Intranet and extranet terminal access method, device, platform, equipment and medium

Abstract

The embodiment of the invention provides an internal and external network terminal access method, device, platform, equipment and medium, the internal and external network access platform is deployed with a software-defined boundary architecture, the software-defined boundary architecture comprises a zero-trust system, and the method comprises the following steps: receiving a communication connection request of an internal and external network terminal through the zero-trust system; in response to the communication connection request, opening an access authority of an internet port to the internal and external network terminals based on the knock packet; establishing communication connection with the intranet and extranet terminal based on the access authority, and receiving an office service access request of the intranet and extranet terminal; and responding to the office service access request, acquiring office data, and returning the office data to the working space domain of the internal and external network terminal. A zero-trust strategy is realized through a software-defined boundary architecture, and an internet exposed surface is converged by utilizing an internet port hiding technology; and safety guarantee of double-domain isolation of personal space and working space is carried out on internal and external network terminals through a zero-trust sandbox, and internal and external network isolation during office and operation and maintenance is realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an access method for internal and external network terminals, an access device for internal and external network terminals, a corresponding internal and external network access platform, a corresponding electronic device, and a corresponding computer-readable storage medium. Background Art

[0002] Remote work is an important working mode that can achieve office convenience.

[0003] However, there is often a contradiction between convenience and security. In order to ensure the operation and efficiency of remote office, most companies conduct remote office through VPN (Virtual Private Network) or the Internet. The diversification of access roles, usage scenarios, complexity of access environment and complexity of access terminals caused by remote office will lead to the breaking of the boundaries of traditional office networks. Traditional easily identifiable security boundaries do not exist. Due to the absence of security boundaries, the interconnection of data between various links can easily cause problems such as credential loss, abuse of authority or malicious access, leading to data leakage and serious security risks in office networks. Summary of the invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide an access method for internal and external network terminals, an access device for internal and external network terminals, a corresponding internal and external network access platform, a corresponding electronic device and a corresponding computer-readable storage medium that overcome the above problems or at least partially solve the above problems.

[0005] An embodiment of the present invention discloses an access method for an intranet terminal, which relates to an intranet access platform. The intranet access platform is deployed with a software-defined boundary architecture, and the software-defined boundary architecture includes a zero-trust system. The method includes:

[0006] Receiving, through the zero-trust system, a communication connection request from the intranet and extranet terminals, wherein the communication connection includes a knock-on packet;

[0007] In response to the communication connection request, opening access rights of the Internet port to the intranet and extranet terminals based on the knock package;

[0008] Establishing a communication connection with the intranet terminal based on the access permission, and receiving an office business access request from the intranet terminal; wherein the intranet terminal includes a personal space domain and a workspace domain divided based on a zero-trust sandbox;

[0009] Respond to the office service access request, obtain office data, and return the office data to the workspace domain of the intranet and extranet terminals.

[0010] The embodiment of the present invention further discloses an access device for an intranet terminal, which relates to an intranet access platform. The intranet access platform is deployed with a software-defined boundary architecture, and the software-defined boundary architecture includes a zero-trust system. The device includes:

[0011] A communication connection request receiving module, used to receive a communication connection request from the intranet terminal, wherein the communication connection includes a knocking packet;

[0012] An access permission opening module, used for responding to the communication connection request and opening the access permission of the Internet port to the intranet and intranet terminals based on the knock package;

[0013] A business access request receiving module, used to establish a communication connection with the intranet terminal based on the access permission, and receive the office business access request of the intranet terminal; wherein the intranet terminal includes a personal space domain and a workspace domain divided based on a zero-trust sandbox;

[0014] The office data returning module is used to respond to the office service access request, obtain office data, and return the office data to the workspace domain of the intranet and extranet terminals.

[0015] The embodiment of the present invention further discloses an intranet access platform, wherein the intranet access platform is deployed with a software defined boundary architecture, wherein the software defined boundary architecture includes a zero trust system, wherein the zero trust system includes a zero trust controller and a zero trust gateway.

[0016] The zero-trust controller is used to receive a communication connection request from the internal and external network terminal, respond to the communication connection request, open access rights to the Internet port to the internal and external network terminal based on the knock package included in the communication connection, and establish a communication connection with the internal and external network terminal based on the access rights, and receive an office business access request from the internal and external network terminal;

[0017] The zero-trust gateway is used to respond to the office business access request, obtain office data, and return the office data to the workspace domain of the intranet and extranet terminals.

[0018] An embodiment of the present invention further discloses an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, any one of the methods for accessing an internal or external network terminal is implemented.

[0019] The embodiment of the present invention further discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, any one of the methods for accessing an internal or external network terminal is implemented.

[0020] The embodiments of the present invention include the following advantages:

[0021] In an embodiment of the present invention, a communication connection request from an intranet terminal is received through a zero-trust system of an intranet access platform, and based on a knocking package included in the communication connection request, the access rights to the Internet port are opened to the intranet terminal, so as to establish a communication connection between the intranet terminal and the intranet access platform based on the access rights, and obtain office data by responding to office business access requests, and return the obtained office data to the workspace domain of the intranet terminal. The zero-trust strategy is implemented through a software-defined boundary architecture, and the access rights to the Internet port are opened to the intranet terminal based on the knocking package, and then the Internet port hiding technology is used to converge the Internet exposure surface; and the zero-trust sandbox is used to provide security guarantees for the dual-domain isolation of personal space and work space for the intranet terminal, so as to achieve isolation of the intranet during office and operation and maintenance, reduce the risk of the computer being invaded by the intranet after being remotely controlled, and enhance office efficiency based on one-click switching between the intranet and the intranet. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 is a schematic diagram of the architecture of a software-defined edge architecture provided by an embodiment of the present invention;

[0023] Figure 2 It is a flowchart of the steps of an embodiment of a method for accessing an internal and external network terminal of the present invention;

[0024] Figure 3 is a schematic diagram of converging Internet exposure surfaces provided by an embodiment of the present invention;

[0025] FIG. 4A to FIG. 4B is a schematic diagram of security code distribution provided by an embodiment of the present invention;

[0026] FIG. 5A to FIG. 5B is another schematic diagram of distributing security codes provided by an embodiment of the present invention;

[0027] Figure 6 is a schematic diagram of data transmission in a secure tunnel provided by an embodiment of the present invention;

[0028] FIG. 7A to FIG. 7B is a schematic diagram of establishing a communication connection provided by an embodiment of the present invention;

[0029] FIG. 8A to FIG. 8B is a schematic diagram of establishing another communication connection provided by an embodiment of the present invention;

[0030] FIG. 9A to FIG. 9Bis a schematic diagram of establishing another communication connection provided by an embodiment of the present invention;

[0031] Fig.10 is a schematic diagram of sandbox isolation provided by an embodiment of the present invention;

[0032] Fig.11 It is a structural block diagram of an embodiment of an access device for an intranet and extranet terminal of the present invention. DETAILED DESCRIPTION

[0033] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0034] To facilitate those skilled in the art to understand the present invention, the following explains the terms or nouns involved in the following embodiments of the present invention:

[0035] Zero Trust Architecture: No user, device, or network traffic is trusted by default, whether from the internal or external network. Instead, all access requests must go through a strict authentication and authorization process.

[0036] BYOD: Bring Your Own Device, refers to a policy in which some companies allow employees to bring their own laptops, tablets, smartphones and other mobile devices to the office, and use these devices to obtain internal company information and use company-licensed applications.

[0037] SDP: Software Defined Perimeter, software-defined perimeter, is a new generation of network security technology architecture based on zero trust.

[0038] 4A system: refers to an integrated solution for unified identity authentication, authorization, account and audit management.

[0039] IPS: Intrusion Prevention System, an intrusion prevention system, is used to help organizations identify malicious traffic and proactively block such traffic from entering their networks. Specifically, products using IPS technology can be deployed continuously to monitor incoming traffic and check whether the traffic has vulnerabilities and exploitable opportunities. If vulnerabilities and exploitable opportunities are detected, appropriate measures defined in the security policy will be taken, such as blocking access, isolating hosts, or blocking access to external websites that may pose a risk of leakage.

[0040] TCP: Transmission Control Protocol, is a connection-oriented, reliable transmission protocol.

[0041] UDP: User Datagram Protocol, is a connectionless, unreliable transmission protocol.

[0042] Knock Packet: Knock Packet is usually used to describe a specific data packet that is used to trigger certain actions on network devices (such as firewalls or servers). Knock Packet technology is often used to implement the so-called "Port Knocking Protocol", which is a network security technology that unlocks or activates specific network services or ports by sending a series of predefined network data packets (knock packets).

[0043] SDK: Software Development Kit is a set of tools that helps developers create, test, and deploy software applications on a specific platform or service.

[0044] DNS: Domain Name System, is a core service of the Internet. As a distributed database that maps domain names and IP addresses to each other, it enables users to access the Internet more conveniently without having to remember IP address strings that can be directly read by machines.

[0045] DDOS: Distributed Denial of Service is a network attack method whose purpose is to occupy network resources through a large number of legitimate requests, making the target system unable to provide normal services, resulting in service unavailability.

[0046] DCN: Data Communication Network, refers to data communication network, which is a network system used to transmit data between different devices.

[0047] WAF: Web Application Firewall, is a security device or service used to protect web applications from various network attacks.

[0048] SNAT: Source Network Address Translation.

[0049] ACL: Access Control List, access control list.

[0050] Remote work is an important working mode that can achieve office convenience.

[0051] However, the convenience of remote work will bring complexity to secure access and increase security risks.

[0052] As an example, remote work will lead to the diversification of access roles, specifically leading to more diversified user roles accessing the network, including various types of employees, supervisors at all levels, functional personnel, developers, partners, suppliers and other roles. The identities and permissions of various access personnel are different, which also brings greater challenges to enterprise security management. As another example, remote work will lead to the diversification of usage scenarios, specifically leading to the rapid expansion and diversification of usage scenarios, such as various types of remote operation and maintenance guarantees, remote process approval, remote collaborative office, remote development and testing, home seats, etc. The usage scenarios that various user roles need to access are different. For example, suppliers need to access the procurement system, sales personnel need to access the sales management system, financial managers need to access the financial management platform, and developers need to access sensitive code data platform, etc., facing many access personnel and usage scenarios, the difficulty of security management is further increased; as another example, remote work will lead to the complexity of the access environment, specifically the transformation from the original traditional single office environment to an access environment across the country around the clock, no longer restricted by geographical location, it is difficult to ensure the security of the access environment, the network boundaries are more blurred, and new security risks arise; as another example, remote work will lead to the complexity of access terminals, specifically the terminals for accessing the work platform are also more complicated, from the original company's intranet PC and centrally purchased PC to various BYOD personal terminals such as home computers of various employees, a large number of access users, a large number of access terminals, the terminal environment security cannot be effectively guaranteed, which once again greatly increases the security risks.

[0053] The embodiment of the present invention proposes a unified access platform for internal and external networks. The unified access platform for internal and external networks implements a zero-trust strategy by adopting an SDP architecture, performs dual-domain isolation of personal space and workspace through a zero-trust sandbox, and integrates the authentication, organizational structure and authority system of a 4A system through zero-trust to achieve secure access of remote office terminals and mobile office terminals to an office network, solve the problems of diversified access roles, diversified usage scenarios, diversified access environments, and diversified access terminals, so as to converge the exposure of the Internet, realize that the internal network does not leave the computer room, and thereby increase the security of internal and external network terminals accessing the office network.

[0054] Specifically, by adopting Internet port hiding technology, the access rights of Internet ports are opened to internal and external network terminals based on the knocking package, thereby reducing the Internet exposure. By integrating the zero-trust system and the work assistant and using the master-slave APP mode, the work assistant and all APPs inherit the zero-trust SDK to complete the intensive management and control of the APP and eliminate the APP exposure. Moreover, the zero-trust sandbox is used to ensure the security of dual-domain isolation of personal space and work space for internal and external network terminals, and the isolation of internal and external networks during office and operation and maintenance is achieved, reducing the risk of the computer being invaded by the internal network after being remotely controlled, and improving office efficiency based on one-click switching between internal and external networks. In addition, through the zero-trust integration of the 4A system's authentication, organizational structure and permission system, the employee's work number permissions are minimized and controlled, achieving one account, one authentication, and roaming across the entire network, greatly improving the user's login system and operation and maintenance efficiency.

[0055] When opening the access rights of the Internet port, you can integrate multi-factor trusted authentication to ensure the absolute security of the access terminal; you can also use the SDP method, with identity as the center, based on the zero trust concept, and through multi-dimensional dynamic trust authorization. In addition, according to the principle that the intranet does not leave the computer room, all other branch intranets and office intranets can be taken back to the computer room, and you can log in to the zero trust through the Internet and access the intranet after the authentication is passed.

[0056] In the process of intensive management and control, it can be mainly based on the integration of work assistant and zero-trust SDK, which is a unique 1+1+N security protection mode. "1": one APP portal (the work assistant portal integrates all self-used APPs), "1": one self-used system portal (the zero-trust platform portal integrates all self-used systems), "N": N public Internet systems (intensively protected by the WEB dynamic defense system), clearing all self-used exposure surfaces.

[0057] In addition, the zero-trust controller can also adopt a three-cluster mode, with three devices in one cluster, so that in the event of any damage to one cluster, the performance and authorization of the remaining control center devices can still ensure the secure access and stable operation of the terminal users without affecting the normal operation of the business. It should be noted that the internal and external network access platform provided by the embodiment of the present invention has good system adaptability, can adapt to a variety of systems and can be used normally on a variety of systems, has a wide range of usage scenarios, good adaptability, and a high degree of support.

[0058] Reference Figure 1 , showing a schematic diagram of the architecture of the software defined border architecture provided by an embodiment of the present invention. The embodiment of the present invention can implement a zero trust strategy by adopting an SDP architecture, such as Figure 1 The software-defined edge architecture shown is a zero-trust deployment architecture. The aforementioned architecture can be deployed on the intranet and extranet access platforms to achieve unified access of intranet and extranet terminals to the office network.

[0059] The above-mentioned software-defined border architecture may include office network border security protection equipment.

[0060] When internal and external network terminals, such as mobile terminals or PC terminals, access the business systems of the office network, specifically when the mobile terminal accesses through the application or the PC accesses through the Web based on DNS, access control can be performed through the office network boundary security protection device.

[0061] Exemplarily, office network boundary security protection equipment may include firewalls, Internet behavior management, zero-trust systems, national security gateways, terminal anti-virus software and other security components to build an office network security protection system.

[0062] Among them, the zero-trust system can include a zero-trust controller and a zero-trust gateway. The zero-trust system can provide zero-trust services to internal and external network terminals through the aforementioned zero-trust platform including the zero-trust controller and the zero-trust gateway. Figure 1 As shown, the zero-trust controller may include, for example, controller A1, controller A2, controller A3, controller B1, controller B2, controller B3, controller C1, controller C2, controller C3, etc.; the zero-trust gateway may include, for example, (non-national secret) gateway A1, (non-national secret) gateway A2, (national secret) gateway B1, (national secret) gateway B2, (national secret) gateway C1, (national secret) gateway C2, etc.

[0063] Optionally, the zero-trust controller can be used as a control center, and the zero-trust gateway can be used as a security proxy gateway to separate the control plane from the data plane. The zero-trust controller can be used for authentication and policy delivery, and the security proxy gateway can be used for proxy forwarding of data traffic. The zero-trust controller and the security proxy gateway can usually interact through a secure control channel.

[0064] In one possible implementation, the software-defined boundary architecture may also include a zero-trust sandbox.

[0065] Optionally, the zero-trust sandbox can be used to provide terminal data encryption, environment isolation, behavior monitoring and other technical guarantees for data security. Specifically, it can be manifested as a security guarantee through the dual-domain isolation of personal space and work space in the zero-trust sandbox.

[0066] In a possible implementation embodiment, the software-defined border architecture may also include DCN services, namely, office network-related office service systems, such as work assistants, OA, and 4A.

[0067] Specifically, the solution to application security access can be solved by integrating various application systems with zero trust and work assistants. This is achieved by integrating with work assistants and using the master-slave APP model. The work assistants and all APPs can inherit the zero trust SDK to complete the intensive management and control of APPs and eliminate the exposure of APPs. In addition, the zero trust platform can be used to centralize the entrance to self-use systems. This is achieved by integrating the authentication, organizational structure and permission system of the 4A system through zero trust, realizing one account, one authentication, and roaming across the entire network, thereby improving employee perception and facilitating operation and maintenance.

[0068] In actual applications, the zero-trust controller can be mainly used to receive communication connection requests from internal and external network terminals, respond to communication connection requests, open access rights to Internet ports to internal and external network terminals based on the knock package included in the communication connection, and establish communication connections with internal and external network terminals based on access rights, and receive office business access requests from internal and external network terminals; the zero-trust gateway can be mainly used to respond to office business access requests, obtain office data, and return office data to the workspace domain of internal and external network terminals, thereby realizing access to office business by internal and external network terminals.

[0069] The essence of the above-mentioned zero-trust architecture is identity-centric dynamic trusted access control, which focuses on security capabilities in dimensions such as identity, trust, business access, and dynamic access control. It dynamically and continuously evaluates and adjusts trust based on multiple factors such as people, processes, environment, and access context in business scenarios, forming a dynamic and adaptive security closed-loop system with strong risk response capabilities.

[0070] The SDP architecture provided by the embodiment of the present invention realizes single sign-on of OA system and 4A system, unifies the WEB system portal, completes the integration of work assistant and zero trust, unifies the APP portal, and completes user combing through the account life cycle system, realizes unified identity authentication and management of mobile and PC terminals, and finally completes unified security access control and convergence of Internet exposure surfaces to solve the security environment of mobile access terminal equipment, user identity authentication, national secret data transmission, access control, terminal data security, Internet convergence, intranet within the computer room and other problems, and jointly constructs business system security access, identity authority management and network boundary security with work assistant, 4A, OA platform, and boundary security protection equipment.

[0071] Reference Figure 2 , showing a flow chart of steps of an embodiment of a method for accessing an internal and external network terminal of the present invention, involving Figure 1 The software-defined edge architecture shown may include the following steps:

[0072] Step 201, receiving a communication connection request from an intranet or intranet terminal through a zero-trust system;

[0073] The embodiment of the present invention adopts Internet port hiding technology to hide Internet ports, specifically TCP ports, so that internal and external network terminals can have a communication tunnel with the zero-trust system to access the UDP port.

[0074] In one embodiment of the present invention, assuming that the intranet and extranet terminals are SDP clients with identity authentication, the intranet and extranet terminals can initiate a communication connection to the zero-trust system (ie, SDP) to access intranet applications.

[0075] Specifically, the communication connection request sent by the internal and external network terminals to the zero-trust system may include a knocking packet, which can be used to indicate the user identity of the internal and external network terminals to achieve network invisibility to the back-end of the proxy gateway, and transform the original network location-based access control into identity-centric access control, that is, upgrading from IP-based ACL to identity-based ACL, eliminating dependence on IP, breaking through geographical location restrictions, and realizing business mobility. At the same time, it prevents ACL corruption, ensures the security of data transmission, strengthens access control, converges Internet exposure, improves user experience perception and realizes intelligent operation and maintenance management.

[0076] like Figure 3 As shown, each access user can be granted credit first, then authenticated, and then connected. When a non-trusted client logs in to access, the login page cannot be opened, and no interface (including TCP port and UDP port) can be accessed, so as to avoid malicious scanning, vulnerability probing attacks, weak password blasting, etc. by attackers, and minimize the business exposure to ensure security. Among them, the TCP port is not open to internal and external network terminals, and the UDP interface does not respond to the client of illegal users. When the SDP client performs SPA knock authentication on the UDP port, it can send a knock packet to the zero-trust system to send a communication connection request to the zero-trust system.

[0077] Step 202, in response to the communication connection request, opening the access rights of the Internet port to the internal and external network terminals based on the knock packet;

[0078] Employees remotely access office OA, network management and maintenance, billing, CRM, internal APP and other systems. Due to the complexity of user roles and groups, it is necessary to reasonably and effectively authenticate the identity of the accessing users. Moreover, when the access environment and access time change, it is necessary to ensure the legitimacy of the identity again.

[0079] The zero-trust system can authenticate the internal and external network terminals based on the knock information contained in the knock package, thereby opening access rights to the Internet ports to the internal and external network terminals based on the knock information in the knock package.

[0080] Specifically, the opened Internet port is a TCP port, and the internal and external network terminals have access rights to the TCP port. The internal and external network terminals can access the office business system through the TCP port.

[0081] Step 203: establishing a communication connection with the intranet and intranet terminals based on the access rights, and receiving an office service access request from the intranet and intranet terminals;

[0082] Office business access requests can be used by intranet and extranet terminals to request business access or data access to the office business system.

[0083] Step 204, responding to the office service access request, acquiring office data, and returning the office data to the workspace domain of the intranet and extranet terminals.

[0084] Among them, on internal and external network terminals, it can include personal space domain and work space domain divided based on zero trust sandbox.

[0085] In actual applications, the zero-trust system can respond to office business access requests, obtain office data, and return office data to the workspace domain of internal and external network terminals.

[0086] It should be noted that the contraction of business from Internet publishing to intranet scenarios does not change user access habits. For example, the access domain name does not change, and B / S services do not require mandatory installation of clients.

[0087] In an embodiment of the present invention, a communication connection request from an intranet terminal is received through a zero-trust system of an intranet access platform, and based on a knocking package included in the communication connection request, the access rights to the Internet port are opened to the intranet terminal, so as to establish a communication connection between the intranet terminal and the intranet access platform based on the access rights, and obtain office data by responding to office business access requests, and return the obtained office data to the workspace domain of the intranet terminal. The zero-trust strategy is implemented through a software-defined boundary architecture, and the access rights to the Internet port are opened to the intranet terminal based on the knocking package, and then the Internet port hiding technology is used to converge the Internet exposure surface; and the zero-trust sandbox is used to provide security guarantees for the dual-domain isolation of personal space and work space for the intranet terminal, so as to achieve isolation of the intranet during office and operation and maintenance, reduce the risk of the computer being invaded by the intranet after being remotely controlled, and enhance office efficiency based on one-click switching between the intranet and the intranet.

[0088] In some embodiments of the present invention, step 202, opening the access rights of the Internet port to the intranet and extranet terminals based on the knock package, includes:

[0089] Verify whether the data packet format of the knocking package is correct; if the data packet format of the knocking package is correct, verify the knocking package information of the knocking package; when the knocking package information verification passes, open the access rights of the Internet port to the internal and external network terminals.

[0090] In the embodiment of the present invention, the SPA single-packet authorization security mechanism can realize network invisibility, hide key services to the backend, and minimize the exposure surface.

[0091] Optionally, the knock package information may include at least one or more of the following: user identity information, terminal device information, timestamp, network information and location information; wherein the user identity information includes at least one or more of the following: security code information and random number, and the terminal device information includes at least one or more of the following: device physical address information and device name.

[0092] Optionally, the security code information is bound to the intranet and extranet terminal users; wherein the security code information has a valid period of use and / or number of uses.

[0093] As an example, a one-person-one-code management model can be adopted to effectively solve problems such as security code loss and security code misuse, and further improve the security of user access.

[0094] For details, please refer to FIG. 4A to FIG. 4B , showing a schematic diagram of security code distribution provided by an embodiment of the present invention. In the one-person-one-code mode, the security code can be bound to the user, and each person has his or her own exclusive security code. At the same time, the administrator can set a separate validity period for each exclusive security code to meet the needs of temporary access of outsourced operation and maintenance personnel during major security exercises. When the SPA security code is found to be leaked, it can also be reset in the console to quickly cancel the leaked SPA security code, and allocate a unique SPA security code to each user, perfectly solving the problems of security code loss and security code fraud, and realizing refined management.

[0095] As another example, the SPA can be further upgraded and updated based on one person one code, which greatly improves the security of the authentication mode and prevents the leakage of security codes.

[0096] For details, please refer to FIG. 5A to FIG. 5B, shows another security code distribution schematic diagram provided by an embodiment of the present invention. In the SPA one-time code mode, whether it is the server or the client, the security code is all encrypted, distributed and stored; whether it is the administrator or the user, neither can view the security code in plain text, but replaces the encrypted security code with the plain text activation code to prevent the security code from being exposed; and for users who want to obtain the security code, they must not only enter a valid activation code to pass the SPA authentication, but also complete the identity authentication. After confirming that the person and the code are consistent, the server will issue the encrypted security code; that is, even if the administrator resigns or the attacker obtains a valid activation code in scenarios such as phishing, the final security code cannot be replaced without the identity credentials of the corresponding user, thereby strengthening the security code exchange verification; and, since the security code is used with the business for a long time, it is often consistent with the validity period of the user account, that is, a long-term key, but the activation code is used as an intermediate way between the first knock and the replacement of the security code, and the validity period can be converged to minutes, hours, etc., and it will become invalid after exchanging the security code once. Through the validity period and the number of uses, the exposure cycle is greatly converged, that is, a one-time key, and the activation code exposure cycle is converged.

[0097] It should be noted that, due to the code-changing behavior of the one-time code, unlike the security code that can be used forever after the user enters it (not expired / not reset), the user needs to log in and successfully change the code before using the long-term valid security code, otherwise the knocking will fail after obtaining the activation code. Furthermore, the security code can be exchanged for the activation code + multi-factor authentication to prevent the security code from being leaked and further improve the access security, which is not limited in this embodiment of the present invention.

[0098] Optionally, the knock packet information of the knock packet may be subjected to at least one of the following verification processes: data packet replay verification, data packet forgery verification, and user security code verification.

[0099] In an embodiment of the present invention, the multi-factor trusted authentication that ensures the security of the access terminal may include multiple factors such as the above-mentioned user identity information, terminal device information, timestamp, network information and location information, or a dual factor obtained by combining the above-mentioned two factors. When one of the factors does not comply with the regulations, the UDP protocol will deny the internal and external network terminals from accessing the TCP port, that is, the access rights to the TCP port will not be opened to the internal and external network terminals.

[0100] Optionally, an SDP (software defined perimeter) approach may be adopted, which is identity-centric and based on the zero trust concept, to achieve trusted authentication of internal and external network terminals through multi-dimensional dynamic trust authorization. For example, it may include identity authentication based on multi-factor identity information, trust assessment based on trust level assessment, terminal device authentication based on terminal device environment and security status, behavior monitoring based on continuous monitoring of behavior, traffic, and logs, and access authorization authentication based on trust level authorization of access rights, etc. The embodiments of the present invention are not limited to this.

[0101] In a possible embodiment, the zero-trust controller can open access rights to Internet ports to internal and external network terminals based on the knock package.

[0102] In a possible embodiment, the zero-trust gateway can respond to the office service access request, obtain office data, and return the office data to the workspace domain of the internal and external network terminals. Specifically, the zero-trust gateway can forward the office data to the zero-trust controller, and the zero-trust controller can return the office data to the workspace domain of the internal and external network terminals.

[0103] On the server side, the zero-trust platform is divided into two parts: the control center and the security proxy gateway, which separates the control plane from the data plane. The controller is used for authentication and policy delivery, while the security proxy gateway is only used for proxy forwarding of data traffic. Figure 6 As shown, the control center and the secure proxy gateway interact through a secure control channel.

[0104] For example, the zero-trust controller is the brain of the internal and external network access platform. It can mainly establish dynamic and fine-grained access rules between visitors and resources, and send these access rules to the security proxy gateway to proxy forward user traffic according to the rules. The rules established by the controller are only open to authorized users. This whitelist access control mode can reject unauthorized access traffic at the TCP stage, greatly reducing the exposure to network attacks.

[0105] It should be noted that the access rules provided by the controller are not static. Its trust engine makes comprehensive judgments based on the user's access behavior, environment, and the characteristics of the business system itself, and dynamically adjusts the access rules to prevent threats to the business server. At the same time, the zero trust engine can provide an open API to interact with other security components, and realize a full-dimensional and three-dimensional security protection system by uniformly processing the information reported by the security components. This is not limited in the embodiments of the present invention.

[0106] In actual applications, on the terminal device side, the client can be provided with the ability to report terminal security risks and divert network data. Specifically, the client periodically detects the terminal environment and reports the data to the control center. The control center can adjust the access policy in real time according to the reporting results to avoid the access risks that may be brought by terminal security; at the same time, the client can add identity tags to the specified network traffic and divert the access process information to the secure access gateway for processing. Trusted access determines whether to proxy the traffic based on the access policy.

[0107] Specifically, the method of first granting trust and then authenticating can be used to prevent an untrusted client from opening the login page and accessing any interface when establishing a TLS connection because it does not carry a valid SPA password. A trusted terminal carrying an SPA seed can successfully establish a connection and log in when establishing a TLS connection because it carries a valid password.

[0108] As an example, see FIG. 7A to FIG. 7B , shows a schematic diagram of establishing a communication connection provided by an embodiment of the present invention, which mainly reflects a zero-trust service hiding method of a UDP-based SPA mode.

[0109] like Fig. 7A As shown, first, a DTLS UDP SPA knocking packet is sent to the UDP port. The knocking packet information may include information such as the user pre-shared key, device identification, client source IP, and access target port. Then, the zero-trust function component can capture the SPA packet flowing through the network card and verify the legitimacy of the data in the SPA packet, such as replay verification, forgery verification, user identity verification, and device identification verification. After the verification is passed, the local firewall rules can be updated to open TCP port access rights (fixed time) to the source IP of the legitimate user / device. After the TCP three-way handshake and the SSL four-way handshake, an HTTPS connection can be established. That is, in the UDP-based SPA mode, the server closes all ports by default. Before normal users access, they need to send a UDP SPA knocking packet containing identity credentials. After the verification is passed, the corresponding service is opened to the specified source IP.

[0110] However, in the actual operation process, Figure 7BAs shown in the figure, although the UDP-based SPA mode has the advantage of not listening to any port by default and preventing scanning detection and DDOS attacks before hacker attacks from the source, it has the following disadvantages: 1) SNAT knocking amplification: Similar to Internet remote access, the public network exit IP is consistent due to SNAT conversion. Once a terminal knocks successfully, all terminals under the public network IP do not need to knock again, which is almost ineffective when a large number of employees access remotely; 2) UDP transmission is unstable: Since operators have a certain degree of suppression on UDP, there is generally a possibility of QoS speed limit and packet loss. It is possible that the UDP knocking packet is lost, resulting in inability to access the service normally.

[0111] As another example, refer to FIG. 8A to FIG. 8B , shows a schematic diagram of establishing another communication connection provided by an embodiment of the present invention, which mainly reflects a zero-trust service hiding method of a TCP-based SPA mode.

[0112] like Fig. 8A As shown in the figure, when the client initiates a connection in TCP-based SPA mode, it does not need to send an additional UDP knock packet separately. Instead, the first client hello packet in the TLS handshake process carries the SPA authorization packet containing the identity identifier to the service. After the server verifies it, it establishes a complete TLS. If the verification fails, the TCP connection is directly disconnected.

[0113] However, in the actual operation process, Figure 8B As shown in the figure, the TCP-based SPA mode has the following advantages: 1) Security: it is impossible to obtain the port service type and version information, it is impossible to associate vulnerability detection, and it is impossible to carry out further attacks; 2) Fine-grained control: the terminal-level port is hidden to achieve fine-grained control; 3) Availability: it avoids the risk of UDP transmission packet loss and greatly improves availability. However, it has the disadvantage of TCP port opening. Compared with UDP-based SPA, TCP-based SPA will expose the port and can be scanned by the external network.

[0114] As another example, refer to FIG. 9A to FIG. 9B , shows a schematic diagram of establishing another communication connection provided by an embodiment of the present invention, which mainly embodies a zero-trust service hiding method in a UDP+TCP SPA hybrid mode.

[0115] The zero-trust service hiding method that adopts the UDP+TCP SPA hybrid mode can combine the advantages of the first two SPA single-packet authorizations. By superimposing the capabilities of TCP SPA on the basis of UDP SPA, the server closes all ports by default. Before normal user access, the client needs to send a UDP SPA knocking package containing identity credentials. After successful verification, the local firewall rules are updated to temporarily release a very short time window to allow the specified source IP to access the device TCP port. In the subsequent connection establishment process, the TCP SPA process is followed to complete the TLS conference negotiation, which can further enhance security. For example, the entire process uses the national secret algorithm, the security code information of the knocking package can prevent HASH collision and support brute force locking, etc.

[0116] In a possible embodiment, when the opening time of the access right of the Internet port reaches a preset time threshold, the access right of the Internet port is closed to the intranet and intranet terminals.

[0117] like Fig.9A and 9B As shown in the figure, in the UDP+TCP SPA hybrid mode, the zero-trust client can send a UDP SPA knocking packet in DTLS format to the server in advance. The payload content of the knocking packet can include the user's personal security code, random number, timestamp, MAC address and name of the terminal device; the zero-trust service SPAD on the device receives the UDP SPA knocking packet and verifies whether the format of the knocking packet is correct. If it is not correct, the packet will be dropped directly. After the format is correct, the payload is decrypted and verified, including data packet replay verification, data packet forgery verification, and user security code verification; after the verification is passed, the zero trust service SPAD updates the local firewall rules of the device and temporarily (such as 60S) opens TCP port access rights to the source IP of legitimate users / devices; the zero trust client initiates a TCP connection request with the zero trust gateway, and successfully establishes a TCP connection after a TCP three-way handshake; the zero trust client initiates the TLS secure socket protocol, sends a TLS client hello handshake packet, and carries an SPA knocking packet in the extended field of TLS client hello; the zero trust service SPAD parses the SPA knocking packet from the TLS client hello extended field, decrypts and verifies the payload, including data packet replay verification, data packet forgery verification, and user security code verification; after the verification is passed, the TLS handshake negotiation is successfully completed, an SSL encrypted transmission tunnel is established, and business data transmission begins.

[0118] In a possible embodiment, the intranet and extranet terminals include a personal space domain and a workspace domain divided based on a zero-trust sandbox.

[0119] Specifically, based on the existing zero-trust access security platform, all PC terminals can deploy security sandboxes to prevent data leakage. With the security sandbox function, personal space and work space can be distinguished on a device. All systems run in the work space, and business access and related data are all performed in the sandbox (i.e., work space) to prevent data leakage. Personal space does not use business systems and office systems, so there is no mandatory control to ensure personal experience.

[0120] The security sandbox opens an independent encrypted data leakage prevention workspace on the terminal side. Users access the business system based on a secure encrypted link in the workspace. All data is also encrypted and stored in the workspace and cannot be copied to the personal space. At the same time, it has network isolation between the personal space and the workspace, clipboard isolation, data import and export control, process protection, anti-screenshot, screen watermark deterrence and other data security and leakage prevention features.

[0121] Optionally, based on actual business needs, the following data leakage prevention functions and strategies are available:

[0122] (1) File encryption: When creating, downloading, receiving, or editing files in the workspace, the files are automatically encrypted and stored in the sandbox. Even if the personal space is infected with a ransomware virus, it will not affect the files in the workspace.

[0123] (2) Network isolation: The target address ranges accessible to workspace processes and personal space processes are isolated from each other by default.

[0124] (3) Application control: The program control function can be used to set a list of programs that are only allowed to run in the workspace. When the end user runs a program outside the list, it will be blocked and prompted. Avoid running applications arbitrarily in the sandbox, which may bring security risks.

[0125] (4) File import and export control: Policies can be used to restrict the bidirectional import and export operations of files in the workspace and personal space.

[0126] (5) Clipboard isolation: Clipboard isolation can be configured in one-way or two-way isolation through policies, such as allowing only copying from personal space to work space; fine-grained clipboard management, allowing only N-byte strings to be copied, for example, in outsourced debt collection scenarios, only mobile phone numbers can be copied out; when copying to personal space is allowed, the copied content is audited; copying and pasting within personal space is not restricted;

[0127] (6) Screen capture prevention: The screenshot / screen recording tools in the personal space cannot capture the images in the workspace; the content captured by the screenshot / screen recording tools in the workspace cannot be taken out of the workspace; the running of screenshot / screen recording tools in the workspace can be restricted by running program management.

[0128] (7) Screen watermark: The workspace screen is watermarked to deter, audit, and trace behaviors such as screen capture.

[0129] That is, through the dual-domain isolation of personal space and workspace in the zero-trust sandbox, the internal and external networks can be isolated during office and operation and maintenance, reducing the risk of the computer being invaded by the internal network after being remotely controlled; based on one-click switching between the internal and external networks, office efficiency can be improved. In actual applications, the workspace and personal space are isolated from each other, and cannot access each other, cannot copy and paste, can only interact through the cloud document system, and downloading documents requires approval; the system, host, database, and document operations in the workspace all have screen watermarks, such as host screen watermarks, database screen watermarks, document screen watermarks, etc.

[0130] For example, Fig.10 As shown, working files can be encrypted and isolated through the sandbox. This function builds a secure file system dedicated to the security domain in the mobile device file system, intercepts all file operations of security domain applications through hook technology, isolates application data of personal domain and security domain, and encrypts the file path (file isolation) and file content (file encryption) in the file sandbox with high intensity. It also enables security domain applications to access both security domain files and personal domain files (file flow).

[0131] In a possible embodiment, it is also possible to respond to user login requests from intranet and extranet terminals to multiple business systems; the login accounts in the user login requests of multiple business systems are the same; and when access rights to the Internet ports are opened to the intranet and extranet terminals, the intranet and extranet terminals are allowed to log in to multiple business systems based on the login accounts.

[0132] For example, the authentication, organizational structure and permission system of the 4A system can be integrated through zero trust to achieve one account, one authentication, and roaming across the entire network, thereby improving employee perception and facilitating operation and maintenance. For example, you can log in through the 4A account password and the work assistant code scan (both are 4A authentication, unified authentication system across the province); or, through the platform single sign-on 4A and OA; or, single sign-on 4A; or, single sign-on OA, etc., to achieve single sign-on of OA system and 4A system, unified WEB system portal, complete the integration of work assistant and zero trust, unified APP portal, and complete user combing through the account life cycle system, realize unified identity authentication and management of mobile and PC terminals, and finally complete unified security access control and convergence of Internet exposure.

[0133] Optionally, the embodiment of the present invention may also adopt a zero-trust client for the application. The client may create a virtual network card, and introduce traffic to the national secret proxy gateway through the zero-trust client, supporting two different tunnel connection technologies: long connection and short connection.

[0134] It should be noted that after users access the intranet, their access behavior needs to be audited; if suspicious or abnormal access behavior is found, access rights need to be restricted, or the user's identity needs to be blocked or reconfirmed; when accessing highly sensitive businesses, a more secure permission restriction strategy is required.

[0135] Among them, the long connection is benchmarked against the L3VPN resources of SSL VPN, which is usually also called the three-layer tunnel and system-level VPN. When the client has multiple C / S applications, it will connect to the proxy gateway through a TCP connection. Short connection is improved on the basis of the original SSL VPN TCP resources, and is implemented by using the three-layer to four-layer technology. The flow is based on the virtual network card flow (the TCP resources of SSL VPN use the application layer hook technology for flow). When the client has multiple C / S applications, a separate TCP short connection is established for each C / S application through the three-layer to four-layer mechanism. In this way, proxy access is achieved, so the application range supported is wider, whether it is B / S application or C / S application. In order to make up for the defects of traditional tunnel technology and avoid the compatibility problem of WEB resources, zero trust innovatively proposed the tunnel to WEB technology in tunnel technology. Zero trust uses the client to proxy the access traffic through the tunnel technology, and then forwards it to the local WEB proxy service, and the WEB proxy server proxies the traffic to the upstream resource server. The access traffic passing through the tunnel proxy can retain the advantages of good tunnel application compatibility and fast transmission speed; and by converting the tunnel proxy into a WEB proxy, the application layer functions such as URL auditing and WEB watermarking can be realized.

[0136] Optionally, the embodiment of the present invention can also create a unique 1+1+N security protection mode based on the integration of the work assistant and the zero-trust SDK. "1": one APP portal (the work assistant portal integrates all self-use APPs), "1": one self-use system portal (the zero-trust platform portal integrates all self-use systems), "N": N public Internet systems (intensively protected by the WEB dynamic defense system), and all self-use exposure surfaces are cleared. Based on the powerful security capabilities in data transmission and the solid technical accumulation of mobile security, the SDK provides secure access capabilities and dual-domain isolation security sandbox capabilities for the mobile work assistant integrated with the SDK. The mobile work assistant integrates a lightweight SDK, that is, realizes dual-domain isolation protection of the work assistant, encrypts and isolates the data in the work assistant, and allows the work assistant to securely access the intranet business system, so that mobile office services can be carried out safely and quickly using mobile terminals at any time and any place.

[0137] Optionally, the embodiment of the present invention can also follow the principle that the intranet does not leave the computer room, and all other branch intranets and office intranets can be retracted to the computer room, and the entire province can log in to zero trust through the Internet and access the intranet after authentication.

[0138] Optionally, the embodiments of the present invention can also use zero trust to integrate 4A authentication and permissions, minimize the management and control of employee ID permissions, avoid data leakage, realize one account, one authentication, and roaming across the entire network, greatly improve the user login system and operation and maintenance efficiency, and achieve minimized permission reduction.

[0139] In an embodiment of the present invention, a unified access platform for internal and external networks is proposed. The unified access platform for internal and external networks implements a zero-trust strategy by adopting an SDP architecture, performs dual-domain isolation of personal space and workspace through a zero-trust sandbox, and integrates the authentication, organizational structure and authority system of a 4A system through zero-trust to achieve secure access of remote office terminals and mobile office terminals to the office network, solve problems such as diversified access roles, diversified usage scenarios, diversified access environments, and diversified access terminals, so as to converge the exposure of the Internet, realize that the internal network does not leave the computer room, and thereby increase the security of internal and external network terminals accessing the office network.

[0140] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0141] Reference Fig.11 , shows a structural block diagram of an embodiment of an access device for an intranet terminal of the present invention, involving an intranet access platform, wherein the intranet access platform is deployed with a software-defined boundary architecture, wherein the software-defined boundary architecture includes a zero-trust system, and specifically may include the following modules:

[0142] The communication connection request receiving module 1101 is used to receive the communication connection request of the intranet terminal, wherein the communication connection includes a knocking packet;

[0143] An access permission opening module 1102 is used to respond to the communication connection request and open the access permission of the Internet port to the intranet and intranet terminals based on the knock package;

[0144] The service access request receiving module 1103 is used to establish a communication connection with the internal and external network terminal based on the access permission, and receive the office service access request of the internal and external network terminal; wherein the internal and external network terminal includes a personal space domain and a workspace domain divided based on a zero-trust sandbox;

[0145] The office data returning module 1104 is used to respond to the office service access request, obtain office data, and return the office data to the workspace domain of the intranet terminal.

[0146] In one embodiment of the present invention, the zero trust system includes a zero trust controller; the access permission opening module 1102 may include the following submodules:

[0147] The access permission opening submodule is used to open the access permission of the Internet port to the internal and external network terminals based on the knock package through the zero trust controller.

[0148] In one embodiment of the present invention, the access permission opening submodule may include the following units:

[0149] The access permission opening unit is used to verify whether the data packet format of the knock packet is correct; if the data packet format of the knock packet is correct, verify the knock packet information of the knock packet; when the knock packet information verification is passed, open the access permission of the Internet port to the intranet and extranet terminals.

[0150] In one embodiment of the present invention, the knock package information includes at least one or more of the following: user identity information, terminal device information, timestamp, network information, and location information;

[0151] The user identity information includes at least one or more of the following: security code information and a random number; the terminal device information includes at least one or more of the following: device physical address information and device name.

[0152] In one embodiment of the present invention, the security code information is bound to the intranet and extranet terminal users;

[0153] The security code information may have a valid period of use and / or number of uses.

[0154] In one embodiment of the present invention, the access permission opening unit may include the following subunits:

[0155] The access rights opening subunit is used to perform at least one of the following verification processes on the knock package information of the knock package: data packet replay verification, data packet forgery verification, and user security code verification.

[0156] In one embodiment of the present invention, the access permission opening submodule may further include the following units:

[0157] The access permission closing unit is used to close the access permission of the Internet port to the internal and external network terminals when the opening time of the access permission of the Internet port reaches a preset time threshold.

[0158] In one embodiment of the present invention, the zero trust system includes a zero trust gateway, and the office data return module 1104 may include the following submodules:

[0159] The office data return submodule is used to respond to the office business access request through the zero-trust gateway, obtain office data, and return the office data to the workspace domain of the intranet and extranet terminals.

[0160] In one embodiment of the present invention, the office data return submodule may include the following units:

[0161] An office data return unit is used to forward the office business access request to the office business server through the zero trust gateway, and obtain the office data returned by the office business server in response to the office business access request; forward the office data to the zero trust controller through the zero trust gateway, and return the office data to the workspace domain of the internal and external network terminals through the zero trust controller.

[0162] In one embodiment of the present invention, the zero-trust system integrates multiple business systems, and the device provided by the embodiment of the present invention may also include the following modules:

[0163] A business login module is used to respond to user login requests from the internal and external network terminals to the multiple business systems; the login accounts in the user login requests of the multiple business systems are the same; and when the access rights of the Internet port are opened to the internal and external network terminals, the internal and external network terminals are allowed to log in to the multiple business systems based on the login accounts.

[0164] In an embodiment of the present invention, the access device for the internal and external network terminals provided by the embodiment of the present invention receives the communication connection request of the internal and external network terminals through the zero-trust system of the internal and external network access platform, and opens the access rights of the Internet port to the internal and external network terminals based on the knocking package included in the communication connection request, so as to establish a communication connection between the internal and external terminals and the internal and external network access platform based on the access rights, and obtain office data by responding to the office business access request, and return the obtained office data to the workspace domain of the internal and external network terminals. The zero-trust strategy is implemented through the software-defined boundary architecture, and the access rights of the Internet port are opened to the internal and external network terminals based on the knocking package, and then the Internet port hiding technology is used to converge the Internet exposure surface; and the zero-trust sandbox is used to provide security guarantees for the dual-domain isolation of personal space and work space for the internal and external network terminals, so as to achieve the isolation of the internal and external networks during office and operation and maintenance, reduce the risk of the computer being invaded by the internal network after being remotely controlled, and switch between the internal and external networks with one key, thereby enhancing office efficiency.

[0165] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0166] An embodiment of the present invention further provides an electronic device, including:

[0167] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned access method embodiment of the internal and external network terminals are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0168] An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned access method embodiment for internal and external network terminals are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0169] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0170] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0171] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0172] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0173] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0174] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0175] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0176] The above describes in detail an access method for internal and external network terminals, an access device for internal and external network terminals, a corresponding internal and external network access platform, a corresponding electronic device, and a corresponding computer-readable storage medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for accessing an intranet or extranet terminal. It is characterized in that Involving an intranet and extranet access platform, the intranet and extranet access platform is deployed with a software-defined boundary architecture, the software-defined boundary architecture includes a zero-trust system, and the method includes: Receiving, through the zero-trust system, a communication connection request from the intranet and extranet terminals, wherein the communication connection includes a knock-on packet; In response to the communication connection request, opening access rights of the Internet port to the intranet and extranet terminals based on the knock package; Establishing a communication connection with the intranet terminal based on the access permission, and receiving an office business access request from the intranet terminal; wherein the intranet terminal includes a personal space domain and a workspace domain divided based on a zero-trust sandbox; Respond to the office service access request, obtain office data, and return the office data to the workspace domain of the intranet and extranet terminals.

2. The method according to claim 1, It is characterized in that The access rights of opening the Internet port to the internal and external network terminals based on the knock package include: Verify whether the data packet format of the knock packet is correct; If the data packet format of the knock packet is correct, verifying the knock packet information of the knock packet; When the knock package information verification is passed, the access rights of the Internet port are opened to the intranet and extranet terminals.

3. The method according to claim 2, It is characterized in that The method further comprises: When the opening time of the access right of the Internet port reaches a preset time threshold, the access right of the Internet port is closed to the intranet and extranet terminals.

4. The method according to claim 2, It is characterized in that The knock package information includes at least one or more of the following: user identity information, terminal device information, timestamp, network information and location information; The user identity information includes at least one or more of the following: security code information and a random number; the terminal device information includes at least one or more of the following: device physical address information and device name.

5. The method according to claim 4, It is characterized in that The security code information is bound to the intranet and extranet terminal users; The security code information may have a valid period of use and / or number of uses.

6. The method according to claim 3, It is characterized in that The verifying the knock package information of the knock package includes: The knock packet information of the knock packet is subjected to at least one of the following verification processes: data packet replay verification, data packet forgery verification, and user security code verification.

7. The method according to claim 1, It is characterized in that The zero-trust system includes a zero-trust controller and a zero-trust gateway; the access rights to open the Internet port to the internal and external network terminals based on the knock package include: Opening access rights of Internet ports to the intranet and intranet terminals through the zero-trust controller based on the knock package; The responding to the office service access request, acquiring office data, and returning the office data to the workspace domain of the intranet terminal includes: The zero-trust gateway responds to the office business access request, obtains office data, and returns the office data to the workspace domain of the intranet and extranet terminals.

8. The method according to claim 7, It is characterized in that The step of responding to the office service access request through the zero-trust gateway, acquiring office data, and returning the office data to the workspace domain of the intranet and intranet terminals includes: Forwarding the office business access request to the office business server through the zero-trust gateway, and obtaining the office data returned by the office business server in response to the office business access request; The office data is forwarded to the zero trust controller through the zero trust gateway, and the office data is returned to the workspace domain of the intranet and extranet terminals through the zero trust controller.

9. The method according to any one of claims 1 to 8, It is characterized in that The zero-trust system integrates multiple business systems, and the method further includes: Responding to user login requests from the intranet and extranet terminals to the multiple business systems; the login accounts in the user login requests of the multiple business systems are the same; In a case where the access rights of the Internet port are opened to the intranet and the extranet terminals, the intranet and the extranet terminals are allowed to log in to the multiple business systems based on the login account.

10. An access device for an intranet terminal, It is characterized in that Involving an intranet and extranet access platform, the intranet and extranet access platform is deployed with a software-defined boundary architecture, the software-defined boundary architecture includes a zero-trust system, and the device includes: A communication connection request receiving module, used to receive a communication connection request from the intranet terminal, wherein the communication connection includes a knocking packet; An access permission opening module, used for responding to the communication connection request and opening the access permission of the Internet port to the intranet and intranet terminals based on the knock package; A business access request receiving module, used to establish a communication connection with the intranet terminal based on the access permission, and receive the office business access request of the intranet terminal; wherein the intranet terminal includes a personal space domain and a workspace domain divided based on a zero-trust sandbox; The office data returning module is used to respond to the office service access request, obtain office data, and return the office data to the workspace domain of the intranet and extranet terminals.

11. An intranet and extranet access platform, It is characterized in that The internal and external network access platform is deployed with a software-defined border architecture, the software-defined border architecture includes a zero-trust system, and the zero-trust system includes a zero-trust controller and a zero-trust gateway. The zero-trust controller is used to receive a communication connection request from the internal and external network terminal, respond to the communication connection request, open access rights to the Internet port to the internal and external network terminal based on the knock package included in the communication connection, and establish a communication connection with the internal and external network terminal based on the access rights, and receive an office business access request from the internal and external network terminal; The zero-trust gateway is used to respond to the office business access request, obtain office data, and return the office data to the workspace domain of the intranet and extranet terminals.

12. An electronic device, It is characterized in that include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the method for accessing an internal or external network terminal as claimed in any one of claims 1 to 9 is implemented.

13. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for accessing an internal or external network terminal as claimed in any one of claims 1 to 9 is implemented.

Images