A distributed network construction method under zero trust

Abstract

The present invention relates to a distributed network construction method under a zero-trust framework, comprising the following steps: step 1, establishing a connection with an agent center when a new customer accesses; step 2, the customer initiates a subscription message to the agent to subscribe to a topic; step 3, the customer publishes a message according to the topic subscribed in step 2. The present invention can greatly improve the security of a distributed system.

Description

Technical Field

[0001] The present invention belongs to the field of information and communication technology, and relates to a distributed network construction method, in particular to a distributed network construction method under zero trust. Background Art

[0002] Nowadays, information technology is changing with each passing day, and open sharing has become the mainstream of the times. The emergence of open computing environments such as cloud computing and distributed computing marks the gradual development of information systems from single-domain, closed to cross-domain, collaborative. The complexity of network information resources in the big data environment makes the protection of information resources and privacy data more difficult. Traditional access control models can no longer achieve the protection of privacy information and the secure interaction of confidential data in complex network environments. There is an urgent need for fine-grained and highly flexible access control models. Therefore, attribute-based access control models (ABAC) have emerged. Attribute-based access control models can adapt to complex network environments in a fine-grained manner, and use attributes to describe users and resources, making them sufficiently flexible and scalable, and ensuring the security of anonymous access in large distributed environments.

[0003] The traditional network security model cannot meet the security needs of the intranet, so the zero-trust network security model came into being. Any subject accessing the network, including the person initiating the access, the device initiating the access, and the application being accessed, is in an untrusted state by default at each access, and dynamic access trust needs to be built through continuous identity authentication and access authorization. This is the core idea of ​​the zero-trust network security model, and its essence is to perform access control based on the identity of the access subject.

[0004] The combination of zero-trust network and dynamic access control technology is a hot topic in the current IoT security research and a new development direction. Existing distributed network security protection technology faces security risks such as illegal terminal access, legitimate terminals being exploited for attacks, and unauthorized malicious terminal access due to problems such as insufficient security authentication of "terminal (device) - application (behavior) - user (role)", insufficient security monitoring of terminal network access behavior, and insufficient precision and dynamic adaptability of terminal access control.

[0005] After searching, no published patent documents identical or similar to the present invention were found. Summary of the invention

[0006] The purpose of the present invention is to overcome the shortcomings of the prior art and propose a distributed network construction method under zero trust that is reasonably designed, highly flexible, safe and reliable, which can greatly improve the security of the distributed system.

[0007] The present invention solves the practical problem by adopting the following technical solutions:

[0008] A distributed network construction method under a zero-trust framework includes the following steps:

[0009] Step 1: When a new customer accesses, a connection is established with the agent center;

[0010] Step 2: The client sends a subscription message to the proxy to subscribe to the topic;

[0011] Step 3: The client publishes messages according to the topic subscribed in step 2.

[0012] Moreover, the specific steps of step 1 include:

[0013] (1) A new client submits a certification application to the authentication center of the trust assessment module. The authentication center checks whether the new client exists in the existing blacklist and whitelist: ① If the new client exists in the blacklist, the authentication center refuses to return the certificate ② If the new client exists in the whitelist, the authentication center returns the certificate with the subject attributes and the initial trust value ③ If the new client does not exist in the whitelist, the authentication center also returns the certificate with the subject attributes and does not have the initial trust value;

[0014] (2) A new customer initiates a connection request to the proxy center and attaches a certificate. The request is intercepted by the policy execution point PEP. The PEP first transfers the customer information to the trust evaluation center of the trust evaluation module, and the trust evaluation center calculates the current trust value of the customer.

[0015] (3) After obtaining the client's trust value, the PEP determines whether to allow the connection request based on the trust threshold; if the trust value meets the requirement, the PEP forwards the connection request to the proxy and updates the list to the authentication center;

[0016] (4) After the proxy center successfully establishes a connection with the client, it will feedback a connection confirmation message. This message is also intercepted by the PEP and a trust evaluation is performed again. This trust evaluation will be performed on both the client and the proxy center at the same time, and then the connection confirmation message will be forwarded.

[0017] Moreover, the specific steps of step 2 include:

[0018] (1) The client sends a subscription message to the proxy, which is intercepted by the PEP and first forwarded to the trust evaluation center for trust evaluation of the current client. If the trust level is lower than the trust threshold required for subscription to the topic, the application is directly rejected and the blacklist is updated;

[0019] (2) PEP provides the client's current trust value to the policy decision point (PDP) in the access control module. Trust will be used as an important subject attribute in the authorization process. PDP searches for a satisfying access control policy at the policy management point (PAP) based on the attribute information and the client's trust value. If the request is denied, a rejection message is returned to the client. If it is allowed, a subscription message is forwarded to the proxy.

[0020] (3) The proxy accepts the subscription request and forwards the subscription success / failure message to the client, which is also intercepted by the PEP and forwarded to the trust evaluation center, which conducts a trust evaluation on the proxy center and the client and updates the trust list.

[0021] Moreover, the specific steps of step 3 include:

[0022] (1) The client publishes a message to the proxy center based on the topic. The message is intercepted by the PEP and first forwarded to the trust evaluation center for trust evaluation of the current client. If the trust value is too low, the release is directly rejected and the blacklist is updated;

[0023] (2) The PEP provides the PDP with the client's current trust value. The PDP searches for a satisfying access control policy at the PAP based on the attribute information and the client's trust value. If the release is denied, the PDP returns a rejection message to the client. If the release is allowed, the PDP forwards the release message to the proxy center.

[0024] (3) The proxy center receives the information published by the client, queries the trust evaluation center for the latest trust list, and forwards the topic message to the subscribing clients who meet the trust level of the topic based on the trust value. If the client's trust value does not reach the trust threshold required to receive the message, the proxy center sends a message rejection notice to the client, informing the client that there is no message received for this topic and attaching the reason;

[0025] (4) The agency center provides feedback on the success / failure of publishing to the publishing client, which is also intercepted by the PEP and forwarded to the trust assessment center, which conducts a trust assessment on the agent and the client and updates the trust list.

[0026] Advantages and beneficial effects of the present invention:

[0027] 1. The present invention proposes a distributed network construction method under a zero-trust framework, including: a client, a proxy center, an access control module and a trust assessment module; the client and the proxy center are basic components in the subscription / publishing mode, the client is both the publisher and the subscriber of the message, and the proxy is responsible for accepting client requests and managing the subscription and publication of messages. The present invention adds an access control module and a trust assessment module to the framework of the traditional subscription / publishing mode, takes advantage of the fine-grained and high flexibility of the ABAC model, and combines dynamic and continuous trust assessment to greatly improve the security of the distributed system.

[0028] 2. The present invention combines the ABAC access control model with continuous trust evaluation, and proposes a distributed network construction method based on the subscription / publishing model under the zero-trust framework. By utilizing the fine-grained and highly flexible characteristics of the ABAC model, the security requirements of dynamic access in distributed networks are met, and it is committed to filling the security gaps of the existing distributed Internet of Things, which has certain feasibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a flowchart of the process of establishing a connection with the agent center when a new customer accesses step 1 of the present invention;

[0030] Figure 2 It is a flowchart of the process of the client sending a subscription message to the agent to subscribe to a topic in step 2 of the present invention;

[0031] Figure 3 It is a flowchart of the process of the client publishing a message according to the present invention;

[0032] Figure 4 It is a block diagram of the ABAC model’s authorization process for user behavior;

[0033] Figure 5 It is a block diagram of the trust evaluation center (PEC) in the trust evaluation module performing trust evaluation on users. DETAILED DESCRIPTION

[0034] The embodiments of the present invention are further described in detail below with reference to the accompanying drawings:

[0035] A distributed network construction method under a zero-trust framework, such as Figures 1 to 3 As shown, the following steps are included:

[0036] Step 1: When a new customer accesses, a connection is established with the agent center;

[0037] The specific steps of step 1 include:

[0038] (1) A new client submits a certification application to the authentication center of the trust assessment module. The authentication center checks whether the new client exists in the existing blacklist and whitelist: ① If the new client exists in the blacklist, the authentication center refuses to return the certificate ② If the new client exists in the whitelist, the authentication center returns the certificate with the subject attributes and the initial trust value ③ If the new client does not exist in the whitelist, the authentication center also returns the certificate with the subject attributes and does not have the initial trust value;

[0039] (2) A new customer initiates a connection request to the proxy center and attaches a certificate. The request is intercepted by the Policy Enforcement Point (PEP). The PEP first transfers the customer information to the trust evaluation center of the trust evaluation module, and the trust evaluation center calculates the customer's current trust value.

[0040] The trust evaluation center can be linked with the policy decision point PDP and policy information point PIP in the access control module to collect user interaction records and quantify them into comprehensive trust values;

[0041] (3) After obtaining the client's trust value, PEP determines whether to allow the connection request based on the trust threshold; if the trust value is met, the connection request is forwarded to the proxy and the list is updated to the authentication center.

[0042] (4) After the proxy center successfully establishes a connection with the client, it will feedback the connection confirmation information. This message is also intercepted by the PEP and a trust evaluation is performed again. This trust evaluation will be performed on both the client and the proxy center (usually with a higher trust value), and then the connection confirmation information is forwarded.

[0043] Taking the proxy as one of the trust evaluation objects can effectively avoid the security risks brought by untrusted proxies and greatly improve the security of the distributed system.

[0044] In this embodiment, when a new client accesses, it needs to establish a connection with the proxy center. Before establishing the connection, it needs to apply for authentication from the authentication center. After obtaining the certificate, it can apply for connection. At this time, the application is intercepted by the PEP and forwarded to the trust evaluation center, which performs a trust evaluation on the new client and then forwards the proxy to establish the connection. The proxy feedbacks the success / failure information, which is forwarded by the PEP and the trust evaluation is performed again on the proxy and the client.

[0045] Step 2: The client sends a subscription message to the proxy to subscribe to the topic;

[0046] Before receiving messages, clients need to subscribe to the topic, and the subscription message is initiated by the client to the proxy;

[0047] The specific steps of step 2 include:

[0048] (1) The client sends a subscription message to the proxy, which is intercepted by the PEP and first forwarded to the trust evaluation center for trust evaluation of the current client. If the trust level is lower than the trust threshold required for the topic subscription, the application is directly rejected and the blacklist is updated. There is no need for subsequent authorization process, which reduces the overhead caused by access control.

[0049] (2) PEP provides the customer's current trust value to the Policy Decision Point (PDP) in the access control module. Trust will participate in the authorization process as an important subject attribute. PDP will determine the customer's current trust value at the Policy Administration Point (PDP) based on the attribute information and the customer's trust value. , If the request is denied, a rejection message is returned to the client. If it is allowed, a subscription message is forwarded to the proxy.

[0050] Since there is no process in which the client subject directly applies for access to the resource object in the present invention, the present invention makes certain changes to the access control process, and its access control policy formulation and implementation will be based on the subject. The subject exists in a tree form, and the access control policy is created based on the subject tree. The administrator can assign access rights that match each subject, and the authorization process is based on the permissions, constraints, and policies under the subject;

[0051] (3) The proxy accepts the subscription request and forwards the subscription success / failure message to the client, which is also intercepted by the PEP and forwarded to the trust evaluation center, which conducts a trust evaluation on the proxy center and the client and updates the trust list.

[0052] In this embodiment, the process of canceling a subscription is similar to the process of applying for a subscription, so it will not be described in detail.

[0053] In this embodiment, the client needs to subscribe to the topic before receiving the message. The subscription message is initiated by the client to the proxy and intercepted by the PEP. It is first forwarded to the trust evaluation center to perform a trust evaluation on the current client. The PEP provides the PDP with the client's current trust value. The PDP searches for a satisfying access control policy at the policy management point based on various attribute information and the client's trust value. The proxy accepts the subscription request and forwards the subscription success / failure message to the client, which is also intercepted by the PEP and forwarded to the trust evaluation center to perform a trust evaluation on the proxy and the client and update the trust list.

[0054] Step 3: The client publishes messages based on the topic subscribed in step 2

[0055] The specific steps of step 3 include:

[0056] (1) The client publishes a message to the proxy center based on the topic. The message is intercepted by the PEP and first forwarded to the trust evaluation center for trust evaluation of the current client. If the trust value is too low, the release is directly rejected and the blacklist is updated;

[0057] (2) PEP provides the PDP with the client's current trust value. The PDP searches the PAP for a satisfying access control policy based on the attribute information and the client's trust value. If the release is denied, a rejection message is returned to the client. If the release is allowed, a release message is forwarded to the proxy center.

[0058] Due to the dynamic nature of distributed systems, each subscription / publishing of a message requires authorization. After an action is completed, the user's current permissions are invalidated, and the next time the same action is performed (such as publishing the same topic information again), re-authorization is required;

[0059] (3) The proxy center receives the information published by the client, queries the trust evaluation center for the latest trust list, and forwards the topic message to the subscribing clients who meet the trust level of the topic based on the trust value. If the client's trust value does not reach the trust threshold required to receive the message, the proxy center sends a message rejection notice to the client, informing the client that there is no message received for this topic and attaching the reason;

[0060] (4) The agency center provides feedback on the success / failure of publishing to the publishing client, which is also intercepted by the PEP and forwarded to the trust assessment center, which conducts a trust assessment on the agent and the client and updates the trust list.

[0061] In this embodiment, customers can publish messages based on topics. In the traditional subscription publishing mode, after the proxy receives the message published by the customer, it directly sends it to the customers who have subscribed to the topic according to the subscription list. This practice does not conform to the idea of ​​zero trust. In this model, restrictions will be added to the publishing of messages. Not only do customers need to conduct trust evaluation and access control decisions when publishing messages, but the proxy also needs to obtain the customer's trust value when forwarding messages, and forward the corresponding messages to customers who meet the trust requirements.

[0062] In this embodiment, an access control module is also included to dynamically authorize user behavior;

[0063] The functions and effects of the access control module are as follows:

[0064] The access control part of the present invention adopts and improves the attribute-based access control model (AttributeBasedAccessControl, ABAC). ABAC is an access control method that matches access control permissions to protected resources based on the specified attributes of the subject and the object, environmental conditions, and a set of policies specified based on these attributes and conditions. Since there is no process in which the client subject directly applies for access to the resource object in the present invention, the present invention makes certain changes to the ABAC model, and its access control policy formulation and implementation will be based on the subject. The subject exists in a tree form, and the access control policy is created based on the subject tree. The administrator can assign access permissions that match each subject, and the authorization process is performed based on the permissions, constraints, and policies under the subject.

[0065] Extensible Access Control Markup Language (XACML) is an OASIS specification that uses XML to express access control policies for information access. It can support access control policy languages ​​with complex and fine-grained rules and can be used to implement the ABAC authorization model. The model consists of five main parts: a) Policy Enforcement Point (PEP): a system entity that enforces access control by issuing decision requests and enforcing authorization decisions; b) Policy Decision Point (PDP): an entity that makes access control decisions based on access control policies and other attribute information; c) Policy Administration Point (PAP): an entity that generates and maintains security policies in the system; d) Policy Information Point (PIP): an entity that obtains attribute information of subjects, environments, and resources. If some attributes are missing in the request initiated by the PEP, the PIP will find them and feed them back to the PDP for decision making; e) Context Processor: converts external requests into XACML requests, converts XACML responses into external responses, and digitizes XACML requests (responses) based on attribute services.

[0066] The access control model diagram is as follows Figure 4As shown, this content is not the research content of the present invention, so it will not be elaborated in detail.

[0067] In this embodiment, a trust evaluation module is also included to perform continuous trust evaluation on user behavior.

[0068] The trust evaluation module is described as follows:

[0069] The trust evaluation module is divided into two parts: the certification authority center (CAC) and the trust evaluation center (PEC), which are responsible for managing the trust system in the network. The basic framework of TEC is as follows: Figure 5 As shown in the figure. CAC stores the blacklist and whitelist of customers and is responsible for issuing certificates. TEC is responsible for evaluating the trust between any peer entities in the network system. TEC works with the authentication and authorization center CAC, policy decision point PDP and other modules in the model to collect the historical records of access interactions between entities and quantify them into comprehensive trust capabilities. It uses peer entity similarity, penalty mechanism, trust decay, etc. to calculate direct trust, indirect trust and recommended trust, and feeds back the results to the policy decision point PDP in the access control module for the next step. Trust will participate in the authorization process as an important subject attribute.

[0070] Usually, access control policies do not change frequently, but the subject's trust changes dynamically. Multiple abnormal behaviors will cause the subject's trust to drop sharply or even enter the blacklist. This reduces the overhead of access control to a certain extent, because some behaviors of users with unqualified trust will be directly rejected without the need for subsequent authorization processes. In addition, the topic tree has a hierarchical division, and the trust hierarchy system is applicable to this model. Subscription, publishing, and receiving behaviors under different topics correspond to different trust thresholds, which is easy to implement.

[0071] In addition, the broker is also used as one of the trust evaluation objects, which can effectively avoid the security risks brought by untrusted brokers and greatly improve the security of the distributed system.

[0072] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0073] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0074] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0075] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

Claims

1. A distributed network construction method under a zero-trust framework, characterized in that: The following steps are involved: Step 1: When a new customer accesses, a connection is established with the agent center; Step 2: The client sends a subscription message to the proxy center to subscribe to the topic; Step 3: The client publishes messages according to the topic subscribed in step 2; The specific steps of step 1 include: (1) A new client submits a certification application to the authentication center of the trust assessment module. The authentication center checks whether the new client exists in the existing blacklist and whitelist: ① If the new client exists in the blacklist, the authentication center refuses to return the certificate ② If the new client exists in the whitelist, the authentication center returns the certificate with the subject attributes and the initial trust value ③ If the new client does not exist in the whitelist, the authentication center also returns the certificate with the subject attributes and does not have the initial trust value; (2) A new customer initiates a connection request to the proxy center and attaches a certificate. The request is intercepted by the policy execution point PEP. The PEP first transfers the customer information to the trust evaluation center of the trust evaluation module, and the trust evaluation center calculates the current trust value of the customer. (3) After obtaining the client's trust value, the PEP determines whether to allow the connection request based on the trust threshold. If the trust value is met, the PEP forwards the connection request to the proxy center and updates the list to the authentication center. (4) After the proxy center successfully establishes a connection with the client, it will feedback the connection confirmation information. This message is also intercepted by the PEP, and a trust evaluation is performed again. This trust evaluation will be performed on both the client and the proxy center at the same time, and then the connection confirmation information will be forwarded; The specific steps of step 2 include: (1) The client sends a subscription message to the proxy center, which is intercepted by the PEP and first forwarded to the trust evaluation center for trust evaluation of the current client. If the trust level is lower than the trust threshold required for subscription to the topic, the application is directly rejected and the blacklist is updated; (2) PEP provides the client's current trust value to the policy decision point PDP in the access control module. Trust will be used as an important subject attribute in the authorization process. PDP searches for a satisfying access control policy at the policy management point PAP based on the attribute information and the client's trust value. If the request is denied, a rejection message is returned to the client. If it is allowed, a subscription message is forwarded to the proxy center. (3) The proxy center accepts the subscription request and forwards the subscription success / failure message to the client, which is also intercepted by the PEP and forwarded to the trust evaluation center, which conducts a trust evaluation on the proxy center and the client and updates the trust list.

2. According to a method for constructing a distributed network under a zero-trust framework according to claim 1, it is characterized in that: The specific steps of step 3 include: (1) The client publishes a message to the proxy center based on the topic. The message is intercepted by the PEP and first forwarded to the trust evaluation center for trust evaluation of the current client. If the trust value is lower than the trust threshold, the release is directly rejected and the blacklist is updated; (2) The PEP provides the PDP with the client's current trust value. The PDP searches for a satisfying access control policy at the PAP based on the attribute information and the client's trust value. If the release is denied, the PDP returns a rejection message to the client. If the release is allowed, the PDP forwards the release message to the proxy center. (3) The proxy center receives the information published by the client, queries the trust evaluation center for the latest trust list, and forwards the topic message to the subscribing clients who meet the trust level of the topic based on the trust value. If the client's trust value does not reach the trust threshold required to receive the message, the proxy center sends a message rejection notice to the client, informing the client that there is no message received for this topic and attaching the reason; (4) The agency center provides feedback on the success / failure of publishing to the publishing client, which is also intercepted by the PEP and forwarded to the trust evaluation center, which conducts a trust evaluation on the agency center and the client and updates the trust list.

Images