A business access control system and control method based on zero trust

Abstract

The present invention relates to a business access control system based on zero trust, including: a client sub-gateway, a zero-trust controller, a central gateway, and a key management server; the central gateway is communicatively connected to the key management server, the key management server, the client sub-gateway, and the central gateway are respectively communicatively connected to the zero-trust controller, and the client sub-gateway is communicatively connected to the client. A business access control system and control method based on zero trust provided by the present invention can effectively overcome the reliance on boundary protection in the prior art. In the solution provided by the present invention, before access is allowed, all access subjects need to be authenticated and authorized, which solves the security threats brought by the current enterprise business architecture with blurred boundaries and effectively improves the security performance of the business access control system.

Description

Technical Field

[0001] The present invention relates to the field of computer network security technology, and in particular to a zero-trust based business access control system and control method. Background Art

[0002] At present, many enterprises use the method of dividing security zones for resource access protection. First, the network is divided into different security zones such as the external network, the internal network and the DMZ, forming a network boundary between different security zones, and then deploying security equipment at the network boundary, including firewalls, IDS, IPS, WAF and other network security technical means to prevent various attacks from outside the boundary, so as to build the enterprise's network security system. In this traditional security concept, the network location determines the degree of trust. Users outside the security zone boundary are untrustworthy by default, and users within the security zone boundary will be granted a high trust level to access the company's sensitive resources. They are trusted by default.

[0003] With the development of emerging technologies such as cloud computing, wireless interconnection, the Internet of Things, and big data, and with the migration of business to the cloud, the prevalence of APT attacks, and the trend of mobile office, corporate data is no longer limited to the intranet, and the internal and external network boundaries originally established by the organization are becoming increasingly blurred. There are also more technical means that can easily break through network boundaries. Network security is no longer limited to boundary security, especially now that the focus of security is gradually shifting to data security. We should pay full attention to the data security of the enterprise intranet, and the traditional boundary-based network security architecture and solutions have been difficult to adapt to modern enterprise network infrastructure. Summary of the invention

[0004] In order to address the shortcomings of the prior art, the present invention provides a business access control system and control method based on zero trust to solve the reliance on boundary protection in the prior art. Before access is allowed, all access subjects need to undergo identity authentication and authorization, thus solving the security threats brought about by the current enterprise business architecture with blurred boundaries.

[0005] In order to achieve the above object, the technical solution of the present invention is as follows.

[0006] A business access control system based on zero trust, comprising: a client sub-gateway, a zero-trust controller, a central gateway, and a key management server; the central gateway is connected in communication with the key management server, the key management server, the client sub-gateway, and the central gateway are respectively connected in communication with the zero-trust controller, and the client sub-gateway is connected in communication with the client; the zero-trust controller is used to control the identity aggregation of the client, the client sub-gateway, and the central gateway, and to issue routing policies, working keys, and authorized access control policies; the central gateway is used to control secure access to the business system; the key management server is used to generate and issue working keys; the client sub-gateway is deployed on the client, and securely accesses authorized business resources by establishing a tunnel with the zero-trust controller and the central gateway; wherein the client sub-gateway is used to send a business access request for the business server to the client sub-gateway, and the business access request includes a business access request message and a target address for session request access;

[0007] The client sub-gateway suspends the service access request message, and matches and maps the session request to the corresponding zero trust central gateway and the corresponding key management server from multiple preset zero trust controllers according to the preset path mapping relationship;

[0008] A zero-trust controller is used to deploy a zero-trust control center, which is used to manage the permissions of clients and client sub-gateways and receive session requests. A central gateway and a key management server for client permissions and receiving session requests in the entire zero-trust system are preset. After the session communication is established, the working key issued by the key management server is sent to the client sub-gateway;

[0009] The central gateway authenticates the client sub-gateway according to the access control policy preset by the zero-trust control center. After successful authentication, the central gateway agrees to the client sub-gateway session communication request, synchronizes the authentication result to the key management server, and applies for the client sub-gateway working key from the key management server.

[0010] The key management server receives the identity authentication result from the central gateway and the client sub-gateway working key application distributed by the zero-trust controller. Once the identity is confirmed, the working key is sent to the central gateway and the zero-trust controller.

[0011] The business server, when the client sub-gateway receives the working key, establishes an encrypted tunnel with the central gateway through the working key, and the client sub-gateway sends the suspended business access request to the business server through the central gateway to provide the corresponding business access service for the client.

[0012] Furthermore, before the zero-trust network access control system authenticates the service access request, it also includes: (1) the client sub-gateway uses the transmission key to securely encrypt at the physical layer, including the client gateway identity information and the original data packet of the session request, and the original data packet of the session request is generated at the physical layer using the transmission key; (2) sending the session request encrypted through the physical layer network to the central gateway; (3) for the session request, the central gateway decrypts and processes it according to the preset transmission key to obtain the client sub-gateway identity information required for authentication; (4) verifying the client sub-gateway identity information, and after the verification is passed, forwarding the verification information to the key management server, and applying for the client sub-gateway service access working key from the key management server.

[0013] Furthermore, the key management server obtains the correct identity information of the client sub-gateway, generates and issues a working key for the client sub-gateway service access, including: (1) responding to the working key for the client sub-gateway service access applied for by the central gateway, and issuing the working key to the central gateway for session establishment and decryption of the service access request; (2) comparing the client sub-gateway identity information applied for by the zero-trust controller with the confirmed identity information of the central gateway, and issuing the working key to the zero-trust controller if the comparison is correct, and the zero-trust controller forwards the working key to the client sub-gateway; (3) the client sub-gateway receives the working key from the key management server, encrypts the pending service access request message, sends it to the central gateway for decryption, and determines whether to forward it to the service server according to the access control policy preset by the zero-trust control center.

[0014] Furthermore, the client business server access request is decrypted and an authority determination is performed according to a preset access control policy. After a successful determination, the client business access request is forwarded to the business server corresponding to the target address, including: the zero trust control center is used to manage user terminal permissions and send the preset access control policy to the zero trust controller and the central gateway, the zero trust controller is used to receive the business access request message, and authenticate the client according to the preset access control policy. After successful authentication, the business request message and the corresponding target address are sent to the central gateway, and the central gateway is used to perform an authority determination on the business access request. After a successful determination, the business access request is forwarded to the business server corresponding to the target address.

[0015] A service access control method based on zero trust, characterized by comprising the following steps:

[0016] (1) The client sub-gateway obtains the service access request message from the client to the service server, generates an encrypted session request and sends it to the zero trust controller. The client sub-gateway obtains the working key through the identity authentication of the central gateway, establishes an encrypted tunnel, and forms an encrypted service request including the service access request and user terminal information;

[0017] (2) The zero-trust controller determines the central gateway node according to the target address and the preset diversion strategy, and sends the service request message application to the zero-trust control center to which the target central gateway is attached;

[0018] (3) The zero-trust control center manages the client permissions and receives the service request message, performs identity authentication on the client according to a preset access control policy, and after successful identity authentication, performs an authority determination on the service access request. After successful determination, the service access request is forwarded to the service server corresponding to the target address, and the service server provides the client with corresponding service access services according to the service access request.

[0019] Furthermore, the zero trust system includes: a zero trust control center, a zero trust controller and a central gateway linked in sequence; wherein the zero trust control center manages user terminal permissions and sends preset access control policies to the zero trust controller and the central gateway, the zero trust controller performs identity authentication on the user terminal according to the access control policy, and after successful identity authentication, sends the service request message and the corresponding service server address to the central gateway, the central gateway performs authority determination on the service access request, and after successful determination, forwards the client's service access request to the service server corresponding to the target address.

[0020] Further, sending the service request message to the zero trust controller on the zero trust control center includes: sending the service request message to the zero trust controller of the target zero trust control center.

[0021] Furthermore, the zero trust control center manages user terminal permissions and receives the service request message, performs identity authentication on the user terminal according to a preset access control policy, and after successful identity authentication, performs permission determination on the service access request, and after successful determination, forwards the service access request to the service server corresponding to the target address, including: the zero trust control center manages user terminal permissions and sends the preset access control policy to the zero trust controller and the central gateway, the zero trust controller receives the service request message, performs identity authentication on the client according to the preset access control policy, and after successful identity authentication, sends the service request message and the corresponding service server address to the central gateway, the central gateway performs permission determination on the service access request, and after successful determination, forwards the service access request to the service server corresponding to the target address, and the service server provides corresponding service access services to the client according to the service access request.

[0022] Furthermore, after the zero-trust controller is installed, the following operations are performed through the controller: add client sub-gateway, add central gateway, add key management server, add trusted zone, add application, and add client authorization.

[0023] The beneficial effect of the invention is that the business access control system and control method based on zero trust provided by the invention can effectively overcome the reliance on boundary protection in the prior art. In the solution provided by the invention, all access subjects need to be authenticated and authorized before access is allowed, which solves the security threats brought by the current enterprise business architecture with blurred boundaries and effectively improves the security performance of the business access control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a block diagram of the system modules used in the embodiments of the present invention.

[0025] Figure 2 Schematic diagram of the system workflow used in the embodiment of the present invention. DETAILED DESCRIPTION

[0026] The specific implementation of the present invention is described below in conjunction with the accompanying drawings and examples to facilitate a better understanding of the present invention.

[0027] Example

[0028] like Figure 1The zero-trust-based business access control system shown includes: a client sub-gateway, a zero-trust controller, a central gateway, and a key management server; the central gateway is connected to the key management server, the key management server, the client sub-gateway, and the central gateway are connected to the zero-trust controller respectively, and the client sub-gateway is connected to the client; the zero-trust controller is used to control the identification aggregation of the client, the client sub-gateway, and the central gateway, and to issue routing policies, working keys, and authorized access control policies; the central gateway is used to control the secure access to the business system; the key management server is used to generate and issue working keys; the client sub-gateway is deployed on the client, and securely accesses the authorized business resources by establishing a tunnel with the zero-trust controller and the central gateway; wherein the client sub-gateway is used to send a business access request for the business server to the client sub-gateway, the business access request including a business access request message and a target address for the session request access; the client sub-gateway suspends the business access request message, and matches and maps the session request to the corresponding zero-trust central gateway and the corresponding key management server from multiple preset zero-trust controllers according to a preset path mapping relationship. Server; a zero-trust controller, which is used to deploy a zero-trust control center. The zero-trust control center is used to manage the permissions of clients and client sub-gateways and receive session requests. The central gateway and key management server for client permissions and receiving session request requirements in the entire zero-trust system are preset. After the session communication is established, the working key issued by the key management server is sent to the client sub-gateway; the central gateway authenticates the client sub-gateway according to the access control policy preset by the zero-trust control center. After the identity authentication is successful, it agrees to the client sub-gateway session communication request, and synchronizes the identity authentication result to the key management server while applying for the client sub-gateway working key from the key management server; the key management server receives the identity authentication result from the central gateway and the client sub-gateway working key application distributed by the zero-trust controller. After the identity confirmation is passed, the working key is sent to the central gateway and the zero-trust controller; the business server, when the client sub-gateway receives the working key, it establishes an encrypted tunnel with the central gateway through the working key, and the client sub-gateway sends the suspended business access request to the business server through the central gateway to provide corresponding business access services for the client.

[0029] In an embodiment of the present invention, before the zero-trust network access control system authenticates the service access request, it also includes: (1) the client sub-gateway uses a transmission key to securely encrypt at the physical layer, including the client gateway identity information and the original data packet of the session request, and the original data packet of the session request is generated at the physical layer using the transmission key; (2) sending the session request encrypted through the physical layer network to the central gateway; (3) the central gateway decrypts the session request according to the preset transmission key to obtain the client sub-gateway identity information required for authentication; (4) verifying the client sub-gateway identity information, and after the verification is passed, forwarding the verification information to the key management server, and applying for the client sub-gateway service access working key from the key management server. The key management server obtains the correct identity information of the client sub-gateway, generates and issues a working key for the client sub-gateway service access, including: (1) responding to the working key for the client sub-gateway service access applied by the central gateway, and issuing the working key to the central gateway for session establishment and decryption of the service access request; (2) comparing the client sub-gateway identity information applied by the zero trust controller with the confirmed identity information of the central gateway, and issuing the working key to the zero trust controller if the comparison is correct, and the zero trust controller forwards the working key to the client sub-gateway; (3) the client sub-gateway receives the working key from the key management server, encrypts the pending service access request message, sends it to the central gateway for decryption, and determines whether to forward it to the service server according to the access control policy preset by the zero trust control center. Decrypt the client business server access request and make a permission determination according to the preset access control policy. After the determination is successful, forward the client business access request to the business server corresponding to the target address, including: the zero trust control center is used to manage user terminal permissions and send the preset access control policy to the zero trust controller and the central gateway. The zero trust controller is used to receive the business access request message, authenticate the client according to the preset access control policy, and after the authentication is successful, send the business request message and the corresponding target address to the central gateway. The central gateway is used to make a permission determination for the business access request, and after the determination is successful, forward the business access request to the business server corresponding to the target address. After the zero trust controller is installed, perform the following operations through the controller: add a client sub-gateway, add a central gateway, add a key management server, add a trusted area, add an application, and add client authorization.

[0030] like Figure 2 As shown, the zero-trust-based service access control method in the embodiment of the present invention is characterized by comprising the following steps:

[0031] (1) The client sub-gateway obtains the service access request message from the client to the service server, generates an encrypted session request and sends it to the zero trust controller. The client sub-gateway obtains the working key through the identity authentication of the central gateway, establishes an encrypted tunnel, and forms an encrypted service request including the service access request and user terminal information;

[0032] (2) The zero-trust controller determines the central gateway node according to the target address and the preset diversion strategy, and sends the service request message application to the zero-trust control center to which the target central gateway is attached;

[0033] (3) The zero-trust control center manages the client permissions and receives the service request message, performs identity authentication on the client according to a preset access control policy, and after successful identity authentication, performs an authority determination on the service access request. After successful determination, the service access request is forwarded to the service server corresponding to the target address, and the service server provides the client with corresponding service access services according to the service access request.

[0034] In the above method, the zero-trust system includes: a zero-trust control center, a zero-trust controller and a central gateway linked in sequence; wherein the zero-trust control center manages user terminal permissions and sends preset access control policies to the zero-trust controller and the central gateway, the zero-trust controller authenticates the user terminal according to the access control policy, and after successful authentication, sends the service request message and the corresponding service server address to the central gateway, the central gateway determines the authority of the service access request, and after successful determination, forwards the client's service access request to the service server corresponding to the target address. Sending the service request message to the zero-trust controller on the zero-trust control center includes: sending the service request message to the zero-trust controller of the target zero-trust control center. The zero trust control center manages user terminal permissions and receives the service request message, authenticates the user terminal according to a preset access control policy, and after the authentication is successful, makes a permission determination on the service access request, and after the determination is successful, forwards the service access request to the service server corresponding to the target address, including: the zero trust control center manages user terminal permissions and sends the preset access control policy to the zero trust controller and the central gateway, the zero trust controller receives the service request message, authenticates the client according to the preset access control policy, and after the authentication is successful, sends the service request message and the corresponding service server address to the central gateway, the central gateway makes a permission determination on the service access request, and after the determination is successful, forwards the service access request to the service server corresponding to the target address, and the service server provides the client with corresponding service access services according to the service access request.

[0035] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A zero-trust-based business access control system, characterized in that: include: Client sub-gateway, zero-trust controller, central gateway, key management server; The central gateway is connected to the key management server in communication, the key management server, the client sub-gateway, and the central gateway are connected to the zero trust controller in communication, and the client sub-gateway is connected to the client in communication; The zero-trust controller is used to control the identity aggregation of clients, client sub-gateways, and central gateways, and to issue routing policies, working keys, and authorized access control policies; The central gateway is used to control the security access to the business system; the key management server is used to generate and issue working keys; The client sub-gateway is deployed on the client side and establishes a tunnel with the zero-trust controller and the central gateway to provide secure access to authorized business resources. in, The client is used to send a service access request for the service server to the client sub-gateway, wherein the service access request includes a service access request message and a target address for the session request access; The client sub-gateway suspends the service access request message, and matches and maps the session request to the corresponding zero trust central gateway and the corresponding key management server from multiple preset zero trust controllers according to the preset path mapping relationship; A zero-trust controller is used to deploy a zero-trust control center, which is used to manage the permissions of clients and client sub-gateways and receive session requests. A central gateway and a key management server for client permissions and receiving session requests in the entire zero-trust system are preset. After the session communication is established, the working key issued by the key management server is sent to the client sub-gateway; The central gateway authenticates the client sub-gateway according to the access control policy preset by the zero-trust control center. After successful authentication, the central gateway agrees to the client sub-gateway session communication request, synchronizes the authentication result to the key management server, and applies for the client sub-gateway working key from the key management server. The key management server receives the identity authentication result from the central gateway and the client sub-gateway working key application distributed by the zero-trust controller. Once the identity is confirmed, the working key is sent to the central gateway and the zero-trust controller. The business server, when the client sub-gateway receives the working key, establishes an encrypted tunnel with the central gateway through the working key, and the client sub-gateway sends the suspended business access request to the business server through the central gateway to provide the corresponding business access service for the client.

2. The zero-trust-based business access control system according to claim 1, characterized in that: Before the zero-trust network access control system authenticates the service access request, it also includes: (1) the client sub-gateway uses the transmission key to securely encrypt at the physical layer, including the client gateway identity information and the original data packet of the session request, and the original data packet of the session request is generated at the physical layer using the transmission key; (2) sending the session request encrypted through the physical layer network to the central gateway; (3) for the session request, the central gateway decrypts and processes it according to the preset transmission key to obtain the client sub-gateway identity information required for authentication; (4) verifying the client sub-gateway identity information, and after the verification is passed, forwarding the verification information to the key management server, and applying for the client sub-gateway service access working key from the key management server.

3. The zero-trust-based service access control system according to claim 2, characterized in that: The key management server obtains the correct identity information of the client sub-gateway, generates and issues a working key for the client sub-gateway service access, including: (1) responding to the working key for the client sub-gateway service access applied by the central gateway, and issuing the working key to the central gateway for session establishment and decryption of the service access request; (2) comparing the client sub-gateway identity information applied by the zero trust controller with the confirmed identity information of the central gateway, and issuing the working key to the zero trust controller if the comparison is correct, and the zero trust controller forwards the working key to the client sub-gateway; (3) the client sub-gateway receives the working key from the key management server, encrypts the pending service access request message, sends it to the central gateway for decryption, and determines whether to forward it to the service server according to the access control policy preset by the zero trust control center.

4. The zero-trust-based service access control system according to claim 3, characterized in that: The client business server access request is decrypted and permission is determined according to a preset access control policy. After a successful determination, the client business access request is forwarded to the business server corresponding to the target address, including: the zero trust control center is used to manage user terminal permissions and send the preset access control policy to the zero trust controller and the central gateway, the zero trust controller is used to receive the business access request message, authenticate the client according to the preset access control policy, and after successful authentication, the business request message and the corresponding target address are sent to the central gateway, the central gateway is used to determine the permission of the business access request, and after a successful determination, the business access request is forwarded to the business server corresponding to the target address.

5. A business access control method based on zero trust, characterized in that: The following steps are involved: (1) The client sub-gateway obtains the service access request message from the client to the service server, generates an encrypted session request and sends it to the zero trust controller. The client sub-gateway obtains the working key through the identity authentication of the central gateway, establishes an encrypted tunnel, and forms an encrypted service request including the service access request and user terminal information; (2) The zero-trust controller determines the central gateway node according to the target address and the preset diversion strategy, and sends the service request message application to the zero-trust control center to which the target central gateway is attached; (3) The zero-trust control center manages the client permissions and receives the service request message, performs identity authentication on the client according to the preset access control policy, and after successful identity authentication, performs permission determination on the service access request. After successful determination, the service access request is forwarded to the service server corresponding to the target address, and the service server provides the client with corresponding service access services according to the service access request.

6. The zero-trust-based service access control method according to claim 5, characterized in that: The zero-trust system includes: a zero-trust control center, a zero-trust controller and a central gateway linked in sequence; wherein the zero-trust control center manages user terminal permissions and sends preset access control policies to the zero-trust controller and the central gateway, the zero-trust controller authenticates the user terminal according to the access control policy, and after successful authentication, sends the service request message and the corresponding service server address to the central gateway, the central gateway determines the authority of the service access request, and after successful determination, forwards the client's service access request to the service server corresponding to the target address.

7. The zero-trust-based service access control method according to claim 6 is characterized in that: Sending the service request message to the zero trust controller on the zero trust control center includes sending the service request message to the zero trust controller of the target zero trust control center.

8. The zero-trust-based service access control method according to claim 7 is characterized in that: The zero trust control center manages user terminal permissions and receives the service request message, authenticates the user terminal according to a preset access control policy, and after the authentication is successful, makes a permission determination on the service access request, and after the determination is successful, forwards the service access request to the service server corresponding to the target address, including: the zero trust control center manages user terminal permissions and sends the preset access control policy to the zero trust controller and the central gateway, the zero trust controller receives the service request message, authenticates the client according to the preset access control policy, and after the authentication is successful, sends the service request message and the corresponding service server address to the central gateway, the central gateway makes a permission determination on the service access request, and after the determination is successful, forwards the service access request to the service server corresponding to the target address, and the service server provides the client with corresponding service access services according to the service access request.

Images