WO2010034209A1

WO2010034209A1 - Method, system and device for revaluating security state

Info

Publication number: WO2010034209A1
Application number: PCT/CN2009/072555
Authority: WO
Inventors: 任兰芳; 尹瀚; 贾科
Original assignee: 华为技术有限公司
Priority date: 2008-09-28
Filing date: 2009-06-30
Publication date: 2010-04-01
Also published as: CN101582792A

Abstract

The present invention provides a method, a system and a device for revaluating security state. Said method includes: the terminal accessing the second security domain is revaluated; the result of said revaluation is sent to said second security domain. By means of the revaluation after the terminal accessed the relying security domain (RSD), the present invention ensures that the security state of the terminal accessing the network always meets the requirement of security policy of the current network in the whole connection process of the terminal and would not threaten the network security to a certain extent.

Description

Method, system and device for reassessing safety state

The present invention relates to the field of communications technologies, and in particular, to a method, system and apparatus for re-evaluating a security state. Background technique

With the rapid development and universal application of the Internet, virus technology has also developed rapidly. When a large-scale virus outbreak occurs, a large amount of data traffic transmitted in the network will generate garbage data due to viruses, resulting in waste of resources, which seriously affects network efficiency and security. It has adverse effects and security threats on the user's terminal and service, and the virus intrusion of the user terminal is very easy, and the terminal may have security risks such as system vulnerabilities or virus database expiration. Security control of the terminal and strict network security assessment ensure network security.

With the development of mobile technology and the popularity of mobile terminals, more and more users hope to access the network at any time to enjoy a variety of services. At this time, it is not only necessary to provide security protection and efficient when the terminal is initially accessed. Security assessment, and it is necessary to ensure that the terminal does not pose a certain threat to the network during the entire communication process of the terminal. This requires that the network periodically re-evaluate the security status of the terminal according to certain policies.

In the prior art, when an ASD (Asserting Security Domain) terminal cross-domain access RSD (Relying Security Domain), the RSD needs to perform security state evaluation on the terminal. RSD does not directly collect and evaluate the security status information of the terminal, but after receiving the access request of the terminal, the RSD sends a terminal security status assertion request to the ASD of the terminal, after receiving the security state assertion of the terminal ASD, according to This result responds to the terminal's access request. Only terminals that meet the RSD security policy requirements are allowed to access RSD. After the terminal obtains the allowed access response of the RSD, the terminal can communicate with the RSD or enjoy a certain service.

In the process of implementing the present invention, the inventors have found that at least the following problems exist in the prior art: After communication between the terminal and the RSD, the RSD no longer focuses on the security state of the terminal. Evaluation or any other concern, RSD does not re-evaluate the security status of the terminal during the entire communication between the terminal and the RSD. Summary of the invention

Embodiments of the present invention provide a method, system, and apparatus for re-evaluating a security state to timely adjust appropriate control of a terminal according to a result of re-evaluation.

In order to achieve the above object, an embodiment of the present invention provides a method for re-evaluating a security state, including:

Re-evaluating the terminal accessing the second security domain;

Transmitting the re-evaluation result to the second security domain.

The embodiment of the invention further provides a system for reassessing the security status, including:

a first security domain, configured to re-evaluate a terminal accessing the second security domain, and send the re-evaluation result to the second security domain;

And a second security domain, configured to perform corresponding control on the access of the terminal according to the re-evaluation result.

An embodiment of the present invention further provides a device for re-evaluating a security state, including:

a re-evaluation module, configured to re-evaluate a terminal accessing the second security domain;

And a sending module, configured to send the re-evaluation result to the second security domain.

a receiving module, configured to receive a result of the re-evaluation sent from the first security domain;

And a control module, configured to perform corresponding control on access of the terminal according to the result of the re-evaluation. Compared with the prior art, the embodiment of the invention has the following advantages:

By re-evaluating the terminal after accessing the RSD-segment time, the security state of the terminal entering the network is guaranteed to meet the security policy requirements of the current network during the entire connection process of the terminal, and does not pose a certain threat to the security of the network. In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor.

1 is a flow chart of a method for reassessing a safety state according to a first embodiment of the present invention; FIG. 2 is a flow chart of a method for reassessing a safety state according to a second embodiment of the present invention; An execution flow chart of the initial evaluation of the proposed RSD to the terminal requesting access to the network;

4 is a flowchart of execution of re-evaluation of a terminal by an RSD according to Embodiment 2 of the present invention; FIG. 5 is a flowchart of execution of re-evaluation of a terminal by another RSD according to Embodiment 2 of the present invention;

6 is a flow chart showing an execution process of another RSD for re-evaluating a terminal according to Embodiment 2 of the present invention;

7 is a system structural diagram of a safety state re-evaluation according to Embodiment 3 of the present invention; FIG. 8 is a structural diagram of a safety state re-evaluation apparatus according to Embodiment 4 of the present invention; A device structure diagram for re-evaluation of a safety state is proposed. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

A method for re-evaluating a security state according to the first embodiment of the present invention, as shown in FIG. 1, may include:

Step S101: Perform re-evaluation on the terminal accessing the second security domain.

Step S102: Send the re-evaluation result to the second security domain.

Specifically, after the re-evaluation result is sent to the second security domain, the second security domain The re-evaluation result can also be received, and corresponding access to the terminal is controlled according to the re-evaluation result. Further, the method may further include:

Step S103: The second security domain receives the re-evaluation result, and performs corresponding control on the access of the terminal according to the re-evaluation result.

From a security perspective, all systems in a network are actually composed of multiple security domains, each of which is referred to as a domain. The second security domain and the first security domain may be a security domain or a server in the network, and may be an authentication server or an evaluation server. In all embodiments of the present invention, the second security domain relies on the security domain RSD. For example, the first security domain takes the assertion of the security domain ASD as an example. The terminal can be a smart terminal, a mobile phone, a PDA (Personal Digital Assistant, a personal data processor), a normal PC (personal computer), a notebook, and an AP (Access Point) support TNC (Trusted Network Connect, Trusted Network Connection) Evaluated device.

The re-evaluation of the trigger condition of the terminal that is communicating across the domain may include: the ASD transmitting an assertion trigger condition of the terminal security status re-evaluation result to the RSD; and/or the RSD transmitting the re-evaluation request or the subscription re-evaluation result information to the ASD of the terminal Trigger condition. The assertion triggering condition for the ASD to send the terminal security state re-evaluation result to the RSD includes: the configuration of the security policy of the terminal ASD is changed, and the security policy configuration of the terminal ASD needs to periodically perform security state evaluation on the terminal, and the terminal Requesting the ASD to re-evaluate one or more of the security status assessments of the terminal. The triggering condition for the RSD to send the re-evaluation request or the subscription re-evaluation result information to the ASD of the terminal includes: the RSD discovers that the suspicious behavior of the terminal occurs, the security policy of the RSD itself changes, and the terminal is required to re-evaluate, The RSD subscribes to the ASD for information about the terminal security status re-evaluation result, and requests the ASD to send the evaluation result information to the RSD in time, or to specify one of a fixed re-evaluation period, once the evaluation result changes. Or several.

The appropriate control of the terminal according to the result of the re-evaluation includes: if the security status of the terminal is only partially complying with the security policy requirements of the second security domain, The terminal can only partially access the second security domain, and the result of the re-evaluation indicates that the security state of the terminal completely meets the second security domain policy requirement, and the second security domain continues to maintain communication with the terminal. And changing the access status of the terminal to fully access the second security domain; or

If the security status of the terminal fully meets the security policy requirements of the second security domain, the re-evaluation result indicates that the security status of the terminal only partially meets the requirements of the second security domain, The second security domain allows the terminal to access to continue to maintain communication with the terminal, and the access at this time is to partially access the second security domain;

If the security status of the terminal is in compliance with the security policy requirements of the second security domain, the re-evaluation result indicates that the security status of the terminal does not meet the security policy requirements of the second security domain. The second security domain terminates all connections with the terminal; or

The second security domain performs role mapping on the terminal that is allowed to access according to the re-evaluation result of the terminal, and maps the terminal that does not belong to the second security domain to the terminal in the second security domain.

^Mountain

3⁄4.

It can be seen that, in the embodiment of the present invention, the re-evaluation of the terminal after accessing the RSD-time period ensures that the security state of the terminal entering the network always meets the security policy requirements of the current network during the entire connection process of the terminal, and does not Security poses a certain threat.

A method for re-evaluating the security state according to the second embodiment of the present invention, as shown in FIG. 2, includes: Step S201: The RSD performs an initial evaluation when the terminal requests to access the network, and determines whether the security state assertion provided by the ASD satisfies the RSD. The security policy requires that when the security state assertion provided by the ASD meets the RSD security policy requirements, after completing the initial evaluation of the terminal requesting access to the network and establishing communication between the terminal and the RSD, the ASD sends the terminal security state to the RSD. When the assertion of the evaluation result is made, go to step S202, when the RSD sends the re-evaluation request or the subscription re-evaluation result information to the ASD of the terminal, go to step S203, when the security state assertion provided by the ASD fails to meet the RSD security policy requirement, Go to step S204.

Step S202, after the terminal completes the initial evaluation and establishes communication with the RSD for a period of time,

The ASD sends an assertion of the terminal security status re-evaluation result to the RSD, and the RSD will promptly enter the terminal. The line is reassessed and the appropriate control of the terminal is adjusted in time based on the results of the reassessment. The terminal and

The communication between the RSDs is specifically cross-domain communication, specifically the cross-domain communication between the ASD domain and the RSD domain.

Specifically, after the RSD completes the initial evaluation of the terminal and starts communication with the terminal, the ASD of the provider of the security state assertion of the terminal sends an assertion of the re-evaluation result of the terminal security state to the RSD, and the RSD adjusts according to the result. Appropriate control of the terminal. In addition, the ASD of the security state asserted by the terminal may also send an assertion of the security status re-evaluation result to the terminal, so that the terminal forwards the assertion of the security status re-evaluation result to the RSD, and the RSD adjusts according to the result. Appropriate control of the terminal.

The trigger condition of the assertion of the security state of the terminal asserting the ASD of the provider to the RSD to send the terminal security state re-evaluation result includes, but is not limited to, the following scenario, the configuration of the security policy of the terminal ASD is changed, or the security policy configuration of the terminal ASD is configured. It is required to periodically perform a security status assessment on the terminal, or the terminal requests the ASD to re-evaluate its security status. Driven by the above trigger conditions, ASD will re-evaluate the security status of the terminal and generate a corresponding re-evaluation result, and will actively send the result of the re-evaluation to the RSD.

Step S203, after the initial evaluation of the terminal is completed, and the communication is established with the RSD for a period of time, when the RSD sends a re-evaluation request or a subscription re-evaluation result information to the ASD of the terminal, the ASD is required to re-evaluate the security state of the terminal and send a heavy weight for the terminal. When the evaluation result is asserted, the RSD can re-evaluate the terminal in time, and adjust the appropriate control of the terminal in time according to the result of the re-evaluation.

Specifically, after the RSD completes the initial evaluation of the terminal and starts communication with the terminal, the RSD sends a re-evaluation request or a subscription re-evaluation result information to the ASD of the terminal, and requires the ASD to re-evaluate the terminal security status and send the terminal to the terminal. When asserting the results of the evaluation, the RSD can adjust the appropriate control of the terminal in time based on the result.

The RSD sends a re-evaluation request to the terminal's ASD or subscribes to the re-evaluation result information, requesting

ASD re-evaluates the terminal security status and sends an assertion trigger for the terminal re-evaluation result The conditions include, but are not limited to, the following scenarios: RSD finds that the terminal has some suspicious behavior, or the RSD's own security policy changes, requires re-evaluation of the terminal, or RSD subscribes to the ASD for information about the terminal security status re-evaluation result. ASD is required to send this information to the RSD in a timely manner as soon as its evaluation results change, or to specify a fixed reassessment period or frequency.

In the above steps S202 and S203, there is no sequential relationship, but the object for transmitting the re-evaluation request is different. In step S202, the access request is specifically an assertion that the ASD sends the terminal security state re-evaluation result to the RSD. In step S203, the service request is specifically, the RSD sends a re-evaluation request or a subscription re-evaluation result information to the ASD of the terminal. In this embodiment, the network for re-evaluation includes, but is not limited to, a fixed network, a wireless network, and other converged networks.

Step S204: When the security state assertion provided by the ASD does not meet the RSD security policy requirement, the RSD does not directly respond to the denial of access, but requests other security state assertions to the ASD, and the RSD is re-established according to the ASD. Other security state assertions provided respond to requests from the terminal.

Specifically, in step S201, the execution process of the initial evaluation when the RSD requests the terminal to access the network is as shown in FIG. 3, and includes:

Step S301: The terminal initiates an access request to the server of the RSD.

Step S302, the RSD determines the ASD of the provider of the terminal security state assertion, and sends a terminal security state assertion request to the ASD.

The security state assertion refers to a statement of terminal security status information, security evaluation results, and security event metadata associated with the terminal, and based on the security status assertion, it can be determined whether the terminal is secure.

Step S303: After receiving the terminal assertion request of the RSD, the ASD identifies which terminal the assertion request corresponds to, and responds to the security state assertion of the terminal requested by the RSD.

Step S304, the RSD asserts the security status sent by the ASD of the terminal according to the security status of the terminal.

Step S305, according to the foregoing evaluation result, the RSD makes a response whether to allow the terminal to access. Step S306, the initial evaluation process is completed, and the terminal that allows access can establish a connection with the RSD to communicate.

When the security state assertion provided by the terminal's ASD does not meet the RSD requirements, the RSD can re-request new or other types of security state assertions. The reassessment at this time can be determined by pre-negotiating between ASD and RSD, requiring ASD to provide up-to-date or specific security status assertion related information to complete the initial evaluation process.

Specifically, in step S202, the RSD re-evaluates the terminal in time, and adjusts the appropriate control to the terminal according to the result of the re-evaluation. The execution process is as shown in FIG. 4, and the process includes: Step S401, the terminal initial The evaluation is completed and communication begins with the RSD.

Specifically, the RSD completes an initial security state assessment for requesting access by the terminal, and the terminal can communicate with the RSD for the terminal that is allowed to access. For the terminal that is allowed to access the RSD, the RSD may be completely allowed to access, and the terminal may access all resources in the RSD, or may partially allow access, gP, and the terminal may only access some resources in the RSD. . If the security status of the terminal is in full compliance with the RSD policy, the terminal is allowed to access the RSD. If the security status of the terminal meets the RSD policy requirements, the RSD may only allow the terminal to access the terminal.

Step S402: After the terminal accesses the RSD and communicates with the RSD for a period of time, the terminal may initiate a re-evaluation request to the ASD, requesting the ASD to perform a re-evaluation process on the terminal.

Specifically, when the ASD security policy of the terminal changes, or the policy of the terminal ASD requires periodic re-evaluation of the terminal, or the ASD receives the re-evaluation request sent by the terminal, the ASD performs security status on the terminal. Re-evaluation of information and corresponding re-evaluation results.

Step S403, the ASD sends the current re-evaluation result assertion to the RSD.

In addition, the ASD can also assert the current re-evaluation result to the terminal, causing the terminal to forward the assertion of the security status re-evaluation result to the RSD.

Step S404, the RSD adjusts the appropriate control to the terminal in time according to the re-evaluation result. Specifically, when the re-evaluation result sent by the ASD is to allow access, the terminal and the RSD can be continued. The communication between the terminal and the RSD can also be ended when the terminal security state assertion cannot satisfy the requirements of the RSD. When the RSD requirements are not met, the RSD can re-request new or other types of security state assertions.

According to the re-evaluation results sent by ASD, timely adjustment of appropriate controls for the terminal includes but is not limited to:

If the security status of the terminal is only partially compliant with the RSD security policy, the terminal can only partially access the RSD, and the result of the re-evaluation shows that the security status of the terminal fully complies with the RSD policy requirements, then the RSD will continue to be maintained. Communicate with the terminal, and change the access status of the terminal to fully access the RSD, and enjoy all the services of the RSD;

If the initial access evaluation, the security status of the terminal fully complies with the RSD security policy requirements, and the re-evaluation result shows that the security status of the terminal only partially meets the RSD requirements, and the RSD also allows the terminal access to continue to maintain communication with the terminal, but at this time Access can only be part of the access, then RSD will limit some services of the terminal;

If the initial access evaluation is performed, the security status of the terminal fully complies with the RSD security policy requirements, and the re-evaluation result indicates that the terminal security status no longer meets the RSD security policy requirements. At this time, the RSD will abort all current connections with the terminal. Serve it; in this case, RSD may divide the terminal into a certain isolation area, and may also notify ASD to fix it.

In addition, the RSD can perform role mapping on the terminal that is allowed to access according to the result of the terminal re-evaluation, and map the terminal that is not originally its own to the terminal in the RSD domain, so that the terminal can access all the network resources corresponding to the roles in the domain. .

Specifically, in step S203, the RSD re-evaluates the terminal in time, and adjusts the execution process of the appropriate control to the terminal according to the result of the re-evaluation. As shown in FIG. 5, the method includes the following steps: Step S501: Initial evaluation of the terminal is completed. , and start communication with the RSD.

Specifically, the RSD completes an initial security state assessment for requesting access by the terminal, and the terminal can communicate with the RSD for the terminal that is allowed to access. For a terminal that allows access to the RSD, the RSD may be completely allowed to access, and the terminal may access all resources in the RSD. It can be partially allowed access, gP, and the terminal can only access some resources in the RSD. If the security status of the terminal fully complies with the policy requirements of the RSD, the terminal is allowed to access the RSD completely. If the security status of the terminal meets the requirements of the RSD policy, the RSD may only allow the terminal to access.

Step S502: After the terminal accesses the RSD and communicates with the RSD for a period of time, the RSD sends a re-evaluation request to the ASD, requesting the ASD to send the re-evaluation result for the terminal to the RSD.

Specifically, the RSD finds that the terminal has some suspicious behavior, or the RSD's own security policy changes, and requires the terminal to be re-evaluated. At this time, the RSD sends a re-evaluation request to the ASD, requesting the ASD to re-evaluate the terminal. It is sent to the RSD. In addition, the RSD can also actively subscribe to the ASD for information about the terminal security status re-evaluation result. The ASD requests the RSD to send this information to the RSD in time, or to specify a fixed re-evaluation period or frequency.

Step S503, the ASD performs re-evaluation of the security status information on the terminal, and generates a corresponding re-evaluation result.

Step S504, the ASD sends the current re-evaluation result assertion to the RSD. In addition, the ASD can also assert the current re-evaluation result to the terminal, causing the terminal to forward the assertion of the security status re-evaluation result to the RSD.

Step S505: The RSD adjusts the appropriate control to the terminal in time according to the re-evaluation result sent by the ASD.

Specifically, when the re-evaluation result sent by the ASD is to allow access, the communication between the terminal and the RSD can be continued. When the terminal security state assertion cannot satisfy the RSD requirement, the communication between the terminal and the RSD can also be ended. When the RSD requirements are not met, the RSD can re-request new or other types of security state assertions.

According to the re-evaluation results sent by ASD, timely adjustment of appropriate control for the terminal includes but is not limited to: If the initial access evaluation, the security status of the terminal only partially meets the requirements of the RSD security policy, the terminal can only partially access the RSD. The result of the reassessment shows that the security status of the terminal is in full compliance with the RSD policy requirements, then the RSD will continue to maintain communication with the terminal and connect the terminal. Into the state of the full access to the RSD, you can enjoy all the services of the RSD;

Specifically, in step S204, the RSD does not directly reject the access response, and the execution process of requesting other security state assertions to the ASD is as shown in FIG. 6, and includes:

Step S601: The terminal initiates an access request to the server of the RSD.

Step S602, the RSD determines the ASD of the provider of the terminal security state assertion, and sends a terminal security state assertion request to the ASD.

Step S603: After receiving the terminal assertion request of the RSD, the ASD identifies which terminal the assertion request corresponds to, and responds to the security state assertion of the terminal requested by the RSD.

Step S604, the RSD asserts the security status sent by the ASD of the terminal according to the security status of the terminal, and determines that the security status assertion of the terminal does not satisfy the security policy requirement of the RSD.

Step S605: The RSD sends an assertion request of the other security state of the terminal to the ASD of the provider of the terminal security state assertion.

Step S606, after receiving the assertion request of the other security state of the RSD, the ASD responds to the other security state assertion of the terminal requested by the RSD. Step S607, according to the result of the re-evaluation, the RSD makes a response whether to allow the terminal to access.

Step S608, the re-evaluation process is completed, and the terminal that is allowed to access can establish a connection with the RSD to communicate.

When the other security state assertions provided by the terminal's ASD still fail to meet the RSD requirements, the terminal's access request may be denied.

In the foregoing embodiment, the two network devices may be applicable to the same terminal. The two network devices may belong to different security domains (or belong to the same security domain, or belong to different networks or the same network) to the same terminal. Proper control through safety status assessment. This embodiment is also applicable to appropriate control of terminal security state evaluation by various networks such as enterprise networks, telecommunication networks, and mobile networks. In all embodiments of the present invention, the terminal does not have to access two different security domains, but may be shared security assessment information between the same network, the same security domain, or different networks.

It can be seen that, in this embodiment, by re-evaluating the terminal after accessing the RSD-time, the security state of the terminal entering the network is ensured to meet the security policy requirements of the current network in the whole connection process of the terminal, and the network security is not Cause a certain threat. Moreover, when the ASD of the terminal does not satisfy the RSD requirement when the initial security state assertion is satisfied, the RSD can re-request other assertions, thereby improving the efficiency of the network.

A system for re-evaluating a security state according to Embodiment 3 of the present invention, as shown in FIG. 7, includes:

The ASD 71 is configured to re-evaluate the terminal 73 accessing the RSD 72, and send the result of the re-evaluation to the RSD 72;

The RSD 72 is configured to perform corresponding control of the access of the terminal 73 based on the result of the re-evaluation sent by the ASD 71.

The terminal 73 is configured to communicate with the RSD 72, and the terminal 73 is a device supporting a trusted network connection evaluation, and the type includes a smart terminal, a mobile phone, a personal data processor, a personal computer, a notebook, and an access point. Or several.

It can be seen that, in the embodiment of the present invention, by re-evaluating the terminal after accessing the RSD-time, Ensure that the security status of the terminal entering the network always meets the security policy requirements of the current network during the entire connection process of the terminal, and does not pose a certain threat to the security of the network.

A device for re-evaluating a security state according to the fourth embodiment of the present invention, the network device being deployed in the first security domain, as shown in FIG. 8, comprising:

a re-evaluation module 81, configured to re-evaluate a terminal accessing the RSD;

a sending module 82, configured to send the result of the re-evaluation by the re-evaluation module 81 to the RSD, so that the

The RSD makes appropriate control over the access of the terminal.

Further, the re-evaluation module 81 includes:

The receiving unit 811 is configured to receive a re-evaluation request initiated by the terminal, to perform a re-evaluation process on the terminal.

The sending unit 812 is configured to send an assertion of the terminal security state re-evaluation result to the RSD after the receiving unit 811 performs the re-evaluation process on the terminal. The triggering condition of the assertion of the re-evaluation result includes a change in the configuration of the security policy of the terminal ASD; the security policy configuration of the terminal ASD requires periodic assessment of the security status of the terminal; The terminal performs one or more of the security status assessments.

A device for re-evaluating a security state according to the fifth embodiment of the present invention, the device is RSD 9, and the network device is deployed in the second security domain, as shown in FIG. 9, including:

The receiving module 91 is configured to receive a result of the re-evaluation from the ASD transmission;

The control module 92 is configured to perform appropriate control on the access of the terminal according to the result of the re-evaluation received by the receiving module 91.

Further, the device further includes:

The sending module 93 is configured to send a re-evaluation request or a subscription re-evaluation result information to the ASD of the terminal, the re-evaluation request or the subscription re-evaluation result information. The trigger condition includes the RSD discovery The suspicious behavior of the terminal occurs; the security policy of the RSD itself is changed, and the terminal is required to be re-evaluated; the RSD subscribes to the ASD for information about the re-evaluation result of the security status of the terminal, and the requirement is as described above. The evaluation result changes, and the ASD sends the evaluation result information to the RSD in time, or specifies one or several of the fixed re-evaluation periods.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by hardware, or can be implemented by means of software plus a necessary general hardware platform. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (which may be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including several The instructions are for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention.

The above description is only a preferred embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. The scope of protection of the invention should be considered.

Claims

Claim

A method for re-evaluating a security state, wherein the terminal in the first security domain accesses the second security domain, including:

Re-evaluating the terminal accessing the second security domain;

Transmitting the re-evaluation result to the second security domain.

2. The method according to claim 1, wherein the re-evaluating the terminal accessing the second security domain comprises:

The terminal that accesses the second security domain is re-evaluated according to the trigger condition that the first security domain of the terminal is configured to change.

3. The method according to claim 1, wherein the re-evaluating the terminal accessing the second security domain comprises:

According to the security policy configuration of the first security domain of the terminal, a trigger condition for periodically performing security state assessment on the terminal is required, and the terminal accessing the second security domain is re-evaluated.

4. The method according to claim 1, wherein the re-evaluating the terminal accessing the second security domain comprises:

The terminal accessing the second security domain is re-evaluated according to the trigger condition that the terminal requests the first security domain to re-evaluate the security state of the terminal.

The method according to claim 1, wherein the re-evaluating the terminal accessing the second security domain comprises:

And determining, according to the second security domain, that the terminal triggers a suspicious behavior, and re-evaluating the terminal accessing the second security domain.

6. The method according to claim 1, wherein the re-evaluating the terminal accessing the second security domain comprises:

According to the change of the security policy of the second security domain itself, a trigger condition for re-evaluating the terminal is required, and the terminal accessing the second security domain is re-evaluated.

7. The method of claim 1, wherein the pair accesses the second security domain The terminal performs a reassessment including:

Subscribing, according to the second security domain, the first security domain to the terminal security state re-evaluation result information, requesting that the first security domain sends the second security domain to the second security domain in time after the evaluation result changes The evaluation result information, or a trigger condition for specifying a fixed re-evaluation period, is re-evaluated to the terminal accessing the second security domain.

The method according to claim 1, wherein after the re-evaluating the terminal accessing the second security domain, the method further includes:

The second security domain receives the re-evaluation result, and performs corresponding control on the access of the terminal according to the re-evaluation result.

9. The method of claim 8, wherein the controlling the access to the terminal comprises:

If the security status of the terminal is only partially complying with the security policy requirements of the second security domain, the terminal can only partially access the second security domain, and the result of the re-evaluation shows the terminal. The security status is in full compliance with the second security domain policy requirement, the second security domain continues to maintain communication with the terminal, and the access status of the terminal is changed to fully access the second security domain; or

If the security status of the terminal fully meets the security policy requirements of the second security domain, the re-evaluation result indicates that the security status of the terminal only partially meets the requirements of the second security domain, The second security domain allows the terminal to access to continue to maintain communication with the terminal, and the access at this time is to partially access the second security domain; or

If the security status of the terminal is in compliance with the security policy requirements of the second security domain, the re-evaluation result indicates that the security status of the terminal does not meet the security policy requirements of the second security domain. The second security domain terminates all connections with the terminal; or the second security domain performs role mapping on the terminal that is allowed to access according to the terminal re-evaluation result, and does not belong to the second security domain. The terminal is mapped to a terminal in the second security domain, and the terminal is allowed to access the corresponding resource.

The method according to claim 1, wherein before the re-evaluating the terminal accessing the second security domain, the method further includes:

The second security domain performs an initial evaluation when the terminal requests access to the network;

Determining whether the security status assertion provided by the first security domain satisfies the security policy requirement of the second security domain;

When the security status assertion provided by the first security domain does not satisfy the security policy requirement of the second security domain, the re-evaluation is performed according to other security state assertions provided by the first security domain.

Receiving, by the first security domain, the re-evaluation request initiated by the terminal, to perform a re-evaluation process on the terminal;

The first security domain asserts the result of the re-evaluation to the second security domain.

The second security domain sends a re-evaluation request to the first security domain, so that the first security domain performs re-evaluation of the security status information on the terminal to generate a re-evaluation result;

The second security domain receives a re-evaluation result assertion generated by the first security domain.

13. The method according to claim 1, wherein the transmitting the re-evaluation result to the second security domain comprises:

Transmitting, by the first security domain, the result of the re-evaluation directly to the second security domain; and/or

The first security domain sends the result of the re-evaluation to the terminal, so that the terminal forwards the result of the re-evaluation to the second security domain.

14. A network system, comprising:

a first security domain, configured to re-evaluate a terminal accessing the second security domain, and send the re-evaluation result to the second security domain; And a second security domain, configured to perform corresponding control on access to the terminal according to the re-evaluation result.

15. The system of claim 14, further comprising:

And a terminal, configured to communicate with the second security domain, where the terminal is a device supporting a trusted network connection evaluation, and the type includes a smart terminal, or a mobile phone, or a personal data processor, or a personal computer, or a notebook.

A network device, wherein the network device is deployed in the first security domain, and includes:

The apparatus according to claim 16, wherein the re-evaluation module comprises: a receiving unit, configured to receive a re-evaluation request initiated by the terminal, to perform a re-evaluation process on the terminal;

And a sending unit, configured to send an assertion of the terminal security state re-evaluation result to the second security domain after performing the re-evaluation process.

18. A network device, wherein the network device is deployed in a second security domain, and includes:

a receiving module, configured to receive a re-evaluation result sent by the first security domain;

And a control module, configured to perform corresponding control on the access of the terminal according to the re-evaluation result.

The device of claim 18, further comprising:

a sending module, configured to send a re-evaluation request or a subscription re-evaluation to the first security domain of the terminal