WO2024120113A1 - 云应用访问控制方法、装置及计算机可读存储介质 - Google Patents

云应用访问控制方法、装置及计算机可读存储介质 Download PDF

Info

Publication number
WO2024120113A1
WO2024120113A1 PCT/CN2023/130653 CN2023130653W WO2024120113A1 WO 2024120113 A1 WO2024120113 A1 WO 2024120113A1 CN 2023130653 W CN2023130653 W CN 2023130653W WO 2024120113 A1 WO2024120113 A1 WO 2024120113A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
cloud
cloud application
security
information
Prior art date
Application number
PCT/CN2023/130653
Other languages
English (en)
French (fr)
Inventor
陈德照
祝涛
Original Assignee
华为云计算技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN202310127438.5A external-priority patent/CN118214571A/zh
Application filed by 华为云计算技术有限公司 filed Critical 华为云计算技术有限公司
Publication of WO2024120113A1 publication Critical patent/WO2024120113A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the field of cloud technology, and in particular to a cloud application access control method, device, and computer-readable storage medium.
  • the present application provides a cloud application access control method, device and computer-readable storage medium, which can effectively protect cloud applications and improve the security of cloud applications.
  • a cloud application access control method comprising:
  • the cloud gateway When receiving the cloud application access request sent by the terminal device, the cloud gateway obtains the identity information of the terminal device, the identity information of the first user, and the first information, where the first information includes at least one of the following: a security check result obtained by detecting the security baseline of the terminal device and a score corresponding to the security check result, where the first user is a user of the terminal device;
  • the cloud gateway authenticates the terminal device according to the identity information of the terminal device, the identity information of the first user, and the first information;
  • the cloud gateway allows the terminal device to access the cloud application.
  • the cloud gateway will adopt the security policy to protect the security of the cloud application.
  • the cloud gateway denies the terminal device access to the cloud application.
  • the cloud gateway when the cloud gateway receives a cloud application access request sent by a terminal device, it authenticates the terminal device based on the user identity and the identity of the terminal device, as well as the security check results obtained by detecting the security baseline of the terminal device and/or the score corresponding to the security check results, thereby strengthening the cloud application access control of the terminal device and being able to better protect the security of the cloud application.
  • the cloud gateway will continue to monitor whether the terminal device has security risks. When it detects that the terminal device has security risks, it will adopt security policies to protect the security of the cloud application, eliminate security risks in a timely manner, and further improve the security of the cloud application.
  • the cloud gateway may obtain the first information in the following manner: the cloud gateway sends an authentication request to the terminal device, requesting authentication of the cloud gateway, and receiving the first information sent by the terminal device after the authentication of the cloud gateway is passed. In this way, untrusted devices can be prevented from stealing the first information, and the security of the first information can be protected.
  • the security check result is obtained by an agent of the terminal device detecting a security baseline of the terminal device, and the security check result obtained by the cloud gateway is sent by the agent of the terminal device to the cloud gateway.
  • the work of checking the security baseline of the terminal device is the responsibility of the agent of the terminal device, and there is no need for the cloud gateway to instruct the terminal device to check the security baseline, thereby achieving loosely coupled cooperation between the cloud vendor to which the cloud gateway belongs and the agent vendor.
  • the score corresponding to the security check result is the score of the security check result by the agent of the terminal device, and the score corresponding to the security check result obtained by the cloud gateway is sent to the cloud gateway by the agent of the terminal device.
  • the work of scoring the security check results is also the responsibility of the agent of the terminal device. There is no need for the cloud gateway to instruct the terminal device to score the security check results, which can deepen the loosely coupled cooperation between the cloud vendor to which the cloud gateway belongs and the agent vendor.
  • the method provided in the first aspect further includes the following steps: the cloud gateway obtains attribute information of the cloud application access request, and determines whether the terminal device has a security risk based on the attribute information of the cloud application access request.
  • the attribute information of the cloud application access request includes at least one of the following: the time when the cloud gateway receives the cloud application access request, the IP address of the terminal device that sends the cloud application access request, The identifier of the first user who sends the cloud application access request, the fingerprint of the browser that sends the cloud application access request, the information of the cloud application accessed by the cloud application access request, and the operation performed on the cloud application by the cloud application access request.
  • the method provided in the first aspect further includes the following steps: the cloud gateway obtains the latest first information, and determines whether there is a security risk in the terminal device based on the latest first information.
  • the security policy includes one or more of the following combinations: terminating terminal device access to cloud applications, adding the IP address of the terminal device to a blacklist, delaying terminal device access to cloud applications, and authenticating the terminal device through one or more authentication factors.
  • the first information acquired by the cloud gateway is sent to the cloud gateway after being encrypted by the terminal device, so that the security of the first information during transmission can be improved.
  • the authentication factors are password, fingerprint information, face information, iris information, voice, mobile phone verification, email verification, security questions, ID number, passport number, and digital certificate.
  • the cloud gateway is a zero-trust gateway.
  • a cloud application access control device comprising:
  • an acquisition module configured to acquire, upon receiving a cloud application access request sent by a terminal device, identity information of the terminal device, identity information of a first user, and first information, wherein the first information includes at least one of the following: a security check result obtained by detecting a security baseline of the terminal device, and a score corresponding to the security check result, wherein the first user is a user of the terminal device;
  • An authentication module used to authenticate the terminal device according to the identity information of the terminal device, the identity information of the first user and the first information;
  • the authentication module is also used to allow the terminal device to access the cloud application if the terminal device passes the authentication, and to adopt a security policy if it is determined that there is a security risk in the terminal device during the process of the terminal device accessing the cloud application.
  • the security policy is used to protect the security of the cloud application;
  • the authentication module is also used to deny the terminal device access to the cloud application if the authentication terminal device fails.
  • the cloud application access control device further includes a sending module for sending an authentication request to a terminal device, requesting authentication of the cloud application access control device.
  • the acquisition module is used to receive the first information sent by the terminal device after the authentication of the cloud application access control device is passed.
  • the security check result is obtained by an agent of the terminal device detecting a security baseline of the terminal device, and the security check result obtained by the acquisition module is sent to the acquisition module by the agent of the terminal device.
  • the score corresponding to the security check result is a score given to the security check result by an agent of the terminal device, and the score corresponding to the security check result acquired by the acquisition module is sent to the acquisition module by the agent of the terminal device.
  • the cloud application access control device further includes a monitoring module.
  • the acquisition module is used to acquire the attribute information of the cloud application access request
  • the monitoring module is used to determine whether the terminal device has a security risk based on the attribute information of the cloud application access request.
  • the attribute information of the cloud application access request includes at least one of the following: the time when the acquisition module receives the cloud application access request, the IP address of the terminal device that sends the cloud application access request, the identifier of the first user that sends the cloud application access request, the fingerprint of the browser that sends the cloud application access request, the information of the cloud application accessed by the cloud application access request, and the operation performed on the cloud application by the cloud application access request;
  • the acquisition module is used to acquire the latest first information
  • the monitoring module is used to determine whether the terminal device has a security risk based on the latest first information
  • the security policy includes one or more of the following combinations: terminating terminal device access to cloud applications, adding the IP address of the terminal device to a blacklist, delaying terminal device access to cloud applications, and authenticating the terminal device through one or more authentication factors.
  • the first information acquired by the acquisition module is sent to the acquisition module after being encrypted by the terminal device.
  • the authentication factors are password, fingerprint information, face information, iris information, voice, mobile phone verification, email verification, security questions, ID number, passport number, and digital certificate.
  • the cloud application access control device is a zero-trust gateway.
  • a computing device comprising a processor and a memory; the processor is used to execute instructions stored in the memory, so that the computing device implements the method described in the first aspect and any one of the embodiments of the first aspect.
  • a computer-readable storage medium stores instructions for implementing the method described in the first aspect and any one of the embodiments of the first aspect.
  • a computer program product comprising a computer program.
  • the computer program When the computer program is read and executed by a computing device, the computing device executes the method described in the first aspect and any one of the embodiments of the first aspect.
  • FIG1 is a schematic diagram of the structure of a cloud application access control system exemplarily shown in the present application
  • FIG2 is a flow chart of a cloud application access control method provided by the present application.
  • FIG3 is a schematic diagram of a process of authenticating a terminal device by a cloud gateway as exemplified in the present application;
  • FIG4 is a schematic diagram of a process of monitoring whether a terminal device has security risks provided by the cloud gateway of the present application
  • FIG5 is a schematic diagram of the structure of a cloud application access control device provided by the present application.
  • FIG6 is a schematic diagram of the structure of a computing device provided by the present application.
  • Safety baseline is a term borrowed from the concept of “baseline”.
  • baseline is: a basic reference in measurement, calculation or positioning, such as the coastal baseline, which is the water level line reached by the water level.
  • the safety baseline can be considered as the shortest board of the safety barrel, or in other words, the minimum safety requirement.
  • the security baseline of terminal devices can be understood as the minimum security requirement for terminal devices. It is the standard that terminal device configuration must meet in order to meet security specification requirements. It mainly includes security requirements in terms of viruses, vulnerabilities, configuration and system status. Among them, vulnerabilities are usually security risks caused by defects in software or protocols, such as login vulnerabilities, denial of service vulnerabilities, buffer overflows, information leakage, worm backdoors, malicious code execution, etc., reflecting the security vulnerability of the terminal device itself; configuration mainly includes configuration requirements in terms of accounts, passwords, authorizations, logs, IP protocols, etc. Improper configuration may lead to security risks in terminal devices; system status includes monitoring of port status, processes, accounts, services and important file changes.
  • Security baseline testing generally uses various tools to test security baseline test items (such as whether a firewall is installed, whether a firewall is started, whether there are viruses, whether there are vulnerabilities, whether there is a user authentication module, etc.) to obtain security check results.
  • This security check result is a list item that will be compared with relevant requirements to determine whether each item is compliant, that is, to determine whether there is a security risk in the device.
  • FIG1 is a schematic diagram of the structure of a cloud application access control system exemplarily shown in the present application.
  • the system includes: a terminal device 100 , a cloud gateway 200 , a cloud platform 300 , and a resource pool 400 .
  • the terminal device 100 is connected to the public cloud through a network, which may be a wide area network, a local area network, a point-to-point connection, or any combination thereof.
  • the public cloud includes a cloud gateway 200, a cloud platform 300, and a resource pool 400.
  • the terminal device 100 can access the cloud applications in the resource pool 400 through the cloud gateway 200 and the cloud platform 300.
  • the terminal device 100 may also be referred to as a terminal or a client, and may be a device with wireless transceiver function, which may be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it may also be deployed on the water surface (such as a ship, etc.); it may also be deployed in the air (such as an airplane, a balloon, and a satellite, etc.).
  • the terminal device 100 may be a user equipment (UE), wherein the UE includes a handheld device, a vehicle-mounted device, a wearable device, or a computing device with wireless communication function.
  • the UE may be a mobile phone, a tablet computer, or a computer with wireless transceiver function.
  • the terminal device 100 may also be a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a wireless terminal in telemedicine, a wireless terminal in a smart grid, a wireless terminal in a smart city, a wireless terminal in a smart home, and the like.
  • VR virtual reality
  • AR augmented reality
  • wireless terminal in industrial control a wireless terminal in unmanned driving
  • a wireless terminal in telemedicine a wireless terminal in a smart grid
  • a wireless terminal in a smart city a wireless terminal in a smart home, and the like.
  • the cloud gateway 200 is mainly responsible for performing cloud application access control according to the location of the terminal device 100 in the network (i.e., the IP address of the terminal device 100) when receiving a cloud application access request to the resource pool 400 sent by the terminal device 100. That is, the network is divided into intranet, extranet and other areas, and the intranet and extranet are isolated at the network boundary. If it is determined that the IP address of the terminal device 100 carried in the cloud application access request belongs to the intranet IP address, the terminal device 100 is allowed to access the cloud application. If it is determined that the IP address of the terminal device 100 does not belong to the intranet IP address, the terminal device 100 is denied access to the cloud application.
  • the cloud platform 300 can be used to receive the cloud application access request forwarded by the cloud gateway 200, and locate the specific cloud application according to the cloud application identifier carried in the cloud application access request, so as to enable the terminal device 100 to access the cloud application.
  • the cloud platform 300 can be implemented by a general physical server, such as an ARM server or an X86 server, or a virtual machine, which is not specifically limited in this application.
  • the resource pool 400 can provide users with a variety of cloud applications (also known as cloud services or cloud resources).
  • the types of cloud applications may include computing, storage, database, artificial intelligence (AI), big data, and other categories.
  • computing-type cloud applications may include elastic cloud servers (ECS), bare metal servers, cloud phones, and the like;
  • storage-type cloud applications may include object storage, cloud hard disks, data backup, and the like;
  • database-type cloud applications may include databases, data replication, data management, and the like;
  • AI-type cloud applications may include image recognition, text recognition, natural language processing (NLP), and the like;
  • big data-type cloud applications may include map reduce, data search, recommendation systems, and the like.
  • more cloud application types may be included, and each type may include more cloud applications, which are not illustrated one by one here.
  • the cloud application access control system shown in FIG1 is only an example.
  • the system may also include other or more Multiple components, for example, include more terminal devices 100 and more cloud gateways 200 .
  • the cloud gateway 200 performs cloud application access control based on the location of the terminal device 100 in the network (referring to the IP address of the terminal device 100) to protect the security of the cloud application.
  • the network becomes more and more fragmented and the network boundaries become more and more blurred, network security risks are becoming increasingly complex, such as the emergence of new network attack methods such as targeted threat attacks and ransomware.
  • Continuing to use the above solution for cloud application access control will inevitably bring a large number of implicit trust vulnerabilities and security operation and maintenance workload, and cannot well protect the security of cloud applications.
  • the cloud gateway 200 passes the authentication of the terminal device 100, it will continue to allow the terminal device 100 to access the cloud application, and does not monitor the security risks that may exist in the terminal device 100 during the process of the terminal device 100 accessing the cloud application.
  • the terminal device 100 is invaded by a virus during the process of accessing the cloud application, or the user identity authentication module on the terminal device 100 is deleted, or the user identity authentication module on the terminal device 100 updates the password, and the updated password is weak, which poses a great security threat to the cloud application.
  • the present application provides a cloud application access control method.
  • the cloud gateway 200 when the cloud gateway 200 receives the cloud application access request sent by the terminal device 100, it can obtain the identity information of the first user (referring to the user of the terminal device 100) and the identity information of the terminal device 100, and obtain the security check results obtained by detecting the security baseline of the terminal device 100 and/or the score of the security check results. Then, the terminal device 100 is authenticated according to the above information. If the authentication is passed, the terminal device 100 is allowed to access the cloud application, and the terminal device 100 is continuously monitored for security risks during the process of the terminal device 100 accessing the cloud application.
  • a security policy is adopted to protect the security of the cloud application and the security risk is eliminated in time. If the authentication fails, the terminal device 100 is denied access to the cloud application, thereby well protecting the security of the cloud application.
  • the method may include the following steps:
  • the cloud gateway 200 When the cloud gateway 200 receives a cloud application access request sent by the terminal device 100, it obtains the identity information of the first user, the identity information of the terminal device 100 and the first information, where the first information includes at least one of the following: a security check result obtained by detecting the security baseline of the terminal device 100, and a score corresponding to the security check result, where the first user is the user of the terminal device 100.
  • the identity information of the first user is used by the cloud gateway 200 to authenticate the first user
  • the identity information of the terminal device 100 is used by the cloud gateway 200 to authenticate the identity of the terminal device 100
  • the first information is used by the cloud gateway 200 to evaluate the security risk of the terminal device 100 and authenticate the terminal device 100 based on the evaluated security risk.
  • the identity information of the first user may be the user name and password of the first user, and the user name may be the work number, email address, mobile phone number, ID number, passport number, fingerprint information, face information, iris information, etc. of the first user;
  • the identity information of the terminal device 100 may be the serial number, machine name, IP address, digital certificate, etc. of the terminal device 100;
  • the security baseline of the terminal device 100 may include multiple detection items, such as whether a firewall is installed, whether a firewall is started, whether a virus exists, whether a vulnerability exists, whether there is a user identity authentication module, etc.; the score corresponding to the security check result refers to the scoring of the security check result. Generally, the higher the score, the more secure the terminal device 100 is.
  • the cloud gateway 200 can refer to any one of the following methods 1 to 8 to obtain the identity information of the first user, the identity information of the terminal device 100, and the first information:
  • Method 1 The cloud gateway 200 sends a first acquisition request to the terminal device 100, requesting to obtain the identity information of the first user, the identity information of the terminal device 100, and the first information.
  • Method 2 The cloud gateway 200 sends a second acquisition request to the terminal device 100, requesting to obtain the identity information of the first user, the identity information of the terminal device 100 and the security check result. After obtaining the security check result, the cloud gateway 200 scores the security check result to obtain a score corresponding to the security check result.
  • Method 3 The cloud application access request sent by the terminal device 100 carries the identity information of the first user and the identity information of the terminal device 100, but does not carry the first information.
  • the cloud gateway 200 obtains the identity information of the first user and the identity information of the terminal device 100 from the cloud application access request, and the cloud gateway 200 sends a third acquisition request to the terminal device 100, requesting to obtain the first information.
  • Method 4 The cloud application access request sent by the terminal device 100 carries the identity information of the first user and the identity information of the terminal device 100, but does not carry the first information.
  • the cloud gateway 200 obtains the identity information of the first user and the identity information of the terminal device 100 from the cloud application access request.
  • the cloud gateway 200 sends a fourth acquisition request to the terminal device 100, requesting to obtain the security check result. After obtaining the security check result, the cloud gateway 200 scores the security check result to obtain a score corresponding to the security check result.
  • Method 5 The cloud application access request sent by the terminal device 100 carries the identity information of the first user, but does not carry the identity information and the first information of the terminal device 100.
  • the cloud gateway 200 obtains the identity information of the first user from the cloud application access request.
  • the cloud gateway 200 sends a fifth acquisition request to the terminal device 100, requesting to obtain the identity information and the first information of the terminal device 100.
  • Method 6 The cloud application access request sent by the terminal device 100 carries the identity information of the terminal device 100, but does not carry the identity information of the first user.
  • the cloud gateway 200 obtains the identity information of the terminal device 100 from the cloud application access request, and the cloud gateway 200 sends a sixth acquisition request to the terminal device 100, requesting to obtain the identity information and the first information of the first user.
  • Method 7 The cloud application access request sent by the terminal device 100 carries the identity information of the first user, but does not carry the identity information and the first information of the terminal device 100.
  • the cloud gateway 200 obtains the identity information of the first user from the cloud application access request.
  • the cloud gateway 200 sends a seventh acquisition request to the terminal device 100, requesting to obtain the identity information and security check results of the terminal device 100.
  • the cloud gateway 200 scores the security check results to obtain a score corresponding to the security check results.
  • Method 8 The cloud application access request sent by the terminal device 100 carries the identity information of the terminal device 100, but does not carry the identity information and the first information of the first user.
  • the cloud gateway 200 obtains the identity information of the terminal device 100 from the cloud application access request.
  • the cloud gateway 200 sends an eighth acquisition request to the terminal device 100, requesting to obtain the identity information and the security check result of the first user.
  • the cloud gateway 200 scores the security check result to obtain a score corresponding to the security check result.
  • the above-mentioned acquisition request may include inspection items corresponding to the security baseline of the terminal device 100, such as whether a firewall is installed, whether the firewall is started, whether there is a virus, whether there is a vulnerability, whether there is a user identity authentication module, etc., so that the terminal device 100 can detect itself according to the inspection items corresponding to the security baseline of the terminal device 100 carried in the acquisition request to obtain a security inspection result.
  • inspection items corresponding to the security baseline of the terminal device 100 such as whether a firewall is installed, whether the firewall is started, whether there is a virus, whether there is a vulnerability, whether there is a user identity authentication module, etc.
  • an agent (also referred to as agent software) is installed on the terminal device 100, and the agent is configured with check items corresponding to the security baseline of the terminal device 100.
  • agent software When the terminal device 100 runs the agent, the agent can detect the security baseline of the terminal device 100 to obtain the security check result.
  • the cloud gateway 200 when obtaining the security check result, can directly send an acquisition request to the agent of the terminal device 100 to request the security check result, and the acquisition request does not need to include the check items corresponding to the security baseline of the terminal device 100.
  • the work of checking the security baseline of the terminal device 100 is the responsibility of the agent of the terminal device 100, and there is no need for the cloud gateway 200 to instruct the terminal device 100 to check the security baseline of the terminal device 100, which can achieve loose coupling cooperation between the cloud vendor to which the cloud gateway 200 belongs and the agent vendor.
  • the agent on the terminal device 100 may also have the function of scoring the security check result.
  • the cloud gateway 200 may directly send an acquisition request to the agent of the terminal device 100 to request the score corresponding to the security check result. It can be seen that in this embodiment, the work of scoring the security check result is also the responsibility of the agent of the terminal device 100, and there is no need for the cloud gateway 200 to instruct the terminal device 100 to score the security check result, which can deepen the loose coupling cooperation between the cloud vendor to which the cloud gateway 200 belongs and the agent vendor.
  • the agent of the terminal device 100 may provide a lightweight interface for the cloud gateway 200 to obtain security check results and scores corresponding to the security check results, or the agent of the terminal device 100 may integrate a software development kit (SDK) provided by the cloud vendor of the cloud gateway 200 to enable the cloud gateway 200 to obtain security check results and scores corresponding to the security check results.
  • SDK software development kit
  • the above-listed methods for the cloud gateway 200 to obtain the identity information of the first user, the identity information of the terminal device 100 and the first information are merely examples, and other methods that enable the cloud gateway 200 to obtain the above information also fall within the scope of protection of this application, and this application does not make any specific limitations on this.
  • the cloud gateway 200 may send an authentication request to the terminal device 100/the agent of the terminal device 100, requesting the terminal device 100/the agent of the terminal device 100 to authenticate the cloud gateway 200. If the terminal device 100/the agent of the terminal device 100 passes the authentication of the cloud gateway 200, the cloud gateway 200 is allowed to obtain the security check results and the scores corresponding to the security check results. If the authentication of the cloud gateway 200 fails, the cloud gateway 200 is denied to obtain the security check results and the scores corresponding to the security check results.
  • the authentication request may include authentication information of the cloud gateway 200, such as the number, machine name, IP address, digital certificate, etc. of the cloud gateway 200.
  • the authentication information of the cloud gateway 200 can be preset in the terminal device 100/the agent of the terminal device 100.
  • the terminal device 100/the agent of the terminal device 100 receives an authentication request sent by the cloud gateway 200 and carrying the authentication information of the cloud gateway 200
  • the cloud gateway 200 is authenticated according to the preset authentication information and the authentication information carried in the authentication request.
  • the authentication of the cloud gateway 200 is passed; otherwise, the authentication of the cloud gateway 200 is failed.
  • the terminal device 100 in order to prevent the identity information of the terminal device 100, the identity information of the first user, the security check result, and the score corresponding to the security check result from being stolen by other devices outside the cloud gateway 200 when the terminal device 100 returns the identity information of the terminal device 100, the identity information of the first user, the security check result, and the score corresponding to the security check result to the cloud gateway 200, the terminal device 100 can encrypt the information and then transmit it to the cloud gateway 200.
  • S202 The cloud gateway 200 authenticates the terminal device 100 according to the identity information of the first user, the identity information of the terminal device 100 and the first information. If the authentication is successful, S203 and S204 are executed. If the authentication is not successful, S206 is executed.
  • the user can use the terminal device 100 to the cloud gateway 200 or the cloud gateway 200 to which the user belongs.
  • the terminal device 100 applies for identity registration with the user identity management platform provided by the cloud vendor.
  • the cloud gateway 200 or the user identity management platform reviews the identity of the user. If the review is passed, the identity information of the user is saved, so that the cloud gateway 200 or the user identity management platform can subsequently authenticate the user identity based on the saved user identity information.
  • the terminal device 100 can also apply for identity registration with the cloud gateway 200 or the terminal device identity management platform provided by the cloud vendor to which the cloud gateway 200 belongs.
  • the terminal device identity management platform reviews the identity of the terminal device 100. If the review is passed, the identity information of the terminal device 100 is saved, so that the cloud gateway 200 or the terminal device identity management platform can subsequently authenticate the identity of the terminal device 100 based on the saved identity information of the terminal device 100.
  • the specific implementation process of S202 includes the following steps S2021-S2026:
  • S2021 The cloud gateway 200 authenticates the identity of the first user according to the identity information of the first user. If the identity authentication of the first user passes, S2022 is executed; if the identity authentication of the first user fails, S2026 is executed.
  • the cloud gateway 200 can directly match the identity information of the first user with the identity information of at least one user stored in itself. If there is matching identity information, the identity authentication of the first user is successful; otherwise, the identity authentication of the first user fails.
  • the cloud gateway 200 can send a query request carrying the identity information of the first user to the user identity management platform, and the user identity management platform matches the identity information of the first user with the identity information of at least one user stored by itself. If there is matching identity information, the authentication of the first user is successful. Otherwise, the authentication of the first user is failed. Then, the user identity management platform feeds back the authentication result to the cloud gateway 200.
  • S2022 The cloud gateway 200 authenticates the identity of the terminal device 100 according to the identity information of the terminal device 100. If the identity authentication of the terminal device 100 passes, S2023 is executed; if the identity authentication of the terminal device 100 fails, S2026 is executed.
  • the cloud gateway 200 can directly match the identity information of the terminal device 100 with the identity information of at least one terminal device stored in itself. If there is matching identity information, the identity of the terminal device 100 is authenticated; otherwise, the identity of the terminal device 100 is not authenticated.
  • the cloud gateway 200 can send a query request carrying the identity information of the terminal device 100 to the terminal device identity management platform, and the terminal device identity management platform matches the identity information of the terminal device 100 with the identity information of at least one terminal device stored by itself. If there is matching identity information, the identity of the terminal device 100 is authenticated. Otherwise, the identity of the terminal device 100 is not authenticated. Then, the terminal device identity management platform feeds back the authentication result to the cloud gateway 200.
  • S2023 The cloud gateway 200 authenticates whether the terminal device 100 is compliant based on the security check result. If the terminal device 100 is compliant, S2024 is executed. If the terminal device 100 is not compliant, S2026 is executed.
  • the cloud gateway 200 can determine whether each inspection item in the security inspection result meets the preset requirements. When it is determined that each inspection item in the security inspection result meets the preset requirements, the terminal device 100 is determined to be compliant. Otherwise, the terminal device 100 is determined to be non-compliant.
  • the preset requirements corresponding to each inspection item can be customized according to actual conditions. Taking the inspection item of whether there is a vulnerability as an example, the preset requirement can be that there is no vulnerability or that the existing vulnerability type does not belong to the preset vulnerability type. Taking the inspection item of whether there is a virus as an example, the preset requirement can be that there is no virus or that the existing virus does not belong to the preset virus type. Taking the inspection item of whether there is a user identity authentication module as an example, the preset requirement can be that there is a user identity authentication module. This application does not specifically limit the preset requirements corresponding to each inspection item.
  • S2024 The cloud gateway 200 determines whether the score corresponding to the security check result reaches the preset score. If it is determined that the score corresponding to the security check result reaches the preset score, S2025 is executed. If it is determined that the score corresponding to the security check result does not reach the preset score, S2026 is executed.
  • the preset score can be customized according to the actual scenario. For example, when the full score of the security check result is 100 points, and the higher the score, the safer the terminal device 100, the preset score can be 70 points, 80 points, etc.; when the full score of the security check result is 100 points, and the lower the score, the safer the terminal device 100, the preset score can be 20 points, 30 points, etc. This application does not specifically limit the preset score.
  • the cloud gateway 200 passes the authentication of the terminal device 100.
  • S2026 The cloud gateway 200 fails to authenticate the terminal device 100.
  • the implementation process of S202 shown in Figure 3 is only an example. In a specific implementation, the implementation process of S202 may also be other.
  • the cloud gateway 200 first authenticates the identity of the terminal device 100 based on the identity information of the terminal device 100, and then authenticates the identity of the first user based on the identity information of the first user, and then determines whether the score corresponding to the security check result reaches the preset score, and finally authenticates whether the terminal device 100 is compliant based on the security check result. This application will not elaborate on this.
  • the cloud gateway 200 may also perform other operations, such as For example, if the cloud gateway 200 fails to authenticate the identity of the first user, the cloud gateway 200 may send a first prompt message to the terminal device 100, prompting the first user to re-enter the user's identity information; for another example, if the cloud gateway 200 fails to authenticate the identity of the terminal device 100, the cloud gateway 200 may send a second prompt message to the terminal device 100, prompting the first user to check the identity information of the terminal device 100; for another example, if the cloud gateway 200 authenticates that the terminal device 100 is not compliant, the cloud gateway 200 may send a third prompt message to the terminal device 100, prompting the first user to optimize the terminal device 100.
  • the cloud gateway 200 may also perform other operations, such as For example, if the cloud gateway 200 fails to authenticate the identity of the first user, the cloud gateway 200 may send a first prompt message to the terminal device 100, prompting the first user to re-enter the user's identity information; for another example, if the cloud gateway 200 fails to
  • the third prompt message may prompt the first user that the terminal device 100 is infected with a virus; for another example, if the cloud gateway 200 determines that the score corresponding to the security check result does not reach the preset score, the cloud gateway 200 may send a fourth prompt message to the terminal device 100, prompting the first user to optimize the terminal device 100.
  • S203 The cloud gateway 200 allows the terminal device 100 to access the cloud application.
  • the cloud gateway 200 may forward the cloud application access request of the terminal device 100 to the cloud platform 300 , and the cloud platform 300 may locate the specific cloud application according to the cloud application identifier carried in the cloud application access request, thereby enabling the terminal device 100 to access the cloud application.
  • S204 When the terminal device 100 accesses the cloud application, the cloud gateway 200 monitors whether the terminal device 100 has security risks. If it is determined that the terminal device 100 has security risks, S205 is executed. If it is determined that the terminal device 100 has no security risks, S204 is executed again.
  • the cloud gateway 200 may refer to any one or a combination of the following methods (1) to (4) to monitor whether the terminal device 100 has security risks:
  • Method (1) the cloud gateway 200 periodically obtains the latest first information and determines whether the terminal device 100 has a security risk based on the latest first information.
  • the cloud gateway 200 may periodically send an acquisition request for acquiring the latest first information to the terminal device 100/an agent of the terminal device 100/other devices that update the first information in real time, requesting to acquire the latest first information.
  • the cloud gateway 200 can determine whether each inspection item in the latest security check result meets the preset requirements. If it is determined that each inspection item meets the preset requirements, it is determined that there is no security risk in the terminal device 100. Otherwise, it can be determined that there is a security risk in the terminal device 100.
  • the cloud gateway 200 can determine whether the score corresponding to the latest security check result reaches the preset score. If it is determined that the latest score reaches the preset score, it is determined that there is no security risk in the terminal device 100. Otherwise, it can be determined that there is a security risk in the terminal device 100.
  • the cloud gateway 200 can determine whether each inspection item in the latest security check result meets the preset requirements, and determine whether the score corresponding to the latest security check result reaches the preset score. If it is determined that each inspection item meets the preset requirements and the latest score reaches the preset score, it is determined that there is no security risk in the terminal device 100. Otherwise, it can be determined that there is a security risk in the terminal device 100.
  • the above-mentioned cloud gateway 200 determines whether the terminal device 100 has a security risk based on the latest first information.
  • the implementation method is merely an example. Other methods that can determine whether the terminal device 100 has a security risk based on the latest first information also fall within the scope of protection of this application, and this application does not make any specific limitations on this.
  • Method (2) as shown in FIG4 , includes the following steps:
  • S401 The cloud platform 300 periodically obtains the latest first information.
  • the cloud platform 300 determines whether there is a security risk in the terminal device 100 based on the latest first information.
  • S404 The cloud platform 300 sends the security policy to the cloud gateway 200.
  • S405 The cloud gateway 200 determines that the terminal device 100 has a security risk according to the security policy.
  • S406 The cloud gateway 200 executes the security policy.
  • the security policy may include one or more of the following combinations: terminating the terminal device 100 from accessing the cloud application, adding the IP address of the terminal device 100 to a blacklist, delaying the terminal device 100 from accessing the cloud application, and re-authenticating the terminal device 100 through one or more authentication factors, and when the re-authentication of the terminal device 100 is passed, allowing the terminal device 100 to access the cloud application, etc. It should be understood that the above security policies are merely examples and should not be regarded as limiting the way to protect the security of cloud applications.
  • the above authentication factors may be password, fingerprint information, face information, iris information, voice, mobile phone verification, email verification, security questions, ID number, passport number, digital certificate, etc.
  • the cloud gateway 200 extracts attribute information of the cloud application access request, the attribute information of the cloud application access request includes at least one of the following: the time when the cloud gateway 200 receives the cloud application access request, the identification of the terminal device 100 that sends the cloud application access request, the identification of the first user, the fingerprint of the browser that sends the cloud application access request, the information of the cloud application accessed by the cloud application access request, and the operation performed on the cloud application by the cloud application access request, and then determines whether the terminal device 100 has a security risk based on the attribute information of the cloud application access request.
  • Browser fingerprint refers to obtaining various information about the browser, such as font, resolution, browser mode, language, time zone, number of central processing unit (CPU) cores, graphics card information, plug-in information, etc., and calculating a unique value based on this information. This unique value is the browser fingerprint.
  • CPU central processing unit
  • the information of cloud applications includes the identification of cloud applications (such as the name of the cloud application, the location of the cloud application, etc.), the type of cloud application, the content of the cloud application, etc.
  • the type of cloud applications can be divided into key cloud applications, ordinary cloud applications, or high-sensitivity cloud applications, medium-sensitivity cloud applications, low-sensitivity cloud applications, etc.
  • the process of determining whether the terminal device 100 has a security risk based on the time when the cloud gateway 200 receives the cloud application access request can be as follows: the cloud gateway 200 can determine whether the time when it receives the cloud application access request is within a preset time range (e.g., 7:00:00-24:00:00). If the time when the cloud application access request is received is within the preset time range, it is determined that the terminal device 100 has no security risk. Otherwise, it is determined that the terminal device 100 has a security risk.
  • the preset time range can be customized according to the actual scenario, and this application does not specifically limit this. For example, the preset time range can be the time period when the first user accesses the cloud application on a daily basis.
  • the process by which the cloud gateway 200 determines whether there is a security risk for the terminal device 100 based on the IP address of the terminal device 100 that sends the cloud application access request can be as follows: the cloud gateway 200 can determine whether there is an IP address in the IP address blacklist library that is identical to the IP address of the terminal device 100. If there is an identical IP address, it is determined that there is a security risk for the terminal device 100; if there is no identical IP address, it is determined that there is no security risk for the terminal device 100.
  • the process by which the cloud gateway 200 determines whether there is a security risk in the terminal device 100 based on the identifier of the first user can be as follows: the cloud gateway 200 can determine whether there is a user identifier that is identical to the identifier of the first user in the user identifier blacklist library. If there is an identical user identifier, it is determined that there is a security risk in the terminal device 100; if there is no identical user identifier, it is determined that there is no security risk in the terminal device 100.
  • the cloud gateway 200 can query the terminal device type mapping table according to the identifier of the first user to determine the type of the terminal device 100 of the first user, and then determine whether the type of the terminal device 100 belongs to a preset terminal device type.
  • the terminal device type mapping table is used to record the identifier of at least one user and the type of the terminal device of at least one user, and the terminal device type recording table is also used to record the mapping relationship between the identifier of at least one user and the type of the terminal device of each user.
  • the cloud gateway 200 can determine that the type of the terminal device 100 is type A by querying Table 1 based on the first user's identifier 0001, and further determine that the type of the terminal device 100 belongs to the preset terminal device type. Therefore, the cloud gateway 200 can determine that there is no security risk in the terminal device 100.
  • Table 1 is only used as an example to reflect the correspondence between the user identification and the type of terminal device.
  • the content and correspondence recorded in the terminal type mapping table can also be in other forms, which are not specifically limited here.
  • the process by which the cloud gateway 200 determines whether there is a security risk in the terminal device 100 based on the browser fingerprint can be as follows: the cloud gateway 200 can determine whether there is a fingerprint in the browser fingerprint blacklist library that is identical to the fingerprint of the browser sending the cloud application access request. If the same fingerprint exists, it is determined that there is a security risk in the terminal device 100; if the same fingerprint does not exist, it is determined that there is no security risk in the terminal device 100.
  • the cloud gateway 200 can determine whether there is an identifier in the cloud application identifier blacklist library that is identical to the identifier of the cloud application accessed by the cloud application access request. If the same identifier exists, it is determined that there is a security risk for the terminal device 100. If the same identifier does not exist, it is determined that there is no security risk for the terminal device 100.
  • the process by which the cloud gateway 200 determines whether the terminal device 100 has a security risk based on the type of cloud application can be as follows: the cloud gateway 200 determines whether the type of cloud application is a preset cloud application type (such as the above-mentioned high-sensitivity cloud application type). If the type of cloud application is determined to be the preset cloud application type, it is determined that the terminal device 100 has a security risk. Otherwise, it can be determined that the terminal device 100 does not have a security risk.
  • a preset cloud application type such as the above-mentioned high-sensitivity cloud application type
  • the process of cloud gateway 200 determining whether there is a security risk in terminal device 100 based on the operation performed by the cloud application access request on the cloud application can be as follows: the cloud gateway can determine whether there is a behavior in the attack behavior library that is identical to the operation performed by the cloud application access request on the cloud application. If the same behavior exists, it is determined that there is a security risk in terminal device 100. Otherwise, it can be determined that there is no security risk in terminal device 100.
  • Mode (4) The cloud gateway 200 forwards the cloud application access request sent by the terminal device 100 to the cloud platform 300, and the cloud platform 300 extracts the attribute information of the cloud application access request. Then, the cloud platform 300 determines whether the terminal device 100 has a security risk based on the attribute information of the cloud application access request. When it is determined that the terminal device 100 has a security risk, the cloud platform 300 generates a security policy and sends the security policy to the cloud gateway 200. When the cloud gateway 200 receives the security policy sent by the cloud platform 300, it determines that the terminal device 100 has a security risk and executes the security policy.
  • the attribute information of the cloud application access request listed above is only used as an example, and this application does not specifically limit the attribute information of the cloud application access request. It should also be understood that the above-listed method of the cloud gateway 200/cloud platform 300 determining whether the terminal device 100 has a security risk based on the attribute information of the cloud application access request is only used as an example, and other methods that can enable the cloud gateway 200/cloud platform 300 to determine whether the terminal device 100 has a security risk based on the attribute information of the cloud application access request, such as timing detection, artificial intelligence, etc., also fall within the scope of protection of this application, and this application will not elaborate on them.
  • the cloud gateway 200/cloud platform 300 determines whether there is a security risk in the terminal device 100, the richer the information of the cloud application access request referenced, the more accurate the result will be, which is more conducive to improving the security of the cloud application.
  • the enterprise to which the terminal device 100 belongs has multiple terminal devices, and the enterprise deploys a monitoring center for real-time monitoring of the multiple terminal devices for security risks.
  • the monitoring center monitors that there is a security risk in a terminal device among the multiple terminal devices
  • the monitoring center can send a notification carrying the identification of the terminal device with security risks to the cloud gateway 200, notifying the cloud gateway 200 that the terminal device has a security risk.
  • the cloud gateway 200 can determine whether the cloud application access request received and processed comes from the above-mentioned terminal device with security risks. If it is determined that the cloud application access request received and processed comes from the above-mentioned terminal device with security risks, the security policy is executed.
  • the monitoring center when it monitors that there is a security risk in a terminal device among multiple terminal devices, it can also send a notification carrying the identification of the terminal device with security risk to the cloud platform 300, notifying the cloud platform 300 that the terminal device has a security risk.
  • the cloud platform 300 After receiving the notification, the cloud platform 300 can generate a security policy and send the security policy to the cloud gateway 200.
  • the security policy can carry the identification of the terminal device with security risk.
  • the cloud gateway 200 After receiving the security policy, can determine whether the cloud application access request received and processed comes from the above-mentioned terminal device with security risk. If it is determined that the cloud application access request received and processed comes from the above-mentioned terminal device with security risk, the security policy is executed.
  • the cloud gateway 200 may further determine the security risk level, and then execute corresponding security policies according to different security risk levels. For example, assuming that the preset score is 80 points, the cloud gateway 200 pre-sets the security risk level of [50 points, 80 points) as level 1, the security risk level of [25 points, 50 points) as level 2, and the security risk level of [0 points, 25 points) as level 3.
  • the security policy corresponding to level 1 is "delay the terminal device 100 to access the cloud application, and re-authenticate the terminal device 100 through one or more authentication factors, and then re-authenticate the terminal device 100. If the authentication passes, the terminal device 100 is allowed to access the cloud application.
  • the security policy corresponding to level 2 is "termination of terminal device 100 access to cloud applications”
  • the security policy corresponding to level 3 is "termination of terminal device 100 access to cloud applications and adding the IP address of the terminal device to the blacklist”.
  • the cloud gateway 200 can determine that there is a security risk in the terminal device 100, and further determine that the security risk level is level 2, and then execute the security policy corresponding to the above-mentioned level 2 risk.
  • S205 The cloud gateway 200 adopts security policies to protect the security of cloud applications.
  • S206 The cloud gateway 200 denies the terminal device 100 access to the cloud application.
  • the cloud gateway 200 may directly discard the cloud application access request of the terminal device 100 , or retain the cloud application access request but not forward the request to the cloud platform 300 .
  • the cloud gateway 200 may also add the IP address of the terminal device 100 to a blacklist, or delay the terminal device 100 from accessing the cloud application. During the delayed period, the terminal device 100 may be authenticated again through one or more authentication factors. When the terminal device 100 is authenticated again, the terminal device 100 is allowed to access the cloud application. When the authentication fails again, the terminal device 100 is denied access to the cloud application.
  • the cloud gateway 200 is a zero-trust gateway, which is a cloud gateway service provided by a cloud vendor to the outside world and is used to ensure the security of cloud applications through continuous identity authentication (including user identity authentication and terminal device identity authentication).
  • the cloud gateway 200 when the cloud gateway 200 receives the cloud application access request sent by the terminal device 100, it authenticates the terminal device 100 according to the user identity and the identity of the terminal device 100, as well as the security check result obtained by detecting the security baseline of the terminal device 100 and/or the score corresponding to the security check result, thereby strengthening the cloud application access control of the terminal device 100 and better protecting the security of the cloud application.
  • the terminal device 100 is continuously monitored for security risks.
  • a security strategy is adopted to protect the security of the cloud application, which can eliminate the security risks in a timely manner and further improve the security of the cloud application.
  • the above text elaborates on the cloud application access control method provided by the present application.
  • the cloud application access control device provided by the present application is introduced next.
  • the device can be applied to the resource access control system shown in Figure 1, and specifically can be applied to the cloud gateway 200 shown in Figure 1.
  • each module can be a software module or a hardware module, or can be partly a software module and partly a hardware module.
  • the present application does not limit this.
  • FIG. 5 is a schematic diagram of the structure of a cloud application access control device 500 exemplarily shown in the present application.
  • the device 500 includes: an acquisition module 510 and an authentication module 520 .
  • the acquisition module 510 is used to obtain the identity information of the terminal device 100, the identity information of the first user and the first information when receiving a cloud application access request sent by the terminal device 100, the first information including at least one of the following: a security check result obtained by detecting the security baseline of the terminal device 100, and a score corresponding to the security check result, and the first user is the user of the terminal device 100.
  • the authentication module 520 is used to authenticate the terminal device 100 according to the identity information of the terminal device 100, the identity information of the first user and the first information.
  • the authentication module 520 is further used to allow the terminal device 100 to access the cloud application if the terminal device 100 passes the authentication, and to adopt a security policy when the terminal device 100 accesses the cloud application if it is determined that the terminal device 100 has a security risk, and the security policy is used to protect the security of the cloud application;
  • the authentication module 520 is also used to deny the terminal device 100 access to the cloud application when the authentication of the terminal device 100 fails.
  • the apparatus 500 further includes a sending module 540 for sending an authentication request to the terminal device 100 to request authentication of the apparatus 500 , and the acquisition module 510 is for receiving the first information sent by the terminal device 100 after the authentication apparatus 500 passes.
  • the security check result is obtained by an agent of the terminal device 100 detecting a security baseline of the terminal device 100 , and the security check result obtained by the acquisition module 510 is sent by the agent of the terminal device 100 to the acquisition module 510 .
  • the score corresponding to the security check result is a score given to the security check result by the agent of the terminal device 100 , and the score corresponding to the security check result acquired by the acquisition module 510 is sent to the acquisition module 510 by the agent of the terminal device 100 .
  • the apparatus 500 further includes a monitoring module 530, the acquisition module 510 is used to acquire the attribute information of the cloud application access request, and the monitoring module 530 is used to determine whether the terminal device 100 has a security risk according to the attribute information of the cloud application access request.
  • the attribute information of the cloud application access request includes at least one of the following: the time when the acquisition module 510 receives the cloud application access request, the IP address of the terminal device 100 that sends the cloud application access request, the identifier of the first user, the fingerprint of the browser that sends the cloud application access request, the information of the cloud application accessed by the cloud application access request, and the operation performed on the cloud application by the cloud application access request.
  • the acquisition module 510 is used to acquire the latest first information
  • the monitoring module 530 is used to determine whether the terminal device 100 has a security risk based on the latest first information.
  • the security policy includes one or more of the following combinations: terminating the terminal device 100 from accessing the cloud application; adding the IP address of the terminal device 100 to a blacklist; delaying the terminal device 100 from accessing the cloud application; authenticating the terminal device 100 through one or more authentication factors.
  • the first information acquired by the acquisition module 510 is sent to the acquisition module 510 after the terminal device 100 performs an encryption operation.
  • the authentication factors are password, fingerprint information, face information, iris information, voice, mobile phone verification, email verification, security questions, ID number, passport number, and digital certificate.
  • the cloud application access control device 500 is a zero-trust gateway.
  • the specific implementation of various operations performed by the above-mentioned cloud application access control device 500 can refer to the relevant description of the steps performed by the cloud gateway 200 in the above-mentioned cloud application access control method embodiment, and for the sake of brevity of the specification, it will not be repeated here.
  • Figure 6 is a structural diagram of a possible computing device provided by the present application.
  • the computing device can be used to implement the functions of the cloud application access control device 500 in the method embodiments shown in Figure 2, the method embodiments shown in Figure 3, and the method embodiments shown in Figure 4, and thus can also achieve the beneficial effects of the method embodiments shown in Figure 2, the method embodiments shown in Figure 3, and the method embodiments shown in Figure 4.
  • the computing device 600 includes a processor 610 , a memory 620 , and a communication interface 630 , wherein the processor 610 , the memory 620 , and the communication interface 630 may be interconnected via a bus 640 .
  • the processor 610 can read the program code (including instructions) stored in the memory 620 and execute the program code stored in the memory 620, so that the computing device 600 executes the steps performed by the cloud gateway 200 in the cloud application access control method shown in Figures 2, 3, and 4.
  • the specific implementation process is detailed in the above method embodiment and will not be repeated here.
  • the processor 610 may have a variety of specific implementation forms, such as a CPU, or a combination of a CPU and a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.
  • the processor 610 executes various types of digital storage instructions, such as software or firmware programs stored in the memory 620, which enables the computing device 600 to provide a variety of services.
  • the memory 620 is used to store program codes, and the execution is controlled by the processor 610.
  • the program code may include one or more software modules, which may be the software modules provided in the embodiment of FIG. 5 .
  • the memory 620 may include a volatile memory (volatile memory), such as a random access memory (RAM); the memory 620 may also include a non-volatile memory (non-volatile memory), such as a read-only memory (ROM), a flash memory (flash memory), a hard disk drive (HDD) or a solid-state drive (SSD); the memory 620 may also include a combination of the above types.
  • volatile memory such as a random access memory (RAM)
  • non-volatile memory such as a read-only memory (ROM), a flash memory (flash memory), a hard disk drive (HDD) or a solid-state drive (SSD)
  • ROM read-only memory
  • flash memory flash memory
  • HDD hard disk drive
  • SSD solid-state drive
  • the communication interface 630 may be a wired interface (e.g., an Ethernet interface, an optical fiber interface, other types of interfaces (e.g., an infiniBand interface)) or a wireless interface (e.g., a cellular network interface or a wireless local area network interface) for communicating with other computing devices or apparatuses.
  • the communication interface 630 may use a protocol family based on the transmission control protocol/internet protocol (TCP/IP), such as a remote function call (RFC) protocol, a simple object access protocol (SOAP) protocol, a simple network management protocol (SNMP) protocol, a common object request broker architecture (CORBA) protocol, and a distributed protocol, etc.
  • TCP/IP transmission control protocol/internet protocol
  • RRC remote function call
  • SOAP simple object access protocol
  • SNMP simple network management protocol
  • CORBA common object request broker architecture
  • the bus 640 may be a peripheral component interconnect express (PCIe) bus, an extended industry standard architecture (EISA) bus, a unified bus (Ubus or UB), a compute express link (CXL), a cache coherent interconnect for accelerators (CCIX), etc.
  • PCIe peripheral component interconnect express
  • EISA extended industry standard architecture
  • Ubus or UB unified bus
  • CXL compute express link
  • CCIX cache coherent interconnect for accelerators
  • the bus 640 may be divided into an address bus, a data bus, a control bus, etc.
  • the bus 640 may also include a power bus, a control bus, and a status signal bus, etc.
  • various buses are labeled as bus 640 in the figure. For ease of representation, only one thick line is used in FIG. 6, but it does not mean that there is only one bus or one type of bus.
  • computing device 600 is only an example provided in an embodiment of the present application, and computing device 600 may have more or fewer components than those shown in FIG. 6 , may combine two or more components, or may have different configurations of components.
  • the present application also provides a computer-readable storage medium, which stores instructions. When the instructions are executed, some or all of the steps of the cloud application access control method recorded in the above embodiment can be implemented.
  • the present application also provides a computer program product, which includes: a computer program or instructions, which, when executed, can implement some or all of the steps of the cloud application access control method recorded in the above embodiment.
  • all or part of the embodiments can be implemented by software, hardware or any combination thereof.
  • all or part of the embodiments can be implemented in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media integrated therein.
  • the available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium, or a semiconductor medium, etc.
  • a and/or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.
  • the character “/” generally indicates that the previous and next associated objects are in an “or” relationship; in the formula of this application, the character “/” indicates that the previous and next associated objects are in a “division” relationship.
  • “Including at least one of A, B or C” can mean: including A; including B; including C; including A and B; including A and C; including B and C; including A, B and C.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请提供一种云应用访问控制方法、装置及计算机可读存储介质，其中，方法包括：云网关在接收到终端设备发送的云应用访问请求时，获取终端设备的身份信息、第一用户(指终端设备的使用者)的身份信息和第一信息(包括对终端设备的安全基线进行检测得到的安全检查结果和/或安全检查结果对应的分数)，之后根据终端设备的身份信息、第一用户的身份信息和第一信息认证终端设备，若认证通过则允许终端设备访问云应用，并且在终端设备访问云应用的过程中，若云网关确定终端设备存在安全风险，则采取安全策略保护云应用的安全，若认证不通过则拒绝终端设备访问云应用。该方法能够对云应用起到很好的保护作用，提升云应用的安全性。

Description

云应用访问控制方法、装置及计算机可读存储介质
本申请要求于2022年12月09日提交中国国家知识产权局、申请号为202211579816.5、发明名称为“资源访问控制方法、装置及计算机可读存储介质”的中国专利申请的优先权，以及要求于2023年02月16日提交中国国家知识产权局、申请号为202310127438.5、发明名称为“云应用访问控制方法、装置及计算机可读存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及云技术领域，尤其涉及一种云应用访问控制方法、装置及计算机可读存储介质。
背景技术
随着云技术和各种网络基础设施的快速发展，越来越多的应用被部署在云上，远程访问技术也越来越常用，网络越来越碎片化，而且网络的边界越来越模糊，导致网络安全风险日益复杂，如定向威胁攻击(advanced persistent threat，APT)、勒索软件等新型网络攻击手段层出不穷，传统的根据终端设备在网络中的位置(指终端设备的网际互联协议(internet protocol，IP)地址)进行云应用访问控制的方法遇到了越来越多的挑战，对云应用起到的保护作用较弱。
发明内容
本申请提供一种云应用访问控制方法、装置及计算机可读存储介质，能够对云应用起到很好的保护作用，提升云应用的安全性。
第一方面，提供一种云应用访问控制方法，该方法包括：
云网关在接收到终端设备发送的云应用访问请求时，获取终端设备的身份信息、第一用户的身份信息和第一信息，第一信息包括如下至少一种：对终端设备的安全基线进行检测得到的安全检查结果、安全检查结果对应的分数，第一用户为终端设备的使用者；
云网关根据终端设备的身份信息、第一用户的身份信息和第一信息认证终端设备；
云网关在认证终端设备通过的情况下，允许终端设备访问云应用，并在终端设备访问云应用的过程中，若确定终端设备存在安全风险，则采取安全策略，安全策略用于保护云应用的安全；
云网关在认证终端设备不通过的情况下，拒绝终端设备访问云应用。
上述方案中，云网关在接收到终端设备发送的云应用访问请求时，根据用户身份和终端设备的身份，以及对终端设备的安全基线进行检测得到的安全检查结果和/或安全检查结果对应的分数认证终端设备，加强了对终端设备的云应用访问控制，能够更好地保护云应用的安全。
而且，云网关在终端设备访问云应用的过程中，会继续监控终端设备是否存在安全风险，在监控到终端设备存在安全风险时，采取安全策略保护云应用的安全，能够及时清除安全风险，进一步提升云应用的安全性。
在一种可能的实施方式中，云网关可以通过如下方式获取第一信息：云网关向终端设备发送认证请求，请求认证云网关，接收终端设备在认证云网关通过之后，发送的第一信息。如此，可以防止不可信设备窃取第一信息，保护第一信息的安全。
在一种可能的实施方式中，安全检查结果为终端设备的代理对终端设备的安全基线进行检测得到，云网关获取的安全检查结果为终端设备的代理发送给云网关。
实施上述实施方式，对终端设备的安全基线进行检查的工作，由终端设备的代理负责，无需云网关指示终端设备对安全基线进行检查，可以实现云网关所属的云厂商与代理厂商的松耦合合作。
在一种可能的实施方式中，安全检查结果对应的分数为终端设备的代理对安全检查结果的评分，云网关获取的安全检查结果对应的分数为终端设备的代理发送给云网关。
实施上述实施方式，对安全检查结果进行打分的工作，也由终端设备的代理负责，无需云网关指示终端设备对安全检查结果进行打分，可以加深云网关所属的云厂商与代理厂商的松耦合合作。
在一种可能的实施方式中，第一方面提供的方法还包括如下步骤：云网关获取云应用访问请求的属性信息，并根据云应用访问请求的属性信息，确定终端设备是否存在安全风险。其中，云应用访问请求的属性信息包括如下至少一种：云网关接收云应用访问请求的时间、发送云应用访问请求的终端设备的IP地址、 发送云应用访问请求的第一用户的标识、发送云应用访问请求的浏览器的指纹、云应用访问请求所访问的云应用的信息、云应用访问请求对云应用进行的操作。
在一种可能的实施方式中，第一方面提供的方法还包括如下步骤：云网关获取最新的第一信息，并根据最新的第一信息，确定终端设备是否存在安全风险。
在一种可能的实施方式中，安全策略包括如下一种或多种组合：终止终端设备访问云应用、将终端设备的IP地址加入黑名单、迟终端设备访问云应用、通过一个或多个认证因子认证终端设备。
在一种可能的实施方式中，云网关获取的第一信息为终端设备进行加密操作后发送给云网关。如此，可以提升第一信息在传输过程中的安全性。
在一种可能的实施方式中，认证因子为密码、指纹信息、人脸信息、虹膜信息、声音、手机验证、邮箱验证、安全问题、身份证号、护照号、数字证书。
在一种可能的实施方式中，云网关为零信任网关。
第二方面，提供一种云应用访问控制装置，包括：
获取模块，用于在接收到终端设备发送的云应用访问请求时，获取终端设备的身份信息、第一用户的身份信息和第一信息，第一信息包括如下至少一种：对终端设备的安全基线进行检测得到的安全检查结果、安全检查结果对应的分数，第一用户为终端设备的使用者；
认证模块，用于根据终端设备的身份信息、第一用户的身份信息和第一信息认证终端设备；
认证模块，还用于在认证终端设备通过的情况下，允许终端设备访问云应用，并在终端设备访问云应用的过程中，若确定终端设备存在安全风险，则采取安全策略，安全策略用于保护云应用的安全；
认证模块，还用于在认证终端设备不通过的情况下，拒绝终端设备访问云应用。
在一种可能的实施方式中，云应用访问控制装置还包括发送模块，用于向终端设备发送认证请求，请求认证云应用访问控制装置，该情况下，获取模块，用于接收终端设备在认证云应用访问控制装置通过之后，发送的第一信息。
在一种可能的实施方式中，安全检查结果为终端设备的代理对终端设备的安全基线进行检测得到，获取模块获取的安全检查结果为终端设备的代理发送给获取模块。
在一种可能的实施方式中，安全检查结果对应的分数为终端设备的代理对安全检查结果的评分，获取模块获取的安全检查结果对应的分数为终端设备的代理发送给获取模块。
在一种可能的实施方式中，云应用访问控制装置还包括监控模块，该情况下，获取模块，用于获取云应用访问请求的属性信息，监控模块，用于根据云应用访问请求的属性信息，确定终端设备是否存在安全风险。其中，云应用访问请求的属性信息包括如下至少一种：获取模块接收云应用访问请求的时间、发送云应用访问请求的终端设备的IP地址、发送云应用访问请求的第一用户的标识、发送云应用访问请求的浏览器的指纹、云应用访问请求所访问的云应用的信息、云应用访问请求对云应用进行的操作；
在一种可能的实施方式中，获取模块，用于获取最新的第一信息，监控模块，用于根据最新的第一信息，确定终端设备是否存在安全风险。
在一种可能的实施方式中，安全策略包括如下一种或多种组合：终止终端设备访问云应用、将终端设备的IP地址加入黑名单、延迟终端设备访问云应用、通过一个或多个认证因子认证终端设备。
在一种可能的实施方式中，获取模块获取的第一信息为终端设备进行加密操作后发送给获取模块。
在一种可能的实施方式中，认证因子为密码、指纹信息、人脸信息、虹膜信息、声音、手机验证、邮箱验证、安全问题、身份证号、护照号、数字证书。
在一种可能的实施方式中，云应用访问控制装置为零信任网关。
第三方面，提供一种计算设备，所述计算设备包括处理器和存储器；所述处理器用于执行所述存储器存储的指令，使得所述计算设备实现如上述第一方面，以及第一方面的任一种实施方式所述的方法。
第四方面，提供一种计算机可读存储介质，所述计算机可读存储介质存储有指令，所述指令用于实现如上述第一方面，以及第一方面的任一种实施方式所述的方法。
第五方面，提供一种计算机程序产品，包括计算机程序，当所述计算机程序被计算设备读取并执行时，使得所述计算设备执行如上述第一方面，以及第一方面的任一种实施方式所述的方法。
本申请在上述各方面提供的实现方式的基础上，还可以进行进一步组合以提供更多实现方式。
附图说明
图1为本申请示例性示出的一种云应用访问控制***的结构示意图；
图2为本申请提供的一种云应用访问控制方法的流程示意图；
图3为本申请示例性示出的一种云网关对终端设备进行认证的流程示意图；
图4为本申请提供的云网关监控终端设备是否存在安全风险的流程示意图；
图5为本申请提供的一种云应用访问控制装置的结构示意图；
图6为本申请提供的一种计算设备的结构示意图。
具体实施方式
下面将结合附图，对本申请提供的技术方案进行描述。
为了使本申请提供的技术方案更清晰，首先进行相关术语的解释。
(1)安全基线，是借用“基线”的概念，字典上对“基线”的解释是：一种在测量、计算或定位中的基本参照，如海岸基线，是水位到达的水位线，类比于“木桶理论”，可以认为安全基线是安全木桶的最短板，或者说，是最低的安全要求。
(2)终端设备的安全基线，可以理解为终端设备的最低安全要求，是为满足安全规范要求，终端设备配置必须达到的标准，主要包括病毒、漏洞、配置和***状态等方面的安全要求，其中，漏洞通常是由于软件或协议等自身存在缺陷引起的安全风险，如登录漏洞、拒绝服务漏洞、缓冲区溢出、信息泄漏、蠕虫后门、恶意代码执行等，反映了终端设备自身的安全脆弱性；配置主要包括了账号、口令、授权、日志、IP协议等方面的配置要求，配置不当导致终端设备存在安全风险；***状态包括端口状态、进程、账号、服务以及重要文件变化的监控。
安全基线检测，一般是使用各种工具对安全基线检测项(如是否安装防火墙、是否启动防火墙、是否存在病毒、是否存在漏洞、是否有用户身份认证模块等)进行检测，得到安全检查结果，这个安全检查结果是一个列表项，会用来和相关要求进行对比，确定各项是否合规，即确定设备是否存在安全风险。
本申请提供的技术方案适用于需要进行云应用访问控制以保护云应用安全的场景，参见图1，图1是本申请示例性示出的一种云应用访问控制***的结构示意图。
如图1所示，该***包括：终端设备100、云网关200、云平台300以及资源池400。
终端设备100通过网络连接公有云，网络可以是广域网、局域网、点对点连接等方式，或它们的任意组合。公有云包括云网关200、云平台300以及资源池400，终端设备100可以通过云网关200和云平台300访问资源池400中的云应用。
终端设备100还可以称为终端或者客户端，可以是一种具有无线收发功能的设备，其可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。终端设备100可以是用户设备(user equipment，UE)，其中，UE包括具有无线通信功能的手持式设备、车载设备、可穿戴设备或计算设备。示例性地，UE可以是手机(mobile phone)、平板电脑或带无线收发功能的电脑。终端设备100还可以是虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制中的无线终端、无人驾驶中的无线终端、远程医疗中的无线终端、智能电网中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。
云网关200，主要负责在接收到终端设备100发送的对资源池400的云应用访问请求时，根据终端设备100在网络中的位置(即终端设备100的IP地址)进行云应用访问控制，即将网络划分为内网、外网等区域，在网络边界对内网和外网进行隔离，若确定云应用访问请求中携带的终端设备100的IP地址属于内网IP地址，则允许终端设备100访问云应用，若确定终端设备100的IP地址不属于内网IP地址，则拒绝终端设备100访问云应用。
云平台300可以用于接收云网关200转发的云应用访问请求，并根据云应用访问请求中携带的云应用的标识定位到具体的云应用，实现终端设备100对云应用的访问。云平台300可以是通用的物理服务器实现的，例如，ARM服务器或者X86服务器，也可以是虚拟机，本申请不作具体限定。
资源池400可以为用户提供各种各样的云应用(也可以称为云服务或者云资源)，如图1所示，云应用的类型可包括计算、存储、数据库、人工智能(artificial intelligence，AI)、大数据等大类，其中，计算类型的云应用可包括弹性云服务器(elastic cloud server，ECS)、裸金属服务器、云手机等等，存储类型的云应用可包括对象存储、云硬盘、数据备份等等，数据库类型的云应用可包括数据库、数据复制、数据管理等等，AI类型的云应用可包括图像识别、文字识别、自然语言处理(natural language processing，NLP)等等，大数据类型的云应用可包括映射规约(map reduce)、数据搜索、推荐***等等，当然，还可以包括更多的云应用类型，每种类型可以包括更多的云应用，这里不一一举例说明。
应理解，图1所示的云应用访问控制***仅仅是作为示例，具体实现中，该***还可以包括其他或更 多组件，例如，包括更多的终端设备100和更多的云网关200。
上述方案中，云网关200根据终端设备100在网络中的位置(指终端设备100的IP地址)进行云应用访问控制，以保护云应用的安全。但是，随着网络越来越碎片化、网络边界越来越模糊，网络安全风险日益复杂，如定向威胁攻击、勒索软件等新型网络攻击手段层出不穷，继续使用上述方案进行云应用访问控制，必然会带来大量的隐含信任漏洞以及安全运维工作量，无法很好地保护云应用安全。
此外，上述云应用访问控制方案中，云网关200在认证终端设备100通过后，便会一直允许终端设备100访问云应用，并未对终端设备100访问云应用的过程中，终端设备100可能存在的安全风险进行监控，例如，终端设备100在访问云应用的过程中被病毒入侵，或者终端设备100上的用户身份认证模块被删除，或者终端设备100上的用户身份认证模块更新了密码，而更新后的密码强度较弱，这给云应用带来了极大的安全威胁。
为了解决上述问题，本申请提供一种云应用访问控制方法，在本申请提供的云应用访问控制方法中，云网关200在接收到终端设备100发送的云应用访问请求时，可以获取第一用户(指终端设备100的使用者)的身份信息和终端设备100的身份信息，以及获取对终端设备100的安全基线进行检测得到的安全检查结果和/或对安全检查结果进行的评分，然后，根据上述信息对终端设备100进行认证，在认证通过的情况下，允许终端设备100访问云应用，并在终端设备100访问云应用的过程中持续监控终端设备100是否存在安全风险，在确定终端设备100存在安全风险时，采取安全策略保护云应用的安全，及时清除安全风险，在认证不通过时，拒绝终端设备100访问云应用，从而很好地保护云应用的安全。
为了便于更清楚地理解本申请提供的云应用访问控制方法，下面结合图2所示的交互示意图进行更详细地描述，如图2所示，该方法可以包括如下步骤：
S201：云网关200在接收到终端设备100发送的云应用访问请求时，获取第一用户的身份信息、终端设备100的身份信息和第一信息，第一信息包括如下至少一种：对终端设备100的安全基线进行检测得到的安全检查结果、安全检查结果对应的分数，第一用户为终端设备100的使用者。
其中，第一用户的身份信息用于云网关200对第一用户进行身份认证，终端设备100的身份信息用于云网关200对终端设备100的身份进行认证，第一信息用于云网关200评估终端设备100的安全风险大小，并根据评估的安全风险认证终端设备100。
具体实现中，第一用户的身份信息可以为第一用户的用户名和密码，用户名可以为第一用户的工号、邮箱名、手机号码、身份证号、护照号、指纹信息、人脸信息、虹膜信息等；终端设备100的身份信息可以为终端设备100的编号、机器名、IP地址、数字证书等；终端设备100的安全基线可以包括多个检测项，如是否安装防火墙、是否启动防火墙、是否存在病毒、是否存在漏洞、是否有用户身份认证模块等；安全检查结果对应的分数，指对安全检查结果进行评分，通常，分数越高，表示终端设备100越安全。
下面以第一信息包括安全检查结果和安全检查结果对应的分数为例，对云网关200获取终端设备100的身份信息、第一用户的身份信息和第一信息的过程进行详细介绍。具体地，云网关200可以参考如下方式1至方式8中任意一种，实现获取第一用户的身份信息、终端设备100的身份信息和第一信息：
方式1、云网关200向终端设备100发送第一获取请求，请求获取第一用户的身份信息、终端设备100的身份信息和第一信息。
方式2、云网关200向终端设备100发送第二获取请求，请求获取第一用户的身份信息、终端设备100的身份信息和安全检查结果，云网关200在获取到安全检查结果后，对安全检查结果进行打分，得到安全检查结果对应的分数。
方式3、终端设备100发送的云应用访问请求中携带第一用户的身份信息和终端设备100的身份信息，未携带第一信息，云网关200从云应用访问请求中获取第一用户的身份信息和终端设备100的身份信息，云网关200向终端设备100发送第三获取请求，请求获取第一信息。
方式4、终端设备100发送的云应用访问请求中携带第一用户的身份信息和终端设备100的身份信息，未携带第一信息，云网关200从云应用访问请求中获取第一用户的身份信息和终端设备100的身份信息，云网关200向终端设备100发送第四获取请求，请求获取安全检查结果，云网关200在获取到安全检查结果后，对安全检查结果进行打分，得到安全检查结果对应的分数。
方式5、终端设备100发送的云应用访问请求中携带第一用户的身份信息，未携带终端设备100的身份信息和第一信息，云网关200从云应用访问请求中获取第一用户的身份信息，云网关200向终端设备100发送第五获取请求，请求获取终端设备100的身份信息和第一信息。
方式6、终端设备100发送的云应用访问请求中携带终端设备100的身份信息，未携带第一用户的身 份信息和第一信息，云网关200从云应用访问请求中获取终端设备100的身份信息，云网关200向终端设备100发送第六获取请求，请求获取第一用户的身份信息和第一信息。
方式7、终端设备100发送的云应用访问请求中携带第一用户的身份信息，未携带终端设备100的身份信息和第一信息，云网关200从云应用访问请求中获取第一用户的身份信息，云网关200向终端设备100发送第七获取请求，请求获取终端设备100的身份信息和安全检查结果，云网关200在获取到安全检查结果后，对安全检查结果进行打分，得到安全检查结果对应的分数。
方式8、终端设备100发送的云应用访问请求中携带终端设备100的身份信息，未携带第一用户的身份信息和第一信息，云网关200从云应用访问请求中获取终端设备100的身份信息，云网关200向终端设备100发送第八获取请求，请求获取第一用户的身份信息和安全检查结果，云网关200在获取到安全检查结果后，对安全检查结果进行打分，得到安全检查结果对应的分数。
具体地，上述获取请求(如第一获取请求、第二获取请求、…、第八获取请求)可以包括终端设备100的安全基线对应的检查项，如是否安装防火墙、是否启动防火墙、是否存在病毒、是否存在漏洞、是否有用户身份认证模块等，使得终端设备100可以根据获取请求中携带的终端设备100的安全基线对应的检查项对自身进行检测，得到安全检查结果。
在一种可能的实施例中，终端设备100上安装有代理(也可以称为代理软件)，该代理配置有终端设备100的安全基线对应的检查项，当终端设备100运行该代理时，该代理可以对终端设备100的安全基线进行检测得到安全检查结果。该情况下，云网关200在获取安全检查结果时，可以直接向终端设备100的代理发送获取请求，请求获取安全检查结果，获取请求中无需包括终端设备100的安全基线对应的检查项。可以看出，在该实施例中，对终端设备100的安全基线进行检查的工作，由终端设备100的代理负责，无需云网关200指示终端设备100对终端设备100的安全基线进行检查，可以实现云网关200所属的云厂商与代理厂商的松耦合合作。
在一种可能的实施例中，终端设备100上的代理还可能具有对安全检查结果进行打分的功能，该情况下，云网关200在获取安全检查结果对应的分数时，可以直接向终端设备100的代理发送获取请求，请求获取安全检查结果对应的分数。可以看出，在该实施例中，对安全检查结果进行打分的工作，也由终端设备100的代理负责，无需云网关200指示终端设备100对安全检查结果进行打分，可以加深云网关200所属的云厂商与代理厂商的松耦合合作。
具体实现中，终端设备100的代理可以提供可供云网关200获取安全检查结果、安全检查结果对应的分数的轻量化接口，或者，终端设备100的代理可以集成云网关200的云厂商提供的可供云网关200获取安全检查结果、安全检查结果对应的分数的软件开发工具包(software development kit，SDK)等。
应理解，上文所列举的云网关200获取第一用户的身份信息、终端设备100的身份信息和第一信息的方式仅仅是作为示例，其他能够实现云网关200获取上述信息的方式也属于本申请的保护范围，本申请对此不作具体限定。
在一种可能的实施例中，为了防止不可信设备窃取上述安全检查结果、安全检查结果对应的分数，云网关200在访问终端设备100获取安全检查结果、安全检查结果对应的分数之前，云网关200可以向终端设备100/终端设备100的代理发送认证请求，请求终端设备100/终端设备100的代理认证云网关200，终端设备100/终端设备100的代理在认证云网关200通过的情况下，允许云网关200获取安全检查结果、安全检查结果对应的分数，在认证云网关200不通过的情况下，拒绝云网关200获取安全检查结果、安全检查结果对应的分数。认证请求中可以包括云网关200的认证信息，如云网关200的编号、机器名、IP地址、数字证书等。
具体实现中，可以在终端设备100/终端设备100的代理中预置云网关200的认证信息，当终端设备100/终端设备100的代理接收到云网关200发送的携带云网关200的认证信息的认证请求时，根据预置的认证信息和认证请求中携带的认证信息对云网关200进行认证，当确定预置的认证信息与认证请求中携带的认证信息匹配时，则认证云网关200通过，反之，则认证云网关200不通过。
在一种可能的实施例中，为了防止终端设备100在向云网关200返回终端设备100的身份信息、第一用户的身份信息、安全检查结果、安全检查结果对应的分数的过程中，这些信息被云网关200之外的其他设备窃取，终端设备100可以对这些信息进行加密操作后，再向云网关200传输。
S202：云网关200根据第一用户的身份信息、终端设备100的身份信息和第一信息认证终端设备100，在认证通过的情况下，执行S203和S204，在认证不通过的情况下，执行S206。
本申请实施例中，在步骤S201之前，用户可以通过终端设备100向云网关200或者云网关200所属 的云厂商提供的用户身份管理平台申请身份注册，云网关200或者用户身份管理平台对用户的身份进行审查，若审查通过，则保存用户的身份信息，便于后续云网关200或者用户身份管理平台根据保存的用户身份信息对用户身份进行认证，终端设备100还可以向云网关200或者云网关200所属的云厂商提供的终端设备身份管理平台申请身份注册，终端设备身份管理平台对终端设备100的身份进行审查，若审查通过，则保存终端设备100的身份信息，便于后续云网关200或者终端设备身份管理平台根据保存的终端设备100的身份信息对终端设备100的身份进行认证。
继续以第一信息包括安全检查结果及安全检查结果对应的分数为例，在一种可能的实施例中，如图3所示，S202的具体实现过程包括如下步骤S2021-S2026：
S2021：云网关200根据第一用户的身份信息认证第一用户的身份，在第一用户的身份认证通过的情况下，执行S2022，在第一用户的身份认证不通过的情况下，执行S2026。
在云网关200本地存储有至少一个用户的身份信息的情况下，云网关200可以直接将第一用户的身份信息与自身保存的至少一个用户的身份信息进行匹配，在存在匹配的身份信息的情况下，认证第一用户的身份通过，反之，认证第一用户的身份不通过。
在云网关200本地未存储有至少一个用户的身份信息，用户身份管理平台存储有至少一个用户的身份信息的情况下，云网关200可以发送携带第一用户的身份信息的查询请求给用户身份管理平台，由用户身份管理平台将第一用户的身份信息与自身保存的至少一个用户的身份信息进行匹配，在存在匹配的身份信息的情况下，认证第一用户的身份通过，反之，认证第一用户的身份不通过，然后，用户身份管理平台反馈认证结果给云网关200。
S2022：云网关200根据终端设备100的身份信息认证终端设备100的身份，在终端设备100的身份认证通过的情况下，执行S2023，在终端设备100的身份认证不通过的情况下，执行S2026。
在云网关200本地存储有至少一个终端设备的身份信息的情况下，云网关200可以直接将终端设备100的身份信息与自身保存的至少一个终端设备的身份信息进行匹配，在存在匹配的身份信息的情况下，认证终端设备100的身份通过，反之，认证终端设备100的身份不通过。
在云网关200本地未存储有至少一个终端设备的身份信息，终端设备身份管理平台存储有至少一个终端设备的身份信息的情况下，云网关200可以发送携带终端设备100的身份信息的查询请求给终端设备身份管理平台，由终端设备身份管理平台将终端设备100的身份信息与自身保存的至少一个终端设备的身份信息进行匹配，在存在匹配的身份信息的情况下，认证终端设备100的身份通过，反之，认证终端设备100的身份不通过，然后，终端设备身份管理平台反馈认证结果给云网关200。
S2023：云网关200根据安全检查结果认证终端设备100是否合规，在认证终端设备100合规的情况下，执行S2024，在认证终端设备100不合规的情况下，执行S2026。
具体地，云网关200可以确定安全检查结果中的各检查项是否满足预设要求，在确定安全检查结果中的各检查项均满足预设要求时，则确定终端设备100合规，反之，则确定终端设备100不合规。
各检查项对应的预设要求可以根据实际情况进行自定义，以检查项为是否存在漏洞为例，预设要求可以为不存在漏洞或者为存在的漏洞类型不属于预设漏洞类型，以检查项为是否存在病毒为例，预设要求可以为不存在病毒或者为存在的病毒不属于预设病毒类型，以检查项为是否有用户身份认证模块为例，预设要求可以为有用户身份认证模块，本申请对各检查项对应的预设要求不作具体限定。
S2024：云网关200确定安全检查结果对应的分数是否达到预设分数，在确定安全检查结果对应的分数达到预设分数的情况下，执行S2025，在确定安全检查结果对应的分数未达到预设分数的情况下执行S2026。
其中，预设分数可以根据实际场景进行自定义，如在安全检查结果满分为100分，且分数越高表示终端设备100越安全时，预设分数可以70分、80分等，如在安全检查结果满分为100分，且分数越低表示终端设备100越安全时，预设分数可以为20分、30分等，本申请对预设分数不作具体限定。
S2025：云网关200认证终端设备100通过。
S2026：云网关200认证终端设备100不通过。
应理解，图3所示的S202的实现过程仅仅是作为一种示例，具体实现中，S202的实现过程也可以为其他，例如，云网关200先根据终端设备100的身份信息认证终端设备100的身份，之后根据第一用户的身份信息认证第一用户的身份，之后确定安全检查结果对应的分数是否达到预设分数，最后根据安全检查结果认证终端设备100是否合规，本申请对此不再展开赘述。
具体实现中，在云网关200认证终端设备100不通过的情况下，云网关200还可以执行其他操作，例 如，若云网关200认证第一用户的身份不通过，云网关200可以向终端设备100发送第一提示信息，提示第一用户重新输入用户的身份信息；又例如，若云网关200认证终端设备100的身份不通过，云网关200可以向终端设备100发送第二提示信息，提示第一用户检查终端设备100的身份信息；又例如，若云网关200认证终端设备100不合规，云网关200可以向终端设备100发送第三提示信息，提示第一用户对终端设备100进行优化，假设云网关200认证终端设备100不合规的原因是安全检查结果显示终端设备100存在病毒，那么第三提示信息可以提示第一用户终端设备100中了病毒；又例如，若云网关200确定安全检查结果对应的分数未达到预设分数，云网关200可以向终端设备100发送第四提示信息，提示第一用户对终端设备100进行优化。
S203：云网关200允许终端设备100访问云应用。
具体地，云网关200可以将终端设备100的云应用访问请求转发至云平台300，由云平台300根据云应用访问请求中携带的云应用的标识定位到具体的云应用，实现终端设备100对云应用的访问。
S204：云网关200在终端设备100访问云应用的过程中，监控终端设备100是否存在安全风险，在确定终端设备100存在安全风险的情况下，执行S205，在确定终端设备100不存在安全风险的情况下，再次执行S204。
在本申请具体的实施例中，云网关200可以参考如下方式(1)至方式(4)中任意一种或者多种组合实现监控终端设备100是否存在安全风险：
方式(1)、云网关200周期性获取最新的第一信息，并根据最新的第一信息，确定终端设备100是否存在安全风险。
具体地，云网关200可以周期性向终端设备100/终端设备100的代理/其他实时更新第一信息的设备发送用于获取最新的第一信息的获取请求，请求获取最新的第一信息。
以最新的第一信息包括最新的安全检查结果为例，具体地，云网关200可以确定最新的安全检查结果中的各检查项是否满足预设要求，若确定各检查项均满足预设要求，则确定终端设备100不存在安全风险，反之，可以确定终端设备100存在安全风险。
以最新的第一信息包括最新的安全检查结果对应的分数为例，具体地，云网关200可以确定最新的安全检查结果对应的分数是否达到预设分数，若确定最新的分数达到预设分数，则确定终端设备100不存在安全风险，反之，可以确定终端设备100存在安全风险。
以最新的第一信息包括最新的安全检查结果和最新的安全检查结果对应的分数为例，具体地，云网关200可以确定最新的安全检查结果中的各检查项是否满足预设要求，以及确定最新的安全检查结果对应的分数是否达到预设分数，若确定各检查项均满足预设要求，且最新的分数达到预设分数，则确定终端设备100不存在安全风险，反之，可以确定终端设备100存在安全风险。
应理解，上述云网关200根据最新的第一信息确定终端设备100是否存在安全风险的实现方式仅仅是作为示例，其他能够实现根据最新的第一信息确定终端设备100是否存在安全风险的方式也属于本申请的保护范围，本申请对此不作具体限定。
方式(2)、如图4所示，包括如下步骤：
S401：云平台300周期性获取最新的第一信息。
S402：云平台300根据最新的第一信息，确定终端设备100是否存在安全风险。
S403：云平台300在确定终端设备100存在安全风险时，生成安全策略，安全策略用于保护云应用的安全。
S404：云平台300向云网关200发送安全策略。
S405：云网关200根据安全策确定终端设备100存在安全风险。
S406：云网关200执行安全策略。
安全策略可以包括如下一种或多种组合：终止终端设备100访问云应用、将终端设备100的IP地址加入黑名单、延迟终端设备100访问云应用，以及通过一个或多个认证因子再次认证终端设备100，当再次认证终端设备100通过时，允许终端设备100访问云应用等。应理解，上述安全策略仅仅是作为示例，不应视为保护云应用的安全的方式的限定。
上述认证因子可以为密码、指纹信息、人脸信息、虹膜信息、声音、手机验证、邮箱验证、安全问题、身份证号、护照号、数字证书等。
方式(2)的具体实现过程可以参考方式(1)的具体实现过程，为了说明书的简洁，此处不再展开赘述。
方式(3)、云网关200提取云应用访问请求的属性信息，云应用访问请求的属性信息包括如下至少一种：云网关200接收云应用访问请求的时间、发送云应用访问请求的终端设备100的标识、第一用户的标识、发送云应用访问请求的浏览器的指纹、云应用访问请求所访问的云应用的信息、云应用访问请求对云应用进行的操作，然后，根据云应用访问请求的属性信息确定终端设备100是否存在安全风险。
浏览器指纹，指通过获取浏览器的各种信息，例如字体、分辨率、浏览器模式、语言、时区、中央处理单元(central processing unit，CPU)核心数、显卡信息、插件信息等，综合这些信息计算出一个唯一值，这个唯一值就是浏览器指纹。
云应用的信息，包括云应用的标识(如云应用的名称、云应用的位置等)、云应用的类型、云应用的内容等，在本申请中，云应用的类型可以划分为关键云应用、普通云应用，或者，划分为高敏感级云应用、中敏感级云应用、低敏感级云应用等。
具体地，以云应用访问请求的属性信息为云网关200接收云应用访问请求的时间为例，云网关200根据自身接收云应用访问请求的时间，确定终端设备100是否存在安全风险的过程可以如下：云网关200可以确定自身接收云应用访问请求的时间是否在预设时间范围(例如7:00:00-24:00:00)内，若接收云应用访问请求的时间在预设时间范围内，则确定终端设备100不存在安全风险，反之，则确定终端设备100存在安全风险。其中，预设时间范围可以根据实际场景进行自定义，本申请对此不作具体限定，例如，预设时间范围可以为第一用户日常访问云应用的时间段。
再以云应用访问请求的属性信息为发送云应用访问请求的终端设备100的标识(如IP地址)为例，云网关200根据发送云应用访问请求的终端设备100的IP地址，确定终端设备100是否存在安全风险的过程可以如下：云网关200可以确定IP地址黑名单库中是否存在与终端设备100的IP地址相同的IP地址，若存在相同的IP地址，则确定终端设备100存在安全风险，若不存在相同的IP地址，则确定终端设备100不存在安全风险。
再以云应用访问请求的属性信息为第一用户的标识为例，云网关200根据第一用户的标识，确定终端设备100是否存在安全风险的过程可以如下：云网关200可以确定用户标识黑名单库中是否存在与第一用户的标识相同的用户标识，若存在相同的用户标识，则确定终端设备100存在安全风险，若不存在相同的用户标识，则确定终端设备100不存在安全风险。
可选地，云网关200可以根据第一用户的标识查询终端设备类型映射表确定第一用户的终端设备100的类型，然后，确定终端设备100的类型是否属于预设终端设备类型，在确定终端设备100的类型属于预设终端设备类型时，则确定终端设备100不存在安全风险，反之，则确定终端设备100存在安全风险，其中，终端设备类型映射表用于记录至少一个用户的标识和至少一个用户的终端设备的类型，终端设备类型记录表还用于记录至少一个用户的标识和每个用户的终端设备的类型之间的映射关系。
举例来讲，参见表1示例性示出的终端设备类型映射表，标识为0001的用户和标识为0002的用户的终端设备的类型为A类型，标识为0003和标识为0004的用户的终端设备的类型为B类型，假设第一用户的标识为0001，预设终端设备类型为A，那么云网关200根据第一用户的标识0001查询表1可以确定终端设备100的类型是A类型，并进一步确定终端设备100的类型属于预设终端设备类型，因此，云网关200可以确定终端设备100不存在安全风险。
表1终端设备类型映射表
可以理解，上述表1仅仅作为示例，以体现用户的标识、终端设备的类型的对应关系，在具体实现中，终端类型映射表记录的内容以及对应关系还可以是其他形式，此处不作具体限定。
接下来以云应用访问请求的属性信息为发送云应用访问请求的浏览器的指纹为例，云网关200根据浏览器指纹，确定终端设备100是否存在安全风险的过程可以如下：云网关200可以确定浏览器指纹黑名单库中是否存在与发送云应用访问请求的浏览器的指纹相同的指纹，若存在相同的指纹，则确定终端设备100存在安全风险，若不存在相同的指纹，则确定终端设备100不存在安全风险。
接下来以云应用访问请求的属性信息为云应用访问请求所访问的云应用的标识为例，云网关200根据 所访问的云应用的标识，确定终端设备100是否存在安全风险的过程可以如下：云网关200可以确定云应用标识黑名单库中是否存在与云应用访问请求所访问的云应用的标识相同的标识，若存在相同的标识，则确定终端设备100存在安全风险，若不存在相同的标识，则确定终端设备100不存在安全风险。
接下来以云应用访问请求的属性信息为云应用的类型为例，云网关200根据云应用的类型，确定终端设备100是否存在安全风险的过程可以如下：云网关200确定云应用的类型是否为预设云应用类型(如上述高敏感级云应用类型)，若确定云应用的类型为预设云应用类型，则确定终端设备100存在安全风险，反之，则可以确定终端设备100不存在安全风险。
接下来以云应用访问请求的属性信息为云应用访问请求对云应用进行的操作为例，云网关200根据云应用访问请求对云应用进行的操作，确定终端设备100是否存在安全风险的过程可以如下：云网关可以确定攻击行为库中是否存在与云应用访问请求对云应用进行的操作相同的行为，若存在相同的行为，则确定终端设备100存在安全风险，反之，则可以确定终端设备100不存在安全风险。
方式(4)、云网关200将终端设备100发送的云应用访问请求转发给云平台300，由云平台300提取云应用访问请求的属性信息，然后，云平台300根据云应用访问请求的属性信息确定终端设备100是否存在安全风险，在确定终端设备100存在安全风险时，云平台300生成安全策略，并向云网关200发送安全策略。云网关200在接收到云平台300发送的安全策略时，则确定终端设备100存在安全风险，并执行安全策略。
方式(4)的具体实现过程可以参考方式(3)的具体实现过程，为了说明书的简洁，此处不再展开赘述。
应理解，上述所列举的云应用访问请求的属性信息仅仅是作为示例，本申请不对云应用访问请求的属性信息作具体限定。还应理解，上述所列举的云网关200/云平台300根据云应用访问请求的属性信息确定终端设备100是否存在安全风险的方式仅仅是作为示例，其他能够实现云网关200/云平台300根据云应用访问请求的属性信息确定终端设备100是否存在安全风险的方式，如时序检测、人工智能等，也属于本申请的保护范围，本申请不再展开赘述。
可以理解，云网关200/云平台300在确定终端设备100是否存在安全风险时，所参考的云应用访问请求的信息越丰富，得到的结果会更准确，更有利于提升云应用的安全性。
在一种可能的实施例中，终端设备100所属的企业有多台终端设备，且企业部署有用于实时监控多台终端设备是否存在安全风险的监控中心，监控中心在监控到多台终端设备中有终端设备存在安全风险时，可以向云网关200发送携带存在安全风险的终端设备的标识的通知，通知云网关200该终端设备存在安全风险，云网关200在接收到通知后，可以确定接收和处理的云应用访问请求是否来自于上述存在安全风险的终端设备，若确定接收和处理的云应用访问请求来自于上述存在安全风险的终端设备，则执行安全策略。
或者，监控中心在监控到多台终端设备中有终端设备存在安全风险时，也可以向云平台300发送携带存在安全风险的终端设备的标识的通知，通知云平台300该终端设备存在安全风险，云平台300在接收到通知后，可以生成安全策略，并向云网关200发送安全策略，安全策略中可以携带存在安全风险的终端设备的标识，云网关200在接收到安全策略后，可以确定接收和处理的云应用访问请求是否来自于上述存在安全风险的终端设备，若确定接收和处理的云应用访问请求来自于上述存在安全风险的终端设备，则执行安全策略。
具体实现中，云网关200在确定终端设备100存在安全风险后，还可以进一步确定安全风险等级，然后根据不同的安全风险等级执行对应的安全策略，举例来讲，假设预设分数为80分，云网关200中预先设置了[50分，80分)的安全风险等级为1级，[25分，50分)的安全风险等级为2级，[0分，25分)的安全风险等级为3级，1级对应的安全策略为“延迟终端设备100访问云应用，并通过一个或多个认证因子再次认证终端设备100，在再次认证通过的情况下，允许终端设备100访问云应用，在再次认证不通过的情况下，拒绝终端设备100访问云应用”，2级对应的安全策略为“终止终端设备100访问云应用”，3级对应的安全策略为“终止终端设备100访问云应用并将终端设备的IP地址加入黑名单”，假设云网关200获取的最新的安全检查结果对应的分数为48分，则云网关200可以确定终端设备100存在安全风险，并进一步确定安全风险等级为2级，然后执行上述2级风险对应的安全策略。
S205：云网关200采取安全策略保护云应用的安全。
S206：云网关200拒绝终端设备100访问云应用。
具体地，云网关200可以直接丢弃终端设备100的云应用访问请求，或者，保留云应用访问请求，但不转发该请求至云平台300。
可选地，云网关200在认证终端设备100不通过的情况下，还可以将终端设备100的IP地址加入黑名单，或者，延迟终端设备100访问云应用，在延迟的时间段内，通过一个或多个认证因子再次认证终端设备100，当再次认证终端设备100通过时，允许终端设备100访问云应用，当再次认证不通过时，拒绝终端设备100访问云应用。
在一种具体的实施例中，云网关200为零信任网关，零信任网关是云厂商对外提供的一个云网关服务，用于通过持续身份认证(包括用户身份认证和终端设备身份认证)来保障云应用的安全。
可以看出，本申请提供的云应用访问控制方法中，云网关200在接收到终端设备100发送的云应用访问请求时，根据用户身份和终端设备100的身份，以及对终端设备100的安全基线进行检测得到的安全检查结果和/或安全检查结果对应的分数认证终端设备100，加强了对终端设备100的云应用访问控制，能够更好地保护云应用安全。而且，在终端设备100访问云应用的过程中，继续监控终端设备100是否存在安全风险，在监控到终端设备100存在安全风险时，采取安全策略保护云应用的安全，能够及时清除安全风险，进一步提升云应用的安全性。
上文详细阐述了本申请提供的云应用访问控制方法，根据相同的发明构思，接下来介绍本申请提供的云应用访问控制装置，该装置可以应用于图1所示的资源访问控制***，具体可以应用于图1所示的云网关200。
应理解，本申请提供的云应用访问控制装置内部的单元模块可以有多种划分，各个模块可以是软件模块，也可以是硬件模块，也可以部分是软件模块部分是硬件模块，本申请不对其进行限制。
参见图5，图5为本申请示例性示出的一种云应用访问控制装置500的结构示意图，如图5所示，该装置500包括：获取模块510和认证模块520。
获取模块510，用于在接收到终端设备100发送的云应用访问请求时，获取终端设备100的身份信息、第一用户的身份信息和第一信息，第一信息包括如下至少一种：对终端设备100的安全基线进行检测得到的安全检查结果、安全检查结果对应的分数，第一用户为终端设备100的使用者。
认证模块520，用于根据终端设备100的身份信息、第一用户的身份信息和第一信息认证终端设备100。
认证模块520，还用于在认证终端设备100通过的情况下，允许终端设备100问云应用，并在终端设备100访问云应用的过程中，若确定终端设备100存在安全风险，则采取安全策略，安全策略用于保护云应用的安全；
认证模块520，还用于在认证终端设备100不通过的情况下，拒绝终端设备100访问云应用。
在一种可能的实现方式中，如图5所示，装置500还包括发送模块540，发送模块540用于向终端设备100发送认证请求，请求认证装置500，获取模块510用于接收终端设备100在认证装置500通过之后，发送的第一信息。
在一种可能的实现方式中，安全检查结果为终端设备100的代理对终端设备100的安全基线进行检测得到，获取模块510获取的安全检查结果为终端设备100的代理发送给获取模块510。
在一种可能的实现方式中，安全检查结果对应的分数为终端设备100的代理对安全检查结果的评分，获取模块510获取的安全检查结果对应的分数为终端设备100的代理发送给获取模块510。
在一种可能的实现方式中，如图5所示，装置500还包括监控模块530，获取模块510用于获取云应用访问请求的属性信息，监控模块530用于根据云应用访问请求的属性信息，确定终端设备100是否存在安全风险。其中，云应用访问请求的属性信息包括如下至少一种：获取模块510接收云应用访问请求的时间、发送云应用访问请求的终端设备100的IP地址、第一用户的标识、发送云应用访问请求的浏览器的指纹、云应用访问请求所访问的云应用的信息、云应用访问请求对云应用进行的操作。
在一种可能的实现方式中，获取模块510用于获取最新的第一信息，监控模块530用于根据最新的第一信息，确定终端设备100是否存在安全风险。
在一种可能的实现方式中，安全策略包括如下一种或多种组合：终止终端设备100访问云应用；将终端设备100的IP地址加入黑名单；延迟终端设备100访问云应用；通过一个或多个认证因子认证终端设备100。
在一种可能的实现方式中，获取模块510获取的第一信息为终端设备100进行加密操作后发送给获取模块510。
在一种可能的实现方式中，认证因子为密码、指纹信息、人脸信息、虹膜信息、声音、手机验证、邮箱验证、安全问题、身份证号、护照号、数字证书。
在一种可能的实现方式中，云应用访问控制装置500为零信任网关。
具体地，上述云应用访问控制装置500执行各种操作的具体实现，可参照上述云应用访问控制方法实施例中由云网关200执行的步骤中的相关描述，为了说明书的简洁，这里不再赘述。
图6为本申请提供的可能的计算设备的结构示意图，该计算设备可以用于实现上述图2所示的方法实施例、图3所示的方法实施例、图4所示的方法实施例中云应用访问控制装置500的功能，因此也能实现图2所示的方法实施例、图3所示的方法实施例、图4所示的方法实施例所具备的有益效果。
如图6所示，计算设备600包括处理器610、存储器620以及通信接口630，其中，处理器610、存储器620以及通信接口630之间可以通过总线640相互连接。
处理器610可以读取存储器620中存储的程序代码(包括指令)，执行存储器620中存储的程序代码，使得计算设备600执行图2、图3、图4所示的云应用访问控制方法中由云网关200执行的步骤，其具体实现过程详见上述方法实施例，这里不再赘述。
处理器610可以有多种具体实现形式，例如CPU，或者CPU和硬件芯片的组合。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)、可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)、现场可编程逻辑门阵列(field-programmable gate array，FPGA)、通用阵列逻辑(generic array logic，GAL)或其任意组合。处理器610执行各种类型的数字存储指令，例如存储在存储器620中的软件或者固件程序，它能使计算设备600提供多种服务。
存储器620用于存储程序代码，并由处理器610来控制执行。程序代码可以包括一个或多个软件模块，这一个或多个软件模块可以为图5实施例中提供的软件模块。
存储器620可以包括易失性存储器(volatile memory)，例如随机存取存储器(random access memory，RAM)；存储器620也可以包括非易失性存储器(non-volatile memory)，例如只读存储器(read-only memory，ROM)、快闪存储器(flash memory)、硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器620还可以包括上述种类的组合。
通信接口630可以为有线接口(例如以太网接口、光纤接口、其他类型接口(例如，infiniBand接口))或无线接口(例如蜂窝网络接口或使用无线局域网接口)，用于与其他计算设备或装置进行通信。通信接口630可以采用传输控制协议/网际互联协议(transmission control protocol/internet protocol，TCP/IP)之上的协议族，例如，远程函数调用(remote function call，RFC)协议、简单对象访问协议(simple object access protocol，SOAP)协议、简单网络管理协议(simple network management protocol，SNMP)协议、公共对象请求代理体系结构(common object request broker architecture，CORBA)协议以及分布式协议等等。
总线640可以是快捷***部件互连标准(peripheral component interconnect express，PCIe)总线、扩展工业标准结构(extended industry standard architecture，EISA)总线、统一总线(unified bus，Ubus或UB)、计算机快速链接(compute express link，CXL)、缓存一致互联协议(cache coherent interconnect for accelerators，CCIX)等。总线640可以分为地址总线、数据总线、控制总线等。总线640除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线640。为便于表示，图6中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
应当理解，计算设备600仅为本申请实施例提供的一个例子，并且，计算设备600可具有比图6示出的部件更多或更少的部件，可以组合两个或更多个部件，或者可具有部件的不同配置实现。
本申请还提供一种计算机可读存储介质，该计算机可读存储介质中存储有指令，该指令被运行时可以实现上述实施例中记载的云应用访问控制方法的部分或者全部步骤。
本申请还提供一种计算机程序产品，该计算机程序产品包括：计算机程序或指令，当该计算机程序或指令被运行时可以实现上述实施例中记载的云应用访问控制方法的部分或者全部步骤。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其它实施例的相关描述。
在上述实施例中，可以全部或部分地通过软件、硬件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述 计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如软盘、硬盘、磁带)、光介质、或者半导体介质等。在本申请的各个实施例中，如果没有特殊说明以及逻辑冲突，不同的实施例之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例中的技术特征根据其内在的逻辑关系可以组合形成新的实施例。
本申请中，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。在本申请的文字描述中，字符“/”，一般表示前后关联对象是一种“或”的关系；在本申请的公式中，字符“/”，表示前后关联对象是一种“相除”的关系。“包括A，B或C中的至少一个”可以表示：包括A；包括B；包括C；包括A和B；包括A和C；包括B和C；包括A、B和C。
可以理解的是，在本申请的实施例中涉及的各种数字编号仅为描述方便进行的区分，并不用来限制本申请的实施例的范围。上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定。

Claims (23)

  1. 一种云应用访问控制方法，其特征在于，所述方法包括：
    云网关在接收到终端设备发送的云应用访问请求时，获取所述终端设备的身份信息、第一用户的身份信息和第一信息，所述第一信息包括如下至少一种：对所述终端设备的安全基线进行检测得到的安全检查结果、所述安全检查结果对应的分数，所述第一用户为所述终端设备的使用者；
    所述云网关根据所述终端设备的身份信息、所述第一用户的身份信息和所述第一信息认证所述终端设备；
    所述云网关在认证所述终端设备通过的情况下，允许所述终端设备访问所述云应用，并在所述终端设备访问所述云应用的过程中，若确定所述终端设备存在安全风险，则采取安全策略，所述安全策略用于保护所述云应用的安全；
    所述云网关在认证所述终端设备不通过的情况下，拒绝所述终端设备访问所述云应用。
  2. 根据权利要求1所述的方法，其特征在于，所述云网关获取第一信息，包括：
    所述云网关向所述终端设备发送认证请求，请求认证所述云网关；
    所述云网关接收所述终端设备在认证所述云网关通过之后，发送的所述第一信息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述安全检查结果为所述终端设备的代理对所述终端设备的安全基线进行检测得到，所述云网关获取的所述安全检查结果为所述终端设备的代理发送给所述云网关。
  4. 根据权利要求3所述的方法，其特征在于，所述安全检查结果对应的分数为所述终端设备的代理对所述安全检查结果的评分，所述云网关获取的所述安全检查结果对应的分数为所述终端设备的代理发送给所述云网关。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，所述方法还包括：
    所述云网关获取所述云应用访问请求的属性信息，所述云应用访问请求的属性信息包括如下至少一种：所述云网关接收所述云应用访问请求的时间、发送所述云应用访问请求的所述终端设备的网际互联协议IP地址、发送所述云应用访问请求的所述第一用户的标识、发送所述云应用访问请求的浏览器的指纹、所述云应用访问请求所访问的所述云应用的信息、所述云应用访问请求对所述云应用进行的操作；
    所述云网关根据所述云应用访问请求的属性信息，确定所述终端设备是否存在安全风险。
  6. 根据权利要求1至4任一项所述的方法，其特征在于，所述方法还包括：
    所述云网关获取最新的第一信息；
    所述云网关根据所述最新的第一信息，确定所述终端设备是否存在安全风险。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，所述安全策略包括如下一种或多种组合：
    终止所述终端设备访问所述云应用；
    将所述终端设备的IP地址加入黑名单；
    延迟所述终端设备访问所述云应用；
    通过一个或多个认证因子认证所述终端设备。
  8. 根据权利要求1至7任一项所述的方法，其特征在于，所述云网关获取的所述第一信息为所述终端设备进行加密操作后发送给所述云网关。
  9. 根据权利要求5至8任一项所述的方法，其特征在于，所述认证因子为密码、指纹信息、人脸信息、虹膜信息、声音、手机验证、邮箱验证、安全问题、身份证号、护照号、数字证书。
  10. 根据权利要求1至9任一项所述的方法，其特征在于，所述云网关为零信任网关。
  11. 一种云应用访问控制装置，其特征在于，所述装置包括：
    获取模块，用于在接收到终端设备发送的云应用访问请求时，获取所述终端设备的身份信息、第一用户的身份信息和第一信息，所述第一信息包括如下至少一种：对所述终端设备的安全基线进行检测得到的安全检查结果、所述安全检查结果对应的分数，所述第一用户为所述终端设备的使用者；
    认证模块，用于根据所述终端设备的身份信息、所述第一用户的身份信息和所述第一信息认证所述终端设备；
    所述认证模块，还用于在认证所述终端设备通过的情况下，允许所述终端设备访问所述云应用，并在所述终端设备访问所述云应用的过程中，若确定所述终端设备存在安全风险，则采取安全策略，所述安全策略用于保护所述云应用的安全；
    所述认证模块，还用于在认证所述终端设备不通过的情况下，拒绝所述终端设备访问所述云应用。
  12. 根据权利要求11所述的装置，其特征在于，所述装置还包括发送模块；
    所述发送模块，用于向所述终端设备发送认证请求，请求认证所述云应用访问控制装置；
    所述获取模块，用于接收所述终端设备在认证所述云应用访问控制装置通过之后，发送的所述第一信息。
  13. 根据权利要求11或12所述的装置，其特征在于，所述安全检查结果为所述终端设备的代理对所述终端设备的安全基线进行检测得到，所述获取模块获取的所述安全检查结果为所述终端设备的代理发送给所述获取模块。
  14. 根据权利要求13所述的装置，其特征在于，所述安全检查结果对应的分数为所述终端设备的代理对所述安全检查结果的评分，所述获取模块获取的所述安全检查结果对应的分数为所述终端设备的代理发送给所述获取模块。
  15. 根据权利要求11至14任一项所述的装置，其特征在于，所述装置还包括监控模块；
    所述获取模块，用于获取所述云应用访问请求的属性信息，所述云应用访问请求的属性信息包括如下至少一种：所述获取模块接收所述云应用访问请求的时间、发送所述云应用访问请求的所述终端设备的IP地址、发送所述云应用访问请求的所述第一用户的标识、发送所述云应用访问请求的浏览器的指纹、所述云应用访问请求所访问的所述云应用的信息、所述云应用访问请求对所述云应用进行的操作；
    所述监控模块，用于根据所述云应用访问请求的属性信息，确定所述终端设备是否存在安全风险。
  16. 根据权利要求11至14任一项所述的装置，其特征在于，所述装置还包括监控模块；
    所述获取模块，用于获取最新的第一信息；
    所述监控模块，用于根据所述最新的第一信息，确定所述终端设备是否存在安全风险。
  17. 根据权利要求11至16任一项所述的装置，其特征在于，所述安全策略包括如下一种或多种组合：
    终止所述终端设备访问所述云应用；
    将所述终端设备的IP地址加入黑名单；
    延迟所述终端设备访问所述云应用；
    通过一个或多个认证因子认证所述终端设备。
  18. 根据权利要求11至17任一项所述的装置，其特征在于，所述获取模块获取的所述第一信息为所述终端设备进行加密操作后发送给所述获取模块。
  19. 根据权利要求15至18任一项所述的装置，其特征在于，所述认证因子为密码、指纹信息、人脸信息、虹膜信息、声音、手机验证、邮箱验证、安全问题、身份证号、护照号、数字证书。
  20. 根据权利要求11至19任一项所述的装置，其特征在于，所述装置为零信任网关。
  21. 一种计算设备，其特征在于，所述计算设备包括处理器和存储器；所述计算设备的处理器用于执行所述计算设备的存储器中存储的指令，以使得所述计算设备执行如权利要求1至10任一项所述的方法。
  22. 一种计算机可读存储介质，其特征在于，包括计算机程序指令，当所述计算机程序指令由计算设备执行时，所述计算设备执行如权利要求1至10任一项所述的方法。
  23. 一种计算机程序产品，其特征在于，所述计算机程序产品包括指令，当所述指令被计算设备运行时，使得所述计算设备执行如权利要求1至10任一项所述的方法。
PCT/CN2023/130653 2022-12-09 2023-11-09 云应用访问控制方法、装置及计算机可读存储介质 WO2024120113A1 (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202211579816.5 2022-12-09
CN202211579816 2022-12-09
CN202310127438.5 2023-02-16
CN202310127438.5A CN118214571A (zh) 2022-12-09 2023-02-16 云应用访问控制方法、装置及计算机可读存储介质

Publications (1)

Publication Number Publication Date
WO2024120113A1 true WO2024120113A1 (zh) 2024-06-13

Family

ID=91378570

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/130653 WO2024120113A1 (zh) 2022-12-09 2023-11-09 云应用访问控制方法、装置及计算机可读存储介质

Country Status (1)

Country Link
WO (1) WO2024120113A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102739771A (zh) * 2012-04-18 2012-10-17 上海和辰信息技术有限公司 一种支持服务融合的云应用集成管理平台和方法
CN103067397A (zh) * 2012-12-31 2013-04-24 华为技术有限公司 一种桌面云***的安全认证方法、接入网关及认证服务器
CN106330869A (zh) * 2016-08-15 2017-01-11 江苏敏捷科技股份有限公司 一种基于云应用的数据安全保护***和方法
US11184766B1 (en) * 2016-09-07 2021-11-23 Locurity Inc. Systems and methods for continuous authentication, identity assurance and access control
CN114662080A (zh) * 2020-12-23 2022-06-24 息象(北京)科技发展有限公司 数据保护方法、装置及桌面云***

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102739771A (zh) * 2012-04-18 2012-10-17 上海和辰信息技术有限公司 一种支持服务融合的云应用集成管理平台和方法
CN103067397A (zh) * 2012-12-31 2013-04-24 华为技术有限公司 一种桌面云***的安全认证方法、接入网关及认证服务器
CN106330869A (zh) * 2016-08-15 2017-01-11 江苏敏捷科技股份有限公司 一种基于云应用的数据安全保护***和方法
US11184766B1 (en) * 2016-09-07 2021-11-23 Locurity Inc. Systems and methods for continuous authentication, identity assurance and access control
CN114662080A (zh) * 2020-12-23 2022-06-24 息象(北京)科技发展有限公司 数据保护方法、装置及桌面云***

Similar Documents

Publication Publication Date Title
US10523676B2 (en) Techniques for detecting unauthorized access to cloud applications based on velocity events
US7886339B2 (en) Radius security origin check
WO2019095911A1 (zh) 一种抵御拒绝服务攻击的方法及设备
US11805129B2 (en) Fictitious account generation on detection of account takeover conditions
CN111917714B (zh) 一种零信任架构***及其使用方法
US20080134314A1 (en) Automated security privilege setting for remote system users
KR20160111940A (ko) 생체측정 프로토콜 표준들을 위한 시스템 및 방법
US11055398B2 (en) Monitoring strength of passwords
WO2016188335A1 (zh) 用户数据的访问控制方法、装置及***
US11863549B2 (en) Adjusting security policies based on endpoint locations
WO2022105096A1 (zh) 一种确定信任终端的方法及相关装置
CN111314381A (zh) 安全隔离网关
CN110516470A (zh) 访问控制方法、装置、设备及存储介质
US20230412636A1 (en) Risk measurement method for user account and related apparatus
US20230315890A1 (en) Call location based access control of query to database
CN116015977B (zh) 一种用于物联网设备的网络访问控制方法及***
WO2024120113A1 (zh) 云应用访问控制方法、装置及计算机可读存储介质
US11177958B2 (en) Protection of authentication tokens
CN115883170A (zh) 网络流量数据监测分析方法、装置及电子设备及存储介质
CN116996238A (zh) 一种网络异常访问的处理方法以及相关装置
CN112769731B (zh) 一种进程控制方法、装置、服务器及存储介质
CN107294994A (zh) 一种基于云平台的csrf防护方法和***
CN110247902A (zh) 网站访问安全控制方法、装置及***
CN118214571A (zh) 云应用访问控制方法、装置及计算机可读存储介质
CN113297629B (zh) 一种鉴权方法、装置、***、电子设备和存储介质