Service hiding architecture based on zero-trust model and implementation method

Abstract

The invention relates to the technical field of information security, in particular to a service hiding architecture based on a zero-trust model and an implementation method.The service hiding architecture comprises a zero-trust security control center and a zero-trust security agent component, and the zero-trust security control center is arranged on the inner side of the zero-trust security agent component; all synchronous execution protocols of communication before SDP knock are changed into asynchronous execution protocols, only an access subject is allowed to send a UDP and forward the UDP to a zero-trust security control center through a zero-trust security agent component, and the zero-trust security control center returns a response result to the access subject through other security channels such as emails and short messages. According to the service hiding architecture based on the zero-trust model and the implementation method, the zero-trust security control center is deployed on the inner side of the zero-trust security agent component, so that the risk exposure surface of a zero-trust system is reduced; the thought of replacing a traditional TCP with an asynchronous UDP protocol is adopted, it is guaranteed that an access subject cannot establish TCP connection before authentication is passed through the protocol design, and the network attack difficulty is greatly improved.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a zero-trust model-based service hiding architecture and an implementation method. Background technique [0002] Zero trust is a new security protection concept for the digital age, a network security paradigm centered on resource protection, and dynamic access control centered on identity. Zero trust processes data access and authentication verification between the access subject and the access object, and it decomposes the general access behavior into a control plane for network communication control and a data plane for application communication. The access subject initiates an access request through the control plane, implements identity authentication through the trust evaluation engine and access control engine, and obtains permission before accessing the business application, thereby establishing a credible and secure access link. [0003] Zero trust products...

AI Technical Summary

Problems solved by technology

Most of the traditional network attacks are based on the TCP protocol, and SDP controllers and PDPs have become clear attack targets.

Images