Access method and system, access configuration method and system, electronic equipment and storage medium

Abstract

The invention provides an access method and system, an access configuration method and system, electronic equipment and a storage medium, and relates to the technical field of communication. The access method comprises the following steps: in response to an obtained access flow of accessing a second service system by a first service system, identifying whether an operation of the access flow has a security risk; the initial access address of the second service system is configured as the address of the security protection instance; the initial access address is the access address of the access traffic, so that the access traffic of the second service system can be obtained by the security protection instance and whether the operation of the access traffic has security risks or not can be identified, and the specific operation of the access traffic can be identified; further, if the access traffic does not have the security risk, forwarding the access traffic to the second service system; and if the access traffic has the security risk, intercepting the access traffic, thereby improving the security between service systems.

Description

Technical Field

[0001] The present disclosure belongs to the field of communication technology, and particularly relates to an access and access configuration method, system, electronic device, and storage medium. Background Art

[0002] Cloud applications are software deployed on cloud servers. Terminals access the corresponding cloud applications on cloud servers through the network. Cloud applications provide various business systems, which typically trust each other by default. To protect cloud applications, a network-layer solution is typically implemented by routing access traffic to firewalls located at the edge of the data center network.

[0003] In related technologies, firewall protection is at the network layer or transport layer. Therefore, the firewall mainly performs security identification of the destination address, access address, and protocol type when the access traffic first enters the cloud application. It cannot identify the specific operations of the access traffic. In addition, due to the mutual trust between various business systems, after the access traffic enters a business system in the cloud application, it may maliciously access other business systems from one business system, thereby reducing the security between business systems. Summary of the Invention

[0004] The present disclosure provides an access and access configuration method, system, electronic device and storage medium.

[0005] An embodiment of a first aspect of the present disclosure provides an access method, which is applied to a security protection instance. The method includes:

[0006] In response to obtaining access traffic from the first business system to the second business system, identifying whether the operation of the access traffic poses a security risk; the initial access address of the second business system is configured as the address of the security protection instance; the initial access address is the access address of the access traffic;

[0007] If the access traffic does not pose a security risk, forwarding the access traffic to the second business system according to the port from which the access traffic is obtained;

[0008] If there is a security risk in the access traffic, the access traffic is intercepted.

[0009] In the embodiment of the present disclosure, forwarding the access traffic to the second business system according to the port from which the access traffic is obtained includes:

[0010] Determine the port for obtaining access traffic; determine the real access address of the second business system based on the mapping relationship between the port and the real access address;

[0011] Modify the access address of the access traffic to the real access address;

[0012] The access traffic with the modified access address is sent to the second business system.

[0013] In the embodiment of the present disclosure, identifying whether the access traffic presents a security risk includes:

[0014] Determining a target encryption method for access traffic corresponding to the second business system based on a mapping relationship between the second business system and the encryption method;

[0015] Based on the target encryption method of the access traffic corresponding to the second business system, identify whether the access traffic has security risks.

[0016] In an embodiment of the present disclosure, identifying whether the access traffic presents a security risk based on the target encryption mode of the second business system includes:

[0017] If the target encryption mode is encrypted, obtaining a key corresponding to the second business system; decrypting the access traffic based on the key, and using a preset identification method to identify whether the decrypted access traffic has a security risk;

[0018] If the target encryption method is unencrypted, the preset identification method is used to identify whether the access traffic has a security risk.

[0019] In the embodiment of the present disclosure, the preset identification method is used to identify whether access traffic poses a security risk, including:

[0020] Parsing data in each field of the access traffic to be identified; the access traffic to be identified includes first access traffic or second access traffic, the first access traffic is decrypted encrypted access traffic, and the second access traffic is unencrypted access traffic;

[0021] For any field, based on the mapping relationship between the field and the preset regular expression, determine the target regular expression corresponding to the field;

[0022] The data in the field is verified using the target regular expression. If the data conforms to the target regular expression, there is no security risk; if the data conforms to the target regular expression, there is a security risk.

[0023] In the embodiment of the present disclosure, after intercepting the access traffic, the method further includes:

[0024] Obtaining a first operation log for identifying whether the access traffic has a security risk; and obtaining a second operation log for intercepting the access traffic;

[0025] Sending the first operation log and the second operation log to a security management platform so that the security management platform analyzes attack behaviors of access traffic based on the first operation log and the second operation log

[0026] An embodiment of a second aspect of the present disclosure provides an access configuration method, which is applied to a security management platform. The method includes:

[0027] Receive a first operation log and a second operation log of access traffic sent by a security protection instance; the access traffic is access traffic from a first business system to a second business system, and according to the access method described in the first aspect or any optional implementation manner of the first aspect, the access traffic is identified as having a security risk; the first operation log is a behavior log of the security protection instance identifying the access traffic; the second operation log is a behavior log of the security protection instance intercepting the access traffic;

[0028] The first operation log and the second operation log are analyzed to obtain attack behavior of the access traffic.

[0029] In an embodiment of the present disclosure, the method further includes:

[0030] An initial access address for each business system is configured, where the initial access address is the address of the security protection instance, so that access traffic for each business system is sent to the security protection instance for security risk detection.

[0031] In the embodiment of the present disclosure, the initial access address includes an Internet Protocol address and a port, and configuring the initial access address of each business system includes:

[0032] Configure the Internet Protocol address of each business system as the Internet Protocol address of the security protection instance; and configure the port for each business system to enter the security protection instance.

[0033] An embodiment of a third aspect of the present disclosure provides an access device, which is applied to a security protection instance. The device includes:

[0034] an identification module configured to, in response to obtaining access traffic from a first business system to a second business system, identify whether the operation of the access traffic poses a security risk; an initial access address of the second business system is configured as the address of the security protection instance; and the initial access address is the access address of the access traffic;

[0035] a forwarding module, configured to forward the access traffic to the second business system according to the port from which the access traffic is obtained, if the access traffic does not pose a security risk;

[0036] The interception module is used to intercept the access traffic if there is a security risk in the access traffic.

[0037] An embodiment of a fourth aspect of the present disclosure provides an access configuration device, which is applied to a security management platform. The device includes:

[0038] A receiving module, configured to receive a first operation log and a second operation log of access traffic sent by a security protection instance; the access traffic is access traffic from a first business system to a second business system, and the access traffic is identified as having a security risk;

[0039] An analysis module is used to analyze the first operation log and the second operation log to obtain attack behavior of the access traffic.

[0040] An embodiment of the fifth aspect of the present disclosure provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect or any optional implementation of the first aspect, or the second aspect and any optional implementation of the second aspect.

[0041] An embodiment of the sixth aspect of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the method described in the first aspect or any optional embodiment of the first aspect, or the second aspect and any optional embodiment of the second aspect.

[0042] The technical solutions provided in the embodiments of the present disclosure have at least the following technical effects or advantages:

[0043] The embodiment of the present disclosure identifies whether there is a security risk in response to obtaining access traffic from a first business system to a second business system; since the initial access address of the second business system is configured as the address of the security protection instance; the initial access address is the access address of the access traffic, and therefore the access traffic of the second business system can be obtained by the security protection instance and identified whether there is a security risk in the operation of the access traffic, thereby realizing the identification of the specific operation of the access traffic; further, if there is no security risk in the access traffic, it is forwarded to the second business system; if there is a security risk in the access traffic, the access traffic is intercepted, thereby improving the security between business systems.

[0044] Additional aspects and advantages of the present disclosure will be given in part in the following description and in part will become apparent from the following description or learned through practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Various other advantages and benefits will become apparent to those skilled in the art by reading the detailed description of the preferred embodiment below. The accompanying drawings are only for the purpose of illustrating the preferred embodiment and are not to be considered as limiting the present disclosure. In addition, the same reference numerals are used throughout the accompanying drawings to represent the same components.

[0046] In the attached figure:

[0047] Figure 1 A schematic diagram of a secure access system provided by an embodiment of the present disclosure is shown;

[0048] Figure 2 A flowchart of an access method provided by an embodiment of the present disclosure is shown;

[0049] Figure 3 A flowchart of an access configuration method provided by an embodiment of the present disclosure is shown;

[0050] Figure 4 A schematic structural diagram of an access device provided by another embodiment of the present disclosure is shown;

[0051] Figure 5 A schematic structural diagram of an access device provided by another embodiment of the present disclosure is shown;

[0052] Figure 6 A schematic structural diagram of an electronic device provided by an embodiment of the present disclosure is shown;

[0053] Figure 7 A schematic diagram of a storage medium provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0054] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0055] It should be noted that, unless otherwise specified, the technical or scientific terms used in the present disclosure should have the common meanings understood by those skilled in the art to which the present disclosure belongs.

[0056] The following introduces the implementation scenarios and related technologies involved in the embodiments of the present disclosure.

[0057] Cloud applications are software deployed on cloud servers. Terminals access corresponding cloud applications on cloud servers through the network. Cloud applications provide various types of business systems, each of which trusts the other. Security protection for cloud applications typically involves directing access traffic to firewalls deployed at the network or transport layer for identification.

[0058] In related technologies, firewalls are deployed at the network layer or transport layer. Therefore, the firewall only securely identifies the destination address, access address, and protocol type when the access traffic first enters the cloud application. It cannot identify the specific operations of the access traffic. Moreover, due to the mutual trust between business systems, after the access traffic enters a business system in the cloud application, it may maliciously access other business systems from one business system, thereby reducing the security between business systems.

[0059] In view of this, embodiments of the present disclosure provide an access and access configuration method, an electronic device, and a storage medium. The technical solutions of the present disclosure are described in detail below using specific embodiments. The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments. The embodiments of the present disclosure will be described below in conjunction with the accompanying drawings.

[0060] See also Figure 1 , Figure 1 The diagram of an exemplary system structure of the security access system provided by the present disclosure is shown. The security access system provided by the present disclosure includes a client 11 and a server 10, wherein the client 11 and the server 10 are connected via a network. The client can be hardware, such as electronic devices such as mobile phones, personal computers, tablet computers, wearable devices, etc.; it can also be an application (Application, APP) or software module deployed on an electronic device. The server 10 can be an independent physical server, or a server cluster composed of multiple physical servers, a distributed system or a cloud platform. The server 10 can deploy resources and computing power.

[0061] The access system provided by the embodiment of the present disclosure is deployed on a server 10 . The access system provided by the present disclosure includes at least two business systems 101 , a security protection instance 102 and a security management platform 103 . Figure 1 Only two business systems are used as an example for illustration. In the embodiment of the present disclosure, there is no limitation on the number of business systems 101 , and those skilled in the art can determine the number based on actual conditions.

[0062] Among them, the security management platform 103 is used to configure the initial access address of each business system. The initial access address is the address of the security protection instance, so that the access traffic for each business system is sent to the security protection instance for security risk detection. When the first business system accesses the second business system, the first business system sends access traffic to the second business system; the access address of the access traffic is the initial access address of the second business system; the initial access address of the second business system is the address of the security protection instance. In response to obtaining the access traffic from the first business system to the second business system, the security protection instance 103 identifies whether the access traffic poses a security risk; if the access traffic does not pose a security risk, the access traffic is forwarded to the second business system based on the port from which the access traffic was obtained; if the access traffic poses a security risk, the access traffic is intercepted.

[0063] In some embodiments, after the initial access address of each business system is configured through the management configuration unit, after the user accesses the first business system deployed on the server 10 through the client 11, access to the second business system through the first business system requires security detection by the security protection instance 102 before access is allowed. The security protection instance obtains the access traffic of the second business system and identifies whether the operation of the access traffic poses a security risk, thereby providing security isolation. In addition, the relevant log information of the access traffic with security risks can be sent to the situational awareness unit for analyzing the operational behavior of the access traffic with security risks, as well as the attack trend within a certain time period, thereby improving the security between business systems.

[0064] It is understood that the structure shown in the present disclosure does not constitute a specific limitation on the access system. In other embodiments of the present disclosure, the access system may include Figure 1 More or fewer devices may be shown in the figures, which is not limiting. Figure 1 The server 10 and client 11 are schematic diagrams at the logical function level. In actual implementation, the client 11 may include at least one electronic device entity, and the server 10 may include at least one server device entity. This is not limited here.

[0065] It should be understood that the algorithms and networks included in the above-mentioned analysis modules are illustrative examples of the present disclosure and do not limit the modules in the embodiments of the present disclosure. Those skilled in the art can flexibly deploy the algorithms included in the modules in the embodiments of the present disclosure according to actual circumstances. This is not a limitation here.

[0066] The following combination Figure 1 An exemplary embodiment is used to describe an access method proposed according to an embodiment of the present disclosure.

[0067] like Figure 2As shown, the embodiment of the present disclosure provides an access method, which can be applied to a security protection instance. The security protection instance can be Figure 1 The method includes:

[0068] In step S21 , in response to obtaining access traffic from the first business system to the second business system, it is identified whether the operation of the access traffic has a security risk.

[0069] The initial access address of the second business system is configured as the address of the security protection instance; the initial access address is the access address of the access traffic. The security protection instance can be a virtual machine deployed with the World Wide Web (Web) application protection system, or a server or host that is distinct from the business system and the security management platform.

[0070] Exemplarily, the first business system and the second business system can be different businesses corresponding to the same tenant. For example, if a tenant is a company, the business systems are different departments corresponding to the company, which can be the Finance Department, the Human Resources Department, etc. If the employee corresponding to the Human Resources Department successfully accesses the corresponding first business system (Human Resources Department) through the client, and then needs to access the second business system (Finance Department), in this case, the first business system accesses the second business system, and the traffic generated by the access is the access traffic. The corresponding first business system accesses the second business system and forwards the access traffic through the business switch.

[0071] In the embodiment of the present disclosure, the external access address (initial access address) of each business system is set to the address of the security protection instance. Therefore, the access traffic of the first business system to the second business system is sent to the security protection instance. After obtaining the access traffic, the security protection instance identifies whether the operation of the access traffic poses a security risk. In some embodiments, a normal behavior baseline can be established through machine learning (such as isolation forest, autoencoder) or statistical methods to detect whether the access traffic deviates from the baseline. For example, identify the packet size, frequency, and burst characteristics of the access traffic; identify whether the access time of the access traffic is an irregular access time, cross-regional access, etc.

[0072] In some embodiments, there are some business systems that need to be encrypted when accessed, and there are some business systems that do not need to be encrypted when accessed. The corresponding encryption and decryption methods between business systems that require encrypted access may be different. Therefore, after obtaining the access traffic, the security protection instance can decrypt the access traffic according to the encryption method corresponding to the second business system. Therefore, identifying whether there is a security risk in the access traffic includes: determining the target encryption method for the access traffic corresponding to the second business system based on the mapping relationship between the second business system and the encryption method; and identifying whether there is a security risk in the access traffic based on the target encryption method for the access traffic corresponding to the second business system.

[0073] Exemplarily, the encryption method includes encrypted and unencrypted. If the encryption method of the second business system is encrypted, it is necessary to identify whether the access traffic poses a security risk after decryption; if the encryption method of the second business system is unencrypted, it is possible to directly identify whether the access traffic poses a security risk.

[0074] In some embodiments, if the encryption method of the second business system is "no encryption required," the access traffic is unencrypted traffic, and when configuring the initial access address for the second business system, the configuration can be performed in accordance with the Hypertext Transfer Protocol. If encrypted traffic is transmitted between the two business systems, it is necessary to decrypt the traffic in the security protection instance to identify whether there is a security risk. If there is no security risk, the traffic can continue to be transmitted to the second business system. For example, if the encryption method of the second business system is "encryption required," the access traffic is encrypted traffic, and when configuring the initial access address for the second business system, the configuration can be performed in accordance with the Hypertext Transfer Protocol Secure Edition.

[0075] Furthermore, if the target encryption mode is encrypted, a key corresponding to the second business system is obtained; the access traffic is decrypted based on the key, and a preset identification method is used to identify whether the decrypted access traffic presents a security risk; if the target encryption mode is unencrypted, a preset identification method is used to identify whether the access traffic presents a security risk. The key can be a security certificate, a plaintext key, a security token, etc.

[0076] In some embodiments, protection rules can be configured by pre-set identification methods to identify and enable Web attack protection, support Structured Query Language (SQL) injection protection, cross-site scripting attack protection, etc.; enable Distributed Denial of Service attack (DDoS) attack protection, etc. It also supports DDoS (Distance DoS) attack protection, including IP attack protection, Transmission Control Protocol (TCP) attack protection, and User Datagram Protocol (UDP) attack protection. It also supports Web access protocol compliance detection, including strict verification of parameters such as Uniform Resource Locator (URL), HTTP Cookie (Cookie), and HTTP Referer (Refer).

[0077] In some further embodiments, using a preset identification method to identify whether access traffic poses a security risk includes: parsing data in each field of the access traffic to be identified; the access traffic to be identified includes first access traffic or second access traffic, the first access traffic is decrypted encrypted access traffic, and the second access traffic is unencrypted access traffic; for any field, based on the mapping relationship between the field and the preset regular expression, determining the target regular expression corresponding to the field; using the target regular expression to verify the data in the field, if the data conforms to the target regular expression, there is no security risk; if the data conforms to the target regular expression, there is a security risk.

[0078] In step S22, if there is no security risk in the access traffic, the access traffic is forwarded to the second business system according to the port from which the access traffic is obtained.

[0079] For example, if the access traffic is identified as not presenting a security risk, the access traffic can be forwarded to the second service system. Only allowing traffic that passes security checks can prevent the risk of unauthorized scanning and malware propagation to a certain extent.

[0080] In some embodiments, access traffic can be forwarded to the second business system by configuring address matching rules in a router or firewall to map traffic from a specific port to the second business system; and the switch flow table can also be dynamically configured using the OpenFlow Switch Specification (OpenFlow) protocol to achieve refined control of port forwarding to forward access traffic to the second business system.

[0081] There are also some embodiments that forward the access traffic to the second business system based on the port through which the access traffic is obtained, including: determining the port through which the access traffic is obtained; determining the real access address of the second business system based on the mapping relationship between the port and the real access address; modifying the access address of the access traffic to the real access address; and sending the access traffic with the modified access address to the second business system.

[0082] For example, after determining that the access traffic poses no security risk, the security protection instance can determine the real access address of the access traffic, namely the real access address of the second business system, based on the port from which the access traffic was obtained. During implementation, a pre-established mapping table of ports and real access addresses corresponding to the second business system can be used. When forwarding is required, the real access address is determined based on this mapping table. After the access address of the access traffic is modified to the real access address, the access traffic is forwarded to the second business system via the switch.

[0083] In step S23, if the access traffic has a security risk, the access traffic is intercepted.

[0084] For example, when it is determined that the access traffic has a security risk, the security mode instance can directly intercept the access traffic, thereby preventing the access traffic with security risks from reaching the second business system, thereby improving the security of mutual access between business systems.

[0085] In some embodiments, after intercepting the access traffic, a first operation log can be obtained to identify whether the access traffic poses a security risk; and a second operation log can be obtained to intercept the access traffic; and the first operation log and the second operation log can be sent to the security management platform so that the security management platform can analyze the attack behavior of the access traffic based on the first operation log and the second operation log.

[0086] For example, after sending the first operation log and the second operation log to the security management platform, the security management platform can analyze the first operation log and the second operation log to determine the attack method. Furthermore, the identification method of the access traffic of the security access instance can be improved based on the analyzed method.

[0087] In summary, by implementing the access method of the embodiment of the present disclosure, in response to obtaining the access traffic of the first business system accessing the second business system, it is identified whether the access traffic has a security risk; since the initial access address of the second business system is configured as the address of the security protection instance; the initial access address is the access address of the access traffic, and therefore the security protection instance can obtain the access traffic of the second business system and identify whether the operation of the access traffic has a security risk, thereby realizing the identification of the specific operation of the access traffic; further, if the access traffic does not have a security risk, it is forwarded to the second business system; if the access traffic has a security risk, the access traffic is intercepted, thereby improving the security between the business systems.

[0088] Corresponding to the above embodiment, the embodiment of the present disclosure also provides an access configuration method, which is applied to a security management platform. The security management platform can be Figure 1 The security management platform 103 in Figure 3 As shown, the method includes:

[0089] In step S31, a first operation log and a second operation log of access traffic sent by the security protection instance are received.

[0090] The access traffic is access traffic from the first business system to the second business system, and according to the access method in the above embodiment, the access traffic is identified as having a security risk. The first operation log is a behavior log of the security protection instance identifying the access traffic; and the second operation log is a behavior log of the security protection instance intercepting the access traffic.

[0091] In step S32, the first operation log and the second operation log are analyzed to obtain attack behaviors of access traffic.

[0092] Exemplarily, a first operation log and a second operation log are received, where the operation log is an operation log of an identification behavior and an interception behavior corresponding to the intercepted traffic.

[0093] Before analysis, the first operation log and the second operation log can also be preprocessed, for example, the logs can be cleaned, invalid or duplicate logs can be removed, and the log data can be formatted to ensure that the log entries have a unified structure for subsequent analysis. Key information such as timestamp, user ID, operation type, access path, IP address, etc. can also be extracted.

[0094] Operation log analysis can be performed using a pre-defined rule base. For example, a rule base containing known attack signatures can be established based on common attack patterns, such as SQL injection, TCP attacks, brute force cracking, and DDoS attacks. The first and second operation logs are analyzed one by one to check whether they match the attack signatures in the rule base. If a match is found, the behavior is marked as a potential attack and detailed information is recorded.

[0095] In addition, in some embodiments, operation logs within a certain time period can be obtained to perform trend analysis on access traffic to the same business system, or to analyze attack behavior in access traffic from the same source. Normal access traffic behavior can be pre-modeled to analyze user access frequency, access paths, operation types, and so on. If user operation behavior subsequently deviates significantly from normal patterns, it may indicate an attack. For example, if a user frequently accesses a sensitive interface within a short period of time, it may be a brute force attack.

[0096] In some embodiments, before the above S31, the access configuration method may also include: configuring the initial access address of each business system, the initial access address being the address of the security protection instance, so that the access traffic for each business system is sent to the security protection instance for security risk detection.

[0097] For example, the initial access address corresponding to each business system is configured so that when accessing the corresponding business system, the access traffic reaches the initial access address, that is, the reverse proxy address (initial access address) of each business system is configured. The initial access address of all business systems is configured as the address of the security protection instance, and the port used to enter the security protection instance is used to distinguish which business system is being accessed.

[0098] The initial access address includes the Internet Protocol address and port. The initial access address of each business system is configured as follows:

[0099] Configure the Internet Protocol address of each business system as the Internet Protocol address of the security protection instance; and configure the port for each business system to enter the security protection instance.

[0100] By implementing the access configuration method, the first operation log and the second operation log of the access traffic sent by the security protection instance are received, wherein the access traffic is the access traffic of the first business system accessing the second business system, and the access traffic is identified as having a security risk; therefore, analysis can be performed based on the first operation log and the second operation log to obtain the attack behavior of the access traffic with a security risk, and the attack behavior can be further analyzed so that protection suggestions can be provided later.

[0101] The exemplary implementations involved in the embodiments of the present disclosure may refer to the implementations of the above embodiments and the descriptions of the above embodiments, which will not be repeated here.

[0102] correspond Figure 4 The present disclosure also provides an access device for use in security protection examples. The device includes:

[0103] An identification module 41 is configured to, in response to obtaining access traffic from a first business system to a second business system, identify whether the operation of the access traffic poses a security risk; the initial access address of the second business system is configured as the address of the security protection instance; the initial access address is the access address of the access traffic;

[0104] a forwarding module 42 configured to forward the access traffic to the second business system according to the port from which the access traffic is obtained if the access traffic does not pose a security risk;

[0105] The interception module 43 is configured to intercept the access traffic if there is a security risk in the access traffic.

[0106] The access device provided in the above embodiment of the present disclosure and the access method provided in the embodiment of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0107] correspond Figure 3 The present disclosure also provides an access configuration device for use in a security management platform, such as Figure 5 As shown, the device includes:

[0108] A receiving module 51 is configured to receive a first operation log and a second operation log of access traffic sent by a security protection instance; the access traffic is access traffic from a first business system to a second business system, and according to the access method of the above embodiment, the access traffic is identified as having a security risk; the first operation log is a behavior log of the security protection instance identifying the access traffic; and the second operation log is a behavior log of the security protection instance intercepting the access traffic;

[0109] The analysis module 52 is configured to analyze the first operation log and the second operation log to obtain attack behaviors of the access traffic.

[0110] The access configuration device provided in the above embodiment of the present disclosure and the access configuration method provided in the embodiment of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0111] The present disclosure also provides an electronic device to perform the above access method. Figure 6 , which shows a schematic diagram of an electronic device provided by some embodiments of the present disclosure. Figure 6 As shown, the electronic device 6 includes: a processor 600, a memory 601, a bus 602 and a communication interface 603, and the processor 600, the communication interface 603 and the memory 601 are connected via the bus 602; the memory 601 stores a computer program that can be run on the processor 600, and when the processor 600 runs the computer program, it executes the access method provided by any of the aforementioned embodiments of the present disclosure.

[0112] It should be pointed out that Figure 6 The electronic device shown can be implemented as Figure 1 In a security protection example or security management platform, memory 601 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage. Communication between virtual devices in the system is achieved through at least one communication interface 603 (which may be wired or wireless), and may use the Internet, a wide area network, a local area network, a metropolitan area network, etc.

[0113] The bus 602 may be an ISA bus, a PCI bus, or an EISA bus. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 601 is used to store programs. The processor 600 executes the programs upon receiving execution instructions. The access method disclosed in any of the aforementioned embodiments of the present disclosure may be applied to the processor 600 or implemented by the processor 600.

[0114] The processor 600 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method may be completed by hardware integrated logic circuits in the processor 600 or by software instructions. The processor 600 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It may implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present disclosure. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in conjunction with the embodiments of the present disclosure may be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium mature in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory 601 , and the processor 600 reads the content in the memory 601 and completes the steps of the above method in combination with its hardware.

[0115] The electronic device provided by the embodiment of the present disclosure and the access method provided by the embodiment of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented by them.

[0116] The present disclosure also provides a computer-readable storage medium corresponding to the access method provided in the above embodiment. Figure 7 The computer-readable storage medium shown is a CD 30 on which a computer program (ie, a program product) is stored. When the computer program is run by a microprocessor, it executes the access method provided by any of the aforementioned embodiments.

[0117] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0118] The computer-readable storage medium provided by the above-mentioned embodiment of the present disclosure and the access and access configuration method provided by the embodiment of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0119] Although the optional embodiments of the present disclosure have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiment and all changes and modifications that fall within the scope of the present disclosure.

[0120] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present disclosure in detail. It should be understood that the above description is only a specific implementation method of the present disclosure and is not intended to limit the scope of protection of the present disclosure. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solutions of the present disclosure should be included in the scope of protection of the present invention.

Claims

1. An access method, characterized in that: Applied to a security protection instance, the method includes: In response to obtaining access traffic from the first business system to the second business system, identifying whether the operation of the access traffic poses a security risk; the initial access address of the second business system is configured as the address of the security protection instance; the initial access address is the access address of the access traffic; If the access traffic does not pose a security risk, forwarding the access traffic to the second business system according to the port from which the access traffic is obtained; If there is a security risk in the access traffic, the access traffic is intercepted.

2. The method according to claim 1, characterized in that The step of forwarding the access traffic to the second business system according to the port from which the access traffic is obtained includes: Determine the port for obtaining access traffic; determine the real access address of the second business system based on the mapping relationship between the port and the real access address; Modify the access address of the access traffic to the real access address; The access traffic with the modified access address is sent to the second business system.

3. The method according to claim 1, characterized in that The identifying whether the access traffic operation has a security risk includes: Determining a target encryption method for access traffic corresponding to the second business system based on a mapping relationship between the second business system and the encryption method; Based on the target encryption method of the access traffic corresponding to the second business system, identify whether the operation of the access traffic has a security risk.

4. The method according to claim 3, characterized in that Based on the target encryption mode of the second business system, identifying whether the operation of accessing the traffic presents a security risk includes: If the target encryption mode is encrypted, obtaining a key corresponding to the second business system; decrypting the access traffic based on the key, and using a preset identification method to identify whether the decrypted access traffic has a security risk; If the target encryption method is unencrypted, the preset identification method is used to identify whether the access traffic has a security risk.

5. The method according to claim 4, characterized in that Using the preset identification method to identify whether the access traffic poses a security risk includes: Parsing data in each field of the access traffic to be identified; the access traffic to be identified includes first access traffic or second access traffic; the first access traffic is decrypted encrypted access traffic, and the second access traffic is unencrypted access traffic; For any field, based on the mapping relationship between the field and the preset regular expression, determine the target regular expression corresponding to the field; The data in the field is verified using the target regular expression. If the data conforms to the target regular expression, there is no security risk; if the data conforms to the target regular expression, there is a security risk.

6. The method according to claim 1, characterized in that After intercepting the access traffic, the method further includes: Obtaining a first operation log for identifying whether the access traffic has a security risk; and obtaining a second operation log for intercepting the access traffic; The first operation log and the second operation log are sent to a security management platform, so that the security management platform analyzes attack behaviors of access traffic based on the first operation log and the second operation log.

7. An access configuration method, characterized in that: Applied to a security management platform, the method includes: Receive a first operation log and a second operation log of access traffic sent by a security protection instance; the access traffic is access traffic from a first business system to a second business system, and the access traffic is identified as having a security risk according to the access method according to any one of claims 1 to 6; the first operation log is a behavior log of the security protection instance identifying the access traffic; the second operation log is a behavior log of the security protection instance intercepting the access traffic; The first operation log and the second operation log are analyzed to obtain attack behavior of the access traffic.

8. The method according to claim 7, characterized in that The method further comprises: An initial access address for each business system is configured, where the initial access address is the address of the security protection instance, so that access traffic for each business system is sent to the security protection instance for security risk detection.

9. The method according to claim 8, characterized in that The initial access address includes an Internet Protocol address and a port, and the configuration of the initial access address of each business system includes: Configure the Internet Protocol address of each business system as the Internet Protocol address of the security protection instance; and configure the port for each business system to enter the security protection instance.

10. An access system comprising at least two business systems, a security protection instance, and a security management platform. The security management platform is used to configure the initial access address of each business system; The initial access address is the address of the security protection instance, so that the access traffic for each business system is sent to the security protection instance for security risk detection; The first business system is configured to send access traffic to the second business system; the access address of the access traffic is the initial access address of the second business system; the initial access address of the second business system is the address of the security protection instance; The security protection instance is used to identify whether there is a security risk in the access traffic of the first business system to the second business system in response to obtaining the access traffic; If the access traffic does not pose a security risk, forwarding the access traffic to the second business system according to the port from which the access traffic is obtained; If there is a security risk in the access traffic, the access traffic is intercepted.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory, wherein the processor implements the method according to any one of claims 1 to 9 when executing the computer program.

12. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images