Security detection method and device and electronic equipment

Abstract

The embodiment of the invention provides a security detection method and device and electronic equipment. The security detection method comprises: in response to a security detection request, obtaining first configuration information corresponding to a to-be-detected configuration item, the security detection request being used for indicating to perform security detection on at least one to-be-detected configuration item respectively corresponding to a part of cloud environments or all cloud environments in a plurality of cloud environments of a user; and detecting the first configuration information based on the configuration rule of each cloud environment, and outputting the detection result, thereby realizing security management of the multi-cloud environment.

Description

Technical Field

[0001] This application relates to the field of cloud security, and more particularly, to security detection methods, devices, and electronic devices. Background Art

[0002] An enterprise's cloud environment is large and complex, with a large number of resources and accounts to maintain. When users configure the cloud environment, the following problems are likely to occur: uncertainty about how to correctly configure cloud resources, overly permissive permission configurations due to diverse user identities, time-consuming and laborious long-term tracking and maintenance of cloud resource configurations, etc. These problems are likely to lead to configuration errors, omissions, and excessive permissions, resulting in possible data leakage and other security incidents.

[0003] Most enterprises choose hybrid cloud or multi-cloud deployment solutions to fully utilize the advantages of different cloud service providers or meet compliance requirements. However, different cloud environments have different configuration methods, making security management more complex. Summary of the Invention

[0004] This application provides a security detection method, device, and electronic device, realizing security management in a multi-cloud environment.

[0005] In a first aspect, this application provides a security detection method, including:

[0006] In response to a security detection request, obtain first configuration information corresponding to a configuration item to be detected, where the security detection request is used to indicate security detection of at least one configuration item to be detected corresponding to some or all of the multiple cloud environments of a user;

[0007] Detect the first configuration information based on the configuration rules of each cloud environment, and output a detection result.

[0008] In one implementation, the obtaining of the first configuration information corresponding to the configuration item to be detected includes:

[0009] Obtain the first configuration information through access interfaces corresponding to the configuration items to be detected in each cloud environment.

[0010] In one implementation, the responding to the security detection request includes:

[0011] Respond to the security detection request triggered by the user through the client page, or respond to the security detection request triggered by a scheduled task.

[0012] In one implementation, the outputting of the detection result includes at least one of the following:

[0013] Output a detection report indicating whether each configuration item to be detected corresponding to each of the multiple cloud environments passes or fails the detection;

[0014] Outputting warning information, wherein the warning information is used to indicate the risk of the configuration item that failed the detection;

[0015] Output repair information, where the repair information is used to indicate a modification target for the configuration item that fails the detection.

[0016] In one implementation, outputting the detection result includes:

[0017] Output the test results based on the priority of each configuration item to be tested.

[0018] In one implementation, the method further includes:

[0019] Receive configuration rule customization information input by a user, and update the configuration rules of the cloud environment based on the configuration rule customization information.

[0020] In a second aspect, the present application provides a security detection method, comprising:

[0021] Sending a security check request to the server, where the security check request is used to instruct a security check to be performed on at least one configuration item to be checked corresponding to some or all of the user's multiple cloud environments;

[0022] A detection result sent by the server is received, where the detection result is obtained by detecting first configuration information based on configuration rules of each cloud environment, and the first configuration information is configuration information corresponding to the configuration item to be detected.

[0023] In one implementation, sending a security check request to the server includes:

[0024] In response to the user's operation on the client page, the security detection request is sent to the server, wherein the client displays the preset configuration items to be detected in all cloud environments of the user through one or more levels of pages.

[0025] In one implementation, the method further includes:

[0026] The test result is displayed on the client page, and the test result includes at least one of the following:

[0027] Test report, used to indicate whether each configuration item to be tested has passed or failed;

[0028] Warning information is used to indicate the risk of configuration items that fail detection;

[0029] Repair information, used to indicate the modification target for the configuration item that failed the detection.

[0030] In a third aspect, the present application provides a safety detection device, comprising:

[0031] An acquisition module, in response to a security detection request, acquires first configuration information corresponding to a configuration item to be detected, where the security detection request is used to indicate performing security detection on at least one configuration item to be detected corresponding to some or all of a plurality of cloud environments of a user;

[0032] A detection module, configured to detect the first configuration information based on configuration rules of each cloud environment and output a detection result.

[0033] In one implementation, the acquisition module is configured to:

[0034] Acquire the first configuration information through access interfaces corresponding to respective configuration items to be detected in each cloud environment.

[0035] In one implementation, the acquisition module is configured to:

[0036] In response to the security detection request triggered by the user through a client page, or in response to the security detection request triggered by a timing task.

[0037] In one implementation, the detection module is used for at least one of the following:

[0038] Output a detection report indicating whether each configuration item to be detected corresponding to each of the multiple cloud environments passes or fails the detection;

[0039] Output an alarm message, where the alarm message is used to indicate the risk of a configuration item that fails the detection;

[0040] Output repair information, where the repair information is used to indicate a modification target for a configuration item that fails the detection.

[0041] In one implementation, the detection module is configured to:

[0042] Output a detection result based on the priority sorting of each configuration item to be detected.

[0043] In one implementation, it further includes: a receiving module, configured to

[0044] Receive custom configuration rule information input by a user and update the configuration rules of the cloud environment based on the custom configuration rule information.

[0045] In a fourth aspect, the present application provides a security detection device, including:

[0046] A sending module, which sends a security detection request to a server, where the security detection request is used to indicate performing security detection on at least one configuration item to be detected corresponding to some or all of a plurality of cloud environments of a user;

[0047] A receiving module, configured to receive the detection result sent by the server, where the detection result is obtained by detecting the first configuration information based on the configuration rules of each cloud environment, and the first configuration information is the configuration information corresponding to the configuration item to be detected.

[0048] In one implementation, the sending module is configured to:

[0049] In response to a user operation on the client page, send the security detection request to the server, where the client displays all the preset configuration items to be detected under the user's cloud environments through one or more levels of pages.

[0050] In one implementation, it further includes: a display module, configured to:

[0051] Display the detection result through the client page, where the detection result includes at least one of the following:

[0052] A detection report, used to indicate whether each configuration item to be detected passes or fails;

[0053] An alarm message, used to indicate the risk of the configuration item that fails the detection;

[0054] Repair information, used to indicate the modification target of the configuration item that fails the detection.

[0055] In a fifth aspect, the present application provides an electronic device, including: a memory and a processor;

[0056] The memory is used to store a computer program;

[0057] The processor is used to execute the computer program stored in the memory, and when the computer program runs, the processor executes the method described in the first aspect or the second aspect.

[0058] In a sixth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored, and when the computer program is executed by a processor, the processor executes the method described in the first aspect or the second aspect.

[0059] In a seventh aspect, the present application provides a computer program product, including a computer program, and when the computer program is executed by a processor, it implements the method described in the first aspect or the second aspect.

[0060] The security detection method, device, and electronic device provided in the present application achieve automated collection of configuration information in a multi-cloud environment, automated monitoring of the configuration in a multi-cloud environment based on predefined configuration rules, and output of corresponding detection results, helping users evaluate and strengthen the security configuration of cloud resources and reducing security risks in a multi-cloud environment. Brief Description of the Drawings

[0061] To more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0062] Figure 1 It is a schematic diagram of an application scenario of a security detection method provided by an embodiment of the present application;

[0063] Figure 2 It is a flowchart of a security detection method provided by an embodiment of the present application Figure 1 ;

[0064] Figure 3 It is a flowchart of a security detection method provided by an embodiment of the present application Figure 2 ;

[0065] Figure 4 It is a schematic structural diagram of a security detection device provided by an embodiment of the present application Figure 1 ;

[0066] Figure 5 It is a schematic structural diagram of a security detection device provided by an embodiment of the present application Figure 2 ;

[0067] Figure 6 It is a schematic block diagram of an electronic device provided by an embodiment of the present application. Detailed Embodiments

[0068] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some, but not all, of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts fall within the scope of protection of the present application.

[0069] Cloud Security Posture Management (CSPM) is defined as a security product. Currently, most CSPM product solutions can achieve basic security capabilities such as monitoring the cloud environment and detecting configuration errors, but they are not rich enough in terms of compatibility and cannot support multi-cloud environments.

[0070] In view of this, in the embodiments of the present application, a security detection method supporting a multi-cloud environment is proposed, which realizes automatic collection of configuration information of the multi-cloud environment, automatically monitors the configuration of the multi-cloud environment based on predefined rules, and outputs corresponding results to help users evaluate and strengthen the security configuration of cloud resources and reduce security risks in the multi-cloud environment. Figure 1 It is a schematic diagram of an application scenario of a security detection method provided by an embodiment of the present application. Taking a multi-cloud deployment solution of cloud environment 1, cloud environment 2 to cloud environment n as an example, the user triggers a security detection of the multi-cloud environment through the client 101, and the server 102 responds and collects the configuration information of each cloud environment in the multi-cloud environment, and based on the predefined rules, determines the configuration problems existing in the multi-cloud environment and returns the detection results to the client 101.

[0071] Figure 2 It is a flow diagram of a security detection method provided by an embodiment of the present application Figure 1 . This method is applied to the server. Optionally, the server can be a configuration detection engine. As Figure 2 shown, this method includes:

[0072] S201. In response to a security detection request, obtain first configuration information corresponding to a configuration item to be detected, where the security detection request is used to indicate a security detection of at least one configuration item to be detected corresponding to some or all of the multiple cloud environments of the user respectively.

[0073] The security detection request can be triggered by the user through the client. The user can trigger the security detection of the multi-cloud environment through the client at any time when security detection is required. Or, the security detection request can be triggered by a scheduled task, that is, the server can perform security detection periodically according to the setting of the scheduled task, or perform security detection at a specific time set by the scheduled task, where the scheduled task can be preset. In the embodiments of the present application, the triggering manner of the security detection request is not limited. That is, the server responds to the security detection request triggered by the user through the client page, or responds to the security detection request triggered by the scheduled task.

[0074] In response to a security detection request, the server needs to obtain the first configuration information corresponding to the configuration items to be detected from the cloud environment indicated by the security detection request. Herein, the cloud environment indicated by the security detection request may be one or more of the user's multiple cloud environments, and at least one configuration item to be detected corresponding to each cloud environment indicated by the security detection request may be part or all of all the configuration items to be detected in the cloud environment. By way of example, the client can display each configuration item to be detected under each cloud environment through one-level or multi-level pages, and the user can select one or more configuration items to be detected therefrom to trigger a security detection. By way of example, an option for performing a security detection on all the configuration items to be detected in all cloud environments can also be displayed on the client page, so that the user can directly trigger a security detection on all the configuration items to be detected in all cloud environments through this option.

[0075] The configuration items to be detected in the cloud environment may be the configuration information for various aspects of cloud resources in the cloud environment, such as the configuration information of resources such as virtual machines, storage, and networks. The configuration items to be detected for each cloud environment may include configuration items in multiple security dimensions. For example, from the authorization management dimension, it may include configuration items to be detected for managing and controlling the usage and access permissions of the cloud platform to detect whether there are problems such as over-authorization of user accounts and password expiration, so as to discover and solve problems in authorization management and improve the security and reliability of the cloud platform. Another example is that from the security risk dimension, based on the security practices of different cloud providers, the security configuration of the business system, code vulnerabilities, log configuration, etc. to be detected are determined to maximize the protection of user data and business security. Still another example is that from the compliance risk dimension, based on international standards, for example, the relevant standards of the Center for Internet Security (CIS), the configuration items to be detected related to information security are determined, thereby improving the network security of cloud products and reducing the risk of network attacks.

[0076] The server separately obtains the first configuration information of the corresponding configuration items to be detected from each cloud environment. For example, the server can obtain the first configuration information through the access interfaces corresponding to the configuration items to be detected in each cloud environment. In the embodiment of the present application, the server integrates the access interfaces corresponding to the configuration items to be detected in each cloud environment provided by the cloud service provider. The server can access the cloud environment through the corresponding access interfaces based on the configuration items to be detected in the cloud environment indicated by the security detection request to obtain the corresponding first configuration information. It can be understood that the configuration items to be detected in each cloud environment may be the same, partially the same, or different, and for each configuration item to be detected in each cloud environment, the server can obtain a piece of first configuration information respectively.

[0077] S202. Detect the first configuration information based on the configuration rules of each cloud environment, and output a detection result.

[0078] To ensure the security of the cloud environment, such as ensuring data security and appropriate permission scopes, corresponding configuration rules need to be preset for the configuration items of each cloud environment. The configuration rules can correspond to each configuration item to be detected. For example, each configuration item to be detected corresponds to one configuration rule, or multiple configuration items to be detected correspond to one configuration rule. Setting the cloud environment according to these configuration rules can ensure security.

[0079] Exemplarily, the configuration item to be detected is the number of incorrect password retries. The configuration rule for this configuration item to be detected includes the threshold for configuring the number of incorrect password retries. The first configuration information obtained by the server is the actual number of incorrect password retries configured in the cloud environment, and the server determines whether the actual number of incorrect password retries satisfies the threshold constraint in the configuration rule.

[0080] Optionally, on the premise of ensuring security, the configuration rules for each cloud environment can provide options for users to perform custom configurations such as threshold configuration according to their own needs. The server can receive the custom configuration information of the configuration rules input by the user and update the configuration rules of the cloud environment based on the custom configuration information of the configuration rules.

[0081] Optionally, in the embodiments of the present application, priorities can be set for the configuration rules of each cloud environment, that is, the priorities of each configuration item to be detected, to represent the importance or urgency of the risks corresponding to the configuration items to be detected.

[0082] After obtaining the first configuration information corresponding to the configuration item to be detected, the first configuration information can be compared with the configuration rule corresponding to the configuration item to be detected to determine whether the first configuration rule conforms to the configuration rule, and a detection result is output. Optionally, the detection result output by the server can include at least one of the following: output a detection report indicating whether each configuration item to be detected corresponding to each of the multiple cloud environments passes or fails; output an alarm message, and the alarm message is used to indicate the risk of the configuration item that fails the detection; output repair information, and the repair information is used to indicate the modification target for the configuration item that fails the detection.

[0083] Taking the aforementioned configuration item to be detected, i.e., the number of incorrect password retries, as an example, the configuration rule of this configuration item to be detected includes the threshold for configuring the number of incorrect password retries. The first configuration information obtained by the server is the actual number of incorrect password retries configured in the cloud environment. If the server determines that the actual number of incorrect password retries satisfies the threshold constraint in the configuration rule, then this configuration item to be detected passes the detection. If the server determines that the actual number of incorrect password retries does not satisfy the threshold constraint in the configuration rule, this configuration item to be detected fails the detection. Optionally, when this configuration item to be detected fails the detection, the server can output an alarm message to prompt the user of a security risk. Optionally, when this configuration item to be detected fails the detection, the server can output repair information to prompt the user to modify the configuration of the number of incorrect password retries so that it satisfies the threshold constraint in the configuration rule.

[0084] Compare the first configuration information with the configuration rule corresponding to this configuration item to be detected. If the first configuration information conforms to the configuration rule, then this configuration item to be detected passes the detection. If the first configuration information does not conform to the configuration rule, then this configuration item to be detected fails the detection. Optionally, for the configuration item to be detected that fails the detection, the server can output an alarm message to prompt the user. Optionally, for the configuration item to be detected that fails the detection, the server can output repair suggestions to prompt the user to modify the configuration item to be detected according to the modification target, where the modification target is determined according to the configuration rule of this configuration item to be detected.

[0085] Optionally, in order to enable the user to view the security risks more intuitively, the server can output the detection results based on the priority sorting of each configuration item to be detected. For example, for the configuration items to be detected that fail the detection, the configuration items to be detected with a higher risk priority are ranked before the configuration items to be detected with a lower risk priority.

[0086] The method of the embodiment of the present application realizes the automatic collection of the configuration information of the multi-cloud environment, automatically monitors the configuration of the multi-cloud environment based on the predefined configuration rules, and outputs the corresponding detection results, helping the user evaluate and strengthen the security configuration of cloud resources and reducing the security risks in the multi-cloud environment.

[0087] Figure 3 is a flowchart of a security detection method provided by an embodiment of the present application Figure 2 This method is applied to the client.

[0088] As Figure 3 shown, this method includes:

[0089] S301. Send a security detection request to the server. The security detection request is used to indicate to perform a security detection on at least one configuration item to be detected corresponding to some or all of the multiple cloud environments of the user.

[0090] S302. Receive the detection result sent by the server. The detection result is obtained by detecting the first configuration information based on the configuration rules of each cloud environment, and the first configuration information is the configuration information corresponding to the configuration item to be detected.

[0091] The client sends a security detection request to the server. The server obtains the first configuration information corresponding to the configuration item to be detected from the cloud environment indicated by the security detection request, and detects the first configuration information based on the configuration rules of each cloud environment, determines the detection result, and returns the detection result to the client so that the user can timely understand the security risk.

[0092] Optionally, in response to the user's operation on the client page, send a security detection request to the server, where the client displays the preset configuration items to be detected under all cloud environments of the user through one or more levels of pages.

[0093] The user triggers a security detection request through an operation on the client page. The operation control for triggering the security detection request and the like can be displayed in various forms on the client page. By way of example, the operation control for performing a security detection on the preset configuration items to be detected under all cloud environments of the user can be displayed on the client page, and the user can click the operation control to perform a security detection on all the detected configuration items of all cloud environments. By way of example, the preset configuration items to be detected under all cloud environments can be displayed in a preset order on the client page, and each configuration item to be detected can have an independent operation control for security detection. The user can click the operation control of each configuration item to be detected to perform an independent security detection on the configuration item to be detected. Alternatively, the operation control for performing a security detection after single or multiple selection of the configuration items to be detected can be displayed on the client page, and the user can click the operation control after selecting one or more configuration items to be detected to trigger a security detection on the selected one or more configuration items to be detected.

[0094] Optionally, display the detection result through the client page. The detection result includes at least one of the following: a detection report for indicating whether each configuration item to be detected passes or fails; an alarm message for indicating the risk of the configuration item that fails the detection; and repair information for indicating the modification target of the configuration item that fails the detection.

[0095] Optionally, the detection results can also include analysis results. For example, the quantity or proportion of the to-be-detected configuration items that pass or fail the detection; the quantity of the to-be-detected configuration items with high priority among the to-be-detected configuration items that fail the detection; the quantity or proportion of the to-be-detected configuration items that pass or fail the detection in different security dimensions. For example, the proportion of the to-be-detected configuration items that fail the detection in the authorization management dimension, the proportion of the to-be-detected configuration items that fail the detection in the security risk dimension, and the proportion of the to-be-detected configuration items that fail the detection in the compliance risk dimension; the quantity or proportion of the to-be-detected configuration items that pass or fail the detection in each cloud environment. For example, the proportion of the to-be-detected configuration items that fail the detection in Cloud Environment 1 and the proportion of the to-be-detected configuration items that fail the detection in Cloud Environment 2. Through the result display on the client side, users can intuitively understand the detection results, determine security risks, so as to repair security problems in a timely manner, realizing convenient, efficient and flexible security management of multi-cloud environments.

[0096] In the solution of the embodiment of the present application, the server can access the cloud environments of different cloud providers through user authorization, and provide a CSPM solution with simple configuration and rich cloud environment coverage. On the premise of providing configuration rules predefined by professional security personnel, it supports users to modify custom parameters such as the thresholds of configuration items, taking into account flexibility while providing an out-of-the-box solution.

[0097] Figure 4 It is a schematic structure of a security detection device provided by an embodiment of the present application Figure 1 . As Figure 4 shown, the security detection device 400 includes:

[0098] An acquisition module 401, which, in response to a security detection request, acquires first configuration information corresponding to a to-be-detected configuration item, where the security detection request is used to indicate performing security detection on at least one to-be-detected configuration item corresponding to some or all of the cloud environments of a user's multiple cloud environments.

[0099] A detection module 402, which is used to detect the first configuration information based on the configuration rules of each cloud environment and output a detection result.

[0100] In one implementation, the acquisition module urchases the first configuration information through the access interfaces corresponding to the to-be-detected configuration items of each cloud environment.

[0101] The acquisition module 401 is used to:

[0102] In one implementation, the acquisition module 401 is used to:

[0103] Respond to a security detection request triggered by a user through a client page, or respond to a security detection request triggered by a scheduled task.

[0104] In one implementation, the detection module 402 is used for at least one of the following:

[0105] Output a detection report indicating whether each configuration item to be detected corresponding to each of multiple cloud environments passes or fails the detection;

[0106] Output an alarm message, which is used to indicate the risk of the configuration item that fails the detection;

[0107] Output repair information, which is used to indicate the modification target of the configuration item that fails the detection.

[0108] In one implementation, the detection module 402 is used for:

[0109] Output detection results based on the priority sorting of each configuration item to be detected.

[0110] In one implementation, it further includes: a receiving module, which is used for

[0111] Receive the custom configuration rule information input by the user, and update the configuration rules of the cloud environment based on the custom configuration rule information.

[0112] The device in the embodiments of the present application can be used to execute the security detection method in the foregoing embodiments. The implementation principle and technical effects are similar, and will not be described in detail here.

[0113] Figure 5 It is a schematic structure of a security detection device provided by the embodiments of the present application Figure 2 As Figure 5 shown, the security detection device 500 includes:

[0114] A sending module 501 that sends a security detection request to the server. The security detection request is used to indicate to perform a security detection on at least one configuration item to be detected corresponding to some or all of the user's multiple cloud environments respectively;

[0115] A receiving module 502 that is used to receive the detection results sent by the server. The detection results are obtained by detecting the first configuration information based on the configuration rules of each cloud environment. The first configuration information is the configuration information corresponding to the configuration item to be detected.

[0116] In one implementation, the sending module 501 is used for:

[0117] In response to the user's operation on the client page, send a security detection request to the server, where the client displays the preset configuration items to be detected under all the user's cloud environments through one or multiple levels of pages.

[0118] In one implementation, it further includes: a display module, which is used for:

[0119] The detection results are displayed on the client page, and the detection results include at least one of the following:

[0120] A detection report for indicating whether each configuration item to be detected passes or fails;

[0121] An alarm message for indicating the risk of the configuration item that fails the detection;

[0122] Repair information for indicating the modification target of the configuration item that fails the detection.

[0123] The device in the embodiment of the present application can be used to execute the security detection method in the foregoing embodiment, and its implementation principle and technical effect are similar, and will not be described in detail here.

[0124] Figure 6 is a schematic block diagram of an electronic device provided by an embodiment of the present application. As Figure 6 shown, the electronic device 600 may include at least one processor 601 for implementing the security detection method provided by the embodiment of the present application.

[0125] Optionally, the electronic device 600 further includes at least one memory 602 for storing program instructions and / or data. The memory 602 is coupled to the processor 601. The coupling in the embodiment of the present application is an indirect coupling or communication connection between devices, units or modules, which can be electrical, mechanical or other forms for information interaction between devices, units or modules. The processor 601 may cooperate with the memory 602. The processor 601 may execute the program instructions stored in the memory 602. At least one of the at least one memories may be included in the processor.

[0126] Optionally, the electronic device 600 further includes a communication interface 603 for communicating with other devices through a transmission medium, so that the electronic device 600 can communicate with other devices. The communication interface 603 may be, for example, a transceiver, an interface, a bus, a circuit or a device capable of implementing a transceiver function. The processor 601 may use the communication interface 603 to transmit and receive data and / or information and is used to implement the method provided by the embodiment of the present application. For specific details, refer to the detailed description in the foregoing embodiment, and will not be described in detail here.

[0127] In the embodiment of the present application, the specific connection medium between the foregoing processor 601, memory 602 and communication interface 603 is not limited. In the embodiment of the present application Figure 6 it is connected by a bus 604 between the processor 601, memory 602 and communication interface 603. The bus 604 is Figure 6 shown in thick lines, and the connection manners between other components are only for illustrative purposes and are not to be construed as limiting. The bus may be divided into an address bus, a data bus, a control bus, etc. For the sake of convenience of representation,Figure 6 It is represented by only one thick line, but it does not mean that there is only one bus or one type of bus.

[0128] It should be understood that the processor in the embodiments of the present application may be an integrated circuit chip with signal processing capabilities. In the implementation process, the steps of the above method embodiments can be completed by the integrated logic circuit in the hardware of the processor or instructions in software form. The above processor may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. It can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as being executed and completed by the hardware decoding processor, or executed and completed by a combination of the hardware and software modules in the decoding processor. The software module may be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and combines its hardware to complete the steps of the above method.

[0129] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchlink DRAM (SLDRAM), and direct rambus RAM (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include but not be limited to these and any other suitable types of memory.

[0130] The present application also provides a computer-readable storage medium storing a computer program (which may also be referred to as code or instructions). When the computer program is run, it causes the computer to execute the method in any of the foregoing embodiments.

[0131] The present application also provides a computer program product including a computer program that, when executed by a processor, implements the method in any of the foregoing embodiments.

[0132] The terms "unit", "module", etc. used in this specification may be used to represent computer-related entities, hardware, firmware, combinations of hardware and software, software, or software in execution.

[0133] Those of ordinary skill in the art will realize that the various illustrative logical blocks and steps described in connection with the embodiments disclosed herein can be implemented in either electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods for each specific application to implement the described functions, but such implementation should not be considered to exceed the scope of this application. In several embodiments provided in this application, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling, direct coupling, or communication connection between each other can be through some interfaces. The indirect coupling or communication connection of the device or unit can be in electrical, mechanical, or other forms.

[0134] The unit described as a separate component may or may not be physically separated. The component displayed as a unit may or may not be a physical unit, that is, it may be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0135] In addition, the functional units in each embodiment of this application can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit.

[0136] In the above embodiments, the functions of each functional unit can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions (programs). When the computer program instructions (programs) are loaded and executed on a computer, the processes or functions according to the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wire (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more integrated available media. The available medium can be a magnetic medium (such as a floppy disk, hard disk, magnetic tape), an optical medium (such as a digital video disc (DVD)), or a semiconductor medium (such as a solid-state disk (SSD)), etc.

[0137] If this function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present application. The aforementioned storage medium includes: USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical discs, etc., which can store program codes.

[0138] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data that have been authorized by the user or fully authorized by all parties. And the collection, use, and processing of the relevant data need to comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding operation entrances are provided for the user to choose to authorize or refuse.

[0139] As described above, it is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of changes or substitutions, which should all be covered within the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims described above.

Claims

1. A security detection method, characterized in that, Applied to the server side, including: In response to a security detection request, obtain first configuration information corresponding to the configuration items to be detected, where the security detection request is used to indicate performing security detection on at least one configuration item to be detected corresponding to some or all of the multiple cloud environments of the user; Detect the first configuration information based on the configuration rules of each cloud environment, and output a detection result.

2. The method according to claim 1, wherein The obtaining of the first configuration information corresponding to the configuration items to be detected includes: Obtain the first configuration information through the access interfaces corresponding to the configuration items to be detected in each cloud environment.

3. The method according to claim 1, wherein The responding to the security detection request includes: Respond to the security detection request triggered by the user through the client page, or respond to the security detection request triggered by a scheduled task.

4. The method according to any one of claims 1-3, characterized in that The outputting of the detection result includes at least one of the following: Output a detection report indicating whether each configuration item to be detected corresponding to each of the multiple cloud environments passes or fails the detection; Output an alarm message, where the alarm message is used to indicate the risk of the configuration item that fails the detection; Output repair information, where the repair information is used to indicate the modification target for the configuration item that fails the detection.

5. The method according to any one of claims 1 to 3, characterized in that, The outputting of the detection result includes: Output the detection result based on the priority sorting of each configuration item to be detected.

6. The method according to any one of claims 1-3, characterized in that It further includes: Receive the custom configuration rule information input by the user, and update the configuration rules of the cloud environment based on the custom configuration rule information.

7. A security detection method, characterized in that, Applied to the client side, including: Send a security detection request to the server, where the security detection request is used to indicate performing security detection on at least one configuration item to be detected corresponding to some or all of the multiple cloud environments of the user; Receive the detection result sent by the server, where the detection result is obtained by detecting the first configuration information based on the configuration rules of each cloud environment, and the first configuration information is the configuration information corresponding to the configuration item to be detected.

8. The method according to claim 7, wherein The sending of the security detection request to the server includes: In response to the user's operation on the client page, send the security detection request to the server, where the client displays the preset configuration items to be detected under all the user's cloud environments through one or multiple levels of pages.

9. The method according to claim 7, wherein It further includes: Display the detection result through the client page, where the detection result includes at least one of the following: A detection report, used to indicate whether each configuration item to be detected passes or fails the detection; An alarm message, used to indicate the risk of the configuration item that fails the detection; Repair information, used to indicate the modification target for the configuration item that fails the detection.

10. A safety detection device, characterized in that, It includes: An obtaining module, which, in response to a security detection request, obtains first configuration information corresponding to the configuration items to be detected, where the security detection request is used to indicate performing security detection on at least one configuration item to be detected corresponding to some or all of the multiple cloud environments of the user; A detection module, used to detect the first configuration information based on the configuration rules of each cloud environment, and output a detection result.

11. A security detection device, characterized in that, It includes: A sending module that sends a security detection request to a server, where the security detection request is used to indicate to perform security detection on at least one configuration item to be detected corresponding to some or all of multiple cloud environments of a user. A receiving module for receiving a detection result sent by the server, where the detection result is obtained by detecting first configuration information based on configuration rules of each cloud environment, and the first configuration information is the configuration information corresponding to the configuration item to be detected.

12. An electronic device, characterized in that, Comprising: A memory and a processor; The memory is used to store a computer program; The processor is used to execute the computer program stored in the memory, and when the computer program runs, it causes the processor to execute the method according to any one of claims 1-9.

13. A computer-readable storage medium, characterized in that, A computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, it causes the processor to execute the method according to any one of claims 1-9.

14. A computer program product, characterized in that, Comprising a computer program, and when the computer program is executed by a processor, it implements the method according to any one of claims 1-9.

Images