It should be understood that authentication request is a request sent to the network control device in the case that the business system receives the resource access request sent by the target object through the terminal device, and it is determined that the target resource to be accessed by the target object belongs to the resource of the target type according to the resource access request. This authentication request is used to request the network control device to determine whether the target object is allowed to access the target resource.

The resource belonging to the target type represents that the resource belongs to sensitive resources in the business system, and the target object requires a higher level of security when accessing the resource. Therefore, in the case that the target resource to be accessed by the target object belongs to the resource of the target type, the network control device needs to evaluate whether there is a risk for the target object to access the target resource in the current security status. For other resources in the business system that do not belong to the target type, the business system can control access to the target object through a data access strategy. For example, the data access strategy includes a resource that the target object is able to access and a resource that the target object is unable to access.

It is worth noting that the relevant meanings of the security status information will be illustrated in detail in subsequent embodiments.

In the step 220, acquiring historical resource access information and historical security status information of the target object from the business system according to the identity information of the target object, in response to the authentication request.

Here, the network control device accesses the business system in respond to the authentication request sent by the business system, and acquires the historical resource access information and the historical security status information that match the identity information of the target object from the business system.

The historical resource access information refers to the information of the resource that the target object has accessed during historical time, such as the information of the resource of the business system that the target object has recently accessed. For example, every time the target object accesses a resource in the business system, the business system may record the target object's access time, geographical location, name information of the accessed resource, and operation behavior for the resource, and form the historical resource access information. It should be understood that the operation behavior for the resource may include viewing, modifying, sending to the outside network, and other behavior.

The historical security status information refers to the security status information of the target object when accessing the business system during historical time. For example, every time the target object accesses a resource in the business system, the resource access request sent by the target object may carry the security status information of the target object. When the business system receives the resource access request, the business system records the security status information carried by the resource access request, and forms the historical security status information. The security status information may include the identity information of the target object and network security information used to represent the security status of the network environment where the target object is located. The network security information may include at least one of the device information of the terminal device corresponding to the target object, software environment information, and geographic location information. The device information may refer to the IP (Internet Protocol) address, MAC (Media Access Control) address and other information of the terminal device. The software environment information may refer to the information used to represent the security status of the network environment when the terminal device accesses the business system. For example, the software environment information may include applications installed on the terminal device, the port opened by the terminal device, the used network type, and so on. The software environment information can be used to determine whether the terminal device is in a secure status when accessing the business system. For example, in the case that the applications installed on the terminal device include a risky application, it indicates that the terminal device is in an unsafe state. In the case that the applications installed on the terminal device does not include an antivirus application, it indicates that the terminal device is in an unsafe state. For example, in the case that a risky port is opened on the terminal device, it indicates that the terminal device is in an unsafe state. For example, in the case that the network type used by the terminal device is a public network, it indicates that the terminal device is in an unsafe state.

In some embodiments, the network control device may read the historical resource access information and the historical security status information of the target object from a log database of the business system. The business system may store the resource access information and the security status information of the target object every time when the target object accesses the business system in a log database in the form of logs, and form the historical resource access information and the historical security status information. When the network control device receives the authentication request, the network control device responds to the authentication request and reads log data that matches the identity information of the target object from the business system's log database, and obtains the historical resource access information and the historical security status information of the target object.

In the step 230, determining access permission information of the target object for the target resource according to the historical resource access information and the historical security status information.

Here, after acquiring the historical resource access information and the historical security status information of the target object from the business system, the network control device determines whether the target object is able to access the target resource and obtains the access permission information, according to the historical resource access information and the historical security status information.

In some embodiments, it is possible to determine that the target object is able to access the target resource in the case that the historical resource access information and the historical security status information respectively match the resource access information and security status information required to access the target resource.

For example, in the case that the historical resource access information of the target object indicates that the target object has visited a risky website in the past, the target object cannot access the target resource. For another example, in the case that the historical security status information of the target object indicates that the terminal device of the target object has installed a risky application, the target object cannot access the target resource.

In other embodiments, the historical resource access information and the historical security status information may be input into an access strategy model to obtain the access permission information output by the access strategy model.

The access strategy model may be obtained by training a neural network model using sample resource access information marked with access permission information and sample security status information.

It is worth noting that for different resources belonging to the target type in the business system, the historical resource access information and the historical security status information required to access the resources may be different. For example, for the most sensitive resources or resources that can only be accessed with the highest permission in the business system, it is necessary to ensure that the target object is at the highest security level to access the resource, in this case, the historical resource access information and the historical security status information of the target object need to meet higher requirements.

In the step 240, sending the access permission information to the business system, in which the access permission information is used to enable the business system to determine an operation for the resource access request according to the access permission information.

Here, after obtaining the access permission information, the network control device can send the access permission information to the business system through the communication connection with the business system, so that the business system can determine the operation for the resource access request according to the access permission information. The operation for the resource access request may be to determine whether the target object is allowed to access the target resource and/or whether higher-level authentication is required for the target object.

For example, in the case that the access permission information represents that the target object is not allowed to access the target resource, the business system blocks the resource access request of the target object to the target resource. In the case that the access permission information represents that the target object is allowed to access the target resource, the business system releases the resource access request of the target object to enable the target object to access the target resource. In the case that the access permission information represents that it requires higher-level authentication for the target object, the business system sends an identity authentication request to the terminal device of the target object to enable the target object to perform the higher-level identity authentication.

Taking the VPN single sign on scenario as an example, after receiving a resource access request from the target object, the VPN business system sends an authentication request to the network control device in the case that the business system determines that the target resource to be accessed by the resource access request belongs to the resource of the target type, to obtain the access permission information sent by the network control device in response to the authentication request. In the case that the access permission information represents that the target object is not allowed to access the target resource, the VPN business system blocks the forwarding of the target resource to prevent the target object from accessing the target resource. In the case that the access permission information represents that the target object is allowed to access the target resource, the VPN business system forwards the target resource to the terminal device of the target object, so that the target object can access the target resource.

Therefore, by responding to the authentication request sent by the business system, the historical resource access information and the historical security status information of the target object are acquired from the business system according to the identity information of the target object, and the access permission information of the target object for the target resource is determined according to the historical resource access information and the historical security status information, and then the access permission information is sent to the business system, to enable the business system to determine the operation for the resource access request according to the access permission information, so as to dynamically determine the permission of the target object to access the target resource belonging to the target type, and in the case that the real-time security status of the terminal device does not support the target object to access the target resource, the target object is prohibited to access the target resource to protect the business system from damage. Moreover, through the above-mentioned resource access control method, it is possible to prohibit the target object from accessing the target resource in the case that the security status information of the terminal device does not support the target object to access the target resource, without affecting the working performance of the business system.

In some embodiments, the network control device may store the access permission information in a disposal log database to enable traceability according to the data in the disposal log database during a subsequent traceability audit process.

In some embodiments, determining a target risk item triggered by the target object, according to the historical resource access information and the historical security status information and in conjunction with a preset mapping relationship, in which the mapping relationship includes a corresponding relationship between different combinations of the historical resource access information and the historical security status information, and different risk items; and determining the access permission information of the target object for the target resource according to the target risk item.

Here, the mapping relationship refers to the corresponding relationship between different risk items and different combinations of the historical resource access information and the historical security status information. A plurality of corresponding relationships may be stored in advance in the network control device to determine whether there is a risk when the target object accesses the business system.

For example, the historical resource access information includes access time of the resource, geographic location, name information of the accessed resource, and operation behavior for the resource. The security status information may include the identity information of the target object and the network security information used to represent the security status of the network environment where the target object is located. In the case that the geographic location information in the historical resource access information represents that the geographic location of the target object when requesting access to the target resource is not a commonly used location for the target object to access the business system, a geographic location change risk item is triggered. Correspondingly, the access permission information corresponding to the geographic location change risk item may be multi-authentication of the target object, and after the multi-authentication is passed, access to the target resource is allowed.

For another example, in the case that the historical security status information of the target object represents that the target object is about to resign, and the historical resource access information of the target object represents that the target object has more than a preset number of data sending out events, a data sending out risk item is triggered. Correspondingly, the access permission information corresponding to the data sending out risk item may be to prohibit the target object from accessing the target resource.

For another example, in the case that the historical security status information of the target object represents that the terminal device requesting access to the target resource changes compared to the terminal device previously accessing the business system, and the historical security status information represents that the target object has opened a risky port that has remote login permission, weak code, and the like, a device security risk item is triggered. Correspondingly, the access permission information corresponding to the device security risk item may be to prohibit the target object from accessing the target resource and/or to prohibit the target object from accessing the business system.

It is worth noting that the mapping relationship is a calculation rule used to determine whether there is a risk item in the historical resource access information and the historical security status information. If it is determined that the target object has not triggered any risk items according to all mapping relationships, the target object can be allowed to access the target resource.

It should be understood that the historical security status information may reflect the changes in security status information of the terminal device during a historical period. For example, the historical security status information may be used to determine whether the terminal device used by the target object to access the business system has changed, whether the network environment has changed, and so on. The historical resource access information may reflect the changes in the behavior habits of the target object accessing the resource in the business system during a historical period. For example, through the historical resource access information, it is possible to determine whether the type of the resource accessed by the target object has changed, and whether the operation behavior for the resource has changed. By combining the historical resource access information and the historical security status information with the mapping relationship, the behavior of the target object's historical access to the business system can be analyzed to dynamically adjust the access permission of the target object to sensitive resources in the business system according to the changes in behavior, thereby protecting sensitive resources in the business system from damage.

FIG. 3 is a flowchart of a resource access control method provided by another exemplary embodiment. As shown in FIG. 3, in some embodiments, the resource access control method may include the following steps.

In the step 310, in the case that security status information of the target object accessing the business system changes, determining a data access strategy of the target object according to the security status information, in which the data access strategy includes a resource that the target object is able to access and a resource that the target object is unable to access.

Here, in the case that the security status information of the target object accessing the business system changes, the network control device re-determines the data access strategy of the target object according to the latest security status information of the target object, and the data access strategy includes the resource that the target object is able to access and the resource that the target object is unable to access.

It should be understood that the data access strategy refers to the access permissions for resources in the business system that do not belong to the target type when the target object accesses the business system. For example, the data access strategy may include a first resource set that the target object is unable to access and a second resource set that the target object is able to access. The resources included in the first resource set and the second resource set may be all other resources that the business system can provide that do not belong to the target type.

Each target object has a default data access strategy, which may be an initial data access strategy configured for the target object according to the own permission level of the target object. In the case that the target object first accesses the business system, the business system provides resources that the target object can access to the target object according to the default data access strategy. In the case that the security status information of the target object changes, the network control device recalculates the data access strategy of the target object according to the security status information of the target object, and allows the business system to adjust the access permission of the target system to resources in the business system according to the recalculated data access strategy.

It is worth noting that determining the data access strategy of the target object according to the security status information may be calculating the security level of the terminal device according to the security status information, and determining the data access strategy according to the security level. For example, under the first security status information, the first security status information corresponds to the first security level, and under the identity level of the target object and the first security level, the target object can access a resource A, a resource B, a resource C, a resource D, and a resource E. In the case that the security level of the target object is changed to the second security level, as the second security level is lower than the first security level and the second security level cannot reach the minimum security level required to access the resource D and the resource E, the target object can access the resource A, the resource B, and the resource C under the identity level of the target object and the second security level.

In some embodiments, the network control device may receive an information change event sent by a security information data source, in which the information change event is sent by the security information data source to the network control device when the security information data source detects a change in the security status information of the target object.

The information change event is used to notify the network control device that the security status information of the target object accessing the business system has changed. For example, every time the target object accesses the business system, the security information data source records the latest security status information of the target object, and generates an information change event when the latest security status information changes from the last recorded security status information. The network control device subscribes to the information change event, and in the case that the information change event is detected, the network control device determines that the security status information of the target object accessing the business system has changed, and begins to recalculate the data access strategy of the target object for the business system according to the latest security status information of the target object.

It is worth noting that the security information data source may be set in the business system. For example, every time the business system receives a resource access request from the terminal device, the business system records the security status information carried in the resource access request through the security information data source. Of course, the security information data sources may also be set in the network control device. For example, the network control device may store the security status information of the target object, and a manager or the terminal device can update the security status information of the target object stored in the network control device.

In the step 320, sending the data access strategy to the business system, in which the data access strategy is used to enable the business system to determine access permissions of the target object for resources in the business system other than the resource of the target type according to the data access strategy.

Here, after obtaining the data access strategy, the network control device sends the data access strategy to the business system, so that the business system can adjust the access permissions of the target object for the business system according to the data access strategy. For example, for resources that the target object can access, the business system allows the target object to access, and for resources that the target object cannot access, the business system refuses the target object to access.

It is worth noting that the data access strategy is aimed at access permissions of the resources in the business system other than the resource of the target type. In the case that the target object needs to access the resource belonging to the target type in the business system, the access permission of the target object for the resource belonging to the target type may be determined according to the above-mentioned steps 210 to 240.

In some embodiments, the network control device may create a permission change task and save the permission change task in a task queue, execute the permission change task in the task queue, and store the data access strategy in a data access table, in which the data access table is used for the business system to obtain the data access strategy from the data access table.

The network control device responds to the information change event, determines the data access strategy according to the security status information, creates the permission change task, and submits the permission change task to the task queue. Then, the network control device executes the permission change task in the task queue and stores the corresponding data access strategy in the data access table. The data access table is used for the business system to obtain the data access strategy from the data access table. For example, the business system may periodically obtain the data access strategy from the data access table and update the data access strategy in the business system.

It is worth noting that the permission change task in the task queue will only be completed after the corresponding data access strategy is successfully obtained by the business system. If the data access strategy has not been successfully obtained by the business system, the permission change task in the task queue will not be completed, and the permission change task may be executed multiple times to ensure that the data access strategy can be successfully obtained by the business system.

It should be understood that the above-mentioned data access strategy may be used to control the access permissions of the target object for the resources in the business system other than the target resource, and may also be used to control the access permission of the target resource, which may be set as needed in practical applications.

Therefore, in the case that the security status information of the target object changes, the data access strategy of the target object is determined according to the security status information of the target object, and the data access strategy is sent to the business system, which allows the business system to adjust the access permission of the target object for the business system according to the data access strategy, so that the business system does not need to evaluate every access of the target object, instead, the business system directly determines the resource access permission of the target object according to the data access strategy, without affecting the working performance of the business system; especially for a high traffic business system, if every access of the target object is evaluated, it will reduce the working performance of the business system. Moreover, the process of determining the data access strategy is placed in the network control device, so that the permission change behavior of the target object will not invade the functions of the business system, thereby ensuring the normal operation of the business system.

In some embodiments, the network control device may obtain permission change information according to the data access strategy, and send the permission change information to the business system. The permission change information is used to enable the business system to send the permission change information to the terminal device of the target object through a long connection channel between the business system and the terminal device, to display the permission change information on the terminal device.

Here, the network control device may generate the permission change information according to the data access strategy after obtaining the data access strategy. The permission change information is used to represent that the resource access permission of the target object for the business system has changed. For example, in the case that the data access strategy represents that the access permission of the target object for the business system is downgraded, the permission change information indicating that the access permission of the target object for the business system has been downgraded may be generated.

After generating the permission change information, the network control device sends the permission change information to the business system. The business system receives the permission change information and sends the permission change information to the terminal device through a long connection channel with the terminal device of the target object, to display the permission change information on the terminal device and enable the target object to eliminate the risk information according to the permission change information.

The long connection channel may refer to the long connection between the terminal device and the business system through WebSocket (a protocol for full duplex communication over a single TCP (Transmission Control Protocol) connection).

For example, the network control device may save the permission change information in the message queue, and the message queue is used for the business system to obtain the permission change information from the message queue.

It is worth noting that after obtaining the permission change information from the message queue, the business system sends the permission change information to the terminal device through WebSocket. The terminal device then displays the received WebSocket message on the client as a reminder or a notification to remind the target object to repair the existing risks.

It should be understood that in the case that the target object has repaired the existing risks, the security status information of the target object will change. Correspondingly, the network control device will update the data access strategy of the target object in the business system, so that the target object can restore access to the business system.

Therefore, by sending the permission change information to the business system, the target object can perceive the access permission change according to the permission change information and guide the target object to repair the existing risk items.

FIG. 4 is a flowchart of a resource access control method provided by another exemplary embodiment. As shown in FIG. 4, the resource access control method provided by the embodiments of the present disclosure may be applied to the business system 102 shown in FIG. 1. As shown in FIG. 4, the resource access control method may include the following steps.

In the step 410, receiving a resource access request sent by a target object, in which the resource access request is used to request access to a target resource;

Here, the business system receives the resource access request sent by the target object to the business system through the communication connection with the terminal device. This resource access request is used to request access to the target resource in the business system.

It is worth noting that a detailed illustration of the resource access request may refer to the above-mentioned embodiments, which will not be repeated here.

In the step 420, in the case that the target resource belongs to a resource of a target type, sending an authentication request to a network control device in response to the resource access request sent by the target object, in which the authentication request includes identity information of the target object and the target resource to be accessed by the target object, and the authentication request is used to enable the network control device to acquire historical resource access information and historical security status information of the target object from the business system according to the identity information of the target object, determine access permission information of the target object for the target resource according to the historical resource access information and the historical security status information, and send the access permission information to the business system.

Here, the business system receives the resource access request sent by the target object, and sends the authentication request to the network control device through the communication connection with the network control device in response to the resource access request, in the case that it is determined that the target resource to be accessed by the target object belongs to the resources of the target type. The authentication request may include the identity information of the target object and the target resource to be accessed by the target object. The target object refers to the account logged in to the terminal device, and the identity information of the target object may refer to the target object's account, password, verification code, or other information used for identity verification. Of course, the identity information may also refer to facial information, fingerprint information, or other biometric features used for identity verification. The target resource to be accessed by the target object refers to a specific resource in the business system that the target object needs to access for the resource access request sent this time. For example, the target resource may refer to a certain resource in the application system, or may refer to a network resource such as VPN, Wi-Fi, and so on.

It should be understood that authentication request is a request sent to the network control device in the case that the business system receives the resource access request sent by the target object through the terminal device, and it is determined that the target resource to be accessed by the target object belongs to the resource of the target type according to the resource access request. This authentication request is used to request the network control device to determine whether the target object is allowed to access the target resource.

The resource belonging to the target type represents that the resource belongs to sensitive resources in the business system, and the target object requires a higher level of security when accessing the resource. Therefore, in the case that the target resource to be accessed by the target object belongs to the resource of the target type, the network control device needs to evaluate whether there is a risk for the target object to access the target resource in the current security status. For other resources in the business system that do not belong to the target type, the business system can control access to the target object through a data access strategy. For example, the data access strategy includes a resource that the target object is able to access and a resource that the target object is unable to access.

It is worth noting that details on how the network control device obtains the access permission information in response to the authentication request may be referred to the related descriptions of the above-mentioned embodiments, which will not be repeated here.

In the step 430, upon receiving the access permission information sent by a network security device, determining an operation for the resource access request according to the access permission information.

Here, the business system receives the access permission information sent by the network control device, and upon receiving the access permission information sent by the network security device, determines the operation for the resource access request according to the access permission information.

For example, in the case that the access permission information represents that the target object is not allowed to access the target resource, the business system blocks the resource access request of the target object to the target resource. In the case that the access permission information represents that the target object is allowed to access the target resource, the business system releases the resource access request of the target object to enable the target object to access the target resource. In the case that the access permission information represents that it requires higher-level authentication for the target object, the business system sends an identity authentication request to the terminal device of the target object to enable the target object to perform the higher-level identity authentication.

Therefore, by sending the authentication request to the network control device and receiving the access permission information sent by the network control device in response to the authentication request, and determining the operation for the resource access request according to the access permission information, it is possible to dynamically determine the access permission of the target object to the target resource when the security status of the terminal device changes, so that in the case that the real-time security status of the terminal device does not support the target object to access the target resource, the target object is prohibited to access the target resource, to protect the business system from damage. Moreover, through the above-mentioned resource access control method, it is possible to prohibit the target object from accessing the target resource in the case that the real-time security status of the terminal device does not support the target object to access the target resource, without affecting the working performance of the business system.

In some embodiments, the business system may also determine the access permissions of the target object for resources in the business system other than the resource of the target type according to the data access strategy, in the case that the business system receives the data access strategy from the network control device.

Here, the data access strategy refers to the access permissions for resources in the business system that do not belong to the target type when the target object accesses the business system. For example, the data access strategy may include a first resource set that the target object is unable to access and a second resource set that the target object is able to access. The resources included in the first resource set and the second resource set may be all other resources that the business system can provide that do not belong to the target type.

The data access strategy is aimed at access permissions of other resources in the business system except for the resource of the target type. In the case that the target object needs to access the resource belonging to the target type in the business system, the business system can determine the access permission of the target object for the resource belonging to the target type according to the above-mentioned steps 410 to 430.

The data access strategy is determined by the network control device according to the security status information of the target object accessing the business system in the case that the security status information of the target object changes, and the data access strategy includes a resource that the target object is able to access and a resource that the target object is unable to access.

It is worth noting that regarding how to determine the data access strategy and how to receive the data access strategy, the above embodiments may be referred to, which will not be repeated here.

Therefore, through the data access strategy, the business system does not need to evaluate every access of the target object, instead, the business system directly determines the resource access permission of the target object according to the data access strategy, without affecting the working performance of the business system; especially for a high traffic business system, if every access of the target object is evaluated, it will reduce the working performance of the business system. Moreover, the process of determining the data access strategy is placed in the network control device, so that the permission change behavior of the target object will not invade the functions of the business system, thereby ensuring the normal operation of the business system.

In some embodiments, in the case that the business system receives the permission change information sent by the network control device, the business system can send the permission change information to the terminal device through a long connection channel with the terminal device of the target object to display the permission change information on the terminal device. The permission change information is generated by the network control device according to the data access strategy, and the permission change information is used to represent that the resource access permission of the target object for the business system has changed.

Here, the relevant descriptions of the generation process of the permission change information, how the business system obtains the permission change information, and how the business system sends the permission change information to the terminal device may be referred to the above-mentioned embodiments, which will not be repeated here.

Therefore, through the permission change information, the target object can perceive the access permission change according to the permission change information, and guide the target object to repair existing risk items.

FIG. 5 is a flowchart of a resource access control method provided by another exemplary embodiment. As shown in FIG. 5, the resource control method may include the following steps.

- S501, a terminal device sends a resource access request to a business system;
- S502, the business system receives the resource access request;
- S503, the business system sends an authentication request to a network control device;
- S504, the network control device receives the authentication request;
- S505, the network control device requests historical resource access information and historical security status information of the target object from the business system;
- S506, the business system sends the historical resource access information and the historical security status information of the target object to the network control device;
- S507, the network control device receives the historical resource access information and the historical security status information of the target object;
- S508, the network control device determines access permission information according to the historical resource access information and the historical security status information;
- S509, the network control device sends the access permission information to the business system;
- and S510, the business system receives the access permission information.

It is worth noting that the specific implementation processes of S501 to S510 may refer to the relevant descriptions of the above-mentioned embodiments, which will not be illustrated in detail here.

FIG. 6 is a schematic structural diagram of a resource access control apparatus provided by an exemplary embodiment. As shown in FIG. 6, the embodiments of the present disclosure provide a resource access control apparatus, which is applied to a network control device, and the resource access control apparatus 600 includes:

- a first receiving module 601, configured to receive an authentication request sent by a business system, in which the authentication request is sent by the business system in the case that the business system determines a target resource to be accessed by a target object belonging to a resource of a target type according to a resource access request sent by the target object, and the authentication request includes identity information of the target object and the target resource to be accessed by the target object;
- an acquisition module 602, configured to acquire historical resource access information and historical security status information of the target object from the business system according to the identity information of the target object, in response to the authentication request;
- a determination module 603, configured to determine access permission information of the target object for the target resource according to the historical resource access information and the historical security status information;
- and a first sending module 604, configured to send the access permission information to the business system, in which the access permission information is used to enable the business system to determine an operation for the resource access request according to the access permission information.

Optionally, the determination module 603 is specifically configured to:

- determine a target risk item triggered by the target object, according to the historical resource access information and the historical security status information and in conjunction with a preset mapping relationship, in which the mapping relationship includes a corresponding relationship between different combinations of the historical resource access information and the historical security status information, and different risk items;
- and determine the access permission information of the target object for the target resource according to the target risk item.

Optionally, the apparatus 600 further includes:

- a strategy adjusting module, configured to, in the case that the security status information of the target object accessing the business system changes, determine a data access strategy of the target object according to the security status information, in which the data access strategy includes a resource that the target object is able to access and a resource that the target object is unable to access;
- and a strategy sending module, configured to send the data access strategy to the business system, in which the data access strategy is used to enable the business system to determine access permissions of the target object for resources in the business system other than the resource of the target type according to the data access strategy.

Optionally, the apparatus 600 further includes:

- an information generating module, configured to obtain permission change information according to the data access strategy in which the permission change information is used to represent that a resource access permission of the target object for the business system has been changed;
- and an information sending module, configured to send the permission change information to the business system, in which the permission change information is used to enable the business system to send the permission change information to a terminal device of the target object through a long connection channel between the business system and the terminal device, to display the permission change information on the terminal device.

The logic executed by each functional module in the resource access apparatus 600 in the above-mentioned embodiment has been illustrated in detail in the method embodiments section, which will not be repeated here.

FIG. 7 is a structural schematic diagram of a resource access control apparatus provided by another exemplary embodiment. As shown in FIG. 7, the embodiments of the present disclosure provide a resource access control apparatus, which is applied to a business system, and the resource access control apparatus 700 includes:

- a second receiving module 701, configured to receive a resource access request sent by a target object, in which the resource access request is used to request access to a target resource;
- a second sending module 702, configured to send an authentication request to a network control device in the case that the target resource belongs to a resource of a target type, in which the authentication request includes identity information of the target object and the target resource to be accessed by the target object, and the authentication request is used to enable the network control device to acquire historical resource access information and historical security status information of the target object from the business system according to the identity information of the target object, determine access permission information of the target object for the target resource according to the historical resource access information and the historical security status information, and send the access permission information to the business system;
- and a third receiving module 703, configured to determine an operation for the resource access request according to the access permission information upon receiving the access permission information sent by a network security device.

Optionally, the apparatus 700 further includes:

- a strategy receiving module, configured to, upon receiving a data access strategy of the target object sent by the network control device, determine access permissions of the target object for resources in the business system other than the resource of the target type according to the data access strategy.

The data access strategy is determined by the network control device according to security status information of the target object accessing the business system in the case that the security status information of the target object changes, and the data access strategy includes a resource that the target object is able to access and a resource that the target object is unable to access.

Optionally, the apparatus 700 further includes:

- an information receiving module, configured to, upon receiving the permission change information sent by the network control device, send the permission change information to a terminal device of the target object through a long connection channel with the terminal device to display the permission change information on the terminal device, in which the permission change information is generated by the network control device according to the data access strategy, and the permission change information is used to represent that a resource access permission of the target object for the business system has been changed.

The logic executed by each functional module in the resource access apparatus 700 in the above-mentioned embodiment has been illustrated in detail in the method embodiments section, which will not be repeated here.

Referring to FIG. 8, FIG. 8 illustrates a schematic structural diagram of an electronic device 800 (e.g., the business system 102 or the network control device 103 in FIG. 1) suitable for implementing the embodiments of the present disclosure. The electronic devices in the embodiments of the present disclosure may include but are not limited to mobile terminals such as a mobile phone, a notebook computer, a digital broadcasting receiver, a personal digital assistant (PDA), a portable Android device (PAD), a portable media player (PMP), a vehicle-mounted terminal (e.g., a vehicle-mounted navigation terminal), or the like, and fixed terminals such as a digital TV, a desktop computer, or the like. The electronic device illustrated in FIG. 8 is merely an example, and should not pose any limitation to the functions and the range of use of the embodiments of the present disclosure.

As illustrated in FIG. 8, the electronic device 800 may include a processing apparatus 801 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various suitable actions and processing according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage apparatus 808 into a random-access memory (RAM) 803. The RAM 803 further stores various programs and data required for operations of the electronic device 800. The processing apparatus 801, the ROM 802, and the RAM 803 are interconnected by means of a bus 804. An input/output (I/O) interface 805 is also connected to the bus 804.

Usually, the following apparatuses may be connected to the I/O interface 805: an input apparatus 806 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, or the like; an output apparatus 807 including, for example, a liquid crystal display (LCD), a loudspeaker, a vibrator, or the like; a storage apparatus