CN114615055A - Access request processing method, data uploading method and device - Google Patents

Abstract

The invention discloses an access request processing method, data uploading method and device, and relates to the technical field of computers. A specific implementation of the method includes: receiving environmental assessment data of a terminal; determining an environmental perception score of the terminal according to the environmental assessment data; receiving an access request for a service system sent by the terminal; obtaining the service system and determine whether the environment perception score of the terminal is greater than or equal to the preset access score of the business system, so as to obtain a comparison result; according to the comparison result, determine whether to allow the terminal to access all business system. This embodiment can dynamically adjust the access control authority of the terminal and improve the system security protection level.

Description

Access request processing method, data uploading method and device

technical field

The present invention relates to the field of computer technology, and in particular, to a method for processing an access request, a method and device for uploading data.

Background technique

Many modern enterprises have realized the information office. In the process of informatization office, the daily work of employees is inseparable from the support of various business systems. With the increase in the number of enterprise business systems and the increasingly complex division of labor among employees, the security requirements of enterprise data are getting higher and higher, and the rapid construction of cloud computing and big data centers has also prompted more enterprises to use the resources of various business systems. Centralized construction and management. Users need to access each business system through a terminal, and the authority to access each business system is usually determined only by the user's identity, and the access authority is fixed, and the system security protection level is low.

SUMMARY OF THE INVENTION

In view of this, the embodiments of the present invention provide an access request processing method and apparatus, which can perform environmental assessment on a terminal, dynamically adjust the access control authority of the terminal, and improve the system security protection level.

In a first aspect, an embodiment of the present invention provides a method for processing an access request, which is applied to a server, including:

Receive the environmental assessment data of the terminal;

According to the environment evaluation data, determine the environment perception score of the terminal;

receiving an access request for the service system sent by the terminal;

Acquire the preset access score of the business system, and determine whether the environment perception score of the terminal is greater than or equal to the preset access score of the business system to obtain a comparison result;

According to the comparison result, it is determined whether to allow the terminal to access the service system.

Optionally, the obtaining the preset access score of the business system includes:

determining the terminal source of the terminal;

A preset access score of the service system for the terminal source is determined.

Optionally, the terminal source of the terminal is office equipment:

The determining of the preset access score of the service system for the terminal source includes:

determining a first access score and a second access score of the business system for office equipment, where the first access score is greater than the second access score;

The determining whether to allow the terminal to access the service system according to the comparison result includes:

In the case that the comparison result indicates that the environment perception score of the terminal is greater than or equal to the first access score, allowing the terminal to access the service system;

In the case that the comparison result indicates that the environment perception score of the terminal is between the second access score and the first access score, allowing the terminal to access the service system through the sandbox;

In the case that the comparison result indicates that the environment perception score of the terminal is less than or equal to the second access score, the terminal is prohibited from accessing the service system, and an environment restoration message is delivered to the terminal.

Optionally, the terminal source of the terminal is a personal device:

The determining of the preset access score of the service system for the terminal source includes:

determining a third access score for the business system for the personal device;

The determining whether to allow the terminal to access the service system according to the comparison result includes:

In the case that the comparison result indicates that the environment perception score of the terminal is greater than or equal to the third access score, allowing the terminal to access the service system through the sandbox;

In the case that the comparison result indicates that the environment perception score of the terminal is lower than the third access score, the terminal is prohibited from accessing the service system.

Optionally, the obtaining the preset access score of the business system includes:

determining the user identity corresponding to the access request;

A preset access score of the business system for the user identity is determined.

Optionally, the user identity is an employee user:

The determining of the preset access score of the business system for the user identity includes:

determining a fourth access score of the business system for the employee user;

The determining whether to allow the terminal to access the service system according to the comparison result includes:

In the case that the comparison result indicates that the environment perception score of the terminal is greater than or equal to the fourth access score, allowing the terminal to access the service system;

In the case that the comparison result indicates that the environment perception score of the terminal is less than the fourth access score, the terminal is prohibited from accessing the service system.

Optionally, the user identity is a third-party user:

The determining of the preset access score of the business system for the user identity includes:

determining the fifth access score of the business system for the third-party user;

The determining whether to allow the terminal to access the service system according to the comparison result includes:

In the case that the comparison result indicates that the environment perception score of the terminal is greater than or equal to the fifth access score, allowing the terminal to access the service system through the sandbox;

In the case that the comparison result indicates that the environment perception score of the terminal is less than the fifth access score, the terminal is prohibited from accessing the service system.

In a second aspect, an embodiment of the present invention provides a method for uploading data, applied to a terminal, including:

Obtain the environmental assessment data of the terminal;

Upload the environmental assessment data to the server.

Optionally, after uploading the environmental assessment data to the server, the method further includes:

receiving an environment repair message under the server;

According to the environment repair message, perform environment repair processing on the terminal.

Optionally, the environment assessment data includes at least one of the following: hardware data, operating system data, basic security software data, and application software data.

In a third aspect, an embodiment of the present invention provides an apparatus for processing an access request, applied to a server, including:

The data receiving module is used to receive the environmental assessment data of the terminal;

a score determination module, configured to determine the environmental perception score of the terminal according to the environmental assessment data;

a request receiving module, configured to receive an access request for the service system sent by the terminal;

A comparison module, configured to obtain the preset access score of the business system, and determine whether the environment perception score of the terminal is greater than or equal to the preset access score of the business system, so as to obtain a comparison result;

and a processing module, configured to determine whether to allow the terminal to access the service system according to the comparison result.

In a fourth aspect, an embodiment of the present invention provides a data uploading apparatus, applied to a terminal, including:

The data acquisition module is used to acquire the environmental assessment data of the terminal;

The data uploading module is used for uploading the environmental assessment data to the server.

In a fifth aspect, an embodiment of the present invention provides an electronic device, including:

one or more processors;

storage means for storing one or more programs,

When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any of the above embodiments.

In a sixth aspect, an embodiment of the present invention provides a computer-readable medium on which a computer program is stored, and when the program is executed by a processor, implements the method described in any of the foregoing embodiments.

In a seventh aspect, an embodiment of the present invention provides a computer program product, including a computer program, which implements the method described in any of the foregoing embodiments when the program is executed by a processor.

An embodiment of the above invention has the following advantages or beneficial effects: determining the environment perception score of the terminal according to the environment evaluation data of the terminal. The environmental awareness score is used to characterize the security level of the terminal accessing the business system. An access score can be preset for each service system according to requirements, so as to limit the minimum environment perception score of a terminal that can access the service system, so that a terminal with a relatively high degree of risk cannot access the service system. Therefore, the embodiments of the present invention can ensure the security in the process of the service system providing services to the outside world.

In addition, with the operation of the terminal, the environmental assessment data of the terminal is constantly changing, so that the environmental perception score of the terminal is also constantly changing, and finally the access control authority of the terminal is also constantly changing. Therefore, the embodiment of the present invention can also dynamically adjust the access control authority of the terminal to improve the security protection level of the system.

Further effects of the above non-conventional alternatives will be described below in conjunction with specific embodiments.

Description of drawings

The accompanying drawings are used for better understanding of the present invention and do not constitute an improper limitation of the present invention. in:

1 is a schematic flowchart of a method for processing an access request provided by a first embodiment of the present invention;

2 is a schematic flowchart of a method for processing an access request provided by a second embodiment of the present invention;

3 is a schematic flowchart of a data uploading method provided by a third embodiment of the present invention;

4 is a schematic diagram of a system architecture of a business system providing services to the outside world according to a fourth embodiment of the present invention;

5 is a schematic diagram of a terminal operating environment provided by a fourth embodiment of the present invention;

6 is a schematic structural diagram of a network environment in which a business system provides services to the outside world according to a fourth embodiment of the present invention;

7 is a schematic diagram of a method for setting dynamic access rights of a business system provided by a fourth embodiment of the present invention;

8 is a schematic diagram of a method for setting dynamic access rights for office equipment according to a fourth embodiment of the present invention;

9 is a schematic diagram of a method for setting dynamic access rights for terminal sources according to a fourth embodiment of the present invention;

10 is a schematic diagram of a method for setting dynamic access rights for user identity provided by the fourth embodiment of the present invention;

11 is a schematic structural diagram of an apparatus for processing an access request provided by an embodiment of the present invention;

12 is a schematic structural diagram of a data uploading apparatus provided by an embodiment of the present invention;

FIG. 13 is a schematic structural diagram of a computer system suitable for implementing a terminal device or a server according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present invention are described below with reference to the accompanying drawings, which include various details of the embodiments of the present invention to facilitate understanding and should be considered as exemplary only. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. Also, descriptions of well-known functions and constructions are omitted from the following description for clarity and conciseness.

The acquisition, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations.

FIG. 1 is a schematic flowchart of a method for processing an access request according to a first embodiment of the present invention. As shown in FIG. 1 , the method includes:

Step 101: Receive environmental assessment data of the terminal.

The environmental assessment data is the relevant data that affects the security of the terminal's external access. The environmental assessment data may include: hardware data, operating system data, basic security software data, and application software data. Specifically, the operating system data may include: operating system version number, operating system patch upgrade status, and the like. Security basic software data may include: virus database update status, antivirus status records, etc.

Step 102: Determine an environment perception score of the terminal according to the environment evaluation data.

The environment perception score is used to characterize the security degree of the terminal to access the external business system. The form of environmental perception score can be set according to specific needs. The environmental perception score can be expressed as: high, medium, and low. The environmental perception score can also be expressed by a percentage system, a ten-point system, and the like.

Step 103: Receive an access request for the service system sent by the terminal.

Step 104: Acquire the preset access score of the service system, and determine whether the environment perception score of the terminal is greater than or equal to the preset access score of the service system, so as to obtain a comparison result.

Different preset access scores can be set for each business system according to the requirements of each business system for privacy and security, so as to limit the minimum environmental awareness score of the terminal that can access the business system, so that the terminal with a greater degree of risk can be used. The business system cannot be accessed.

Step 105: According to the comparison result, determine whether to allow the terminal to access the service system.

In the case that the comparison result indicates that the environment perception score of the terminal is greater than or equal to the preset access score of the service system, the terminal is allowed to access the service system. When the comparison result indicates that the environment perception score of the terminal is less than the preset access score of the service system, the terminal is prohibited from accessing the service system.

In the embodiment of the present invention, the environment perception score of the terminal is determined according to the environment evaluation data of the terminal. Context Awareness Score is used to characterize how secure an environment is to access external business systems. An access score can be preset for each service system according to requirements, so as to limit the minimum environment perception score of a terminal that can access the service system, so that a terminal with a relatively high degree of risk cannot access the service system. Therefore, the embodiments of the present invention can ensure the security in the process of the service system providing services to the outside world.

In addition, with the operation of the terminal, the environmental assessment data of the terminal is constantly changing, so that the environmental perception score of the terminal is also constantly changing, and finally the access control authority of the terminal is also constantly changing. Therefore, the embodiment of the present invention can also dynamically adjust the access control authority of the terminal to improve the security protection level of the system.

FIG. 2 is a schematic flowchart of a method for processing an access request according to a second embodiment of the present invention. As shown in FIG. 2 , the method includes:

Step 201: Receive environmental assessment data of the terminal.

Step 202: Determine an environment perception score of the terminal according to the environment evaluation data.

Step 203: Receive an access request for the service system sent by the terminal.

Step 204: Determine the terminal source of the terminal and/or the user identity corresponding to the access request, and determine the preset access score of the business system for the terminal source and/or the user identity.

Terminal sources may include: office equipment, personal equipment, computers, mobile phones, etc. Office equipment is a system or equipment within a company. Personal equipment is other equipment than office equipment. For the same business system, different preset access scores can be set for office equipment and personal equipment, so that the authority of the terminal to access the business system can be controlled more flexibly. Specifically, since office equipment is from the system or within the company, the reliability of office equipment is usually higher than that of personal equipment. Therefore, for the same business system, the preset access score for office equipment can be lower than that for personal equipment. Default access score.

User identities may include: employee users, third-party users, ordinary users, administrator users, and so on. Employee users are users from within the system or within the company. A third-party user is a user who is not an employee user. For the same business system, different preset access scores can be set for employee users and third-party users, so that the permissions of terminals to access the business system can be controlled more flexibly. Specifically, for the same business system, the preset access score for employee users may be lower than the preset access score for third-party users.

Different preset access scores can also be set for the business system according to the terminal source and user identity. For example, for the same business system, multiple different preset access scores are set for office equipment and employee users, office equipment and third-party users, personal equipment and third-party users, and personal equipment and administrator users.

Step 205: Determine whether the environment perception score of the terminal is greater than or equal to the preset access score of the service system to obtain a comparison result.

Step 206: According to the comparison result, determine whether to allow the terminal to access the service system.

In the embodiment of the present invention, according to the terminal source of the terminal and/or the user identity corresponding to the access request, a plurality of different preset access scores can be set for the same business system, so that the control can be flexibly controlled for different business scenarios and needs. The access authority of the terminal to the business system.

In an embodiment of the present invention, the terminal source of the terminal is office equipment: the determining a preset access score of the business system for the terminal source includes: determining a first access score of the business system for the office equipment an access score and a second access score, the first access score is greater than the second access score; and determining whether to allow the terminal to access the service system according to the comparison result, including: in the comparison The result indicates that when the environment perception score of the terminal is greater than or equal to the first access score, the terminal is allowed to access the service system; when the comparison result indicates that the environment perception score of the terminal is in the first access score When the second access score is between the first access score, the terminal is allowed to access the service system through the sandbox; when the comparison result indicates that the environment perception score of the terminal is less than or equal to the second access score In the case of an access score, the terminal is prohibited from accessing the service system, and an environment repair message is delivered to the terminal.

For a terminal whose source is office equipment, the environment perception score of the terminal is used to limit three situations for the terminal to access the business system, so as to better ensure the security of the business system during external access.

In an embodiment of the present invention, the terminal source of the terminal is a personal device: the determining a preset access score of the service system for the terminal source includes: determining a third access score of the service system for the personal device access score; the determining whether to allow the terminal to access the service system according to the comparison result includes: indicating that the environment perception score of the terminal is greater than or equal to the third access score in the comparison result In this case, the terminal is allowed to access the service system through the sandbox; when the comparison result indicates that the environment perception score of the terminal is less than the third access score, the terminal is prohibited from accessing the service system .

For a terminal whose source is a personal device, the environment perception score of the terminal is used to limit two situations in which the terminal accesses the business system, thereby better ensuring the security of the business system during external access.

In an embodiment of the present invention, the user identity is an employee user: the determining a preset access score of the business system for the user identity includes: determining a fourth access score of the business system for the employee user ;Determining whether to allow the terminal to access the service system according to the comparison result, comprising: in the case that the comparison result represents that the environment perception score of the terminal is greater than or equal to the fourth access score , allowing the terminal to access the service system; when the comparison result indicates that the environment perception score of the terminal is less than the fourth access score, prohibit the terminal from accessing the service system.

For a user whose user identity is an employee user, the preset access score set by the business system for the employee user is used to limit the two situations in which the employee user can access the business system, thereby better ensuring the security of the business system during external access.

In an embodiment of the present invention, the user identity is a third-party user: the determining a preset access score of the service system for the user identity includes: determining a fifth-party user identity of the service system for the third-party user access score; the determining whether to allow the terminal to access the service system according to the comparison result includes: indicating that the environment perception score of the terminal is greater than or equal to the fifth access score in the comparison result In this case, the terminal is allowed to access the service system through the sandbox; when the comparison result indicates that the environment perception score of the terminal is less than the fifth access score, the terminal is prohibited from accessing the service system .

For users whose user identity is a third-party user, the preset access scores set by the business system for third-party users are used to limit the two situations in which employee users can access the business system, so as to better ensure the security of the business system during external access. sex.

FIG. 3 is a schematic flowchart of a data uploading method according to a third embodiment of the present invention. As shown in FIG. 3 , the method includes:

Step 301: Acquire environmental assessment data of the terminal.

This method is applied to the terminal. The environmental assessment data is the relevant data that affects the security of the terminal's external access. The environmental assessment data may include: hardware data, operating system data, basic security software data, and application software data. Specifically, the operating system data may include: operating system version number, operating system patch upgrade status, and the like. Security basic software data may include: virus database update status, antivirus status records, etc.

Step 302: Upload the environmental assessment data to the server.

The server determines the environment perception score of the terminal according to the environment evaluation data of the terminal. Context Awareness Score is used to characterize how secure an environment is to access external business systems. An access score can be preset for each service system according to requirements, so as to limit the minimum environment perception score of a terminal that can access the service system, so that a terminal with a relatively high degree of risk cannot access the service system. Therefore, the embodiments of the present invention can ensure the security in the process of the service system providing services to the outside world.

In addition, with the operation of the terminal, the environmental assessment data of the terminal is constantly changing, so that the environmental perception score of the terminal is also constantly changing, and finally the access control authority of the terminal is also constantly changing. Therefore, the embodiment of the present invention can also dynamically adjust the access control authority of the terminal to improve the security protection level of the system.

After the environment assessment data is uploaded to the server, an environment restoration message under the server is received; and an environment restoration process is performed on the terminal according to the environment restoration message.

If the environment perception score of the terminal is low, there are influence factors in the terminal that affect the security of the terminal accessing the external service system. The server sends an environment repair message to the terminal. The environment repair message may include: modifying the user login password, upgrading the virus database, installing system patches, and the like. The terminal performs environment repair on the terminal according to the environment repair message, so as to strengthen the stability and security of the terminal itself.

FIG. 4 is a schematic diagram of a system architecture of a business system providing external services according to a fourth embodiment of the present invention. As shown in Figure 4, in the desktop terminal, the environment assessment data of the terminal is obtained through a security client, etc., and secure access is achieved through a security client, a zero-trust security agent, and a device. In the mobile terminal, the environment assessment data is obtained through the security client, and secure access is achieved through the security SDK, VMD, etc. In the cloud service platform, application access is received through the secure access agent, and whether the terminal can scope resources is determined through the access control engine. The trust evaluation engine is used to determine the trust rating of the terminal or user according to the identity authentication result sent by the security event management and control platform. The security event management and control platform receives security logs from terminals, cloud work platforms, and resources, and manages and controls vulnerability intelligence data according to the security logs.

The system takes identity as the cornerstone, assigns digital identities to users and devices, builds access subjects for digital identities, and sets minimum permissions for access subjects. Full-scenario business concealment, full-traffic encryption proxy, and full-service mandatory authorization. Identity-based trust assessment, context-based risk determination, and behavior-based anomaly discovery. Attribute-based access control baseline, hierarchical access based on trust level, and dynamic permissions based on risk perception.

FIG. 5 is a schematic diagram of a terminal operating environment provided by a fourth embodiment of the present invention. As shown in Figure 5, the security client in the terminal monitors the security operation of the terminal in real time, and sends it to the security operation management platform on the server side in real time as a trust evaluation indicator; the terminal provides virtualized desktops (sandboxes, virtual machines) and cloud desktops , VMI and other security operating platforms to effectively isolate sensitive data; the terminal environment security operation baseline must include information such as hardware, operating system, security basic software, application software, etc.; Reinforcement; data security protection of terminals through watermarking, DLP and other tools; terminal behavior monitoring through EDR, terminal auditing, etc.; user identity authentication through face recognition, single sign-on and other means;

In addition, the terminal also provides a network security browsing function, through the security reinforcement storage of browser interaction data, cached data, process security plug-in protection, user behavior security control, unified management of access policies, unified monitoring of operational behavior, and automatic switching of multi-browser kernels and other security features to comprehensively enhance the level of desktop security access.

FIG. 6 is a schematic structural diagram of a network environment in which a business system provides external services according to a fourth embodiment of the present invention. As shown in Figure 6, the PC side establishes a communication layer encryption tunnel through the zero-trust security gateway to ensure the communication security between the terminal and the background network; the mobile terminal establishes a communication layer encryption tunnel and transaction message encryption through VMI or security SDK to ensure the terminal. Communication security with the back-end network; the security event management and control platform is linked with the security operation big data platform to detect risks in a timely manner, and take measures such as isolation; establish a secure access service for the business system, unified access to the entrance, and unified access to the entrance traffic. Security management, control and auditing; the security access control platform and security client log information are reported to the security event management and control platform in real time, and the network equipment is linked through the security event management and control platform for automatic disposal in a timely manner.

An embodiment of the present invention also provides a method for processing an access request. The method can dynamically set access rights for the business system. In the process of network access and resource access by a user or device, the trust level assigned to the device or user can be dynamically inferred through data aggregation of multiple data sources. The trust level is in the process of dynamic change, and it accurately reflects the real-time permission status of users or devices through real-time data processing, analysis, and judgment. Each accessed or defined resource needs to define the minimum trust level required for access. When a user or device accesses the resource, the currently obtained maximum trust level is obtained through dynamic analysis. When the maximum trust level is greater than or equal to the minimum trust level required by the resource After that, the resource is allowed to be accessed. To prohibit any form of privileged users, privileged devices, and privileged applications, it is necessary to control permissions by defining trust levels.

FIG. 7 is a schematic diagram of a method for setting dynamic access rights of a business system according to a fourth embodiment of the present invention. As shown in FIG. 7 , first, according to the environmental assessment data of the terminal, a plurality of environmental risk levels of the terminal are determined. For example, the security level of the operating environment is determined according to the sandbox environment data, the risk level of the operating system is determined according to the win7 operating system data, and the user type risk level is determined according to the personnel data of the partner company. Then, the environmental perception score of the terminal is determined according to a plurality of environmental risk levels. Finally, according to the environment perception score of the terminal, the service system accessible by the terminal is determined. For example, in the case of an environmental awareness score of 80, turn off mailbox access, turn off OA access, etc.

The access request processing method provided by the embodiment of the present invention can be applied to various application scenarios of different service systems and different terminals. FIG. 8 is a schematic diagram of a method for setting dynamic access rights for office equipment according to a fourth embodiment of the present invention. As shown in FIG. 8 , different service systems can be accessed according to the terminal environment perception score (the configuration can be adjusted if a service system can be accessed in a certain score interval). When the terminal environment perception score is 100 points, all business systems can be accessed; when the terminal environment perception score is between 80 and 100 points, other business systems except OA can be accessed; the terminal environment perception score is between 60 and 80 Only the EIP can be accessed; when the terminal environment perception score is less than 60 points, the terminal is not allowed to access the intranet, and the terminal environment needs to be repaired.

FIG. 9 is a schematic diagram of a method for setting dynamic access rights for terminal sources according to a fourth embodiment of the present invention. As shown in Figure 9, mobile office users can access the business system in different ways according to the terminal environment perception score; when the terminal environment perception is an office computer and meets the accessible score of the business system, they can directly access the business system on the terminal; When the terminal environment is perceived as an office computer and the score is lower than that of the terminal accessing the business system and higher than that of the accessible sandbox, the business system can be accessed through the sandbox; when the terminal environment is perceived as a personal computer and the score is higher than the accessible sandbox When the score of the box is determined, the user can access the business system through the sandbox.

FIG. 10 is a schematic diagram of a method for setting a dynamic access authority for a user identity according to a fourth embodiment of the present invention. As shown in Figure 10, the same terminal in mobile office uses different ways to access different service systems according to different user identities. In-house employees can directly access the business system on the terminal when accessing through the mobile office; third-party users need to access the business system through the sandbox when accessing through the mobile office, and can only access the business system in the development and testing environment.

FIG. 11 is a schematic structural diagram of an apparatus for processing an access request provided by an embodiment of the present invention. The apparatus is applied to a server. As shown in FIG. 11 , the apparatus includes:

The data receiving module 1101 is used for receiving the environmental assessment data of the terminal;

a score determination module 1102, configured to determine an environment perception score of the terminal according to the environment evaluation data;

a request receiving module 1103, configured to receive an access request for the service system sent by the terminal;

A comparison module 1104, configured to obtain the preset access score of the service system, and determine whether the environment perception score of the terminal is greater than or equal to the preset access score of the service system, so as to obtain a comparison result;

The processing module 1105 is configured to determine whether to allow the terminal to access the service system according to the comparison result.

Optionally, the comparison module 1104 is specifically used for:

determining the terminal source of the terminal;

A preset access score of the service system for the terminal source is determined.

Optionally, the terminal source of the terminal is office equipment:

The comparison module 1104 is specifically used for:

determining a first access score and a second access score of the business system for office equipment, where the first access score is greater than the second access score;

The processing module 1105 is specifically used for:

In the case that the comparison result indicates that the environment perception score of the terminal is greater than or equal to the first access score, allowing the terminal to access the service system;

In the case that the comparison result indicates that the environment perception score of the terminal is between the second access score and the first access score, allowing the terminal to access the service system through the sandbox;

In the case that the comparison result indicates that the environment perception score of the terminal is less than or equal to the second access score, the terminal is prohibited from accessing the service system, and an environment restoration message is delivered to the terminal.

Optionally, the terminal source of the terminal is a personal device:

The comparison module 1104 is specifically used for:

determining a third access score for the business system for the personal device;

The processing module 1105 is specifically used for:

In the case that the comparison result indicates that the environment perception score of the terminal is greater than or equal to the third access score, allowing the terminal to access the service system through the sandbox;

In the case that the comparison result indicates that the environment perception score of the terminal is lower than the third access score, the terminal is prohibited from accessing the service system.

Optionally, the comparison module 1104 is specifically used for:

determining the user identity corresponding to the access request;

A preset access score of the business system for the user identity is determined.

Optionally, the user identity is an employee user:

The comparison module 1104 is specifically used for:

determining a fourth access score of the business system for the employee user;

The processing module 1105 is specifically used for:

In the case that the comparison result indicates that the environment perception score of the terminal is greater than or equal to the fourth access score, allowing the terminal to access the service system;

In the case that the comparison result indicates that the environment perception score of the terminal is less than the fourth access score, the terminal is prohibited from accessing the service system.

Optionally, the user identity is a third-party user:

The comparison module 1104 is specifically used for:

determining the fifth access score of the business system for the third-party user;

The processing module 1105 is specifically used for:

In the case that the comparison result indicates that the environment perception score of the terminal is greater than or equal to the fifth access score, allowing the terminal to access the service system through the sandbox;

In the case that the comparison result indicates that the environment perception score of the terminal is less than the fifth access score, the terminal is prohibited from accessing the service system.

FIG. 12 is a schematic structural diagram of a data uploading device provided by an embodiment of the present invention. The device is applied to a server. As shown in FIG. 12 , the device includes:

a data acquisition module 1201, used to acquire the environmental assessment data of the terminal;

The data uploading module 1202 is used for uploading the environmental assessment data to the server.

Optionally, the device further includes:

A repair module 1203, configured to receive an environment repair message under the server;

According to the environment repair message, perform environment repair processing on the terminal.

Optionally, the environment assessment data includes at least one of the following: hardware data, operating system data, basic security software data, and application software data.

An embodiment of the present invention provides an electronic device, including:

one or more processors;

storage means for storing one or more programs,

When one or more programs are executed by one or more processors, the one or more processors implement the method of any of the above embodiments.

An embodiment of the present invention provides a computer program product, including a computer program, which, when executed by a processor, implements the method of any of the foregoing embodiments in the embodiments of the present invention.

Referring to FIG. 13 below, it shows a schematic structural diagram of a computer system 1300 suitable for implementing a terminal device according to an embodiment of the present invention. The terminal device shown in FIG. 13 is only an example, and should not impose any limitations on the functions and scope of use of the embodiments of the present invention.

As shown in FIG. 13, a computer system 1300 includes a central processing unit (CPU) 1301, which can be loaded into a random access memory (RAM) 1303 according to a program stored in a read only memory (ROM) 1302 or a program from a storage section 1308 Instead, various appropriate actions and processes are performed. In the RAM 1303, various programs and data necessary for the operation of the system 1300 are also stored. The CPU 1301 , the ROM 1302 , and the RAM 1303 are connected to each other through a bus 1304 . An input/output (I/O) interface 1305 is also connected to bus 1304 .

The following components are connected to the I/O interface 1305: an input section 1306 including a keyboard, a mouse, etc.; an output section 1307 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1308 including a hard disk, etc. ; and a communication section 1309 including a network interface card such as a LAN card, a modem, and the like. The communication section 1309 performs communication processing via a network such as the Internet. Drivers 1310 are also connected to I/O interface 1305 as needed. A removable medium 1311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is mounted on the drive 1310 as needed so that a computer program read therefrom is installed into the storage section 1308 as needed.

In particular, the processes described above with reference to the flowcharts may be implemented as computer software programs in accordance with the disclosed embodiments of the present invention. For example, embodiments disclosed herein include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the method illustrated in the flowchart. In such an embodiment, the computer program may be downloaded and installed from the network via the communication portion 1309, and/or installed from the removable medium 1311. When the computer program is executed by the central processing unit (CPU) 1301, the above-described functions defined in the system of the present invention are executed.

It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above. More specific examples of computer readable storage media may include, but are not limited to, electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Programmable read only memory (EPROM or flash memory), fiber optics, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. In the present invention, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, however, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code therein. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device . Program code embodied on a computer readable medium may be transmitted using any suitable medium including, but not limited to, wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code that contains one or more functions for implementing the specified logical function(s) executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams or flowchart illustrations, and combinations of blocks in the block diagrams or flowchart illustrations, can be implemented in special purpose hardware-based systems that perform the specified functions or operations, or can be implemented using A combination of dedicated hardware and computer instructions is implemented.

The modules involved in the embodiments of the present invention may be implemented in a software manner, and may also be implemented in a hardware manner. The described modules can also be set in the processor, for example, can be described as: a data receiving module, a score determination module, a request receiving module, a comparison module and a processing module. Wherein, the names of these modules do not constitute a limitation of the module itself in some cases, for example, the data receiving module may also be described as "a module for receiving environmental assessment data of a terminal".

As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or may exist alone without being assembled into the device. The above-mentioned computer-readable medium carries one or more programs, and when the above-mentioned one or more programs are executed by a device, the device includes:

Receive the environmental assessment data of the terminal;

According to the environment evaluation data, determine the environment perception score of the terminal;

receiving an access request for the service system sent by the terminal;

Acquire the preset access score of the business system, and determine whether the environment perception score of the terminal is greater than or equal to the preset access score of the business system to obtain a comparison result;

According to the comparison result, it is determined whether to allow the terminal to access the service system.

According to the technical solution of the embodiment of the present invention, the environment perception score of the terminal is determined according to the environment evaluation data of the terminal. The environmental assessment data is data related to the terminal environment. Context Awareness Score is used to characterize how secure an environment is to access external business systems. An access score can be preset for each service system according to requirements, so as to limit the minimum environment perception score of a terminal that can access the service system, so that a terminal with a relatively high degree of risk cannot access the service system. Therefore, the embodiments of the present invention can ensure the security in the process of the service system providing services to the outside world.

In addition, with the operation of the terminal, the environmental assessment data of the terminal is constantly changing, so that the environmental perception score of the terminal is also constantly changing. Therefore, the embodiment of the present invention can also dynamically adjust the access control authority of the terminal, which can improve the security protection level of the system.

The above-mentioned specific embodiments do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims (15)

1. A processing method of an access request is applied to a server side, and comprises the following steps:

receiving environment evaluation data of a terminal;

determining an environment perception score of the terminal according to the environment evaluation data;

receiving an access request aiming at a service system sent by the terminal;

acquiring a preset access score of the service system, and determining whether the environmental perception score of the terminal is greater than or equal to the preset access score of the service system to obtain a comparison result;

and determining whether the terminal is allowed to access the service system or not according to the comparison result.

2. The method of claim 1, wherein the obtaining the preset access score of the business system comprises:

determining a terminal source of the terminal;

and determining a preset access score of the service system for the terminal source.

3. The method of claim 2, wherein the terminal source of the terminal is an office device:

the determining a preset access score of the service system for the terminal source includes:

determining a first access score and a second access score of the business system aiming at office equipment, wherein the first access score is larger than the second access score;

the determining whether to allow the terminal to access the service system according to the comparison result includes:

allowing the terminal to access the service system under the condition that the comparison result represents that the environmental perception score of the terminal is greater than or equal to the first access score;

allowing the terminal to access the business system through a sandbox under the condition that the comparison result represents that the environmental perception score of the terminal is between the second access score and the first access score;

and under the condition that the comparison result represents that the environmental perception score of the terminal is less than or equal to the second access score, forbidding the terminal to access the service system, and issuing an environmental remediation message to the terminal.

4. The method of claim 2, wherein the terminal source of the terminal is a personal device:

the determining a preset access score of the service system for the terminal source includes:

determining a third access score of the business system for the personal device;

the determining whether to allow the terminal to access the service system according to the comparison result includes:

allowing the terminal to access the business system through a sandbox under the condition that the comparison result represents that the environmental perception score of the terminal is greater than or equal to the third access score;

and forbidding the terminal to access the service system under the condition that the comparison result represents that the environmental perception score of the terminal is smaller than the third access score.

5. The method of claim 1, wherein the obtaining the preset access score of the business system comprises:

determining a user identity corresponding to the access request;

and determining a preset access score of the business system for the user identity.

6. The method of claim 5, wherein the user identity is an employee user:

the determining the preset access score of the service system for the user identity includes:

determining a fourth access score of the business system for the employee user;

the determining whether to allow the terminal to access the service system according to the comparison result includes:

allowing the terminal to access the service system under the condition that the comparison result represents that the environmental perception score of the terminal is greater than or equal to the fourth access score;

and forbidding the terminal to access the service system under the condition that the comparison result represents that the environmental perception score of the terminal is smaller than the fourth access score.

7. The method of claim 5, wherein the user identity is a third party user:

the determining the preset access score of the service system for the user identity includes:

determining a fifth access score of the business system for a third party user;

the determining whether to allow the terminal to access the service system according to the comparison result includes:

allowing the terminal to access the business system through a sandbox under the condition that the comparison result represents that the environmental perception score of the terminal is greater than or equal to the fifth access score;

and forbidding the terminal to access the service system under the condition that the comparison result represents that the environmental perception score of the terminal is smaller than the fifth access score.

8. A data uploading method is applied to a terminal and comprises the following steps:

acquiring environment evaluation data of a terminal;

and uploading the environment evaluation data to a server.

9. The method of claim 8, wherein after uploading the environment assessment data to a server, further comprising:

receiving an environment remediation message below the server;

and according to the environment restoration message, carrying out environment restoration processing on the terminal.

10. The method of claim 8, wherein the environmental assessment data comprises at least one of: hardware data, operating system data, security base software data, and application software data.

11. An access request processing device, applied to a server side, includes:

the data receiving module is used for receiving environment evaluation data of the terminal;

the score determining module is used for determining the environmental perception score of the terminal according to the environmental evaluation data;

a request receiving module, configured to receive an access request for a service system sent by the terminal;

the comparison module is used for acquiring a preset access score of the business system and determining whether the environmental perception score of the terminal is greater than or equal to the preset access score of the business system or not so as to obtain a comparison result;

and the processing module is used for determining whether the terminal is allowed to access the service system or not according to the comparison result.

12. A data uploading device is applied to a terminal and comprises:

the data acquisition module is used for acquiring environment evaluation data of the terminal;

and the data uploading module is used for uploading the environment evaluation data to a server.

13. An electronic device, comprising:

one or more processors;

a storage device for storing one or more programs,

when executed by the one or more processors, cause the one or more processors to implement the method of any one of claims 1-7 or 8-10.

14. A computer-readable medium, on which a computer program is stored, which, when being executed by a processor, carries out the method according to any one of claims 1-7 or 8-10.

15. A computer program product comprising a computer program, characterized in that the computer program realizes the method according to any of claims 1-7 or 8-10 when executed by a processor.

Images