CN102571703A - Security control system and security control method for cloud data - Google Patents

Abstract

The invention provides a security control system for cloud data. The security control system is applied to a private cloud server. Enterprise internal customer premises equipment accesses the private cloud server through an internal network; the private cloud server is used for storing private cloud data; and each internal customer premises equipment is provided with a global positioning system. The security control system can be used for carrying out multiple validation on the client by combining with current longitude and latitude attribute coordinate information and other permission control. If anyone validation of the customer premises equipment is failed, the security control system for the cloud data refuses an access request of the client equipment. If the current longitude and latitude attribute coordinate information and the other permission control information of the customer premises equipment respectively pass the validation, the security control system for the cloud data allows the customer premises equipment to access the private cloud data. The invention also provides a security control method for the cloud data.

Description

Cloud data security management and control system and method

technical field

The present invention relates to a data security management and control system and method, in particular to a cloud data security management and control system and method.

Background technique

Cloud computing is an Internet-based computing method in which software and hardware resources and data can be shared between network devices. The so-called cloud computing environment is actually a metaphor for the network environment. In a cloud computing environment, operators store hardware and software resources and data in servers, and users can obtain information through browsers or other network services. According to the setting of usage rights, the cloud computing environment can be divided into public cloud and private cloud. Public cloud refers to the provision of scalable and elastic services to external customers of the enterprise through the network, and such services may be free or low-cost. The private cloud, on the other hand, serves internal customers of the enterprise, and is mostly used within the enterprise, and is generally built behind the firewall of the enterprise.

Most of the information stored in the private cloud involves corporate secrets, such as internal personnel relations, sales data, financial statements, and customer information. Therefore, the security management and control of private cloud is extremely important. At present, the private cloud built behind the firewall of the enterprise generally uses the user IP address or user account and password to control the access authority of the information provided by the private cloud. Its disadvantage is that intruders may break through the security line of the firewall by disguising the IP address, account and password of legitimate users.

Contents of the invention

In view of the above, it is necessary to provide a cloud data security management and control system and method, which can strengthen the security management and control of the private cloud, and more effectively prevent intruder attacks.

A cloud data security management and control system is applied to a private cloud server. Client devices within an enterprise access the private cloud server through an internal network. The private cloud server stores private cloud data, and the client devices within each enterprise are installed with a global positioning system. The cloud data security management and control system includes: a setting module, a storage module, a receiving module and a verification module. The setting module is used to set the latitude and longitude coordinate range of the internal client equipment having access authority to the private cloud data. The storage module is used to store the set latitude and longitude coordinate range to the private cloud server. The receiving module is used for receiving a request from a client device to access private cloud data. The verification module is used to check whether the verification information of the client device to access private cloud data is legal, including whether the current latitude and longitude coordinates of the client device fall within the set latitude and longitude coordinate range, whether the IP address, account number and password of the client device are The IP address, account number and password assigned to the internal client device by the private cloud server. If any of the verification information is illegal, the verification module rejects the client device to access the private cloud data; if all the verification information is legal, the verification module judges that the client device is an internal client device and allows the client device Access private cloud data.

A cloud data security management and control method is applied to a private cloud server. An enterprise internal client accesses the private cloud server through an internal network. The private cloud server stores private cloud data, and each enterprise internal client device is equipped with a global positioning system. The method includes: (A) setting the latitude and longitude coordinate range of the internal client device with access authority to the private cloud data; (B) storing the set latitude and longitude coordinate range to the private cloud server; (C) receiving a client device to access the private request for cloud data; (D) check whether the verification information of the client device to access the private cloud data is legal, including whether the current latitude and longitude coordinates of the client device fall within the set latitude and longitude coordinate range, the IP address of the client device, Whether the account number and password are the IP address, account number and password assigned by the private cloud server to the internal client; and (E) if any of the verification information is illegal, the client device is denied access to the private cloud data. If the information is legal, it is judged that the client device is an internal client device of the enterprise, and the client device is allowed to access the private cloud data.

Compared with the prior art, the cloud data security management and control system and method provided by the present invention combine the current latitude and longitude coordinate information of the client device requesting access to private cloud data and other authority control data to perform multiple verifications on the client device, which strengthens the private cloud data. Cloud security management and control can more effectively prevent intruder attacks.

Description of drawings

Fig. 1 is an application environment diagram of a preferred embodiment of the cloud data security management and control system of the present invention.

Fig. 2 is a functional block diagram of a preferred embodiment of the cloud data security management and control system of the present invention.

Fig. 3 is a flow chart of a preferred embodiment of the cloud data security management and control method of the present invention.

FIG. 4 is a schematic diagram of the latitude and longitude coordinates of legal client terminals of the private cloud displayed on the electronic map.

Description of main component symbols

Private cloud server 10 internal client device 20 Firewall 30 External network 40 external client device 50 Cloud data security management and control system 100 set module 110 storage module 120 Receive module 130 Validation module 140 memory 150 Processor 160 digital map 170

Detailed ways

Referring to FIG. 1 , it is an application environment diagram of a preferred embodiment of the cloud data security management and control system 100 of the present invention. The cloud data security management and control system 100 is applied to a private cloud server 10 . The private cloud server 10 is used to store private cloud data, such as enterprise internal information such as personnel relations, salary structure, sales data, financial statements, and customer information. The private cloud server 10 is installed behind the firewall 30 , and the enterprise's internal client equipment 20 accesses the private cloud data stored in the private cloud server 10 through the internal network. The firewall 30 is used to defend against the attacks launched by the external client equipment 50 to the private cloud through the external network 40 .

The private cloud server 10 is also used to assign an IP address to each internal client device 20, access the account number and password of the private cloud data, and set the internal client device 20 to have different levels of security for the private cloud data according to the IP address or account number and password. access permission.

Wherein, each enterprise's internal client device 20 is equipped with a global positioning system (global positioning system, GPS), which is used to locate the latitude and longitude coordinates of each internal client device 20's current location. When the private cloud server 10 receives an access request from a client (internal client or external client) device, it combines the current latitude and longitude coordinate information of the client and other authority control data (such as IP address, user account number and password, etc.) The client performs multi-factor authentication. If any verification of the client fails, the private cloud server 10 rejects the access request of the client device. If the current latitude and longitude coordinate information of the client device and other authority control materials pass the verification, the private cloud server 10 allows the client device to access the private cloud data.

Referring to FIG. 2 , it is a functional block diagram of a preferred embodiment of the cloud data security management and control system 100 of the present invention. The cloud data security management and control system 100 includes a setting module 110 , a storage module 120 , a receiving module 130 and a verification module 140 . The programmed codes of the modules 110 to 140 are stored in the memory 150 of the private cloud server 10 , and the processor 160 of the private cloud server 10 executes these programmed codes to realize the above-mentioned functions provided by the cloud data security management and control system 100 . The private cloud server 10 also stores an electronic map 170, which can display the latitude and longitude coordinate information of the geographic location.

The setting module 110 is used to set the latitude and longitude coordinate range of the internal client device 20 having access authority to the private cloud data. For setting the latitude and longitude coordinate range, reference may be made to the latitude and longitude coordinate information of the covered area of the building (such as factory building, office building, etc.) of the enterprise using the private cloud displayed on the electronic map 170 . As shown in FIG. 4 , the building coverage of the enterprise "H company" using the private cloud displayed on the electronic map 170 is a quadrilateral area composed of four location points "A, B, C, and D". The latitude and longitude coordinates of the end device 20 all fall within the latitude and longitude coordinate range covered by the quadrangular area. The setting module 110 is also used to set the internal client device 20 to have different levels of access rights to the private cloud data.

The storage module 120 is used to store the set latitude and longitude coordinate ranges and different levels of access rights in the memory 150 .

The receiving module 130 is configured to receive a request from a client device to access private cloud data.

The verification module 140 is used to check whether the verification information of the client device to access the private cloud data is legal, including whether the current latitude and longitude coordinates of the client device fall within the set latitude and longitude coordinate range, the IP address, account number and password of the client device Whether it is the IP address, account number and password allocated by the private cloud server 10 to the internal client device 20 . If any verification information is illegal, the verification module 140 refuses the client device to access the private cloud data; if all verification information is legal, the verification module 140 judges that the client device is the client device 20 inside the enterprise, and allows the client device The client device accesses the corresponding private cloud data.

The verification module 140 can first check the current latitude and longitude coordinate information of the client device, if the current latitude and longitude coordinates fall within the set latitude and longitude coordinate range, then check the IP address of the client device, if the IP address is also legal, further request the The client user enters the account number and password for verification. Verification module 140 can also first check whether the IP address of the client device is legal, and then check whether the current latitude and longitude coordinate information of the client device falls within the set latitude and longitude coordinate range, if the current latitude and longitude coordinate falls within the set latitude and longitude coordinate range , and further require the client device to enter an account number and password for verification.

Fig. 3 is a flow chart of a preferred embodiment of the cloud data security management and control method of the present invention. It should be noted that the execution order of the steps in FIG. 3 can be changed, for example, the order of verifying the current latitude and longitude coordinates, IP address, account number and password of the client device requesting to access the private cloud data can be adjusted.

Step S301, installing a global positioning system (global positioning system, GPS) on all internal client devices 20 having access rights to private cloud data.

Step S303 , the setting module 110 sets the latitude and longitude coordinate range of the client device with access to the private cloud data, and the storage module 120 stores the set latitude and longitude coordinate range into the memory 150 . For setting the latitude and longitude coordinate range, reference may be made to the latitude and longitude coordinate information of the covered area of the building (such as factory building, office building, etc.) of the enterprise using the private cloud displayed on the electronic map 170 . As shown in FIG. 4 , the building coverage of the enterprise "H company" using the private cloud displayed on the electronic map 170 is a quadrilateral area composed of four location points "A, B, C, and D". The latitude and longitude coordinates of the end device 20 all fall within the latitude and longitude coordinate range covered by the quadrangular area.

In step S305, the receiving module 130 receives a request from a client device to access private cloud data.

In step S307, the verification module 140 requests the client device to send current latitude and longitude coordinate information.

In step S309, the verification module 140 checks whether the current latitude and longitude coordinate information sent by the client device is received. If the current latitude and longitude coordinate information sent by the client device has not been received, the process enters step S311, and the verification module 140 judges that the client device is not the client device 20 within the enterprise, and refuses the client device to access the private cloud server 10. private cloud data. After that the process ends. If the verification module 140 receives the current latitude and longitude coordinate information sent by the client device, the flow goes to step S313.

In step S313, the verification module 140 checks whether the current latitude and longitude coordinate information of the client device falls within the set latitude and longitude coordinate range. If the current latitude and longitude coordinate information of the client device falls outside the set latitude and longitude coordinate range, the flow goes to step S311. If the current latitude and longitude coordinate information of the client device falls within the set latitude and longitude coordinate range, the process enters step S315.

Step S315, the verification module 140 checks whether other verification information of the client device is legal, such as whether the IP address, account number and password of the client device are the IP address, account number and password assigned to the internal client device 20 by the private cloud server 10 . If any other verification information is invalid, for example, the IP address is invalid, or the account number and password are invalid, the flow goes to step S311. If all other verification information is legal, the process proceeds to step S317, and the verification module 140 judges that the client device is an internal client device 20 of the enterprise, and allows the client device to access the private cloud server 10 according to the access authority of the internal client device 20 The corresponding private cloud data stored.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention without limitation. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be Modifications or equivalent replacements can be made without departing from the spirit and scope of the technical solutions of the present invention.

Claims (10)

1. A cloud data security management and control system, which is applied to a private cloud server, and an enterprise internal client device accesses the private cloud server through an internal network, and the private cloud server stores private cloud data, and is characterized in that each enterprise internal client device Installed with a global positioning system, the cloud data security management and control system includes: The setting module is used to set the longitude and latitude coordinate range of the internal client device with access authority to the private cloud data; The storage module is used to store the set latitude and longitude coordinate range to the private cloud server; A receiving module, configured to receive a request from a client device to access private cloud data; The verification module is used to check whether the verification information of the client device to access the private cloud data is legal, including whether the current latitude and longitude coordinates of the client device fall within the set latitude and longitude coordinate range, the IP address, account number and password of the client device Whether it is the IP address, account number and password assigned by the private cloud server to the internal client device. If any of the verification information is invalid, the client device will be denied access to the private cloud data. If all the verification information is legal, the The client device is the client device inside the enterprise, and the client device is allowed to access the private cloud data. 2. The cloud data security management and control system according to claim 1, wherein the private cloud server also stores an electronic map, and the setting module sets the latitude and longitude coordinate range with reference to the enterprise using the private cloud displayed on the electronic map The latitude and longitude coordinate information of the area covered by the building. 3. The cloud data security management and control system according to claim 1, wherein the setting module is also used to set the internal client devices to have different levels of access rights to the private cloud data. 4. The cloud data security management and control system according to claim 1, wherein the verification module first checks the current latitude and longitude coordinate information of the client device, and if the current latitude and longitude coordinates fall within the set latitude and longitude coordinate range, then Check the IP address of the client device, and if the IP address is legal, then further require the client device to input an account number and password for verification. 5. The cloud data security management and control system as claimed in claim 1, wherein the verification module first checks whether the IP address of the client device is legal, and if the IP address is legal, then checks the current latitude and longitude coordinates of the client device Whether the information falls within the set latitude and longitude coordinate range, if the current latitude and longitude coordinate falls within the set latitude and longitude coordinate range, then further require the client device to enter an account number and password for verification. 6. A cloud data security management and control method, applied to a private cloud server, the enterprise internal client accesses the private cloud server through the internal network, the private cloud server stores private cloud data, and is characterized in that each enterprise internal client device is installed With GPS, the method includes: Set the latitude and longitude coordinate range of internal client devices that have access to private cloud data; Store the set latitude and longitude coordinate range to the private cloud server; Receive a request from a client device to access private cloud data; Check whether the verification information of the client device to access private cloud data is legal, including whether the current latitude and longitude coordinates of the client device fall within the set latitude and longitude coordinate range, and whether the IP address, account number and password of the client device are private cloud server The IP address, account number and password assigned to the internal client device; If any of the verification information is invalid, the client device is denied access to the private cloud data. If all the verification information is legal, the client device is judged to be an internal client device of the enterprise, and the client device is allowed to access the private cloud data. . 7. The cloud data security management and control method as claimed in claim 6, wherein the private cloud server also stores an electronic map, and the latitude and longitude coordinate range is set to be covered by the buildings of the enterprise using the private cloud displayed on the reference electronic map The longitude and latitude coordinate information of the range. 8. The cloud data security management and control method according to claim 6, characterized in that the method further comprises the step of setting internal client devices to have different levels of access rights to private cloud data. 9. The cloud data security control method according to claim 6, wherein the method first checks the current latitude and longitude coordinate information of the client device, and if the current latitude and longitude coordinates fall within the set latitude and longitude coordinate range, then checks the latitude and longitude coordinates. The IP address of the client device, if the IP address is legal, then further request the client device to enter an account number and password for verification. 10. The cloud data security control method according to claim 6, wherein the method first checks whether the IP address of the client device is legal, and if the IP address is legal, then checks whether the current latitude and longitude coordinate information of the client device is falls within the set latitude and longitude coordinate range, if the current latitude and longitude coordinate falls within the set latitude and longitude coordinate range, the client device is further required to enter an account number and password for verification.

Images