Data processing method and device, equipment, storage medium and product

Abstract

The embodiment of the invention discloses a data processing method and device, equipment, a storage medium and a product. The method comprises the steps that under the condition that a data requester passes identity authentication, an identity label of the data requester and a virtual address of the data requester are obtained, a data filtering rule corresponding to the virtual address is generated based on the identity label of the data requester, and the data filtering rule is configured based on strategy parameters; the strategy parameter is obtained from the target group, the identifier of the target group is matched with the identity identifier of the data requester, filtering the to-be-transmitted data corresponding to the virtual address according to the data filtering rule, and transmitting the data meeting the transmission condition to the data requester. Visibly, through the identity label of the data requester, the association between the virtual address of the data requester and the target group is constructed, and the data filtering rule corresponding to the virtual address is configured based on the strategy parameter in the target group, so that the security and privacy of the data can be ensured in the data access process.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data processing method, a data processing apparatus, a computer device, a computer-readable storage medium, and a data processing product. Background Art

[0002] With advancements in scientific research, vast amounts of data are shifting from offline to online. Mobile work is becoming a popular way of working. This often involves accessing network resources through terminal devices; for example, employees accessing corporate cloud files via their mobile phones. Research has found that the number and variety of network resources are vast, and different users can request different data during access. For example, employees in different departments within the same company can request different data. Ensuring data security and privacy during access to network resources by data requesters has become a hot research topic. Summary of the Invention

[0003] The embodiments of the present application provide a data processing method, apparatus, device, computer-readable storage medium, and product that can ensure the security and privacy of data during the process of a data requester accessing network resources.

[0004] In one aspect, an embodiment of the present application provides a data processing method, comprising:

[0005] When the data requester passes identity authentication, the data requester's identity identifier and virtual address are obtained. The virtual address is dynamically allocated after the data requester passes identity authentication.

[0006] Based on the identity of the data requester, a data filtering rule corresponding to the virtual address is generated. The data filtering rule is configured based on policy parameters. The policy parameters are obtained from the target group. The target group's identity matches the data requester's identity.

[0007] The data to be transmitted corresponding to the virtual address is filtered according to the data filtering rules, and the data that meets the transmission conditions is transmitted to the data requester.

[0008] In one aspect, an embodiment of the present application provides a data processing device, comprising:

[0009] An acquisition unit, configured to acquire the identity identifier and virtual address of the data requester when the data requester passes identity authentication, wherein the virtual address is dynamically allocated after the data requester passes identity authentication;

[0010] a processing unit configured to generate a data filtering rule corresponding to the virtual address based on the identity of the data requester, wherein the data filtering rule is configured based on a policy parameter obtained from a target group whose identity matches the identity of the data requester;

[0011] The device is used to filter the data to be transmitted corresponding to the virtual address according to the data filtering rules, and transmit the data meeting the transmission conditions to the data requester through the sending unit.

[0012] In one embodiment, the processing unit is configured to generate a data filtering rule corresponding to the virtual address based on the identity identifier of the data requester, specifically to:

[0013] Check whether there is a target group in the access permission set whose identifier matches the identity identifier of the data requester. The access permission set includes M groups, and different groups contain different policy parameters. M is a positive integer.

[0014] If the target group exists in the access permission set, obtain the policy parameters in the target group and configure the data filtering rules corresponding to the virtual address based on the policy parameters;

[0015] If the target group does not exist in the access permission set, the data filtering rules corresponding to the virtual address are configured based on the preset parameters.

[0016] In one embodiment, the process of filtering the data to be transmitted corresponding to the virtual address according to the data filtering rule by the processing unit includes:

[0017] When it is detected that the policy parameters in the target group are updated, the updated policy parameters are obtained;

[0018] Based on the updated policy parameters, the data filtering rule corresponding to the virtual address is updated to obtain an updated data filtering rule;

[0019] The unfiltered data to be transmitted is filtered using the updated data filtering rules.

[0020] In one embodiment, the policy parameters include at least one of a target network segment and a target address, and each data to be transmitted is associated with a data address; the processing unit is configured to filter the data to be transmitted corresponding to the virtual address according to the data filtering rule, specifically to:

[0021] If the data address of the data to be transmitted matches the policy parameter, the data to be transmitted is determined to be data that meets the transmission condition;

[0022] If the data address of the data to be transmitted does not match the policy parameters, the data to be transmitted is determined to be data that does not meet the transmission conditions.

[0023] In one embodiment, the policy parameters include a first port, and each data to be transmitted is associated with a port; the processing unit is configured to filter the data to be transmitted corresponding to the virtual address according to the data filtering rule, specifically to:

[0024] If the port of the data to be transmitted matches the first port, determining the data to be transmitted as data that meets the transmission condition;

[0025] If the port of the data to be transmitted does not match the first port, the data to be transmitted is determined as data that does not meet the transmission condition.

[0026] In one embodiment, the processing unit is further configured to:

[0027] When it is detected that the data requester ends the data access, the data filtering rule corresponding to the virtual address is deleted.

[0028] In one embodiment, the processing unit is further configured to:

[0029] Obtain an access permission set and cache the access permission set. The access permission set includes M groups, and different groups contain different policy parameters. M is a positive integer.

[0030] When updated data for the access permission set is obtained, the cached access permission set is updated based on the updated data to obtain an updated access permission set.

[0031] In one embodiment, the processing unit is further configured to:

[0032] Obtain the network connection information of the data requester;

[0033] Associate and store network connection information, virtual address and identity; or,

[0034] When it is detected that the network connection information meets the alarm conditions, an alarm prompt is output;

[0035] Among them, the alarm conditions include: detecting that the number of times the data requester requests to obtain data through the second port is greater than the quantity threshold, or detecting that the number of times the data requester requests to obtain data in the target address is greater than the quantity threshold; the second port and the target address are not included in the policy parameters.

[0036] In one embodiment, the processing unit is further configured to:

[0037] Get access policy configuration information;

[0038] If the access policy configuration information indicates that the access policy is not configured through the access permission set, all data requests are accepted; the target group is included in the access permission set;

[0039] If the access policy configuration information indicates that the access policy is configured through the access permission set, then the step of obtaining the identity identifier and virtual address of the data requester is continued when the data requester passes the identity authentication.

[0040] In one embodiment, the identity identifier includes at least one of a certificate and a token of the data requester; the token is provided by the third party after the third-party data requester passes the identity authentication of the third party.

[0041] In one embodiment, the processing unit is configured to obtain the identity of the data requester, specifically to:

[0042] Obtain the certificate or token of the data requester;

[0043] If the data requester's certificate or token is included in the target policy group, the identifier of the target policy group is configured as the identity identifier of the data requester.

[0044] Accordingly, the present application provides a computer device, comprising:

[0045] a memory, wherein a computer program is stored in the memory;

[0046] The processor is used to load a computer program to implement the above data processing method.

[0047] Accordingly, the present application provides a computer-readable storage medium, which stores a computer program, and the computer program is suitable for being loaded by a processor and executing the above-mentioned data processing method.

[0048] Accordingly, the present application provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the above-mentioned data processing method.

[0049] In an embodiment of the present application, when a data requester passes identity authentication, the data requester's identity and virtual address are obtained. Based on the data requester's identity, a data filtering rule corresponding to the virtual address is generated. The data filtering rule is configured based on policy parameters. The policy parameters are obtained from a target group. The target group's identity matches the data requester's identity. The data to be transmitted corresponding to the virtual address is filtered according to the data filtering rule, and the data that meets the transmission conditions is transmitted to the data requester. It can be seen that the association between the data requester's virtual address and the target group can be established through the data requester's identity. Then, based on the policy parameters in the target group, the data filtering rule corresponding to the virtual address is configured. This ensures the security and privacy of data during the data requester's access to network resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A data processing scenario diagram provided in an embodiment of the present application;

[0051] Figure 2 A flowchart of a data processing method provided in an embodiment of the present application;

[0052] Figure 3 A flowchart of another data processing method provided in an embodiment of the present application;

[0053] Figure 4a An architectural diagram of a computer device provided in an embodiment of the present application;

[0054] Figure 4b A data interaction flow chart provided in an embodiment of the present application;

[0055] Figure 4c A schematic diagram of an application scenario provided in an embodiment of the present application;

[0056] Figure 5 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application;

[0057] Figure 6 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application.

[0059] This application involves technologies related to cloud technology, artificial intelligence, and streaming computing. The following is a brief introduction to the related technologies involved:

[0060] Cloud computing is a computing model that distributes computing tasks across a resource pool consisting of a large number of computers, enabling various application systems to access computing power, storage space, and information services as needed. The network that provides these resources is called the "cloud." To users, these resources appear infinitely scalable and can be accessed at any time, used on demand, expanded at any time, and paid for on a per-use basis.

[0061] Cloud computing is the product of the integration of traditional computer and network technologies such as grid computing, distributed computing, parallel computing, utility computing, network storage technologies, virtualization, and load balancing.

[0062] Cloud Platform: A cloud platform deploys a variety of virtual resources for external clients to choose from. Users can request services by sending requests to the cloud platform. The cloud computing resource pool primarily includes computing devices (virtualized machines, including operating systems), storage devices, and network equipment.

[0063] A private cloud is a cloud infrastructure with hardware and software resources created within a firewall, allowing departments within an organization or enterprise to share data center resources. In addition to hardware resources, creating a private cloud typically also requires cloud infrastructure (IaaS, Infrastructure as a Service) software.

[0064] A private cloud also encompasses three layers: cloud hardware, cloud platform, and cloud services. The difference is that the cloud hardware is the user's own personal computer or server, rather than the cloud computing vendor's data center. Cloud computing vendors build data centers to provide public cloud services to millions of users, requiring tens or even millions of servers. Private cloud computing, for individuals, only serves friends and family, while for businesses, only serves their employees, customers, and suppliers. Therefore, an individual or business's own personal computer or server is sufficient for providing cloud services.

[0065] Virtual Private Network (VPN): Its function is to establish a private network on a public network for encrypted communication.

[0066] OpenVPN: An open source VPN solution based on the Secure Sockets Layer (SSL) security protocol, including a VPN server and a VPN terminal.

[0067] VPN instance: An OpenVPN server process or container (running on a Linux host).

[0068] VPN terminal: A hardware or software device that runs the OpenVPN client process or container, used to connect to a VPN cluster and establish a VPN virtual private channel.

[0069] Artificial Intelligence (AI): The so-called AI is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science. It attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that the machines have the functions of perception, reasoning and decision-making. The embodiment of the present application mainly involves analyzing the network connection information of the user (data requester) through a behavioral analysis model to obtain a behavioral analysis result, and the behavioral analysis result is used to indicate whether the user has malicious intent.

[0070] AI technology is a comprehensive discipline encompassing a wide range of fields, encompassing both hardware and software technologies. Foundational AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, pre-trained models, operating / interaction systems, and mechatronics. Pre-trained models, also known as large models or basic models, can be fine-tuned and widely applied to downstream tasks across various AI disciplines. AI software technologies primarily encompass computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0071] Machine Learning (ML) is a multi-disciplinary interdisciplinary subject involving probability theory, statistics, approximation theory, convex analysis, algorithmic complexity theory and other disciplines. It specializes in studying how computers simulate or implement human learning behavior to acquire new knowledge or skills, and reorganize existing knowledge structures to continuously improve their own performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all areas of artificial intelligence. Machine learning and deep learning generally include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and self-learning. The pre-trained model is the latest development in deep learning, which integrates the above technologies. The embodiment of the present application mainly involves training a behavior analysis model based on a sample data set to further improve the accuracy of the prediction results of the behavior analysis model.

[0072] Based on the above-mentioned technologies related to cloud technology and artificial intelligence, the embodiments of the present application provide a data processing solution that can ensure the security and privacy of data when the data requester accesses network resources. Figure 1 A data processing scenario diagram provided in an embodiment of the present application, such as Figure 1 As shown, the data processing scenario provided by the present application includes a terminal device 101 and a server 102, and the data processing solution provided by the present application can be executed by the server 102. Among them, the terminal device may include but is not limited to: smart phones (such as Android phones, IOS phones, etc.), tablet computers, portable personal computers, mobile Internet devices (Mobile Internet Devices, referred to as MID), intelligent voice interaction devices, smart home appliances, vehicle terminals, aircraft, wearable devices, etc., and the embodiments of the present application do not limit this; the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms, and the embodiments of the present application do not limit this.

[0073] It should be noted that Figure 1 The number of terminal devices 101 and servers 102 is only for example and does not constitute an actual limitation of this application. The terminal devices 101 and servers 102 can be connected via wired or wireless means, and this application does not impose any limitation on this.

[0074] The general process of the data processing solution provided in this application is as follows:

[0075] (1) The terminal device 101 sends a data request to the server 102. The data request includes the requested data and the identity of the terminal device 101. The identity can be a certificate assigned by the server 102, and the certificates assigned by the server 102 are different for different users. After receiving the data request sent by the terminal device 101, the server 102 verifies the identity of the terminal device 101. If the identity of the terminal device 101 passes the verification, the server 102 dynamically allocates a virtual address to the terminal device 101. After the identity of the terminal device 101 passes the verification, the agent process running in the server 102 can obtain the identity of the data requester and the virtual address of the data requester.

[0076] (2) After obtaining the identity of the requester and the virtual address of the data requester, the server 102 generates a data filtering rule corresponding to the virtual address based on the identity of the data requester. The data filtering rule is configured based on policy parameters, and the policy parameters are obtained from the target group, the identifier of the target group matches the identity of the data requester. In one embodiment, the server 102 caches an access permission set, and the access permission set includes M groups, different groups contain different policy parameters, and M is a positive integer. If the target group exists in the access permission set, the computer device obtains the policy parameters in the target group and configures the data filtering rule corresponding to the virtual address based on the policy parameters.

[0077] (3) After generating the data filtering rules corresponding to the virtual address, server 102 filters the data to be transmitted corresponding to the virtual address according to the data filtering rules and transmits the data that meets the transmission conditions to the data requester. In other words, server 102 can filter the transmitted data according to the data filtering rules (e.g., remove data that terminal device 101 does not have access rights to), thereby achieving the purpose of controlling the data access rights of terminal device 101, thereby ensuring the security and privacy of data during the process of terminal device 101 accessing resources in server 102.

[0078] In an embodiment of the present application, when a data requester passes identity authentication, the data requester's identity and virtual address are obtained. Based on the data requester's identity, a data filtering rule corresponding to the virtual address is generated. The data filtering rule is configured based on policy parameters. The policy parameters are obtained from a target group. The target group's identity matches the data requester's identity. The data to be transmitted corresponding to the virtual address is filtered according to the data filtering rule, and the data that meets the transmission conditions is transmitted to the data requester. It can be seen that the association between the data requester's virtual address and the target group can be established through the data requester's identity. Then, based on the policy parameters in the target group, the data filtering rule corresponding to the virtual address is configured. This ensures the security and privacy of data during the data requester's access to network resources.

[0079] Based on the above data processing scheme, the embodiment of the present application proposes a more detailed data processing method. The data processing method proposed in the embodiment of the present application will be introduced in detail below with reference to the accompanying drawings.

[0080] See also Figure 2 , Figure 2 This is a flowchart of a data processing method provided in an embodiment of the present application. The data processing method can be executed by a computer device; the computer device can specifically be Figure 1 As shown in the server 102. Figure 2 As shown, the data processing method may include but is not limited to S201-S203:

[0081] S201. When the data requester passes identity authentication, obtain the identity identifier and virtual address of the data requester.

[0082] The identity identifier is used to distinguish different data requesters. Specifically, the identity identifier may include, but is not limited to, a certificate and a token. The certificate may be assigned by a computer device to the data requester, and different data requesters may have different certificates. The token is authenticated by a third party (based on the data requester's identity identifier) ​​and provided to the computer device (by the third party) after the data requester passes the identity authentication (the computer device can synchronize the data requester's organizational structure from the third party). Different data requesters have different corresponding tokens. The virtual address is dynamically assigned by the computer device to the data requester after determining that the data requester has passed the identity authentication; that is, the virtual address assigned to the same data requester after passing the identity authentication twice may be different.

[0083] In one embodiment, a computer device obtains a data request sent by a data requester, the data request carrying the data requester's identity. The computer device verifies the data requester's identity and, after the data requester's identity is verified, dynamically allocates a virtual address to the data requester. The computer device runs a proxy process (for data security). If the data requester passes identity authentication, the proxy process obtains the data requester's identity and virtual address. For example, the proxy process can obtain the data requester's identity and virtual address by triggering a process hook.

[0084] S202: Generate a data filtering rule corresponding to the virtual address based on the identity identifier of the data requester.

[0085] The data filtering rules corresponding to the virtual address are used to filter data transmitted to the virtual address. The data filtering rules are configured based on policy parameters, which are obtained from the target group whose identifier matches the identity of the data requester.

[0086] In one embodiment, a computer device caches an access permission set, which includes M groups, different groups contain different policy parameters, and M is a positive integer. The computer device detects whether there is a target group in the access permission set whose identifier matches the identity identifier of the data requester. If the target group exists in the access permission set, the computer device obtains the policy parameters in the target group and configures the data filtering rules corresponding to the virtual address based on the policy parameters. Among them, the policy parameters may include but are not limited to: network segment, address, port. It can be understood that when the policy parameter is a network segment or address, it means that the data requester can access the data in the network segment or the address (that is, the data obtained from the network segment or the address is data that meets the transmission conditions); when the policy parameter is a port, it means that the data requester can access the data through the port (that is, the data transmitted by the port is data that meets the transmission conditions).

[0087] As can be seen from the above, the data access rights of different data requesters (ie, the data filtering rules corresponding to the virtual addresses) can be configured more finely and accurately through the policy parameters.

[0088] Accordingly, if the target group does not exist in the access permission set, the computer device configures a data filtering rule corresponding to the virtual address based on the preset parameters. If the data filtering rule is obtained based on the preset parameters, then after filtering based on the data filtering rule, the data that meets the transmission conditions is either non-privacy data (such as public data, prompt information, etc.) or empty (i.e., any data transmission is rejected).

[0089] In another embodiment, a computer device obtains a certificate or token from a data requester. If the certificate or token is included in a target policy group, the computer device configures the identifier of the target policy group as the identity of the data requester. Based on the identity of the data requester, a data filtering rule corresponding to the virtual address is generated. Essentially, this establishes an association between different certificates and the same policy group. By configuring the identity of the data requester as the identifier of the target policy group, data filtering rules can be configured for data requesters in batches (e.g., by configuring data filtering rules by company department), improving the efficiency of permission configuration.

[0090] S203: Filter the data to be transmitted corresponding to the virtual address according to the data filtering rule, and transmit the data that meets the transmission conditions to the data requester.

[0091] In one embodiment, the policy parameters include a target network segment, and each data to be transmitted is associated with a data address. The computer device filters the data to be transmitted corresponding to the virtual address according to the data filtering rule, including: if the data address of the data to be transmitted belongs to the target network segment, the computer device determines the data to be transmitted as data that meets the transmission conditions; correspondingly, if the data address of the data to be transmitted does not belong to the target network segment, the computer device determines the data to be transmitted as data that does not meet the transmission conditions.

[0092] In another embodiment, the policy parameters include a target address, and each data to be transmitted is associated with a data address. The computer device filters the data to be transmitted corresponding to the virtual address according to the data filtering rule, including: if the data address of the data to be transmitted matches (e.g., is identical to) the target address, the computer device determines the data to be transmitted as data that meets the transmission condition; and correspondingly, if the data address of the data to be transmitted does not match (e.g., is different from) the target address, the computer device determines the data to be transmitted as data that does not meet the transmission condition.

[0093] In another embodiment, the policy parameters include a first port, and each data to be transmitted is associated with a port (e.g., the data to be transmitted is transmitted via the associated port). The process of the computer device filtering the data to be transmitted corresponding to the virtual address according to the data filtering rule includes: if the port of the data to be transmitted matches the first port, the computer device determining the data to be transmitted as data that meets the transmission condition; correspondingly, if the port of the data to be transmitted does not match the first port, the computer device determining the data to be transmitted as data that does not meet the transmission condition.

[0094] In another embodiment, during the process of filtering the data to be transmitted corresponding to the virtual address according to the data filtering rules, if it is detected that the policy parameters in the target group have been updated, the computer device obtains the updated policy parameters and, based on the updated policy parameters, updates the data filtering rules corresponding to the virtual address to obtain updated data filtering rules. After obtaining the updated data filtering rules, the computer device continues to filter the unfiltered data to be transmitted using the updated data filtering rules. Thus, by using data filtering rules and target groups, data filtering and policy updates can be decoupled, enabling updates to data filtering rules during user data access.

[0095] After obtaining data that meets the transmission conditions (i.e., the data to be transmitted after filtering according to the data filtering rules), the computer device transmits the data that meets the transmission conditions to the data requester (refuses to transmit data that does not meet the transmission conditions to the data requester).

[0096] In an embodiment of the present application, when a data requester passes identity authentication, the data requester's identity and virtual address are obtained. Based on the data requester's identity, a data filtering rule corresponding to the virtual address is generated. The data filtering rule is configured based on policy parameters. The policy parameters are obtained from a target group. The target group's identity matches the data requester's identity. The data to be transmitted corresponding to the virtual address is filtered according to the data filtering rule, and the data that meets the transmission conditions is transmitted to the data requester. It can be seen that the association between the data requester's virtual address and the target group can be established through the data requester's identity. Then, based on the policy parameters in the target group, the data filtering rule corresponding to the virtual address is configured. This ensures the security and privacy of data during the data requester's access to network resources.

[0097] See also Figure 3 , Figure 3 This is a flowchart of another data processing method provided in an embodiment of the present application. The data processing method can be executed by a computer device; the computer device can specifically be Figure 1 As shown in the server 102. Figure 3 As shown, the data processing method may include but is not limited to S301-S308:

[0098] S301: Obtain an access permission set and cache the access permission set.

[0099] Access permission sets can be configured by an administrator or synchronized from a controller. The controller controls the transmission and access of data (e.g., data in a private cloud) and automatically maintains access permission sets; for example, it can update the network segments (policy parameters) in one or more groups within the access permission set. An access permission set consists of M groups, each containing different policy parameters, where M is a positive integer.

[0100] In one embodiment, the group can specifically be an Ipset group. Ipset is a tool in Linux that allows administrators to create and manage sets of IP addresses, networks, (TCP / UDP) port numbers, and MAC addresses. These sets can be used by iptables, nftables, or other network filtering tools to perform more efficient network filtering. For example, assuming that the employees of the Network Platform Department are a group, and the employees of the Network Platform Department are allowed to access the network segments 1.1.1.0 / 24 and 2.2.2.0 / 24, then the group (ipset group) name is configured as: Network Platform Department, and the ipset group stores: 1.1.1.0 / 24 and 2.2.2.0 / 24 (i.e., policy parameters).

[0101] After obtaining the access permission set, the computer device can cache the access permission set. Compared to issuing permission rules upon receiving a data request from the data requester, caching the access permission set can reduce the amount of data involved in the data request and improve the response speed of data requests (such as the response speed of tunnel establishment).

[0102] Furthermore, when updated data for the access permission set is obtained, the computer device can update the cached access permission set based on the updated data to obtain an updated access permission set; in one embodiment, the computer device first adds new data to the cached access permission set based on the updated data, and then deletes the data that needs to be deleted from the cached access permission set based on the updated data.

[0103] S302: Obtain access policy configuration information.

[0104] The access policy configuration information may be used to indicate whether the access policy is configured according to the access permission set.

[0105] S303: Based on the access policy configuration information, determine whether to configure the access policy through the access permission set.

[0106] If the access policy configuration information indicates that the access policy is not configured according to the access permission set, the computer device continues to execute S304; correspondingly, if the access policy configuration information indicates that the access policy is configured according to the access permission set, the computer device continues to execute S305.

[0107] S304. Accept all data requests.

[0108] In one embodiment, the computer device accepts all data requests or processes the data requests according to default rules.

[0109] S305: When the data requester passes the identity authentication, obtain the identity identifier and virtual address of the data requester.

[0110] In one embodiment, the computer device obtains the data request sent by the data requester and verifies the identity of the data requester carried in the data request. If the identity of the data requester passes the verification, the computer device can establish a tunnel with the data requester; for example, a tunnel is established between the client in the data requester and the computer device gateway, and the computer device gateway dynamically allocates a virtual address (i.e., the virtual address of the data requester) to the client. When the data requester passes the identity authentication, the computer device gateway can obtain the identity of the data requester and the virtual address of the data requester by triggering a process hook. After establishing a tunnel with the data requester, the data requester can access the resources in the computer device (such as cloud files in a private cloud) through the established tunnel. All data packets sent by the computer device to the data requester can be filtered by the data filtering rules in S306 before being transmitted through the tunnel.

[0111] S306: Generate a data filtering rule corresponding to the virtual address based on the identity identifier of the data requester.

[0112] In one embodiment, a network filtering tool (such as iptables, nftables, etc.) can be used to generate data filtering rules corresponding to a virtual address based on the identity of the data requester. Taking iptables as an example, the process of a computer device generating data filtering rules corresponding to a virtual address based on the identity of the data requester includes: detecting whether iptables is empty, and if iptables is not empty, clearing iptables; on the one hand, setting the last (lowest priority) rule in iptables, which is used to indicate that the data requester is denied a request (access) to any data in the computer device; on the other hand, setting the first (highest priority) rule in iptables according to the access policy configuration information, if the access policy configuration information indicates that the access policy is not configured according to the access permission set, the first rule can be configured to accept all data requests; if the access policy configuration information indicates that the access policy is configured according to the access permission set, then based on the identity of the data requester, reading the policy parameters in the corresponding ipset group, and configuring one or more rules according to the policy parameters. Optionally, the computer device can also be configured with the penultimate rule (whose priority is only higher than the last rule), which is used to accept requests for non-privacy data (public data); for example, employees in different functional departments of the same company can not only access the data of their own department, but are also allowed to access company announcement data.

[0113] The ipset group enables efficient and rapid configuration of data filtering rules. Compared to chain matching methods based on a large number of rules, it has higher performance and supports the configuration of a large number of group policy rules while ensuring data forwarding capabilities. Based on iptables+ipset, efficient matching of filtering rules and separation of forwarding control are achieved, solving the performance loss caused by chain matching methods and supporting the configuration of a large number of fine-grained rules while ensuring forwarding performance. The data processing method provided in this application can meet the management party's demand for fine-grained access control of the access behavior and access scope of the data requester.

[0114] S307: Filter the data to be transmitted corresponding to the virtual address according to the data filtering rule, and transmit the data that meets the transmission conditions to the data requester.

[0115] In one embodiment, the policy parameters include at least one of a target network segment and a target address, and each data to be transmitted is associated with a source address and a destination address. The computer device obtains the data to be transmitted. If the destination address of the data to be transmitted matches the policy parameters in the data filtering rule corresponding to the virtual address, and the source address of the data to be transmitted matches the virtual address, the computer device determines the data to be transmitted as data that meets the transmission conditions. Correspondingly, if the destination address of the data to be transmitted does not match the policy parameters in the data filtering rule corresponding to the virtual address, or the source address of the data to be transmitted does not match the virtual address, the computer device determines the data to be transmitted as data that does not meet the transmission conditions. The computer device transmits the data that meets the transmission conditions to the data requester and discards the data that does not meet the transmission conditions.

[0116] Simply put, when a data packet passes through the gateway, the gateway will check the source address and destination address of each data packet. When the source address matches the virtual address, and the destination address matches the policy parameters in the data filtering rule corresponding to the virtual address, the gateway will transmit the data packet. For example, suppose the source address is the IP address of an employee of the Network Platform Department, and the policy parameters in the data filtering rule corresponding to the virtual address are 1.1.1.0 / 24 (representing 0-24) and 2.2.2.0 / 24. If the source address of Data Packet 1 matches the IP address of an employee of the Network Platform Department, and the destination address is 3.3.3.3 (which does not match the policy parameters in the data filtering rule corresponding to the virtual address), the computer device will discard Data Packet 1. If the source address of Data Packet 1 matches the IP address of an employee of the Network Platform Department, and the destination address is 2.2.2.3 (which matches the policy parameters in the data filtering rule corresponding to the virtual address), the computer device will transmit Data Packet 2.

[0117] In another embodiment, the policy parameters include a first port, and each data to be transmitted is associated with a port and a source address. The computer device obtains the data to be transmitted. If the source address of the data to be transmitted matches the virtual address, and the port of the data to be transmitted matches the first port, the computer device determines the data to be transmitted as meeting the transmission conditions. Correspondingly, if the source address of the data to be transmitted does not match the virtual address, or the port of the data to be transmitted does not match the first port, the computer device determines the data to be transmitted as not meeting the transmission conditions. The computer device transmits the data that meets the transmission conditions to the data requester and discards the data that does not meet the transmission conditions.

[0118] In another embodiment, the computer device obtains network connection information of the data requester; for example, the computer device may obtain all network connection information (including but not limited to TCP, UDP, and ICMP) through conntrack. Conntrack is used (in Linux) to display and manage the network connection monitoring table in the kernel. The network connection monitoring table is where the kernel monitors the status of all network connections, such as the establishment, maintenance, and removal of TCP connections.

[0119] In one embodiment, after obtaining the network connection information of the data requester, the computer device can associate and store the network connection information, virtual address and identity identifier; for example, the computer device can retrieve and associate the user identifier through the virtual address, record and report the network connection information for review by the administrator.

[0120] In another embodiment, after obtaining the network connection information of the data requester, the computer device may output an alarm prompt when it detects that the network connection information meets an alarm condition; wherein the alarm condition includes: detecting that the data requester has requested to obtain data through the second port a number of times exceeding a quantity threshold, or detecting that the data requester has requested to obtain data at the target address a number of times exceeding a quantity threshold; and the second port and the target address are not included in the policy parameters. For example, if it is detected through the network connection information that the data requester has attempted to obtain data outside of its permission multiple times (a number exceeding the number threshold), an alarm prompt is output.

[0121] In another embodiment, after obtaining the network connection information of the data requester, the computer device can analyze the network connection information of the user (data requester) through a behavior analysis model to obtain a behavior analysis result, and the behavior analysis result is used to indicate whether the user has malicious intent; wherein the behavior analysis model is trained based on a sample data set, specifically, the sample data set includes sample data and verification data corresponding to the sample data, the computer device calls the model to be trained to analyze the sample data to obtain a prediction result, and then trains the model to be trained based on the difference between the prediction result and the verification data corresponding to the sample data (such as adjusting the parameters in the model to be trained so that the difference is less than a difference threshold) to obtain a behavior analysis model.

[0122] S308: When it is detected that the data requester ends the data access, the data filtering rule corresponding to the virtual address is deleted.

[0123] In one embodiment, when it is detected that the data requester ends data access (such as the data requester disconnects or removes the tunnel), the computer device can delete the data filtering rule corresponding to the virtual address by triggering a hook on the disconnect process.

[0124] Figure 4a This is an architectural diagram of a computer device provided in an embodiment of the present application. Figure 4a As shown, the computer device may include a group policy access control module, an access logging module, and a tunnel forwarding module. The group policy access control module is responsible for configuring data filtering rules and filtering data requests. The access logging module is responsible for monitoring the access behavior of data access parties and generating overlay access behavior logs. The tunnel forwarding module is responsible for forwarding tunnel traffic through the basic gateway. By detecting and logging the source and destination of overlay connections, administrators can gain insight into client access behavior and improve security protection capabilities without modifying the OpenVPN logging system and incurring additional performance overhead.

[0125] Figure 4b A data interaction flow chart provided in the embodiment of this application. Figure 4b As shown, the computer device may include a gateway service (openVPN sever), an agent process (sslvpn-agent) and a controller. The agent process obtains the access policy configuration information sent by the controller, and configures the access policy according to the access policy configuration information. Specifically, if the access policy configuration information indicates that the access policy is not configured through the access permission set, all data requests are accepted; if the access policy configuration information indicates that the access policy is configured through the access permission set, the access policy is configured through the access permission set. When the agent process obtains the updated data for the access permission set sent by the controller, the cached access permission set is updated based on the updated data to obtain an updated access permission set. When the data requester (openVPN client) establishes a connection with the gateway service (that is, the identity of the data requester is authenticated), the agent process obtains the identity of the data requester and the virtual address dynamically assigned to the data requester by the gateway service, and generates data filtering rules corresponding to the virtual address based on the identity of the data requester. For specific implementation methods, please refer to Figure 2 S202 or Figure 3 S306 in the above section will not be described in detail here. After obtaining the data filtering rules, the transmitted data can be filtered based on the data filtering rules to ensure data security and privacy. When it is detected that the data requester has ended data access, the disconnect hook is triggered. The gateway service can send a disconnect notification to the proxy process, and the proxy process deletes the data filtering rules corresponding to the virtual address.

[0126] Figure 4c This is a schematic diagram of an application scenario provided by an embodiment of the present application. Figure 4cAs shown, the gateway administrator can enable access policy configuration through access permission sets to achieve flexible configuration of the accessible data range of different access clients accessing the same VPC (that is, the accessible data range of different clients can be configured to be different). Specifically, after enabling group policy access restrictions, the agent process generates data filtering rules corresponding to the virtual address assigned to the data requester based on the identity of the data requester. For example, the network segment of the private cloud is 10.0.0.1 / 16, the URL of area 1 is 10.0.0.1, the URL of area 2 is 10.0.0.3, resource file 1 is stored in area 1, and resource file 2 and resource file 3 are stored in area 3. After enabling group policy access restrictions, employee B's certificate identifier (identity identifier) ​​corresponds to the identifier of group 1, and group 1 includes the policy parameter "10.0.0.1", and supervisor A's certificate identifier (personal identifier) ​​corresponds to the identifier of group 2, and group 1 includes the policy parameters "10.0.0.1" and "10.0.0.3". Therefore, employee B is only allowed to access resource file 1 (when employee B requests access to resource file 3, resource file 3 will be discarded before transmission because it does not meet the transmission conditions), and supervisor A is allowed to access resource files 1-resource file 3 in the private cloud. At the same time, the access behavior of employee B and supervisor A can also be monitored and access records can be generated. The access record can include the data requester's personal identification, the address requested for access (it can also be a port, etc.), the resource file requested for access, and the access result. It is understandable that the data involved in this application (such as website address, network segment, etc.) is only used for example and does not constitute an actual limitation of this application.

[0127] In an embodiment of the present application, when the data requester passes identity authentication, the identity identifier of the data requester and the virtual address of the data requester are obtained, and based on the identity identifier of the data requester, data filtering rules corresponding to the virtual address are generated. The data filtering rules are configured based on policy parameters. The policy parameters are obtained from the target group. The identifier of the target group matches the identity identifier of the data requester. The data to be transmitted corresponding to the virtual address is filtered according to the data filtering rules, and the data that meets the transmission conditions is transmitted to the data requester. It can be seen that through the identity identifier of the data requester, the association between the virtual address of the data requester and the target group can be established. Then, based on the policy parameters in the target group, the data filtering rules corresponding to the virtual address are configured, which can ensure the security and privacy of the data during the process of the data requester accessing network resources. In addition, by detecting and recording the source and destination of the overlay connection, the administrator can gain insight into the client access behavior and improve security protection capabilities without modifying the OpenVPN log system, avoiding additional performance overhead.

[0128] The above describes in detail the method of the embodiment of the present application. In order to facilitate better implementation of the above scheme of the embodiment of the present application, the device of the embodiment of the present application is provided below accordingly.

[0129] See Figure 5 , Figure 5 This is a structural diagram of a data processing device provided in an embodiment of the present application. The device can be mounted on a computer device, which can be specifically Figure 1 Server 102 is shown. Figure 5 The data processing device shown can be used to perform the above Figure 2 and Figure 3 Some or all of the functions described in the method embodiments. Figure 5 , the detailed description of each unit is as follows:

[0130] The acquisition unit 501 is used to acquire the identity identifier and virtual address of the data requester when the data requester passes the identity authentication. The virtual address is dynamically allocated after the data requester passes the identity authentication.

[0131] Processing unit 502, configured to generate a data filtering rule corresponding to the virtual address based on the identity of the data requester, wherein the data filtering rule is configured based on a policy parameter obtained from a target group whose identity matches the identity of the data requester;

[0132] The device is used to filter the data to be transmitted corresponding to the virtual address according to the data filtering rule, and transmit the data meeting the transmission conditions to the data requester through the sending unit 503.

[0133] In one embodiment, the processing unit 502 is configured to generate a data filtering rule corresponding to the virtual address based on the identity identifier of the data requester, specifically to:

[0134] Check whether there is a target group in the access permission set whose identifier matches the identity identifier of the data requester. The access permission set includes M groups, and different groups contain different policy parameters. M is a positive integer.

[0135] If the target group exists in the access permission set, obtain the policy parameters in the target group and configure the data filtering rules corresponding to the virtual address based on the policy parameters;

[0136] If the target group does not exist in the access permission set, the data filtering rules corresponding to the virtual address are configured based on the preset parameters.

[0137] In one embodiment, the process of the processing unit 502 filtering the to-be-transmitted data corresponding to the virtual address according to the data filtering rule includes:

[0138] When it is detected that the policy parameters in the target group are updated, the updated policy parameters are obtained;

[0139] Based on the updated policy parameters, the data filtering rule corresponding to the virtual address is updated to obtain an updated data filtering rule;

[0140] The unfiltered data to be transmitted is filtered using the updated data filtering rules.

[0141] In one embodiment, the policy parameters include at least one of a target network segment and a target address, and each data to be transmitted is associated with a data address; the processing unit 502 is configured to filter the data to be transmitted corresponding to the virtual address according to the data filtering rule, specifically to:

[0142] If the data address of the data to be transmitted matches the policy parameter, the data to be transmitted is determined to be data that meets the transmission condition;

[0143] If the data address of the data to be transmitted does not match the policy parameters, the data to be transmitted is determined to be data that does not meet the transmission conditions.

[0144] In one embodiment, the policy parameters include a first port, and each data to be transmitted is associated with a port; the processing unit 502 is configured to filter the data to be transmitted corresponding to the virtual address according to the data filtering rule, specifically to:

[0145] If the port of the data to be transmitted matches the first port, determining the data to be transmitted as data that meets the transmission condition;

[0146] If the port of the data to be transmitted does not match the first port, the data to be transmitted is determined as data that does not meet the transmission condition.

[0147] In one embodiment, the processing unit 502 is further configured to:

[0148] When it is detected that the data requester ends the data access, the data filtering rule corresponding to the virtual address is deleted.

[0149] In one embodiment, the processing unit 502 is further configured to:

[0150] Obtain an access permission set and cache the access permission set. The access permission set includes M groups, and different groups contain different policy parameters. M is a positive integer.

[0151] When updated data for the access permission set is obtained, the cached access permission set is updated based on the updated data to obtain an updated access permission set.

[0152] In one embodiment, the processing unit 502 is further configured to:

[0153] Obtain the network connection information of the data requester;

[0154] Associate and store network connection information, virtual address and identity; or,

[0155] When it is detected that the network connection information meets the alarm conditions, an alarm prompt is output;

[0156] Among them, the alarm conditions include: detecting that the number of times the data requester requests to obtain data through the second port is greater than the quantity threshold, or detecting that the number of times the data requester requests to obtain data in the target address is greater than the quantity threshold; the second port and the target address are not included in the policy parameters.

[0157] In one embodiment, the processing unit 502 is further configured to:

[0158] Get access policy configuration information;

[0159] If the access policy configuration information indicates that the access policy is not configured through the access permission set, all data requests are accepted; the target group is included in the access permission set;

[0160] If the access policy configuration information indicates that the access policy is configured through the access permission set, then the step of obtaining the identity identifier and virtual address of the data requester is continued when the data requester passes the identity authentication.

[0161] In one embodiment, the identity identifier includes at least one of a certificate and a token of the data requester; the token is provided by the third party after the third-party data requester passes the identity authentication of the third party.

[0162] In one embodiment, the processing unit 502 is configured to obtain the identity of the data requester, specifically to:

[0163] Obtain the certificate or token of the data requester;

[0164] If the data requester's certificate or token is included in the target policy group, the identifier of the target policy group is configured as the identity identifier of the data requester.

[0165] According to one embodiment of the present application, Figure 2 and Figure 3 Some of the steps involved in the data processing method shown can be represented by Figure 5 The data processing apparatus shown in FIG. Figure 2 The S201 shown in FIG can be Figure 5 The acquisition unit 501 shown in FIG. 5 is executed, and S202 can be performed by Figure 5 The processing unit 502 shown in FIG. 5 is executed, and S203 can be performed by Figure 5 The processing unit 502 and the sending unit 503 shown are executed in cooperation. Figure 3 S301, S302 and S305 shown in FIG can be made by Figure 5 The acquisition unit 501 shown in FIG. 5 is executed, and S303, S304, S306 and S308 can be performed by Figure 5 The processing unit 502 shown in FIG. 5 is executed, and S307 can be performed by Figure 5 The processing unit 502 and the sending unit 503 shown are executed in cooperation. Figure 5 The various units in the data processing apparatus shown can be separately or all merged into one or several other units to constitute, or a certain unit (or units) therein can also be split into multiple smaller units in function to constitute, which can achieve the same operation without affecting the realization of the technical effects of the embodiments of the present application. The above-mentioned units are divided based on logical functions. In practical applications, the function of a unit can also be realized by multiple units, or the function of multiple units can be realized by one unit. In other embodiments of the present application, the data processing apparatus may also include other units. In practical applications, these functions can also be implemented with the assistance of other units, and can be implemented by the collaboration of multiple units.

[0166] According to another embodiment of the present application, the program can be executed by running on a general computing device such as a computer including a central processing unit (CPU), a random access memory (RAM), a read-only memory (ROM) and other processing elements and storage elements. Figure 2 and Figure 3 A computer program (including program code) for each step involved in the corresponding method shown in Figure 5 The data processing device shown in and the data processing method of the embodiment of the present application are implemented. The computer program can be recorded on a computer-readable recording medium, for example, and loaded into the above-mentioned computing device through the computer-readable recording medium and run therein.

[0167] Based on the same inventive concept, the principles and beneficial effects of solving problems by the data processing device provided in the embodiment of the present application are similar to the principles and beneficial effects of solving problems by the data processing method in the method embodiment of the present application. Please refer to the principles and beneficial effects of the implementation of the method. For the sake of concise description, they will not be repeated here.

[0168] See also Figure 6 , Figure 6 A schematic diagram of the structure of a computer device provided in an embodiment of the present application is shown in FIG. Figure 6As shown, the computer device includes at least a processor 601, a communication interface 602, and a memory 603. The processor 601, communication interface 602, and memory 603 may be connected via a bus or other means. The processor 601 (also known as the Central Processing Unit (CPU)) is the computing and control core of the computer device. It can parse various instructions within the computer device and process various data within the computer device. For example, the CPU can be used to parse power on and off commands sent by the user to the computer device and control the computer device to perform power on and off operations. Another example is that the CPU can transmit various interactive data between the internal structures of the computer device, etc. The communication interface 602 may optionally include a standard wired interface or a wireless interface (such as Wi-Fi, a mobile communication interface, etc.), which can be used to send and receive data under the control of the processor 601. The communication interface 602 can also be used for data transmission and interaction within the computer device. The memory 603 is a storage device within the computer device, used to store programs and data. It is understood that the memory 603 here can include both the built-in memory of the computer device and the extended memory supported by the computer device. The memory 603 provides a storage space that stores the operating system of the computer device, which may include but is not limited to: Android system, iOS system, Windows Phone system, etc., and this application does not limit this.

[0169] The embodiment of the present application also provides a computer-readable storage medium (Memory), which is a memory device in a computer device for storing programs and data. It is understandable that the computer-readable storage medium here can include both built-in storage media in the computer device and, of course, extended storage media supported by the computer device. The computer-readable storage medium provides a storage space that stores the processing system of the computer device. In addition, one or more instructions suitable for being loaded and executed by the processor 601 are also stored in the storage space. These instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as at least one disk memory; optionally, it can also be at least one computer-readable storage medium located away from the aforementioned processor.

[0170] In one embodiment, the computer device may be Figure 1 The server 102 shown in FIG. 1 is a processor 601 that executes the following operations by running the executable program code in the memory 603:

[0171] When the data requester passes identity authentication, the data requester's identity identifier and virtual address are obtained. The virtual address is dynamically allocated after the data requester passes identity authentication.

[0172] Based on the identity of the data requester, a data filtering rule corresponding to the virtual address is generated. The data filtering rule is configured based on policy parameters. The policy parameters are obtained from the target group. The target group's identity matches the data requester's identity.

[0173] The data to be transmitted corresponding to the virtual address is filtered according to the data filtering rules, and the data that meets the transmission conditions is transmitted to the data requester.

[0174] As an optional embodiment, the processor 601 generates a data filtering rule corresponding to the virtual address based on the identity identifier of the data requester. The specific embodiment is:

[0175] Check whether there is a target group in the access permission set whose identifier matches the identity identifier of the data requester. The access permission set includes M groups, and different groups contain different policy parameters. M is a positive integer.

[0176] If the target group exists in the access permission set, obtain the policy parameters in the target group and configure the data filtering rules corresponding to the virtual address based on the policy parameters;

[0177] If the target group does not exist in the access permission set, the data filtering rules corresponding to the virtual address are configured based on the preset parameters.

[0178] As an optional embodiment, the process of the processor 601 filtering the to-be-transmitted data corresponding to the virtual address according to the data filtering rule includes:

[0179] When it is detected that the policy parameters in the target group are updated, the updated policy parameters are obtained;

[0180] Based on the updated policy parameters, the data filtering rule corresponding to the virtual address is updated to obtain an updated data filtering rule;

[0181] The unfiltered data to be transmitted is filtered using the updated data filtering rules.

[0182] As an optional embodiment, the policy parameter includes at least one of a target network segment and a target address, and each data to be transmitted is associated with a data address; a specific embodiment in which the processor 601 filters the data to be transmitted corresponding to the virtual address according to the data filtering rule is as follows:

[0183] If the data address of the data to be transmitted matches the policy parameter, the data to be transmitted is determined to be data that meets the transmission condition;

[0184] If the data address of the data to be transmitted does not match the policy parameters, the data to be transmitted is determined to be data that does not meet the transmission conditions.

[0185] As an optional embodiment, the policy parameter includes a first port, and each data to be transmitted is associated with a port; a specific embodiment in which the processor 601 filters the data to be transmitted corresponding to the virtual address according to the data filtering rule is:

[0186] If the port of the data to be transmitted matches the first port, determining the data to be transmitted as data that meets the transmission condition;

[0187] If the port of the data to be transmitted does not match the first port, the data to be transmitted is determined as data that does not meet the transmission condition.

[0188] As an optional embodiment, the processor 601 further performs the following operations by running the executable program code in the memory 603:

[0189] When it is detected that the data requester ends the data access, the data filtering rule corresponding to the virtual address is deleted.

[0190] As an optional embodiment, the processor 601 further performs the following operations by running the executable program code in the memory 603:

[0191] Obtain an access permission set and cache the access permission set. The access permission set includes M groups, and different groups contain different policy parameters. M is a positive integer.

[0192] When updated data for the access permission set is obtained, the cached access permission set is updated based on the updated data to obtain an updated access permission set.

[0193] As an optional embodiment, the processor 601 further performs the following operations by running the executable program code in the memory 603:

[0194] Obtain the network connection information of the data requester;

[0195] Associate and store network connection information, virtual address and identity; or,

[0196] When it is detected that the network connection information meets the alarm conditions, an alarm prompt is output;

[0197] Among them, the alarm conditions include: detecting that the number of times the data requester requests to obtain data through the second port is greater than the quantity threshold, or detecting that the number of times the data requester requests to obtain data in the target address is greater than the quantity threshold; the second port and the target address are not included in the policy parameters.

[0198] As an optional embodiment, the processor 601 further performs the following operations by running the executable program code in the memory 603:

[0199] Get access policy configuration information;

[0200] If the access policy configuration information indicates that the access policy is not configured through the access permission set, all data requests are accepted; the target group is included in the access permission set;

[0201] If the access policy configuration information indicates that the access policy is configured through the access permission set, then the step of obtaining the identity identifier and virtual address of the data requester is continued when the data requester passes the identity authentication.

[0202] As an optional embodiment, the identity identifier includes at least one of a certificate and a token of the data requester; the token is provided by the third party after the third-party data requester passes the identity authentication of the third party.

[0203] As an optional embodiment, the specific embodiment of the processor 601 obtaining the identity of the data requester is:

[0204] Obtain the certificate or token of the data requester;

[0205] If the data requester's certificate or token is included in the target policy group, the identifier of the target policy group is configured as the identity identifier of the data requester.

[0206] Based on the same inventive concept, the principles and beneficial effects of solving problems with the computer device provided in the embodiment of the present application are similar to the principles and beneficial effects of solving problems with the data processing method in the method embodiment of the present application. Please refer to the principles and beneficial effects of the implementation of the method. For the sake of concise description, they will not be repeated here.

[0207] An embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored. The computer program is suitable for being loaded by a processor and executing the data processing method of the above method embodiment.

[0208] The present application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the above-described data processing method.

[0209] The steps in the method of the embodiment of the present application can be adjusted in order, combined and deleted according to actual needs.

[0210] The modules in the device of the embodiment of the present application can be merged, divided and deleted according to actual needs.

[0211] In the embodiments of the present application, the "module" or "unit" involved refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0212] A person skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, which can include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0213] The above disclosure is only a preferred embodiment of the present application, and certainly cannot be used to limit the scope of rights of the present application. Ordinary technicians in this field can understand that all or part of the processes of the above embodiment and equivalent changes made in accordance with the claims of this application are still within the scope covered by the application.

Claims

1. A data processing method, characterized in that: The method comprises: When the data requester passes the identity authentication, obtaining the identity identifier of the data requester and the virtual address of the data requester, where the virtual address is dynamically allocated after the data requester passes the identity authentication; Generating a data filtering rule corresponding to the virtual address based on the identity identifier of the data requester, wherein the data filtering rule is configured based on a policy parameter obtained from a target group whose identifier matches the identity identifier of the data requester; The data to be transmitted corresponding to the virtual address is filtered according to the data filtering rule, and the data meeting the transmission condition is transmitted to the data requester.

2. The method according to claim 1, wherein The generating of the data filtering rule corresponding to the virtual address based on the identity identifier of the data requester includes: Detecting whether there is a target group in the access permission set whose identifier matches the identity identifier of the data requester, wherein the access permission set includes M groups, different groups include different policy parameters, and M is a positive integer; If the target group exists in the access permission set, obtaining policy parameters in the target group, and configuring data filtering rules corresponding to the virtual address based on the policy parameters; If the target group does not exist in the access permission set, a data filtering rule corresponding to the virtual address is configured based on preset parameters.

3. The method according to claim 1, wherein The process of filtering the data to be transmitted corresponding to the virtual address according to the data filtering rule includes: When detecting that the policy parameters in the target group are updated, obtaining the updated policy parameters; Based on the updated policy parameters, the data filtering rule corresponding to the virtual address is updated to obtain an updated data filtering rule; The unfiltered data to be transmitted is filtered using the updated data filtering rules.

4. The method according to claim 1, wherein The policy parameter includes at least one of a target network segment and a target address, and each data to be transmitted is associated with a data address; and filtering the data to be transmitted corresponding to the virtual address according to the data filtering rule includes: If the data address of the data to be transmitted matches the policy parameter, determining the data to be transmitted as data that meets the transmission condition; If the data address of the data to be transmitted does not match the policy parameter, the data to be transmitted is determined as data that does not meet the transmission condition.

5. The method according to claim 1, wherein The policy parameters include a first port, and each data to be transmitted is associated with a port; filtering the data to be transmitted corresponding to the virtual address according to the data filtering rule includes: If the port of the data to be transmitted matches the first port, determining the data to be transmitted as data that meets the transmission condition; If the port of the data to be transmitted does not match the first port, the data to be transmitted is determined as data that does not meet the transmission condition.

6. The method according to claim 1, wherein The method further comprises: When it is detected that the data requester ends the data access, the data filtering rule corresponding to the virtual address is deleted.

7. The method according to claim 1, wherein The method further comprises: Obtaining an access permission set and caching the access permission set, wherein the access permission set includes M groups, different groups include different policy parameters, and M is a positive integer; When updated data for the access permission set is obtained, the cached access permission set is updated based on the updated data to obtain an updated access permission set.

8. The method according to claim 1, wherein The method further comprises: Obtaining network connection information of the data requester; storing the network connection information, the virtual address and the identity in association with each other; or When it is detected that the network connection information meets the alarm condition, an alarm prompt is output; The alarm condition includes: detecting that the number of times the data requester requests to obtain data through the second port is greater than a quantity threshold, or detecting that the number of times the data requester requests to obtain data in the target address is greater than a quantity threshold; the second port and the target address are not included in the policy parameters.

9. The method according to claim 1, wherein The method further comprises: Get access policy configuration information; If the access policy configuration information indicates that the access policy is not configured through the access permission set, all data requests are accepted; and the target group is included in the access permission set; If the access policy configuration information indicates that the access policy is configured through an access permission set, then the step of obtaining the identity identifier of the data requester and the virtual address of the data requester is continued when the data requester passes the identity authentication.

10. The method according to claim 1, wherein The identity identifier includes at least one of a certificate and a token of the data requester; the token is provided by the third party after the data requester passes the identity authentication of the third party.

11. The method according to claim 1, wherein The obtaining of the identity of the data requester includes: Obtaining the certificate or token of the data requester; If the certificate or token of the data requester is included in the target policy group, the identifier of the target policy group is configured as the identity identifier of the data requester.

12. A data processing device, characterized in that: The data processing device includes: an acquiring unit, configured to acquire, when the data requester passes identity authentication, an identity identifier of the data requester and a virtual address of the data requester, wherein the virtual address is dynamically allocated after the data requester passes identity authentication; a processing unit, configured to generate a data filtering rule corresponding to the virtual address based on the identity identifier of the data requester, wherein the data filtering rule is configured based on a policy parameter, the policy parameter being obtained from a target group whose identifier matches the identity identifier of the data requester; The device is used to filter the data to be transmitted corresponding to the virtual address according to the data filtering rule, and transmit the data meeting the transmission conditions to the data requester through the sending unit.

13. A computer device, characterized in that: include: a memory, wherein the computer program is stored in the memory; A processor, configured to load the computer program to implement the data processing method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor and executing the data processing method according to any one of claims 1 to 11.

15. A computer program product, characterized in that The computer program product comprises a computer program, and the computer program is suitable for being loaded by a processor and executing the data processing method according to any one of claims 1 to 11.

Images