Safety detecting method and purview control system for client terminal

Abstract

The invention discloses a security detection method for a client, which includes: presetting at least one security assessment strategy, when the authority control system receives a login request from the client, selects a preset security assessment strategy, and obtains The terminal extracts all the detection attributes of each detection class of the security assessment strategy. If all the attributes of each detection class extracted match all the detection attributes of one of the detection objects of the corresponding detection class set in advance, it is determined that the client passes the test. Security detection; the present invention also discloses an authority control system, including: a security evaluation policy setting module and a security detection module. The invention enables the client to log into the authority control system as long as it passes the security detection of any security assessment strategy, thereby improving the success rate of the client access authority control system.

Description

technical field [0001] The invention relates to the technical field of communication security, in particular to a client security detection method and an authority control system. Background technique [0002] At present, the control technologies for user permissions are mainly divided into two categories: user role-based permission control and user device security-based permission control. Their corresponding authorization methods are: role-based authorization (role-based) and client-based authorization. Authorization for end-host security (host-based), where: [0003] Role-based authorization: Divide users into different groups or roles, each group or role can access different resources, and then authorize users according to the groups to which they belong. This type of authorization is also called static authorization; [0004] Authorization based on client host security: Authorize users based on the security status of their devices. This type of authorization is also ca...

AI Technical Summary

Problems solved by technology

For example: in practical applications, if the client needs to access resources with low security requirements during a certain login, it only needs to meet some login detection conditions at this time, and the existing technology does not consider the resources accessed by the client. Individual Security Requirements

[0015] 2. The login detection sequence and resource protection policy are configured separately, which may cause inconsistencies between the two, resulting in failure of the client to access resources

For example, firewall detection is not included in the login detection sequence, but the protection policy set for a certain resource requires that the firewall is running. At this time, the permission control system cannot find information about whether the firewall is running in the login detection results. Therefore, even if The firewall is running, and the permission control system will also deny the client access to the resource

[0016] 3. The security of the client host needs to be checked twice, that is, a security check is required when logging in, and a protection policy check is also required when accessing specific resources, which reduces the work efficiency of the authority control system

[0017] 4. The login detection sequence is long, and it is difficult for administrators to maintain

[0018] 5. Failure to respond to changes in client host security and new requirements of the authority control system in a timely manner may cause authorization errors

The existing technology only checks the security of the client once when the client logs in. When the client is online for a long time, the status of a certain login security sequence of the client may change. For example: the firewall changes from running to non-running, or, The authority control system has changed the protection policy for a certain resource. At this time, the authority control system still authorizes the client according to the original login detection result or resource protection policy, which will cause authorization errors.

Images