A zero-trust gateway-based access control method and system

Abstract

The embodiment of the application provides a kind of access control method and system based on zero trust gateway, it is related to gateway technical field.The method comprises: obtaining the access request information sent by user;According to access request information, extract user token data and application token data;Token verification is carried out to user token data and application token data based on local policy cache database, and token verification state information is obtained;According to token verification state information, it is judged whether token verification passes, if token verification does not pass, then reject access request information;If token verification passes, it is judged whether including or not including preset field according to the request parameter of access request information, if not, then reject access request information;If yes, access request information is sent to application server, and link channel is established with application server;Based on link channel, user accesses application server.The method can carry out flexible multi-dimensional inspection, improve request rate, realize the technical effect of improving user experience.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of gateways, in particular to a zero-trust gateway-based access control method and system, an electronic device and a computer readable storage medium. BACKGROUND

[0002] At present, the zero-trust gateway is located at the boundary between the user domain and the data domain, and the access traffic of each intranet resource flows through the zero-trust gateway. In order to ensure that the access traffic entering the intranet is safe and reliable, the zero-trust gateway needs to perform multi-dimensional inspection and control on each access request. Since the zero-trust gateway needs to access the services of the zero-trust control center to obtain the inspection results when performing multi-dimensional inspection on each request, it will cause pressure on the zero-trust control center. Therefore, it is necessary to provide a zero-trust gateway control scheme that can support multi-dimensional inspection while relieving the pressure on the zero-trust control center and not affecting the verification results of each request.

[0003] In the prior art, one method of zero-trust access is to perform virtual mapping on the zero-trust security agent and complete the access through the virtual agent. However, the virtual agent does not have a clear update mechanism after receiving the user token and object permissions. If the object permissions of the user have been recycled, the virtual agent will still release them, thereby causing the risk of exceeding authority. Moreover, the virtual agent only supports the inspection of user tokens and object permissions and cannot perform inspection in other dimensions, such as terminal risk inspection and request parameter verification. Another method of zero-trust access is to initiate single packet authentication with the control plane by the terminal security engine of the access subject, and send it to the trusted access control engine in a fixed single packet authentication format through a one-way connectionless port. However, since a special client (terminal security engine) must be installed on the user side to securely implement access control, the application scenarios that can be protected are limited, especially for public website applications, and the user experience is poor. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a zero-trust gateway-based access control method, system, electronic device and computer readable storage medium, which can perform flexible multi-dimensional inspection, improve request rate and achieve the technical effect of improving user experience.

[0005] In a first aspect, the embodiments of the present application provide a zero-trust gateway-based access control method, comprising:

[0006] obtaining access request information sent by a user, the access request information comprising user token data and application token data;

[0007] extracting the user token data and the application token data according to the access request information;

[0008] token verification is passed, determining whether the preset field is included or not included according to a request parameter of the access request information, and if not, rejecting the access request information;

[0009] determining whether the token verification is passed according to the token verification state information, and if the token verification is not passed, rejecting the access request information;

[0010] if the token verification is passed, determining whether the preset field is included or not included according to a request parameter of the access request information, and if not, rejecting the access request information;

[0011] if yes, sending the access request information to an application server and establishing a link channel with the application server;

[0012] based on the link channel, performing the access of the user to the application server.

[0013] In the implementation process, the access control method of the zero-trust gateway can perform token verification and request parameter verification on the access request information, thereby achieving multi-dimensional checking of the access request information. Meanwhile, the local policy cache database supports policy cache control, and the use of policy cache control can significantly reduce the pressure of the linkage service, improve the access rate without affecting the verification result of the access request information, and perfect the user experience. Therefore, the method can perform flexible multi-dimensional checking, improve the request rate, and achieve the technical effect of improving the user experience.

[0014] Further, the zero-trust gateway is configured with terminal verification, and before the step of extracting the user token data and the application token data according to the access request information, the method further comprises:

[0015] checking whether the terminal verification of the zero-trust gateway is enabled, and if not, jumping to the step of extracting the user token data and the application token data according to the access request information;

[0016] if yes, obtaining a user identification code according to the access request information;

[0017] based on the local policy cache database, performing terminal verification on the user identification code to obtain terminal verification state information;

[0018] determining whether the terminal verification is passed according to the terminal verification state information, and if the terminal verification is not passed, rejecting the access request information;

[0019] if the terminal verification is passed, jumping to the step of extracting the user token data and the application token data according to the access request information.

[0020] In the implementation process, if the zero-trust gateway is configured and enabled for terminal verification, the risk state data of the user identifier code can be quickly queried based on the local policy cache database, so as to perform terminal verification on the user identifier code of the user terminal.

[0021] Further, the step of performing terminal verification on the user identifier code based on the local policy cache database to obtain terminal verification state information comprises:

[0022] querying whether there is risk state data of the user identifier code based on the local policy cache database, and if yes, obtaining terminal verification state information;

[0023] if no, deriving a request to access a terminal risk perception service of the zero-trust control center and query the risk state data of the user identifier code, setting a minute-level expiration time, updating the risk state data of the user identifier code to the local policy cache database, and obtaining terminal verification state information.

[0024] In the implementation process, if there is no risk state data of the user identifier code in the local policy cache database, the risk state data of the user identifier code can be queried through the terminal risk perception service of the zero-trust control center, so as to obtain terminal verification state information, and the risk state data queried through the terminal risk perception service is used to update the local policy cache database; thus, in the next terminal verification on the user identifier code, the risk state data of the user identifier code can be quickly queried based on the local policy cache database.

[0025] Further, the step of performing token verification on the user token data and the application token data based on the local policy cache database to obtain token verification state information comprises:

[0026] querying whether there is security state data of the token based on the local policy cache database, and if yes, obtaining token verification state information;

[0027] if no, deriving a request to access an authentication service of the zero-trust control center and query the security state data of the token, setting a minute-level expiration time, updating the security state data of the token to the local policy cache database, and obtaining token verification state information.

[0028] In the implementation process, if there is no security state data of the token in the local policy cache database, the security state data of the user token can be queried through the authentication service of the zero-trust control center, so as to obtain token verification state information, and the security state data queried through the authentication service is used to update the local policy cache database; thus, in the next token verification, the security state data of the token can be quickly queried based on the local policy cache database.

[0029] Further, the user accesses the authentication service login page through the browser, and before the step of obtaining the access request information sent by the user, the method further comprises:

[0030] Obtaining the login authentication information sent by the user;

[0031] Generating the access request information including the user token data and the application token data according to the login authentication information.

[0032] Further, before the step of accessing the application server by the user based on the link channel, the method further comprises:

[0033] Obtaining the response application data returned by the application server;

[0034] Filtering the response application data according to a preset sensitive database, and returning the filtered response application data to the user.

[0035] In the above implementation process, after receiving the response data of the application server, the sensitive information in the response data can be deleted according to the fields configured by the administrator, so as to prevent leakage and improve access security.

[0036] Further, the zero trust gateway is provided with a cache update interface of the local policy cache database, and the zero trust gateway supports bidirectional authentication of the user and the application server.

[0037] In the above implementation process, the zero trust gateway provides a cache update interface, and when the authentication service and the terminal risk service discover that the permission is changed or the terminal state is changed, the data can be pushed to the cache module of the zero trust gateway in real time, and the zero trust gateway supports bidirectional authentication technology, so as to ensure the security and reliability of the cache of the zero trust gateway.

[0038] In a second aspect, the embodiments of the present application provide an access control system based on a zero trust gateway, comprising:

[0039] A request module, configured to obtain access request information sent by a user, the access request information including user token data and application token data;

[0040] A token module, configured to extract the user token data and the application token data according to the access request information;

[0041] A token verification module, configured to perform token verification on the user token data and the application token data based on a local policy cache database, to obtain token verification state information; determine whether the token verification passes according to the token verification state information, and if the token verification does not pass, reject the access request information;

[0042] The request verification module is configured to, if the token verification passes, determine whether the preset field is included or not included according to a request parameter of the access request information, and if not, reject the access request information;

[0043] The access module is configured to, if yes, send the access request information to an application server and establish a link channel with the application server, and perform the access of the user to the application server based on the link channel.

[0044] Further, the zero-trust gateway is configured with terminal verification, and the access control system based on the zero-trust gateway further comprises a terminal verification module, which is configured to:

[0045] check whether the zero-trust gateway is enabled for terminal verification, and if not, jump to the step of extracting the user token data and the application token data according to the access request information;

[0046] if yes, obtain a user identification code according to the access request information;

[0047] perform terminal verification on the user identification code based on the local policy cache database to obtain terminal verification state information;

[0048] determine whether the terminal verification passes according to the terminal verification state information, and if the terminal verification does not pass, reject the access request information;

[0049] if the terminal verification passes, jump to the step of extracting the user token data and the application token data according to the access request information.

[0050] Further, the terminal verification module is further configured to:

[0051] query whether there is risk state data of the user identification code based on the local policy cache database, and if yes, obtain terminal verification state information;

[0052] if not, derive a terminal risk perception service of a zero-trust control center to query the risk state data of the user identification code, set a minute-level expiration time, update the risk state data of the user identification code to the local policy cache database, and obtain terminal verification state information.

[0053] Further, the token verification module is further configured to:

[0054] query whether there is security state data of the token based on the local policy cache database, and if yes, obtain token verification state information;

[0055] If not, a derived request accesses an authentication service of the zero trust control center and queries the security state data of the token, sets a minute-level expiration time, updates the security state data of the token to the local policy cache database, and obtains token verification state information.

[0056] Further, the zero-trust gateway-based access control system further includes a login module, which is configured to:

[0057] obtain login authentication information sent by the user;

[0058] generate access request information including the user token data and the application token data according to the login authentication information.

[0059] Further, the zero-trust gateway-based access control system further includes a response filtering module, which is configured to:

[0060] obtain response application data returned by the application server;

[0061] filter the response application data according to a preset sensitive database, and return the filtered response application data to the user.

[0062] In a third aspect, an electronic device is provided, which includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and the processor implements the steps of the method according to any one of the first aspect when executing the computer program.

[0063] In a fourth aspect, a computer readable storage medium is provided, and the computer readable storage medium stores instructions, and the instructions, when running on a computer, cause the computer to execute the method according to any one of the first aspect.

[0064] In a fifth aspect, a computer program product is provided, and the computer program product, when running on a computer, causes the computer to execute the method according to any one of the first aspect.

[0065] Other features and advantages of the present application will be illustrated in the following description, or can be known or determined from the description without any doubt, or can be known from the implementation of the above-mentioned technology.

[0066] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the following preferred embodiments are specifically described, and the accompanying drawings are referred to, and the detailed description is as follows. BRIEF DESCRIPTION OF DRAWINGS

[0067] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be regarded as a limitation to the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0068] Figure 1 The flowchart of the access control method based on the zero-trust gateway provided by the embodiments of the present application;

[0069] Figure 2 The flowchart of another access control method based on the zero-trust gateway provided by the embodiments of the present application;

[0070] Figure 3 The flowchart of obtaining the terminal verification state information provided by the embodiments of the present application;

[0071] Figure 4 The flowchart of obtaining the token verification state information provided by the embodiments of the present application;

[0072] Figure 5 The structural block diagram of the access control system based on the zero-trust gateway provided by the embodiments of the present application;

[0073] Figure 6 The structural block diagram of the electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0074] The technical solutions in the embodiments of the present application will be described in combination with the drawings in the embodiments of the present application.

[0075] It should be noted that: similar labels and letters represent similar items in the following drawings, therefore, once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. At the same time, in the description of the present application, the terms "first", "second" and the like are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0076] The embodiment of the application provides an access control method and system based on a zero-trust gateway, an electronic device and a computer readable storage medium, which can be applied to access control of a gateway. The access control method based on the zero-trust gateway can perform token verification and request parameter verification on access request information, thereby achieving multi-dimensional checking of the access request information. Meanwhile, the local policy cache database supports policy cache control, and the use of policy cache control can significantly reduce the pressure of the linkage service, improve the access rate without affecting the verification result of the access request information, and improve the user experience. Therefore, the method can perform flexible multi-dimensional checking, improve the request rate, and achieve the technical effect of improving the user experience.

[0077] Exemplarily, in the embodiment of the application, a user connects with a zero-trust gateway through a user terminal, the zero-trust gateway is connected with an application server, and the user terminal completes access to the application server based on the zero-trust gateway.

[0078] Please refer to Figure 1 , Figure 1 A flowchart of an access control method based on a zero-trust gateway is provided in the embodiment of the application. The access control method based on the zero-trust gateway comprises the following steps:

[0079] S100: Obtain access request information sent by a user, wherein the access request information comprises user token data and application token data.

[0080] Exemplarily, a user uses a browser on a user terminal to access an authentication service login page, and after completing authentication, the user accesses the zero-trust gateway through the browser with access request information carrying user token data and application token data.

[0081] S200: Extract the user token data and the application token data according to the access request information.

[0082] S300: Perform token verification on the user token data and the application token data based on a local policy cache database, and obtain token verification state information.

[0083] S400: Determine whether the token verification passes according to the token verification state information. If the token verification does not pass, jump to S800.

[0084] Exemplarily, the local policy cache database can quickly query state data of the user token data and the application token data to obtain the token verification state information. Alternatively, if the local policy cache database does not have state data of the user token data and the application token data, the authentication service of the zero-trust control center can be used to query the security state data of the token, and the local policy cache database can be updated.

[0085] S500: If the token verification passes, it is judged whether the preset field is included or not included according to the request parameter of the access request information, if not, jump to S800;

[0086] Exemplarily, the request parameter of the access request information is checked, which can be used to check whether the header of the access request information contains or does not contain a certain field; thus, the administrator can flexibly control the field content when accessing the application, and improve the security and flexibility of access control.

[0087] S600: If yes, the access request information is sent to the application server, and a link channel is established with the application server;

[0088] S700: Based on the link channel, the user accesses the application server;

[0089] S800: The access request information is rejected.

[0090] Exemplarily, the access control method of the zero-trust gateway can perform token verification and request parameter verification on the access request information, and realize multi-dimensional checking of the access request information. At the same time, the local policy cache database supports policy cache control, and using policy cache control can significantly reduce the pressure of the linkage service, improve the access rate without affecting the verification result of the access request information, and perfect the user experience; thus, the method can perform flexible multi-dimensional checking, improve the request rate, and realize the technical effect of improving the user experience.

[0091] Please refer to Figure 2 , Figure 2 Another flowchart of an access control method based on a zero-trust gateway provided by the embodiment of the application.

[0092] Exemplarily, the zero-trust gateway is configured with terminal verification, and before the step S300 of extracting user token data and application token data according to the access request information, the method further comprises:

[0093] S210: Check whether the terminal verification of the zero-trust gateway is enabled, if not, jump to S300;

[0094] S220: If yes, obtain the user identification code according to the access request information;

[0095] S230: Perform terminal verification on the user identification code based on the local policy cache database to obtain terminal verification state information;

[0096] S240: Judge whether the terminal verification passes according to the terminal verification state information, if the terminal verification does not pass, jump to S800; if the terminal verification passes, jump to S300.

[0097] Exemplarily, if the zero trust gateway is configured and enabled to perform terminal verification, the risk state data of the user identifier code can be quickly queried based on the local policy cache database, so as to perform terminal verification on the user identifier code of the user terminal. The terminal verification state information includes risk information of the user terminal, including virus scanning results, vulnerability information, malicious behavior detection and the like.

[0098] Optionally, if there is no risk state data of the user identifier code in the local policy cache database, the risk state data of the user identifier code can be queried through the terminal risk perception service of the zero trust control center, and the update of the local policy cache database can be completed.

[0099] Referring to Figure 3 , Figure 3 A flowchart for obtaining terminal verification state information is provided for the embodiments of the present application.

[0100] Exemplarily, S230: performing terminal verification on the user identifier code based on the local policy cache database to obtain terminal verification state information, including:

[0101] S231: querying whether there is risk state data of the user identifier code based on the local policy cache database;

[0102] S232: if yes, obtaining the terminal verification state information;

[0103] S233: if no, deriving a request to access the terminal risk perception service of the zero trust control center and query the risk state data of the user identifier code, setting a minute-level expiration time, updating the risk state data of the user identifier code to the local policy cache database and obtaining the terminal verification state information.

[0104] Exemplarily, if there is no risk state data of the user identifier code in the local policy cache database, the risk state data of the user identifier code can be queried through the terminal risk perception service of the zero trust control center, so as to obtain the terminal verification state information, and the update of the local policy cache database can be completed through the risk state data queried by the terminal risk perception service; thus, the risk state data of the user identifier code can be quickly queried based on the local policy cache database when terminal verification is performed on the user identifier code next time.

[0105] Referring to Figure 4 , Figure 4 A flowchart for obtaining token verification state information is provided for the embodiments of the present application.

[0106] Exemplarily, S300: performing token verification on the user token data and the application token data based on the local policy cache database to obtain token verification state information, including:

[0107] S310: Query whether there is security state data of the token based on the local policy cache database;

[0108] S320: If yes, obtain token verification state information;

[0109] S330: If no, derive the request to access the authentication service of the zero trust control center and query the security state data of the token, set the minute-level expiration time, update the security state data of the token to the local policy cache database, and obtain token verification state information.

[0110] Illustratively, if there is no security state data of the token in the local policy cache database, the security state data of the user token can be queried through the authentication service of the zero trust control center, thereby obtaining token verification state information, and completing the update of the local policy cache database through the security state data queried by the authentication service; thereby, the security state data of the token can be quickly queried based on the local policy cache database during the next token verification.

[0111] Illustratively, S100: The user accesses the login page of the authentication service through the browser, and before the step of obtaining the access request information sent by the user, the method further comprises:

[0112] S101: Obtain the login authentication information sent by the user;

[0113] S102: Generate access request information including user token data and application token data according to the login authentication information.

[0114] Illustratively, before the step of S700: Accessing the application server by the user based on the link channel, the method further comprises:

[0115] S610: Obtain the response application data returned by the application server;

[0116] S620: Filter the response application data according to the preset sensitive database, and return the filtered response application data to the user.

[0117] Illustratively, after receiving the response data of the application server, the response data can be filtered according to the fields configured by the administrator, and the sensitive information in the response data is deleted, thereby preventing leakage and improving access security.

[0118] Illustratively, the zero trust gateway is provided with a cache update interface of the local policy cache database, and the zero trust gateway supports bidirectional authentication of the user and the application server.

[0119] Exemplarily, the zero-trust gateway provides a cache update interface, and the authentication service and the terminal risk service can push data to the cache module of the zero-trust gateway in real time when the permission is changed or the terminal state is changed. The zero-trust gateway supports a bidirectional authentication technology, so as to ensure the security and reliability of the cache of the zero-trust gateway.

[0120] In some embodiments, in combination with Figures 1 to 4 The embodiment of the present application provides a multi-dimensional inspection and policy cache control scheme, supports terminal risk perception service and authentication service linkage inspection, and further uses a policy cache technology to reduce the pressure of linkage service, provides a policy cache update interface, improves access speed without affecting verification results, and perfects user experience. In the embodiment of the present application, flexible multi-dimensional inspection is supported for each request, for example, token verification, terminal risk verification, request parameter verification and the like, all risk inspections are gathered together, and only when all dimensions of inspection pass can access intranet resources be released, and risk is blocked in the user domain, and the security of intranet traffic is improved. The present application simultaneously supports a minute-level policy cache technology, and terminal and token verification results are cached according to configured policies, and minute-level cache, local and remote hybrid verification, and a policy cache update interface are supported, the request speed of each interface in single access is improved, the pressure of the zero-trust control center is reduced, and user experience is improved.

[0121] In some implementation scenarios, in combination with Figures 1 to 4 The embodiment of the present application provides an access control method based on a zero-trust gateway, and specific steps of a flow are as follows:

[0122] 1. A user uses a browser to access an authentication service login page and completes authentication.

[0123] 2. After the user logs in successfully, the user carries a user token and an application token to access the zero-trust gateway through the browser.

[0124] 3. If a terminal verification module configured by the zero-trust gateway is started, it is judged whether the request contains a device ID (user identification code), if not, a jump is set to make the client browser request a local service of an endpoint detection and response (EDR) to obtain the device ID. The EDR regularly pushes risk information of the terminal to a terminal environment perception service, including virus scanning results, vulnerability information, malicious behavior control and the like.

[0125] 4. After the browser requests to obtain the device ID, the user token and the application token are carried to access the zero-trust gateway again.

[0126] 5. Request access to the Zero Trust Gateway Terminal Verification Module. This module checks whether there is risk status data for the terminal in the local policy cache database. If not, it uses a derived request to access the Terminal Risk Awareness Service of the Zero Trust Control Center to query the terminal risk.

[0127] 6. After the terminal risk perception service responds, the terminal risk information is cached locally and an expiration time in minutes is set according to the configuration. If the terminal is secure, it proceeds to the next inspection module; if it is not secure, the user request is rejected.

[0128] 7. After the request enters the token verification module, the user token and application token are extracted. This module first checks whether the local policy cache database has security status data for the user token and application token. If not, it uses a derived request to access the authentication service of the Zero Trust Control Center to query the token status.

[0129] 8. After the authentication service responds, this module caches the token status information locally and sets a minute-level expiration time. If the token verification passes, it proceeds to the next inspection module; if it is insecure, the user request is rejected.

[0130] 9. Proceed to the request header inspection module. This module checks whether a certain field is included or not in the header. Administrators can flexibly control the content of fields when accessing this application. Allow access only after all checks pass.

[0131] 10. After the zero-trust gateway passes the multi-dimensional checks, it allows the request, establishes a connection channel with the application server, and receives the application server's response.

[0132] 11. After receiving the application server's response, the response filtering module can delete sensitive information in the response based on the fields configured by the administrator to prevent leakage. After passing through the filtering module, the application data is returned to the user.

[0133] 12. When a user receives the first HTML page of the application's request response, the browser will immediately load other static resources and interface data within the page. When these access requests pass through the zero-trust gateway, the terminal risk verification module and token verification module can use data from the local policy cache database for verification, thereby reducing the pressure on the zero-trust control center service and improving the user experience.

[0134] 13. The Zero Trust Gateway also provides a cache update interface. When the authentication service and the terminal risk service detect changes in permissions or terminal status, they can push the data to the Zero Trust Gateway's cache module in real time. The Zero Trust Gateway supports two-way authentication technology, which can ensure the security and reliability of the Zero Trust Gateway cache.

[0135] For example, the access control method based on a zero-trust gateway provided in this application embodiment can be used in trusted access inspection and control products in a zero-trust system, and the process is as follows:

[0136] 1) Configure and link data with the terminal risk awareness service, including request protocol, domain name, port, two-way authentication certificate, etc.; as well as caching strategies such as whether the terminal verification uses remote verification or local cache verification, and maximum cache time;

[0137] 2) Configuration and authentication service linkage data, including protocol, domain name, port, two-way authentication certificate, etc.; as well as token verification method, using remote verification or local cache verification, cache maximum time, and other caching strategies;

[0138] 3) Configuration and application linkage data, including application protocols, domain names, ports, certificates, etc.;

[0139] 4) Configure request header validation fields, such as required fields and fields that cannot be included;

[0140] 5) Configure response header validation fields, such as fields that must be included and fields that cannot be included;

[0141] 6) When a user accesses an intranet application with token data and device ID, the trusted access control performs a series of checks based on the configuration to complete access control.

[0142] Please see Figure 5 , Figure 5 This is a structural block diagram of an access control system based on a zero-trust gateway provided in an embodiment of this application. The access control system based on a zero-trust gateway includes:

[0143] The request module 100 is used to obtain access request information sent by the user, including user token data and application token data.

[0144] Token module 200 is used to extract user token data and application token data based on access request information;

[0145] The token verification module 300 is used to verify user token data and application token data based on the local policy cache database and obtain token verification status information; it determines whether the token verification passes based on the token verification status information, and if the token verification fails, it refuses to access the request information.

[0146] The request verification module 400 is used to determine whether preset fields are included or not based on the request parameters of the access request information if the token verification passes; if not, the access request information is rejected.

[0147] The access module 500 is used to send access request information to the application server and establish a link channel with the application server if necessary; and to enable user access to the application server based on the link channel.

[0148] For example, the zero-trust gateway is configured with terminal verification, and the access control system based on the zero-trust gateway further includes a terminal verification module, which is used for:

[0149] Check if the Zero Trust Gateway has enabled endpoint verification. If not, proceed to the step of extracting user token data and application token data based on the access request information.

[0150] If so, obtain the user identification code based on the access request information;

[0151] The user identification code is verified by the terminal based on the local policy cache database to obtain the terminal verification status information.

[0152] The terminal verification status information is used to determine whether the terminal verification has passed. If the terminal verification fails, the access request is rejected.

[0153] If the terminal verification passes, proceed to the step of extracting user token data and application token data based on the access request information.

[0154] For example, the terminal verification module is also used for:

[0155] Based on the local policy cache database query, check if there is risk status data for user identification codes. If so, obtain terminal verification status information.

[0156] If not, a derived request is made to access the terminal risk awareness service of the Zero Trust Control Center and query the risk status data of the user identifier code, set a minute-level expiration time, update the risk status data of the user identifier code to the local policy cache database, and obtain the terminal verification status information.

[0157] For example, the token verification module 300 is also used for:

[0158] The database query is based on a local policy cache to check if there is security status data for the token. If so, the token verification status information is obtained.

[0159] If not, a derived request is made to access the authentication service of the Zero Trust Control Center and query the security status data of the token, set a minute-level expiration time, update the security status data of the token to the local policy cache database, and obtain the token verification status information.

[0160] For example, the access control system based on the zero-trust gateway also includes a login module, which is used for:

[0161] Retrieve the login authentication information sent by the user;

[0162] Based on the login authentication information, an access request is generated that includes user token data and application token data.

[0163] For example, the access control system based on the zero-trust gateway also includes a response filtering module, which is used to:

[0164] Retrieve the application data returned by the application server;

[0165] The response application data is filtered based on a preset sensitive database, and the filtered response application data is returned to the user.

[0166] It should be noted that the access control system based on a zero-trust gateway provided in this application embodiment is different from... Figures 1 to 4 The method embodiments shown correspond to each other, and will not be described again here to avoid repetition.

[0167] This application also provides an electronic device, please refer to [link to application]. Figure 6 , Figure 6 This is a structural block diagram of an electronic device provided in an embodiment of this application. The electronic device may include a processor 510, a communication interface 520, a memory 530, and at least one communication bus 540. The communication bus 540 is used to enable direct communication between these components. In this embodiment, the communication interface 520 of the electronic device is used for signaling or data communication with other node devices. The processor 510 may be an integrated circuit chip with signal processing capabilities.

[0168] The processor 510 described above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor, or the processor 510 can be any conventional processor.

[0169] The memory 530 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc. The memory 530 stores computer-readable instructions. When these computer-readable instructions are executed by the processor 510, the electronic device can perform the aforementioned operations. Figures 1 to 4 The various steps involved in the method implementation examples.

[0170] Alternatively, the electronic device may also include a storage controller and an input / output unit.

[0171] The memory 530, storage controller, processor 510, peripheral interface, and input / output unit are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses 540. The processor 510 is used to execute executable modules stored in the memory 530, such as software function modules or computer programs included in electronic devices.

[0172] The input / output unit is used to provide users with the ability to create tasks and to set optional start periods or preset execution times for those tasks, thereby enabling user-server interaction. The input / output unit may be, but is not limited to, a mouse and keyboard.

[0173] Understandable. Figure 6 The structure shown is for illustrative purposes only; the electronic device may also include components that are more advanced than those shown. Figure 6 The more or fewer components shown, or having the same Figure 6 The different configurations shown. Figure 6 The components shown can be implemented using hardware, software, or a combination thereof.

[0174] This application also provides a storage medium storing instructions. When the instructions are run on a computer, the computer program is executed by a processor to implement the method described in the method embodiment. To avoid repetition, the method will not be described again here.

[0175] This application also provides a computer program product that, when run on a computer, causes the computer to perform the method described in the method embodiment.

[0176] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0177] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0178] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0179] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0180] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0181] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. An access control method based on a zero-trust gateway, characterized in that, include: Obtain access request information sent by the user, the access request information including user token data and application token data; Extract the user token data and application token data based on the access request information; Based on the local policy cache database, token verification is performed on the user token data and application token data to obtain token verification status information; The token verification status information is used to determine whether the token verification is successful. If the token verification fails, the access request is rejected. If the token verification passes, determine whether the preset fields are included or not based on the request parameters of the access request information. If not, reject the access request information. If so, the access request information is sent to the application server, and a link channel is established with the application server; The user accesses the application server based on the aforementioned link channel; The zero-trust gateway is configured with terminal verification. Before the step of extracting the user token data and application token data based on the access request information, the method further includes: Check whether the zero-trust gateway has terminal verification enabled. If not, proceed to the step of extracting the user token data and application token data based on the access request information. If so, obtain the user identification code based on the access request information; Based on the local policy cache database, the user identification code is verified by the terminal to obtain terminal verification status information; The terminal verification status information is used to determine whether the terminal verification has passed. If the terminal verification fails, the access request information is rejected. If the terminal verification passes, proceed to the step of extracting the user token data and application token data based on the access request information; The step of performing terminal verification on the user identifier code based on the local policy cache database to obtain terminal verification status information includes: Based on the local policy cache database query, check if there is risk status data for the user identification code. If so, obtain the terminal verification status information. If not, a derived request is made to access the terminal risk awareness service of the Zero Trust Control Center and query the risk status data of the user identifier code, set a minute-level expiration time, update the risk status data of the user identifier code to the local policy cache database, and obtain the terminal verification status information.

2. The access control method based on a zero-trust gateway according to claim 1, characterized in that, The step of verifying the user token data and application token data based on the local policy cache database to obtain token verification status information includes: Based on the local policy cache database query, check if there is security status data for the token; if so, obtain the token verification status information. If not, a derived request is made to access the authentication service of the Zero Trust Control Center and query the security status data of the token, set a minute-level expiration time, update the security status data of the token to the local policy cache database, and obtain the token verification status information.

3. The access control method based on a zero-trust gateway according to claim 1, characterized in that, Before the step of obtaining the access request information sent by the user when the user accesses the authentication service login page through a browser, the method further includes: Obtain the login authentication information sent by the user; Based on the login authentication information, an access request information including the user token data and the application token data is generated.

4. The access control method based on a zero-trust gateway according to claim 1, characterized in that, Prior to the step of enabling the user to access the application server based on the link channel, the method further includes: Obtain the response application data returned by the application server; The response application data is filtered according to a preset sensitive database, and the filtered response application data is returned to the user.

5. The access control method based on a zero-trust gateway according to any one of claims 1 to 4, characterized in that, The zero-trust gateway is equipped with a cache update interface for the local policy cache database, and the zero-trust gateway supports two-way authentication between the user and the application server.

6. An access control system based on a zero-trust gateway, characterized in that, include: The request module is used to obtain access request information sent by the user, the access request information including user token data and application token data; The token module is used to extract the user token data and application token data based on the access request information; The token verification module is used to perform token verification on the user token data and application token data based on the local policy cache database, and obtain token verification status information. The token verification status information is used to determine whether the token verification is successful. If the token verification fails, the access request is rejected. The request verification module is used to determine whether a preset field is included or not based on the request parameters of the access request information if the token verification passes; if not, the access request information is rejected. The access module is used to send the access request information to the application server if the condition is met, and to establish a link channel with the application server. The user accesses the application server based on the aforementioned link channel; The zero-trust gateway is configured with terminal verification, and the access control system based on the zero-trust gateway further includes a terminal verification module, which is used for: Check whether the zero-trust gateway has terminal verification enabled. If not, proceed to the step of extracting the user token data and application token data based on the access request information. If so, obtain the user identification code based on the access request information; Based on the local policy cache database, the user identification code is verified by the terminal to obtain terminal verification status information; The terminal verification status information is used to determine whether the terminal verification has passed. If the terminal verification fails, the access request information is rejected. If the terminal verification passes, proceed to the step of extracting the user token data and application token data based on the access request information; The terminal verification module is also used for: Based on the local policy cache database query, check if there is risk status data for the user identification code. If so, obtain the terminal verification status information. If not, a derived request is made to access the terminal risk awareness service of the Zero Trust Control Center and query the risk status data of the user identifier code, set a minute-level expiration time, update the risk status data of the user identifier code to the local policy cache database, and obtain the terminal verification status information.

7. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the access control method based on a zero-trust gateway as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the access control method based on a zero-trust gateway as described in any one of claims 1 to 5.

Images