Zero-trust network access processing method, device, electronic device and storage medium

Abstract

The present application provides an access processing method, device, electronic device and computer-readable storage medium for a zero-trust network; it relates to the security field of cloud technology, and the method includes: receiving an access request sent by an application; obtaining the address of the business site that the application needs to access from the access request; based on the identification of the application and the address of the business site, querying the access control policy of the zero-trust network to obtain the access mode of the application accessing the business site; establishing a communication connection between the application and the business site based on the access mode and the zero-trust network; sending the access request to the business site through the communication connection, and sending the access request response of the business site to the application through the communication connection. Through this application, a flexible, stable and efficient access mode can be provided to applications through a zero-trust network.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a method, device, electronic device, and computer-readable storage medium for processing access to a zero-trust network. Background Art

[0002] Zero-trust networks establish secure access control between access subjects (i.e., user areas) and access objects (i.e., enterprise data areas), building a security protection system with "identity" as the logical boundary. That is, only trusted subjects (such as legitimate devices and legitimate users) can access objects (such as application systems, data, and service interfaces), thereby improving the network's security risk perception capabilities.

[0003] However, in the zero-trust network access architecture provided by related technologies, trusted applications need to access any site in the reachable area through proxy access. This single access method cannot adapt to the complex network environment in which the application is located. Summary of the Invention

[0004] Embodiments of the present application provide a method, device, electronic device, and computer-readable storage medium for access processing in a zero-trust network, which can provide flexible access modes to applications through a zero-trust network.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] The present invention provides a method for processing access to a zero-trust network, including:

[0007] Receive access requests sent by applications;

[0008] Obtaining, from the access request, an address of a business site that the application needs to access;

[0009] Based on the identifier of the application and the address of the business site, query the access control policy of the zero-trust network to obtain the access mode of the application to the business site;

[0010] establishing a communication connection between the application and the business site based on the access mode and the zero-trust network;

[0011] The access request is sent to the service site through the communication connection, and the access request response of the service site is sent to the application through the communication connection.

[0012] In the above scheme, when receiving an access request sent by an application, the method also includes: obtaining the domain name of the business site by: matching the IP address corresponding to the access request with the virtual IP configuration list included in the access control policy; when the IP address exists in the virtual IP configuration list, querying the mapping list between the virtual IP address and the domain name based on the IP address to obtain the domain name of the business site; when the IP address does not exist in the virtual IP configuration list, querying the mapping list between the system native IP address and the domain name based on the IP address to obtain the domain name of the business site.

[0013] In the above scheme, when the access mode is proxy access, the communication connection between the application and the business site is established based on the access mode and the zero-trust network, including: obtaining the credentials of the access request; forwarding the credentials to the zero-trust network server through the zero-trust network gateway, so that the zero-trust network server verifies the credentials and obtains a verification result; when the verification result indicates that the credential verification is successful, sending the credentials and the access request to the business site through the zero-trust network gateway to establish a communication connection between the application and the business site, and performing proxy access via the zero-trust network gateway; when the verification result indicates that the credential verification fails, forwarding the access request to the business site through the zero-trust network gateway to establish a direct communication connection between the application and the business site.

[0014] In the above scheme, the receiving of the access request sent by the application includes: hijacking the access request sent by the application through the virtual network card running on the zero-trust network agent; obtaining the credential of the access request includes: extracting the request parameters of the access request through the zero-trust network client, sending a credential request to the zero-trust network server based on the request parameters, and receiving the credential returned by the zero-trust network server.

[0015] In the above scheme, the request parameters include: the address and port of the application, the address and port of the business site, and the identifier of the application; sending a credential request to the zero-trust network server based on the request parameters and receiving the credential returned by the zero-trust network server include: sending the request parameters to the zero-trust network client through the zero-trust network agent, so that the zero-trust network client obtains the characteristic information of the application based on the identifier of the application in the request parameters; sending a credential request to the zero-trust network server through the zero-trust network client, wherein the credential request carries the address and port of the application, the address and port of the business site, and the characteristic information, so that the zero-trust network server performs authentication processing and returns the credential to the zero-trust network client when the authentication is passed.

[0016] In the above scheme, when the access mode is direct access, the communication connection between the application and the business site is established based on the access mode and the zero-trust network, including: obtaining the credentials of the access request through the zero-trust network client, and forwarding the credentials to the zero-trust network server via the zero-trust network gateway, so that the zero-trust network server verifies the credentials and obtains a verification result; when the verification result indicates that the credential verification is successful, forwarding the credentials and the network request to the business site through the zero-trust network gateway to establish a direct communication connection between the application and the business site.

[0017] The present invention provides a zero-trust network access processing device, including:

[0018] A receiving module, configured to receive an access request sent by an application;

[0019] An acquisition module, configured to acquire, from the access request, the address of the business site that the application needs to access;

[0020] A query module, configured to query the access control policy of the zero-trust network based on the identifier of the application and the address of the business site, and obtain an access mode for the application to access the business site;

[0021] an establishing module, configured to establish a communication connection between the application and the business site based on the access mode and the zero-trust network;

[0022] A sending module is configured to send the access request to the business site via the communication connection, and to send a response to the access request of the business site to the application via the communication connection.

[0023] An embodiment of the present application provides an electronic device, including:

[0024] a memory for storing executable instructions;

[0025] The processor is used to implement the access processing method of the zero-trust network provided in the embodiment of the present application when executing the executable instructions stored in the memory.

[0026] An embodiment of the present application provides a computer-readable storage medium storing executable instructions for causing a processor to execute and implement the zero-trust network access processing method provided in the embodiment of the present application.

[0027] The embodiments of the present application have the following beneficial effects:

[0028] By querying the access control policy of the zero-trust network through the application's identification and the address of the business site, the access mode of the application to the business site can be obtained, thereby providing flexible and diverse access modes based on the application and business site, adapting to the complex characteristics of the network environment in which the application and business site are located, and ensuring the stability and efficiency of access to the business site through the zero-trust network. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 1 is a schematic diagram of the architecture of a zero-trust network access processing system 100 provided in an embodiment of the present application;

[0030] Figure 2 4 is a schematic diagram of the structure of the terminal device 400 provided in an embodiment of the present application;

[0031] Figure 3A This is a flowchart of a method for access processing in a zero-trust network provided by an embodiment of the present application;

[0032] Figure 3B This is a flowchart of a method for access processing in a zero-trust network provided by an embodiment of the present application;

[0033] Figure 4 This is a flowchart of a method for access processing in a zero-trust network provided by an embodiment of the present application;

[0034] Figure 5 This is a flowchart of a method for access processing in a zero-trust network provided by an embodiment of the present application;

[0035] Figure 6 This is a schematic diagram of a scenario in which an administrator configures an access control policy for a zero-trust network provided by an embodiment of the present application;

[0036] Figure 7A This is a schematic diagram of a scenario in which an administrator configures an access control policy for a zero-trust network provided by an embodiment of the present application;

[0037] Figure 7B This is a schematic diagram of a scenario in which an administrator configures an access control policy for a zero-trust network provided by an embodiment of the present application;

[0038] Figure 8 This is a schematic diagram of a scenario in which an administrator configures an access control policy for a zero-trust network provided by an embodiment of the present application;

[0039] Figure 9 This is a configuration diagram of a trusted application provided in an embodiment of the present application;

[0040] Figure 10 This is a schematic diagram of a scenario in which an access user accesses a zero-trust network client provided by an embodiment of the present application;

[0041] Figure 11A This is a schematic diagram of a scenario in which an access user queries an access control policy provided by an embodiment of the present application;

[0042] Figure 11B This is a schematic diagram of a scenario in which an access user queries an access control policy provided by an embodiment of the present application;

[0043] Figure 12 This is a schematic diagram of the access process of the zero-trust network provided by an embodiment of the present application;

[0044] Figure 13 This is a schematic diagram of the architecture of the access processing system for the zero-trust network provided in an embodiment of the present application;

[0045] Figure 14 This is a flow chart of executing custom DNS logic for a domain name carried in a network access request, as provided in an embodiment of the present application;

[0046] Figure 15 This is a flow chart of executing custom DNS logic for a domain name carried in a network access request, as provided in an embodiment of the present application;

[0047] Figure 16 This is a schematic diagram of the principle of realizing configuration information synchronization between the IOA client and the zero-trust network agent by combining configuration-aware change push and configuration pull response provided by an embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limiting this application. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0049] In the following description, reference is made to “some embodiments”, which describes a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0050] In the following description, the terms "first\second" are only used to distinguish similar objects and do not represent a specific order for the objects. It can be understood that "first\second" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0051] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0052] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0053] 1) Zero Trust Network: A communication architecture between access subjects and access objects, based on identity authentication, with the capabilities of secure business access, continuous trust assessment, and dynamic access control.

[0054] 2) Access Subject: In a zero-trust network, the party that initiates access, such as a person, device, or application accessing intranet business resources.

[0055] 3) Access Object: In a zero-trust network, the party being accessed can be, for example, the business resources, data, development and testing environment, and operation and maintenance environment of the enterprise intranet.

[0056] 4) Direct access: In a zero-trust network architecture, when an application initiates a network access request to a target site, the zero-trust network agent (such as a full-flow agent) hijacks the request and directly initiates a network access request to the target site through the full-flow agent. This initiates direct access, and the full-flow agent sends the network response of the target site to the application. This access mode is called direct access.

[0057] 5) Proxy access: In a zero-trust network architecture, an application initiates a network access request to a target site. After the request is hijacked by the full-flow proxy, the full-flow proxy initiates a request forwarding to the zero-trust network gateway (such as an intelligent gateway). The access to the target site is proxied by the intelligent gateway. After the access, the intelligent gateway sends the network response of the target site to the full-flow proxy, and the full-flow proxy forwards the network response of the target site to the application. This access mode is called proxy access.

[0058] 6) Zero Trust Network Agent: This agent is deployed on controlled endpoints to initiate secure access. It is responsible for initiating trusted authentication requests for the access subject. Once the identity is verified to be trustworthy, an encrypted access connection is established. This also serves as the policy enforcement point for access control. For example, a Zero Trust Network Agent can be a full-flow proxy that implements full-flow hijacking based on a TUN / TAP virtual network card.

[0059] 7) Zero Trust Network Gateway: Deployed at the entrance of enterprise applications and data resources, it is responsible for verifying and forwarding each session request to access enterprise resources.

[0060] 8) Trusted Application: An application carrier that is authorized by the management end and can be accessed by the terminal to the internal business system, including the application name, MD5 value of the application, signature information, etc.

[0061] 9) Reachable zone: A list of internal sites set by the enterprise that end users can access through the zero-trust network.

[0062] The zero-trust network access architecture provided by related technologies typically only supports administrators issuing a single access control policy type (i.e., a full proxy policy, requiring any trusted application to access any site within the reachable area through proxy access). Administrators are also restricted to making adjustments within a single access control policy type, and are not allowed to switch between different access control policy types. In other words, the access methods provided by related technologies for zero-trust networks lack flexibility.

[0063] In view of this, embodiments of the present application provide a method, apparatus, electronic device, and computer-readable storage medium for access processing in a zero-trust network, which can improve the flexibility of zero-trust network access. The following describes exemplary applications of the electronic device provided in embodiments of the present application. The electronic device provided in embodiments of the present application can be implemented as various types of user terminals, such as laptops, tablet computers, desktop computers, set-top boxes, mobile devices (e.g., mobile phones, portable music players, personal digital assistants, dedicated messaging devices, portable gaming devices), and can also be implemented as servers. Below, exemplary applications of the electronic device when implemented as a terminal device will be described.

[0064] See also Figure 1 , Figure 1 This is a schematic diagram of the architecture of the zero-trust network access processing system 100 provided in an embodiment of the present application. Figure 1 As shown, terminal device 400 is a terminal device associated with a user. Application 401, a zero-trust network agent 402, and a zero-trust network client 403 are running on terminal device 400. Application 401 can be of various types, such as video playback applications, online conferencing applications, live broadcast applications, news applications, and instant messaging applications. It should be noted that application 401 refers to an application that has been authorized by zero-trust network server 200 to access internal business systems (e.g., business server 500).

[0065] The zero-trust network agent 402 is used to hijack the access request sent by the application 401, and the access control policy obtained by the zero-trust network client 403 from the zero-trust network server 200 is stored in the zero-trust network agent 402. When the zero-trust network agent 402 hijacks the access request sent by the application 401, it obtains the address of the business site (for example, the business server 500) that the application 401 needs to access from the access request, and based on the identifier of the application 401 and the address of the business server 500 (for example, the Internet Protocol (IP) address of the business server 500), queries the access control policy of the zero-trust network to obtain the access mode of the application 401 to access the business server 500. Next, based on the obtained access pattern and the zero-trust network (including the zero-trust network agent, zero-trust network gateway, and zero-trust network server), zero-trust network agent 402 establishes a communication connection between application 401 and business server 500. It then sends the hijacked access request to business server 500 via the communication connection and also sends the access request response returned by business server 500 to application 401 via the communication connection. This is described in detail below.

[0066] For example, when the access mode is direct access, the zero-trust network agent 402 forwards the access request sent by the hijacked application 401 to the business server 500 to establish a direct communication connection between the application 401 and the business server 500, and returns the access request response corresponding to the access request sent by the business server 500 to the application 401 through the direct communication connection established above to the application 401, and calls the human-computer interaction interface of the application 401 for presentation.

[0067] It should be noted that for direct access, there is actually only one direct communication connection between the application 401 and the business server 500, and there is no need to transfer through the zero-trust network gateway 300.

[0068] For example, when the access mode is proxy access, after hijacking the access request sent by application 401, zero-trust network agent 402 first initiates an authentication request to zero-trust network client 403 (i.e., zero-trust network agent 402 requests credentials for this access request from zero-trust network client 403). After receiving the authentication request sent by zero-trust network agent 402, zero-trust network client 403 requests credentials from zero-trust network server 200 and sends the credentials returned by zero-trust network server 200 to zero-trust network agent 402. After receiving the credentials sent by zero-trust network client 403, zero-trust network agent 402 sends the credentials to zero-trust network gateway 300, so that zero-trust network gateway 300 sends the credentials to zero-trust network server 200 for verification. When the zero-trust network server 200 successfully verifies the credentials sent by the zero-trust network gateway 300, the zero-trust network gateway 300 establishes a communication connection with the zero-trust network agent 402. The zero-trust network agent 402 then forwards the access request sent by the hijacked application 401 to the zero-trust network gateway 300, which then forwards the access request sent by the application 401 to the business server 500. When the zero-trust network server 200 fails to verify the credentials sent by the zero-trust network gateway 300, the connection between the zero-trust network agent 402 and the zero-trust network gateway 300 is disconnected, and the zero-trust network agent 402 directly forwards the access request sent by the application 401 to the business server 500.

[0069] It should be noted that for proxy access, it actually includes two communication connections between application 401 and zero-trust network gateway 300, and between zero-trust network gateway 300 and business server 500, which are relayed by zero-trust network gateway 300 (that is, when application 401 sends an access request to business server 500, the address of application 401 is replaced with the address of zero-trust network gateway 300; when receiving the access request response returned from business server 500, the address of zero-trust network gateway 300 is replaced with the address of application 401, and then the access request response is sent to application 401).

[0070] In some embodiments, the zero-trust network server 200 and the business server 500 can be independent physical servers, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal device 400 can be a smart phone, tablet computer, laptop computer, desktop computer, smart speaker, smart watch, etc., but is not limited to this. The terminal device 400 can be directly or indirectly connected to the zero-trust network server 200, the zero-trust network gateway 300 and the business server 500 through wired or wireless communication, which is not limited in the embodiments of the present application.

[0071] Below Figure 1 The structure of the terminal device 400 in FIG is described. Figure 2 , Figure 2 is a schematic diagram of the structure of the terminal device 400 provided in an embodiment of the present application. Figure 2 The terminal device 400 shown includes: at least one processor 410, a memory 450, at least one network interface 420, and a user interface 430. The various components in the terminal device 400 are coupled together via a bus system 440. It is understood that the bus system 440 is used to achieve connection and communication between these components. In addition to including a data bus, the bus system 440 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, the bus system 440 is not shown in FIG. Figure 2 Various buses are labeled as bus system 440 .

[0072] The processor 410 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., where the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0073] The user interface 430 includes one or more output devices 431 that enable presentation of media content, including one or more speakers and / or one or more visual display screens. The user interface 430 also includes one or more input devices 432, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0074] The memory 450 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard drives, optical drives, etc. The memory 450 may optionally include one or more storage devices that are physically remote from the processor 410.

[0075] Memory 450 includes volatile memory or nonvolatile memory, or may include both volatile and nonvolatile memory. Nonvolatile memory may be read-only memory (ROM), and volatile memory may be random access memory (RAM). The memory 450 described in the embodiments of the present application is intended to include any suitable type of memory.

[0076] In some embodiments, the memory 450 can store data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplified below.

[0077] Operating system 451, including system programs for processing various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, and driver layer, which are used to implement various basic services and process hardware-based tasks;

[0078] A network communication module 452 for reaching other computing devices via one or more (wired or wireless) network interfaces 420 , exemplary network interfaces 420 including Bluetooth, WiFi, and USB;

[0079] a presentation module 453 for enabling presentation of information via one or more output devices 431 (e.g., a display screen, a speaker, etc.) associated with the user interface 430 (e.g., a user interface for operating peripheral devices and displaying content and information);

[0080] The input processing module 454 is configured to detect one or more user inputs or interactions from one of the one or more input devices 432 and to translate the detected inputs or interactions.

[0081] In some embodiments, the apparatus provided in the embodiments of the present application may be implemented in software. Figure 2An access processing device 455 of a zero-trust network stored in a memory 450 is shown, which may be software in the form of programs and plug-ins, and includes the following software modules: a receiving module 4551, an acquisition module 4552, a query module 4553, an establishment module 4554, a sending module 4555, a matching module 4556, a determination module 4557, a push module 4558, and a construction module 4559. These modules are logical, and therefore can be arbitrarily combined or further split according to the functions implemented.

[0082] For example, each step of the corresponding terminal device, zero-trust network server and zero-trust network gateway recorded below in the embodiment of the present application can be implemented as a separate module and deployed in the terminal device, zero-trust network server and zero-trust network gateway in the form of hardware, software or a combination of the two, thereby empowering the terminal device, zero-trust network server and zero-trust network gateway, so that the terminal device, zero-trust network server and zero-trust network gateway can work together to realize the access processing method of the zero-trust network provided in the embodiment of the present application.

[0083] Of course, terminal devices, zero trust network servers and zero trust network gateways can all implement the same Figure 2 All modules in the device shown in the figure, since each electronic device has the ability to realize any one of the roles of terminal device, zero trust network server and zero trust network gateway, can flexibly switch roles according to actual needs. For example, the zero trust network server can be switched to the role of zero trust network gateway when necessary, so that the ratio between electronic devices with different roles can be flexibly adjusted according to actual business needs.

[0084] For example, in Figure 2 As for the terminal device shown in the figure, although all the modules in the above-mentioned access processing device 455 are shown at one time, it should not be considered that the access processing device 455 deployed in the terminal device excludes the implementation that can only include the receiving module 4551, the acquisition module 4552, the query module 4553, the establishment module 4554 and the sending module 4555. The functions of each module will be explained below.

[0085] In other embodiments, the apparatus provided in the embodiments of the present application may be implemented in hardware. As an example, the apparatus provided in the embodiments of the present application may be a processor in the form of a hardware decoding processor, which is programmed to execute the access processing method of the zero-trust network provided in the embodiments of the present application. For example, the processor in the form of a hardware decoding processor may be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0086] As described above, the zero-trust network access processing device 455 provided in the embodiment of the present application can be deployed in terminal devices, zero-trust network servers and zero-trust network gateways, so that the terminal devices, zero-trust network servers and zero-trust network gateways can collaboratively implement the zero-trust network access processing method.

[0087] See also Figure 3A , Figure 3A This is a flow chart of a zero-trust network access processing method provided by an embodiment of the present application. Figure 3A The steps shown can be performed by a terminal device running a zero trust network agent and a zero trust network client. Figure 3A As shown, in step S101, an access request sent by an application is received; in step S102, the address of the business site that the application needs to access is obtained from the access request; in step S103, based on the identification of the application and the address of the business site, the access control policy of the zero-trust network is queried to obtain the access mode for the application to access the business site; in step S104, a communication connection is established between the application and the business site based on the access mode and the zero-trust network; in step S105, an access request is sent to the business site through the communication connection, and a response to the access request of the business site is sent to the application through the communication connection. In this way, flexible and diverse access modes can be provided according to the application and the business site, adapting to the complex characteristics of the network environment in which the application and the business site are located, and ensuring the stability and efficiency of accessing the business site through the zero-trust network.

[0088] Next, we will continue to explain in detail the access processing method of the zero-trust network provided in the embodiment of the present application from the perspective of the interaction between the terminal device (running an application, a zero-trust network agent and a zero-trust network client), the zero-trust network gateway and the zero-trust network server.

[0089] See also Figure 3B , Figure 3B This is a flow chart of a zero-trust network access processing method provided by an embodiment of the present application, such as Figure 3B As shown, there are applications, zero trust network agents and zero trust network clients running on the terminal device. Figure 3B The steps shown are described in detail.

[0090] In step S201, the zero-trust network agent hijacks the access request sent by the application.

[0091] In some embodiments, the accessing user can perform a trigger operation on the application running on the terminal device (for example, it can be a contact operation such as clicking, long pressing, or a contactless operation such as voice or gesture) to cause the application to send a corresponding access request. Then, the zero-trust network agent (such as a full-traffic agent) hijacks the access request sent by the application through the virtual network card.

[0092] For example, taking a search application (such as a browser) as an example, when the browser running on the terminal device receives a click operation triggered by a visiting user, it generates a corresponding access request. For example, the access request can be generated after the visiting user enters the domain name of a business site in the search bar of the browser. Then, the full-flow proxy can hijack the access request sent by the browser based on the TUN / TAP virtual network card.

[0093] In other embodiments, the application may initiate an access request in the following manner: first, query the domain name cache for the binding relationship between the business site to be accessed and the network address, and then generate an access request for the business site based on the queried network address.

[0094] However, when the domain name cache of the application does not store the binding relationship between the business site and the network address, the access processing method of the zero-trust network provided in the embodiment of the present application can also perform the following processing: listen to the domain name resolution port (for example, port 53) through the zero-trust network agent to hijack the domain name resolution request sent by the application, and extract the domain name of the business site from the domain name resolution request, query the access control policy based on the extracted domain name, and obtain the IP address assigned to the domain name (for example, when the access control policy is a full proxy type policy, the custom domain name system (DNS, Domain Name System) logic in the zero-trust network agent can be used to assign a corresponding virtual IP address to the domain name, and create a mapping list between the domain name and the virtual IP address; when the access control policy is a full direct connection type policy, the domain name can be resolved through the system DNS in the Internet to obtain the system native IP address corresponding to the domain name, and create a mapping list between the domain name and the system native IP address), then, send the obtained IP address to the application through the zero-trust network agent, so that the application generates an access request based on the IP address.

[0095] For example, taking the case where an application needs to access a business site with the domain name "km.oa.com", the zero-trust network agent listens on port 53 to hijack the domain name resolution request sent by the application, and extracts the domain name of the business site, that is, "km.oa.com", from the domain name resolution request. Then, based on the domain name query access control policy, when the domain name "km.oa.com" exists in the virtual IP configuration list, that is, when the domain name "km.oa.com" needs to be accessed through proxy access, the custom DNS logic in the zero-trust network agent will allocate a corresponding virtual IP address to the domain name "km.oa.com", such as "192.168.202.1", and then return this virtual IP address to the application, so that the application generates an access request for the domain name "km.oa.com" based on this virtual IP address.

[0096] In step S202, the zero-trust network agent obtains the address of the business site that the application needs to access from the access request.

[0097] In some embodiments, the address of a business site may include a domain name, such as "www.aaa.com," or an IP address, such as "10.28.0.12." For access requests in the form of IP addresses, since there is no domain name resolution process, they can be directly hijacked by the virtual network card. For access requests in the form of domain names, DNS resolution of the enterprise intranet domain name on the public network may fail (i.e., the corresponding IP address cannot be resolved) or the DNS resolution may be contaminated with the domain name. As a result, the application will not initiate subsequent network access requests (i.e., when the application initiates an access request for a business site in the form of a domain name address, it must wait until the DNS resolves the correct IP address before the access behavior can continue).

[0098] In response to the above technical problems, the access control method for a zero-trust network provided in an embodiment of the present application can obtain the domain name of the business site in the following manner: matching the IP address corresponding to the access request with the virtual IP configuration list in the access control policy; when the IP address exists in the virtual IP configuration list, querying the mapping list between the virtual IP address and the domain name based on the IP address to obtain the domain name of the business site; when the IP address does not exist in the virtual IP configuration list, querying the mapping list between the system's native IP address and the domain name based on the IP address to obtain the domain name of the business site. In this way, it can solve the problem that the intranet domain name of some enterprises fails to perform DNS resolution under the public network or the DNS resolution is polluted by the domain name, resulting in the application not initiating subsequent requests.

[0099] In step S203, the zero-trust network agent queries the access control policy of the zero-trust network based on the identifier of the application and the address of the business site, and obtains the access mode of the application to the business site.

[0100] In some embodiments, when the access control policy is a full-proxy type policy, the zero-trust network agent can obtain the access mode of the application accessing the business site in the following manner: match the application with multiple trusted application configuration nodes in the full-proxy type policy respectively, and match the address of the business site with multiple reachable area configuration nodes in the full-proxy type policy respectively; wherein the trusted application configuration node includes multiple feature fields of the application allowed to access (such as the name of the application, process name, serial number and signature information, etc.), and the reachable area configuration node includes multiple feature fields of the business site allowed to access (such as the name of the module where the reachable area is located, the name of the reachable area, etc.); when there is a trusted application configuration node that matches the application, and there is a reachable area configuration node that matches the address of the business site, the access mode is determined to be proxy access; when there is no trusted application configuration node that matches the application, or there is no reachable area configuration node that matches the address of the business site, the access mode is determined to be direct access.

[0101] In other embodiments, when the access control policy is a full direct connection type policy, the zero-trust network agent can obtain the access mode of the application accessing the business site in the following manner: match the application with multiple trusted application configuration nodes in the full direct connection type policy respectively, and match the address of the business site with multiple reachable area configuration nodes in the full direct connection type policy respectively; when there is a trusted application configuration node that matches the application and there is a reachable area configuration node that matches the address of the business site, the access mode is determined to be direct access; when there is no trusted application configuration node that matches the application, or there is no reachable area configuration node that matches the address of the business site, the access mode is determined to be proxy access.

[0102] For example, taking the access control policy stored in the zero-trust network agent as a full direct connection type policy, after the zero-trust network agent obtains the identifier of the application (such as application A) and the address of the business site (such as business site B) that application A needs to access, it matches application A with multiple trusted application configuration nodes in the full direct connection type policy, and matches the address of business site B with multiple reachable area configuration nodes in the full direct connection type policy; when application A exists in the trusted application configuration node and business site B exists in the reachable area configuration node, the access mode of application A to business site B is determined to be direct access; when application A does not exist in the trusted application configuration node, or business site B does not exist in the reachable area configuration node, the access mode of application A to business site B is determined to be proxy access.

[0103] In other embodiments, when the access control policy includes a direct connection configuration list, the zero-trust network agent can also obtain the access mode of the application to the business site in the following manner: matching the address of the business site with the direct connection configuration list; when the address of the business site exists in the direct connection configuration list, determining that the access mode of the application to the business site is direct connection access.

[0104] For example, taking business site A as an example, the addresses of multiple business sites (including IP addresses and domain name addresses) are stored in the direct connection configuration list. When the address of business site A hits the direct connection configuration list, that is, when the address of business site A exists in the direct connection configuration list, it is determined that the access mode of the application to business site A is direct connection access.

[0105] In some embodiments, when the access control policy includes a virtual IP configuration list, the zero-trust network agent can also obtain the access mode of the application accessing the business site in the following manner: matching the address of the business site with the virtual IP configuration list; when the address of the business site exists in the virtual IP configuration list, determining that the access mode of the application accessing the business site is proxy access.

[0106] For example, taking business site B as an example, the addresses of multiple business sites (such as virtual IP addresses) are stored in the virtual IP configuration list. When the address of business site B hits the virtual IP configuration list, that is, when the address of business site B exists in the virtual IP configuration list, it is determined that the access mode of the application to business site B is proxy access.

[0107] In other embodiments, after determining the access mode, the zero-trust network agent can establish a communication connection between the application and the business site based on the access mode and the zero-trust network; and send an access request to the business site through the communication connection, and send an access request response of the business site to the application through the communication connection.

[0108] It should be noted that for direct access, the source address / port of the access request will not be modified (that is, it always points to the application), so that a direct communication connection can be established between the application and the business site through the three-way handshake protocol; for proxy access, it is necessary to send credentials and access requests to the business site through the zero-trust network gateway (at this time, the source address / port is the source address / port of the zero-trust network gateway), that is, the zero-trust network gateway itself establishes a communication connection with the business site, and also needs to establish a communication connection with the application, so that the zero-trust network gateway can forward data between the two.

[0109] The following is a detailed description of the above two access modes.

[0110] In some embodiments, when it is determined in step S203 that the access mode is direct access, steps S204 to S206 are subsequently executed.

[0111] In step S204, the zero-trust network agent sends the hijacked access request to the business server.

[0112] In some embodiments, when the zero-trust network agent queries the access control policy of the zero-trust network based on the application's identification and the address of the business site, and obtains that the access mode of the application to the business site is direct access, the hijacked access request can be forwarded directly to the corresponding business server.

[0113] For example, taking application A accessing business site B with IP address "192.168.202.1" as an example, when the zero-trust network agent queries the access control policy of the zero-trust network based on the identification of application A and the IP address of business site B (for example, compares the IP address of business site B with the direct connection configuration list), and obtains that the access mode of application A to business site B is direct connection access, the access request sent by application A is directly forwarded through the physical network card to the business server with IP address "192.168.202.1".

[0114] In step S205, the business server returns an access request response to the zero-trust network agent.

[0115] In some embodiments, when the business server receives an access request forwarded by the zero-trust network agent, it responds and returns the response result to the zero-trust network agent. For example, when the access request sent by the application is a retrieval request, the business server can return the retrieval result to the zero-trust network agent.

[0116] In step S206, the zero-trust network agent sends the access request response returned by the business server to the application.

[0117] In some embodiments, after receiving the access request response returned by the business server, the zero-trust network agent sends the received access request response to the application, so that the application outputs the access request response to the human-computer interaction interface.

[0118] In other embodiments, when it is determined in step S203 that the access mode is proxy access, steps S204 to S206 will be replaced by steps S207 to S2017, that is, steps S207 to S2017 will be executed subsequently.

[0119] In step S207, the zero-trust network agent sends an authentication request to the zero-trust network client.

[0120] In some embodiments, when the zero-trust network agent queries the access control policy of the zero-trust network based on the application's identifier and the address of the business site, and obtains that the access mode of the application to the business site is proxy access, it first sends an authentication request to the zero-trust network client (i.e., applies to the zero-trust network client for the credentials corresponding to this access request).

[0121] In step S208 , the zero-trust network client applies for credentials for the access request from the zero-trust network server.

[0122] In some embodiments, after receiving the authentication request sent by the zero-trust network agent, the zero-trust network client extracts the request parameters carried in the authentication request, where the request parameters may include: the address and port of the application, the address and port of the business site, and the identification of the application (for example, the process identifier (PID, Process IDentification) corresponding to the application), etc. Then, the zero-trust network client can obtain the characteristic information of the application (for example, the MD5 value of the process corresponding to the application, the process path, the last modification time of the process, copyright information, signature information, etc.) based on the identification of the application carried in the request parameters. Subsequently, the zero-trust network gateway sends a credential request to the zero-trust network server (that is, applies for a ticket from the zero-trust network server), where the credential request carries the address and port of the application, the address and port of the business site, and the characteristic information of the application.

[0123] In step S209 , the zero-trust network server returns the credentials to the zero-trust network client.

[0124] In some embodiments, after receiving a credential request sent by a zero-trust network client, the zero-trust network server authenticates the credential request, and after the authentication is passed, generates a credential corresponding to the access request sent by the application, and returns the credential, the maximum number of uses of the credential, and the valid usage time of the credential as a response to the zero-trust network client.

[0125] In step S2010, the zero trust network client sends the credentials returned by the zero trust network server to the zero trust network agent.

[0126] In some embodiments, after receiving the credentials, the maximum number of uses of the credentials, and the valid usage time of the credentials returned by the zero trust network server, the zero trust network client sends the credentials, the maximum number of uses of the credentials, and the valid usage time of the credentials as a response to the authentication request to the zero trust network agent.

[0127] In step S2011, the zero-trust network agent sends the certificate to the zero-trust network gateway.

[0128] In some embodiments, after receiving the credentials sent by the zero-trust network client, the zero-trust network agent sends the credentials to the zero-trust network gateway, and the zero-trust network gateway forwards the credentials to the zero-trust network server so that the zero-trust network server verifies the credentials.

[0129] In step S2012, the zero trust network gateway sends the credentials to the zero trust network server for verification.

[0130] In some embodiments, after receiving the credentials sent by the zero-trust network gateway, the zero-trust network server verifies the credentials, for example, comparing the credentials sent by the zero-trust network gateway with the credentials stored in the zero-trust network server itself (i.e., the credentials generated in step S209). When the two are consistent, it is determined that the verification has passed, and a verification result indicating that the verification has passed is returned to the zero-trust network gateway; when the two are inconsistent, it is determined that the verification has failed, and a verification result indicating that the verification has failed is returned to the zero-trust network gateway.

[0131] It should be noted that when the zero-trust network gateway receives the verification result indicating verification failure returned by the zero-trust network server, it disconnects the communication connection with the zero-trust network agent so that the zero-trust network agent directly forwards the access request to the corresponding business server through the physical network card.

[0132] In step S2013, the zero-trust network agent sends the hijacked access request to the zero-trust network gateway.

[0133] In some embodiments, when the zero-trust network server passes the credential verification sent by the zero-trust network gateway, the zero-trust network agent forwards the access request sent by the hijacked application to the zero-trust network gateway, so that the zero-trust network gateway can access the target business site.

[0134] In step S2014, the zero-trust network gateway forwards the access request to the business server.

[0135] In some embodiments, after receiving an access request sent by the zero-trust network agent, the zero-trust network gateway forwards the access request to the corresponding business server based on the destination IP address or domain name carried in the access request (i.e., the IP address or domain name corresponding to the business server).

[0136] In step S2015, the business server sends an access request response to the zero trust network gateway.

[0137] In some embodiments, after receiving the access request forwarded by the zero-trust network gateway, the business server responds to the access request and returns the access request response to the zero-trust network gateway. For example, when the access request sent by the application is a search request, the business server can return the search result to the zero-trust network gateway.

[0138] In step S2016, the zero trust network gateway sends the access request response to the zero trust network agent.

[0139] In some embodiments, after receiving the access request response from the service server, the zero-trust network gateway returns the access request response to the zero-trust network agent running on the terminal device. For example, the zero-trust network gateway may return the search result returned by the service server to the zero-trust network agent running on the terminal device associated with the accessing user.

[0140] In step S2017, the zero-trust network agent sends the access request response to the application.

[0141] In some embodiments, after receiving the access request response returned by the business server forwarded by the zero trust network gateway, the zero trust network agent sends the received access request response to the application, so that the application outputs the access request response to the human-computer interaction interface.

[0142] The following describes the update process for the configuration information stored in the zero-trust network agent (including access control policies, the connection address of the zero-trust network server, the connection configuration information of the zero-trust network gateway, etc.).

[0143] In some embodiments, the updated configuration information (for example, the administrator has added a reachable area configuration node or modified the connection address configuration of the zero trust network gateway, such as modifying the connection protocol, connection address or connection port, etc.) can be actively pushed by the zero trust network server to the zero trust network agent.

[0144] For example, see Figure 4 , Figure 4 This is a flow chart of the access processing method of the zero-trust network provided by the embodiment of the present application, which will be combined with Figure 4 Steps S301 to S303 are shown for explanation.

[0145] In step S301 , a trigger is set in a zero-trust network server.

[0146] In some embodiments, a trigger can be set in the zero-trust network server, wherein the trigger condition of the trigger can be that when any one of the access control policy, the connection address of the zero-trust network server, and the connection configuration information of the zero-trust network gateway is updated, the zero-trust network server is triggered to automatically push the updated configuration information to the zero-trust network client.

[0147] In step S302, when the configuration information is updated, the zero-trust network server is triggered to push the updated configuration information to the zero-trust network client.

[0148] In some embodiments, when a trigger detects that configuration information stored in a zero-trust network server is updated, for example, when an administrator modifies an access control policy, the zero-trust network server is automatically triggered to push the modified access control policy to the zero-trust network client.

[0149] In step S303, the zero-trust network client sends the updated configuration information to the zero-trust network agent.

[0150] In some embodiments, after receiving the updated configuration information pushed by the zero trust network server, the zero trust network client pushes the received updated configuration information to the zero trust network agent, so that the zero trust network agent performs settings based on the received updated configuration information.

[0151] In other embodiments, the zero-trust network client may also receive a response result returned by the zero-trust network agent, and perform the following operations: construct a push status cache based on the response result of the zero-trust network agent; wherein the response result is generated after the zero-trust network agent is set based on the updated configuration information, and the push status cache is in the form of a key-value pair, and the key-value pair uses the hash value corresponding to the updated configuration information as the key, and the push timestamp and push status corresponding to the updated configuration information as the value; wherein the push status includes at least one of the following: unknown status, pending push status, push success, and push failure.

[0152] For example, taking the updated configuration information as configuration information A, after receiving configuration information A pushed by the zero-trust network client, the zero-trust network agent sets configuration information A and returns a response result (e.g., setting success) to the zero-trust network client. After receiving the response result returned by the zero-trust network agent, the zero-trust network client performs a hash operation on configuration information A to obtain the hash value corresponding to configuration information A. It then creates a cache item corresponding to configuration information A using the hash value corresponding to configuration information A as the key and the push timestamp and push status corresponding to configuration information A as the value; the push status is push success.

[0153] In other embodiments, the zero-trust network client may also perform the following processing for the configuration information corresponding to a specific timestamp and a specific hash value: when the zero-trust network agent successfully receives and sets the configuration information, queries the push status cache based on the specific hash value; when there is a cache record corresponding to the specific hash value in the push status cache, updates the push status corresponding to the specific hash value (for example, updates the push status from push failure to push success); when there is no cache record corresponding to the specific hash value in the push status cache, determines the number of cache items included in the push status cache; when the number of cache items is greater than a quantity threshold, deletes a preset number of cache items according to the push timestamp, and establishes cache items corresponding to the specific hash value and the specific timestamp in the deleted push status cache.

[0154] In other embodiments, the updated configuration information can also be synchronized to the zero-trust network agent by actively pulling it through the zero-trust network client.

[0155] For example, see Figure 4 , Figure 4 This is a flow chart of the access processing method of the zero-trust network provided by the embodiment of the present application, which will be combined with Figure 4 Steps S304 to S307 are shown for explanation.

[0156] In step S304, a timer is set in the zero trust network client.

[0157] In some embodiments, a timer may be set in the zero-trust network client so that the zero-trust network client periodically (for example, every 10 minutes) sends a configuration information acquisition request to the zero-trust network server.

[0158] In step S305, the zero-trust network client periodically sends a configuration information acquisition request to the zero-trust network server based on a timer.

[0159] In some embodiments, the zero-trust network client initiates a configuration information acquisition request to the zero-trust network server every time the timer setting expires. For example, when the timer setting period is 5 minutes, the zero-trust network client initiates a configuration information acquisition request to the zero-trust network server every 5 minutes.

[0160] In step S306, the zero-trust network server sends the updated configuration information to the zero-trust network client.

[0161] In some embodiments, when the zero-trust network server receives a configuration information acquisition request sent by a zero-trust network client, it checks whether the configuration information has been updated. When the configuration information has not been updated, it ignores the configuration information acquisition request sent by the zero-trust network client; when the configuration information is updated, it sends the updated configuration information to the zero-trust network client.

[0162] In step S307, the zero trust network client sends the updated configuration information to the zero trust network agent.

[0163] In some embodiments, after receiving the updated configuration information returned by the zero-trust network server, the zero-trust network client generates a corresponding hash value based on the obtained updated configuration information, and compares the generated hash value with the hash value corresponding to the last pushed configuration information recorded in the memory. When the two are inconsistent, the obtained updated configuration information is pushed to the zero-trust network agent; when the two are consistent, the push status corresponding to the last pushed configuration information is queried; when the push status is push failure or the corresponding record is not queried, the obtained updated configuration information is pushed to the zero-trust network agent.

[0164] It should be noted that Figure 4 The scheme of active pushing by the zero-trust network server and active pulling by the zero-trust network client shown can be executed synchronously. For example, a trigger can be set in the zero-trust network server and a timer can be set in the zero-trust network client at the same time. Of course, when the zero-trust network server fails to actively push the updated configuration information, the scheme of active pulling by the zero-trust network client can be executed. The embodiments of the present application do not limit this.

[0165] In other embodiments, although the combination of the zero-trust network server's active push solution and the zero-trust network client's active pull solution can improve the efficiency of configuration information synchronization, it cannot guarantee that the updated configuration information can be pushed 100% to the zero-trust network agent. In order to solve the problem of push failure and further improve the success rate of configuration information synchronization, the zero-trust network access processing method provided in the embodiment of the present application also uses the zero-trust network agent's pull solution as a backup solution.

[0166] For example, see Figure 5 , Figure 5 This is a flow chart of the access processing method of the zero-trust network provided by the embodiment of the present application, which will be combined with Figure 5 The steps shown are explained.

[0167] In step S401, the zero-trust network agent periodically sends a configuration information acquisition request to the zero-trust network client at a first frequency.

[0168] In some embodiments, when the zero-trust network agent does not obtain the updated configuration information, it can periodically send a configuration information acquisition request to the zero-trust network client at a first frequency (i.e., a high frequency, for example, once every 5 minutes) to request the updated configuration information.

[0169] In step S402, the zero-trust network client sends a configuration information acquisition request to the zero-trust network server.

[0170] In some embodiments, after receiving the configuration information acquisition request sent by the zero trust network agent, the zero trust network client forwards the request to the zero trust network server.

[0171] In step S403, the zero-trust network server sends the updated configuration information to the zero-trust network client.

[0172] In some embodiments, when a zero-trust network server receives a configuration information acquisition request forwarded by a zero-trust network client, it checks whether the configuration information stored in itself has been updated. When the configuration information has not been updated, it ignores the configuration information acquisition request sent by the zero-trust network client; when the configuration information is updated, it sends the updated configuration information to the zero-trust network client.

[0173] In step S404, the zero trust network client sends the updated configuration information to the zero trust network agent.

[0174] In some embodiments, after the zero-trust network client receives the updated configuration information returned by the zero-trust network server, the received updated configuration information is pushed to the zero-trust network agent.

[0175] It should be noted that the zero-trust network client needs to pass the authentication of the push interface of the zero-trust network agent before it can successfully call the push interface of the zero-trust network agent and push the updated configuration information to the zero-trust network agent.

[0176] In step S405, the zero-trust network agent continues to periodically send a configuration information acquisition request to the zero-trust network client at the second frequency to request the updated configuration information.

[0177] In some embodiments, when the zero-trust network agent successfully receives and sets the updated configuration information pushed by the zero-trust network client, since the configuration information will not be updated again immediately after the update, the zero-trust network agent can continue to periodically send configuration information acquisition requests to the zero-trust network client at a second frequency (i.e., a lower frequency, such as once every 30 minutes) to request the updated configuration information. This avoids the problems of untimely configuration information retrieval (when the frequency setting is low) and excessive resource consumption (when the frequency setting is high) in related technologies.

[0178] The access processing method for a zero-trust network provided in the embodiment of the present application solves the problem of network access interruption or jitter caused by switching between a full direct connection type policy and a full proxy type policy, and at the same time optimizes the problem of slow terminal effectiveness after the access control policy is adjusted by the management and control end. In a zero-trust network access architecture, the network access operations of terminal users are controlled and affected by the access control policy. The access processing method for a zero-trust network provided in the embodiment of the present application supports administrators to flexibly switch between a full direct connection type policy and a full proxy type policy, and realizes network access configuration information synchronization between a zero-trust network agent and a zero-trust network client in real time through a solution based on configuration changes, timestamps and configuration hash values. Compared with the solution provided by the related art that only relies on periodic pulling of configuration information, the access processing method for a zero-trust network provided in the embodiment of the present application can improve the efficiency of configuration information synchronization, shorten terminal response time, and improve the stability of network access.

[0179] The following describes an exemplary application of the embodiments of the present application in a practical application scenario.

[0180] The zero-trust network architecture provided by related technologies typically only supports administrators issuing a single access control policy type (i.e., a full-agent policy) and allows administrators to make adjustments within only one access control policy type, without the ability to switch between different access control policy types. Furthermore, in related technologies, zero-trust network agents typically only periodically request configuration information from zero-trust network clients (such as Intelligent Office Automation (IOA) clients). Upon receiving a configuration request, the IOA client collects the latest access control policy and network-related configuration information and sends a configuration response to the zero-trust network agent. This means that when an administrator changes the access control policy or network-related configuration information configured on the management client, the zero-trust network agent must wait until the IOA client sends a configuration request before the IOA client can synchronize the latest configuration information with the zero-trust network agent. During this period, network access is prone to jitter, leading to frequent access failures. The terminal takes a long time to respond to configuration changes, resulting in poor network access stability.

[0181] In view of this, the embodiment of the present application provides an access processing method for a zero-trust network, which can support administrators to issue full direct connection type policies or full proxy type policies, and allow administrators to flexibly switch between the two policy types, providing greater configuration flexibility. At the same time, it also solves the problem of DNS resolution errors or DNS failures in domain name type site access when switching between the two policy types, and also solves the problem of network access jitter caused by switching between proxy access and direct access. When the access control policy or network-related configuration information changes, the IOA client realizes the rapid synchronization of network access configuration information between the zero-trust network agent and the zero-trust network client by combining active push based on trigger points and periodic pull. Compared with the solution provided by the related art that only relies on periodic pulling of configuration information, the access processing method for a zero-trust network provided by the embodiment of the present application can improve the efficiency of configuration information synchronization while shortening the terminal's response time to configuration information changes, thereby improving the stability of network access.

[0182] The zero-trust network access processing method provided in the embodiment of the present application can be applied to online office scenarios, can ensure an efficient and stable remote collaborative office experience, and promote the application of zero-trust technology in the digital industry.

[0183] The following is a detailed description of the zero-trust network access processing method provided in the embodiment of the present application.

[0184] For example, see Figure 6 , Figure 6This is a schematic diagram of a scenario in which an administrator configures an access control policy for a zero-trust network, as provided in an embodiment of the present application. Figure 6 As shown, interface 600 is the corresponding interface when logging into a zero-trust network client (such as an IOA client) based on the administrator's account. The administrator can configure the access control policy associated with the trusted application in the trusted application configuration area 610 presented in interface 600; of course, the administrator can also configure the access control policy associated with the business system in the business system configuration area 620 presented in interface 600.

[0185] The zero-trust network access processing method provided in the embodiment of the present application allows administrators to configure business sites in the form of IP or domain names.

[0186] For example, see Figure 7A , Figure 7A This is a schematic diagram of a scenario in which an administrator configures an access control policy for a zero-trust network provided by an embodiment of the present application. Figure 7A As shown, a category selection box is presented in the business system configuration interface 700. When the administrator selects "IP" 710 in the category selection box, he can also select "Specify IP" or "IP segment" in the "IP" column 720. In addition, the administrator can also configure the "Port" 730, for example, configure it to all ports or specified ports.

[0187] For example, see Figure 7B , Figure 7B This is a schematic diagram of a scenario in which an administrator configures an access control policy for a zero-trust network provided by an embodiment of the present application. Figure 7B As shown, when the administrator selects “Domain Name” 740 in the category selection box presented on the business system configuration interface 700 , the administrator may also fill in the domain name of a specific business site in the domain name filling box 750 .

[0188] The access processing method of the zero-trust network provided in the embodiment of the present application is based on a combined control strategy of people (identity)-application-target business system, realizes traffic filtering, supports wildcard domain names, IP segments, and multiple ports, and can be inherited and expanded based on the user's organizational structure.

[0189] For example, see Figure 8 , Figure 8 This is a schematic diagram of a scenario in which an administrator configures an access control policy for a zero-trust network provided by an embodiment of the present application. Figure 8As shown, the administrator can also create multiple user accounts (i.e., access user accounts) in the account creation area 810 presented in the interface 800. The user accounts can be individual user accounts or group user accounts, which is not limited in this embodiment of the present application. For group user accounts, configuration information inheritance can also be achieved. For example, the user account at the next level can inherit the configuration information of the user account at the previous level.

[0190] The following describes the configuration process of trusted applications.

[0191] For example, see Figure 9 , Figure 9 This is a configuration diagram of a trusted application provided by an embodiment of the present application. Figure 9 As shown, the configuration interface 900 of the trusted application presents: the application process name 910, signature information 920, version 930, the hash value corresponding to the process (such as MD5 value) 940 and the hash value corresponding to the process (such as sha256 value) 950.

[0192] Furthermore, when zero-trust office is enabled, end users can implement zero-trust office functions by logging into a zero-trust network client (such as an IOA client).

[0193] For example, see Figure 10 , Figure 10 This is a schematic diagram of a scenario in which a user accesses a zero-trust network client provided by an embodiment of the present application, such as Figure 10 As shown, a variety of login methods are displayed in the login interface 1000, including code scanning login or account login. Accessing users can use any method to log in to the zero-trust network client (such as the IOA client).

[0194] For example, see Figure 11A , Figure 11A This is a schematic diagram of a scenario in which a user queries an access control policy provided by an embodiment of the present application, such as Figure 11A As shown, interface 1100 is the interface presented after the accessing user successfully logs into the zero-trust network client. The user account 1101 of the accessing user is presented in interface 1100. In addition, the "Office Security Real-time Protection" control 1102 is also presented in interface 1100. When the accessing user clicks the control 1102, the corresponding sub-interface 1103 will be presented in the form of a pop-up window in interface 1100. The protection strategy in the access control strategy configured by the administrator is presented in sub-interface 1103, such as application entry protection and system bottom-level protection. Among them, application entry protection includes desktop icon protection, camera protection, USB disk protection, file download protection, and web firewall. System bottom-level protection includes file system protection, registry protection, process protection, driver protection, and hacker intrusion protection.

[0195] For example, see Figure 11B , Figure 11B This is a schematic diagram of a scenario in which a user queries an access control policy provided by an embodiment of the present application, such as Figure 11B As shown, when the accessing user clicks the "Trusted Software Configured" control 1104 in interface 1100, a corresponding sub-interface 1105 is displayed in a pop-up window within interface 1100. Sub-interface 1105 displays the application policies within the access control policy configured by the administrator, such as trusted software (i.e., trusted applications) and blocked software. Trusted software includes application categories and business applications. For example, if the application type is a search application, the business applications can be Browser 1 (e.g., Internet Explorer), Browser 2 (e.g., Chrome), and Browser 3 (e.g., QQ Browser).

[0196] The access processing method for a zero-trust network provided in an embodiment of the present application enables end users to access the business system configured by the administrator through designated trusted applications based on the user-level policy issued by the management end.

[0197] The following is a detailed description of the zero-trust network access processing method provided in the embodiment of the present application from a technical perspective.

[0198] For example, see Figure 12 , Figure 12 This is a schematic diagram of the access process of the zero-trust network provided by the embodiment of the present application, such as Figure 12 As shown, the zero-trust network client (such as the IOA client) acts as a zero-trust network security service provider, and provides a unified entrance for the access subject to access the object's resources through the zero-trust network agent and the zero-trust network gateway (such as the smart gateway). The IOA client provides authentication operations for the unified entrance. Only network requests that pass the authentication can be forwarded by the zero-trust network agent to the smart gateway, and access to the actual business system is proxied by the smart gateway.

[0199] For example, see Figure 13 , Figure 13 This is a schematic diagram of the architecture of the access processing system for the zero-trust network provided by the embodiment of the present application. Figure 13 As shown, the core modules of the access processing system of the zero-trust network mainly include: zero-trust network client (such as IOA client), zero-trust network server (such as IOA server), zero-trust network agent (such as full-flow agent) and zero-trust network gateway (such as smart gateway), which are explained below.

[0200] The IOA client is a security agent installed on the work device of the accessing user (such as a company employee). It is responsible for verifying the user's trusted identity on the device, verifying whether the device is trustworthy, and verifying whether the application is trustworthy. At the same time, it is also used to apply for unknown processes to the IOA server for process inspection.

[0201] The zero-trust network proxy is mainly used to hijack device traffic (such as access requests sent by applications) through the TUN / TAP virtual network card. After authentication by the IOA client, it is responsible for forwarding the network requests sent by the application to the smart gateway. If the authentication fails, a direct connection is made or the connection is terminated.

[0202] The intelligent gateway is deployed at the entrance of enterprise applications and data resources, and is responsible for authenticating, authorizing and forwarding each session request to access enterprise resources.

[0203] The IOA server is primarily used to securely dispatch business traffic through a policy control engine, authorizing it at the granularity of person-device-business system-application. The IOA server includes an authentication module for verifying the identity of the accessing user; a device trust module for verifying the device's hardware and security information; and an application detection module for detecting the security of application processes, such as the presence of vulnerabilities or viruses. Furthermore, the IOA server regularly submits files for inspection to the threat intelligence cloud service or an antivirus engine (such as the TAV antivirus engine). When a malicious process is identified, an asynchronous blocking operation is performed through the client.

[0204] The overall process is as follows: When the access subject initiates a network access request for the access object through an application, the zero-trust network agent (such as a full-flow agent) hijacks the access request initiated by the application through the TUN / TAP virtual network card. If the access control policy determines that it is a full-proxy policy type, the zero-trust network agent requests a ticket from the IOA client, and the IOA client then applies for a ticket from the IOA server. After the IOA client successfully applies for the ticket, it responds to the zero-trust network agent. Subsequently, the zero-trust network agent sends the actual network access traffic to the intelligent gateway through the physical network card, and the intelligent gateway acts as the agent for the actual business access. If the access control policy determines that it is a full direct connection policy type, the zero-trust network agent hijacks the network access request sent by the application, and directly conducts network access and response processes with the corresponding destination business site through the physical network card to achieve direct access.

[0205] For the full proxy policy type, the specific process is as follows: The IOA client first hijacks the network access request initiated by the application through the Zero Trust Network Agent. Then, the Zero Trust Network Agent initiates an authentication request to the IOA client (i.e., the Zero Trust Network Agent requests credentials for this network access request from the IOA client). The request parameters include the source IP or domain name, source port, destination IP or domain name, destination port, and the process identifier (PID) corresponding to the application. The IOA client then uses the PID sent by the Zero Trust Network Agent to collect the MD5 of the process, process path, last modification time, copyright information, and signature information. Together with the source IP or domain name, source port, destination IP or domain name, and destination port carried in the network access request sent by the Zero Trust Network Agent, the client requests a ticket from the IOA server. If the request is successful, the IOA client returns the ticket, the maximum number of uses for the ticket, and the ticket's validity period to the Zero Trust Network Agent as a response. At this time, the zero-trust network agent can initiate an Https request to the smart gateway. The authorization header field of the request carries the network request credentials (i.e., ticket) returned by the IOA client. After receiving the Https request sent by the zero-trust network agent, the smart gateway parses the ticket in the header field and requests the IOA server to verify the ticket. If the verification is successful, a connection is successfully established between the smart gateway and the zero-trust network agent. The zero-trust network agent can then send the network access request initiated by the hijacked application to the smart gateway, which will forward it to the corresponding business server and proxy the actual application network access. If the IOA server fails to verify the ticket, the connection between the zero-trust network agent and the smart gateway is interrupted. For traffic from applications accessing specific sites outside the access control policy, a network access request is initiated to the target business server through the zero-trust network agent to achieve direct access.

[0206] Furthermore, IP-based site access can be directly hijacked by the virtual network card because there's no domain name resolution process. However, for business sites with domain names, such as "km.oa.com" and "www.crop.com," DNS resolution of the corporate intranet domain name on the public network may fail (i.e., the corresponding IP address cannot be resolved) or the DNS resolution may be contaminated, preventing the application from initiating subsequent network requests. (When an application initiates access to a domain-based site, it must wait for DNS to resolve the correct IP address before continuing.)

[0207] To address the above technical issues, the zero-trust network access processing method provided in the embodiments of the present application uses a zero-trust network agent to capture DNS requests by listening on port 53, and executes a custom DNS resolution logic for the DNS requests: that is, for each domain name requesting DNS resolution, a corresponding virtual IP address (e.g., "192.168.220.1") is automatically generated, and a mapping relationship between the domain name and the virtual IP address is generated. For example, when an application requests a DNS request for the domain name "www.crop.com", the zero-trust network agent listens on port 53 and automatically assigns a corresponding virtual IP address to "www.crop.com", such as "192.168.220.12", and stores the mapping relationship between this domain name and the virtual IP address: "www.crop.com" - "192.168.220.12". The custom DNS resolution process is described in detail below.

[0208] For example, see Figure 14 , Figure 14 This is a schematic diagram of the principle of executing custom DNS logic for the domain name carried in the network access request provided by the embodiment of the present application, such as Figure 14 As shown, when an application initiates a network access request for a business site in the form of a domain name, it first sends a DNS request. The DNS request passes through the virtual network card and is captured by the zero-trust network agent (such as a full-flow agent) and enters the custom DNS logic of the zero-trust network agent. The zero-trust network agent first determines whether the domain name needs to be accessed through a proxy (that is, whether access to the actual business site needs to be proxied through an intelligent gateway) based on the access control policy sent by the IOA server to the IOA client (the specific access control policy must be sent to the zero-trust network agent by the IOA client through configuration synchronization). If so, the custom DNS logic allocates the corresponding virtual IP address and stores the mapping relationship between the virtual IP address and the domain name in the zero-trust network agent. If the proxy access type is not required, it goes directly to the system DNS to perform DNS resolution and generate the system native IP address.

[0209] The following example illustrates the execution of custom DNS logic when an application accesses a business site with the domain name "km.oa.com".

[0210] For example, see Figure 15 , Figure 15 This is a flow chart of executing custom DNS logic for a domain name carried in a network access request provided by an embodiment of the present application, such as Figure 15As shown, the application first performs DNS resolution for the domain name "km.oa.com." This DNS resolution traffic is automatically imported into the virtual network card, and the zero-trust network agent (such as a full-flow agent) takes over DNS resolution. At this point, the zero-trust network agent first queries the access control policy to check whether the domain name is included in the access control policy. If the domain name is included in the access control policy, it is considered to be an enterprise intranet domain name and the virtual IP address is allocated. If the domain name is not included in the access control policy, it is considered not an intranet domain name and is sent to the system DNS for DNS resolution to resolve the system's native IP address.

[0211] Continue to see Figure 15 , the Zero Trust Network Agent successfully resolves the domain name "km.oa.com" to the IP address "100.8.0.x." When the Zero Trust Network Agent responds to the virtual IP address or resolves the system's native IP address via the system DNS, it sends the result to the application via the virtual network card, completing the application's DNS resolution process. At the same time, the Zero Trust Network Agent also stores the mapping between the virtual IP address (the result of custom DNS logic processing) and the domain name, or the mapping between the system's native IP address (the result of system DNS resolution) and the domain name in the Zero Trust Network Agent's memory.

[0212] After the application successfully performs DNS resolution, it will immediately send a TCP request to the IP address resolved by DNS (which may be a virtual IP address or the system native IP address resolved by the system DNS), such as "100.8.0.x". The TCP request will also enter the virtual network card and be captured by the zero-trust network agent. The zero-trust network agent will use the IP address (the value is 100.8.0.x) to check whether the domain name is in the virtual IP address-domain name mapping list or the system native IP address-domain name mapping list. If "km.oa.com" is configured in the access control policy, the corresponding domain name will be retrieved from the virtual IP address-domain name mapping list based on the IP address, and finally the domain name corresponding to the request is obtained as "km.oa.com", thereby completing the virtual IP address-actual domain name lookup.

[0213] This method can solve the problem of applications not initiating subsequent requests due to the failure of DNS resolution of some companies' intranet domain names on the public network (i.e., the inability to resolve the corresponding IP address) or domain name pollution in DNS resolution.

[0214] The following introduces the specific content of the access control strategy of the zero-trust network.

[0215] The access control policy for a zero-trust network consists of a configuration node for reachable zones (i.e., the enterprise's core internal sites) and a configuration node for trusted applications (i.e., security applications that specify end users with access to reachable zones). The following is an example of an access control policy and a description of the fields. (The content following / / in the following content indicates an explanation of the fields to the left.)

[0216] {

[0217] "Name": "ngnpol", / / name of the access control policy

[0218] "Details": { / / The main content of the access control policy

[0219] "switch": "1", / / Whether to enable this policy. If the value is "1", it means it is enabled; if the value is "0", it means it is disabled.

[0220] "policytype": "proxy_access", / / indicates the type of access mode used in the policy. If the value is "proxy_access", it indicates a full proxy policy type; if the value is "direct_access", it indicates a full direct connection policy type

[0221] "accessiblearea": [{ / / Configuration node of the accessible area in the policy

[0222] "areamodule": "domain_type1", / / the module name where the reachable area is located

[0223] "name": "corp OA", / / the name of the reachable area

[0224] "type": "domain", / / indicates that the "connaddr" item represents a domain name or IP. If the value is "domain", it means that "connaddr" is a domain name. If the value is "IP", it means that the value of the "connaddr" item is an IP address.

[0225] "filterport": "1", / / indicates whether to filter the port. If the value is 1, the port is filtered through the "connport" item. If the value is 0, it means not filtering the port (and allowing any port)

[0226] "connaddr": / / indicates the access object; it can be a specific access object or multiple access objects represented by wildcards. For example, "*.tfs.corp.com" indicates that the domain name with * supports fuzzy matching. Please filter out formats such as *.com and *.cn. * only performs fuzzy matching on subdomains.

[0227] "connport": "899" / / indicates the port number of the access object. If filterport is 1, the port number must be included. It can be 1 or multiple. If filterport is 0, it can be empty. Please separate multiple ports with semicolons (i.e. English semicolons).

[0228] },

[0229] {

[0230] "areamodule": "domain_type2",

[0231] "name": "sof OA",

[0232] "type": "domain",

[0233] "filterport": "1",

[0234] "connaddr": "*.oa.sof.com",

[0235] "connport": "443;27800"

[0236] }

[0237] ],

[0238] "trustedapp": [{ / / Configuration node for trusted applications in the policy

[0239] "appname": "MS OFFICE OUTLOOK", / / the name of the application

[0240] "procname": "OUTLOOK.exe", / / the process name of the application

[0241] "category_serialnum": 1, / / serial number of the category to which the application belongs

[0242] "categoryname": "office", / / the name of the class to which the application belongs

[0243] "signature": "Microsoft Corporation", / / signature information

[0244] "appversion": "4.0.2.132", / / version number

[0245] "corp": "Microsoft" / / Application copyright information

[0246] }]

[0247] }

[0248] }

[0249] As shown in the example above, the accessible internal corporate sites specified by the access control policy are: *.tfs.corp.com (only port 899 is accessible) and *.oa.sof.com (accessible ports 443 and 27800). Users can only access these two sites through OUTLOOK.exe (version 4.0.2.132).

[0250] In the above policy example, "policytype" indicates the type of access control policy. If the value of this item is "proxy_access", it indicates a full proxy type policy; if the value of this item is "direct_access", it indicates a full direct type policy.

[0251] The following describes the full proxy and full direct connection policies, where an end user using an application A to access a site U is called an application-site combination. For a full proxy policy, only application-site combinations that meet the reachable regions and trusted applications specified in the policy will have access to the actual business site proxied through the intelligent gateway. For application-site combinations that do not meet the access control policy, network access is achieved through a direct connection to the business site via the zero-trust network agent. For a full direct connection policy, only application-site combinations that meet the reachable regions and trusted applications specified in the policy will have network access achieved through a direct connection to the business site via the zero-trust network agent. For application-site combinations that do not meet the access control policy, network access is achieved through a direct connection to the business site via the intelligent gateway.

[0252] In addition, the IOA client synchronizes the direct connection configuration list and virtual IP configuration list with the Zero Trust Network Agent, enabling flexible switching between direct and proxy access types. The direct connection configuration list indicates that the Zero Trust Network Agent directly connects to the target business site without going through the intelligent gateway agent.

[0253] For example, the JSON format of the direct connection configuration list information synchronized by the IOA client to the zero trust network agent is as follows:

[0254] {

[0255] "rule": ["direct"], / / Rule type: direct access

[0256] "servers": ["*.xx1.com", "xx1.com", "*.xx2.com:80", "1.2.8.4", "1.2.3.4:8088"], / / List of directly connected server connection addresses (* is a wildcard, representing any character)

[0257] "hash": "xx", / / The hash value of the current configuration content, used to uniquely identify the current configuration

[0258] "timestamp": 1608189498 / / The timestamp sent by the current configuration is used to prevent the setting from being overwritten. When the timestamp is less than or equal to the current timestamp, the setting is ignored.

[0259] }

[0260] For any domain names or IP addresses that are hit, a fully direct connection policy will be enforced, forcing network access to the target business site directly through the Zero Trust Network Agent, bypassing the intelligent gateway proxy. This means that domain names in the direct connection configuration list are resolved to their corresponding IP addresses through the system DNS, rather than through the virtual IP addresses generated by the Zero Trust Network Agent's custom DNS logic.

[0261] The virtual IP configuration list represents a list of domain names that comply with the access control policy and need to be resolved into virtual IP addresses by the custom DNS logic of the zero-trust network agent. Its corresponding JSON format is as follows:

[0262] {

[0263] "rule": "fakeIP", / / Rule type: "Virtual IP"

[0264] "servers": ["www.oa.com", "*.corp.com"], / / A list of domain names that need to be resolved into virtual IP addresses (* is a wildcard character representing any character)

[0265] "hash": "xxxxx", / / The hash value of the current configuration content, used to uniquely identify the current configuration

[0266] "timestamp": 1608189542 / / The timestamp sent by the current configuration is used to prevent the setting from being overwritten. When the timestamp is less than or equal to the current timestamp, the setting is ignored.

[0267] }

[0268] The content of the virtual IP configuration list is the policy in the access control policy (that is, the custom DNS logic in the zero-trust network agent), which consists of the enterprise's internal domain name sites.

[0269] When the access control policy is a full proxy type policy, the direct connection configuration list is a list of all backend servers corresponding to the IOA server (if it is a stand-alone deployment, it is the server connection address of the stand-alone deployed IOA server; if it is a cluster distributed deployment, it is a list of server connection addresses of all distributed deployments) and a list of all intelligent gateway connection addresses. The virtual IP configuration list is a list of all domain names and virtual IP addresses in the access control policy.

[0270] When the access control policy is a fully direct connection policy, the direct connection configuration list consists of the domain name information in the access control policy (excluding the virtual IP address in the policy), the list of all servers corresponding to the IOA server, and the list of all smart gateway connection addresses. The virtual IP configuration list can be left empty.

[0271] The following is an example.

[0272] For example, assume that an enterprise administrator configures the IOA server connection addresses as 10.80.25.6:8451, 10.80.25.6:8451, www.crop.com:8454, and km.srp.co.com:8492, and the smart gateway connection addresses as www.sg.com:9445 and crop.sg.com:8492. The reachable zones in the access control policy include www.a.com, www.b.com, www.c.com, 10.11.56.24, and 10.28.0.12.

[0273] When the type of access control policy configured by the administrator is a full proxy type policy, the direct connection configuration list is the list of all server connection addresses and smart gateway connection addresses corresponding to the IOA server, that is, the collection of "10.80.25.6:8451", "10.80.25.6:8451", "www.crop.com:8454", "km.srp.co.com:8492", "www.sg.com:9445" and "crop.sg.com:8492", and the virtual IP configuration list is all domain names and IP addresses in the access control policy, that is, "www.a.com", "www.b.com", "www.c.com", "10.11.56.24" and "10.28.0.12".

[0274] When the administrator configures a fully direct connection access control policy, the direct connection configuration list is a list of all server connection addresses and smart gateway connection addresses corresponding to the IOA server, as well as all reachable zone information (including domain name type and IP type) in the access control policy. This list includes "10.80.25.6:8451," "10.80.25.6:8451," "www.crop.com:8454," "km.srp.co.com:8492," "www.sg.com:9445," "crop.sg.com:8492," "www.a.com," "www.b.com," "www.c.com," "10.11.56.24," and "10.28.0.12." The virtual IP configuration list can be left empty.

[0275] The zero-trust network access processing method provided in the embodiment of the present application combines the two methods of configuration-aware change push and configuration pull response to realize timely and stable configuration synchronization logic between the IOA client and the zero-trust network agent, which is described in detail below.

[0276] For example, see Figure 16 , Figure 16 This is a schematic diagram of the principle of realizing configuration information synchronization between the IOA client and the zero-trust network agent by combining configuration-aware change push and configuration pull response provided by the embodiment of the present application, as shown in FIG. Figure 16As shown in the figure, "package1, package2, package3...packageN" represent different network data packets processed by the zero-trust network agent (such as the agent client); "A, B, C, D..." represent different data packets sent and responded to when the agent client and the IOA client execute terminal local process communication; "Trigger" represents a trigger; "Timer" represents a timer; "policy" represents an access control policy; "server config" represents the connection address corresponding to the IOA server, including the connection address for stand-alone deployment and the set of connection addresses of all servers in a cluster distributed deployment scenario; "SG config" represents the connection address configuration of the smart gateway, including the connection protocol, connection address, and connection port; "Check" indicates checking the configuration sending status; "LastConfig" indicates the last sent configuration; "DirectSrv" indicates the direct connection configuration list; "InterDomain" indicates the virtual IP configuration list; "state_cache" indicates the configuration sending status cache; "hash:state" represents the mapping table between the configuration hash value (hash) and the configuration sending status; "authentication" indicates the verification process of the agent client push interface; and "MsgPush" indicates executing configuration push.

[0277] The access processing method for a zero-trust network provided in an embodiment of the present application realizes rapid synchronization of configurations between a zero-trust network agent and an IOA client by combining push and pull methods. Among them, the access control policy, the connection address configuration of the IOA server, and the intelligent gateway configuration serve as trigger factors for push. When at least one of these three factors changes, the IOA client is triggered to pull the latest configuration information, including reading and parsing the access control policy, reading the latest connection address of the IOA server, and reading and parsing the latest intelligent gateway connection configuration information. Then, the current virtual IP configuration list and the direct connection configuration list are combined and a hash value is generated based on the configuration content. Then, based on the hash value, it is determined whether the current configuration is the same as the hash value of the last pushed configuration recorded in the memory of the IOA client. If different, the configuration push is executed immediately; if the hash value of the current configuration is the same as the hash value of the last pushed configuration, the push status of the last configuration is queried. If the configuration push status corresponding to the hash value in the push status cache is a push failure, or if the record corresponding to the hash value is not found in the push status cache, it is considered that the current configuration needs to be pushed. The IOA client calls the push interface of the zero-trust network agent to push the current virtual IP configuration list (InterDomain) and direct connection configuration list (DirectSrv).

[0278] The zero-trust network agent first authenticates the push interface call request of the IOA client. If the authentication fails, the IOA client push fails. If the authentication succeeds, the zero-trust network agent receives these two types of configurations, namely the virtual IP configuration list (InterDomain) and the direct connection configuration list (DirectSrv), and parses the timestamps and hash values therein, and compares them with the timestamps of the historical configurations that have already performed the setting operation. If the current timestamp is newer than the timestamp of the historical configuration, the current configuration is considered to be the new configuration and proceeds to the next step of inspection and setting; otherwise, it is considered to be the old configuration and can be ignored.

[0279] After checking whether the current configuration is a new configuration, the zero-trust network agent compares the hash value of the current configuration with the hash value of the most recently set historical configuration to see if they are the same. If they are the same, the processing is ignored and the IOA client is responded with the result of the normal configuration setting to avoid repeatedly setting the same configuration and affecting network access, such as clearing the existing DNS cache or refreshing the new virtual IP list to cause network jitter; if they are not the same, the zero-trust network agent performs a configuration refresh operation and responds to the setting result to the IOA client at the same time. The IOA client builds a push status cache based on the result of the zero-trust network agent's response.

[0280] The push status cache can be composed of multiple cache items. Each cache item consists of the hash value corresponding to the cache and the push status, forming a key-value pair structure, where the key is the hash value corresponding to the configuration information, and the value includes the push timestamp and push status of the configuration information. The push status includes unknown status, pending push status, push success, and push failure. After receiving the response result from the zero trust network agent, the IOA client builds the push status cache. In addition, for a specific timestamp T and a specific hash value H If the zero-trust network agent successfully receives and sets the configuration information, the IOA client first searches the push status cache for the specific hash value. H Corresponding cache record, if there is a corresponding cache record, update the specific hash value H The corresponding push status. If no specific hash value is found H The corresponding cache records are further checked to see if the number of cache items exceeds the set maximum value. If it exceeds the maximum value, the cache records are traversed and a preset number (for example, 1 / 2) of historical cache records are deleted based on the push timestamp. When the number of current cache records is less than the cache maximum value, the push status cache automatically creates a new cache with a specific hash value. H and a specific timestamp T The corresponding cache item.

[0281] In addition, when a push configuration fails, the IOA client automatically enters the push retry state. After reaching the maximum number of retries, for example 3 times, if the push still fails, the push is stopped and the last push result is recorded in the push status cache.

[0282] For example, see Figure 16 If the configuration push triggered by the three configuration push triggers (access control policy, IOA server connection address configuration, and smart gateway connection address configuration) fails, you can set a timer to periodically check and push the configuration to improve the synchronization efficiency and availability. The specific process is as follows:

[0283] The IOA client first reads and parses the latest access control policy, the latest IOA server connection address, and the latest intelligent gateway configuration from the IOA server, combining these to form the current virtual IP configuration list and direct connection configuration list. A hash value is generated based on the configuration content. Based on the hash value, the client then determines whether the current configuration matches the hash value of the last configuration push recorded in the IOA client's memory. If they are different, the configuration push is immediately executed. If the hash values of the current configuration match the last configuration push, the client queries the last configuration push status. If the configuration push status corresponding to the hash value in the push status cache indicates a push failure, or if no push record corresponding to the hash value is found in the push status cache, the client assumes that the current configuration needs to be pushed. At this point, the IOA client can call the push interface of the Zero Trust Network Agent to push the current virtual IP configuration list (InterDomain) and direct connection configuration list (DirectSrv). Only after the IOA client passes the push interface authentication of the zero-trust network agent can it successfully call the push interface of the zero-trust network agent, receive the response result of the zero-trust network agent, and adjust the push status cache based on the result.

[0284] It should be noted that the configuration push process executed due to the trigger mechanism may be executed in parallel with the configuration check and push process through the timer period. In order to achieve accurate configuration synchronization and avoid errors, it is necessary to ensure that the addition, modification, and deletion of push status cache items are thread-safe. When the Zero Trust Network Agent receives multiple configurations at the same time, it selects the latest configuration information based on the timestamp of the configuration information and uses the hash value to avoid repeatedly setting the same configuration information in a short period of time, which may cause performance consumption and network jitter.

[0285] The above introduces the solution for pushing configuration information between the IOA client and the zero-trust network agent. Although the two methods of actively pushing by combining trigger factors and setting timer periodic checking and pushing are used, it still cannot guarantee that the configuration information of the IOA client can be pushed successfully 100%, and there is still a certain probability of push failure. In order to solve the problem of failure of active push by the IOA client and to further improve the success rate of configuration information synchronization, the zero-trust network access processing method provided in the embodiment of the present application can also use the zero-trust network agent to periodically pull the configuration information of the IOA client as a backup solution. Figure 16 As shown, after the IOA client receives the server connection address configuration information, smart gateway connection address configuration information, and access control policy from the IOA server through the network, the zero-trust network agent can periodically initiate a configuration information pull request to the IOA client by setting a high frequency (for example, sending once every 5 minutes). The IOA client parses the configuration information and responds to the zero-trust network agent with the latest configuration information. After the zero-trust network agent successfully receives the configuration information responded by the IOA client, it can be adjusted to a low frequency (for example, sending once every half an hour). In this way, while reducing consumption, the timeliness of the configuration information is detected and updated. At the same time, a backup mechanism that complements the configuration information push mechanism is also implemented. In other words, the zero-trust network access processing method provided in the embodiment of the present application can achieve a high configuration synchronization success rate by combining the IOA client's active push and the zero-trust network agent's active pull mechanism, avoiding the problems of low configuration information update timeliness, high configuration synchronization error rate, untimely configuration pull (when the frequency is set low), or excessive resource consumption (when the frequency is set high) in the solutions provided by related technologies.

[0286] The access processing method for a zero-trust network provided in the embodiment of the present application solves the problem of network access interruption or jitter caused by switching between a full direct connection type policy and a full proxy type policy, and at the same time optimizes the problem of slow terminal effectiveness after the access control policy is adjusted by the management and control end. In a zero-trust network access architecture, the network access operations of terminal users are controlled and affected by the access control policy. The access processing method for a zero-trust network provided in the embodiment of the present application supports administrators to flexibly switch between a full direct connection type policy and a full proxy type policy, and realizes network access configuration information synchronization between zero-trust components (such as a zero-trust network agent and an IOA client) in real time through a solution based on configuration changes, timestamps and configuration hash values. Compared with the solution provided by the related art that only relies on periodic pulling of configuration information, the access processing method for a zero-trust network provided in the embodiment of the present application can improve the efficiency of configuration information synchronization, shorten terminal response time, and improve the stability of network access.

[0287] The following continues to describe the exemplary structure of the zero-trust network access processing device 455 provided in the embodiment of the present application implemented as a software module. In some embodiments, such as Figure 2 As shown, the software modules stored in the zero-trust network access processing device 455 of the memory 450 may include: a receiving module 4551, an acquisition module 4552, a query module 4553, an establishment module 4554 and a sending module 4555.

[0288] Receiving module 4551 is used to receive an access request sent by an application; obtaining module 4552 is used to obtain the address of the business site that the application needs to access from the access request; query module 4553 is used to query the access control policy of the zero-trust network based on the application's identification and the address of the business site, and obtain the access mode for the application to access the business site; establishing module 4554 is used to establish a communication connection between the application and the business site based on the access mode and the zero-trust network; sending module 4555 is used to send an access request to the business site through the communication connection, and send the access request response of the business site to the application through the communication connection.

[0289] In some embodiments, the access processing device 455 of the zero-trust network also includes a matching module 4556, which is used to match the application with multiple trusted application configuration nodes in the full-proxy type policy when the access control policy is a full-proxy type policy, and to match the address of the business site with multiple reachable area configuration nodes in the full-proxy type policy; wherein the trusted application configuration node includes multiple feature fields of the application allowed to access, and the reachable area configuration node includes multiple feature fields of the business site allowed to access; the access processing device 455 of the zero-trust network also includes a determination module 4557, which is used to determine that the access mode of the application accessing the business site is proxy access when there is a trusted application configuration node that matches the application and there is a reachable area configuration node that matches the address of the business site; and when there is no trusted application configuration node that matches the application, or there is no reachable area configuration node that matches the address of the business site, determine that the access mode of the application accessing the business site is direct access.

[0290] In some embodiments, the matching module 4556 is also used to match the application with multiple trusted application configuration nodes in the full direct connection type policy, and to match the address of the business site with multiple reachable area configuration nodes in the full direct connection type policy, when the access control policy is a full direct connection type policy; wherein the trusted application configuration node includes multiple feature fields of the application allowed to access, and the reachable area configuration node includes multiple feature fields of the business site allowed to access; the determination module 4557 is also used to determine that the access mode of the application to the business site is direct access when there is a trusted application configuration node that matches the application and there is a reachable area configuration node that matches the address of the business site; and to determine that the access mode of the application to the business site is proxy access when there is no trusted application configuration node that matches the application or there is no reachable area configuration node that matches the address of the business site.

[0291] In some embodiments, when the access control policy includes a direct connection configuration list, the matching module 4556 is also used to match the address of the business site with the direct connection configuration list; the determination module 4557 is also used to determine that the access mode of the application to the business site is direct connection access when the address of the business site exists in the direct connection configuration list.

[0292] In some embodiments, when the access control policy includes a virtual Internet Protocol IP configuration list, the matching module 4556 is also used to match the address of the business site with the virtual IP configuration list; the determination module 4557 is also used to determine that the access mode of the application to the business site is proxy access when the address of the business site exists in the virtual IP configuration list.

[0293] In some embodiments, the access processing device 455 of the zero-trust network also includes a push device 4558, which is used to push the updated configuration information to the zero-trust network client through the zero-trust network server when the configuration information is updated, so that the zero-trust network client sends the updated configuration information to the zero-trust network agent; wherein the configuration information includes at least one of the following: access control policy, connection address of the zero-trust network server, and connection configuration information of the zero-trust network gateway.

[0294] In some embodiments, the access processing device 455 of the zero-trust network also includes a construction module 4559, which is used to build a push status cache based on the response result of the zero-trust network agent; wherein, the response result is generated after the zero-trust network agent is set based on the updated configuration information, and the push status cache is in the form of a key-value pair, and the key-value pair uses the hash value corresponding to the updated configuration information as the key, and the push timestamp and push status corresponding to the updated configuration information as the value; wherein, the push status includes at least one of the following: unknown status, pending push status, push success, and push failure.

[0295] In some embodiments, construction module 4559 is also used to perform the following processing for configuration information corresponding to a specific timestamp and a specific hash value: when the zero-trust network agent successfully receives and sets the configuration information, the push status cache is queried based on the specific hash value; when there is a cache record corresponding to the specific hash value in the push status cache, the push status corresponding to the specific hash value is updated; when there is no cache record corresponding to the specific hash value in the push status cache, the number of cache items included in the push status cache is determined; when the number of cache items is greater than the quantity threshold, a preset number of cache items are deleted according to the push timestamp, and cache items corresponding to the specific hash value and the specific timestamp are established in the push status cache after deletion.

[0296] In some embodiments, the sending module 4555 is also used to periodically send a configuration information acquisition request to the zero trust network server through the zero trust network client when the zero trust network server fails to push the updated configuration information, and send the updated configuration information returned by the zero trust network server to the zero trust network agent.

[0297] In some embodiments, the sending module 4555 is also used to periodically send a configuration information acquisition request to the zero trust network client at a first frequency through the zero trust network agent when the zero trust network agent fails to obtain the updated configuration information; when the zero trust network agent receives the updated configuration information obtained by the zero trust network client from the zero trust network server, the zero trust network agent continues to periodically send an acquisition request to the zero trust network client at a second frequency through the zero trust network agent to request to obtain the updated configuration information again; wherein the first frequency is greater than the second frequency.

[0298] In some embodiments, the acquisition module 4552 is also used to listen to the domain name resolution port to hijack the domain name resolution request of the application when the binding relationship between the business site and the network address is not stored in the application, and extract the domain name of the business site from the domain name resolution request, and obtain the IP address assigned to the domain name based on the domain name query access control policy; the sending module 4551 is also used to send the IP address to the application so that the application generates an access request based on the IP address.

[0299] In some embodiments, the query module 4553 is also used to assign a corresponding virtual IP address to the domain name when the access control policy is a full proxy type policy; and is used to resolve the domain name when the access control policy is a full direct connection type policy to obtain the system native IP address corresponding to the domain name.

[0300] In some embodiments, the acquisition module 4552 is also used to obtain the domain name of the business site in the following manner: matching the IP address corresponding to the access request with the virtual IP configuration list included in the access control policy; when the IP address exists in the virtual IP configuration list, querying the mapping list between the virtual IP address and the domain name based on the IP address to obtain the domain name of the business site; when the IP address does not exist in the virtual IP configuration list, querying the mapping list between the system native IP address and the domain name based on the IP address to obtain the domain name of the business site.

[0301] In some embodiments, the acquisition module 4552 is also used to obtain the credentials of the access request when the access mode is proxy access; the sending module 4555 is also used to forward the credentials to the zero trust network server through the zero trust network gateway, so that the zero trust network server verifies the credentials and obtains the verification result; the establishment module 4554 is also used to send the credentials and access request to the business site through the zero trust network gateway when the verification result indicates that the credential verification is successful, so as to establish a communication connection between the application and the business site and perform proxy access via the zero trust network gateway; and to forward the access request to the business site through the zero trust network gateway when the verification result indicates that the credential verification fails, so as to establish a direct communication connection between the application and the business site.

[0302] In some embodiments, the receiving module 4551 is also used to hijack the access request sent by the application through the virtual network card running on the zero-trust network agent; the obtaining module 4552 is also used to extract the request parameters of the access request through the zero-trust network client, send a credential request to the zero-trust network server based on the request parameters, and receive the credential returned by the zero-trust network server.

[0303] In some embodiments, the request parameters include: the address and port of the application, the address and port of the business site, and the identifier of the application; the sending module 4555 is also used to send the request parameters to the zero-trust network client through the zero-trust network agent, so that the zero-trust network client obtains the characteristic information of the application based on the identifier of the application in the request parameters; and is used to send a credential request to the zero-trust network server through the zero-trust network client, wherein the credential request carries the address and port of the application, the address and port of the business site, and the characteristic information, so that the zero-trust network server performs authentication processing and returns the credential to the zero-trust network client when the authentication is passed.

[0304] In some embodiments, the acquisition module 4552 is also used to obtain the credentials of the access request through the zero-trust network client when the access mode is direct access; the sending module 4555 is also used to forward the credentials to the zero-trust network server via the zero-trust network gateway, so that the zero-trust network server verifies the credentials and obtains the verification result; the establishment module 4554 is also used to forward the credentials and network request to the business site through the zero-trust network gateway when the verification result indicates that the credential verification is successful, so as to establish a direct communication connection between the application and the business site.

[0305] It should be noted that the description of the device in the embodiment of the present application is similar to the description of the above method embodiment and has similar beneficial effects as the method embodiment, so it will not be repeated. Figure 3A 、 Figure 3B 、 Figure 4 ,or Figure 5 The present invention should be understood by referring to the description of any one of the accompanying drawings.

[0306] Embodiments of the present application provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device (e.g., a computer device) reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the zero-trust network access processing method described in the embodiments of the present application.

[0307] The embodiment of the present application provides a computer-readable storage medium storing executable instructions, wherein the executable instructions are stored. When the executable instructions are executed by a processor, the processor will execute the method provided by the embodiment of the present application, for example, Figure 3A 、 Figure 3B 、 Figure 4 ,or Figure 5 Any of the accompanying drawings shows an access processing method for a zero-trust network.

[0308] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface storage, optical disk, or CD-ROM; or various devices including one or any combination of the above memories.

[0309] In some embodiments, executable instructions may be in the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0310] As an example, executable instructions may, but need not, correspond to a file in a file system, may be stored as part of a file that stores other programs or data, such as in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinating files (e.g., files storing one or more modules, subroutines, or code portions).

[0311] As an example, executable instructions may be deployed to be executed on one electronic device (e.g., an electronic device), or on multiple electronic devices located at one site, or on multiple electronic devices distributed across multiple sites and interconnected by a communication network.

[0312] In summary, the access processing method for a zero-trust network provided in the embodiment of the present application solves the problem of network access interruption or jitter caused by switching between a full direct connection type policy and a full proxy type policy, and at the same time optimizes the problem of slow terminal effectiveness after the zero-trust access control policy is adjusted by the management and control end. In a zero-trust network access architecture, the network access operations of terminal users are controlled and affected by the zero-trust access control policy. The access processing method for a zero-trust network provided in the embodiment of the present application supports administrators to flexibly switch between a full direct connection type policy and a full proxy type policy, and realizes a solution for rapid synchronization of network access configuration information between zero-trust components (such as a zero-trust network agent and a zero-trust network client) based on configuration changes, timestamps and configuration hash values. Compared with the solution provided by the related art that only relies on periodic pulling of configuration information, the access processing method for a zero-trust network provided in the embodiment of the present application can improve the efficiency of configuration information synchronization, shorten terminal response time, and improve the stability of network access.

[0313] The above description is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent replacements, and improvements made within the spirit and scope of the present application are included in the scope of protection of the present application.

Claims

1. A zero-trust network access processing method, characterized in that: The method comprises: Receive access requests sent by applications; Obtaining, from the access request, an address of a business site that the application needs to access; Based on the identifier of the application and the address of the business site, query the access control policy of the zero-trust network to obtain the access mode of the application to the business site, the access control policy includes a direct connection configuration list and a virtual Internet Protocol IP configuration list, the direct connection configuration list includes the addresses of multiple business sites resolved by the domain name system, the virtual IP configuration list is a domain name list of virtual IPs resolved by the domain name system logic customized by the zero-trust network agent, the access mode includes direct access and proxy access, and the zero-trust network client and the zero-trust network agent implement switching between the direct access and the proxy access by synchronizing the direct connection configuration list and the virtual IP configuration list; establishing a communication connection between the application and the business site based on the access mode and the zero-trust network; sending the access request to the business site via the communication connection, and sending the access request response of the business site to the application via the communication connection; When the configuration information is updated, the updated configuration information is pushed to the zero trust network client through the zero trust network server, so that the zero trust network client sends the updated configuration information to the zero trust network agent; The configuration information includes at least one of the following: the access control policy, the connection address of the zero-trust network server, and the connection configuration information of the zero-trust network gateway.

2. The method according to claim 1, characterized in that When the access control policy is a full proxy type policy, querying the access control policy of the zero-trust network based on the identifier of the application and the address of the business site to obtain the access mode of the application to the business site includes: Matching the application with multiple trusted application configuration nodes in the full proxy type policy respectively, and matching the address of the business site with multiple reachable area configuration nodes in the full proxy type policy respectively; The trusted application configuration node includes multiple feature fields of application programs that are allowed to be accessed, and the reachable area configuration node includes multiple feature fields of business sites that are allowed to be accessed; When there is a trusted application configuration node matching the application and a reachable area configuration node matching the address of the business site, determining that the access mode of the application to the business site is proxy access; When there is no trusted application configuration node matching the application, or there is no reachable area configuration node matching the address of the business site, it is determined that the access mode of the application to the business site is direct access.

3. The method according to claim 1, characterized in that When the access control policy is a fully direct connection type policy, querying the access control policy of the zero-trust network based on the identifier of the application and the address of the business site to obtain the access mode of the application to the business site includes: Matching the application with multiple trusted application configuration nodes in the full direct connection type policy respectively, and matching the address of the business site with multiple reachable area configuration nodes in the full direct connection type policy respectively; The trusted application configuration node includes multiple feature fields of application programs that are allowed to be accessed, and the reachable area configuration node includes multiple feature fields of business sites that are allowed to be accessed; When there is a trusted application configuration node matching the application and a reachable area configuration node matching the address of the business site, determining that the access mode of the application to the business site is direct access; When there is no trusted application configuration node matching the application, or no reachable area configuration node matching the address of the business site, it is determined that the access mode of the application to the business site is proxy access.

4. The method according to claim 1, wherein When the access control policy includes a direct connection configuration list, the method further includes: Matching the address of the business site with the direct connection configuration list; When the address of the business site exists in the direct connection configuration list, it is determined that the access mode of the application program to the business site is direct connection access.

5. The method according to claim 1, wherein When the access control policy includes a virtual IP configuration list, the method further includes: Matching the address of the business site with the virtual IP configuration list; When the address of the service site exists in the virtual IP configuration list, it is determined that the access mode of the application program to the service site is proxy access.

6. The method according to claim 1, characterized in that After sending the updated configuration information to the zero trust network agent, the method further includes: Building a push status cache based on the response result of the zero-trust network agent; The response result is generated by the zero-trust network agent after setting based on the updated configuration information, and the push status cache is in the form of a key-value pair, and the key-value pair uses the hash value corresponding to the updated configuration information as a key and the push timestamp and push status corresponding to the updated configuration information as a value; The push status includes at least one of the following: unknown status, pending push status, push success, and push failure.

7. The method according to claim 6, characterized in that The method further comprises: For the configuration information corresponding to a specific timestamp and a specific hash value, perform the following processing: When the zero-trust network agent successfully receives and sets the configuration information, querying the push status cache based on the specific hash value; When a cache record corresponding to the specific hash value exists in the push status cache, updating the push status corresponding to the specific hash value; When there is no cache record corresponding to the specific hash value in the push status cache, determining the number of cache items included in the push status cache; When the number of cache items is greater than a quantity threshold, a preset number of cache items are deleted according to the push timestamp, and cache items corresponding to the specific hash value and the specific timestamp are created in the push status cache after deletion.

8. The method according to claim 1, characterized in that When the zero-trust network server fails to push the updated configuration information, the method further includes: The zero-trust network client periodically sends a configuration information acquisition request to the zero-trust network server, and sends the updated configuration information returned by the zero-trust network server to the zero-trust network agent.

9. The method according to claim 8, characterized in that When the zero-trust network agent fails to obtain the updated configuration information, the method further includes: Periodically sending a configuration information acquisition request to the zero trust network client at a first frequency through the zero trust network agent; When the zero-trust network agent receives the updated configuration information obtained by the zero-trust network client from the zero-trust network server, the zero-trust network agent continues to periodically send an acquisition request to the zero-trust network client at a second frequency to request the updated configuration information; The first frequency is greater than the second frequency.

10. The method according to claim 1, characterized in that When the binding relationship between the service site and the network address is not stored in the application, the method further includes: Listen to the domain name resolution port to hijack the domain name resolution request of the application, and Extracting the domain name of the business site from the domain name resolution request, querying the access control policy based on the domain name, and obtaining the IP address assigned to the domain name; The IP address is sent to the application program, so that the application program generates the access request based on the IP address.

11. The method according to claim 10, characterized in that The querying the access control policy based on the domain name to obtain the IP address allocated to the domain name includes: When the access control policy is a full proxy type policy, assigning a corresponding virtual IP address to the domain name; When the access control policy is a full direct connection type policy, the domain name is resolved to obtain the system native IP address corresponding to the domain name.

12. An access processing device for a zero-trust network, characterized in that: The device comprises: A receiving module, configured to receive an access request sent by an application; An acquisition module, configured to acquire, from the access request, the address of the business site that the application needs to access; a query module for querying the access control policy of the zero-trust network based on the identifier of the application and the address of the business site, and obtaining the access mode of the application to the business site, wherein the access control policy includes a direct connection configuration list and a virtual Internet Protocol IP configuration list, the direct connection configuration list includes the addresses of multiple business sites resolved by the domain name system, the virtual IP configuration list is a list of virtual IP domain names resolved by the domain name system logic customized by the zero-trust network agent, the access mode includes direct access and proxy access, and the zero-trust network client and the zero-trust network agent implement switching between the direct access and the proxy access by synchronizing the direct connection configuration list and the virtual IP configuration list; an establishing module, configured to establish a communication connection between the application and the business site based on the access mode and the zero-trust network; a sending module, configured to send the access request to the business site via the communication connection, and send a response to the access request of the business site to the application via the communication connection; A push module is used to push the updated configuration information to the zero-trust network client through the zero-trust network server when the configuration information is updated, so that the zero-trust network client sends the updated configuration information to the zero-trust network agent; wherein, the configuration information includes at least one of the following: the access control policy, the connection address of the zero-trust network server, and the connection configuration information of the zero-trust network gateway.

13. An electronic device, characterized in that: include: a memory for storing executable instructions; The processor is configured to implement the zero-trust network access processing method described in any one of claims 1 to 11 when executing the executable instructions stored in the memory.

14. A computer-readable storage medium, characterized in that Executable instructions are stored, and when the executable instructions are executed, they are used to implement the access processing method of the zero-trust network described in any one of claims 1 to 11.

15. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the access processing method of the zero-trust network described in any one of claims 1 to 11 is implemented.

Images