An enhanced identity authentication and resource access control system

Abstract

The application provides an enhanced identity authentication and resource access control system, comprising a client terminal identity recognition module, an environment security detection module, an asset network stealth module, an access proxy module, a comprehensive management module, and a continuous trust evaluation module based on identity, environment and behavior. The application takes identity as the authentication subject, digitizes identity, continuously evaluates trust, dynamically adjusts access strategy, and hides assets and data information. The application realizes micro-isolation of the terminal and the application access environment through a terminal container, and realizes lightweight graphical auditing. A software-defined boundary model based on zero trust is used to establish an application-level access link, realize business security access, and enable users to access only resources within the minimum permission. Through linkage of the trustworthiness calculation module and the strategy module, dynamic strategy distribution is realized, and the gateway performs secondary authentication or blocking on abnormal access behavior of resources according to strategy information, which plays an important role in ensuring secure access of user resources.

Description

Technical Field

[0001] This application relates to the field of network information security technology, and in particular to an enhanced identity authentication and resource access control system. Background Technology

[0002] With the development of information technology, information has become a crucial asset for organizations. The protection of information assets is receiving increasing attention, especially today with the rapid development of network technology. Most organizations conduct data exchanges and other operations through networks, making information a network resource. While improving work efficiency, this also exposes organizations to the risk of unauthorized access and use of information. Therefore, implementing network resource access control has become an urgent need.

[0003] Currently, the main network access control methods are based on policy configurations of devices such as routers, switches, and firewalls, which can achieve the purpose and function of access control to a certain extent. However, these access control methods are usually host-based, implementing access control through characteristics such as host addresses. Although some technologies now take into account the identity of the resource access initiator, they often only use simple fingerprint, facial, or voice authentication, which is easily deceived by fingerprint spoofing, recorded voice, or mask technology, resulting in the loss of information or property. Summary of the Invention

[0004] In view of this, the purpose of this application is to propose an enhanced identity authentication and resource access control system, which can specifically solve the existing problems.

[0005] To achieve the above objectives, this application also proposes an enhanced identity authentication and resource access control system, comprising:

[0006] The client terminal identity recognition module acquires the physical environment information and network environment information perception results of the client terminal, performs multi-factor authentication, authorizes the execution of permissions according to the authentication results, and performs user operation auditing.

[0007] The environmental security detection module uses SSL tunnels and trust anchors to perform environmental security detection based on the results of physical environment information perception and network environment information perception.

[0008] The asset network stealth module uses a container within the client terminal to perform micro-isolation between the client terminal and the application access environment, and performs lightweight graphical auditing, dynamically adjusts access strategies, and hides asset and data information.

[0009] The access proxy module uses a zero-trust-based software-defined boundary model to establish application-level access links, enabling secure business access so that users of the client terminal can only access resources within the minimum permissions.

[0010] The comprehensive management module manages personnel accounts, terminals, resources, and permission information based on a risk model analysis library.

[0011] The continuous trust assessment module based on identity, environment, and behavior, through trust calculation and linkage with the asset network stealth module, enables dynamic policy distribution and performs secondary authentication or blocking of abnormal access to resources based on policy information.

[0012] Furthermore, the customer terminal identity recognition module includes the following steps:

[0013] The system acquires user input information from the client terminal, obtains images of the surrounding physical environment of the client terminal through a camera, and acquires network environment information of the client terminal; wherein, the network environment information includes WIFI router address, IP address or telephone network address;

[0014] The user's identity is authenticated based on whether the user input information meets the preset input conditions, whether the surrounding physical environment image matches the pre-stored image, and whether the network environment information matches the pre-stored network environment information database.

[0015] Based on the identity authentication result, the corresponding policy execution permissions are authorized, and the user is prompted to perform an operation audit.

[0016] Furthermore, the environmental safety detection module includes the following steps:

[0017] Based on the policy execution permissions, the network environment information is converted into a trust token;

[0018] The location data of the client terminal is determined based on the image of the surrounding physical environment, and an SSL tunnel is opened using a first certificate associated with the location data;

[0019] Encrypt a data packet containing the location data based on the user input information, and authenticate a trust token associated with the request when a request to transmit the data packet is received;

[0020] Upon receiving a security detection text message and verifying the trust token associated with the security detection text message, the trust anchor is advanced or the first certificate is iterated to complete the environmental security detection.

[0021] Furthermore, the asset network stealth module includes the following steps:

[0022] The container within the client terminal is allocated based on the user input information, and the container is used to micro-isolate the client terminal from the application access environment;

[0023] According to the policy, the client terminal's service request is forwarded to the DNS server, and the identifier returned by the DNS server is received.

[0024] Based on the preset mapping relationship between the container and the identifier, perform graphical auditing;

[0025] Based on the results of the graphical audit, adjust the policy execution permissions.

[0026] Furthermore, the access proxy module includes the following steps:

[0027] Change all synchronous execution protocols of the software-defined boundary to asynchronous execution protocols, and only allow the client terminal to send UDP packets to the zero-trust security control unit through the zero-trust security proxy component;

[0028] The zero-trust security control unit sends response information to the client terminal, and the client terminal executes subsequent processes based on the response results, thus completing the communication work that replaces the TCP protocol.

[0029] The Zero Trust Security Proxy component acts as a communication proxy, forwarding the TCP protocol to the Zero Trust Security Control Unit to establish application-level access links.

[0030] Furthermore, the access proxy module includes the following steps:

[0031] Step 1: The SDP controller determines a list of accepting hosts that can be authorized to communicate with the client terminal. Step 2: The SDP controller notifies the accepting hosts to accept communication from the client terminal and all optional security policies required for encrypted communication. Step 3: The SDP controller sends the list of accepting hosts and optional security policies to the client terminal. Step 4: The client terminal initiates a single-packet authorization to each accepting host and establishes a bidirectional TLS connection with that accepting host.

[0032] Furthermore, the omnidirectional pipe module includes the following steps:

[0033] The security risk assessment model corresponding to the trust token is retrieved from the preset risk model analysis library. The data packet is then subjected to online diagnosis and dynamic analysis using the security risk assessment model to generate a visual risk assessment report. The security risk assessment model includes one or more of the following: personnel account analysis tools, terminal analysis tools, resource analysis models, and permission risk assessment models, which are generated in advance based on experience data.

[0034] Furthermore, the continuous trust assessment module includes the following steps:

[0035] The credibility of the identification results of the client terminal identity recognition module is calculated to determine the first abnormal access behavior to the resource;

[0036] The reliability of the detection results from the environmental safety detection module is calculated to determine the second abnormal access behavior to the resource;

[0037] The credibility of the access links of the access proxy module is calculated to identify third-party abnormal access behaviors to the resources.

[0038] The credibility of the risk assessment results of the comprehensive management module is calculated to determine the fourth abnormal access behavior to resources;

[0039] Based on the adjusted policy execution permissions of the asset network stealth module, secondary authentication or blocking is performed on the abnormal access behavior of the resources.

[0040] In summary, the advantages of this application and the user experience it brings are as follows:

[0041] 1. Advanced technical architecture: Based on zero-trust technical architecture and optimized business access process, with underlying hardening processing to ensure system security and eliminate inherent vulnerability risks;

[0042] 2. Comprehensive environment compatibility: It has a wide range of supported types, including various mainstream protocols, and supports various operating systems, network devices, databases, and middleware, fully covering all business operation scenarios;

[0043] 3. Excellent user experience: Supports all mainstream browsers and operating systems, provides multiple login methods, C / S menu and direct connection mode, supports local calls from various clients, and minimizes changes to user habits;

[0044] 4. Strong market presence: A robust risk model analysis library provides users with mature, stable, and user-friendly products. Attached Figure Description

[0045] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the various drawings denote the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings depict only some embodiments disclosed in this application and should not be construed as limiting the scope of this application.

[0046] Figure 1 This diagram illustrates the configuration of an enhanced identity authentication and resource access control system according to an embodiment of this application.

[0047] Figure 2 A flowchart of a client terminal identity recognition module according to an embodiment of this application is shown.

[0048] Figure 3A flowchart of an environmental safety detection module according to an embodiment of this application is shown.

[0049] Figure 4 A flowchart of an asset network stealth module according to an embodiment of this application is shown.

[0050] Figure 5 A flowchart of an access proxy module according to an embodiment of this application is shown.

[0051] Figure 6 A flowchart of the continuous trust assessment module according to an embodiment of this application is shown.

[0052] Figure 7 A schematic diagram of the structure of an electronic device provided in one embodiment of this application is shown.

[0053] Figure 8 A schematic diagram of a storage medium provided in one embodiment of this application is shown. Detailed Implementation

[0054] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the invention. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0055] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0056] like Figure 1 As shown, this application provides an enhanced identity authentication and resource access control system. It uses identity as the authentication subject, digitizes identity, continuously assesses trust levels, dynamically adjusts access policies, and hides asset and data information. It achieves micro-isolation between the terminal and application access environment through a terminal container and implements lightweight graphical auditing. It uses a zero-trust software-defined perimeter (SDP) model to replace the traditional VPN network tunnel method, establishing application-level access links to achieve secure business access. Users can only access resources within their minimum permissions. Through the linkage between trust calculation and the policy module, it achieves dynamic policy distribution, and performs secondary authentication or blocking of abnormal access behavior based on policy information, playing a crucial role in ensuring secure user access to resources.

[0057] The application embodiment provides an enhanced identity authentication and resource access control system, which includes:

[0058] The client terminal identity recognition module acquires the physical environment information and network environment information perception results of the client terminal, performs multi-factor authentication, authorizes the execution of permissions according to the authentication results, and performs user operation auditing.

[0059] The environmental security detection module uses SSL tunnels and trust anchors to perform environmental security detection based on the results of physical environment information perception and network environment information perception.

[0060] The asset network stealth module uses a container within the client terminal to perform micro-isolation between the client terminal and the application access environment, and performs lightweight graphical auditing, dynamically adjusts access strategies, and hides asset and data information.

[0061] The access proxy module uses a zero-trust-based software-defined boundary model to establish application-level access links, enabling secure business access so that users of the client terminal can only access resources within the minimum permissions.

[0062] The comprehensive management module manages personnel accounts, terminals, resources, and permission information based on a risk model analysis library.

[0063] The continuous trust assessment module based on identity, environment, and behavior, through trust calculation and linkage with the asset network stealth module, enables dynamic policy distribution and performs secondary authentication or blocking of abnormal access to resources based on policy information.

[0064] Customer terminal identity recognition module, such as Figure 2 As shown, it includes the following steps:

[0065] S1. Obtain user input information from the client terminal, acquire images of the surrounding physical environment of the client terminal through a camera, and obtain network environment information of the client terminal; wherein, the network environment information includes WIFI router address, IP address or telephone network address;

[0066] S2. Based on whether the user input information meets the preset input conditions, whether the surrounding physical environment image matches the pre-stored image, and whether the network environment information matches the pre-stored network environment information database, authenticate the current user's identity.

[0067] S3. Authorize the corresponding policy execution permissions based on the identity authentication result and prompt the user to conduct an operation audit. For example, if the user's identity authentication result is an advanced user, and it is predicted that the user may perform operations such as data deletion or asset transfer that can only be performed by advanced users, then the user's operation can be audited again, and only those who pass the audit can be confirmed as legitimate users.

[0068] Environmental safety detection module, such as Figure 3 As shown, it includes the following steps:

[0069] S21. Based on the policy execution permissions, convert the network environment information into a trust token;

[0070] S22. Determine the location data of the client terminal based on the surrounding physical environment image, and open an SSL (Secure Sockets Layer) tunnel using a first certificate associated with the location data;

[0071] S23. Encrypt a data packet including the location data according to the user input information, and when a request to transmit the data packet is received, authenticate a trust token associated with the request;

[0072] S24. After receiving the security detection text message and verifying the trust token associated with the security detection text message, advance the trust anchor or iterate the first certificate to complete the environmental security detection.

[0073] Asset network stealth modules, such as Figure 4 As shown, it includes the following steps:

[0074] S31. Allocate a container within the client terminal using the user input information, wherein the container is used to micro-isolate the client terminal from the application access environment;

[0075] S32. Based on the policy execution permissions, forward the client terminal's service request to the DNS server and receive the identifier returned by the DNS server;

[0076] S33. Perform graphic auditing based on the preset mapping relationship between the container and the identifier;

[0077] S34. Adjust the policy execution permissions based on the results of the graphical audit.

[0078] Access the proxy module, such as Figure 5 As shown, it includes the following steps:

[0079] S41: Change all synchronous execution protocols of the software-defined boundary to asynchronous execution protocols, and only allow the client terminal to send UDP packets to the zero-trust security control unit through the zero-trust security proxy component;

[0080] S42: The Zero Trust Security Control Unit sends the response information to the client terminal, and the client terminal executes subsequent processes based on the response result, thus completing the communication work that replaces the TCP protocol.

[0081] S43: The Zero Trust Security Proxy Component acts as a communication proxy, forwarding the TCP protocol to the Zero Trust Security Control Unit to establish an application-level access connection.

[0082] Alternatively, access the proxy module, including the following steps:

[0083] Step 1: The SDP controller determines a list of accepting hosts that can be authorized to communicate with the client terminal. Step 2: The SDP controller notifies the accepting hosts to accept communication from the client terminal and all optional security policies required for encrypted communication. Step 3: The SDP controller sends the list of accepting hosts and optional security policies to the client terminal. Step 4: The client terminal initiates a single-packet authorization to each accepting host and establishes a bidirectional TLS connection with that accepting host.

[0084] The comprehensive management module includes the following steps:

[0085] The security risk assessment model corresponding to the trust token is retrieved from the preset risk model analysis library. The data packet is then subjected to online diagnosis and dynamic analysis using the security risk assessment model to generate a visual risk assessment report. The security risk assessment model includes one or more of the following: personnel account analysis tools, terminal analysis tools, resource analysis models, and permission risk assessment models, which are generated in advance based on experience data.

[0086] A continuous trust assessment module based on identity, environment, and behavior, such as... Figure 6 As shown, it includes the following steps:

[0087] S51. Calculate the credibility of the identification result of the client terminal identity recognition module to determine the first abnormal access behavior to the resource, including: establishing a credibility calculation model and identification tag based on the labeled content of the identification result; generating the account credibility of the identity recognition result; and determining the first abnormal access behavior to the resource based on the credibility and the access frequency of the account.

[0088] S52. Calculate the credibility of the detection results from the environmental safety detection module to determine the second abnormal access behavior to the resource, including: using the anomaly of the trust token as evidence in the naive credibility model and calculating the credibility of the evidence; creating knowledge in the naive credibility model based on the trust token and calculating the credibility of the knowledge; substituting the credibility of the evidence and the credibility of the knowledge into the credibility calculation formula of the naive credibility model to calculate the credibility of the conclusion event of whether there is an abnormal resource access behavior.

[0089] S53. Perform credibility calculation on the access link of the access proxy module to determine the third abnormal access behavior to the resource, including: determining whether the access link is a suspicious hidden link; if not, obtaining the hidden website corresponding to the access link based on the access link, and obtaining the hidden website content of the hidden website; analyzing the hidden website content to obtain the analysis result; calculating the credibility evaluation value of the access link according to the preset credibility value calculation rules and the analysis result; comparing the credibility evaluation value with the preset credibility threshold; if the credibility evaluation value is less than the credibility threshold, then determining the third abnormal access behavior to the resource.

[0090] S54. Calculate the credibility of the risk assessment results of the comprehensive management module to determine the fourth abnormal access behavior to the resource, including: obtaining the user credibility and telephone credibility corresponding to the risk assessment results based on the pre-established user credit database and telephone credit database; calculating the overall credibility of the risk assessment results based on the user credibility and telephone credibility, wherein the overall credibility is used to map the credibility of the risk assessment results.

[0091] S55. Based on the adjusted policy execution permissions of the asset network stealth module, perform secondary authentication or block the abnormal access behavior of the resource.

[0092] This application also provides an electronic device corresponding to the enhanced identity authentication and resource access control system provided in the foregoing embodiments, to execute the enhanced identity authentication and resource access control system. This application does not limit the scope of the embodiments.

[0093] Please refer to Figure 7 This illustrates a schematic diagram of an electronic device provided by some embodiments of this application. For example... Figure 7 As shown, the electronic device 20 includes: a processor 200, a memory 201, a bus 202, and a communication interface 203. The processor 200, the communication interface 203, and the memory 201 are connected via the bus 202. The memory 201 stores a computer program that can run on the processor 200. When the processor 200 runs the computer program, it executes the enhanced identity authentication and resource access control system provided in any of the foregoing embodiments of this application.

[0094] The memory 201 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 203 (which can be wired or wireless), such as the Internet, wide area network, local area network, or metropolitan area network.

[0095] Bus 202 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 201 is used to store programs. After receiving an execution instruction, the processor 200 executes the program. The enhanced identity authentication and resource access control system disclosed in any of the foregoing embodiments of this application can be applied to the processor 200, or implemented by the processor 200.

[0096] The processor 200 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 200 or by instructions in software form. The processor 200 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 201. The processor 200 reads the information in memory 201 and, in conjunction with its hardware, completes the steps of the above method.

[0097] The electronic device provided in this application embodiment and the enhanced identity authentication and resource access control system provided in this application embodiment are based on the same inventive concept and have the same beneficial effects as the methods they adopt, operate or implement.

[0098] This application also provides a computer-readable storage medium corresponding to the enhanced identity authentication and resource access control system provided in the foregoing embodiments. Please refer to... Figure 8 The computer-readable storage medium shown is an optical disc 30, on which a computer program (i.e., a program product) is stored. When the computer program is run by a processor, it executes the enhanced authentication and resource access control system provided in any of the foregoing embodiments.

[0099] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical and magnetic storage media, which will not be elaborated here.

[0100] The computer-readable storage medium provided in the above embodiments of this application and the enhanced identity authentication and resource access control system provided in the embodiments of this application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0101] It should be noted that:

[0102] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, this application is not directed to any particular programming language. It should be understood that the content of this application described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of this application.

[0103] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of this application may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0104] Similarly, it should be understood that, in order to simplify this application and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of this application, various features of this application are sometimes grouped together into a single embodiment, figure, or description thereof. However, this method of disclosure should not be construed as reflecting an intention that the claimed application requires more features than are expressly recited in each claim. Rather, as reflected in the following claims, inventive aspects lie in fewer than all features of a single foregoing disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of this application.

[0105] Those skilled in the art will understand that modules in the device of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiments can be combined into a single module, unit, or component, and further, they can be divided into multiple sub-modules, sub-units, or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination can be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or device so disclosed. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0106] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features but not others included in other embodiments, combinations of features from different embodiments are intended to be within the scope of this application and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.

[0107] The various component embodiments of this application can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the virtual machine creation system according to the embodiments of this application. This application can also be implemented as a device or system program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such an implementation of this application can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0108] It should be noted that the above embodiments are illustrative of this application and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. This application can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several systems, several of these systems may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0109] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in this application, and these should all be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An enhanced identity authentication and resource access control system, characterized in that, include: The client terminal identity recognition module acquires the physical environment information and network environment information perception results of the client terminal, performs multi-factor authentication, authorizes the execution of permissions according to the authentication results, and performs user operation auditing. The environmental security detection module uses SSL tunnels and trust anchors to perform environmental security detection based on the results of physical environment information perception and network environment information perception. The asset network stealth module uses a container within the client terminal to perform micro-isolation between the client terminal and the application access environment, and performs lightweight graphical auditing, dynamically adjusts access strategies, and hides asset and data information. The access proxy module uses a zero-trust-based software-defined boundary model to establish application-level access links, enabling secure business access so that users of the client terminal can only access resources within the minimum permissions. The comprehensive management module manages personnel accounts, terminals, resources, and permission information based on a risk model analysis library. The continuous trust assessment module based on identity, environment, and behavior, through trust calculation and linkage with the asset network stealth module, enables dynamic policy distribution and performs secondary authentication or blocking of abnormal access to resources based on policy information. The asset network stealth module allocates a container within the client terminal based on user input information. The container is used to micro-isolate the client terminal from the application access environment. The system forwards the client terminal's service request to the DNS server according to the policy execution permission and receives the identifier returned by the DNS server; it performs graphical auditing based on the preset mapping relationship between the container and the identifier; and it adjusts the policy execution permission based on the result of the graphical auditing.

2. The system according to claim 1, characterized in that, The client terminal identity recognition module includes the following steps: The system acquires user input information from the client terminal, obtains images of the surrounding physical environment of the client terminal through a camera, and acquires network environment information of the client terminal; wherein, the network environment information includes WIFI router address, IP address or telephone network address; The user's identity is authenticated based on whether the user input information meets the preset input conditions, whether the surrounding physical environment image matches the pre-stored image, and whether the network environment information matches the pre-stored network environment information database. Based on the identity authentication result, the corresponding policy execution permissions are authorized, and the user is prompted to perform an operation audit.

3. The system according to claim 2, characterized in that, The environmental safety detection module includes the following steps: Based on the policy execution permissions, the network environment information is converted into a trust token; The location data of the client terminal is determined based on the image of the surrounding physical environment, and an SSL tunnel is opened using a first certificate associated with the location data; Encrypt a data packet containing the location data based on the user input information, and authenticate a trust token associated with the request when a request to transmit the data packet is received; Upon receiving a security detection text message and verifying the trust token associated with the security detection text message, the trust anchor is advanced or the first certificate is iterated to complete the environmental security detection.

4. The system according to claim 1, characterized in that, The access proxy module includes the following steps: Change all synchronous execution protocols of the software-defined boundary to asynchronous execution protocols, and only allow the client terminal to forward UDP to the zero-trust security control unit through the zero-trust security proxy component; The zero-trust security control unit sends the response information to the client terminal, and the client terminal executes the subsequent preset communication process according to the response result, and so on to complete the communication work that replaces the TCP protocol; The Zero Trust Security Proxy component acts as a communication proxy, forwarding the TCP protocol to the Zero Trust Security Control Unit to establish application-level access links.

5. The system according to claim 1, characterized in that, The access proxy module includes the following steps: Step 1: Determine the list of accepting hosts that can be authorized to communicate with the client terminal through the SDP controller; Step 2: Inform the accepting hosts through the SDP controller to accept communication from the client terminal and all optional security policies required for encrypted communication; Step 3: Send the list of accepting hosts and optional security policies that can be accepted for connection to the client terminal through the SDP controller. Step 4: Initiate a single-packet authorization to each accepting host that can accept the connection through the client terminal, and establish a two-way TLS connection with the accepting host.

6. The system according to claim 3, 4, or 5, characterized in that, The omnidirectional pipe module includes the following steps: The system retrieves the security risk assessment model corresponding to the trust token from the preset risk model analysis library. Through the security risk assessment model, it performs online diagnosis and dynamic analysis on the data packet and generates a visualized risk assessment report. The security risk assessment model includes one or more of the following: personnel account analysis tools, terminal analysis tools, resource analysis models, and permission risk assessment models, which are generated in advance based on experience data.

7. The system according to claim 6, characterized in that, The continuous trust assessment module includes the following steps: The credibility of the identification results of the client terminal identity recognition module is calculated to determine the first abnormal access behavior to the resource; The reliability of the detection results from the environmental safety detection module is calculated to determine the second abnormal access behavior to the resource; The credibility of the access links of the access proxy module is calculated to identify third-party abnormal access behaviors to the resources. The credibility of the risk assessment results of the comprehensive management module is calculated to determine the fourth abnormal access behavior to resources; Based on the adjusted policy execution permissions of the asset network stealth module, secondary authentication or blocking is performed on the abnormal access behavior of the resources.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor runs the computer program to implement the system as described in any one of claims 1-7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by a processor to implement the system as described in any one of claims 1-7.

Images