CN118157885A - Remote access processing method, device, equipment and storage medium - Google Patents

Abstract

The application belongs to the technical field of information security, and discloses a remote access processing method, a device, equipment and a storage medium. When the remote access message is intercepted, the access protocol type and the target server corresponding to the remote access message are acquired; replacing sensitive data in the remote access message by a sensitive filtering strategy corresponding to the access protocol type to obtain a secure access message; the secure access message is forwarded to the target server. Because the remote access information is intercepted, and after the interception, the sensitive information is filtered by adopting different strategies according to the access protocol type corresponding to the remote access information, the front interception of the remote service access is realized, the filtration of malicious attacks and dangerous operations is ensured, and the effective protection of domain penetration attacks is realized.

Description

Remote access processing method, device, equipment and storage medium

Technical Field

The present invention relates to the field of information security technology, and in particular to a remote access processing method, device, equipment and storage medium.

Background technique

In the construction of enterprise network informatization, due to the huge number of internal assets and users, most enterprises choose AD (Active Directory) domain as a solution for unified management of users and hosts. However, due to the imperfect protection system, attackers often attack the domain control and then attack the core equipment within the enterprise to obtain the company's confidential data.

Domain penetration is represented by attacks such as RPC (Remote Procedure Call) remote privilege escalation and NTML Relay, which do not require review by ISP (Internet Service Provider) firewalls and export gateway firewalls. However, most companies tend to have relatively weak protection in their intranet environments. Traditional security protection systems (such as firewalls and IDS (intrusion detection systems)) are no longer sufficient to resist current domain penetration threats, and the protection against such attacks is not ideal.

The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art.

Summary of the invention

The main purpose of the present invention is to provide a remote access processing method, device, equipment and storage medium, aiming to solve the technical problem that the existing technology has unsatisfactory protection effect on domain penetration attacks based on remote access.

To achieve the above object, the present invention provides a remote access processing method, the method comprising the following steps:

When a remote access message is intercepted, obtaining an access protocol type and a target server corresponding to the remote access message;

Replacing sensitive data in the remote access message by a sensitive filtering policy corresponding to the access protocol type to obtain a secure access message;

The secure access message is forwarded to the target server.

Optionally, the step of replacing sensitive data in the remote access message by using a sensitive filtering policy corresponding to the access protocol type to obtain a secure access message includes:

If the access protocol type is a request response type, detecting whether the remote access message is a service query message;

If the remote access message is not service query information, extracting the access service identifier and the requested access port from the remote access message;

Obtaining a port replacement rule corresponding to the access service identifier;

Determine the real service port according to the requested access port and the port replacement rule;

The requested access port in the remote access message is replaced with the real service port to obtain a secure access message.

Optionally, if the access protocol type is a request response type, the step of detecting whether the remote access message is service query information includes:

If the access protocol type is a request-response type, extracting the requested access port from the remote access message;

If the service query port is consistent with the requested access port, the remote access message is determined to be service query information.

Optionally, if the access protocol type is a request response type, after the step of detecting whether the remote access message is service query information, the method further includes:

If the remote access message is a service query message, forwarding the remote access message to the target server, and obtaining a service query response fed back by the target server according to the remote access message;

Performing port replacement on the service query response to obtain replacement response information;

The replacement response information is sent to a message sending end corresponding to the remote access message.

Optionally, the step of performing port replacement on the service query response to obtain replacement response information includes:

Extracting service identification information and real service port from the service query response;

Detecting whether there is a port replacement rule corresponding to the service identification information;

If there is a port replacement rule corresponding to the service identification information, determining the service external port according to the port replacement rule and the real service port;

The real service port in the service query response is replaced with the service external port to obtain replacement response information.

Optionally, the step of detecting whether there is a port replacement rule corresponding to the service identification information includes:

Searching for a port replacement rule corresponding to the service identification information in a preset replacement rule library;

If the port replacement rule corresponding to the service identification information can be found, it is determined that the port replacement rule corresponding to the service identification information exists.

Optionally, the step of replacing sensitive data in the remote access message by using a sensitive filtering policy corresponding to the access protocol type to obtain a secure access message includes:

If the access protocol type is a pipeline connection type, detecting whether the instruction included in the remote access message is a pipeline start instruction;

If it is a pipeline start instruction, detecting whether the access target corresponding to the remote access message is a sensitive target;

If the access target is a sensitive target, the remote access message is replaced with a pipe name to obtain a secure access message.

Optionally, the step of detecting whether the instruction included in the remote access message is a pipeline start instruction includes:

extracting remote access parameters from the remote access message;

If the remote access parameter is a startup object type, it is determined that the instruction included in the remote access message is a pipeline startup instruction.

Optionally, if the access target is a sensitive target, the step of replacing the pipe name of the remote access message to obtain a secure access message includes:

If the access target is a sensitive target, searching for a pipeline replacement rule corresponding to the target server;

Matching the access target with the pipeline replacement rule to obtain the pipeline to be replaced;

The remote access message is replaced with a pipe name according to the pipe to be replaced to obtain a secure access message.

Optionally, if the access protocol type is a pipe connection type, the step of detecting whether the instruction included in the remote access message is a pipe start instruction includes:

If the access protocol type is a pipe connection type, obtaining the sender IP corresponding to the remote access message;

Check whether the sender's IP address is in the access blacklist;

If it does not exist in the access blacklist, it is detected whether the instruction included in the remote access message is a pipeline start instruction.

Optionally, if the access target is a sensitive target, after the step of replacing the pipe name of the remote access message to obtain a secure access message, the method further includes:

Obtain the historical number of pipeline replacements corresponding to the sender IP;

and adding one to the historical pipeline replacement times to obtain the current replacement times;

If the current number of replacements is greater than a preset replacement threshold, the sender IP is added to the access blacklist.

In addition, to achieve the above object, the present invention also proposes a remote access processing device, which includes the following modules:

A message interception module, used to obtain the access protocol type and target server corresponding to the remote access message when intercepting the remote access message;

A sensitive filtering module, used to replace sensitive data in the remote access message by a sensitive filtering policy corresponding to the access protocol type to obtain a secure access message;

The message forwarding module is used to forward the security access message to the target server.

Optionally, the sensitive filtering module is also used to detect whether the remote access message is service query information if the access protocol type is a request response type; if the remote access message is not service query information, extract the access service identifier and the requested access port from the remote access message; obtain the port replacement rule corresponding to the access service identifier; determine the real service port according to the requested access port and the port replacement rule; replace the requested access port in the remote access message with the real service port to obtain a secure access message.

Optionally, the sensitive filtering module is also used to extract the request access port from the remote access message if the access protocol type is a request response type; obtain the service query port corresponding to the target server; and if the service query port is consistent with the request access port, determine that the remote access message is service query information.

Optionally, the sensitive filtering module is also used to forward the remote access message to the target server if the remote access message is service query information, and obtain a service query response fed back by the target server based on the remote access message; perform port replacement on the service query response to obtain replacement response information; and send the replacement response information to the message sending end corresponding to the remote access message.

Optionally, the sensitive filtering module is also used to extract service identification information and the real service port from the service query response; detect whether there is a port replacement rule corresponding to the service identification information; if there is a port replacement rule corresponding to the service identification information, determine the service external port according to the port replacement rule and the real service port; replace the real service port in the service query response with the service external port to obtain replacement response information; and send the replacement response information to the message sending end of the remote access message.

Optionally, the sensitive filtering module is further used to search for a port replacement rule corresponding to the service identification information in a preset replacement rule library; if the port replacement rule corresponding to the service identification information can be found, it is determined that there is a port replacement rule corresponding to the service identification information.

Optionally, the sensitive filtering module is also used to detect whether the instruction contained in the remote access message is a pipeline startup instruction if the access protocol type is a pipeline connection type; if it is a pipeline startup instruction, detect whether the access target corresponding to the remote access message is a sensitive target; if the access target is a sensitive target, replace the remote access message with a pipeline name to obtain a secure access message.

In addition, to achieve the above-mentioned purpose, the present invention also proposes a remote access processing device, which includes: a processor, a memory, and a remote access processing program stored in the memory and executable on the processor, and the remote access processing program implements the steps of the remote access processing method described above when executed.

In addition, to achieve the above object, the present invention also proposes a computer-readable storage medium, on which a remote access processing program is stored, and when the remote access processing program is executed, the steps of the remote access processing method described above are implemented.

The present invention obtains the access protocol type and target server corresponding to the remote access message when intercepting the remote access message; replaces the sensitive data in the remote access message by the sensitive filtering strategy corresponding to the access protocol type to obtain the secure access message; and forwards the secure access message to the target server. Since the remote access message is intercepted, and after the interception, different strategies are used to filter sensitive information according to the access protocol type corresponding to the remote access message, the pre-interception of remote service access is realized, and malicious attacks and dangerous operations can be filtered, thereby achieving effective protection against domain penetration attacks.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of the structure of an electronic device in a hardware operating environment according to an embodiment of the present invention;

FIG2 is a flow chart of a first embodiment of a remote access processing method according to the present invention;

3 is a schematic flow chart of a second embodiment of a remote access processing method according to the present invention;

FIG4 is a schematic diagram of a port replacement process according to an embodiment of the present invention;

5 is a schematic flow chart of a third embodiment of a remote access processing method according to the present invention;

FIG6 is a schematic diagram of replacing a pipe name according to an embodiment of the present invention;

FIG7 is a schematic diagram of remote server access according to an embodiment of the present invention;

FIG8 is a structural block diagram of a first embodiment of a remote access processing device according to the present invention.

The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings.

Detailed ways

It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

Refer to FIG. 1 , which is a schematic diagram of the structure of a remote access processing device in a hardware operating environment according to an embodiment of the present invention.

As shown in FIG1 , the electronic device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

Those skilled in the art will appreciate that the structure shown in FIG. 1 does not limit the electronic device and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

As shown in FIG. 1 , the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a remote access processing program.

In the electronic device shown in FIG1 , the network interface 1004 is mainly used for data communication with a network server; the user interface 1003 is mainly used for data interaction with a user; the processor 1001 and the memory 1005 in the electronic device of the present invention can be set in a remote access processing device, and the electronic device calls the remote access processing program stored in the memory 1005 through the processor 1001, and executes the remote access processing method provided in an embodiment of the present invention.

An embodiment of the present invention provides a remote access processing method. Referring to FIG. 2 , FIG. 2 is a flow chart of a first embodiment of a remote access processing method of the present invention.

In this embodiment, the remote access processing method includes the following steps:

Step S10: when a remote access message is intercepted, the access protocol type and the target server corresponding to the remote access message are obtained.

It should be noted that the execution subject of this embodiment can be the remote access processing device, and the remote access processing device can be an electronic device such as a personal computer, a server, or of course, other electronic devices that can achieve the same or similar functions. This embodiment does not limit this. In this embodiment and the following embodiments, the remote access processing method of the present invention is described by taking the remote access processing device as an example.

It should be noted that the server can be a server that performs unified management of remote servers. It can mainly serve as a registration center for remote services. It is mainly used to provide users with remote service query functions (for example: querying the service name, access address, access port and other relevant information of a remote service), and forwarding messages to the corresponding remote server. The remote access processing device can be the server itself, or it can be a proxy server that can intercept and process messages received/sent by the server.

In a specific implementation, a remote access message may be a message sent by a user end to a server end when the user end needs to use a remote service. The target server may be the server that the user end actually wants to access, and the target server may be determined by the attribution of the service that the remote access message needs to access. For example, when a user end sends a remote access message to query information about a remote service, and the query service is provided by the server end, the target server is the server end; when accessing a specific remote service, the remote server that provides the remote service is the target server.

In the specific implementation, the access protocol type can be classified into two types, namely the request response type and the pipe connection type. For example, taking the Windows system as an example, its remote access protocol can be divided into two types: ncacn_ip_tcp and ncacn_np. Among them, ncacn_ip_tcp is the request response type, and ncacn_np is the pipe connection type.

In actual use, the access protocol type corresponding to the remote access message can be determined by intercepting the remote access message, and remote access messages transmitted by different access protocol types can be intercepted in different ways;

For example: for remote access messages transmitted in the form of request-response type, the remote access processing device can intercept the request received by the user end and detect whether the protocol type in the intercepted request is the remote access protocol; for remote access messages transmitted in the form of pipe connection type, the remote access processing device can intercept by mounting a named pipe file system (NPFS).

Step S20: Replace sensitive data in the remote access message using a sensitive filtering policy corresponding to the access protocol type to obtain a secure access message.

It is understandable that the formats of remote access messages transmitted for different access protocol types are different. On this basis, the types of sensitive data contained therein may be different, and the locations of the sensitive data may also be different. When replacing sensitive data, the required methods are also different. Therefore, you can first find the corresponding sensitive filtering policy according to the access protocol type, and then replace the sensitive data in the remote access message according to the sensitive filtering policy to obtain a secure access message.

Step S30: forwarding the security access message to the target server.

It is understandable that after the sensitive data is replaced, the remote access message can be guaranteed to be secure, and therefore, the secure access message can be directly forwarded to the target server for specific processing by the target server.

In actual use, when forwarding the security access message to the target server, different message forwarding methods (such as through pipelines or ALPC, etc.) can be selected according to the different access protocol types to forward the security access message to the target server and call the service in the target server for processing.

In a specific implementation, after forwarding the security access message to the target server for processing, if the target server also feeds back corresponding data, the remote access processing device can also intercept the data fed back by the target server for further processing, and feed it back to the user end after processing.

This embodiment obtains the access protocol type and target server corresponding to the remote access message when intercepting the remote access message; replaces the sensitive data in the remote access message by the sensitive filtering policy corresponding to the access protocol type to obtain a secure access message; and forwards the secure access message to the target server. Since the remote access message is intercepted and after the interception, different policies are used to filter sensitive information according to the access protocol type corresponding to the remote access message, the pre-interception of remote service access is achieved, ensuring that malicious attacks and dangerous operations can be filtered, thereby achieving effective protection against domain penetration attacks.

Refer to FIG. 3 , which is a flow chart of a second embodiment of a remote access processing method according to the present invention.

Based on the first embodiment, step S20 of the remote access processing method of this embodiment includes:

Step S201: If the access protocol type is a request response type, then detecting whether the remote access message is service query information.

It should be noted that if the access protocol type is a request-response type, it means that the user end calls the remote service in the form of request-response, and the access port of the remote service is generally uniformly allocated and managed by the server for the remote service registered in the server. In this calling method, the user end needs to first obtain the specific access port number of a remote service from the server. At this time, the remote access message may be used to access the server to query the access port number of the remote service. Therefore, it is necessary to detect whether the remote access message is service query information.

In a specific implementation, in order to accurately determine whether the remote access message is service query information, step S201 in this embodiment may include:

If the access protocol type is a request-response type, extracting the requested access port from the remote access message;

If the service query port is consistent with the requested access port, the remote access message is determined to be service query information.

It should be noted that the server can pre-specify a fixed port as a service query port, and provide a port number query function for the remote service through the fixed port, so that the remote caller can query the specific port number of the remote service. Therefore, if the requested access port extracted from the remote access message is consistent with the service query port, it means that the user end is performing a port query, and at this time it can be determined that the remote access message is service query information.

Furthermore, since during the process of querying the service port, data is transmitted between the user end and the server end in the form of request and response, the data may be intercepted by malicious attackers, thereby obtaining the specific access port of the remote service and launching an attack. In order to ensure security, some important remote service ports may be replaced. After step S201, the steps described in this embodiment may also include:

If the remote access message is a service query message, forwarding the remote access message to the target server, and obtaining a service query response fed back by the target server according to the remote access message;

Performing port replacement on the service query response to obtain replacement response information;

The replacement response information is sent to a message sending end corresponding to the remote access message.

It should be noted that if the remote access message is service query information, it means that the user end needs to query the service access port of the remote service. Therefore, the remote access message can be forwarded to the target server (the target server is the server end at this time), and the target server can extract the service identification information from the remote access message, and then find the corresponding information according to the service identification information, and encapsulate it into a service query response. At this time, in order to ensure that the real port is not leaked, the remote access processing device can intercept the service query response, and then replace the port thereof, and replace the service access port of the remote service contained therein with other controllable port numbers, and after the replacement, send the replacement response information to the message sending end corresponding to the remote access message (that is, the above-mentioned user end).

In actual use, the real service port in the service query response is replaced with the service external port, and the replacement response information is obtained by replacing the real service port in the service query response with the service external port, and using the replaced service query response as the replacement response information.

In a specific implementation, in order to ensure that the replaced port can be restored normally and that the subsequent user terminal can access the remote service normally, at this time, the step of performing port replacement on the service query response and obtaining replacement response information in this embodiment may include:

Extracting service identification information and real service port from the service query response;

Detecting whether there is a port replacement rule corresponding to the service identification information;

If there is a port replacement rule corresponding to the service identification information, determining the service external port according to the port replacement rule and the real service port;

The real service port in the service query response is replaced with the service external port to obtain replacement response information.

It should be noted that the service identification information can be the unique identification of the remote service queried by the user, and the real service port can be the real port of the remote service queried by the access user. If there is a port replacement rule corresponding to the service identification information, it means that the remote service corresponding to the service identification information is very important and port replacement is required.

In a specific implementation, determining the service external port according to the port replacement rule and the real service port may be a mapping relationship between the real service port and the external service port, and searching the service external port corresponding to the real service port in the mapping relationship.

Furthermore, since the remote access processing device may act as a proxy server to manage multiple different servers at the same time, and different servers may have different replacement rules for different situations, in order to avoid misjudgment

The step of detecting whether there is a port replacement rule corresponding to the service identification information in this embodiment includes:

Searching for a port replacement rule corresponding to the service identification information in a preset replacement rule library;

If the port replacement rule corresponding to the service identification information can be found, it is determined that the port replacement rule corresponding to the service identification information exists.

It should be noted that the preset replacement rule base may be a database storing port replacement rules corresponding to different service identification information. If the port replacement rule corresponding to the service identification information can be found in the preset replacement rule base, it means that the administrator of the remote access processing device has set the corresponding port replacement rule for it and stored it in the preset replacement rule base. Therefore, it can be determined that there is a port replacement rule corresponding to the service identification information.

For ease of understanding, the present invention is described in conjunction with FIG. 4 , but the present solution is not limited thereto. FIG. 4 is a schematic diagram of the port replacement process of the present embodiment. As shown in FIG. 4 , if the client (i.e., the user end) needs to query the port number of a remote service (i.e., the service access port), a request will be generated according to the service identification information (Target UUID) of the remote service, and sent to the server end. The EPM module in the server end will respond to the request and search for the corresponding entry in its service list. If the entry is successfully found, a service query response in the form of Tower will be generated according to the entry, and an attempt will be made to feed it back to the client end. At this time, the EPM Filter module in the remote access processing device will intercept the service query response in the form of Tower, extract the service identification information therefrom, search for the corresponding port replacement rule according to the service identification information, and modify and replace the port number in the service query response according to the port replacement rule. After the replacement is completed, the replacement response information obtained by the replacement will be sent to the message sending end (i.e., the user end that sends the remote access message).

Step S202: If the remote access message is not service query information, extracting the access service identifier and the requested access port from the remote access message.

It should be noted that if the remote access message is not service query information, it means that the user end is accessing a specific remote service at this time. However, since the access port of the remote service obtained by the user end when querying the remote service has been replaced, if it is not processed, it cannot access the remote service normally in real time. At this time, the access service identifier and the requested access port can be extracted from the remote access message to restore the real service access port. Among them, the access service identifier can be the service identifier information of the remote service that the remote access message needs to access, and the requested access port can be the service access port required by the remote access information.

Step S203: Acquire the port replacement rule corresponding to the access service identifier.

It should be noted that obtaining the port replacement rule corresponding to the access service identifier may be searching for the port replacement rule corresponding to the access service identifier in a preset replacement rule library.

It is understandable that if the port replacement rule corresponding to the access service identifier cannot be found, it means that the remote service that needs to be accessed at this time is not an important remote service, and its service access port has not been replaced when it was sent to the user end. At this time, the subsequent steps can be no longer executed, and the remote access message can be directly used as a security access message.

Step S204: determining the real service port according to the requested access port and the port replacement rule.

It should be noted that the mapping relationship between the real service port and the external service port is extracted from the port replacement rule, and the requested access port is used as the service external port to find the corresponding real service port.

Step S205: Replace the requested access port in the remote access message with the real service port to obtain a secure access message.

In actual use, the requested access port in the remote access message is replaced with the real service port, and the secure access message is obtained by replacing the requested access port contained in the remote access message with the real service port, and using the replaced remote access message as the secure access message.

This embodiment detects whether the remote access message is a service query message if the access protocol type is a request response type; if the remote access message is not a service query message, extracts the access service identifier and the requested access port from the remote access message; obtains the port replacement rule corresponding to the access service identifier; determines the real service port according to the requested access port and the port replacement rule; replaces the requested access port in the remote access message with the real service port to obtain a secure access message. Since the real access port of the remote service is not exposed to the outside during access, but the external access port is exposed to the outside, malicious attackers cannot obtain the real access port of the remote service, thus avoiding malicious attackers' attacks on the remote service.

Refer to FIG. 5 , which is a flowchart of a third embodiment of a remote access processing method according to the present invention.

Based on the first embodiment, step S20 of the remote access processing method of this embodiment includes:

Step S201 ′: If the access protocol type is a pipe connection type, detecting whether the instruction included in the remote access message is a pipe start instruction.

It should be noted that when the user end uses the pipe connection type protocol for message transmission, it does not need to obtain the port and can directly connect through the pipe to call the remote service. When a malicious attacker attacks through a pipe connection, he or she opens a pipe and tamper with it to achieve the attack. Therefore, when the access protocol type is the pipe connection type, it is possible to detect whether the instruction contained in the remote access message is a pipe startup instruction, that is, whether it is an instruction to open a pipe.

In a specific implementation, in order to accurately determine whether the instruction included in the remote access message is a pipeline start instruction, the step of detecting whether the instruction included in the remote access message is a pipeline start instruction in this embodiment may include:

extracting remote access parameters from the remote access message;

If the remote access parameter is a startup object type, it is determined that the instruction included in the remote access message is a pipeline startup instruction.

It should be noted that when a pipe is opened, the parameter passed in the command will be an object whose type is a startup object type. Therefore, the remote access parameter can be extracted from the remote access message, and then it can be determined whether the remote access parameter is a startup object type, thereby determining whether the instruction contained in the remote access message is a pipe startup instruction.

In a specific implementation, determining whether the remote access parameter is a startup object type may include attempting to convert the remote access parameter into a format corresponding to the startup object type. If the conversion is successful, the remote access parameter may be determined to be a startup object type.

For example, taking the remote call of Windows system as an example, the parameter passed in the pipe start instruction will be an IRP_MJ_CREATE request object. Therefore, it is possible to detect whether the remote access parameter is an IRP_MJ_CREATE request object. If so, it can be determined that the instruction contained in the remote access message is a pipe start instruction.

Furthermore, in order to deal with the cyclic attack method of the malicious attacker and avoid consuming too many device resources due to the cyclic attack, the step S201' in this embodiment may include:

If the access protocol type is a pipe connection type, obtaining the sender IP corresponding to the remote access message;

Check whether the sender's IP address is in the access blacklist;

If it does not exist in the access blacklist, it is detected whether the instruction included in the remote access message is a pipeline start instruction.

It should be noted that the sender IP may be the IP address of the device that sends the remote access message. Obtaining the sender IP corresponding to the remote access message may be extracting the sender IP from the remote access message, or performing IP tracing to obtain the sender IP of the remote access message. The access blacklist may be a data table storing the IP addresses of malicious attackers.

It is understandable that if the sender IP does not exist in the access blacklist, it means that the sender of the remote access message has not been identified as a malicious attacker, so the subsequent steps can be continued. If the sender IP exists in the access blacklist, it means that the sender of the remote access message has been identified as a malicious attacker, and no further processing is required at this time, but the remote access message can be directly cleared to avoid wasting too many device resources for it.

Step S202': If it is a pipeline start instruction, then detect whether the access target corresponding to the remote access message is a sensitive target.

It is understandable that if the instruction contained in the remote access message is a pipeline startup instruction, it needs to be further detected to determine whether the remote access message is initiated by a malicious attacker. Therefore, the access target corresponding to the remote access message can be obtained, and then it can be determined whether the access target is a sensitive target.

In a specific implementation, detecting whether the access target corresponding to the remote access message is a sensitive target can be by extracting the pipe name of the pipe accessed by the remote access message from the remote access message, and detecting whether the pipe name is in a preset sensitive pipe list. If so, it can be determined whether the access target corresponding to the remote access message is a sensitive target, wherein the preset sensitive pipe list includes the name of a sensitive pipe, and the preset sensitive pipe list can be set by the administrator of the remote access processing device.

Step S203': if the access target is a sensitive target, the remote access message is replaced with a pipe name to obtain a secure access message.

It is understandable that if the access target is a sensitive target, it means that the remote access message is very likely to be initiated by a malicious attacker. If the attacker continues to access the remote server, the remote server may be attacked. Therefore, the pipe name of the remote access message can be replaced, and the replaced remote access message can be used as a secure access message. The access pipe can be transferred to the preset secure pipe, thereby ensuring that the remote server will not be attacked.

Furthermore, in order to timely discover malicious attackers, avoid cyclic attacks by malicious attackers, and avoid consuming too many device resources due to cyclic attacks, after step S203' described in this embodiment, the following may also be included:

Obtain the historical number of pipeline replacements corresponding to the sender IP;

and adding one to the historical pipeline replacement times to obtain the current replacement times;

If the current number of replacements is greater than a preset replacement threshold, the sender IP is added to the access blacklist.

It should be noted that the historical pipe replacement times may be the times that pipe names of remote access messages sent by the sender IP have been replaced. The preset replacement threshold may be pre-set by the administrator of the remote access processing device according to actual needs, for example, the preset replacement threshold may be set to 5.

It can be understood that if the current number of replacements is greater than the preset replacement threshold, it means that the sender IP has tried to open sensitive pipes many times. Therefore, the sender can be determined to be a malicious attacker, and therefore, the sender can be added to the access blacklist.

For ease of understanding, an explanation is now given in conjunction with FIG. 6 , but this solution is not limited thereto. FIG. 6 is a schematic diagram of pipe name replacement in this embodiment. As shown in FIG. 6 , the remote access processing device mounts the NPFS device in advance, intercepts remote access messages of pipe connection type (i.e., IPR requests), extracts remote access parameters therein, and detects whether the remote access parameters therein are IRP_MJ_CREATE request objects. If not, it is directly sent to NPFS for pipe connection; if so, the pipe name is extracted therefrom, and when it is determined that the pipe name is in the preset sensitive pipe list (i.e., EaLength>0), the pipe name therein is changed. After the change is completed, the modified remote access message is sent to NPFS for pipe connection.

For ease of understanding, the present invention is now described in conjunction with FIG. 7 , but this solution is not limited thereto. FIG. 7 is a schematic diagram of remote server access of this embodiment. As shown in FIG. 7 , the remote access processing device includes at least three modules: EPM Filter, PIPE Filter, and RPC Proxy. When the client makes an RPC call, it sends a remote access message to the server, and the server sends the remote access message to the remote access processing device. The remote access processing device selects a corresponding module for processing according to the access protocol type, and after processing, sends the message to the RPC Proxy module, which forwards the message to the real remote server (RPC Server) by the RPC Proxy module.

In this embodiment, if the access protocol type is a pipe connection type, then the instruction contained in the remote access message is detected as a pipe start instruction; if it is a pipe start instruction, then the access target corresponding to the remote access message is detected as a sensitive target; if the access target is a sensitive target, then the pipe name of the remote access message is replaced to obtain a secure access message. Since the instructions in the pipe connection process are identified, when the remote visitor attempts to open a sensitive target through a pipe, the pipe name is replaced, thereby filtering dangerous operations, improving the security of the remote access process, and achieving effective protection against domain penetration attacks.

In addition, an embodiment of the present invention further provides a storage medium, on which a remote access processing program is stored. When the remote access processing program is executed by a processor, the steps of the remote access processing method described above are implemented.

5, which is a structural block diagram of a first embodiment of a remote access processing device according to the present invention.

As shown in FIG5 , the remote access processing device proposed in the embodiment of the present invention includes:

The message interception module 10 is used to obtain the access protocol type and target server corresponding to the remote access message when intercepting the remote access message;

A sensitive filtering module 20, configured to replace sensitive data in the remote access message by a sensitive filtering policy corresponding to the access protocol type to obtain a secure access message;

The message forwarding module 30 is used to forward the security access message to the target server.

This embodiment obtains the access protocol type and target server corresponding to the remote access message when intercepting the remote access message; replaces the sensitive data in the remote access message by the sensitive filtering policy corresponding to the access protocol type to obtain a secure access message; and forwards the secure access message to the target server. Since the remote access message is intercepted and after the interception, different policies are used to filter sensitive information according to the access protocol type corresponding to the remote access message, the pre-interception of remote service access is achieved, ensuring that malicious attacks and dangerous operations can be filtered, thereby achieving effective protection against domain penetration attacks.

Furthermore, the sensitive filtering module 20 is also used to detect whether the remote access message is service query information if the access protocol type is a request response type; if the remote access message is not a service query information, extract the access service identifier and the requested access port from the remote access message; obtain the port replacement rule corresponding to the access service identifier; determine the real service port according to the requested access port and the port replacement rule; replace the requested access port in the remote access message with the real service port to obtain a secure access message.

Furthermore, the sensitive filtering module 20 is also used to extract the request access port from the remote access message if the access protocol type is a request response type; obtain the service query port corresponding to the target server; if the service query port is consistent with the request access port, determine that the remote access message is service query information.

Furthermore, the sensitive filtering module 20 is also used to forward the remote access message to the target server if the remote access message is service query information, and obtain a service query response fed back by the target server based on the remote access message; perform port replacement on the service query response to obtain replacement response information; and send the replacement response information to the message sending end corresponding to the remote access message.

Furthermore, the sensitive filtering module 20 is also used to extract service identification information and a real service port from the service query response; detect whether there is a port replacement rule corresponding to the service identification information; if there is a port replacement rule corresponding to the service identification information, determine the service external port according to the port replacement rule and the real service port; replace the real service port in the service query response with the service external port to obtain replacement response information; and send the replacement response information to the message sending end of the remote access message.

Furthermore, the sensitive filtering module 20 is also used to search for a port replacement rule corresponding to the service identification information in a preset replacement rule library; if the port replacement rule corresponding to the service identification information can be found, it is determined that there is a port replacement rule corresponding to the service identification information.

Furthermore, the sensitive filtering module 20 is also used to detect whether the instruction contained in the remote access message is a pipeline startup instruction if the access protocol type is a pipeline connection type; if it is a pipeline startup instruction, detect whether the access target corresponding to the remote access message is a sensitive target; if the access target is a sensitive target, replace the remote access message with a pipeline name to obtain a secure access message.

Furthermore, the sensitive filtering module 20 is further configured to extract a remote access parameter from the remote access message; if the remote access parameter is a startup object type, then determine that the instruction contained in the remote access message is a pipeline startup instruction.

Furthermore, the sensitive filtering module 20 is also used to find the pipe replacement rule corresponding to the target server if the access target is a sensitive target; match the access target with the pipe replacement rule to obtain the pipe to be replaced; replace the pipe name of the remote access message according to the pipe to be replaced to obtain a secure access message.

Furthermore, the sensitive filtering module 20 is also used to obtain the sender IP corresponding to the remote access message if the access protocol type is a pipeline connection type; detect whether the sender IP exists in the access blacklist; if it does not exist in the access blacklist, detect whether the instruction contained in the remote access message is a pipeline startup instruction.

Furthermore, the sensitive filtering module 20 is also used to obtain the historical pipeline replacement times corresponding to the sender IP; and add one to the historical pipeline replacement times to obtain the current replacement times; if the current replacement times is greater than a preset replacement threshold, the sender IP is added to the access blacklist.

It should be understood that the above is only an example and does not constitute any limitation on the technical solution of the present invention. In specific applications, technicians in this field can make settings as needed, and the present invention does not limit this.

It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.

In addition, for technical details not fully described in this embodiment, reference may be made to the remote access processing method provided in any embodiment of the present invention, and will not be repeated here.

In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM)/RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

The present invention discloses A1, a remote access processing method, the remote access processing method comprising the following steps:

When a remote access message is intercepted, obtaining an access protocol type and a target server corresponding to the remote access message;

Replacing sensitive data in the remote access message by a sensitive filtering policy corresponding to the access protocol type to obtain a secure access message;

The secure access message is forwarded to the target server.

A2. The remote access processing method as described in A1, wherein the step of replacing the sensitive data in the remote access message by the sensitive filtering policy corresponding to the access protocol type to obtain a secure access message comprises:

If the access protocol type is a request response type, detecting whether the remote access message is a service query message;

If the remote access message is not service query information, extracting the access service identifier and the requested access port from the remote access message;

Obtaining a port replacement rule corresponding to the access service identifier;

Determine the real service port according to the requested access port and the port replacement rule;

The requested access port in the remote access message is replaced with the real service port to obtain a secure access message.

A3. The remote access processing method as described in A2, wherein if the access protocol type is a request response type, the step of detecting whether the remote access message is service query information comprises:

If the access protocol type is a request-response type, extracting the requested access port from the remote access message;

If the service query port is consistent with the requested access port, the remote access message is determined to be service query information.

A4. The remote access processing method as described in A2, wherein if the access protocol type is a request response type, after the step of detecting whether the remote access message is service query information, the method further comprises:

If the remote access message is a service query message, forwarding the remote access message to the target server, and obtaining a service query response fed back by the target server according to the remote access message;

Performing port replacement on the service query response to obtain replacement response information;

The replacement response information is sent to a message sending end corresponding to the remote access message.

A5. The remote access processing method as described in A4, wherein the step of performing port replacement on the service query response and obtaining replacement response information comprises:

Extracting service identification information and real service port from the service query response;

Detecting whether there is a port replacement rule corresponding to the service identification information;

If there is a port replacement rule corresponding to the service identification information, determining the service external port according to the port replacement rule and the real service port;

The real service port in the service query response is replaced with the service external port to obtain replacement response information.

A6. In the remote access processing method described in A5, the step of detecting whether there is a port replacement rule corresponding to the service identification information comprises:

Searching for a port replacement rule corresponding to the service identification information in a preset replacement rule library;

If the port replacement rule corresponding to the service identification information can be found, it is determined that the port replacement rule corresponding to the service identification information exists.

A7. The remote access processing method as described in A1, wherein the step of replacing the sensitive data in the remote access message by the sensitive filtering policy corresponding to the access protocol type to obtain a secure access message comprises:

If the access protocol type is a pipeline connection type, detecting whether the instruction included in the remote access message is a pipeline start instruction;

If it is a pipeline start instruction, detecting whether the access target corresponding to the remote access message is a sensitive target;

If the access target is a sensitive target, the remote access message is replaced with a pipe name to obtain a secure access message.

A8. The remote access processing method as described in A7, wherein the step of detecting whether the instruction contained in the remote access message is a pipeline start instruction comprises:

extracting remote access parameters from the remote access message;

If the remote access parameter is a startup object type, it is determined that the instruction included in the remote access message is a pipeline startup instruction.

A9. The remote access processing method as described in A7, wherein if the access target is a sensitive target, the step of replacing the pipe name of the remote access message to obtain a secure access message comprises:

If the access target is a sensitive target, searching for a pipeline replacement rule corresponding to the target server;

Matching the access target with the pipeline replacement rule to obtain the pipeline to be replaced;

The remote access message is replaced with a pipe name according to the pipe to be replaced to obtain a secure access message.

A10. The remote access processing method as described in A7, wherein if the access protocol type is a pipe connection type, the step of detecting whether the instruction included in the remote access message is a pipe start instruction comprises:

If the access protocol type is a pipe connection type, obtaining the sender IP corresponding to the remote access message;

Check whether the sender's IP address is in the access blacklist;

If it does not exist in the access blacklist, it is detected whether the instruction included in the remote access message is a pipeline start instruction.

A11. The remote access processing method as described in A10, wherein if the access target is a sensitive target, the remote access message is replaced with a pipe name, and after the step of obtaining a secure access message, the method further comprises:

Obtain the historical number of pipeline replacements corresponding to the sender IP;

and adding one to the historical pipeline replacement times to obtain the current replacement times;

If the current number of replacements is greater than a preset replacement threshold, the sender IP is added to the access blacklist.

The present invention also discloses B12, a remote access processing device, the remote access processing device comprising the following modules:

A message interception module, used to obtain the access protocol type and target server corresponding to the remote access message when intercepting the remote access message;

A sensitive filtering module, used to replace sensitive data in the remote access message by a sensitive filtering policy corresponding to the access protocol type to obtain a secure access message;

The message forwarding module is used to forward the security access message to the target server.

B13. In the remote access processing device as described in B12, the sensitive filtering module is also used to detect whether the remote access message is service query information if the access protocol type is a request response type; if the remote access message is not a service query information, extract the access service identifier and the requested access port from the remote access message; obtain the port replacement rule corresponding to the access service identifier; determine the real service port according to the requested access port and the port replacement rule; replace the requested access port in the remote access message with the real service port to obtain a secure access message.

B14. In the remote access processing device as described in B13, the sensitive filtering module is also used to extract the request access port from the remote access message if the access protocol type is a request response type; obtain the service query port corresponding to the target server; and determine that the remote access message is service query information if the service query port is consistent with the request access port.

B15. In the remote access processing device as described in B13, the sensitive filtering module is also used to forward the remote access message to the target server if the remote access message is service query information, and obtain the service query response fed back by the target server based on the remote access message; perform port replacement on the service query response to obtain replacement response information; and send the replacement response information to the message sending end corresponding to the remote access message.

B16. In the remote access processing device as described in B15, the sensitive filtering module is also used to extract service identification information and the real service port from the service query response; detect whether there is a port replacement rule corresponding to the service identification information; if there is a port replacement rule corresponding to the service identification information, determine the service external port according to the port replacement rule and the real service port; replace the real service port in the service query response with the service external port to obtain replacement response information; and send the replacement response information to the message sending end of the remote access message.

B17. In the remote access processing device as described in B16, the sensitive filtering module is further used to search for a port replacement rule corresponding to the service identification information in a preset replacement rule library; if the port replacement rule corresponding to the service identification information can be found, it is determined that there is a port replacement rule corresponding to the service identification information.

B18. In the remote access processing device as described in B12, the sensitive filtering module is also used to detect whether the instruction contained in the remote access message is a pipeline startup instruction if the access protocol type is a pipeline connection type; if it is a pipeline startup instruction, detect whether the access target corresponding to the remote access message is a sensitive target; if the access target is a sensitive target, replace the remote access message with a pipeline name to obtain a secure access message.

The present invention also discloses C19, a remote access processing device, which includes: a processor, a memory, and a remote access processing program stored in the memory and executable on the processor, and the remote access processing program implements the steps of the remote access processing method described above when executed.

The present invention also discloses D20, a computer-readable storage medium, on which a remote access processing program is stored, and when the remote access processing program is executed, the steps of the remote access processing method described above are implemented.

Claims (10)

1. A remote access processing method, characterized in that the remote access processing method comprises the following steps: When a remote access message is intercepted, obtaining an access protocol type and a target server corresponding to the remote access message; Replacing sensitive data in the remote access message by a sensitive filtering policy corresponding to the access protocol type to obtain a secure access message; The secure access message is forwarded to the target server. 2. The remote access processing method according to claim 1, wherein the step of replacing the sensitive data in the remote access message by the sensitive filtering policy corresponding to the access protocol type to obtain a secure access message comprises: If the access protocol type is a request response type, detecting whether the remote access message is a service query message; If the remote access message is not service query information, extracting the access service identifier and the requested access port from the remote access message; Obtaining a port replacement rule corresponding to the access service identifier; Determine the real service port according to the requested access port and the port replacement rule; The requested access port in the remote access message is replaced with the real service port to obtain a secure access message. 3. The remote access processing method according to claim 2, wherein if the access protocol type is a request response type, the step of detecting whether the remote access message is service query information comprises: If the access protocol type is a request-response type, extracting the requested access port from the remote access message; If the service query port is consistent with the requested access port, the remote access message is determined to be service query information. 4. The remote access processing method according to claim 2, characterized in that after the step of detecting whether the remote access message is service query information if the access protocol type is a request response type, it further comprises: If the remote access message is a service query message, forwarding the remote access message to the target server, and obtaining a service query response fed back by the target server according to the remote access message; Performing port replacement on the service query response to obtain replacement response information; The replacement response information is sent to a message sending end corresponding to the remote access message. 5. The remote access processing method according to claim 4, wherein the step of performing port replacement on the service query response to obtain replacement response information comprises: Extracting service identification information and real service port from the service query response; Detecting whether there is a port replacement rule corresponding to the service identification information; If there is a port replacement rule corresponding to the service identification information, determining the service external port according to the port replacement rule and the real service port; The real service port in the service query response is replaced with the service external port to obtain replacement response information. 6. The remote access processing method according to claim 5, wherein the step of detecting whether there is a port replacement rule corresponding to the service identification information comprises: Searching for a port replacement rule corresponding to the service identification information in a preset replacement rule library; If the port replacement rule corresponding to the service identification information can be found, it is determined that there is a port replacement rule corresponding to the service identification information. 7. The remote access processing method according to claim 1, wherein the step of replacing the sensitive data in the remote access message by the sensitive filtering policy corresponding to the access protocol type to obtain a secure access message comprises: If the access protocol type is a pipeline connection type, detecting whether the instruction included in the remote access message is a pipeline start instruction; If it is a pipeline start instruction, detecting whether the access target corresponding to the remote access message is a sensitive target; If the access target is a sensitive target, the remote access message is replaced with a pipe name to obtain a secure access message. 8. A remote access processing device, characterized in that the remote access processing device comprises the following modules: A message interception module, used to obtain the access protocol type and target server corresponding to the remote access message when intercepting the remote access message; A sensitive filtering module, used to replace sensitive data in the remote access message by a sensitive filtering policy corresponding to the access protocol type to obtain a secure access message; A message forwarding module is used to forward the security access message to the target server. 9. A remote access processing device, characterized in that the remote access processing device comprises: a processor, a memory, and a remote access processing program stored in the memory and executable on the processor, wherein when the remote access processing program is executed, the steps of the remote access processing method according to any one of claims 1 to 7 are implemented. 10. A computer-readable storage medium, characterized in that a remote access processing program is stored on the computer-readable storage medium, and the remote access processing program implements the steps of the remote access processing method according to any one of claims 1 to 7 when executed.