behavior object information, the second behavior permission of the current file access operation under the access control rule is detected, and based on the behavior type information, the third behavior permission of the current file access operation under the access control rule is detected; by integrating the first behavior permission, the second behavior permission and the third behavior permission, the file access permission of the current file access operation under the access control rule is obtained.

[0087] In this embodiment, through behavioral feature information of multiple different dimensions, multi-level detection is performed on the behavioral permissions of the current file access operation under the access control rules, and relying on multiple different behavioral permissions that comply with the access control rules, the file access permissions of the current file access operation under the access control rules are completed, thereby ensuring that the current file access operation still complies with the security access standards in a more refined security assessment dimension. Therefore, it lays a foundation for simultaneously improving the control security of the bastion host file access control and reducing the control limitations of the bastion host file access control.

[0088] In one embodiment, the access control rules include multiple access control lists; generating file access permissions for the current file access operation under the access control rules according to the multiple behavior permissions includes:

[0089] Selection step: select a target access control list from multiple access control lists; detect the behavior permission matching result of the current file access operation under the target access control list based on multiple behavior permissions; return to execute the selection step until all access control lists are selected as target access control lists, and obtain the file access result corresponding to the multiple behavior permission matching results; generate file access permissions based on the result type of the file access result.

[0090] It should be noted that, when the access control rules include multiple access control lists, multi-dimensional behavioral permission detection under the same access control rule is used to generate the file access permission of the current file access operation under the access control rule. It is inevitable that permission decision conflicts will occur. Among them, the permissions or conditions of the multiple access control lists are different. The multiple access control lists can specifically be multiple blacklists, multiple whitelists, or multiple lists composed of blacklists and whitelists. It can be understood that for the sake of processing efficiency, in the event of a permission decision conflict, the multiple access control lists can be sorted based on the priority and list type. For example, if multiple black and white lists have different decision results for the same file operation, the permission decision made by the whitelist and the rejection decision made by the blacklist will be adopted first. If other decision results (such as the rejection decision made by the whitelist and the permission decision made by the blacklist) conflict, the decision result ranked first will be adopted first to resolve the conflict.

[0091] As an example, the selection steps are as follows: selecting a target access control list from multiple access control lists; detecting the behavioral permission matching result of the current file access operation under the target access control list based on multiple behavioral permissions; returning to execute the selection steps until all access control lists are selected as the target access control lists, and obtaining the file access result corresponding to the multiple behavioral permission matching results; generating file access permissions based on the result type of the file access result.

[0092] In one implementable method, if the result type of the file access result is: an allow decision made by a whitelist or a deny decision made by a blacklist, the file access result is generated directly; if the file access result is not of the above result type, the file access result is generated after confirming that all access control lists are selected as target access control lists.

[0093] In this embodiment, for complex access control scenarios with multiple access control lists, this embodiment selects any access control list from multiple access control lists as the target access control list in turn, and uses multiple behavioral permissions to detect the behavioral permission matching results of the current file access operation under the target access control list. Finally, after obtaining the file access results corresponding to the multiple behavioral permission matching results, the file access permissions are generated according to the result type of the file access results, thereby realizing the comprehensive determination of the file access permissions of the current file access operation under the access control rules based on the first dimension of multiple access control rules and the second dimension of different behavioral permissions of the same access control rule. Therefore, the limitations of the bastion host file access control are further reduced and the control security of the bastion host file access control is improved.

[0094] In one embodiment, access control is performed on the current file access operation according to the file access permission, including:

[0095] When the file access permission is that the current file access operation has the access permission, the behavior abnormality value of the current file access operation is detected; if the behavior abnormality value is greater than the preset behavior reference value, access control is performed on the current file access operation according to the behavior verification result of the current file access operation; if the behavior abnormality value is less than or equal to the preset behavior reference value, the current file access operation is allowed to be executed:

[0096] It should be noted that, combined with entity behavior analysis technology, the bastion host can also establish a behavioral baseline through in-depth analysis of daily user and device behavior, and when the system detects abnormal behavior that deviates from the baseline, it can automatically adjust access rights or trigger an alarm, thereby providing higher security and flexibility. This technology can not only identify threats not covered by conventional rules, but also improve the sensitivity and response speed of the system through anomaly detection mechanisms to better protect the information security of the enterprise. Among them, behavioral anomaly detection for file access operations can be implemented based on anomaly detection algorithms. For example, in one feasible method, the user's file operation behavior can be continuously monitored and recorded during a set observation period, including information such as operation time, frequency, operation type, and operation source IP. During the set observation period, an initial baseline of user behavior is established through the isolation forest algorithm, and the baseline is continuously improved after the observation period. This baseline is used to evaluate the behavioral anomaly values ​​of current file access operations. Among them, the workflow diagram of the isolation forest algorithm can be shown as follows: Figure 3As shown in the figure: 1) Randomly select a subset from the dataset; 2) Build a forest: 1. Randomly select a feature, 2. Randomly select a split point between the minimum and maximum values ​​of the feature, 3. Divide the data into two parts based on the selected split point, 4. Recursively repeat this process for each part until the stopping condition is met.

[0097] It should be noted that the decision process of the decision module has been demonstrated in the above example, and this embodiment will not be repeated here. On the other hand, when the decision module decides that the blacklist and whitelist allow the operation, it will also start anomaly detection and calculate the anomaly score for the allowed operation. For example, in one feasible method, the average path length h(x) of the current file access operation in the isolation forest is first calculated, and the following formula is used:

[0098]

[0099] in, is the behavior anomaly value, c(n) is the normalization constant, E(h(x)) is the average path length, and then after calculating the behavior anomaly value of the current file access operation, the final access control result for the current file access operation is obtained according to the size relationship between the behavior anomaly value and the preset behavior baseline value. For example, assuming the preset behavior baseline value is 0.9, if the behavior anomaly value is 0.8, the current file access operation is allowed to be executed, and if the behavior anomaly value is 1, the current file access operation is denied.

[0100] As an example, when the file access permission is that the current file access operation has access permission, the average path length of the current file access operation in the isolated forest is detected, and the behavioral anomaly value of the current file access operation is detected based on the average path length; if the behavioral anomaly value is greater than a preset behavioral baseline value, the current file access operation is behaviorally verified to obtain a behavioral verification result, and access control of the current file access operation is performed based on the behavioral verification result, wherein the specific method of performing behavioral verification on the current file access operation can be a method of requiring the user to perform a secondary verification by entering a text message verification code; if the behavioral anomaly value is less than or equal to the preset behavioral baseline value, the current access operation is allowed to be executed.

[0101] In one feasible manner, the bastion host file management system can also deploy an audit module to implement an audit of the access control process of file access operations. For example, the record result of the audit module can be: allowing the user at 2024-06-15 14:00:00 from the IP address xxx.xxx.1.35 to submit a request to delete the / data / public / 1.txt file. The operation is risk level 4, executed, no abnormal detection record, and the execution result is successful. Through the deployment of the audit module, audit information can be recorded, which may include metadata, abnormal detection results, decision results, operation results, and operation risk levels. Through the audit module, each file operation can be recorded and analyzed in detail, which is convenient for subsequent tracing and security auditing.

[0102] In this embodiment, UEBA technology is used based on anomaly detection algorithms to continuously learn and analyze normal behavior patterns of file access operations, and establish a dynamic behavior baseline, so that preset behavior benchmark values ​​are set in advance, so that the bastion host file management system can identify abnormal behaviors that deviate from normal patterns, thereby providing more accurate threat detection and risk assessment capabilities, that is, based on the size relationship between the behavior anomaly value and the preset behavior benchmark value, determine whether to perform behavior verification on the current file access operation, and add a secondary verification mechanism when the security of the file access operation is not high, thereby maximizing the security of the bastion host file control.

[0103] In one practicable manner, referring to Figure 4 , Figure 4 The schematic diagram of the structure of the bastion host file management system is shown in FIG. The bastion host file management system includes a construction module, a sorting module, a decision module and an audit module. The construction module can be used to construct an enhanced black and white list and establish an initial baseline of user behavior through an isolation forest algorithm. The sorting module can be used to sort the risk levels from high to low to obtain an effective black and white list. The decision module can make black and white list decisions and calculate anomaly scores when the operation is allowed. The audit module is used to record audit operation information and results.

[0104] In one practicable manner, referring to Figure 5 , Figure 5The control flow chart of the bastion machine file access control is shown, wherein the input file operation to be decided can be understood as the current file access operation, the sourcelps list is used to represent the behavior object information, the paths list is used to represent the behavior path information, and the operations list is used to represent the behavior type information. After multi-level behavior permission detection, the selection step is executed: the selection step: select a target access control list from multiple access control lists; according to multiple behavior permissions, detect the behavior permission matching result of the current file access operation under the target access control list; return to execute the selection step until all access control lists are selected as the target access control list, and obtain the file access result corresponding to the multiple behavior permission matching results; according to the result type of the file access result, generate the file access permission, and when the file access permission is that the current file access operation has the access permission, detect the behavior abnormal value of the current file access operation; if the behavior abnormal value is greater than the preset behavior baseline value, then according to the behavior verification result of the current file access operation, perform access control on the current file access operation; if the behavior abnormal value is less than or equal to the preset behavior baseline value, then allow the current file access operation to be executed, and finally the audit module detects the access control process in real time.

[0105] It can be understood that the following technical effects can be achieved based on this embodiment: 1) Higher security and flexibility: Through the UEBA module, the system can identify and respond to threats not covered by conventional rules, dynamically adjust security policies, and improve response speed and detection sensitivity. Provide user behavior pattern analysis to improve the system's ability to identify abnormal operations; 2) Fine-grained access control: Based on multi-dimensional metadata and risk levels, it allows precise control and sorting optimization of complex access rules, enhancing the adaptability and accuracy of rule management. A wide variety of operation requests can be properly met under security guarantees.

[0106] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0107] Based on the same inventive concept, the embodiment of the present application also provides a bastion machine file access control device for implementing the bastion machine file access control method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more bastion machine file access control device embodiments provided below can refer to the limitations of the bastion machine file access control method above, and will not be repeated here.

[0108] In an exemplary embodiment, Figure 6 As shown, a bastion host file access control device is provided, including: a matching module 401, a determination module 402 and an access control module 403, wherein:

[0109] A matching module 401 is used to match the access control rules that meet the access security standard for the current file access operation according to the attribute feature information carried by the current file access operation received by the bastion host;

[0110] A determination module 402, configured to determine the file access permission of the current file access operation under the access control rule according to the behavior characteristic information carried by the current file access operation;

[0111] The access control module 403 is used to perform access control on the current file access operation according to the file access permission.

[0112] In one embodiment, the attribute feature information includes operation time information; the matching module 401 is further used to:

[0113] Constructing a preset access control rule that meets the security access standard for each historical file access operation; screening multiple preset access control rules to obtain multiple candidate access control rules that are within the effective period of the operation time information identifier; and extracting the access control rule from the multiple candidate access control rules.

[0114] In one embodiment, the matching module 401 is further configured to:

[0115] According to the operational risk information of each of the historical file access operations, the plurality of candidate access control rules are prioritized to obtain a priority ranking result; and according to the priority ranking result, the access control rule is extracted from the plurality of candidate access control rules.

[0116] In one embodiment, the behavior characteristic information includes behavior location information, behavior object information and behavior type information; the determination module 402 is further used to:

[0117] According to the behavior location information, the behavior object information and the behavior type information, the behavior permissions of the current file access operation in the access control rule are detected in sequence; and according to multiple behavior permissions, the file access permissions of the current file access operation under the access control rule are generated.

[0118] In one embodiment, the access control rule includes a plurality of access control lists; the access control module 403 is further used to:

[0119] Selection step: select a target access control list from the multiple access control lists; detect the behavior permission matching result of the current file access operation under the target access control list based on the multiple behavior permissions; return to execute the selection step until all access control lists are selected as the target access control list, and obtain the file access result corresponding to the multiple behavior permission matching results; generate the file access permission according to the result type of the file access result.

[0120] In one embodiment, the access control module 403 is further used to:

[0121] When the file access permission is that the current file access operation has access permission, a behavior anomaly value of the current file access operation is detected; if the behavior anomaly value is greater than a preset behavior baseline value, access control is performed on the current file access operation based on a behavior verification result of the current file access operation; if the behavior anomaly value is less than or equal to the preset behavior baseline value, execution of the current file access operation is allowed.

[0122] Each module in the above-mentioned bastion file access control device can be implemented in whole or in part by software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0123] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 7As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface, the display unit and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a bastion file access control method is implemented. Those skilled in the art can understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0124] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0125] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0126] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0127] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0128] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0129] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A bastion host file access control method, characterized in that: The method comprises: According to the attribute feature information carried by the current file access operation received by the bastion host, an access control rule that meets the access security standard is matched for the current file access operation; Determining the file access permission of the current file access operation under the access control rule according to the behavior characteristic information carried by the current file access operation; Access control is performed on the current file access operation according to the file access permission.

2. The method according to claim 1, characterized in that The attribute characteristic information includes operation timeliness information; the attribute characteristic information carried by the current file access operation received by the bastion host is used to match the access control rule that meets the access security standard for the current file access operation, including: Build preset access control rules that meet security access standards for each historical file access operation; Screening a plurality of preset access control rules to obtain a plurality of candidate access control rules that are within a valid period of time identified by the operation time limit information; The access control rule is extracted from the plurality of candidate access control rules.

3. The method according to claim 2, characterized in that Extracting the access control rule from the multiple candidate access control rules includes: Prioritizing the plurality of candidate access control rules according to the operational risk information of each of the historical file access operations to obtain a priority ranking result; The access control rule is extracted from the plurality of candidate access control rules according to the priority sorting result.

4. The method according to claim 1, characterized in that: The behavior characteristic information includes behavior location information, behavior object information, and behavior type information; and determining the file access permission of the current file access operation under the access control rule according to the behavior characteristic information carried by the current file access operation includes: According to the behavior location information, the behavior object information and the behavior type information, the behavior authority of the current file access operation in the access control rule is detected in sequence; According to the plurality of behavior permissions, a file access permission for the current file access operation under the access control rule is generated.

5. The method according to claim 4, characterized in that The access control rules include multiple access control lists; Generating the file access permission of the current file access operation under the access control rule according to the multiple behavior permissions includes: Selecting step: selecting a target access control list from the multiple access control lists; According to the multiple behavior permissions, detecting a behavior permission matching result of the current file access operation under the target access control list; Return to execute the selection step until all access control lists are selected as the target access control lists, and obtain the file access results corresponding to the multiple behavior permission matching results; The file access permission is generated according to the result type of the file access result.

6. The method according to claim 5, characterized in that The performing access control on the current file access operation according to the file access permission includes: In a case where the file access permission is that the current file access operation has the access permission, detecting a behavior abnormality value of the current file access operation; If the behavior abnormality value is greater than the preset behavior reference value, access control is performed on the current file access operation according to the behavior verification result of the current file access operation; If the behavior abnormality value is less than or equal to the preset behavior reference value, the current file access operation is allowed to be executed.

7. A bastion machine file access control device, characterized in that: The device comprises: A matching module, used to match the access control rules that meet the access security standards for the current file access operation according to the attribute feature information carried by the current file access operation received by the bastion host; A determination module, configured to determine the file access permission of the current file access operation under the access control rule according to the behavior characteristic information carried by the current file access operation; The access control module performs access control on the current file access operation according to the file access permission.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images