Network access control method, system and related equipment based on zero trust mechanism

Abstract

The present disclosure provides a network access control method, system and related equipment based on a zero-trust mechanism, and relates to the field of network security technology. The method includes: collecting the target user's live data and identity data; obtaining the account data of at least one business system in the network to be accessed; generating zero-trust access policy information for the target user to access each business system based on the target user's live data and identity data, as well as the account data of each business system; and controlling the target user's access behavior to one or more business systems in the network to be accessed based on the zero-trust access policy information. The present disclosure can realize dynamic authorized access to each business system in the network, avoid access by illegal users, and thus ensure the overall security of the network.

Description

Background Art

[0002] After a long period of continuous construction, the operator has a large number of business systems. The traditional solution based on static control of firewall IP addresses cannot set up a large number of detailed point-to-point control lists due to the problem of operation and maintenance manpower and material resources. On the other hand, since the IP address that initiates the access may have been illegally controlled, it is impossible to completely protect the internal system from being accessed by unidentified "hacker" users, and thus it is impossible to prevent "hacker" users from controlling the internal system by exploiting loopholes and weak passwords. It can be seen that this firewall-based network access control solution has the problem of low security.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0004] The present disclosure provides a network access control method, system and related equipment based on a zero-trust mechanism, which at least to a certain extent overcome the technical problem of low security of firewall-based network access control solutions in related technologies.

[0005] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0006] According to one aspect of the present disclosure, a network access control method based on a zero-trust mechanism is provided, the method comprising: collecting live data and identity data of a target user; obtaining account data of at least one business system in a network to be accessed; generating zero-trust access policy information for the target user to access each business system based on the live data and identity data of the target user and the account data of each business system; and controlling the target user's access behavior to one or more business systems in the network to be accessed based on the zero-trust access policy information.

[0007] In some embodiments, collecting the live data and identity data of the target user includes: collecting the live data and identity data of the target user through a zero-trust dedicated browser.

[0008] In some embodiments, based on the zero-trust access policy information, the target user's access behavior to one or more business systems in the network to be accessed is controlled, including: establishing a trusted long connection tunnel between the zero-trust dedicated browser and one or more business systems in the network to be accessed that the target user is allowed to access; through the trusted long connection tunnel, the access request initiated by the target user through the zero-trust dedicated browser is transmitted to the corresponding business system in the network to be accessed.

[0009] In some embodiments, based on the live data and identity data of the target user, as well as the account data of each business system, zero-trust access policy information for the target user to access each business system is generated, including: verifying whether the identity data of the target user is real identity data based on the live data of the target user; if the identity data of the target user is real identity data, comparing the identity data of the target user with the account data of each business system to determine whether the identity information of the target user exists in each business system; if the identity information of the target user exists in any business system, determining that the target user is allowed to access the business system; if the identity information of the target user does not exist in any business system, determining that the target user is not allowed to access the business system.

[0010] In some embodiments, after controlling the target user's access behavior to one or more business systems in the network to be accessed according to the zero-trust access policy information, the method further includes: collecting the target user's access behavior data to each business system; performing a multi-dimensional analysis on the collected access behavior data; and outputting early warning prompt information based on the multi-dimensional analysis results.

[0011] In some embodiments, the living body data is a user's facial image, and the identity data is a user's ID number.

[0012] According to another aspect of the present disclosure, a network access control system based on a zero-trust mechanism is also provided, including: a zero-trust dedicated browser, a zero-trust policy controller and a zero-trust gateway; wherein the zero-trust dedicated browser is used to collect the live data and identity data of the target user; the zero-trust policy controller communicates with the zero-trust dedicated browser and at least one business system in the network to be accessed respectively, and is used to obtain the live data and identity data of the target user collected by the zero-trust dedicated browser and the account data of each business system, and generates zero-trust access policy information for the target user to access each business system based on the live data and identity data of the target user and the account data of each business system; the zero-trust gateway communicates with the zero-trust policy controller, and is used to receive the zero-trust access policy information issued by the zero-trust policy controller, and control the target user's access behavior to one or more business systems in the network to be accessed based on the zero-trust access policy information.

[0013] According to another aspect of the present disclosure, a network access control device based on a zero-trust mechanism is also provided, including: a user data collection module, used to collect the live data and identity data of the target user; a system data acquisition module, used to obtain the account data of at least one business system in the network to be accessed; an access policy generation module, used to generate zero-trust access policy information for the target user to access each business system based on the live data and identity data of the target user, and the account data of each business system; an access control module, used to control the target user's access behavior to one or more business systems in the network to be accessed based on the zero-trust access policy information.

[0014] According to another aspect of the present disclosure, an electronic device is also provided, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned network access control methods based on the zero-trust mechanism by executing the executable instructions.

[0015] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the network access control method based on the zero-trust mechanism described above is implemented.

[0016] According to another aspect of the present disclosure, a computer program product is also provided, including a computer program, wherein when the computer program is executed by a processor, the network access control method based on the zero trust mechanism described above is implemented.

[0017] The network access control method, system and related equipment based on the zero-trust mechanism provided in the embodiments of the present disclosure collect the live data and identity data of the target user and obtain the account data of at least one business system in the network to be accessed, and then generate zero-trust access policy information for the target user to access each business system based on the live data and identity data of the target user and the account data of each business system. Finally, based on the zero-trust access policy information, the target user's access behavior to one or more business systems in the network to be accessed is controlled.

[0018] Through the embodiments of the present disclosure, zero-trust access policy information is generated based on the live data and identity data of the target user and the account data of each business system in the network to be accessed, which can achieve dynamic authorized access to each business system in the network and avoid access by illegal users, thereby ensuring the overall security of the network.

[0019] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0021] Figure 1 A schematic diagram of an application system architecture in an embodiment of the present disclosure is shown;

[0022] Figure 2 A flow chart of a network access control method based on a zero-trust mechanism in an embodiment of the present disclosure is shown;

[0023] Figure 3 A schematic diagram of a network access control system based on a zero-trust mechanism in an embodiment of the present disclosure is shown;

[0024] Figure 4 A schematic diagram showing a specific implementation of a network access control system based on a zero-trust mechanism in an embodiment of the present disclosure is shown;

[0025] Figure 5 A schematic diagram of a network access control device based on a zero-trust mechanism in an embodiment of the present disclosure is shown;

[0026] Figure 6 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown;

[0027] Figure 7 A schematic diagram of a computer-readable storage medium in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0028] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0029] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0030] For ease of understanding, before introducing the embodiments of the present disclosure, several terms involved in the embodiments of the present disclosure are first explained as follows:

[0031] The specific implementation of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0032] Figure 1 FIG. 1 shows an exemplary application system architecture diagram to which the network access control method based on the zero trust mechanism in the embodiment of the present disclosure can be applied. Figure 1 As shown, the system architecture includes: a terminal device 101 and at least one service system 102 located in a network to be visited.

[0033] In the embodiment of the present disclosure, the medium providing the communication link between the terminal device 101 and the service system may be a wired network or a wireless network.

[0034] Optionally, the wireless network or wired network described above uses standard communication technology and / or protocol. The network is usually the Internet, but it can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a dedicated network or any combination of a virtual private network). In some embodiments, technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. are used to represent data exchanged through the network. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPsec) can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0035] The terminal device 101 can be various electronic devices, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, smart speakers, smart watches, wearable devices, augmented reality devices, virtual reality devices, etc.

[0036] Optionally, the client of the application installed in different terminal devices 101 is the same, or the client of the same type of application based on different operating systems. Based on the different terminal platforms, the specific form of the client of the application can also be different, for example, the application client can be a mobile client, a PC client, etc.

[0037] The business system 102 may be a server that provides various business services. Optionally, the server may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The terminal and the server may be directly or indirectly connected via wired or wireless communications, which is not limited in the present disclosure.

[0038] Those skilled in the art will know that Figure 1 The number of terminal devices and business systems in the example is only illustrative, and any number of terminal devices, networks, and servers may be provided according to actual needs. This disclosure embodiment does not limit this.

[0039] Under the above system architecture, an embodiment of the present disclosure provides a network access control method based on a zero-trust mechanism, which can be executed by any electronic device with computing and processing capabilities.

[0040] In some embodiments, the network access control method based on the zero-trust mechanism provided in the embodiments of the present disclosure can be executed by a third-party device that communicates with the terminal device and the business system in the above-mentioned system architecture respectively.

[0041] Figure 2 A flow chart of a network access control method based on a zero-trust mechanism in an embodiment of the present disclosure is shown as follows: Figure 2 As shown, the network access control method based on the zero trust mechanism provided in the embodiment of the present disclosure includes the following steps:

[0042] S202, collecting the target user's living body data and identity data.

[0043] It should be noted that the target user may be any user who wants to access one or more business systems in the network to be accessed; the live data may be various biometric data that can uniquely identify the user's identity information, including but not limited to image data (e.g., facial image data), fingerprint data, iris data, etc. The identity data may be various data that reflect the user's identity, including but not limited to: ID card number, passport number, etc.

[0044] It should be noted that the acquisition, storage, use, and processing of data in the technical solution disclosed in this disclosure are in compliance with the relevant provisions of national laws and regulations, and various types of data such as personal identity data, operation data, behavioral data, etc. related to individuals, customers, and groups obtained in the embodiments of this disclosure have all been authorized.

[0045] In the embodiments of the present disclosure, each embodiment is described by taking the case where the living body data is a user's facial image and the identity data is a user's ID card number as an example.

[0046] In some embodiments, the above S202 may be to collect the target user's live data and identity data through a zero-trust dedicated browser. In the disclosed embodiment, the zero-trust dedicated browser may be a security browser specially developed for zero-trust access network control.

[0047] S204: Acquire account data of at least one business system in the network to be accessed.

[0048] It should be noted that the above-mentioned network to be accessed can be any network that requires security protection, for example, the internal networks of various enterprises. The above-mentioned network to be accessed includes one or more business systems. In order to ensure the security of the network to be accessed, it is necessary to ensure that each business system in the network to be accessed will not be accessed by illegal users. Since each business system in the network to be accessed contains account data of legitimate users (usually containing or associated with the identity data of the user), after collecting the identity data of the target user who is currently accessing the network to be accessed, the identity data of the target user can be matched with the identity data of each user in the account data to determine whether the target user is a legitimate user.

[0049] It should be noted that a legitimate user in the embodiments of the present disclosure refers to a user who is authorized to access the business system; an illegal user refers to a user who is not authorized to access the business system.

[0050] S206, generating zero-trust access policy information for the target user to access each business system based on the live data and identity data of the target user and the account data of each business system.

[0051] Since the user's live data is the most authentic data, after collecting the live data and identity data of the target user, the collected live data can be used to verify whether the user is the real person, that is, to verify whether the user's identity data is the real identity data. In specific implementation, it can be achieved by, but not limited to, connecting with a third-party user information system with authoritative authentication, so as to verify the live data of the target user according to the third-party user information system to determine whether the target user is the real person.

[0052] When the user is himself, it means that the identity data of the target user currently collected is the real identity data, which is then matched with the account data of each business system to determine whether the target user is a legitimate user based on whether the identity data of the target user is in each business system.

[0053] It should be noted that the zero-trust access policy information in the embodiments of the present disclosure may include but is not limited to control information on whether the user is allowed to access various business systems in the network to be accessed.

[0054] In some embodiments, the above S206 can be specifically implemented through the following steps: verify whether the identity data of the target user is real identity data based on the live data of the target user; when the identity data of the target user is real identity data, compare the identity data of the target user with the account data of each business system to determine whether the identity information of the target user exists in each business system; if the identity information of the target user exists in any business system, determine that the target user is allowed to access the business system; if the identity information of the target user does not exist in any business system, determine that the target user is not allowed to access the business system.

[0055] In the above embodiment, after verifying that the user's identity data is real identity data based on the user's live data, the user's identity data is compared with the account data of each business system to determine whether the identity information of the target user exists in each business system; if the identity information of the target user exists in a business system, the target user is determined to be a legal user and the target user is allowed to access the corresponding business system; if the identity information of the target user does not exist in a business system, the target user is determined to be an illegal user and the target user is not allowed to access the corresponding business system.

[0056] S208: Control the target user's access behavior to one or more business systems in the access network according to the zero-trust access policy information.

[0057] It should be noted that the zero-trust access policy information in the disclosed embodiment refers to policy information used to control whether the user's access request to one or more business systems in the access network is allowed to pass through the zero-trust gateway. Therefore, in the specific implementation, the zero-trust access policy information can be sent to the zero-trust gateway so that the zero-trust gateway can control the target user's access behavior to one or more business systems in the access network according to the zero-trust access policy information.

[0058] From the above, it can be seen that the network access control method based on the zero-trust mechanism provided in the embodiment of the present disclosure collects the live data and identity data of the target user, and obtains the account data of at least one business system in the network to be accessed, and then generates zero-trust access policy information for the target user to access each business system based on the live data and identity data of the target user and the account data of each business system. Finally, based on the zero-trust access policy information, the target user's access behavior to one or more business systems in the network to be accessed is controlled.

[0059] Through the network access control method based on the zero-trust mechanism provided in the embodiment of the present disclosure, zero-trust access policy information is generated according to the live data and identity data of the target user and the account data of each business system in the network to be accessed, which can realize dynamic authorized access to each business system in the network and avoid access by illegal users, thereby ensuring the overall security of the network.

[0060] In some embodiments, the above S208 can be specifically implemented through the following steps: establishing a trusted long connection tunnel between the zero-trust dedicated browser and one or more business systems in the network to be accessed that the target user is allowed to access; through the trusted long connection tunnel, the access request initiated by the target user through the zero-trust dedicated browser is transmitted to the corresponding business system in the network to be accessed. In this embodiment, by establishing a trusted long connection tunnel, it is possible to ensure that the access request initiated by the target user through the zero-trust dedicated browser is securely transmitted to the corresponding business system in the network to be accessed.

[0061] In some embodiments, after controlling the target user's access behavior to one or more business systems in the access network according to the zero-trust access policy information, the network access control method based on the zero-trust mechanism provided in the embodiments of the present disclosure may also include the following steps: collecting the target user's access behavior data to each business system; performing a multi-dimensional analysis on the collected access behavior data; and outputting early warning prompt information based on the multi-dimensional analysis results.

[0062] Through the above-mentioned embodiments, the access behavior data of users to various business systems in the access network are collected, and then the collected access behavior data are analyzed in multiple dimensions, and warning prompt information can be output according to the multi-dimensional analysis results.

[0063] Based on the same inventive concept, the present disclosure also provides a network access control system based on a zero-trust mechanism, as described in the following embodiments. Since the principle of solving the problem in the system embodiment is similar to that in the above method embodiment, the implementation of the system embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0064] Figure 3A schematic diagram of a network access control system based on a zero-trust mechanism in an embodiment of the present disclosure is shown. Figure 3 As shown, the system includes: a zero-trust dedicated browser 301, a zero-trust policy controller 302 and a zero-trust gateway 303.

[0065] Among them, the zero-trust dedicated browser 301 is used to collect the live data and identity data of the target user; the zero-trust policy controller 302 communicates with the zero-trust dedicated browser 301 and at least one business system in the network to be accessed respectively, and is used to obtain the live data and identity data of the target user collected by the zero-trust dedicated browser and the account data of each business system, and generate zero-trust access policy information for the target user to access each business system based on the live data and identity data of the target user and the account data of each business system; the zero-trust gateway 303 communicates with the zero-trust policy controller 302, and is used to receive the zero-trust access policy information issued by the zero-trust policy controller, and control the target user's access behavior to one or more business systems in the network to be accessed based on the zero-trust access policy information.

[0066] As can be seen from the above, the network access control system based on the zero trust mechanism provided in the embodiment of the present disclosure collects the live data and identity data of the target user through the zero trust dedicated browser 301, and sends it to the zero trust policy controller 302. After the zero trust policy controller 302 obtains the account data of at least one business system in the network to be accessed, it generates zero trust access policy information for the target user to access each business system based on the live data and identity data of the target user and the account data of each business system, and sends it to the zero trust gateway 303, so that the zero trust gateway 303 can control the target user's access behavior to one or more business systems in the network to be accessed according to the zero trust access policy information.

[0067] Through the network access control system based on the zero-trust mechanism provided in the embodiment of the present disclosure, zero-trust access policy information is generated according to the live data and identity data of the target user and the account data of each business system in the network to be accessed, so as to realize dynamic authorized access to each business system in the network and avoid access by illegal users, thereby ensuring the overall security of the network.

[0068] Figure 4 A schematic diagram of a specific implementation of a network access control system based on a zero-trust mechanism in an embodiment of the present disclosure is shown. Figure 4As shown, a face recognition function is built into the zero-trust dedicated browser to collect the user's facial image (i.e., living data) and ID number (i.e., identity information); the zero-trust gateway controls whether the user's access request to each business system in the network to be accessed is passed; the zero-trust policy controller determines whether the same ID number exists in the business system based on the comparison between the facial image and the ID number, dynamically authorizes access to the business system, and sends the zero-trust access policy information to the zero-trust gateway.

[0069] like Figure 4 As shown, the zero-trust policy controller collects user facial images and ID numbers from the zero-trust dedicated browser, and collects account data from the business system through interfaces, views, texts, etc. After checking both, it provides authorization information to the zero-trust gateway.

[0070] like Figure 4 As shown, the zero-trust gateway serves as a unified access point for the business system. Illegal users cannot see the business assets in the network without a zero-trust dedicated browser and a legal account. Each business system only trusts access requests from the zero-trust gateway. After a legal user logs in to the zero-trust dedicated browser and clicks on the permission to access resources, the zero-trust dedicated browser will automatically activate the person-document comparison check function. After collecting the live data and ID card data, it will be sent to the zero-trust policy controller. The zero-trust policy controller will compare the real person with the ID card and whether the target system has the same ID card account. After the comparison check is passed, the zero-trust policy controller will issue a policy to the zero-trust policy gateway to allow the zero-trust dedicated browser to use the zero-trust trusted tunnel to access the target system. The disclosed embodiment will transform the traditional static access control solution based on the firewall IP address into a dynamic access control solution based on the real person live business system account evaluation, which can achieve the purpose of real person real name trusted secure access to the business system and prevent "hackers" and other illegal users from attacking and infiltrating the business system.

[0071] It can be seen that the network access control system based on the zero-trust mechanism provided in the embodiment of the present disclosure identifies the real identity of the user by comparing the real person and the ID card, and then dynamically authorizes the user to access the internal system based on the comparison between the ID card and the business system account. It provides real-person and real-name secure access to the internal system of the enterprise, ensures that "hackers" cannot access the internal system, and protects the objective loopholes and weak passwords of the internal business systems from being exploited, thereby ensuring the overall network security.

[0072] Compared with the firewall IP address static access control solution provided in the related art, the embodiments of the present disclosure can achieve but are not limited to the following technical effects:

[0073] ① The disclosed embodiment deeply integrates person-document matching, person-account matching and zero-trust environment perception architecture, and provides real-name, trusted and secure access to business systems, which can quickly and effectively prevent illegal users from attacking and infiltrating business systems.

[0074] ② In the related art, the firewall solution of statically accessing the business system based on the IP address cannot prevent hackers and other illegal users from infiltrating and accessing the business system, and the IP address needs to be configured in advance. The network access control solution provided in the embodiment of the present disclosure is dynamic control, which can realize in-process control and has the advantage of real-time control.

[0075] ③ In the related technologies, the firewall solution of statically accessing the business system based on IP addresses requires a large number of operation and maintenance personnel to configure massive control rules. This method is a control model that automatically collects data to drive the generation of control strategies. In principle, there is "zero" control list and "zero" operation and maintenance personnel, which greatly reduces the manpower cost of operation and maintenance. With fine and precise control, the business system is only open to users who have undergone live inspection and have real permissions, eliminating unnecessary exposure to resist various new types of network attack risks, and effectively ensuring safe and reliable access to the business system.

[0076] In specific implementation, the network access control solution based on the zero trust mechanism provided in the embodiment of the present disclosure may include the following process:

[0077] 1) Establish a static user ledger: Establish a user real-name identity view, sort out business halls, OA offices, and third-party personnel, and establish a static user ledger.

[0078] 2) Unified identity authentication between users and devices: Users log in uniformly through a secure browser, which obtains device-specific information such as IP, MAC, operating system, CPU, memory, etc. of the user's login terminal device, as well as user account, password, SMS verification code, and dynamic password OTP. A unique verification code is generated through hash operation, and the information and verification code are sent to the controller together using UDP packets for identity authentication. This strengthens the authentication strength and ensures that the subject's identity is credible.

[0079] 3) Build an intelligent centralized controller: After passing the security authentication of the controller, the zero-trust dedicated browser will establish a long connection tunnel with the back-end resources. The back-end collects information such as client and gateway dynamic configuration and policies, realizes dynamic access policy configuration and distribution based on user and device identities, and realizes the separation of the network control plane and the forwarding plane.

[0080] 4) Establish dynamic resource ledger and authorized access: Centralized policy scheduling is performed through the zero-trust controller, dynamic resource scheduling is performed based on user roles and identities, account information of each 4A system and each business system is collected, and each business system is dynamically associated with the real-person ID information collected by the zero-trust dedicated browser. A dynamic resource ledger accessible to logged-in users is established to collect access behavior information such as user access time, source IP and port, and connection protocol, and perform multi-dimensional analysis and early warning to realize the "security brain" function of network control. Through "personal identification and person account perception", the control policy of allowing or prohibiting secure access is dynamically adjusted to achieve fast and secure access to intranet resources in the client through the secure browser portal.

[0081] Based on the same inventive concept, the present disclosure also provides a network access control device based on a zero-trust mechanism, as described in the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0082] Figure 5 A schematic diagram of a network access control device based on a zero-trust mechanism in an embodiment of the present disclosure is shown. Figure 5 As shown, the device includes: a user data collection module 501, a system data acquisition module 502, an access policy generation module 503 and an access control module 504.

[0083] Among them, the user data collection module 501 is used to collect the live data and identity data of the target user; the system data acquisition module 502 is used to obtain the account data of at least one business system in the network to be accessed; the access policy generation module 503 is used to generate zero-trust access policy information for the target user to access each business system based on the live data and identity data of the target user and the account data of each business system; the access control module 504 is used to control the target user's access behavior to one or more business systems in the network to be accessed based on the zero-trust access policy information.

[0084] As can be seen from the above, the network access control device based on the zero-trust mechanism provided in the embodiment of the present disclosure collects the live data and identity data of the target user through the user data collection module 501, and obtains the account data of at least one business system in the network to be accessed through the system data acquisition module 502, and then generates zero-trust access policy information for the target user to access each business system based on the live data and identity data of the target user and the account data of each business system through the access policy generation module 503, and finally controls the target user's access behavior to one or more business systems in the network to be accessed according to the zero-trust access policy information through the access control module 504.

[0085] Through the network access control device based on the zero-trust mechanism provided in the embodiment of the present disclosure, zero-trust access policy information is generated according to the live data and identity data of the target user and the account data of each business system in the network to be accessed, so as to realize dynamic authorized access to each business system in the network and avoid access by illegal users, thereby ensuring the overall security of the network.

[0086] In some embodiments, the user data collection module 501 is also used to collect live data and identity data of the target user through a zero-trust dedicated browser.

[0087] In some embodiments, the above-mentioned access control module 504 is also used to: establish a trusted long connection tunnel between the zero-trust dedicated browser and one or more business systems in the network to be accessed that the target user is allowed to access; through the trusted long connection tunnel, the access request initiated by the target user through the zero-trust dedicated browser is transmitted to the corresponding business system in the network to be accessed.

[0088] In some embodiments, the access policy generation module 503 is also used to: verify whether the target user's identity data is real identity data based on the target user's live data; if the target user's identity data is real identity data, compare the target user's identity data with the account data of each business system to determine whether the target user's identity information exists in each business system; if the target user's identity information exists in any business system, determine that the target user is allowed to access the business system; if the target user's identity information does not exist in any business system, determine that the target user is not allowed to access the business system.

[0089] In some embodiments, the network access control device based on the zero trust mechanism provided in the embodiments of the present disclosure may also include: a data analysis module 505, which is used to collect the access behavior data of the target user to each business system; perform multi-dimensional analysis on the collected access behavior data; and output early warning prompt information based on the multi-dimensional analysis results.

[0090] In some embodiments, in the network access control device based on the zero-trust mechanism provided in the embodiments of the present disclosure, the living data is the user's facial image, and the identity data is the user's ID number.

[0091] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above method embodiments. It should be noted that the above modules as part of the device can be executed in a computer system such as a set of computer executable instructions.

[0092] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0093] Refer to the following Figure 6 The electronic device 600 according to this embodiment of the present disclosure is described. Figure 6 The electronic device 600 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0094] like Figure 6 As shown, the electronic device 600 is in the form of a general computing device. The components of the electronic device 600 may include but are not limited to: at least one processing unit 610, at least one storage unit 620, and a bus 630 connecting different system components (including the storage unit 620 and the processing unit 610).

[0095] Among them, the storage unit stores a program code, and the program code can be executed by the processing unit 610, so that the processing unit 610 executes the steps described in the above "Exemplary Method" section of this specification according to various exemplary embodiments of the present disclosure. For example, the processing unit 610 can execute the following steps of the above method embodiment: collect the live data and identity data of the target user; obtain the account data of at least one business system in the network to be accessed; based on the live data and identity data of the target user, and the account data of each business system, generate zero-trust access policy information for the target user to access each business system; based on the zero-trust access policy information, control the target user's access behavior to one or more business systems in the network to be accessed.

[0096] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache memory unit 6202 , and may further include a read-only memory unit (ROM) 6203 .

[0097] The storage unit 620 may also include a program / utility 6204 having a set (at least one) of program modules 6205, such program modules 6205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0098] Bus 630 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0099] The electronic device 600 may also communicate with one or more external devices 640 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 600, and / or communicate with any device that enables the electronic device 600 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 650. Furthermore, the electronic device 600 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 660. As shown, the network adapter 660 communicates with other modules of the electronic device 600 via a bus 630. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0100] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0101] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart may be implemented as a computer program product, which includes: a computer program, which implements the above XXX method when executed by a processor.

[0102] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is further provided, which may be a readable signal medium or a readable storage medium. Figure 7 A schematic diagram of a computer-readable storage medium in an embodiment of the present disclosure is shown. Figure 7As shown, a program product capable of implementing the above method of the present disclosure is stored on the computer-readable storage medium 700. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary implementations of the present disclosure described in the above “Exemplary Method” section of this specification.

[0103] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0104] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0105] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0106] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0107] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0108] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0109] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0110] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A network access control method based on zero trust mechanism, characterized in that: include: Collect the target user's live data and identity data through a zero-trust dedicated browser; Obtain account data of at least one business system in the network to be accessed; Generate zero-trust access policy information for the target user to access each business system based on the live data and identity data of the target user and the account data of each business system; According to the zero-trust access policy information, control the target user's access behavior to one or more business systems in the network to be accessed; Among them, based on the live data and identity data of the target user, and the account data of each business system, zero-trust access policy information for the target user to access each business system is generated, including: based on the live data of the target user, verifying whether the identity data of the target user is real identity data; if the identity data of the target user is real identity data, comparing the identity data of the target user with the account data of each business system to determine whether the identity information of the target user exists in each business system; if the identity information of the target user exists in any business system, determining that the target user is allowed to access the business system; if the identity information of the target user does not exist in any business system, determining that the target user is not allowed to access the business system; Among them, according to the zero-trust access policy information, the target user's access behavior to one or more business systems in the network to be accessed is controlled, including: establishing a trusted long connection tunnel between the zero-trust dedicated browser and one or more business systems in the network to be accessed that the target user is allowed to access; through the trusted long connection tunnel, the access request initiated by the target user through the zero-trust dedicated browser is transmitted to the corresponding business system in the network to be accessed.

2. The network access control method based on zero trust mechanism according to claim 1 is characterized in that: After controlling the target user's access behavior to one or more business systems in the network to be accessed according to the zero-trust access policy information, the method further includes: Collecting the target user's access behavior data to various business systems; Conduct multi-dimensional analysis on the collected access behavior data; According to the multi-dimensional analysis results, early warning information is output.

3. The network access control method based on zero trust mechanism according to claim 1 or 2, characterized in that: The living body data is a user's facial image, and the identity data is a user's ID card number.

4. A network access control system based on a zero-trust mechanism, characterized in that: include: Zero Trust dedicated browser, Zero Trust policy controller and Zero Trust gateway; Wherein, the zero-trust dedicated browser is used to collect the live data and identity data of the target user; The zero-trust policy controller communicates with the zero-trust dedicated browser and at least one business system in the to-be-accessed network, respectively, to obtain the live data and identity data of the target user collected by the zero-trust dedicated browser and the account data of each business system, and generates zero-trust access policy information for the target user to access each business system based on the live data and identity data of the target user and the account data of each business system; The zero trust gateway communicates with the zero trust policy controller to receive the zero trust access policy information issued by the zero trust policy controller, and controls the target user's access to one or more business systems in the network to be accessed according to the zero trust access policy information; Wherein, the zero-trust policy controller is also used to: verify whether the identity data of the target user is real identity data according to the live data of the target user; if the identity data of the target user is real identity data, compare the identity data of the target user with the account data of each business system to determine whether the identity information of the target user exists in each business system; if the identity information of the target user exists in any business system, determine that the target user is allowed to access the business system; if the identity information of the target user does not exist in any business system, determine that the target user is not allowed to access the business system; Among them, the zero-trust gateway is also used to: establish a trusted long connection tunnel between the zero-trust dedicated browser and one or more business systems in the network to be visited that the target user is allowed to access; through the trusted long connection tunnel, the access request initiated by the target user through the zero-trust dedicated browser is transmitted to the corresponding business system in the network to be visited.

5. A network access control device based on a zero-trust mechanism, characterized in that: include: The user data collection module is used to collect the target user's live data and identity data through a zero-trust dedicated browser; A system data acquisition module, used to acquire account data of at least one business system in the network to be accessed; An access policy generation module, used to generate zero-trust access policy information for the target user to access each business system based on the live data and identity data of the target user and the account data of each business system; An access control module, used to control the target user's access behavior to one or more business systems in the network to be accessed according to the zero-trust access policy information; The access policy generation module is further used to: verify whether the identity data of the target user is real identity data according to the live data of the target user; if the identity data of the target user is real identity data, compare the identity data of the target user with the account data of each business system to determine whether the identity information of the target user exists in each business system; if the identity information of the target user exists in any business system, determine that the target user is allowed to access the business system; if the identity information of the target user does not exist in any business system, determine that the target user is not allowed to access the business system; Among them, the access control module is also used to: establish a trusted long connection tunnel between the zero-trust dedicated browser and one or more business systems in the network to be visited that the target user is allowed to access; through the trusted long connection tunnel, the access request initiated by the target user through the zero-trust dedicated browser is transmitted to the corresponding business system in the network to be visited.

6. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the network access control method based on the zero trust mechanism as described in any one of claims 1 to 3 by executing the executable instructions.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network access control method based on the zero trust mechanism described in any one of claims 1 to 3 is implemented.

Images