Access control method and apparatus for application gateway, and device, medium and program product

Abstract

The present disclosure relates to the technical field of networks. Disclosed are an access control method and apparatus for an application gateway, and a device, a medium and a program product. The access control method for an application gateway provided in the present disclosure comprises: parsing a uniform resource locator (URL) request sent by a first terminal device, so as to determine an access requirement for a target service application and the current access record of the first terminal device; and if the access permission of the first terminal device for the target service application indicates that the first terminal device is allowed to access the target service application, performing identity authentication on the first terminal device on the basis of the current access record, and when an identity authentication result is that the authentication is successful, determining, on the basis of the access requirement, a target access result of accessing the target service application, and feeding back the target access result to the first terminal device, so as to respond to the URL request.

Description

Access control method, device, equipment, medium and program product of application gateway

[0001] Cross-reference to Related Applications

[0002] The present application claims priority to the Chinese patent application No. 202410741996.5, filed on June 7, 2024, and entitled "Access control method, device, equipment, medium and program product of application gateway", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0003] The present disclosure relates to the technical field of network, in particular to an access control method, device, equipment, medium and program product of application gateway. BACKGROUND

[0004] Application gateway is a Web traffic (Open System Interconnect (OSI) layer 7) load balancer that can be used to control the traffic of Web applications. Traditional load balancers operate at the transport layer (OSI layer 4-TCP and UDP) and route traffic to target IP addresses and ports based on source IP addresses and ports. SUMMARY

[0005] Therefore, the present disclosure provides an access control method, device, equipment, medium and program product of application gateway to solve the problem of low data access security.

[0006] In a first aspect, the present disclosure provides an access control method of application gateway, the method comprising:

[0007] receiving a uniform resource locator (URL) request sent by a first terminal device, the URL request being used to request access to a target service application deployed in a first network;

[0008] parsing the URL request to determine an access requirement for the target service application and a current access record of the first terminal device;

[0009] determining, through a preset first configuration file, an access right of the first terminal device to the target service application, the first configuration file comprising access rights between a plurality of service applications and the first network;

[0010] if the access right represents that the first terminal device is allowed to access, performing identity verification on the first terminal device based on the current access record, and determining a target access result of accessing the target service application based on the access requirement when the identity verification result is passed;

[0011] feeding back the target access result to the first terminal device to respond to the URL request.

[0012] In a second aspect, the present disclosure provides an access control device of an application gateway, the device comprising:

[0013] a first receiving module configured to receive a network resource locator (URL) request sent by a first terminal device, the URL request being used to request access to a target service application deployed in a first network;

[0014] a parsing module configured to parse the URL request, and determine an access demand for the target service application and a current access record of the first terminal device;

[0015] a first processing module configured to determine, by using a preset first configuration file, an access right of the first terminal device to the target service application, the first configuration file comprising a plurality of access rights between service applications and the first network;

[0016] a second processing module configured to, if the access right represents that the first terminal device is allowed to access, perform identity verification on the first terminal device based on the current access record, and determine a target access result of accessing the target service application based on the access demand if the identity verification result is passed;

[0017] a feedback module configured to feed back the target access result to the first terminal device in response to the URL request.

[0018] In a third aspect, the present disclosure provides a computer device, comprising a memory and a processor, the memory and the processor being in communication connection with each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the access control method of the application gateway according to the first aspect or any one of the corresponding embodiments thereof.

[0019] In a fourth aspect, the present disclosure provides a computer readable storage medium, the computer readable storage medium storing computer instructions, the computer instructions being used to make a computer perform the access control method of the application gateway according to the first aspect or any one of the corresponding embodiments thereof.

[0020] In a fifth aspect, the present disclosure provides a computer program product, the computer program product comprising computer instructions, the computer instructions being used to make a computer perform the access control method of the application gateway according to the first aspect or any one of the corresponding embodiments thereof. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the prior art, the drawings needed in the specific embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are some embodiments of the present disclosure, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0022] FIG. 1 is a schematic diagram of a system architecture of an access control system according to an embodiment of the present disclosure;

[0023] FIG. 2 is a schematic diagram of a flow of an access control method of an application gateway according to an embodiment of the present disclosure;

[0024] FIG. 3 is a schematic diagram of a flow of another access control method of an application gateway according to an embodiment of the present disclosure;

[0025] FIG. 4 is a structural block diagram of an access control apparatus of an application gateway according to an embodiment of the present disclosure;

[0026] FIG. 5 is a schematic diagram of a flow of yet another access control method of an application gateway according to an embodiment of the present disclosure;

[0027] FIG. 6 is a structural block diagram of another access control apparatus of an application gateway according to an embodiment of the present disclosure;

[0028] FIG. 7 is a schematic diagram of a hardware structure of a computer device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] Embodiments of the present disclosure will be described in more detail with reference to the accompanying drawings. While certain embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be embodied in various forms and should not be interpreted as being limited to the embodiments set forth herein; rather, these embodiments are provided so that the present disclosure can be more thoroughly and completely understood. It should be understood that the drawings and embodiments of the present disclosure are only for illustrative purposes and are not intended to limit the scope of protection of the present disclosure.

[0030] In the description of embodiments of the present disclosure, the term "comprising" and its conjugations should be understood to encompass the meanings of "consisting of" and "consisting essentially of". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions can also be included below.

[0031] In this document, unless explicitly stated otherwise, performing a step "in response to" an event does not mean that the step is performed immediately after the event, but can include one or more intermediate steps.

[0032] It can be understood that the data involved in the present technical solution (including but not limited to the data itself, the obtaining, use, storage or deletion of the data) should comply with the requirements of the relevant laws and regulations and relevant provisions.

[0033] It can be understood that, before using the technical solutions disclosed in the embodiments of the present disclosure, the type of information involved in the present disclosure, the scope of use, the use scenario, etc. should be informed to the relevant user and the authorization of the relevant user should be obtained through appropriate means, wherein the relevant user can include any type of right subject, such as an individual, an enterprise, or a group.

[0034] For example, in response to receiving the active request of the user, the prompt information is sent to the relevant user to explicitly prompt the relevant user that the operation requested to be performed will require obtaining and using the information of the relevant user, so that the relevant user can voluntarily choose whether to provide the information to the software or hardware such as the electronic device, the application program, the server or the storage medium, etc. performing the operation of the technical solutions of the present disclosure according to the prompt information.

[0035] As an optional but non-limiting implementation manner, in response to receiving the active request of the relevant user, the prompt information can be sent to the relevant user in the form of a pop-up window, and the prompt information can be presented in the form of text in the pop-up window. In addition, the pop-up window can also carry selection controls for the user to select "agree" or "disagree" to provide information to the electronic device.

[0036] It can be understood that the above notification and user authorization process is only illustrative and does not limit the implementation of the present disclosure, and other ways that meet the relevant laws and regulations can also be applied to the implementation of the present disclosure.

[0037] Office security usually involves the security management of network, identity, and terminal. Through the implementation of proprietary network networking, access control, management of terminals in the proprietary network, and information security protection, digital office can be more secure, efficient, and easy to use. The security management at the network level can ensure that the proprietary network such as the office network can operate safely and efficiently, and thus ensure that the business data can be transmitted and stored safely. The security management at the identity level can improve the efficiency and security of user access to the proprietary network. The security management at the terminal level can realize the unified management of terminal devices in the proprietary network, data leakage prevention, and terminal threat protection, thereby ensuring the security of enterprise data.

[0038] In actual application, the security management of network, identity, and terminal can realize technical association in multiple technical branches such as networking strategy, network access and control, remote access, unified terminal management, terminal detection and response, enterprise data leakage prevention, and identity authentication management, so that digital office is simpler, more efficient, and easier to implement.

[0039] In the related art, in a private network / dedicated network of an enterprise or other organization, it is usually necessary to install security management software in a terminal device to control the terminal device to access an application deployed in the private network / dedicated network through the security management software. However, when the number of terminal devices requesting connection is large, how to guarantee the data security of the application becomes a problem to be solved.

[0040] In the related art, a terminal device in an external network can access an enterprise-level application deployed in an enterprise intranet through a preset proxy server. However, when the number of terminal devices requesting access is large, how to guarantee the data security of the enterprise-level application in the enterprise intranet becomes a problem to be solved.

[0041] In view of this, the embodiments of the present disclosure provide an access control method of an application gateway. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that here.

[0042] As shown in FIG. 1, the system architecture of the access control system adopted by the embodiments of the present disclosure mainly includes a plurality of terminal devices, an application gateway, and a server where a business application server is located. Among them, the enterprise internal members can access application resources such as application programs hosted in a data center in a first network, a public cloud, a private cloud, and SaaS applications through a business application client on the terminal device. The application gateway is deployed in the headquarters, branch network, Internet Data Center (IDC machine room), or cloud service (such as public cloud, private cloud) of the enterprise. The application gateway is connected with each business application server hosted in the first network, and is used to control the terminal device to access the application resources of each business application. The server where the business application server is located is used to provide services for the corresponding business application client.

[0043] In the present embodiment, an access control method of an application gateway is provided, which can be used in computer devices such as proxy servers and gateways. FIG. 2 is a flowchart of the access control method of the application gateway according to the embodiments of the present disclosure. As shown in FIG. 2, the flow includes the following steps:

[0044] Step S201, receiving a uniform resource locator (URL) request sent by a first terminal device.

[0045] The URL request is used to request access to a target service application deployed in the first network. The target service application can be understood as a service application that needs to be managed in the first network. The first terminal device can access it through the Internet. The first terminal device can be a terminal device deployed in the first network with the target service application, or a terminal device deployed in other networks offline, which is not limited here.

[0046] When the URL request sent by the first terminal device is detected, the access security of the target service application is ensured, and the URL request is intercepted to identify whether the first terminal device can access the target service application based on the URL request.

[0047] In step S202, the URL request is parsed to determine the access demand for the target service application and the current access record of the first terminal device.

[0048] To determine the access purpose of the first terminal device to the target service application, the URL request is parsed to determine the data operation that the first terminal device needs to perform on the data in the target service application, and whether the first terminal device has accessed the target service application, and then determine the access demand for the target service application and the current access record of the first terminal device, so as to better understand the purpose of the first terminal device to access the target service application. For example, by parsing the parameters and parameter values in the URL request, the specific data operation that the first terminal device needs to perform can be determined, such as reading, writing, deleting, downloading, etc. Parsing other related information in the request, such as user identity, access time, etc., can also help determine the context and restriction conditions of the access demand.

[0049] In some optional implementation scenarios, the URL request can be parsed and processed by a pre-set parsing tool. For example, the parsing tool can be a Hypertext Transfer Protocol (HTTP) request parsing library or a Uniform Resource Locator (URL) parsing library used in World Wide Web (web) development, which can be selected according to actual needs.

[0050] In step S203, the access permission of the first terminal device to the target service application is determined through a pre-set first configuration file.

[0051] The first configuration file includes access permissions between a plurality of service applications and the first network. To ensure access security of a target service application, access permissions between the target service application and the first network are determined from the access permissions between the plurality of service applications and the first network, to determine whether the first terminal device can access the target service application.

[0052] In step S204, if the access permission indicates that the first terminal device is allowed to access, identity verification is performed on the first terminal device based on the current access record, and if the identity verification result is a verification pass, target access result of accessing the target service application is determined based on the access requirement.

[0053] If the access permission indicates that the first terminal device is allowed to access, identity verification is performed on the first terminal device based on the current access record to ensure whether the current access of the first terminal device to the target service application is a legal access. If the identity verification result is a verification pass, it indicates that the current access of the first terminal device to the target service application is a legal access. Therefore, to ensure data security of the target application, access redirection processing is performed based on the access requirement to ensure the legality and security of the access, so as to obtain a suitable target access result.

[0054] In step S205, the target access result is fed back to the first terminal device to respond to the URL request.

[0055] The target access result is fed back to the first terminal device, so that the first terminal device can determine whether the sent URL request is valid according to the obtained target access result, so that subsequent targeted processing can be performed, unnecessary polling or waiting time is reduced, and the performance of the system is improved.

[0056] The application gateway access control method provided in the embodiment can ensure access security of a target service application by determining access permissions of a first terminal device to the target service application through a URL request, and then in the case where the first terminal device can access the target service application, performing targeted interception based on access requirements of the first terminal device to the target service application and current access records, and determining a target access result finally fed back to the first terminal device, which can effectively ensure data access security of the target service application and improve legality and security of the target service application being accessed.

[0057] In some optional embodiments, in the process of identity verification on the first terminal device based on the current access record, the following steps are included:

[0058] In step a1, historical access records of the first terminal device are obtained.

[0059] Step a2, identity verification is performed on the first terminal device based on the matching result between the current access record and the historical access record;

[0060] Step a3, if the matching result indicates that there is an access record in the historical access record that is the same as the current access record, it is determined that the identity verification result is verification passed;

[0061] Step a4, if the matching result indicates that there is no access record in the historical access record that is the same as the current access record, it is determined that the identity verification result is verification failed.

[0062] Specifically, the access record includes any one or more of the following record data: the device identifier of the first terminal device, the access account currently used, the request initiation location corresponding to the URL request, the operating system corresponding to the first terminal device, the Internet protocol address or local area network address corresponding to the first terminal device.

[0063] To determine whether the access of the first terminal device is legitimate, the historical access information of the first terminal device is obtained to determine the historical access of the first terminal device to the target business application. The current access record is matched with the historical access record to verify whether the current access is normal access through the historical access record. If the matching result indicates that there is an access record in the historical access record that is the same as the current access record, it indicates that the current access of the first terminal device is reasonable, and therefore, it is determined that the identity verification result is verification passed. If the matching result indicates that there is no access record in the historical access record that is the same as the current access record, it indicates that the current access of the first terminal device is unreasonable, and therefore, it is determined that the identity verification result is verification failed.

[0064] Identity verification based on the historical access record of the user not only ensures the access security of the target application, but also effectively improves the user experience.

[0065] In some optional embodiments, in the process of determining the access demand for the target business application, if the URL request includes a download field, it is determined that the access demand for the target business application is data download. That is, in the process of parsing the URL request, the URL request is field-parsed. If there is a " / download" field in the URL, it is determined that the access demand for the target business application is data download.

[0066] If the target field representing data protection is included in the URL request, it is determined that the access requirement for the target service application is to access the protected data in the target service application. That is, the target field can be a field defined by the service requirement itself. In the process of parsing the URL request, it is identified by field matching whether there is a field in the URL request that matches the target field. If it is identified that there is a field in the URL request that matches the target field, it is determined that the access requirement for the target service application is data protection.

[0067] In the embodiment, an access control method of an application gateway is provided. FIG. 3 is a flowchart of the access control method of the application gateway according to the embodiment of the present disclosure. As shown in FIG. 3, the flow includes the following steps:

[0068] In step S301, a network resource locator URL request sent by a first terminal device is received.

[0069] In step S302, the URL request is parsed to determine an access requirement for a target service application and a current access record of the first terminal device.

[0070] In step S303, an access permission of the first terminal device for the target service application is determined through a preset first configuration file.

[0071] In step S304, if the access permission indicates that the first terminal device is allowed to access, identity verification is performed on the first terminal device based on the current access record.

[0072] In step S305, when the identity verification result is passed, a target access result of accessing the target service application is determined based on the access requirement.

[0073] Specifically, step S305 includes:

[0074] In step S3051, when the identity verification result is passed and the access requirement is data download, a first operation permission of the first terminal device for accessing the target service application is determined through a preset second configuration file.

[0075] The second configuration file includes at least one data operation permission of the first terminal device for accessing the target service application, and the second configuration file is obtained through a permission configuration platform. The data operation permission corresponding to the data download is a download permission.

[0076] When the identity verification result is passed, it indicates that the first terminal device can access the target service application. To ensure the data security of the target application, the first operation permission of the first terminal device for accessing the target service application is determined through the second configuration file.

[0077] If the operation corresponding to the first operation permission does not include the downloading permission, the URL request is blocked, and a preset access error page is taken as a target access result of the target business application.

[0078] If the operation corresponding to the first operation permission does not include the downloading permission, it indicates that the first terminal device can access the target business application but cannot perform the downloading operation on the target business application. Therefore, the URL request is blocked, and the preset access error page is taken as the target access result of the target business application, so as to prompt the first terminal device that the URL request is an invalid request through the access error page, and further to protect the data security of the target business application and reduce the occurrence of data leakage.

[0079] In some optional embodiments, the step S305 further includes:

[0080] If the access demand is to access the protected data in the target business application, the first terminal device is subjected to secondary identity authentication.

[0081] If the access demand is to access the protected data in the target business application, it indicates that the access demand requested by the first terminal device will affect the data security of the target business application. Therefore, in order to protect the data security of the target business application, the access identity of the first terminal device is subjected to secondary verification, so as to protect the access security of the target business application through continuous verification, thereby ensuring the access reliability of the target business application.

[0082] In some optional embodiments, the process of subjecting the first terminal device to secondary identity authentication can be as follows: the URL request is redirected to an identity authentication page of an identity authentication system, and the identity authentication page is sent to the first terminal device, so as to subject the first terminal device to secondary identity authentication through the identity authentication system; if the URL request sent again by the first terminal device is received within a specified time length, it is determined that the secondary identity authentication of the first terminal device is passed; and if the URL request sent again by the first terminal device is not received within the specified time length, it is determined that the secondary identity authentication of the first terminal device is not passed.

[0083] That is, in order to guarantee the access legality of the first terminal device, the URL request is redirected to an identity authentication page of the identity authentication system, so as to perform secondary identity authentication on the access identity of the first terminal device by means of the identity authentication system, and the identity authentication page is sent to the first terminal device to prompt the first terminal device to perform identity authentication processing. The identity authentication through the identity authentication page includes but is not limited to any one or a combination of the following verification methods: verification through inputting a dynamic password, verification through sending a specified short message, or verification through sending an email. The identity authentication content includes but is not limited to any one or a combination of the following dimensions: a login account of the target business application, a model of the first terminal device, a login geographic location of the target business application, an operating system corresponding to the first terminal device, an Internet address where the first terminal device is located, and a MAC (Media Access Control address, a network device address, etc.

[0084] Since the purpose of the secondary identity authentication of the first terminal device is to further determine the access legality of the first terminal device. In order to guarantee the effectiveness of the identity authentication, a specified time period is preset to limit the effective time period of the identity authentication. For example, the specified time period can be 6 hours or 5 minutes, and the specific time period can be set according to the requirements, which is not limited here.

[0085] If the URL request sent by the first terminal device again is received within the specified time period, it is determined that the access identity authentication of the first terminal device is passed, and the access identity of the first terminal device is considered to be a legal identity, and then the URL request sent by the first terminal device can be satisfied in the subsequent process. If the URL request sent by the first terminal device again is not received within the specified time period, it is determined that the access identity authentication of the first terminal device is not passed, and the access identity of the first terminal device is considered to be an illegal identity, and the URL request sent by the first terminal device is intercepted.

[0086] In step S3054, if the secondary identity authentication of the first terminal device is passed, the data protection processing is performed on the application access result page corresponding to the access demand in the target business application, and the processed application access result page is taken as the target access result.

[0087] If the secondary authentication of the first terminal device is passed, the access identity of the first terminal device is a legal identity, and therefore, in order to meet the access demand of the first terminal device and protect the protected data in the target business application, the application access result page corresponding to the access demand in the target business application is subjected to data protection processing, so as to protect the data in the application access result page through the data protection processing, and then the processed application access result page is taken as a target access result, so that when the target access result is fed back to the first terminal device, the access demand of the first terminal device can be met.

[0088] In some optional embodiments, the data protection processing on the application access result page can include determining the application access result page corresponding to the access demand in the target business application, and then adding a preset target identifier to the application access result page to obtain a processed application access result page. By adding a preset target identifier to the application access result page, the specific data access operation performed by the first terminal device on the application access result page can be determined, and the data of the target business application can be effectively prevented from being tampered with, thereby helping to enhance the data security and traceability of the target business application. The target identifier can be a specified unique identifier or a specified tracking code, and the specific identifier content can be determined according to the demand.

[0089] In step S306, the target access result is fed back to the first terminal device to respond to the URL request.

[0090] The access control method of the application gateway provided in the embodiment can determine the access right of the first terminal device to the target business application through the preset first configuration file, can realize centralized access control management, can determine whether the access to the target business application needs to be intercepted based on the URL request sent by the first terminal device, can improve the access security efficiency and reduce the occurrence of missed identification, and can control the access of the first terminal device to the target business application by verifying the access identity of the first terminal device when it is determined that the first terminal device can access the target business application, thereby effectively improving the data access security of the target business application, guiding the first terminal device to the application access result page required by the first terminal device according to the access demand, and providing more accurate and personalized access results.

[0091] In some optional embodiments, in the case where the first terminal device is allowed to access the target service application, in the process of the first terminal device accessing the target service application, the method further includes: obtaining a data access record of the first terminal device accessing protected data in the target service application, so that the running condition of the target service application can be determined according to the data access record. In order to optimize the utilization of resources and response speed, the protected data in the data access record is processed to reduce the amount of redundant and invalid data storage, and then a target access record that can be used to manage the target service application is obtained.

[0092] In some optional embodiments, in order to ensure the reliability of the first configuration file, the first configuration file is obtained from the permission configuration platform and saved at a preset period, so that when the first configuration file is updated, the updated first configuration file can be obtained in time, and the effectiveness of the subsequent control of the first terminal device accessing the target service application can be ensured, thereby effectively improving the access security and data security of the target service application. The first configuration file includes access permissions between a plurality of service applications and corresponding terminal devices. The preset period can be determined according to actual needs, for example, the first configuration file is obtained from the permission configuration platform and saved every 5 minutes. For another example, the first configuration file is obtained from the permission configuration platform and saved every 30 seconds.

[0093] In some optional embodiments, the manner of obtaining the first configuration file further includes: receiving an incremental first configuration file pushed by the permission configuration platform, updating the first configuration file through the incremental first configuration file, and saving the updated first configuration file, so that the first configuration file in the application gateway can be updated in time, the data synchronization between the permission configuration platform and the application gateway is realized, and the effectiveness and reliability of the targeted control of the access to the target service application are improved.

[0094] In some optional examples, in order to ensure network security, the first configuration file obtained further includes access control rules, routing rules, security policies and the like for accessing different target service applications.

[0095] The present disclosure also provides an application gateway, and a structural block diagram of the application gateway can be as shown in FIG. 4, which includes a control plane and a data plane.

[0096] The control plane is connected with the authority configuration platform, and is configured to acquire a first configuration file from the authority configuration platform according to a preset period, and save the first configuration file to a local memory and a disk. The first configuration file includes, but is not limited to, access control rules for different target service applications, routing rules, security policies, and access permissions between a plurality of service applications and corresponding terminal devices. The authority configuration platform can perform real-time rule increment and change pushing based on event driving, so that the control plane can acquire the updated first configuration file in time. In order to save network resources, the first configuration file saved in the local memory is sent to an execution module connected with the control plane for cache updating, so as to synchronize the first configuration file.

[0097] The control plane is further configured to provide a configuration management function of the access control device of the application gateway, including uploading, modifying, backing up and restoring the first configuration file, and the like, so that an administrator can flexibly manage and adjust the access control device of the application gateway. The control plane is further configured to provide services for the data module, including functions of forwarding, routing, accelerating, load balancing and the like, so as to ensure high performance and stability of the network.

[0098] The number of the data plane is at least one, and the data plane is connected with a plurality of servers corresponding to the target service applications, and can support public cloud, private cloud, hybrid cloud and a plurality of deployment architectures. The data plane is configured to redirect the access to an error page, an identity authentication page of an identity authentication system or an application access result page after data protection processing. In the process of running the data plane, the first configuration file, the first terminal device and access information corresponding to the first terminal device can be cached to the memory, and targeted analysis can be performed in the memory, so that the final target access result can be quickly determined.

[0099] Since the first configuration file is cached to the memory of the access control device of the application gateway, the first terminal device can still control the target service application of the intranet for targeted access through the locally cached first configuration file in the absence of a public network.

[0100] As one or more specific application embodiments of the embodiments of the present disclosure, the access control device of the application gateway is taken as an example. When a user needs to access the target service application through the first terminal device, the interaction process of the application gateway controlling the first terminal device to access the target service application can be as shown in FIG. 5, including:

[0101] The control plane of the application gateway obtains a first configuration file from the permission configuration platform, and the permission configuration platform sends the first configuration file to the control plane of the application gateway. The control plane of the application gateway saves the obtained first configuration file in the memory and the disk, and then synchronizes the first configuration file to the data plane of the application gateway to ensure the security of the first configuration file.

[0102] In the control stage, the user sends a URL request for the target service application through the first terminal device. The data plane of the application gateway receives the URL request. The URL request is parsed to determine the access demand for the target service application and the current access record of the first terminal device. The access permission of the first terminal device to the target service application is determined through the preset first configuration file. If the access permission represents that the access of the first terminal device is allowed, the identity of the first terminal device is verified based on the current access record. If the identity verification result is passed and the access demand is data download, the URL request is blocked, and a preset access error page is used as the target access result of the target service application. The target access result is fed back to the first terminal device to respond to the URL request.

[0103] If the access permission represents that the access of the first terminal device is allowed, the identity of the first terminal device is verified based on the current access record. If the identity verification result is passed and the access demand is to access the protected data in the target service application, the URL request is redirected to an identity authentication page of an identity authentication system, and the identity authentication page is sent to the first terminal device. The first terminal device performs access identity verification through the identity authentication page to send a verification result to the identity authentication system. The identity authentication system responds according to the received verification result. If the access identity verification of the first terminal device is passed, the first terminal device sends the URL request again. If the data plane of the application gateway receives the URL request sent by the first terminal device again within a specified time period, it is determined that the access identity verification of the first terminal device is passed. When the secondary identity verification of the first terminal device is passed, the server of the target service application is connected to determine an application access result page corresponding to the access demand in the target service application, a preset target identifier is added to the application access result page, and the processed application access result page is fed back to the first terminal device as the target access result.

[0104] In the process of accessing the target service application through the application gateway by the first terminal device, the access record of the first terminal device accessing the target service application is obtained, and the protected data corresponding to the target field in the access record is processed to obtain a target access record.

[0105] By the access control method of the application gateway, the access to the target service application can be more secure and reliable, and the data security of the target service application can be effectively guaranteed.

[0106] In the embodiment, an access control device of the application gateway is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and will not be described again. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, implementation of hardware, or a combination of software and hardware, is also possible and contemplated.

[0107] The embodiment provides an access control device of the application gateway, as shown in FIG. 6, comprising:

[0108] The first receiving module 601 is configured to receive a network resource locator (URL) request sent by a first terminal device, the URL request being used to request access to a target service application deployed in a first network;

[0109] The parsing module 602 is configured to parse the URL request, and determine an access demand for the target service application and a current access record of the first terminal device;

[0110] The first processing module 603 is configured to determine, by using a preset first configuration file, an access right of the first terminal device to the target service application, the first configuration file comprising a plurality of access rights between service applications and the first network;

[0111] The second processing module 604 is configured to, if the access right represents that the first terminal device is allowed to access, perform identity verification on the first terminal device based on the current access record, and determine a target access result of accessing the target service application based on the access demand when a result of the identity verification is passed;

[0112] The feedback module 605 is configured to feed back the target access result to the first terminal device in response to the URL request.

[0113] In some optional embodiments, the second processing module 604 comprises:

[0114] The obtaining unit is configured to obtain a historical access record of the first terminal device;

[0115] The first verification unit is configured to perform identity verification on the first terminal device based on a matching result between the current access record and the historical access record;

[0116] The first determination unit is configured to, if the matching result represents that there is an access record same as the current access record in the historical access record, determine that the result of the identity verification is passed;

[0117] The second determining unit is configured to determine that the authentication result is authentication failure if the matching result indicates that there is no same access record as the current access record in the historical access record.

[0118] The access record includes any one or more of the following record data: a device identifier of the first terminal device, a currently used access account, a request initiation location corresponding to the URL request, an operating system corresponding to the first terminal device, an Internet protocol address or a local area network address corresponding to the first terminal device.

[0119] In some optional embodiments, the parsing module 602 includes:

[0120] The first parsing unit is configured to determine that the access demand for the target service application is data download if the URL request includes a download field.

[0121] The second parsing unit is configured to determine that the access demand for the target service application is access to protected data in the target service application if the URL request includes a target field representing data protection.

[0122] In some optional embodiments, the second processing module 604 includes:

[0123] The first determining unit is configured to determine, by using a preset second configuration file, a first operation permission allowing the first terminal device to access the target service application if the access demand is data download, the second configuration file including at least one data operation permission allowing the first terminal device to access the target service application, the second configuration file being obtained through an authority configuration platform, and the data operation permission corresponding to the data download being a download permission.

[0124] The first executing unit is configured to block the URL request and use a preset access error page as a target access result of the target service application if the operation permission corresponding to the first operation permission does not include the download permission.

[0125] In some optional embodiments, the second processing module 604 includes:

[0126] The second executing unit is configured to perform secondary authentication on the first terminal device if the access demand is access to the protected data in the target service application.

[0127] The third executing unit is configured to perform data protection processing on an application access result page corresponding to the access demand in the target service application if the secondary authentication on the first terminal device is passed, and use the processed application access result page as the target access result.

[0128] In some optional embodiments, the third executing unit includes:

[0129] The second determining unit is configured to determine an application access result page corresponding to the access demand in the target service application.

[0130] The identification adding unit is configured to add a preset target identification to the application access result page to obtain a processed application access result page.

[0131] In some optional embodiments, the apparatus further comprises:

[0132] The first obtaining module is configured to obtain a data access record of the first terminal device accessing protected data in the target service application.

[0133] The third processing module is configured to perform data processing on the protected data in the data access record to obtain a target access record.

[0134] In some optional embodiments, the obtaining apparatus of the first configuration file comprises:

[0135] The second obtaining module is configured to obtain the first configuration file from the permission configuration platform according to a preset period and save the first configuration file.

[0136] In some optional embodiments, the obtaining apparatus of the first configuration file further comprises:

[0137] The second receiving module is configured to receive an incremental first configuration file pushed by the permission configuration platform.

[0138] The updating module is configured to update the first configuration file by using the incremental first configuration file and save the updated first configuration file.

[0139] Further function descriptions of the above-mentioned various modules and units are the same as those of the above-mentioned corresponding embodiments, and will not be described here.

[0140] The access control apparatus of the application gateway in the embodiment is presented in the form of a functional unit. The unit herein refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and a memory executing one or more software or fixed programs, and / or other devices that can provide the above-mentioned functions.

[0141] The disclosure embodiments further provide a computer device with the access control apparatus of the application gateway shown in FIG. 6.

[0142] Referring to FIG. 7, FIG. 7 is a structural schematic diagram of a computer device according to an optional embodiment of the present disclosure. As shown in FIG. 7, the computer device includes one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components communicate with each other using different buses, and can be installed on a common mainboard or in other manners as needed. The processor can process instructions executed in the computer device, including instructions stored in the memory or on the memory to display graphical information of a GUI on an external input / output device such as a display device coupled to the interface. In some optional embodiments, multiple processors and / or multiple buses can be used with multiple memories and multiple memory banks, if necessary. Also, multiple computer devices can be connected, each providing part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). One processor 10 is taken as an example in FIG. 7.

[0143] The processor 10 can be a central processor, a network processor, or a combination thereof. The processor 10 can further include a hardware chip. The hardware chip can be an application specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device can be a complex programmable logic device, a field programmable logic device, a general array logic, or any combination thereof.

[0144] The memory 20 stores instructions executable by the at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiments.

[0145] The memory 20 can include a program storage area and a data storage area. The program storage area can store an operating system and application programs required by at least one function; the data storage area can store data created according to the use of the computer device, and the like. In addition, the memory 20 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some optional embodiments, the memory 20 can optionally include a memory remotely arranged with respect to the processor 10, and these remote memories can be connected to the computer device through a network. Examples of the network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0146] The memory 20 can include a volatile memory, such as a random access memory; the memory can also include a non-volatile memory, such as a flash memory, a hard disk, or a solid-state disk; and the memory 20 can further include a combination of the above kinds of memories.

[0147] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 can be connected by a bus or other means, and are connected by a bus in FIG. 7 as an example.

[0148] The input device 30 can receive inputted digital or character information, and generate key signal input related to user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a trackpad, a touchpad, a pointing stick, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 can include a display device, an auxiliary lighting device (e.g., an LED), a tactile feedback device (e.g., a vibration motor), etc. The display device includes but is not limited to a liquid crystal display, a light emitting diode, a display, and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0149] The embodiments of the present disclosure further provide a computer readable storage medium, and the method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or recorded in a storage medium, or be implemented as computer code downloaded from a network and stored in a remote storage medium or a non-transitory machine readable storage medium and then stored in a local storage medium, so that the method described herein can be processed by such software using a general purpose computer, a special purpose processor, or programmable or special hardware. The storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid state disk, etc. Further, the storage medium can also include a combination of the above-mentioned types of memories. It can be understood that the computer, the processor, the microprocessor controller, or the programmable hardware includes a storage component that can store or receive software or computer code, which, when accessed and executed by the computer, the processor, or the hardware, implements the method shown in the above embodiments.

[0150] Part of the present application can be applied as a computer program product, for example, computer program instructions, when executed by a computer, the operation of the computer can invoke or provide the method and / or technical solutions according to the present application. Those skilled in the art should understand that the form of computer program instructions in computer readable medium includes but is not limited to source file, executable file, installation package file, etc. Correspondingly, the way of computer program instructions executed by computer includes but is not limited to: the computer directly executes the instructions, or the computer executes the corresponding compiled program after compiling the instructions, or the computer reads and executes the instructions, or the computer executes the corresponding installed program after reading and installing the instructions. Here, the computer readable medium can be any available computer readable storage medium or communication medium accessible to the computer.

[0151] It can be understood that, before using the technical solutions disclosed in the embodiments of the present disclosure, the type of personal information involved in the present disclosure, the use range, the use scenario and the like should be informed to the user and the authorization of the user should be obtained through appropriate means according to relevant laws and regulations.

[0152] For example, in response to receiving the active request of the user, the prompt information is sent to the user to explicitly prompt the user that the operation requested to be performed will require obtaining and using the personal information of the user. Thus, the user can autonomously select whether to provide the personal information to the software or hardware such as the electronic device, the application program, the server or the storage medium performing the operation of the technical solutions of the present disclosure according to the prompt information.

[0153] As an optional but non-limiting implementation manner, in response to receiving the active request of the user, the manner of sending the prompt information to the user may, for example, be a pop-up window manner, and the prompt information may be presented in the form of text in the pop-up window. In addition, the pop-up window may also carry a selection control for the user to select “agree” or “disagree” to provide the personal information to the electronic device.

[0154] It can be understood that the above notification and obtaining of the authorization of the user are only illustrative, and do not limit the implementation manners of the present disclosure, and other manners meeting the relevant laws and regulations can also be applied to the implementation manners of the present disclosure.

[0155] Although the embodiments of the present disclosure are described in combination with the drawings, various modifications and variations can be made by those skilled in the art without departing from the spirit and scope of the present disclosure, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. An access control method of an application gateway, the method comprising: receiving a uniform resource locator (URL) request sent by a first terminal device, the URL request being used to request access to a target service application deployed in a first network, the target service application being a service application deployed in the first network in advance and requiring targeted management; parsing the URL request to determine an access requirement for the target service application and a current access record of the first terminal device; determining, through a preset first configuration file, an access right of the first terminal device to the target service application, the first configuration file including access rights between a plurality of service applications and the first network; if the access right represents that the first terminal device is allowed to access, performing identity verification on the first terminal device based on the current access record, and determining a target access result of accessing the target service application based on the access requirement when a result of the identity verification is passed; feeding back the target access result to the first terminal device to respond to the URL request.

2. The method of claim 1, wherein the identity verification on the first terminal device based on the current access record comprises: obtaining a historical access record of the first terminal device; performing identity verification on the first terminal device based on a matching result between the current access record and the historical access record; if the matching result represents that there is an access record same as the current access record in the historical access record, determining that the result of the identity verification is passed; if the matching result represents that there is no access record same as the current access record in the historical access record, determining that the result of the identity verification is not passed; wherein the access record includes any one or more of the following record data: a device identifier of the first terminal device, a currently used access account, a request initiation location corresponding to the URL request, an operating system corresponding to the first terminal device, an Internet protocol address or a local area network address corresponding to the first terminal device.

3. The method of claim 1, wherein the parsing of the URL request to determine the access requirement for the target service application comprises: if a download field is included in the URL request, determining that the access requirement for the target service application is data download; if a target field representing data protection is included in the URL request, determining that the access requirement for the target service application is access to protected data in the target service application.

4. The method of claim 3, wherein the determination of the target access result of accessing the target service application based on the access requirement comprises: If the access demand is data download, a first operation permission of the first terminal device accessing the target service application is determined through a preset second configuration file, the second configuration file includes at least one data operation permission of the first terminal device accessing the target service application, the second configuration file is obtained through a permission configuration platform, and the data operation permission corresponding to the data download is a download permission. If the operation corresponding to the first operation permission does not include the download permission, the URL request is blocked, and a preset access error page is taken as a target access result of the target service application.

5. The method of claim 4, wherein the determining the target access result of the target service application based on the access demand further comprises: if the access demand is to access protected data in the target service application, performing secondary authentication on the first terminal device; if the secondary authentication of the first terminal device is passed, performing data protection processing on an application access result page of the target service application corresponding to the access demand, and taking the processed application access result page as the target access result.

6. The method of claim 5, wherein the performing secondary authentication on the first terminal device comprises: redirecting the URL request to an identity authentication page of an identity authentication system, and sending the identity authentication page to the first terminal device to perform secondary authentication on the first terminal device through the identity authentication system; if the URL request sent again by the first terminal device is received within a specified time period, it is determined that the secondary authentication of the first terminal device is passed; if the URL request sent again by the first terminal device is not received within the specified time period, it is determined that the secondary authentication of the first terminal device is not passed.

7. The method of claim 5, wherein the performing data protection processing on the application access result page of the target service application corresponding to the access demand comprises: determining the application access result page of the target service application corresponding to the access demand; adding a preset target identifier to the application access result page to obtain a processed application access result page.

8. The method of claim 7, further comprising: obtaining a data access record of the first terminal device accessing the protected data in the target service application; performing data processing on the protected data in the data access record to obtain a target access record.

9. The method of claim 1, wherein the obtaining method of the first configuration file comprises: obtaining and saving the first configuration file from the permission configuration platform according to a preset period.

10. The method of claim 9, wherein the obtaining method of the first configuration file further comprises: receiving an incremental first configuration file pushed by the permission configuration platform; updating the first configuration file through the incremental first configuration file, and saving the updated first configuration file.

11. An access control apparatus of an application gateway, the apparatus comprising: a first receiving module configured to receive a uniform resource locator (URL) request sent by a first terminal device, the URL request being used to request access to a target service application deployed in a first network, the target service application being a service application deployed in the first network in advance and requiring targeted management; a parsing module configured to parse the URL request, and determine an access demand for the target service application and a current access record of the first terminal device; a first processing module configured to determine, by using a preset first configuration file, an access right of the first terminal device to the target service application, the first configuration file including access rights between a plurality of service applications and the first network; a second processing module configured to, if the access right represents that the first terminal device is allowed to access, perform identity verification on the first terminal device based on the current access record, and determine a target access result of accessing the target service application based on the access demand when the identity verification result is passed; a feedback module configured to feed back the target access result to the first terminal device in response to the URL request.

12. A computer device, comprising: a memory and a processor, which are in communication connection with each other, and the memory stores computer instructions, and the processor executes the computer instructions to perform the access control method of the application gateway according to any one of claims 1 to 10.

13. A computer readable storage medium, which stores computer instructions for causing a computer to perform the access control method of the application gateway according to any one of claims 1 to 10.

14. A computer program product, which includes computer instructions for causing a computer to perform the access control method of the application gateway according to any one of claims 1 to 9.

Images