Zero-trust security access control system and method

Abstract

The invention provides a zero-trust security access control system and a zero-trust security access control method. The system comprises a controller, a plurality of gateways and a plurality of user equipment, the controller is used for setting a default gateway connected with the switch as one gateway in the plurality of gateways under the condition that the deployment of the zero-trust security access control system is completed; the gateway is used for setting an address of a download page of the client as a redirection address; after an access request forwarded by any user equipment through a switch connected with the user equipment is received, whether an online user corresponding to the user equipment exists or not is detected, and under the condition that it is determined that no corresponding online user exists, an access address of the access request is adjusted to a redirection address from a target address. Enabling the access page of the user equipment to jump to the downloading page; and the user equipment is used for downloading the installation package of the client through the downloading page, installing the client and automatically executing client login processing according to the login information carried by the installation package. In this way, the downloading and logging efficiency of the client is effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, in particular to a zero-trust security access control system and method. BACKGROUND

[0002] In a zero-trust security access system, a controller is often used to control multiple gateways and multiple clients to achieve hierarchical management. For company management, a company generally only needs one controller as a background management server, each office (branch) corresponds to a gateway, and multiple employees under the office correspond to multiple clients. Each gateway has a corresponding domain on the controller, and the administrator can switch domains to configure corresponding policies and resources on the gateway of the domain where the office is located.

[0003] After the employees of each office download the client and pass multiple authentications, they can access the resources (such as Internet Protocol (IP) resources, World Wide Web (Web) resources, etc.) allowed to be accessed by the employees of the office, thereby realizing zero-trust security management and control. However, as the number of employees in the office increases, the administrator needs to notify the employees of the content related to the client download every time a new employee comes, which is inefficient and increases costs. SUMMARY

[0004] Therefore, the present application provides a zero-trust security access control system and method, which effectively improves the efficiency of client download and login and reduces the time cost, labor cost and communication cost of system management.

[0005] Specifically, the present application is implemented through the following technical solutions:

[0006] According to a first aspect of the present application, a zero-trust security access control system is provided, which comprises a controller, multiple gateways and multiple user devices.

[0007] The controller is configured to, when the zero-trust security access control system is deployed, set the default gateway connected to the switch as one of the multiple gateways; create each independent sub-domain, switch to any sub-domain, and associate the any sub-domain with a gateway.

[0008] The gateway is configured to set an address of a download page of the client as a redirection address, and after receiving an access request for a target address forwarded by any user equipment through a connected switch, detect whether there is an online user corresponding to the user equipment, and in a case where it is determined that there is no corresponding online user, adjust an access address of the access request from the target address to the redirection address, so that the user equipment jumps to the download page.

[0009] The user equipment is configured to download an installation package of the client through the download page and install the client, and automatically perform client login processing according to login information carried by the installation package.

[0010] In an optional implementation, when the gateway adjusts the access address of the access request from the target address to the redirection address in a case where it is determined that there is no corresponding online user, the gateway is specifically configured to, in a case where it is determined that there is no corresponding online user, control the user equipment to display a guide page for prompting a user to download the client or log in to the client, after receiving a user-triggered download client operation, send a redirection request to the controller, and receive the redirection address sent by the controller, and adjust the access address of the access request from the target address to the redirection address.

[0011] The controller is further configured to, in a case where the redirection request is received, send the redirection address to the gateway.

[0012] In an optional implementation, when the controller sends the redirection address to the gateway in a case where the redirection request is received, the controller is specifically configured to:

[0013] In a case where the redirection request is received, obtain stored login information, the login information being used for logging in to the client, the login information including a name of a subdomain associated with the gateway, a server address of the controller, and a username and a password of the client;

[0014] Add the login information to a download link of the client to obtain a modified client download link;

[0015] Generate the redirection address based on the modified client download link, and send the redirection address to the gateway.

[0016] In an optional implementation, the controller is further configured to generate the installation package according to the following steps:

[0017] In a case of receiving a client download request, the login information is obtained from the modified client download link, and the login information is added to a name of the installation package of the client to generate the installation package.

[0018] In an optional implementation, when the user equipment downloads the installation package of the client through the download page and installs the client, and automatically performs client login processing according to the login information carried by the installation package, the user equipment is specifically configured to:

[0019] download the installation package of the client through the download page;

[0020] install the client based on the installation package;

[0021] obtain the login information from the name of the installation package, and fill the login information into a client login page, the client login page being used for logging into the client;

[0022] after receiving a client login request, perform login of the client.

[0023] In an optional implementation, after the gateway controls the user equipment to display a guide page used for prompting a user to download a client or log in to the client, the gateway is further configured to:

[0024] after receiving a user-triggered login client operation, control the user equipment to display a client login page.

[0025] In an optional implementation, after the gateway detects whether there is an online user corresponding to the user equipment, the gateway is further configured to:

[0026] in a case where it is determined that there is a corresponding online user, open resources of the user equipment, so that the user equipment performs access to the target address.

[0027] In an optional implementation, before the controller sends the redirection address to the gateway, the controller is further configured to:

[0028] open a client download port and a client download permission, the client download port and the client download permission being used for downloading the client.

[0029] In an optional implementation, after logging in to the client, the user equipment is further configured to:

[0030] display a user score page, the user score page including a use score of the client and a historical access event associated with a historical use score adjustment, the use score being used for indicating a security state of the client;

[0031] In the case of detecting an abnormal access request, the usage score is decremented.

[0032] In an optional implementation, in the process of using the client of the user equipment, the controller is further configured to:

[0033] detect the usage score of the client;

[0034] In the case of the usage score being less than a target threshold, perform client offline processing.

[0035] According to a second aspect of the present application, a zero-trust security access control method is provided, applied to a zero-trust security access control system, and the method comprises:

[0036] After the deployment of the controller and the plurality of gateways of the zero-trust security access control system is completed, the controller sets a default gateway connected by a switch as one of the plurality of gateways, creates each independent sub-domain, switches to any sub-domain, associates the any sub-domain with one gateway, so that the gateway allows users in the associated sub-domain to access;

[0037] The gateway sets an address of a download page of a client as a redirection address;

[0038] After the gateway receives an access request for a target address forwarded by a connected switch from any user equipment, it is detected whether there is an online user corresponding to the user equipment;

[0039] In the case of determining that there is no corresponding online user, the gateway adjusts an access address of the access request from the target address to the redirection address, so that the access page of the user equipment jumps to the download page.

[0040] According to a third aspect of the present application, a zero-trust security access control method is provided, applied to a controller, and the method comprises:

[0041] After the deployment of the controller and the plurality of gateways of the zero-trust security access control system is completed, the controller sets a default gateway connected by a switch as one of the plurality of gateways;

[0042] Create each independent sub-domain, switch to any sub-domain, associate the any sub-domain with one gateway, so that the gateway allows users in the associated sub-domain to access; wherein the gateway is configured to provide client automatic download login processing for users in each sub-domain by respectively controlling the access redirection of the users in each sub-domain.

[0043] According to a fourth aspect of the present application, a zero-trust security access control method is provided, applied to a gateway associated with one of the independent sub-domains created by a controller and allowing access by users in the associated sub-domain, the method comprising:

[0044] setting the address of the download page of the client as the redirection address;

[0045] Upon receiving an access request for a target address forwarded by any user equipment through the connected switch, detecting whether there is an online user corresponding to the user equipment;

[0046] In the case where it is determined that there is no corresponding online user, adjusting the access address of the access request from the target address to the redirection address, so that the access page of the user equipment jumps to the download page to automatically perform client download login.

[0047] The zero-trust security access control system and method provided by the embodiments of the present application realize efficient client download and login through the cooperative work of the controller and the gateway. The controller can flexibly set the gateway and divide the independent sub-domains. When the gateway detects that there is no corresponding online user for the user equipment, it can automatically redirect the access request to the download page of the client, guide the user equipment to quickly download and install the client, and automatically complete the login according to the login information carried by the installation package without manual intervention, thereby greatly shortening the guide time of client access, effectively improving the efficiency of client download and login, reducing the time cost, labor cost and communication cost of system management, reducing the possibility of human operation errors, and enhancing the overall operation efficiency, system usability and management convenience of the system.

[0048] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, but not limiting the technical solutions of the present disclosure.

[0049] In order to make the above-mentioned purposes, features and advantages of the present disclosure more obvious and easy to understand, the following preferred embodiments are specifically described below with reference to the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 is a schematic diagram of a zero-trust security access control system according to an exemplary embodiment of the present application;

[0051] Figure 2 is a schematic diagram of the management process of a zero-trust security access control system according to an exemplary embodiment of the present application;

[0052] Figure 3 is a flowchart of a zero-trust security access control method according to an exemplary embodiment of the present application;

[0053] Figure 4 is a flowchart of another method of zero-trust security access control according to an example embodiment of the present application;

[0054] Figure 5 is a flowchart of yet another method of zero-trust security access control according to an example embodiment of the present application. DETAILED DESCRIPTION

[0055] The example embodiments will be described in detail in this disclosure with reference to the drawings. The following description is made with reference to the accompanying drawings, in which like reference numerals in different drawings designate identical or similar elements. The following example embodiments described in this disclosure are not representative of all embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present application as detailed in the appended claims.

[0056] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used in this disclosure and the appended claims, the singular forms “a,” “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the term “and / or” as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0057] It will be understood that, although the terms first, second, third, etc. can be used herein to describe various information, these terms are not intended to denote a temporal or chronological order. Rather, these terms are used solely to distinguish different sets of information from one another. For example, a first information can be termed a second information, and similarly, a second information can be termed a first information without departing from the scope of the present application. As used herein, the word “if’ can be interpreted to mean “when” or “upon” or “in response to determining” depending on the context.

[0058] It is found through research that in a zero trust security access system, a controller is often used to control multiple gateways and multiple clients to achieve hierarchical management. For company management, a company generally only needs one controller as a background management server, each office (branch) corresponds to one gateway, and multiple employees under the office correspond to multiple clients. Employees in each office download the client, and after multiple authentications, they can access the resources allowed by the employees in the office to access. However, each time a new employee comes, the administrator often needs to ask the administrator about the content related to the client download. For example, how to access resources, how to download the client, what is the address of the client server, and how to fill in the domain, etc. The administrator needs to inform each employee about the content related to the client download, such as through email notification, telephone notification, oral notification, etc. The efficiency is low, and the cost is increasing. With the increase in the number of employees, the work efficiency of the administrator is increasingly low, and the time cost, labor cost and communication cost are large.

[0059] Based on the above research, the present application provides a zero trust security access control system, which realizes efficient client download and login through the cooperative work of the controller and the gateway, without manual intervention notification, greatly shortens the guide time of client access, effectively improves the efficiency of client download and login on the basis of guaranteeing the zero trust security principle, and reduces the time cost, labor cost and communication cost of system management.

[0060] It can be understood that before using the technical solutions disclosed in the embodiments of the present disclosure, the type, use range, use scenario, etc. of the personal information involved in the present disclosure should be informed to the user and the authorization of the user should be obtained through appropriate means according to relevant laws and regulations.

[0061] The zero trust security access control system provided by the embodiments of the present disclosure will be described below with reference to the accompanying drawings.

[0062] Referring to Figure 1 Fig. 1 is a schematic diagram of a zero trust security access control system according to an example embodiment of the present disclosure. As shown in Figure 1 The zero trust security access control system 100 includes a controller 110, multiple gateways 120 and multiple user devices 130.

[0063] Here, the zero trust security model, also known as zero trust architecture, zero trust network architecture, ZTA, ZTNA, etc., is also sometimes referred to as perimeterless security. The main concept of the zero trust security model is "never trust, always verify", i.e. no device should be trusted by default, even if the device has already connected to a permitted network (such as a company LAN) and has passed verification before. Most modern enterprise network structures are complex, containing numerous interconnected areas, cloud services and infrastructures, as well as connections with remote and mobile environments, unconventional information technology (IT) connections (such as Internet of Things devices). The zero trust principle is not suitable for the complexity of the enterprise network environment due to traditional methods (such as trusting devices within a nominal "enterprise perimeter" or devices connecting through a virtual private network (VPN)). Zero trust advocates mutual authentication, including checking the identity and integrity of the device regardless of location, and combining user identity verification based on the confidence level of the device identity and device status to provide access permissions to applications and services.

[0064] The controller 110, also known as a zero trust security access control system management platform, a software defined perimeter (SDP) controller, a ZTS-M, etc. The controller 110 manages all gateways 120 and user devices 130 in the zero trust security access control system 100, formulates security policies, and determines which clients in different user devices 130 can communicate with different services. The controller 110 can also relay the required information to external authentication services, such as through 4A, LDAP, Radius, etc. authentication protocol support. The controller 110 also needs to have a log audit function to log and audit the connection information of all clients.

[0065] The gateway 120, also known as a zero trust security proxy system, an SDP gateway, a ZTS-APX, etc. By default, the gateway 120 rejects all communications from all hosts other than the controller 110. Only after the controller 110 indicates, the gateway 120 can accept connections from clients.

[0066] The user device 130, also known as a zero-trust security access user device, an SDP user device, a ZTS-C, etc. A client can be installed in the user device 130, and the user device 130 can communicate with the controller 110 through the client to request a list of connectable gateways and a list of permissions. Before the controller 110 provides any information to the user device 130, the controller 110 needs to pass a multi-factor authentication, such as a password combined with a hardware token, biometric information, etc., to provide a stronger level of identity verification to check the identity of the client of the user device 130, and to require the client of the user device 130 to provide information such as a hardware identity document (ID), a native process, an IP address, an address location, etc.

[0067] In the present example, N1 gateways and N2 user devices are taken as an example for illustration, where the specific values of N1 and N2 can be determined according to actual needs, which are not specifically limited here. Taking company management as an example, a company can set up a zero-trust security access system, N1 can be the number of offices (branches) of the company, each office includes a plurality of employees, and N2 can be the number of all employees of the company.

[0068] In the embodiments of the present disclosure, the controller 110 is configured to, in a case where the zero-trust security access control system 100 is deployed, set a default gateway connected by a switch as one of the plurality of gateways; create each independent sub-domain, switch to any sub-domain, and associate the any sub-domain with one gateway.

[0069] In actual applications, the gateways corresponding to offices at different locations respectively have corresponding local area networks, and the local area networks include switches. A user device wants to initiate an access request, and the user device needs to be communicatively connected with a switch to send the access request through the switch.

[0070] Here, in a case where the zero-trust security access control system 100 is deployed, a default gateway connected by a switch is set as one of the plurality of gateways. The one gateway set is the gateway corresponding to the office where the employee is currently located.

[0071] The zero-trust security access control system 100 is deployed, which means that the hardware of the zero-trust security access control system 100 is deployed.

[0072] Specifically, when the default gateway connected by the switch is set as one of the plurality of gateways 120, the gateway IP address connected by the switch can be modified from the IP address of the default gateway to the IP address of the one of the plurality of gateways.

[0073] Thus, the default gateway connected with the switch is set as one of the plurality of gateways 120, and any website accessed by the subsequent user equipment 130, for example, using a browser initiated access request, will pass through the switch and reach the set gateway 120.

[0074] In the embodiments of the present disclosure, the controller 110 is configured to create each independent sub-domain, switch to any sub-domain, associate the any sub-domain with a gateway, and enable the gateway to allow users in the associated sub-domain to access.

[0075] Here, the plurality of gateways 120 correspond to the plurality of sub-domains one by one, and each gateway 120 has a corresponding sub-domain on the controller 110. The corresponding policies and resources of the gateway 120 in the domain of the office can be configured on the controller 110 by switching the sub-domain. When the subsequent client logs in, the name of the corresponding sub-domain can be used to access the corresponding gateway.

[0076] Specifically, after switching to any sub-domain, gateway data related to a gateway can be created in the sub-domain, so as to associate the any sub-domain with the gateway. The gateway data includes the IP address, port, username, password, key, and name of the gateway.

[0077] Here, the username and password of the gateway are used to log in the gateway.

[0078] Optionally, a sub-domain ID can also be created in the sub-domain, and the association between the sub-domain and the gateway can be realized through the sub-domain ID.

[0079] In the embodiments of the present disclosure, the gateway 120 is configured to set the address of the download page of the client as a redirection address, and after receiving an access request for a target address forwarded by any user equipment through a connected switch, detect whether there is an online user corresponding to the user equipment, and in the case where it is determined that there is no corresponding online user, adjust the access address of the access request from the target address to the redirection address, so that the access page of the user equipment jumps to the download page.

[0080] Specifically, when setting the address of the download page of the client as a redirection address, the address of the download page of the client can be added to the default redirection address.

[0081] Optionally, a target symbol and a sub-domain parameter of a sub-domain associated with the gateway 120 can be added after the default redirection address.

[0082] For example, the target symbol can be “?” and “&”, etc. The sub-domain parameter can include a sub-domain name and a sub-domain ID. For example, the added sub-domain name can be in the form of “origin=sub-domain name”.

[0083] According to the foregoing, since the default gateway connected by the switch is set as one of the plurality of gateways, any address accessed by the user equipment 130 on the browser will pass through the switch to the gateway. Accordingly, the gateway can detect whether there is an online user corresponding to the user equipment after receiving an access request for a target address forwarded by the user equipment through the connected switch.

[0084] Here, detecting whether there is an online user corresponding to the user equipment actually detects whether the user equipment 130 is installed with a client and successfully logs in the client.

[0085] Optionally, if the user equipment 130 is installed with a client and successfully logs in the client, it can be determined that there is an online user corresponding to the user equipment. Alternatively, if the user equipment 130 is not installed with a client and successfully logs in the client at the same time, it can be determined that there is no online user corresponding to the user equipment.

[0086] It can be understood that in the case where there is an online user corresponding to the user equipment 130, the user equipment 130 can be considered as a legitimate user under the local area network corresponding to the gateway 120, and therefore the user equipment 130 can carry out business access. In the case where there is no online user corresponding to the user equipment 130, the user equipment 130 can be considered as not a legitimate user under the local area network corresponding to the gateway 120, and therefore the user equipment 130 cannot carry out business access in order to protect system security.

[0087] Here, if there is an online user corresponding to the user equipment 130, the gateway 120 can receive attribute information of the user equipment 130 from the user equipment 130. The gateway 120 itself pre-stores attribute information of each user equipment. Optionally, when detecting whether there is an online user corresponding to the user equipment, the gateway 120 can specifically compare the received attribute information of the user equipment with the attribute information of the user equipment stored by itself, and if they are consistent, it can be determined that there is a corresponding online user.

[0088] The attribute information of the user equipment can include but is not limited to a source IP, a Media Access Control (MAC) address, a version number, an operating system, etc. of the client.

[0089] In the embodiments of the present disclosure, the gateway 120 can adjust the access address of the access request from the target address to the redirection address in a case where it is determined that there is no corresponding online user, so that the user equipment 130 jumps to the download page when accessing the page.

[0090] In this way, by enabling the redirection function, the user equipment can obtain the download path of the client as long as it initiates an access request, so that the user equipment automatically jumps to the download page and guides the user equipment to download the client.

[0091] The user equipment 130 is configured to download the installation package of the client from the download page and install the client, and automatically perform the client login process according to the login information carried by the installation package.

[0092] In this way, the user equipment can download and install the client from the download page, and can automatically parse the login information carried by the installation package to automatically perform the client login process, so that the user can complete the download and login of the client without asking the administrator for information, thereby realizing effective zero-trust management and control.

[0093] In some possible implementation manners, when the gateway 120 adjusts the access address of the access request from the target address to the redirection address in a case where it is determined that there is no corresponding online user, the gateway 120 is specifically configured to control the user equipment 130 to display a guide page for prompting the user to download the client or log in to the client, send a redirection request to the controller 110 after receiving a user-triggered download client operation, and receive the redirection address sent by the controller 110 and adjust the access address of the access request from the target address to the redirection address.

[0094] The controller 110 is further configured to send the redirection address to the gateway 120 in a case where the redirection request is received.

[0095] Here, if it is determined that there is no online user corresponding to the user equipment, it means that the user equipment 130 does not simultaneously install the client and successfully log in to the client. That is, the user equipment 130 may not install the client, or the user equipment 130 may install the client but not log in to the client. The gateway can control the user equipment 130 to display a guide page for prompting the user to download the client or log in to the client.

[0096] For example, a "download client" option and a "login client" option can be displayed in the guide page to guide the user to perform corresponding operations. If the user triggers the "download client" option, it can be received that the user triggers the download client operation, and at this time the user equipment 130 generally does not install the client. If the user triggers the "login client" option, it can be received that the user triggers the login client operation, and at this time the user equipment 130 generally installs the client but does not log in to the client.

[0097] After receiving the user trigger download client operation, the gateway 120 triggers the redirection function and sends a redirection request to the controller 110. The controller 110 sends the redirection address to the gateway 120 upon receiving the redirection request. The gateway 120 can receive the redirection address sent by the controller 110, adjust the access address of the access request from the target address to the redirection address, and thus push the page content corresponding to the redirection address to the user equipment 130, so that the access page of the user equipment 130 jumps to the download page.

[0098] In this way, the client download and login guide process of the user equipment is further optimized through the interaction of the gateway and the controller. When the gateway detects that the user equipment does not have a corresponding online user, it can actively display a guide page and explicitly prompt the user to download or log in to the client, thereby enhancing the intuitiveness and guidance of the user experience. After the user triggers the client download operation, the gateway sends a redirection request to the controller and receives a redirection address, and completes the adjustment of the access address of the user equipment, which realizes automatic and intelligent process control, further improves the efficiency and accuracy of client download and login, reduces the complexity of user operation, and enhances the overall stability and reliability of the system.

[0099] In some possible implementation manners, when the controller 110 sends the redirection address to the gateway upon receiving the redirection request, the controller 110 is specifically configured to:

[0100] Upon receiving the redirection request, obtain stored login information, the login information being used to log in to the client, the login information including the name of a subdomain associated with the gateway, the server address of the controller, and the username and password of the client;

[0101] Add the login information to a download link of the client to obtain a modified client download link;

[0102] Generate the redirection address based on the modified client download link, and send the redirection address to the gateway 120.

[0103] Here, the controller 110 itself pre-stores the login information of each client. In the case of receiving the redirection request, the background Web service of the controller 110 can obtain the stored login information, add the login information to the download link of the client to obtain a modified client download link, generate the redirection address based on the modified client download link, and send the redirection address to the gateway 120.

[0104] In this way, when receiving the redirection request, the controller not only generates the redirection address but also embeds the login information therein. Thus, when the subsequent user equipment logs in to the client, the user can automatically log in without manually inputting information due to the pre-integrated relevant login information, greatly simplifying the user operation process, improving the user experience, and reducing errors and security risks that can be caused by manual input of information, further enhancing the convenience and security of the system.

[0105] In some possible implementation manners, the controller 110 is further configured to generate the installation package according to the following steps:

[0106] In the case of receiving the client download request, the login information is obtained from the modified client download link, and the login information is added to the installation package name of the client to generate the installation package.

[0107] Here, in the case of receiving the client download request, the login information can be obtained from the modified client download link, and then the login information is spliced into the installation package name of the client to generate the installation package.

[0108] Optionally, there can be characters in the login information that do not meet the requirements of the installation package name. When the login information is spliced into the installation package name of the client, the characters in the login information that do not meet the requirements of the installation package name can be replaced with target characters.

[0109] Correspondingly, when the user equipment 130 obtains the login information from the name of the installation package after downloading the installation package, the target characters in the extracted login information can be restored.

[0110] For example, the name of the installation package cannot contain characters such as “:”. When the installation package is generated, the “:” can be replaced. When the user equipment 130 obtains the login information from the name of the installation package, the “:” is restored.

[0111] In this way, the controller extracts the login information from the modified download link when receiving the client download request, and embeds the login information in the name of the client installation package, so that the installation package carries the login information, thereby enabling automatic filling of information to complete client login after installation is completed, without the need for the user to manually input login information, further simplifying the user operation steps, improving the convenience and smoothness of the user experience, and also enhancing the automation degree and overall operation efficiency of the system.

[0112] In some possible implementation manners, when the user equipment 130 downloads the installation package of the client through the download page and installs the client, and automatically performs client login processing according to the login information carried by the installation package, the user equipment 130 is specifically configured to:

[0113] download the installation package of the client through the download page;

[0114] install the client based on the installation package;

[0115] obtain the login information from the name of the installation package, and fill the login information into a client login page used for logging into the client;

[0116] perform login of the client after receiving a client login request.

[0117] Here, the download page can display a plurality of versions of installation packages, and the user can download an installation package matching the version of the user equipment. The plurality of versions of installation packages include, for example, Windows, iOS, Android, and HarmonyOS.

[0118] The name of the installation package downloaded by the user equipment 130 carries the login information, and after receiving an installation request of the user, for example, receiving a click of a “install client” option, the client can be installed based on the installation package, and the login information can be obtained from the name of the installation package, and then the login information is automatically filled into a corresponding position in the client login page. After receiving a client login request, for example, receiving a click of a “log in to the client” option, login of the client is performed.

[0119] In this way, after the user equipment obtains the client installation package through the download page, the user equipment can automatically extract the login information from the name of the installation package and fill the login information into the client login page, to realize automatic login. The automatic filling replaces cumbersome and high-cost human communication, greatly improves the efficiency of client login, reduces the cumbersome operation of manual input of login information, and also reduces the risk of login failure caused by manual input errors, further improves the convenience and smoothness of the user experience, and ensures that the user equipment can be quickly and safely accessed.

[0120] In some possible implementation, after the client is logged in, the user equipment 130 is further configured to prompt the user to modify the password, so as to ensure the security of the client usage.

[0121] In some possible implementation, after the gateway 120 controls the user equipment 130 to display the guide page for prompting the user to download the client or log in the client, the gateway 120 is further configured to:

[0122] After receiving the user triggered login operation, the gateway 120 controls the user equipment 130 to display the client login page.

[0123] Here, after receiving the user triggered login operation, at this time, the user equipment 130 generally has the client installed but does not log in the client, the user equipment 130 can jump to the client login page, so that the user logs in the client through the client login page.

[0124] In this way, after the user equipment displays the guide page, the gateway can directly control the display of the client login page according to the user triggered client login operation, realizing seamless connection from prompting to login, which not only improves the convenience and fluency of the user operation, but also reduces the cumbersome steps of the user switching between different pages, further optimizes the user experience, and enhances the overall ease of use and user friendliness of the system.

[0125] In some possible implementation, after the gateway 120 detects whether there is an online user corresponding to the user equipment 130, the gateway 120 is further configured to:

[0126] In a case where it is determined that there is a corresponding online user, the user equipment is opened for resources, so that the user equipment performs access to the target address.

[0127] Here, in a case where it is determined that there is a corresponding online user, it means that the user equipment 130 has the client installed and successfully logs in the client, and the user equipment 130 can be considered as a legitimate user under the local area network corresponding to the gateway 120, at this time, the user equipment 130 can normally carry out business access, and therefore the user equipment 130 can be opened for resources, so that the user equipment 130 performs access to the target address.

[0128] In this way, the gateway can directly open resources to the user equipment when detecting that the corresponding online user exists, allowing the user equipment to access the target address without additional redirection or prompting operations, thereby effectively improving the access efficiency of the authenticated user, reducing unnecessary process waiting, enhancing the overall response speed of the system and the continuity of the user experience. At the same time, by clearly distinguishing between online users and offline users, the security and fine management capability of the system are further enhanced, ensuring the security of resource access.

[0129] In some possible implementation manners, before sending the redirection address to the gateway, the controller is further configured to:

[0130] open a client download port and a client download permission, the client download port and the client download permission being used for downloading the client.

[0131] It can be understood that, after the controller 110 opens the client download port and the client download permission, the gateway 120 can push a download page to the user equipment 130, and the user equipment 130 can download the client through the download page.

[0132] In this way, by opening the client download port and the download permission in advance through the controller, it is ensured that the user equipment can quickly and unobstructedly obtain an installation package when the user equipment needs to download the client, effectively avoiding the problem of download failure caused by unopened ports or permissions, further improving the reliability and success rate of client download, and improving the overall operation efficiency and user experience of the system.

[0133] In some possible implementation manners, after logging in the client, the user equipment 130 is further configured to:

[0134] display a user score page, the user score page including a use score of the client and a historical access event associated with historical use score adjustment, the use score being used to indicate a security state of the client.

[0135] In a case where an abnormal access request is detected, the use score is decremented.

[0136] In the above steps, after logging in the client, the user equipment 130 can also display a user score page, and the user score page can display a use score of the client. The security state of the client can be reflected through the use score.

[0137] In the process in which the user equipment uses the client, an access request can be detected in real time, and in a case where an abnormal access request is detected, the use score is decremented.

[0138] For example, the abnormal access request can include, but is not limited to, the number of consecutive incorrect password inputs reaching a corresponding threshold, the number of consecutive accesses to the same destination address reaching a corresponding threshold, a change in the client access location, an open deduction user datagram protocol (UDP) port, illegal external connection, and the like.

[0139] Optionally, in a case where it is detected that the access request meets a preset condition, the usage score can be processed for scoring. For example, the preset condition can include installing a scoring software, and the like.

[0140] In this way, by displaying a user score page on the user device and dynamically adjusting the usage score according to the abnormal access request, intuitive security state feedback is provided for the user, so that the user can clearly understand the current security status of the client and the influence of the historical access events on the score, thereby enhancing the security awareness and actively adjusting the usage behavior. In addition, the real-time feedback mechanism can timely discover and respond to the abnormal access request, further improving the security and risk warning capability of the system, and effectively protecting the safe operation of the client.

[0141] In some possible implementation manners, during the use of the client by the user device 130, the controller 110 is further configured to:

[0142] detect the usage score of the client;

[0143] in a case where the usage score is less than a target threshold, perform a client offline processing.

[0144] Here, during the use of the client by the user device, the usage score of the client can be detected in real time, and in a case where the usage score is less than a target threshold, the user device can be processed for client offline processing.

[0145] Here, the specific value of the target threshold can be determined according to actual needs, which is not limited here.

[0146] In this way, by dynamically monitoring and risk controlling the security state of the client, when the usage score of the client is lower than the set threshold, the offline processing is automatically performed, which can timely isolate the client with high potential risk and prevent the spread of security threats, thereby effectively protecting the security and stability of the entire system and further improving the risk prevention capability of the system.

[0147] For a clearer illustration of the management process of the zero-trust security access control system, please refer to Figure 2 FIG. 1 shows a schematic diagram of a management process of a zero-trust security access control system according to an example embodiment of the present application. As shown in FIG. 1, Figure 2As shown in the above embodiments, the controller can set the default gateway connected by the switch to one of the plurality of gateways in the case that the deployment of the zero-trust security access control system is completed; create each independent sub-domain, switch to any sub-domain, associate the any sub-domain with one gateway, and open the client download port and the client download permission. The gateway can enable the redirection function and set the address of the download page of the client as the redirection address. The access request initiated by the user equipment to the target address is forwarded to the gateway through the switch.

[0148] The gateway can detect whether there is an online user corresponding to the user equipment. In the case that it is determined that there is a corresponding online user, the user equipment is opened for resource, so that the user equipment performs access to the target address. In the case that it is determined that there is no corresponding online user, the user equipment is controlled to display a guide page for prompting the user to download the client or log in the client, and after receiving the user triggering the downloading client operation, a redirection request is sent to the controller. The controller can send the redirection address to the gateway in the case that the redirection request is received. The gateway can receive the redirection address sent by the controller, adjust the access address of the access request from the target address to the redirection address, so that the access page of the user equipment jumps to the download page. The user equipment can download the installation package of the client through the download page and install the client, and automatically perform the client login processing according to the login information carried by the installation package. For specific description, refer to the foregoing embodiments, which will not be described here.

[0149] In actual application, the controller sets the default gateway connected by the switch to one of the plurality of gateways in the case that the deployment of the zero-trust security access control system is completed, creates each independent sub-domain, switches to any sub-domain, associates the any sub-domain with one gateway, and opens the client download port and the client download permission; the gateway sets the address of the download page of the client as the redirection address, and the above steps can be executed only once without additional processing. In this way, each time the user equipment initiates an access request, the access request can be forwarded to the gateway through the switch, so that the online user is detected and corresponding processing is performed in the case that there is an online user or there is no online user, thereby guaranteeing the implementation of the zero-trust security.

[0150] The zero-trust security access control system provided by the embodiments of the present application realizes efficient client downloading and logging in through the cooperative work of the controller and the gateway. The controller can flexibly set the gateway and divide independent sub-domains. When the gateway detects that the user equipment has no corresponding online user, the gateway can automatically redirect the access request to the downloading page of the client, guide the user equipment to quickly download and install the client, and automatically complete the login according to the login information carried by the installation package without manual intervention, thereby greatly shortening the guiding time of the client access. On the basis of guaranteeing the zero-trust security principle, the efficiency of client downloading and logging in is effectively improved, the time cost, labor cost and communication cost of system management are reduced, the possibility of human operation errors is reduced, and the overall operation efficiency, system usability and management convenience of the system are enhanced.

[0151] Based on the same inventive concept, the zero-trust security access control method applied to the zero-trust security access control system is also provided in the embodiments of the present application. Since the problem solving principle of the zero-trust security access control method in the embodiments of the present application is similar to that of the zero-trust security access control system described above, the implementation of the zero-trust security access control method can be referred to the implementation of the zero-trust security access control system, and the repeated parts will not be described herein.

[0152] Referring to Figure 3 FIG. 3 shows a flowchart of a zero-trust security access control method according to an example embodiment of the present application. The zero-trust security access control method is applied to a zero-trust security access control system, and the zero-trust security access control system includes a controller, a plurality of gateways and a plurality of user equipment. As shown in Figure 3 The zero-trust security access control method provided by the embodiments of the present application includes steps S301-S304, wherein:

[0153] S301: After the deployment of the controller and the plurality of gateways of the zero-trust security access control system is completed, the controller sets the default gateway connected to the switch as one of the plurality of gateways, creates each independent sub-domain, switches to any sub-domain, associates the any sub-domain with a gateway, and enables the gateway to allow the users in the associated sub-domain to access.

[0154] S302: The gateway sets the address of the downloading page of the client as a redirection address.

[0155] S303: After the gateway receives an access request for a target address forwarded by a connected switch from any user equipment, it is detected whether there is an online user corresponding to the user equipment.

[0156] S304: In a case where it is determined that there is no corresponding online user, adjusting, by the gateway, the access address of the access request from the target address to the redirection address, so that the user equipment jumps to the download page when accessing the page.

[0157] In some possible implementation manners, the adjusting, by the gateway, the access address of the access request from the target address to the redirection address in a case where it is determined that there is no corresponding online user comprises:

[0158] In a case where it is determined that there is no corresponding online user, controlling, by the gateway, the user equipment to display a guide page for prompting a user to download a client or log in the client, sending, by the gateway, a redirection request to the controller after receiving a user-triggered operation of downloading the client, and receiving the redirection address sent by the controller, and adjusting the access address of the access request from the target address to the redirection address;

[0159] The method further comprises:

[0160] In a case where the redirection request is received, sending, by the controller, the redirection address to the gateway.

[0161] In some possible implementation manners, the sending, by the controller, the redirection address to the gateway in a case where the redirection request is received comprises:

[0162] In a case where the redirection request is received, obtaining stored login information, the login information being used for logging in the client, the login information comprising a name of a subdomain associated with the gateway, a server address of the controller, and a username and a password of the client;

[0163] Adding the login information to a download link of the client to obtain a modified client download link;

[0164] Generating the redirection address based on the modified client download link, and sending the redirection address to the gateway.

[0165] In some possible implementation manners, the installation package is generated according to the following steps:

[0166] In a case where a client download request is received, obtaining, by the controller, the login information from the modified client download link, and adding the login information to a name of the installation package of the client to generate the installation package.

[0167] In some possible implementation manners, the method further comprises:

[0168] The user equipment downloads the installation package of the client through the download page and installs the client, and automatically performs client login processing according to login information carried by the installation package.

[0169] In some possible implementation manners, the downloading the installation package of the client through the download page and installing the client, and automatically performing client login processing according to login information carried by the installation package comprises:

[0170] The installation package of the client is downloaded through the download page.

[0171] The client is installed based on the installation package.

[0172] The login information is obtained from the name of the installation package, and the login information is filled into a client login page used for logging into the client.

[0173] After receiving a client login request, the login of the client is performed.

[0174] In some possible implementation manners, after the user equipment is controlled to display a guide page used for prompting the user to download the client or log in to the client, the method further comprises:

[0175] After receiving a user-triggered login client operation, a client login page is displayed through the user equipment.

[0176] In some possible implementation manners, after detecting whether there is an online user corresponding to the user equipment, the method further comprises:

[0177] In a case where it is determined that there is a corresponding online user, the user equipment is enabled to open resources, so that the user equipment performs access to the target address.

[0178] In some possible implementation manners, before the redirection address is sent to the gateway, the method further comprises:

[0179] A client download port and a client download permission are opened, and the client download port and the client download permission are used for downloading the client.

[0180] In some possible implementation manners, after logging in to the client, the method further comprises:

[0181] The user equipment displays a user score page, the user score page comprising a use score of the client and a historical access event associated with a historical use score adjustment, the use score being used for indicating a security state of the client.

[0182] If an abnormal access request is detected, points will be deducted from the usage score.

[0183] In some possible implementations, during the user equipment's use of the client, the method further includes:

[0184] The controller detects the client's usage score.

[0185] If the usage score is less than the target threshold, the client is taken offline.

[0186] It should be noted that the method provided in this embodiment of the invention can achieve the same or similar technical effects as the zero-trust security access control system embodiment described above.

[0187] See Figure 4 The diagram shown is a flowchart illustrating another zero-trust security access control method according to an exemplary embodiment of this application. The zero-trust security access control method is applied to the controller in a zero-trust security access control system. Figure 4 As shown in the figure, the zero-trust security access control method provided in this embodiment includes steps S401 to S402, wherein:

[0188] S401: After the controller and multiple gateways of the zero-trust security access control system are deployed, set the default gateway connected to the switch as one of the multiple gateways.

[0189] S402: Create each independent subdomain, switch to any subdomain, and associate the any subdomain with a gateway so that the gateway allows users in the associated subdomain to access it; wherein, the gateway is used to provide automatic client download and login processing for users in each subdomain by controlling the access redirection of users in each subdomain respectively.

[0190] It should be noted that the method provided in the embodiments of the present invention can achieve the same or similar technical effects as the controller embodiment in the zero-trust security access control system described above.

[0191] See Figure 5 The diagram shown is a flowchart illustrating another zero-trust security access control method according to an exemplary embodiment of this application. The zero-trust security access control method is applied to a gateway in a zero-trust security access control system. The gateway is associated with one of the independent subdomains created by the controller and allows users within the associated subdomain to access it. Figure 5 As shown in the figure, the zero-trust security access control method provided in this embodiment includes steps S501 to S503, wherein:

[0192] S501: Set the address of the download page of the client as a redirection address.

[0193] S502: After receiving an access request for a target address forwarded by any user equipment through a connected switch, detect whether there is an online user corresponding to the user equipment.

[0194] S503: In the case where it is determined that there is no corresponding online user, adjust the access address of the access request from the target address to the redirection address, so that the access page of the user equipment jumps to the download page to automatically perform client download login.

[0195] It should be noted that the above method provided by the embodiment of the present application can achieve the same or similar technical effects as the gateway embodiment in the above zero-trust security access control system.

[0196] Those skilled in the art can understand that in the above method of the specific embodiment, the writing order of each step does not mean a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0197] The embodiment of the present disclosure also provides a computer readable storage medium, which stores a computer program. When the computer program is run by a processor, the steps of the zero-trust security access control method described in the above method embodiment are executed. The storage medium can be a volatile or non-volatile computer readable storage medium.

[0198] The embodiment of the present disclosure also provides a computer program product, which stores a computer program. When the computer program is run by a processor, the steps of the zero-trust security access control method provided by any of the above embodiments of the present disclosure are executed. For details, please refer to the above method embodiment, which will not be repeated here.

[0199] The above computer program product can be specifically implemented by hardware, software or a combination thereof. In one optional embodiment, the computer program product is specifically embodied as a computer storage medium, which can be a volatile or non-volatile computer readable storage medium. In another optional embodiment, the computer program product is specifically embodied as a software product, such as a software development kit (Software Development Kit, SDK) and the like.

[0200] Embodiments of the subject matter and the functional operations described in this specification can be implemented in digital electronic circuitry, in tangibly-embodied computer software or firmware, in computer hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible non-transitory program carrier for execution by, or to control the operation of, data processing apparatus. Alternatively or additionally, the program instructions can be encoded on an artificially generated propagated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal that is generated to encode information for transmission to suitable receiver apparatus for execution by a data processing apparatus. The computer storage medium can be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of one or more of them.

[0201] The processes and logic flows described in this specification can be performed by one or more programmable computers executing one or more computer programs to perform functions by operating on input data and generating output. The processes and logic flows can also be performed by special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC (application specific integrated circuit), and the apparatus can be implemented as special purpose logic circuitry.

[0202] Computers suitable for the execution of a computer program include, by way of example, general and / or special purpose microprocessors, or any other kind of central processing unit. Generally, a central processing unit will receive instructions and data from a read-only memory and / or a random access memory. The essential elements of a computer are a central processing unit for performing instructions and one or more memory devices for storing instructions and data. Generally, a computer will also include, or be operatively coupled to receive data from or transfer data to, or both, one or more mass storage devices for storing data, e.g., magnetic, magneto-optical disks, or optical disks. However, a computer need not have such devices. Moreover, a computer can be embedded in another device, e.g., a mobile telephone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a Global Positioning System (GPS) receiver, or a portable storage device (e.g., a universal serial bus (USB) flash drive), to name just a few.

[0203] Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, such as semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices), magnetic disks (e.g., internal hard disks or removable disks), magneto-optical disks, and CD-ROM and DVD-ROM disks. Processors and memory may be supplemented by or incorporated into dedicated logic circuitry.

[0204] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope of the claims, but rather are primarily intended to describe features of specific embodiments of a particular invention. Certain features described in the various embodiments herein may also be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment may also be implemented separately in various embodiments or in any suitable sub-combination. Furthermore, while features may function in certain combinations as described above and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and a claimed combination may refer to a sub-combination or a variation thereof.

[0205] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order shown or sequentially, or requiring all illustrated operations to be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0206] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings are not necessarily shown in a specific order or sequence to achieve the desired result. In some implementations, multitasking and parallel processing may be advantageous.

[0207] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A zero trust security access control system, characterized by, The zero-trust security access control system comprises a controller, a plurality of gateways and a plurality of user equipment; The controller is configured to, in a case where the zero-trust security access control system is deployed, set a default gateway connected by a switch as one of the plurality of gateways, create each independent sub-domain, switch to any sub-domain, associate the any sub-domain with one gateway, and enable the gateway to allow a user in the associated sub-domain to access; The gateway is configured to set an address of a download page of a client as a redirection address; And in a case where an access request for a target address forwarded by any user equipment through the connected switch is received, detect whether there is an online user corresponding to the user equipment, and in a case where it is determined that there is no corresponding online user, adjust an access address of the access request from the target address to the redirection address, so that a page accessed by the user equipment jumps to the download page; The user equipment is configured to download an installation package of the client through the download page and install the client, and automatically perform client login processing according to login information carried by the installation package.

2. The system of claim 1, wherein, In a case where the gateway determines that there is no corresponding online user and adjusts the access address of the access request from the target address to the redirection address, the gateway is specifically configured to, in a case where it is determined that there is no corresponding online user, control the user equipment to display a guide page for prompting a user to download a client or log in to the client, receive a redirection request triggered by the user after the user triggers a download client operation, send the redirection address to the controller, and receive the redirection address sent by the controller to adjust the access address of the access request from the target address to the redirection address. The controller is further configured to, in a case where the redirection request is received, send the redirection address to the gateway.

3. The system of claim 2, wherein, In a case where the controller receives the redirection request, the controller is specifically configured to: In a case where the redirection request is received, obtain stored login information, the login information being used for logging in to the client, the login information comprising a name of a sub-domain associated with the gateway, a server address of the controller, and a username and a password of the client; Add the login information to a download link of the client to obtain a modified client download link; Generate the redirection address based on the modified client download link, and send the redirection address to the gateway.

4. The system of claim 3, wherein, The controller is further configured to generate the installation package according to the following steps: In a case where a client download request is received, obtain the login information from the modified client download link, and add the login information to a name of an installation package of the client to generate the installation package.

5. The system of claim 1, wherein, In a case where the user equipment downloads the installation package of the client through the download page and installs the client, and automatically performs client login processing according to the login information carried by the installation package, the user equipment is specifically configured to: Download the installation package of the client through the download page; Install the client based on the installation package; Obtain the login information from the name of the installation package, and fill the login information to a client login page used for logging in the client; After receiving the client login request, perform the login of the client.

6. The system of claim 2, wherein, The gateway is further used for, after controlling the user equipment to display a guide page used for prompting the user to download the client or log in the client: After receiving the user triggering the login client operation, controlling the user equipment to display the client login page.

7. The system of claim 1, wherein, The gateway is further used for, after detecting whether there is an online user corresponding to the user equipment: In a case where it is determined that there is a corresponding online user, open resources of the user equipment, so that the user equipment performs the access to the target address.

8. The system of claim 1, wherein, The controller is further used for, before sending the redirection address to the gateway: Open a client download port and a client download permission, which are used for downloading the client.

9. The system according to any of claims 1-8, characterized in that, After logging in the client, the user equipment is further used for: Display a user score page, the user score page including a use score of the client and a historical access event associated with a historical use score adjustment, the use score being used for indicating a security state of the client; In a case where an abnormal access request is detected, perform a demerit processing on the use score.

10. The system of any of claims 1-8, wherein, In a process where the user equipment uses the client, the controller is further used for: Detect a use score of the client; In a case where the use score is less than a target threshold, perform a client offline processing.

11. A zero trust security access control method, characterized in that, Applied to a zero trust security access control system, the method comprises: After deployment of a controller and a plurality of gateways of the zero trust security access control system is completed, set a default gateway connected by a switch to one of the plurality of gateways through the controller, create each independent sub-domain, switch to any sub-domain, associate the any sub-domain with one gateway, so that the gateway allows users in the associated sub-domain to access; Set an address of a download page of the client to a redirection address through the gateway; After the gateway receives an access request for a target address forwarded by a connected switch from any user equipment, detect whether there is an online user corresponding to the user equipment; In a case where it is determined that there is no corresponding online user, adjust an access address of the access request from the target address to the redirection address through the gateway, so that an access page of the user equipment jumps to the download page.

12. A zero trust security access control method, characterized in that, Applied to a controller, the method comprises: After deployment of a controller and a plurality of gateways of the zero trust security access control system is completed, set a default gateway connected by a switch to one of the plurality of gateways; Create each independent sub-domain, switch to any sub-domain, associate the any sub-domain with one gateway, so that the gateway allows users in the associated sub-domain to access; wherein the gateway is used for providing a client automatic download login processing for users in each sub-domain by respectively controlling access redirection of the users in each sub-domain.

13. A zero trust security access control method, characterized in that, The method applied to a gateway associated with one of the independent sub-domains created by a controller and allowing a user in the associated sub-domain to access, and the method comprises: setting an address of a download page of the client as a redirection address; after receiving an access request for a target address forwarded by any user equipment through a connected switch, detecting whether there is an online user corresponding to the user equipment; in a case where it is determined that there is no corresponding online user, adjusting an access address of the access request from the target address to the redirection address, so that an access page of the user equipment jumps to the download page to automatically perform client download login.

Images