Remote office access method and system based on zero trust

Abstract

The present invention provides a remote office access method and system based on zero trust, including a zero trust terminal, a zero trust control center, a zero trust gateway, and an application access gateway. The zero trust terminal checks the terminal environment, generates a SPA request for device authentication, and the zero trust control center and the zero trust terminal establish a mTLS two-way connection, initiates a user login request based on user input information, and initiates a resource access request to the gateway; the zero trust control center verifies the device and user identity; dynamically adjusts user access rights based on user permissions and terminal environment; the zero trust gateway verifies the user and device identity, filters illegal access, and unloads and encapsulates traffic; the application access gateway completes background service access positioning and proxy. The present invention improves the security of user login and solves the problems of weak VPN passwords and poor permission control granularity.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and in particular to a remote office access method and system based on zero trust. Background Art

[0002] Remote office refers to the popular practice in enterprises of establishing a temporary and secure connection in a public network (usually the Internet) through a virtual private network (VPN), forming a secure and stable tunnel through the chaotic public network, helping remote users, company branches, business partners and suppliers to establish a reliable and secure connection with the company's internal network and ensure the secure transmission of data. Generally speaking, this method can support users' full range of daily office needs, including obtaining internal company emails, accessing file servers, internal databases, CRM, ERP, etc. in the LAN, not just remote control.

[0003] SPA (Single Packet Authorization) is a lightweight security protocol that uses only a single data packet for access requests. It simplifies the door-knocking process by integrating all necessary information into a single data packet. Before allowing access to the network, it verifies the identity of the device and user, thereby achieving "network invisibility" and preventing attackers from finding service addresses and ports.

[0004] Currently, the demand for remote office in enterprises is booming. As the most commonly used remote secure connection method, VPN can help enterprises solve the urgent need for remote office. However, VPN also brings great security risks to enterprises due to its slow access speed, vulnerability to attacks, and poor authority control.

[0005] Therefore, the market needs a remote office access method and system based on zero trust. Summary of the invention

[0006] In view of the defects in the prior art, the purpose of the present invention is to provide a remote office access method and system based on zero trust.

[0007] A remote office access method based on zero trust provided by the present invention includes:

[0008] Device authentication step: The zero-trust terminal checks the terminal environment and generates a SPA single-package authorization request for device authentication, and then the zero-trust control center establishes a two-way connection with the zero-trust terminal;

[0009] Identity authentication step: Through the two-way connection, the zero-trust terminal sends a user login request to the zero-trust control center, and the zero-trust control center verifies the user identity in combination with device authentication and dynamically adjusts the user's access rights;

[0010] Steps for accessing business resources: The zero-trust gateway verifies user identity and equipment, filters illegal access, unloads and encapsulates traffic, and then uses the access gateway to complete background service access positioning and proxy.

[0011] Preferably, the zero-trust terminal includes an integrated security sandbox, a local threat engine, and a single-packet verification access module;

[0012] The zero-trust terminal is registered with the zero-trust control center during installation, and the CA root certificate is imported into the terminal;

[0013] When the user starts the zero-trust terminal, the integrated security sandbox starts relevant security functions and the local threat engine checks the current zero-trust terminal system status, network environment and abnormal behavior.

[0014] Preferably, the device authentication step includes:

[0015] Step S1.1: The local threat engine in the zero-trust terminal scans the terminal operating environment and determines whether the safe operating conditions are met according to the preset security rules. If not, the user is prompted to close the risk process; if yes, step S1.2 is executed;

[0016] Step S1.2: The zero-trust terminal generates a pre-shared key through the device unique identifier, timestamp and preset key seed, and then generates a SPA single-package authorization request message and sends it to the zero-trust control center;

[0017] Step S1.3: The zero-trust control center checks the SPA single-package authorization request message and verifies whether the content of the SPA single-package authorization message is valid. If so, a SPA response message is returned to the zero-trust terminal, and the firewall is set to open a specific port for the target IP within a specified time; if not, no response is given;

[0018] Step S1.4: The zero-trust terminal receives the SPA response message and determines whether the CA organization of the zero-trust control center is credible through the CA root certificate. If so, step S1.5 is executed; if not, the authentication is terminated;

[0019] Step S1.5: The zero-trust terminal generates a key and certificate signing request file, and submits an application for a digital certificate to the zero-trust control center;

[0020] Step S1.6: The zero trust control center responds to the application and reviews it. After the review is passed, the digital certificate is returned to the zero trust terminal. Then the zero trust terminal and the zero trust control center establish a two-way connection by exchanging digital certificates.

[0021] Preferably, the identity authentication step includes:

[0022] Step S2.1: The zero-trust terminal sends a user login request to the zero-trust control center;

[0023] Step S2.2: The zero trust control center verifies the login request. After verification, it sends device and user related information to the zero trust gateway and sends the Session ID, service and gateway list to the zero trust terminal;

[0024] Step S2.3: The zero-trust terminal carries the Session ID to report information to the zero-trust control center;

[0025] Step S2.4: The zero-trust control center determines whether there is a Session ID in the reported information. If so, execute step S2.5; if not, redirect the terminal to the login page and re-execute the login process;

[0026] Step S2.5: The zero trust control center analyzes the reported information, determines the trust score of the current user through the analysis results, adjusts the user's access rights according to the trust score, sends user access rights update instructions to the zero trust gateway, and updates the user access service list information to the zero trust terminal.

[0027] Preferably, when the user logs out, the zero trust terminal sends a logout request to the zero trust control center, the zero trust control center sends a current user information clear instruction to the zero trust gateway, and the zero trust gateway and the zero trust control center disconnect from the zero trust terminal.

[0028] Preferably, the step of accessing the service resources includes:

[0029] Step S3.1: The zero-trust terminal sends a SPA knocking request to the zero-trust gateway;

[0030] Step S3.2: The zero-trust gateway responds to the request and verifies it. After verification, it sets firewall rules and opens ports to the specified terminal;

[0031] Step S3.3: The zero-trust terminal establishes a two-way connection with the target zero-trust gateway, and initiates a resource access request to the zero-trust gateway with the Session ID;

[0032] Step S3.4: The zero-trust gateway responds to the request, performs parsing and verification, and after verification, determines whether the current user application is in the access permission list. If not, the access is denied and a prompt indicating insufficient permissions is returned to the zero-trust terminal. If so, execute step S3.5;

[0033] Step S3.5: unloading and encapsulating the access request and sending it to the application access gateway;

[0034] Step S3.6: The application access gateway decrypts the access request, locates the service resource to be acquired and redirects the request to a specific server;

[0035] Step S3.7: After receiving the resource information feedback from the server, the application access gateway encrypts and encapsulates it and sends it to the zero trust gateway;

[0036] Step S3.8: The zero-trust gateway decrypts and sends it to the zero-trust terminal.

[0037] Preferably, the zero-trust control center includes an identity and device management engine, a trust assessment engine, a policy delivery engine, a behavior analysis engine and a key management engine.

[0038] Preferably, the step of checking the SPA single packet authorization request message in step S1.3 includes:

[0039] Step S1.3.1: The identity and device management engine checks whether the device unique identifier in the SPA single package authorization request message is in the trusted list. If so, step S1.3.2 is executed; if not, the authentication ends;

[0040] Step S1.3.2: The key management engine generates CA information by encrypting the CA private key, and the zero trust management and control center sends a SPA single package authorization request response message to the zero trust terminal, carrying the CA information.

[0041] A remote office access system based on zero trust is provided according to the present invention, comprising:

[0042] Device authentication module: The zero-trust terminal checks the terminal environment, generates a SPA single-package authorization request for device authentication, and then the zero-trust control center establishes a two-way connection with the zero-trust terminal;

[0043] Identity authentication module: Through the two-way connection, the zero-trust terminal sends a user login request to the zero-trust control center, and the zero-trust control center verifies the user identity in combination with device authentication and dynamically adjusts the user's access rights;

[0044] Access business resource module: The zero-trust gateway verifies user identity and equipment, filters illegal access, unloads and encapsulates traffic, and then uses the access gateway to complete background service access positioning and proxy.

[0045] Preferably, it includes a zero-trust terminal, a zero-trust control center, a zero-trust gateway and an application access gateway;

[0046] The zero-trust control center includes an identity and device management engine, a trust assessment engine, a policy delivery engine, a behavior analysis engine, and a key management engine;

[0047] The identity and device management engine is used to authenticate users and devices;

[0048] The behavior analysis engine is used to analyze the reported information sent by the zero-trust terminal; the trust assessment engine determines the trust score of the current user according to the analysis result of the behavior analysis engine; the policy delivery engine adjusts the user's access rights according to the trust score, and delivers a user access rights update instruction to the target gateway;

[0049] The key management engine is used to generate a digital certificate.

[0050] Compared with the prior art, the present invention has the following beneficial effects:

[0051] 1. The present invention improves the security of user login through multi-factor authentication, behavior assessment, dynamic access control, etc., monitors the terminal environment and user behavior in real time, and timely shrinks user application access rights according to user credit scores, solving the problems of weak VPN passwords and poor granularity of permission control.

[0052] 2. The present invention improves the fluency of data transmission through TLS two-way data transmission encryption in a short connection mode and reduces the risk of sensitive data leakage through terminal security management and control measures.

[0053] 3. The present invention reduces the attack exposure surface and reduces the risk of being attacked by hiding services. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0055] Figure 1 Schematic diagram of the system architecture of the present invention. DETAILED DESCRIPTION

[0056] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0057] The present invention includes a zero-trust terminal, a zero-trust control center, a zero-trust gateway and an application access gateway. Among them, the zero-trust control center includes an identity and device management engine, a trust assessment engine, a policy issuance engine, a behavior analysis engine and a key management engine. The zero-trust terminal includes an integrated security sandbox, a local threat engine and a single-package verification access module. The zero-trust gateway includes network invisibility, network access, traffic security encryption / decryption, access log recording and application access forwarding. The application access gateway includes firewall and proxy penetration, application access positioning and traffic security encryption / decryption.

[0058] Embodiment 1

[0059] According to a remote office access method based on zero trust provided by the present invention, Figure 1 As shown, including:

[0060] Device authentication steps: The zero-trust terminal checks the terminal environment, generates a SPA single-package authorization request for device authentication, and then the zero-trust control center establishes a two-way connection with the zero-trust terminal. Specifically, the device authentication steps include:

[0061] Step S1.1: The local threat engine in the zero-trust terminal scans the terminal operating environment and determines whether the safe operating conditions are met based on the preset security rules. If not, the user is prompted to close the risky process; if so, a pre-shared key is generated through the device unique identifier, timestamp and preset key seed, and then a SPA single package authorization request message is generated and sent to the zero-trust control center.

[0062] Step S1.2: The zero-trust control center checks the SPA single-package authorization request message and verifies whether the content of the SPA single-package authorization message is valid. If so, it returns a SPA response message to the zero-trust terminal and sets the firewall to open a specific port for the target IP within a specified time; if not, it does not respond.

[0063] Further, preferably, the step of checking the SPA single-package authorization request message includes step S1.3.1: the zero-trust control center first checks whether the SPA has been tampered with, expired, etc. If the SPA information is valid, the identity and device management engine checks whether the device unique identifier in the SPA single-package authorization request message is in the trusted list, and verifies whether the HOTP and HMAC are correct. If so, the key management engine generates CA information through CA private key encryption, and the zero-trust control center sends a SPA single-package authorization request response message to the zero-trust terminal, carrying the CA information. At the same time, the zero-trust control center sets firewall rules to open a specific port for the target IP within a specified time; if not, the authentication ends.

[0064] Step S1.3: The zero-trust terminal receives the SPA response message and determines whether the CA organization of the zero-trust control center is credible through the CA root certificate. If not, the authentication is terminated; if so, a key and certificate signing request file are generated, and an application for a digital certificate is submitted to the zero-trust control center; the zero-trust control center responds to the application and reviews it. After the review is passed, the digital certificate is returned to the zero-trust terminal, and then the zero-trust terminal and the zero-trust control center establish a two-way connection by exchanging digital certificates. The two-way connection includes an mTLS (Mutual Transport Layer Security) two-way connection.

[0065] Identity authentication step: Through the two-way connection, the zero-trust terminal sends a user login request to the zero-trust control center, and the zero-trust control center verifies the user identity in combination with device authentication and dynamically adjusts the user's access rights. Specifically, the identity authentication step includes:

[0066] Step S2.1: The zero-trust terminal sends a user login request to the zero-trust control center.

[0067] Step S2.2: The zero-trust control center verifies the login request. After verification, it sends the device and user related information to the zero-trust gateway and sends the Session ID, service and gateway list to the zero-trust terminal. The device and user related information includes the device unique identifier, accessible service list, user identity and other information.

[0068] Step S2.3: The zero-trust terminal carries the Session ID and reports information to the zero-trust control center, where the reported information includes terminal environment perception information and user operation information.

[0069] Step S2.4: The zero trust control center determines whether there is a Session ID in the reported information. If so, the zero trust control center analyzes the reported information, determines the trust score of the current user based on the analysis results, and adjusts the user's access rights according to the trust score. It sends a user access rights update instruction to the zero trust gateway and updates the user access service list information to the zero trust terminal; if not, the terminal is redirected to the login page and the login process is re-executed.

[0070] When a user requests to log out, the zero-trust terminal sends a logout request to the zero-trust control center, and the zero-trust control center sends an instruction to clear the current user information to the zero-trust gateway. The zero-trust gateway and the zero-trust control center disconnect from the zero-trust terminal.

[0071] Steps for accessing business resources: The zero-trust gateway verifies user identity and equipment, filters illegal access, unloads and encapsulates traffic, and then the application access gateway completes background service access positioning and proxy. Specifically, the steps for accessing business resources include:

[0072] Step S3.1: The zero-trust terminal sends a SPA knock request to the zero-trust gateway.

[0073] Step S3.2: The zero-trust gateway responds to the request and verifies it. After the verification is passed, the firewall rules are set and the port is opened to the designated terminal.

[0074] Step S3.3: The zero-trust terminal establishes a two-way connection with the target zero-trust gateway, and initiates a resource access request to the zero-trust gateway with the Session ID.

[0075] Step S3.4: The zero-trust gateway responds to the request, performs parsing and verification, and determines whether the current user application is in the access permission list after verification. If not, the access is denied and a prompt indicating insufficient permissions is returned to the zero-trust terminal; if so, the access request is unloaded and encapsulated and sent to the application access gateway;

[0076] Step S3.5: The application access gateway decrypts the access request, locates the service resource to be acquired and redirects the request to a specific server;

[0077] Step S3.6: After the application access gateway receives the resource information feedback from the server, it is encrypted and encapsulated and sent to the zero trust gateway; the zero trust gateway decrypts and sends it to the zero trust terminal.

[0078] In addition, the application access gateway of the present invention establishes a connection with the zero trust gateway before re-authentication of the zero trust terminal. Specifically, the application access gateway initiates a network penetration agent to connect to the zero trust gateway, and establishes a network channel between the zero trust gateway and the application access gateway. That is to say, the zero trust gateway and the application access gateway are connected through a network penetration channel. In addition, the zero trust terminal is filed with the zero trust control center during installation, and the CA root certificate is imported into the terminal. When the user starts the zero trust terminal, the integrated security sandbox starts the relevant security functions and the local threat engine checks the current zero trust terminal system status, network environment and abnormal behavior. Among them, the relevant security functions include anti-copying, anti-screenshot, anti-printing, transparent watermark, etc., prohibiting all copying and printing behaviors in the sandbox, and tracking the user's potential screenshot / screen recording behavior in real time through the anti-screenshot module, and immediately displaying a black screen; through the transparent watermark of the window, it is possible to track the data leakage caused by screen photography.

[0079] Embodiment 2

[0080] The present invention also provides a remote office access system based on zero trust. Those skilled in the art can implement the remote office access system based on zero trust by executing the step flow of the remote office access method based on zero trust, that is, the remote office access method based on zero trust can be understood as a preferred implementation of the remote office access system based on zero trust.

[0081] According to a zero-trust remote office access system provided by the present invention, Figure 1 As shown, including:

[0082] Device authentication module: The zero-trust terminal checks the terminal environment, generates a SPA single-package authorization request for device authentication, and then the zero-trust control center establishes a two-way connection with the zero-trust terminal. Specifically, the device authentication steps include:

[0083] Module M1.1: The local threat engine in the zero-trust terminal scans the terminal operating environment and determines whether the safe operating conditions are met based on the preset security rules. If not, the user is prompted to close the risky process. If so, the zero-trust terminal generates a pre-shared key through the device's unique identifier, timestamp and preset key seed, and then generates a SPA single-package authorization request message and sends it to the zero-trust control center.

[0084] Module M1.2: The zero-trust control center checks the SPA single-package authorization request message and verifies whether the content of the SPA single-package authorization message is valid. If so, it returns a SPA response message to the zero-trust terminal and sets the firewall to open a specific port for the target IP within a specified time; if not, it does not respond. The steps for checking the SPA single-package authorization request message in module M1.2 include: Module M1.2.1: The identity and device management engine checks whether the device unique identifier in the SPA single-package authorization request message is in the trusted list. If so, it triggers module M1.2.2; if not, the authentication ends. Module M1.2.3: The key management engine generates CA information by encrypting the CA private key, and the zero-trust control center sends a SPA single-package authorization request response message to the zero-trust terminal, carrying the CA information.

[0085] Module M1.3: The zero-trust terminal receives the SPA response message and determines whether the CA organization of the zero-trust control center is trustworthy through the CA root certificate. If so, the zero-trust terminal generates a key and certificate signing request file and submits an application for a digital certificate to the zero-trust control center; if not, the authentication is terminated.

[0086] Module M1.4: The zero trust control center responds to the application and reviews it. After the review is passed, the digital certificate is returned to the zero trust terminal. Then the zero trust terminal and the zero trust control center establish a two-way connection by exchanging digital certificates.

[0087] Identity authentication module: Through the two-way connection, the zero-trust terminal sends a user login request to the zero-trust control center. The zero-trust control center verifies the user's identity and dynamically adjusts the user's access rights in combination with device authentication. The identity authentication steps include:

[0088] Module M2.1: The zero-trust terminal sends a user login request to the zero-trust control center. Module M2.2: The zero-trust control center verifies the login request. After verification, it sends device and user-related information to the zero-trust gateway, and sends the Session ID, service and gateway list to the zero-trust terminal. Module M2.2: The zero-trust terminal reports information to the zero-trust control center with the Session ID. Module M2.4: The zero-trust control center determines whether there is a Session ID in the reported information. If so, the zero-trust control center analyzes the reported information, determines the trust score of the current user based on the analysis results, and adjusts the user's access rights according to the trust score. It sends a user access rights update instruction to the zero-trust gateway, and updates the user access service list information to the zero-trust terminal; if not, the terminal is redirected to the login page to re-trigger the login process.

[0089] When the user logs out, the zero trust terminal sends a logout request to the zero trust control center, and the zero trust control center sends an instruction to clear the current user information to the zero trust gateway. The zero trust gateway and the zero trust control center disconnect from the zero trust terminal.

[0090] Access business resource module: The zero-trust gateway verifies user identity and equipment, filters illegal access, unloads and encapsulates traffic, and then the application access gateway completes background service access positioning and proxy. The steps for accessing business resources include: Module M2.1: The zero-trust terminal sends a SPA knocking request to the zero-trust gateway. Module M2.2: The zero-trust gateway responds to the request and verifies it. After the verification is passed, the firewall rules are set and the port is opened to the specified terminal. Module M2.2: The zero-trust terminal establishes a two-way connection with the target zero-trust gateway, and carries the Session ID to initiate a resource access request to the zero-trust gateway. Module M2.4: The zero-trust gateway responds to the request, performs parsing and verification, and determines whether the current user application is in the access permission list after the verification. If not, the access is denied and a prompt of insufficient permissions is returned to the zero-trust terminal. If so, the access request is unloaded and encapsulated and sent to the application access gateway; Module M2.5: The application access gateway decrypts the access request, locates the business resources to be obtained, and redirects the request to a specific server; Module M2.6: After receiving the resource information feedback from the server, the application access gateway sends it to the zero-trust gateway after encryption and encapsulation; Module M2.7: The zero-trust gateway decrypts and sends it to the zero-trust terminal.

[0091] In addition, the system includes a zero-trust terminal, a zero-trust control center, a zero-trust gateway, and an application access gateway. The zero-trust control center includes an identity and device management engine, a trust assessment engine, a policy issuance engine, a behavior analysis engine, and a key management engine. Among them, the identity and device management engine is used to authenticate users and devices. The behavior analysis engine is used to analyze the reported information sent by the zero-trust terminal; the trust assessment engine determines the trust score of the current user based on the analysis results of the behavior analysis engine; the policy issuance engine adjusts the user's access rights based on the trust score, and issues user access rights update instructions to the target gateway; the key management engine is used to generate digital certificates.

[0092] The zero-trust terminal includes an integrated security sandbox, a local threat engine, and a single-package verification access module. The zero-trust terminal is registered with the zero-trust control center during installation, and the CA root certificate is imported into the terminal. When the user starts the zero-trust terminal, the integrated security sandbox starts the relevant security functions and the local threat engine checks the current zero-trust terminal system status, network environment, and abnormal behavior.

[0093] Those skilled in the art know that, in addition to implementing the system, device and its various modules provided by the present invention in a purely computer-readable program code, it is entirely possible to implement the same program in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers and embedded microcontrollers by logically programming the method steps. Therefore, the system, device and its various modules provided by the present invention can be considered as a hardware component, and the modules included therein for implementing various programs can also be considered as structures within the hardware component; the modules for implementing various functions can also be considered as both software programs for implementing the method and structures within the hardware component.

[0094] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A remote office access method based on zero trust, characterized in that: include: Device authentication step: The zero-trust terminal checks the terminal environment and generates a SPA single-package authorization request for device authentication, and then the zero-trust control center establishes a two-way connection with the zero-trust terminal; Identity authentication step: Through the two-way connection, the zero-trust terminal sends a user login request to the zero-trust control center, and the zero-trust control center verifies the user identity in combination with device authentication and dynamically adjusts the user's access rights; Steps to access business resources: The zero-trust gateway verifies user identity and devices, filters illegal access, unloads and encapsulates traffic, and then the application access gateway completes background service access positioning and proxy; The zero-trust terminal includes an integrated security sandbox, a local threat engine, and a single-packet verification access module; The zero-trust terminal is registered with the zero-trust control center during installation, and the CA root certificate is imported into the terminal; When the user starts the zero-trust terminal, the integrated security sandbox starts the relevant security functions and the local threat engine checks the current zero-trust terminal system status, network environment and abnormal behavior; The device authentication steps include: Step S1.1: The local threat engine in the zero-trust terminal scans the terminal operating environment and determines whether the safe operating conditions are met according to the preset security rules. If not, the user is prompted to close the risk process; if yes, step S1.2 is executed; Step S1.2: The zero-trust terminal generates a pre-shared key through the device unique identifier, timestamp and preset key seed, and then generates a SPA single-package authorization request message and sends it to the zero-trust control center; Step S1.3: The zero-trust control center checks the SPA single-package authorization request message and verifies whether the content of the SPA single-package authorization request message is valid. If so, a SPA response message is returned to the zero-trust terminal, and the firewall is set to open a specific port for the target IP within a specified time; if not, no response is given; Step S1.4: The zero-trust terminal receives the SPA response message and determines whether the CA organization of the zero-trust control center is credible through the CA root certificate. If so, step S1.5 is executed; if not, the authentication is terminated; Step S1.5: The zero-trust terminal generates a key and certificate signing request file, and submits an application for a digital certificate to the zero-trust control center; Step S1.6: The zero trust control center responds to the application and reviews it. After the review is passed, the digital certificate is returned to the zero trust terminal, and then the zero trust terminal and the zero trust control center establish a two-way connection by exchanging digital certificates; The authentication steps include: Step S2.1: The zero-trust terminal sends a user login request to the zero-trust control center; Step S2.2: The zero trust control center verifies the login request. After verification, it sends device and user related information to the zero trust gateway and sends the Session ID, service and gateway list to the zero trust terminal; Step S2.3: The zero-trust terminal carries the Session ID to report information to the zero-trust control center; Step S2.4: The zero-trust control center determines whether there is a Session ID in the reported information. If so, execute step S2.5; if not, redirect the terminal to the login page and re-execute the login process; Step S2.5: The zero trust control center analyzes the reported information, determines the trust score of the current user through the analysis result, adjusts the user's access rights according to the trust score, sends a user access rights update instruction to the zero trust gateway, and updates the user access service list information to the zero trust terminal; When the user logs out, the zero-trust terminal sends a logout request to the zero-trust control center, and the zero-trust control center sends a command to clear the current user information to the zero-trust gateway. The zero-trust gateway and the zero-trust control center disconnect from the zero-trust terminal. The steps to access business resources include: Step S3.1: The zero-trust terminal sends a SPA knocking request to the zero-trust gateway; Step S3.2: The zero-trust gateway responds to the request and verifies it. After verification, it sets firewall rules and opens ports to the specified terminal; Step S3.3: The zero-trust terminal establishes a two-way connection with the target zero-trust gateway, and initiates a resource access request to the zero-trust gateway with the Session ID; Step S3.4: The zero-trust gateway responds to the request, performs parsing and verification, and after verification, determines whether the current user application is in the access permission list. If not, the access is denied and a prompt indicating insufficient permissions is returned to the zero-trust terminal. If so, execute step S3.5; Step S3.5: unloading and encapsulating the access request and sending it to the application access gateway; Step S3.6: The application access gateway decrypts the access request, locates the service resource to be acquired and redirects the request to a specific server; Step S3.7: After receiving the resource information feedback from the server, the application access gateway encrypts and encapsulates it and sends it to the zero trust gateway; Step S3.8: The zero-trust gateway decrypts and sends the data to the zero-trust terminal; The zero-trust control center includes an identity and device management engine, a trust assessment engine, a policy delivery engine, a behavior analysis engine, and a key management engine; The step of checking the SPA single packet authorization request message in step S1.3 includes: Step S1.3.1: The identity and device management engine checks whether the device unique identifier in the SPA single package authorization request message is in the trusted list. If so, step S1.3.2 is executed; if not, the authentication ends; Step S1.3.2: The key management engine generates CA information by encrypting the CA private key, and the zero trust management and control center sends a SPA single package authorization request response message to the zero trust terminal, carrying the CA information.

2. A remote office access system based on zero trust, characterized in that: The method for executing the remote office access method based on zero trust according to claim 1 comprises: Device authentication module: The zero-trust terminal checks the terminal environment, generates a SPA single-package authorization request for device authentication, and then the zero-trust control center establishes a two-way connection with the zero-trust terminal; Identity authentication module: Through the two-way connection, the zero-trust terminal sends a user login request to the zero-trust control center, and the zero-trust control center verifies the user identity in combination with device authentication and dynamically adjusts the user's access rights; Access business resource module: The zero-trust gateway verifies user identity and equipment, filters illegal access, unloads and encapsulates traffic, and then the application access gateway completes background service access positioning and proxy; Including zero-trust terminals, zero-trust control centers, zero-trust gateways, and application access gateways; The zero-trust control center includes an identity and device management engine, a trust assessment engine, a policy delivery engine, a behavior analysis engine, and a key management engine; The identity and device management engine is used to authenticate users and devices; The behavior analysis engine is used to analyze the reported information sent by the zero-trust terminal; the trust assessment engine determines the trust score of the current user according to the analysis result of the behavior analysis engine; the policy delivery engine adjusts the user's access rights according to the trust score, and delivers a user access rights update instruction to the target gateway; The key management engine is used to generate a digital certificate.

Images