Distributed zero-trust micro-segmentation access control method and system

Abstract

Disclosed in the present application are a distributed zero-trust micro-segmentation access control method and system. The method comprises: a user end initiating a resource authorization request to a security center, so as to make the security center apply for an authentication key identifier corresponding to an authorized access resource from a quantum key distribution network, and generate an SDP policy; receiving the SDP policy returned by the security center, and on the basis of the SDP policy, establishing a security channel with an SDP gateway, so as to access the authorized access resource; on the basis of the authentication key identifier, acquiring from the quantum key distribution network a corresponding authentication key, and using the authentication key to calculate a hash value of resource information; and sending the hash value and the authentication key identifier to the authorized access resource, so as to allow this access after the authorized access resource acquires from the quantum key distribution network the corresponding authentication key to authenticate the identity of the user end and the user end passes identity authentication. The present application implements the last stage of micro-segmentation in a zero-trust process by using identity authentication and access control methods based on cryptography technology.

Description

Distributed zero-trust micro-isolation access control method and system

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on August 9, 2023, with application number 202310996548.5 and invention name “Distributed Zero Trust Micro-Isolation Access Control Method and System”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of cryptographic application technology, and specifically to a distributed zero-trust micro-isolation access control method and system. Background Art

[0003] Zero Trust "micro-segmentation" divides an unstructured, borderless network into numerous logically small segments, ensuring that each segment has only one computing resource. All traffic entering and exiting this micro-segment must pass through access control devices. This creates a fully controllable zero-trust network within a network without any access control capabilities, allowing each resource to be logically isolated from all others. This technology allows IT experts to define specific security settings for different types of data flows and create specialized security policies to restrict network and application flows between various workflows.

[0004] Zero-trust solutions generally use SDP gateways (Software Defined Perimeter, based on the zero-trust concept) and TLS (Transport Layer Security Protocol) to authenticate the entity issuing the access request and protect the channel. Accessed resources are then subject to fine-grained access control via a front-end firewall or reverse proxy. These solutions have the following shortcomings:

[0005] (1) There is a last-centimeter security risk, and there is still an attack surface between the firewall and reverse proxy and the accessed resources.

[0006] (2) Only through access control means, the data connection after the TLS connection is terminated by the SDP gateway still has the possibility of illegal authorization.

[0007] In the related technology, the patent application document with publication number CN115567210A proposes a method for achieving zero-trust access using quantum key distribution. This scheme implements mandatory access control on resources protected by zero-trust gateways based on quantum key distribution and symmetric cryptography technology. It distributes pre-shared master keys using a quantum key distribution (QKD) network, does not directly encrypt data, and is only used for the distribution and protection of data encryption keys. The communication data message from the user to the gateway carries the ciphertext of the data encryption key and the master key ID, and the message is grouped and symmetrically encrypted, while there is no special protection from the gateway to the accessed resources.

[0008] Summary of the Invention

[0009] The technical problem to be solved by this application is how to implement micro-isolation, the last stage in the zero-trust process.

[0010] This application solves the above technical problems through the following technical means:

[0011] In the first aspect, the present application proposes a distributed zero-trust micro-isolation access control method, which is applied to the user end. The method includes:

[0012] The user terminal initiates a resource authorization request to the security center, so that the security center applies to the quantum key distribution network for the authentication key identifier corresponding to the authorized access resource and generates an SDP policy;

[0013] Receive the SDP policy returned by the security center, and establish a secure channel with the SDP gateway based on the SDP policy to access authorized resources;

[0014] Obtaining a corresponding authentication key from the quantum key distribution network based on the authentication key identifier, and calculating a hash value of resource information using the authentication key;

[0015] The hash value and the authentication key identifier are sent to the authorized access resource, so that the authorized access resource can obtain the corresponding authentication key from the quantum key distribution network to authenticate the identity of the user terminal and allow this access.

[0016] Secondly, this application proposes a distributed zero-trust micro-isolation access control method, which is applied to a security center. The method includes:

[0017] Receive a resource authorization request sent by a user terminal, and generate a task ID based on the resource authorization request, wherein the task ID is bound to the identifier of the user terminal, the QKD node to which the user terminal belongs, the identifier of the resource to which the user is authorized to access, and the QKD node to which the user is authorized to access the resource;

[0018] For each task ID, send an authentication key request to the corresponding QKD node to which the authorized access resource belongs, so that the QKD node to which the authorized access resource belongs sends the authentication key and its authentication key identifier to the QKD node on the user end;

[0019] Receive the authentication key identifier returned by the QKD node to which the resource to which access is authorized belongs, and generate an SDP policy based on the authentication key identifier and send it to the user end and SDP gateway so that the user end and SDP gateway establish a channel for accessing the authorized resource based on the SDP policy.

[0020] In a third aspect, this application proposes a distributed zero-trust micro-isolation access control method, which is applied to the accessed resource party. The method includes:

[0021] intercepting, by the service grid, a resource access request sent by a user terminal to a resource that is authorized to access, the resource access request carrying information including a first hash value of resource information calculated using an authentication key and an authentication key identifier;

[0022] Obtaining a corresponding authentication key from a quantum key distribution network according to the authentication key identifier, and calculating a second hash value of the resource information based on the authentication key;

[0023] comparing the second hash value with the first hash value to authenticate the user terminal;

[0024] After the identity authentication is passed, access permission information is sent to the user terminal.

[0025] In a fourth aspect, the present application proposes a user terminal in which a zero-trust agent runs, and the zero-trust agent is used to execute the distributed zero-trust micro-isolation access control method proposed in the first aspect of the present application.

[0026] In a fifth aspect, the present application proposes a security center, which includes:

[0027] An identity authentication module is configured to receive a resource authorization request from a user terminal and generate a task ID based on the resource authorization request. The task ID is bound to the user terminal's identifier, the QKD node to which the user terminal belongs, the identifier of the resource to which the user is authorized to access, and the QKD node to which the user is authorized to access the resource;

[0028] The SDP controller is used to send an authentication key request to the QKD node to which the corresponding authorized access resource belongs for each task ID, so that the QKD node to which the authorized access resource belongs sends the authentication key and its authentication key identifier to the QKD node of the user end; and receive the authentication key identifier returned by the QKD node to which the authorized access resource belongs, and generate an SDP policy based on the authentication key identifier and send it to the user end and the SDP gateway so that the user end and the SDP gateway establish a channel for accessing the authorized resource based on the SDP policy.

[0029] In the sixth aspect, the present application proposes an accessed resource party, in which a service grid runs, and the service grid is used to execute the distributed zero-trust micro-isolation access control method proposed in the third aspect of the present application.

[0030] In a seventh aspect, the present application proposes a distributed zero-trust micro-isolation access control system, the system including a user terminal, an accessed resource party, a security center, and a quantum key distribution network, the user terminal and the accessed resource party are connected via an SDP gateway, the user terminal, the accessed resource party, and the security center are all connected to the quantum key distribution network, and the user terminal is connected to the security center, wherein:

[0031] The user terminal runs a zero-trust agent for initiating a resource authorization request to the security center;

[0032] The security center is configured to apply to the quantum key distribution network for an authentication key identifier corresponding to the resource authorized for access based on the resource authorization request sent by the user terminal, generate an SDP policy, and issue it to the user terminal and the SDP gateway, so that the user terminal and the SDP gateway establish a secure channel for accessing the authorized resource based on the SDP policy;

[0033] The accessed resource party runs a service grid for obtaining an authentication key from the quantum key distribution network to authenticate the last segment of the user terminal's access behavior and directly authorize access to the authorized access resource party.

[0034] The advantages of this application are:

[0035] (1) This application implements access control on the server of the accessed resource, and runs on the same physical device and operating system as the accessed resource, solving the last centimeter security problem. Specifically, the user end accesses the authorized access resource based on the secure channel between the user end and the SDP gateway, combined with the authentication key and cryptographic hash technology generated by the quantum key distribution network. The accessed resource identifies and controls the access behavior of the user end in combination with the authentication key and cryptographic hash technology generated by the quantum key distribution network, and adopts identity authentication and access control methods based on cryptographic technology to realize the last micro-isolation in the zero trust process. Compared with traditional zero trust solutions, it has certain advantages in access control strength and granularity, key management, business transparency, security, etc.

[0036] (2) The QKD network is used to distribute data encryption keys, which are directly used for access control of resources. It not only protects and authenticates the communication data packets from users to the gateway, but also uses keyed hash calculations to perform secondary identity authentication on resource access requests from the gateway to the accessed resources. There is no last-centimeter security issue.

[0037] (3) There is no attack surface between the service mesh deployed in the accessed resources in a sidecar manner and the accessed resources.

[0038] (4) After the TLS secure channel connection is terminated at the SDP gateway, the data connection for resource access must be authenticated by a keyed password, eliminating the possibility of illegal authorization.

[0039] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0041] FIG1 is a flow chart of a distributed zero-trust micro-isolation access control method proposed in the first embodiment of the present application;

[0042] FIG2 is a flow chart of a distributed zero-trust micro-isolation access control method proposed in the second embodiment of the present application;

[0043] FIG3 is a flow chart of a distributed zero-trust micro-isolation access control method proposed in the third embodiment of the present application;

[0044] FIG4 is a schematic diagram of the structure of a security center proposed in the fifth embodiment of the present application;

[0045] FIG5 is a schematic diagram of the structure of a distributed zero-trust micro-isolation access control system proposed in the seventh embodiment of the present application;

[0046] Figure 6 is a schematic diagram of the workflow of a distributed zero-trust micro-isolation access control system proposed in the seventh embodiment of the present application.

[0047] FIG7 schematically shows a block diagram of a computing processing device for executing the method according to the present application; and

[0048] FIG8 schematically shows a storage unit for storing or carrying program codes for implementing the method according to the present application. Specific embodiments

[0049] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0050] Example 1

[0051] As shown in FIG1 , the first embodiment of the present application discloses a distributed zero-trust micro-isolation access control method, which is applied to a user terminal and includes the following steps:

[0052] S101: A user terminal initiates a resource authorization request to a security center, so that the security center applies to a quantum key distribution network for an authentication key identifier corresponding to the resource to be authorized to access, and generates an SDP policy.

[0053] S102: Receive the SDP policy returned by the security center, and establish a secure channel with the SDP gateway based on the SDP policy to access authorized resources;

[0054] S103, obtaining a corresponding authentication key from the quantum key distribution network based on the authentication key identifier, and calculating a hash value of resource information using the authentication key;

[0055] S104: Send the hash value and the authentication key identifier to the authorized access resource, so that the authorized access resource can obtain the corresponding authentication key from the quantum key distribution network to authenticate the identity of the user terminal and allow the access.

[0056] In this embodiment, the user terminal sends a resource authorization request to the security center and receives the SDP policy returned by the security center, thereby establishing secure channel access with the SDP gateway, and accessing the authorized resources in combination with the authentication key and cryptographic hash technology generated by the quantum key distribution network. The accessed resources use the authentication key and cryptographic hash technology generated by the quantum key distribution network to authenticate and control the access behavior of the user terminal, and use identity authentication and access control methods based on cryptographic technology to achieve the last micro-isolation in the zero-trust process.

[0057] In one embodiment, step S101: the user terminal initiates a resource authorization request to the security center, so that the security center applies to the quantum key distribution network for an authentication key identifier corresponding to the resource authorized for access and generates an SDP policy, specifically including:

[0058] A resource authorization request is initiated to the security center. The resource authorization request carries information including the identifier and security status of the user terminal initiating the access behavior, so that the security center can evaluate the security status and determine the resources authorized for access by the user terminal, and apply to the quantum key distribution network for the authentication key identifier corresponding to the authorized access resource to generate the SDP policy.

[0059] Specifically, the entity that initiates the access behavior, such as the user terminal, initiates identity authentication to the security center and reports the security status; so that the security center can authenticate the identity of the entity that initiates the access behavior, and perform a security assessment based on the security status of the entity that initiates the access behavior, and determine the resources authorized to access based on the assessment results.

[0060] The security center determines the QKD node of the access party to which the user belongs based on the identification information of the user terminal (IP or URI, etc.), and determines each QKD node of the resource party to which the user is authorized to access the resource based on the identification information of the resource authorized to the user terminal (IP or URI, etc.). The security center generates a system-wide unique task ID (Identity document, identification) for each pair of access entity and authorized resource (methods such as UUID can be used), and binds it to the user terminal initiating the access, the QKD node of the access party to which the user terminal belongs, the authorized resource, and the QKD node of the resource party to which the authorized resource belongs. The security center applies for an authentication key from the corresponding resource party QKD node for each task and generates an SDP policy based on the authentication key.

[0061] It should be noted that the quantum key distribution network includes QKD nodes and a quantum network link control center, which realizes services such as quantum key generation, quantum key relay, and quantum key provision; the user terminal and the accessed resources are connected to the corresponding QKD nodes in the quantum key distribution network. The QKD nodes are responsible for key distribution within the domain and key transmission between domains. The transmission of inter-domain session keys on the QKD key distribution channel is considered safe. Directly connected QKD nodes transmit and synchronize keys through the quantum network QKD link, and non-directly connected QKD nodes transmit and synchronize keys through the quantum key distribution network and trusted relays.

[0062] In one embodiment, step S102: receiving the SDP policy returned by the security center, and establishing a secure channel with the SDP gateway based on the SDP policy to access authorized resources, includes the following steps:

[0063] S121. Receive the SDP policy returned by the security center, where the SDP policy includes an authentication key identifier corresponding to each authorized access resource;

[0064] S122. Based on the SDP policy, establish a TLS secure channel with the SDP gateway through the zero-trust agent, and access authorized access resources through the TLS secure channel.

[0065] It should be noted that the zero-trust agent runs on the device or application on the user side and is responsible for implementing security functions such as identity authentication, security information collection and reporting, SDP policy issuance, TLS channel establishment, and micro-grid authentication for the entity initiating access.

[0066] In this embodiment, the user end that initiates the access behavior establishes a TLS secure channel through the zero-trust agent and the SDP gateway, and accesses the network where the accessed resource is located through the secure channel, and further connects to the accessed resource; after the TLS connection is terminated by the SDP gateway, the data connection for resource access must also be authenticated by a keyed password, and there is no possibility of illegal authorization.

[0067] In one embodiment, step S103: obtaining a corresponding authentication key from the quantum key distribution network based on the authentication key identifier, and calculating a hash value of resource information using the authentication key, includes the following steps:

[0068] S131. Obtaining a corresponding authentication key from the quantum key distribution network based on the authentication key identifier through a zero-trust agent;

[0069] S132. Calculate a hash value of the resource information using the authentication key and a keyed cryptographic hash algorithm, where the resource information includes: a key identifier, a source IP (Internet Protocol Address), a source port, a destination IP, and a predefined padding string representing a concatenation.

[0070] In one embodiment, in step S104, after sending the hash value and the authentication key identifier to the authorized access resource, the method further includes the following steps:

[0071] Receiving access permission information returned by the authorized access resource, where the access permission information is generated after the authorized access resource obtains the corresponding authentication key from the quantum key distribution network to authenticate the identity of the user terminal;

[0072] Receive access denial information returned by the authorized access resource, where the access denial information is generated after the authorized access resource fails to authenticate the identity of the user terminal by obtaining the corresponding authentication key from the quantum key distribution network.

[0073] In one embodiment, the user terminal stores a pre-shared master key pre-filled by the quantum key distribution network, and the method further includes:

[0074] When the user terminal communicates with the corresponding QKD node in the quantum key distribution network, the pre-shared master key is used for protection.

[0075] It should be noted that the transmission channel between the QKD node and all business nodes connected to the QKD node in the domain (such as user terminals) is protected by master key encryption, and the master key is copied to each business node through a secure medium. The communication (key distribution) between the QKD node and the business node is protected by the master key to improve the security of key distribution.

[0076] Example 2

[0077] As shown in FIG2 , the second embodiment of the present application discloses a distributed zero-trust micro-isolation access control method, which is applied to a security center. The method includes the following steps:

[0078] S201. Receive a resource authorization request sent by a user terminal, and generate a task ID based on the resource authorization request. The task ID is bound to the user terminal identifier, the QKD node to which the user terminal belongs, the identifier of the resource to which the user terminal is authorized to access, and the QKD node to which the resource to which the user terminal is authorized to access belongs.

[0079] S202: For each task ID, send an authentication key request to the corresponding QKD node to which the authorized access resource belongs, so that the QKD node to which the authorized access resource belongs sends the authentication key and its authentication key identifier to the QKD node of the user end;

[0080] S203. Receive the authentication key identifier returned by the QKD node to which the resource to which access is authorized belongs, and generate an SDP policy based on the authentication key identifier and send it to the user terminal and the SDP gateway so that the user terminal and the SDP gateway establish a channel for accessing the authorized resource based on the SDP policy.

[0081] In this embodiment, the security center determines the resources authorized to be accessed by the user based on the resource authorization request sent by the user, and applies to the quantum key distribution network for the authentication key corresponding to the authorized access resource. The SDP policy is generated based on the authentication key, so that the user and the SDP gateway establish a channel for accessing the authorized resources based on the SDP policy, thereby realizing the user's access to the resources.

[0082] In one embodiment, the step S201 of receiving a resource authorization request sent by a user terminal and generating a task ID based on the resource authorization request includes the following steps:

[0083] S211. Accept a resource authorization request sent by a user terminal, where the resource authorization request carries information including an identifier and security status of the user terminal initiating the access behavior.

[0084] S212: Perform a security assessment on the security status of the user terminal, and determine the resources that are authorized to be accessed based on the assessment result;

[0085] S213. Determine the QKD node to which the user terminal belongs based on the identifier of the user terminal, and determine the QKD node to which the authorized access resource belongs based on the identifier of the authorized access resource;

[0086] S214: Generate a task ID for the user terminal that initiates the access behavior and the corresponding authorized access resource.

[0087] Specifically, the security center authenticates the entity initiating the access behavior, conducts a security assessment based on the security status of the entity initiating the access behavior, and determines the resources authorized to access based on the assessment results. The security center determines the QKD node of the access party based on the entity's identification information (IP or URI, etc.), and determines each QKD node of the resource party to which the entity belongs based on the resource identifier (IP or URI, etc.) authorized to the entity. The security center generates a system-wide unique task ID (using methods such as UUID) for each pair of access entity and authorized resource, and binds it to the entity initiating the access, the QKD node of the access party to which the entity belongs, the authorized resource, and the QKD node of the resource party to which the authorized resource belongs.

[0088] In one embodiment, the authentication key identifier is ID_QKDSeq_Key, ID_QKD is the identifier of the QKD node to which the resource is authorized to be accessed, and Seq_Key is the serial number of the authentication key. That is, the authentication key identifier is obtained by concatenating the identifier of the quantum key distribution node to which the resource is authorized to be accessed and the serial number of the authentication key.

[0089] Specifically, the entire center applies for an authentication key from the corresponding resource-side QKD node for each task; the resource-side QKD node generates an authentication key for the task ID, which is identified by the QKD node identifier plus the key serial number, i.e., ID_QKDSeq_Key. It also initiates quantum key transmission (a QKD link is directly connected between the two QKD nodes) or trusted relay (a QKD link is not directly connected between the two QKD nodes) to the access-side QKD node, synchronizes the authentication key and its key identifier to the access-side QKD node, and returns the key identifier to the security center; the security center sends the corresponding SDP policy to the entity that initiates the access and the SDP gateway, where the SDP policy sent to the entity includes the authentication key identifier corresponding to each authorized resource.

[0090] Example 3

[0091] As shown in FIG3 , the third embodiment of the present application discloses a distributed zero-trust micro-isolation access control method, which is applied to the accessed resource party. The method includes the following steps:

[0092] S301. Intercepting, through a service grid, a resource access request sent by a user terminal to a resource to which access is authorized, the resource access request carrying information including a first hash value of resource information calculated using an authentication key and an authentication key identifier;

[0093] S302. Obtain a corresponding authentication key from the quantum key distribution network according to the authentication key identifier, and calculate a second hash value of the resource information based on the authentication key;

[0094] S303: Compare the second hash value with the first hash value to authenticate the user terminal;

[0095] S304: After the identity authentication is passed, the access permission information is sent to the user terminal.

[0096] It should be noted that the service grid running on the accessed resource intercepts the first hash value and key identifier sent by the user, obtains the authentication key for this task from the corresponding resource party's QKD node based on the key identifier, and uses the authentication key to calculate the second hash value of the resource information to authenticate the entity initiating the access behavior. After the authentication (comparison verification) is passed, access to the protected resource is allowed. By configuring a dedicated service grid for the accessed resource and combining quantum key distribution and cryptographic hashing technology to authenticate and control access behavior, cryptographic-based identity authentication and access control methods are used to achieve the last micro-isolation in the zero-trust process. There is no last-centimeter security risk, and there is no attack surface between the service grid deployed in a sidecar manner and the accessed resource.

[0097] In one embodiment, the resource information includes a key identifier, a source IP, a source port, a destination IP, a destination IP, and a predefined fill character string.

[0098] In one embodiment, the accessed resource party is connected to a corresponding QKD node in the quantum key distribution network.

[0099] In one embodiment, the accessed resource stores a pre-shared master key pre-filled via the quantum key distribution network, and the method further includes:

[0100] When the accessed resource party communicates with the corresponding QKD node in the quantum key distribution network, the pre-shared master key is used for protection.

[0101] In one embodiment, after the resource access is completed, the method further includes:

[0102] A key destruction request is sent to the QKD node of the accessed resource through the service grid, so that the corresponding QKD node destroys the authentication key corresponding to this access task.

[0103] Example 4

[0104] Based on the content disclosed in the above-mentioned embodiment 1, this embodiment provides a corresponding user terminal, in which a zero-trust agent runs, and the zero-trust agent is used to execute the distributed zero-trust micro-isolation access control method as described in embodiment 1.

[0105] It should be noted that other embodiments of the user terminal described in this application or implementation methods can refer to the above-mentioned method embodiment 1, which will not be repeated here.

[0106] Example 5

[0107] As shown in FIG4 , the fifth embodiment of the present application discloses a security center, which includes:

[0108] The identity authentication module 11 is used to receive a resource authorization request sent by a user terminal and generate a task ID based on the resource authorization request. The task ID is bound to the user terminal identifier, the QKD node to which the user terminal belongs, the identifier of the resource to which the user terminal is authorized to access, and the QKD node to which the user terminal belongs;

[0109] The SDP controller 12 is used to send an authentication key request to the corresponding QKD node to which the authorized access resource belongs for each task ID, so that the QKD node to which the authorized access resource belongs sends the authentication key and its authentication key identifier to the QKD node of the user end; and receives the authentication key identifier returned by the QKD node to which the authorized access resource belongs, and generates an SDP policy based on the authentication key identifier and sends it to the user end and the SDP gateway so that the user end and the SDP gateway establish a channel for accessing the authorized resource based on the SDP policy.

[0110] In one embodiment, the identity authentication module 11 includes:

[0111] A resource authorization request unit, configured to accept a resource authorization request sent by a user terminal, wherein the resource authorization request carries information including the identifier and security status of the user terminal initiating the access behavior;

[0112] a resource determination unit, configured to perform a security assessment on the security status of the user terminal and determine the resources that are authorized to be accessed based on the assessment result;

[0113] A QKD node determination unit, configured to determine the QKD node to which the user terminal belongs according to the identifier of the user terminal, and determine the QKD node to which the authorized access resource belongs according to the identifier of the authorized access resource;

[0114] The task ID generating unit is used to generate a task ID for the user terminal that initiates the access behavior and the corresponding authorized access resource.

[0115] It should be noted that other embodiments or implementation methods of the security center described in this application can refer to the above-mentioned method embodiment 2, which will not be repeated here.

[0116] Example 6

[0117] Based on the content disclosed in the above-mentioned embodiment 3, this embodiment provides a corresponding accessed resource party, in which a service grid runs, and the service grid is used to execute the distributed zero-trust micro-isolation access control method as described in embodiment 3.

[0118] It should be noted that other embodiments or implementation methods of the accessed resource party described in this application can refer to the above-mentioned method embodiment 3, which will not be repeated here.

[0119] Example 7

[0120] As shown in FIG5 , the seventh embodiment of the present application discloses a distributed zero-trust micro-isolation access control system, the system including a user terminal, an accessed resource party, a security center, and a quantum key distribution network, the user terminal and the accessed resource party are connected via an SDP gateway, the user terminal, the accessed resource party, and the security center are all connected to the quantum key distribution network, and the user terminal is connected to the security center, wherein:

[0121] The user terminal runs a zero-trust agent for initiating a resource authorization request to the security center;

[0122] The security center is configured to apply to the quantum key distribution network for an authentication key identifier corresponding to the resource authorized for access based on the resource authorization request sent by the user terminal, generate an SDP policy, and issue it to the user terminal and the SDP gateway, so that the user terminal and the SDP gateway establish a secure channel for accessing the authorized resource based on the SDP policy;

[0123] The accessed resource party runs a service grid for obtaining an authentication key from the quantum key distribution network to authenticate the last segment of the user terminal's access behavior and directly authorize access to the authorized access resource party.

[0124] Specifically, the zero-trust agent runs on the device or application on the user side, and is responsible for implementing security functions such as identity authentication, security information collection and reporting, SDP policy issuance, TLS channel establishment, and micro-grid authentication for the entity initiating access.

[0125] A service mesh operates as a sidecar network service proxy on devices or application services near the accessed resource. It provides security functions such as routing, flow control, identity authentication, access control, and traffic analysis. It acts as a secure proxy for a single resource, enabling micro-isolation of that resource. In this embodiment, the service mesh uses keys obtained from the QKD node to authenticate the accessing entity at the final stage of the access and directly authorize access to the protected single resource.

[0126] The security center includes an SDP controller and an identity authentication module. It authenticates the identity of the entity initiating access and conducts a security assessment based on the security status of the entity initiating access. After determining the resources authorized for access based on the assessment results, the corresponding SDP policy is sent to the entity initiating access and the SDP gateway.

[0127] The SDP gateway is used to establish a TLS secure channel with the zero-trust agent based on the SDP policy sent by the security center, encrypt traffic, and perform access control on the entity initiating the access behavior;

[0128] The quantum key distribution network includes QKD nodes and a quantum network link control center, which realizes services such as quantum key generation, quantum key relay, and quantum key provision; the quantum network link control center can establish quantum key distribution and relay links between nodes according to the QKD node ID.

[0129] The QKD node is responsible for key distribution within the domain and key transmission between domains. The transmission of inter-domain session keys on the QKD key distribution channel is considered secure. Key transmission and synchronization are performed between directly connected QKD nodes through the quantum network QKD link, and key transmission and synchronization are performed between indirectly connected QKD nodes through the quantum key distribution network and trusted relays. The user terminal and the accessed resource both store a pre-shared master key pre-filled by the quantum key distribution network. The transmission channel between the QKD node and all service nodes connected to the QKD node in the domain (such as the user terminal and the accessed resource) is protected by master key encryption, and the master key is copied to each service node through a secure medium. The communication (key distribution) between the QKD node and the service node is protected by the master key.

[0130] Furthermore, as shown in FIG6 , the workflow of the distributed zero-trust micro-isolation access control system disclosed in this embodiment includes:

[0131] (1) In the initialization phase, a service grid is installed for each resource being accessed, a zero-trust agent is installed for the entity initiating the access behavior, and a secure medium is used to inject multiple pre-shared master keys used for secure connection with the local QKD node offline into the service grid and the zero-trust agent.

[0132] (2) The entity that initiates the access behavior initiates identity authentication to the security center and reports the security status.

[0133] (3) The security center authenticates the entity initiating the access behavior and conducts a security assessment based on the security status of the entity initiating the access behavior. Based on the assessment results, the security center determines the QKD node of the access party based on the entity's identification information (IP or URI, etc.) and determines each QKD node of the resource party based on the resource identification (IP or URI, etc.) authorized to the entity.

[0134] (4) The security center generates a system-wide unique task ID for each access entity-authorized resource pair (using methods such as UUID), and binds it to the entity initiating the access, the access party QKD node to which the entity belongs, the authorized resource, and the resource party QKD node to which the authorized resource belongs. The security center applies for an authentication key from the corresponding resource party QKD node for each task.

[0135] (5) The resource QKD node generates an authentication key for the task ID. The key is identified by the QKD node identifier plus the key serial number, i.e., ID_QKDSeq_Key. The resource QKD node initiates quantum key transmission (if there is a direct QKD link between the two QKD nodes) or trusted relay (if there is no direct QKD link between the two QKD nodes) to the access QKD node, synchronizes the authentication key and its key identifier to the access QKD node, and returns the key identifier to the security center.

[0136] (6) The security center sends the corresponding SDP policy to the entity that initiates the access behavior and the SDP gateway. The SDP policy sent to the entity includes the authentication key identifier corresponding to each authorized resource.

[0137] (7) The entity that initiates the access behavior establishes a TLS secure channel through the zero-trust agent and SDP gateway, and accesses the network where the accessed resource is located through the secure channel to further connect to the accessed resource.

[0138] (8) The entity that initiates the access behavior obtains the authentication key from the accessing party's QKD node through the zero-trust agent based on the authentication key identifier of the accessed resource, and uses the authentication key and the key-based cryptographic hash algorithm to calculate the hash value of the following data: key identifier source IP source port destination IP destination IP predefined filling string, and sends the hash value and key identifier together to the accessed resource.

[0139] (9) The service grid of the accessed resource intercepts the above hash value and key identifier, obtains the authentication key of this task from the resource party QKD based on the key identifier, calculates the hash value in the same way as in step (8), and authenticates the entity that initiates the access behavior. After the authentication (comparison verification) is passed, the access to the protected resource is allowed.

[0140] (10) After the above access task is completed, the service grid notifies the resource party's QKD node to destroy the authentication key and other information corresponding to the task ID.

[0141] This embodiment configures an exclusive service grid for accessed resources, and combines quantum key distribution and cryptographic hashing technology to identify and control access behavior, realizing the last stage of micro-isolation in the zero-trust process. Compared with traditional zero-trust solutions, it has certain advantages in access control strength and granularity, key management, business transparency, and security.

[0142] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present application. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0143] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of such features. Throughout the description of this application, "plurality" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0144] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

[0145] The various component embodiments of the present application can be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. It will be appreciated by those skilled in the art that a microprocessor or a digital signal processor (DSP) can be used in practice to implement some or all of the functions of some or all of the components in the computing processing equipment according to the embodiment of the present application. The application can also be implemented as a device or apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0146] For example, FIG7 illustrates a computing device that can implement the methods according to the present application. The computing device typically includes a processor 1010 and a computer program product or computer-readable medium in the form of a memory 1020. Memory 1020 can be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, a hard disk, or ROM. Memory 1020 has storage space 1030 for program code 1031 for executing any of the method steps described above. For example, storage space 1030 for program code can include individual program codes 1031 for implementing various steps in the method described above. These program codes can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards, or floppy disks. Such computer program products are typically portable or fixed storage units, as described with reference to FIG8 . This storage unit can have storage segments, storage space, and the like arranged similarly to memory 1020 in the computing device of FIG7 . The program code can, for example, be compressed in a suitable form. Typically, the storage unit includes computer-readable code 1031 , ie, code that can be read by a processor such as 1010 , which, when executed by a computing processing device, causes the computing processing device to perform the steps of the method described above.

[0147] References herein to "one embodiment," "an embodiment," or "one or more embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present application. Furthermore, please note that instances of the phrase "in one embodiment" do not necessarily all refer to the same embodiment.

[0148] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0149] In the claims, any reference signs placed between parentheses shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present application may be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names.

[0150] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A distributed zero-trust micro-isolation access control method, wherein: Applied to a user terminal, the method includes: The user terminal initiates a resource authorization request to the security center, so that the security center applies to the quantum key distribution network for the authentication key identifier corresponding to the authorized access resource, and generates a software-defined boundary policy based on the zero trust concept; Receive the software-defined border policy based on the zero-trust concept returned by the security center, and establish a secure channel with the software-defined border gateway based on the zero-trust concept based on the software-defined border policy based on the zero-trust concept to access authorized access resources; Obtaining a corresponding authentication key from the quantum key distribution network based on the authentication key identifier, and calculating a hash value of resource information using the authentication key; The hash value and the authentication key identifier are sent to the authorized access resource, so that the authorized access resource can obtain the corresponding authentication key from the quantum key distribution network to authenticate the identity of the user terminal and allow the access.

2. The distributed zero-trust micro-isolation access control method according to claim 1, wherein: The user terminal initiates a resource authorization request to the security center, so that the security center applies to the quantum key distribution network for the authentication key identifier corresponding to the authorized access resource, and generates a software-defined boundary policy based on the zero trust concept, including: A resource authorization request is initiated to the security center. The resource authorization request carries information including the identifier and security status of the user terminal that initiates the access behavior, so that the security center evaluates the security status and determines the resources authorized for access by the user terminal, and applies to the quantum key distribution network for the authentication key identifier corresponding to the authorized access resource, and generates a software-defined boundary policy based on the zero-trust concept.

3. The distributed zero-trust micro-isolation access control method according to claim 1, wherein: The receiving the software-defined border policy based on the zero-trust concept returned by the security center, and establishing a secure channel with the software-defined border gateway based on the zero-trust concept based on the software-defined border policy based on the zero-trust concept to access the authorized access resources, including: Receive the software-defined boundary policy based on the zero-trust concept returned by the security center, where the software-defined boundary policy based on the zero-trust concept includes an authentication key identifier corresponding to each authorized access resource; Based on the software-defined border strategy based on the zero-trust concept, a secure transport layer protocol security is established through the zero-trust agent and the software-defined border gateway based on the zero-trust concept. channel and is authorized to access resources through the secure channel access of the secure transport layer protocol.

4. The distributed zero-trust micro-isolation access control method according to claim 1, wherein: The obtaining a corresponding authentication key from the quantum key distribution network based on the authentication key identifier, and calculating a hash value of resource information using the authentication key, includes: Obtaining a corresponding authentication key from the quantum key distribution network based on the authentication key identifier through a zero-trust agent; The authentication key and a keyed cryptographic hash algorithm are used to calculate a hash value of the resource information, wherein the resource information includes a key identifier, a source address, a source port, a destination address, a destination address, and a predefined fill character string.

5. The distributed zero-trust micro-isolation access control method according to claim 1, wherein: After sending the hash value and the authentication key identifier to the authorized access resource, the method further includes: Receiving access permission information returned by the authorized access resource, wherein the access permission information is generated after the authorized access resource obtains the corresponding authentication key from the quantum key distribution network to authenticate the identity of the user terminal; Receive access denial information returned by the authorized access resource, where the access denial information is generated after the authorized access resource fails to authenticate the identity of the user terminal by obtaining the corresponding authentication key from the quantum key distribution network.

6. The distributed zero-trust micro-isolation access control method according to claim 1, wherein: The user terminal is connected to a corresponding quantum key distribution node in the quantum key distribution network.

7. The distributed zero-trust micro-isolation access control method according to claim 1, wherein: The user terminal stores a pre-shared master key pre-filled by the quantum key distribution network, and the method further includes: When the user terminal communicates with the corresponding quantum key distribution node in the quantum key distribution network, the pre-shared master key is used for protection.

8. A distributed zero-trust micro-isolation access control method, wherein: Applied to a security center, the method includes: Receive a resource authorization request sent by a user terminal, and generate a task identifier based on the resource authorization request, wherein the task identifier is bound to an identifier of the user terminal, a quantum key distribution node to which the user terminal belongs, an identifier of a resource to which access is authorized, and a quantum key distribution node to which the resource to which access is authorized belongs; For each task identifier, a certification key request is sent to the quantum key distribution node to which the corresponding authorized access resource belongs, so that the quantum key distribution node to which the authorized access resource belongs sends the certification key and its certification key identifier to the quantum key distribution node to which the user terminal belongs; Receive the authentication key identifier returned by the quantum key distribution node to which the resource to which access is authorized belongs, and generate a software-defined border policy based on the zero-trust concept based on the authentication key identifier, and send it to the user terminal and the software-defined border gateway based on the zero-trust concept so that the user terminal and the software-defined border gateway based on the zero-trust concept establish a channel for accessing the authorized resources based on the software-defined border policy based on the zero-trust concept.

9. The distributed zero-trust micro-isolation access control method according to claim 8, wherein: The receiving a resource authorization request sent by a user terminal and generating a task identifier based on the resource authorization request includes: Accepting a resource authorization request sent by a user terminal, wherein the resource authorization request carries information including an identifier and a security status of the user terminal initiating the access behavior; Performing a security assessment on the security status of the user terminal and determining the resources that are authorized to be accessed based on the assessment result; Determine the quantum key distribution node to which the user terminal belongs according to the identifier of the user terminal, and determine the quantum key distribution node to which the authorized access resource belongs according to the identifier of the authorized access resource; A task identifier is generated for the user terminal that initiates the access behavior and the corresponding authorized access resource.

10. The distributed zero-trust micro-isolation access control method according to claim 8, wherein: The authentication key identifier is obtained by concatenating the identifier of the quantum key distribution node to which the resource is authorized to be accessed and the serial number of the authentication key.

11. A distributed zero-trust micro-isolation access control method, wherein: Applied to the accessed resource party, the method comprises: intercepting, by the service grid, a resource access request sent by a user terminal to a resource that is authorized to access, wherein the resource access request carries information including a first hash value of resource information calculated using an authentication key and an authentication key identifier; Obtaining a corresponding authentication key from a quantum key distribution network according to the authentication key identifier, and calculating a second hash value of the resource information based on the authentication key; Comparing the second hash value with the first hash value to authenticate the user terminal; After the identity authentication is passed, access permission information is sent to the user terminal.

12. The distributed zero-trust micro-isolation access control method according to claim 11, wherein: The resource information includes a key identifier, a source address, a source port, a destination address, a destination address, and a predefined filling character string.

13. The distributed zero-trust micro-isolation access control method according to claim 11, wherein: The accessed resource party is connected to a corresponding quantum key distribution node in the quantum key distribution network.

14. The distributed zero-trust micro-isolation access control method according to claim 12, wherein: After the resource access is completed, the method further includes: A key destruction request is sent to the quantum key distribution node of the accessed resource through the service grid, so that the corresponding quantum key distribution node destroys the authentication key corresponding to this access task.

15. The distributed zero-trust micro-isolation access control method according to claim 11, wherein: The accessed resource stores a pre-shared master key pre-filled by the quantum key distribution network, and the method further comprises: When the accessed resource party communicates with the corresponding quantum key distribution node in the quantum key distribution network, the pre-shared master key is used for protection.

16. A user terminal, wherein: A zero-trust agent runs in the user terminal, and the zero-trust agent is used to execute the distributed zero-trust micro-isolation access control method as described in any one of claims 1 to 7.

17. A security center, wherein: The security center includes: An identity authentication module, used to receive a resource authorization request sent by a user terminal, and generate a task identifier based on the resource authorization request, wherein the task identifier is bound to an identifier of the user terminal, a quantum key distribution node to which the user terminal belongs, an identifier of a resource to which access is authorized, and a quantum key distribution node to which the resource to which access is authorized belongs; The software-defined border controller based on the zero-trust concept is used to send an authentication key request to the quantum key distribution node to which the corresponding authorized access resource belongs for each task identifier, so that the quantum key distribution node to which the authorized access resource belongs sends the authentication key and its authentication key identifier to the quantum key distribution node of the user end; and receives the authentication key identifier returned by the quantum key distribution node to which the authorized access resource belongs, and generates a software-defined border policy based on the zero-trust concept based on the authentication key identifier and sends it to the user end and the software-defined border gateway based on the zero-trust concept so that the user end and the software-defined border network based on the zero-trust concept can communicate with each other. The gateway establishes a channel to access authorized resources based on a software-defined perimeter strategy based on the zero-trust concept.

18. An accessed resource party, wherein: A service grid is running in the accessed resource party, and the service grid is used to execute the distributed zero-trust micro-isolation access control method as described in any one of claims 11 to 15.

19. A distributed zero-trust micro-isolation access control system, wherein: The system includes a user terminal, an accessed resource party, a security center, and a quantum key distribution network. The user terminal and the accessed resource party are connected via a software-defined border gateway based on the zero-trust concept. The user terminal, the accessed resource party, and the security center are all connected to the quantum key distribution network. The user terminal is connected to the security center, wherein: The user terminal runs a zero-trust agent to initiate a resource authorization request to the security center; The security center is used to apply to the sub-key distribution network for the authentication key identifier corresponding to the resource authorized to be accessed based on the resource authorization request sent by the user terminal, generate a software-defined border policy based on the zero-trust concept and send it to the user terminal and the software-defined border gateway based on the zero-trust concept, so that the user terminal and the software-defined border gateway based on the zero-trust concept establish a secure channel for accessing the authorized resource party based on the software-defined border policy based on the zero-trust concept; The accessed resource party runs a service grid for obtaining an authentication key from the quantum key distribution network to authenticate the last segment of the user's access behavior and directly authorize the access behavior of the authorized access resource party.

20. A computing device, wherein: include: a memory having computer readable code stored therein; One or more processors, when the computer-readable code is executed by the one or more processors, the computing processing device executes the distributed zero-trust micro-isolation access control method as described in any one of claims 1 to 7 and 11 to 15.

Images