Resource access control method based on zero-trust single packet authentication and authorization

Abstract

The invention belongs to the field of information security, and particularly relates to a zero-trust single packet authentication and authorization-based resource access control method, which comprises the following steps that: terminal equipment initiates an access request to a zero-trust gateway; the zero-trust gateway verifies the request information sent by the terminal equipment, and if the verification is passed, the key center generates a session key and a public key and a private key of the terminal equipment; the terminal equipment generates single packet information that a user accesses the zero-trust gateway, and encrypts the single packet information by using the session key; calculating a message digest of the single packet information, signing the encrypted single packet information and digest information by using a private key, and sending all information to a zero-trust gateway; the zero-trust gateway verifies the signature information, the encryption information and the summary information, if verification is passed, a consistent port is opened for the terminal equipment, and the terminal equipment is allowed to temporarily access the server; by adopting the method described by the invention, the hiding of the service port is realized, the network attack surface is reduced, and the network security is improved.

Description

technical field [0001] The invention belongs to the field of information security, and in particular relates to a resource access control method based on zero-trust single-package authentication and authorization. Background technique [0002] The traditional boundary-based network verifies the user's identity at the network boundary by means of "connect first, then authenticate" to determine whether the user is trustworthy. If the user can be authenticated, the user can move laterally within the network. In traditional networks, the internal network is secure by default, and network security is considered border security. Therefore, security devices such as firewalls and WAFs are deployed to protect network borders. With the continuous development of emerging technologies such as big data and mobile Internet, network boundaries are gradually becoming blurred, and the defects of traditional network security protection models are becoming more and more obvious. For example,...

AI Technical Summary

Problems solved by technology

For example, firewalls in traditional networks need to configure relevant access policies to explicitly allow terminal devices to access corresponding service resources. Although access control policies can be refined to reduce the exposure of service resources, there are still many network security threats

Images