A session information authentication method and device, electronic equipment, and storage medium

Abstract

The application discloses a kind of authentication methods and devices of conversation information, electronic equipment, storage medium, wherein the method is applied to authentication module, the method comprises: receiving the first authentication request message of authentication interface of zero trust service end forwarded by zero trust gateway and the first authentication response message corresponding to first authentication request message;Determine the authentication baseline of the authentication interface of zero trust service end using first authentication request message and first authentication response message;Receive the second authentication request message of authentication interface of zero trust service end forwarded by zero trust gateway and the second authentication response message corresponding to second authentication request message;Second authentication request message and second authentication response message are matched with authentication baseline, and the authentication session information of authentication interface is obtained.The application uses the session of service end authentication interface itself as zero trust session information, and realizes the adaptive authentication of authentication session information of service end authentication interface.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of communication, and in particular to a session information authentication method and device, electronic equipment and storage medium. BACKGROUND

[0002] Zero trust architecture considers that the network is untrusted, and uses an identity management method to build an end-to-end, minimum authorization business application dynamic access control system between access subjects and objects, thereby reducing the attack surface of business applications and improving the discovery and response capabilities of network attacks and identity fraud. In the zero trust architecture, to achieve access control protection of resources and block unauthorized subjects from accessing the resources of the access objects, identity authentication of the access subjects needs to be performed in the zero trust system, and an access control list (ACL) between the access subjects and the protected resources needs to be maintained. In the process of accessing resources through the zero trust system, the access subjects first complete identity authentication and obtain an authorized session, and the zero trust system needs to identify session information in the traffic and perform access control based on the authorized session. The main technologies for implementing identity authentication and authorization in the current zero trust system are as follows:

[0003] 1. Transmission layer traffic proxy scheme: the user installs a special zero trust client software, establishes a secure tunnel with the zero trust gateway after authentication of the zero trust client, encapsulates session (Session) information in the tunnel message through the client to implement access control, and forwards the decrypted tunnel traffic to the access target application system by the zero trust traffic proxy gateway.

[0004] 2. Application layer traffic proxy scheme: the user does not need to install a special zero trust client software, obtains zero trust Session information after completing identity authentication on the web page or web application interface of the zero trust system, increases the information in the Hypertext Transfer Protocol (HTTP) Header or Cookie (a session tracking technology) to implement session identification of the message, and finally performs authentication through the zero trust gateway and completes traffic forwarding.

[0005] In the current zero trust implementation identity authentication and authorization technologies, the authentication of the zero trust system and the authentication of the protected business system are performed separately, different account systems are used, and the following problems exist in the implementation process:

[0006] 1. The user needs to perform at least two times of identity authentication, and if a single sign-on scheme is used, code modification is needed, which reduces the user experience;

[0007] 2. The account systems between the two systems are inconsistent, synchronization is difficult to achieve, and account authorization management risks are brought.

[0008] In the transmission layer traffic proxy solution, tunnel encapsulation technology is adopted, so that access control can only be accurate to Internet Protocol (IP) address and port, and it is difficult to achieve uniform resource locator (URL) level access control for all traffic of the protected service system, and it is difficult to adapt to complex protection scenarios, and bypass function cannot be realized when a fault occurs; and the solution generally needs to be used with a dedicated client, which changes the original system use process and affects user experience.

[0009] In the application layer traffic proxy solution, compared with the transmission layer traffic proxy solution, the solution can compensate for the short board of user experience and dynamic protection to a certain extent, but the solution needs to add zero-trust application layer session information to identify the identity information of the user in each request session, and in the mobile application program use scenario or cross-domain access scenario, the session information needs to be added one by one in each access protected resource request by modifying the code by the client development engineer, which needs a large adaptation cost.

[0010] In view of the problems existing in the current zero-trust identity authentication and authorization technology, it is necessary to provide a reasonable scheme for authenticating the identity of the visitor in the zero-trust system and realizing access control protection of the resource. SUMMARY

[0011] To solve the above technical problems, the embodiments of the present application provide a session information authentication method and device, an electronic device and a storage medium.

[0012] In a first aspect, the embodiments of the present application provide a session information authentication method, which is applied to an authentication module, and the method comprises:

[0013] receiving at least one first authentication request message for an authentication interface of a zero-trust server and at least one first authentication response message corresponding to the at least one first authentication request message forwarded by a zero-trust gateway;

[0014] determining an authentication baseline of the authentication interface of the zero-trust server by using the at least one first authentication request message and the at least one first authentication response message;

[0015] receiving at least one second authentication request message for the authentication interface of the zero-trust server and at least one second authentication response message corresponding to the at least one second authentication request message forwarded by the zero-trust gateway;

[0016] match the at least one second authentication request message and the at least one second authentication response message with the authentication baseline to obtain authentication session information of the authentication interface, and save the authentication session information into a target database.

[0017] In a second aspect, an embodiment of the present application provides a method for authenticating session information, which is applied to a zero-trust gateway, and the method comprises the following steps:

[0018] receiving at least one first authentication request message for an authentication interface of a zero-trust server sent by a zero-trust client, and at least one first authentication response message corresponding to the at least one first authentication request message sent by the zero-trust server;

[0019] forwarding the at least one first authentication request message and the at least one first authentication response message to an authentication module; the at least one first authentication request message and the at least one first authentication response message are used for the authentication module to determine an authentication baseline of the authentication interface of the zero-trust server;

[0020] receiving at least one second authentication request message for the authentication interface of the zero-trust server sent by the zero-trust client, and at least one second authentication response message corresponding to the at least one second authentication request message sent by the zero-trust server; the at least one second authentication request message and the at least one second authentication response message are used for the authentication module to match the at least one second authentication request message and the at least one second authentication response message with the authentication baseline to obtain authentication session information of the authentication interface, and save the authentication session information into a target database.

[0021] In a third aspect, an embodiment of the present application provides an authentication device for session information, which is applied to an authentication module, and the device comprises the following units:

[0022] a first receiving unit, configured to receive at least one first authentication request message for an authentication interface of a zero-trust server and at least one first authentication response message corresponding to the at least one first authentication request message forwarded by a zero-trust gateway;

[0023] a first determining unit, configured to determine an authentication baseline of the authentication interface of the zero-trust server by using the at least one first authentication request message and the at least one first authentication response message;

[0024] a second receiving unit, configured to receive at least one second authentication request message for the authentication interface of the zero-trust server and at least one second authentication response message corresponding to the at least one second authentication request message forwarded by the zero-trust gateway.

[0025] The matching unit is configured to match the at least one second authentication request message and the at least one second authentication response message with the authentication baseline, to obtain authentication session information of the authentication interface, and to save the authentication session information into a target database.

[0026] In a fourth aspect, an embodiment of the present application provides an authentication device of session information, which is applied to a zero trust gateway, and the device comprises:

[0027] The third receiving unit is configured to receive at least one first authentication request message for an authentication interface of a zero trust service end sent by a zero trust client, and at least one first authentication response message corresponding to the at least one first authentication request message sent by the zero trust service end.

[0028] The first forwarding unit is configured to forward the at least one first authentication request message and the at least one first authentication response message to an authentication module, and the at least one first authentication request message and the at least one first authentication response message are used by the authentication module to determine an authentication baseline of the authentication interface of the zero trust service end.

[0029] The fourth receiving unit is configured to receive at least one second authentication request message for the authentication interface of the zero trust service end sent by the zero trust client, and at least one second authentication response message corresponding to the at least one second authentication request message sent by the zero trust service end, and the at least one second authentication request message and the at least one second authentication response message are used by the authentication module to match the at least one second authentication request message and the at least one second authentication response message with the authentication baseline, to obtain authentication session information of the authentication interface, and to save the authentication session information into a target database.

[0030] In a fifth aspect, an embodiment of the present application provides an electronic device, which comprises a memory and a processor, the memory has computer executable instructions stored thereon, and the processor, when running the computer executable instructions stored on the memory, can implement the authentication method of session information according to the above-mentioned embodiments.

[0031] In a sixth aspect, an embodiment of the present application provides a computer storage medium, which has executable instructions stored thereon, and the executable instructions, when executed by a processor, implement the authentication method of session information according to the above-mentioned embodiments.

[0032] The technical scheme of the embodiment of the application can utilize the session of the service end authentication interface itself as zero-trust session information, realizes adaptive authentication of the authentication session information of the service end authentication interface, and enables subsequent authentication of the identity of a client access user to be realized by using the authentication session information obtained through authentication. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 A flowchart of a session information authentication method provided by the embodiment of the application Figure One ;

[0034] Figure 2 A schematic diagram of an authentication baseline confirmation process provided by the embodiment of the application

[0035] Figure 3 A schematic diagram of a secure session information confirmation process provided by the embodiment of the application

[0036] Figure 4 A flowchart of a session information authentication method provided by the embodiment of the application Figure Two ;

[0037] Figure 5 A flowchart of a session information authentication method provided by the embodiment of the application Figure Three ;

[0038] Figure 6 A flowchart of a session information authentication method provided by the embodiment of the application Figure Four ;

[0039] Figure 7 A schematic diagram of a session verification process of a zero-trust gateway provided by the embodiment of the application

[0040] Figure 8 A schematic diagram of a session information authentication process and a process of business protection by using authentication session information provided by the embodiment of the application

[0041] Figure 9 A structural composition schematic diagram of a session information authentication device provided by the embodiment of the application Figure One ;

[0042] Figure 10 A structural composition schematic diagram of a session information authentication device provided by the embodiment of the application Figure Two ;

[0043] Figure 11 A hardware structural composition schematic diagram of an electronic device provided by the embodiment of the application. DETAILED DESCRIPTION

[0044] In order to make the purposes, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0045] It should be noted that similar reference numerals and letters refer to similar items in the following drawings, and therefore, once an item is defined in one drawing, it need not be defined and explained in subsequent drawings.

[0046] The term “and / or” herein merely describes an associated relationship, which means that there can be three relationships, for example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone. In addition, the term “at least one” herein means any one of a plurality or any combination of at least two of a plurality, for example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0047] Figure 1 Flowchart of the session information authentication method provided by the embodiments of the present application Figure One The session information authentication method is applied to an authentication module, as shown in Figure 1 The session information authentication method comprises the following steps:

[0048] S101: receiving at least one first authentication request message for an authentication interface of a zero-trust server and at least one first authentication response message corresponding to the at least one first authentication request message forwarded by a zero-trust gateway;

[0049] S102: determining an authentication baseline of the authentication interface of the zero-trust server by using the at least one first authentication request message and the at least one first authentication response message;

[0050] S103: receiving at least one second authentication request message for the authentication interface of the zero-trust server and at least one second authentication response message corresponding to the at least one second authentication request message forwarded by the zero-trust gateway;

[0051] S104: match the at least one second authentication request message and the at least one second authentication response message with the authentication baseline to obtain authentication session information of the authentication interface, and save the authentication session information into a target database.

[0052] In the embodiment of the application, the authentication interface of the zero trust server is specifically an authentication interface of a protected application system of the zero trust server. It can be understood that if the zero trust server includes multiple protected application systems, each protected application system corresponds to at least one authentication interface; for each authentication interface of each protected application system, an authentication interface instance is formed in the zero trust server. For each authentication interface of each protected application system, the authentication baseline and the authentication session information corresponding to the authentication interface can be obtained by using the method of the embodiment of the application.

[0053] In the embodiment of the application, the at least one first authentication request message is authentication request information sent by at least one client to the authentication interface of the zero trust server via the zero trust gateway, and the number of first authentication request messages sent by each client in the at least one client is one or more.

[0054] The technical scheme of the embodiment of the application can use the session of the server authentication interface itself as the zero trust session information, thereby realizing adaptive authentication of the authentication session information of the server authentication interface. The authentication session information obtained by authentication can realize authentication of the identity of a client access user.

[0055] In the embodiment of the application, since the authentication module can realize adaptive authentication of the authentication session information of the server authentication interface, the authentication module can also be referred to as an adaptive authentication module; the authentication baseline includes the traffic characteristics of the authentication interface that have been authenticated by the authentication module, and can also be referred to as a security baseline or a secure authentication baseline; and the authentication session information is the session information that has been authenticated by the authentication module, and can also be referred to as a secure session or secure session information.

[0056] In the field, the zero trust gateway in the embodiment of the application can also be referred to as a zero trust traffic proxy gateway, a zero trust proxy gateway, or a zero trust security gateway.

[0057] In some embodiments, the above step S102 includes the following steps:

[0058] Each item of information contained in each first authentication request message in the at least one first authentication request message is analyzed, and each item of information contained in each first authentication response message in the at least one first authentication response message is analyzed to obtain the authentication baseline of the authentication interface of the zero trust server.

[0059] In the embodiment of the application, the authentication baseline includes an authentication request baseline and an authentication response baseline.

[0060] In the embodiment of the application, in the process of confirming the authentication baseline of the authentication interface of the zero-trust server, the zero-trust gateway only forwards the authentication request message and the authentication response message, specifically including: receiving, by the zero-trust gateway, the authentication request message for the authentication interface of the server sent by the zero-trust client, forwarding the authentication request message to the zero-trust server and the authentication module respectively; and receiving, by the zero-trust gateway, the authentication response message corresponding to the authentication request message sent by the zero-trust server, forwarding the authentication response message to the zero-trust client and the authentication module respectively.

[0061] The adaptive authentication module can use the session of the server authentication interface itself as a zero-trust session mark to realize adaptive authentication of the authentication session information of the server authentication interface.

[0062] Figure 2 A process diagram for confirming an authentication baseline is provided in the embodiment of the application, Figure 2 The client in the embodiment of the application is a zero-trust client, and the server is a zero-trust server. As shown in Figure 2 The authentication baseline of the authentication interface of the zero-trust server can be confirmed through the following steps a1 to a9:

[0063] a1, configure the authentication interface address.

[0064] The security administrator configures the application authentication interface address on the zero-trust gateway.

[0065] a2, send an authentication request.

[0066] The zero-trust client sends an authentication request for the authentication interface address of the zero-trust server to the zero-trust gateway.

[0067] a3, forward the authentication request.

[0068] The zero-trust gateway sends the authentication request to the zero-trust server after receiving the authentication request sent by the zero-trust client.

[0069] a4, authentication request mirroring.

[0070] The zero-trust gateway also copies the authentication request message and forwards it to the authentication module.

[0071] a5, send an authentication response.

[0072] The zero-trust server responds to the authentication request after receiving the authentication request and returns an authentication response message corresponding to the authentication request.

[0073] a6, authentication response mirroring.

[0074] After receiving the authentication response, the zero-trust gateway forwards the authentication response to the authentication module.

[0075] a7、Forwarding the authentication response.

[0076] The zero-trust gateway also forwards the received authentication response to the zero-trust gateway.

[0077] a8、Analyzing the authentication request and the authentication response.

[0078] The authentication module analyzes the information included in the authentication request and the information included in the authentication response to obtain the authentication request baseline and the authentication response baseline.

[0079] For example, after obtaining the authentication request and the authentication response, the authentication module analyzes the request method, request parameters, and other elements in the authentication request, and analyzes the response header, response parameters, and other elements in the authentication response, outputs the characteristics of the authentication request and the authentication response, and generates the authentication request baseline and the authentication response baseline based on the characteristics of the authentication request and the authentication response.

[0080] a9、Outputting the authentication baseline.

[0081] After the authentication module outputs the authentication baseline, the authentication baseline can be further manually confirmed by an administrator.

[0082] In some embodiments, the characteristics of the authentication request and the authentication response can be output by the authentication module, and then the output characteristics of the authentication request and the authentication response are sent to a security administrator for confirmation and adjustment by the security administrator, and finally the authentication request baseline and the authentication response baseline of the authentication interface are obtained.

[0083] For example, the authentication request baseline includes information such as request method, message content type, message data structure, parameter name, parameter type, and other HTTP header information; and the authentication response baseline includes information such as response status code, response message type, response parameter name, and response parameter position.

[0084] In some embodiments, the above step S104 includes the following steps:

[0085] Step 1-1): For each second authentication request message in the at least one second authentication request message, matching each second authentication request message with the authentication request baseline;

[0086] Step 1-2): Forwarding the second authentication request message in the at least one second authentication request message that matches the authentication request baseline to the zero-trust server;

[0087] Step 1-3): receiving the at least one second authentication response message returned by the zero-trust service end; the at least one second authentication response message is an authentication response message corresponding to a second authentication request message matching the authentication request baseline;

[0088] Step 1-4): matching each second authentication response message in the at least one second authentication response message with the authentication response baseline;

[0089] Step 1-5): analyzing each second authentication response message in the at least one second authentication response message matching the authentication response baseline to obtain first session information contained in each second authentication response message matching the authentication response baseline;

[0090] Step 1-6): confirming the first session information as authentication session information of the authentication interface.

[0091] In the embodiments of the present application, the authentication module can be used to realize the application programming interface (API, Application Programming Interface) simulation capability, and the authentication module can be used to intercept and process the API request. In the case that the API request meets the authentication request baseline, the authentication module forwards the API request to the zero-trust service end. In the case that the authentication module receives the authentication response message returned by the zero-trust gateway and forwarded by the zero-trust service end, the authentication response message is preprocessed to obtain the session information of the user login, which is cached as a security identifier for the zero-trust gateway to identify whether the user is authorized.

[0092] Figure 3 The authentication session information confirmation process provided by the embodiments of the present application is shown in the following figure, Figure 3 The client in the figure is a zero-trust client, and the service end is a zero-trust service end. As shown in the figure, Figure 3 The confirmation of the secure session information includes the following steps b1 to b11.

[0093] b1, send an authentication request.

[0094] The zero-trust client sends an authentication request to the zero-trust gateway for the authentication interface address of the zero-trust service end.

[0095] b2, intercept the authentication request to the authentication module.

[0096] The authentication request passes through the zero-trust gateway proxy, is intercepted by the zero-trust gateway, and is forwarded to the authentication module.

[0097] b3, preprocessing the authentication request and comparing with the authentication request baseline.

[0098] The authentication module pre-processes the authentication request against the configured authentication request baseline, and the pre-processing methods include but are not limited to the following:

[0099] b3.1, check whether the HTTP method (POST, GET, etc.) of the request is consistent with the authentication request baseline;

[0100] b3.2, check whether the text type (ContentType) of the request is consistent with the authentication request baseline, such as application / json, application / x-www-form-urlencoded, etc.;

[0101] b3.3, check whether the data structure of the request message body (body) is consistent with the authentication request baseline, such as form string, json, xml, etc.;

[0102] b3.4, based on the pre-configured request content data structure, parse the request parameters, and check whether the request parameter name, parameter quantity, parameter data type, etc. are consistent with the authentication request baseline, wherein the parameter data type can be matched based on regular expressions;

[0103] b3.5, check whether other characteristics of the request are consistent with the authentication request baseline, including http refer, httporigin, user-agent, etc., which can be matched using regular expressions;

[0104] b3.6, check whether the request content contains key characters for network security attacks, such as single quote (') for various injection attacks, double quote (") for various injection attacks, pipe symbol (|), and angle brackets (<) for cross-site scripting attacks.

[0105] b4, the authentication request matches the authentication request baseline, and the authentication request is forwarded.

[0106] In the case where the authentication request content matches the authentication request baseline, the authentication request is forwarded to the zero-trust server, and the zero-trust server authentication response is waited.

[0107] b5, baseline mismatch, intercept the authentication request.

[0108] In the case where the authentication request content does not match the authentication request baseline, or the authentication request content contains malicious characters, the authentication module directly responds to the zero-trust client and displays a predefined protection prompt message, while counting the number of exceptions.

[0109] The predefined protection prompt information here can be specifically set as: illegal characters exist in your request content, the format of your request parameter is incorrect, etc. in the test verification stage; and can be set as: your request is illegal, please contact the administrator; service is abnormal, please try again later, etc. in the actual application stage after going online.

[0110] It can be understood that, in the test verification stage, in order to enable the developer to know the reason why the authentication request is intercepted in time, the detailed reason why the authentication request is intercepted can be displayed in the predefined protection prompt information; in the actual application stage after going online, in order to avoid that the attacker makes targeted authentication attempts, the detailed reason why the authentication request is intercepted is not displayed in the predefined protection prompt information, but only an error prompt is made.

[0111] b6, sending an authentication response.

[0112] The zero-trust server responds to the authentication request after receiving the authentication request, and returns an authentication response message corresponding to the authentication request.

[0113] b7, preprocessing the authentication response and comparing it with the authentication response baseline.

[0114] The authentication response is intercepted by the zero-trust gateway proxy and forwarded to the authentication module by the zero-trust gateway.

[0115] The authentication module preprocesses the authentication response by comparing it with the configured authentication response baseline, and the preprocessing content includes but is not limited to the following:

[0116] b7.1, checking whether the HTTP status (200, 302, etc.) of the authentication response is consistent with the authentication response baseline;

[0117] b7.2, checking whether the ContentType of the authentication response is consistent with the authentication response baseline, such as application / json, text / html, etc.

[0118] b7.3, checking whether the HTTP Header structure of the authentication response is consistent with the authentication response baseline, such as whether the Set-cookie field name is correct, whether the Location field exists, etc.

[0119] b7.4, checking whether the data structure of the authentication response body is consistent with the authentication response baseline, such as json, xml, etc. If the response status is 302 or the response content is html, it is not necessary to check.

[0120] b8, the authentication response does not match the authentication response baseline, the authentication response is intercepted, and custom information is displayed.

[0121] In the case that the state and content of the authentication response do not match the authentication response baseline, the authentication module identifies that the user login fails or an unexpected error occurs on the server, displays a predefined protection prompt information, and simultaneously counts the number of exceptions.

[0122] b9, the authentication response matches the authentication response baseline, and the session information is saved.

[0123] b10, the session information is saved to the zero trust Redist.

[0124] b11, the authentication response is forwarded to the client.

[0125] The predefined protection prompt information here can be specifically set to account password error, authentication failure, server exception, authentication failure, etc. in the test and debugging stage, and can be set to your request is illegal, please contact the administrator, service exception, please try again later, etc. in the actual application stage after going online.

[0126] It can be understood that, in the test and debugging stage, in order to enable the developer to know the reason why the authentication response is intercepted in time, the detailed reason why the authentication response is intercepted can be displayed in the predefined protection prompt information; in the actual application stage after going online, in order to avoid that the attacker attempts to authenticate purposefully, the detailed reason why the authentication response is intercepted is not displayed in the predefined protection prompt information, but only an error prompt is given.

[0127] In the case that the content of the authentication response matches the authentication response baseline, the response parameters are parsed based on the preconfigured response content data structure, the session mark after login is obtained according to the session parameter name of application login success, is saved to the zero trust Redis, and the authentication response is forwarded to the client.

[0128] Figure 4 Flowchart of the session information authentication method provided by the embodiment of the application Figure Two The session information authentication method is applied to an authentication module, as shown in Figure 4 The session information authentication method comprises the following steps:

[0129] S401: Determine the authentication baseline of the authentication interface of the zero trust server;

[0130] S402: Match the at least one second authentication request message and the at least one second authentication response message received by the zero trust gateway with the authentication baseline;

[0131] S403: For each of the at least one client, count a first number of second authentication request messages corresponding to the client and not matching the authentication request baseline, and / or a second number of second authentication response messages corresponding to the client and not matching the authentication response baseline;

[0132] S404: Determine whether to mark the client as an attack client according to the first number and / or the second number corresponding to the client.

[0133] In the embodiments of the present application, the above step S401 can be implemented by the above steps S101 to S102. The authentication baseline includes the authentication request baseline and the authentication response baseline.

[0134] In the embodiments of the present application, the at least one second authentication request message is authentication request information sent by at least one client to the authentication interface of the zero-trust server via the zero-trust gateway, and the number of second authentication request messages sent by each of the at least one client is one or more.

[0135] In the embodiments of the present application, the number of authentication request / authentication response exceptions can be counted based on the IP address of the zero-trust client. When multiple exceptions occur, it is considered as a potential malicious attack behavior (such as password brute force cracking, structured query language (SQL) injection, command injection attack, etc.). According to the preconfigured security policy, the IP is implemented with flow limiting, fusing and other security disposal measures within a certain time period.

[0136] The embodiments of the present application can use the authentication module to realize the application API simulation capability. The authentication module can intercept and process the API request. When the API request meets the authentication request baseline, the authentication module forwards the API request to the zero-trust server. When the authentication module receives the authentication response message returned by the zero-trust server forwarded by the zero-trust gateway, the authentication response message is preprocessed to obtain the session information of user login, which is cached as a security identifier for the zero-trust gateway to identify whether the user is authorized.

[0137] Figure 5 Flowchart of the session information authentication method provided by the embodiments of the present application Figure Three The session information authentication method is applied to a zero-trust gateway, as shown in Figure 5 The session information authentication method includes the following steps:

[0138] S501: receiving at least one first authentication request message sent by a zero-trust client and directed to an authentication interface of a zero-trust server, and at least one first authentication response message sent by the zero-trust server and corresponding to the at least one first authentication request message;

[0139] S502: forwarding the at least one first authentication request message and the at least one first authentication response message to an authentication module;

[0140] S503: receiving at least one second authentication request message sent by the zero-trust client and directed to the authentication interface of the zero-trust server, and at least one second authentication response message sent by the zero-trust server and corresponding to the at least one second authentication request message.

[0141] In the embodiments of the present application, the at least one first authentication request message and the at least one first authentication response message are used by the authentication module to determine an authentication baseline of the authentication interface of the zero-trust server.

[0142] In the embodiments of the present application, the at least one second authentication request message and the at least one second authentication response message are used by the authentication module to match the at least one second authentication request message and the at least one second authentication response message with the authentication baseline to obtain authentication session information of the authentication interface, and save the authentication session information into a target database.

[0143] In the embodiments of the present application, in the process of confirming the authentication baseline of the authentication interface of the zero-trust server, the zero-trust gateway only performs forwarding of the authentication request message and the authentication response message, specifically including receiving, by the zero-trust gateway, the authentication request message sent by the zero-trust client and directed to the authentication interface of the server, forwarding the authentication request message to the zero-trust server and the authentication module respectively; and receiving, by the zero-trust gateway, the authentication response message sent by the zero-trust server and corresponding to the authentication request message, forwarding the authentication response message to the zero-trust client and the authentication module respectively.

[0144] In the embodiments of the present application, the authentication baseline includes an authentication request baseline and an authentication response baseline.

[0145] The technical solution of the embodiments of the present application can use the session of the server authentication interface itself as the zero-trust session information, thereby realizing adaptive authentication of the authentication session information of the server authentication interface; and the authentication session information obtained through authentication can realize authentication of the identity of the client access.

[0146] In the embodiments of the present application, the authentication module can be used to realize the application API simulation capability. The authentication module can intercept and process the API request, and in the case that the API request meets the authentication request baseline, the authentication module forwards the API request to the zero trust server. In the case that the authentication module receives the authentication response message returned by the zero trust server forwarded by the zero trust gateway, the authentication response message is preprocessed to obtain the session information of user login, which is cached as a security identifier for the zero trust gateway to identify whether the user is authorized.

[0147] Figure 6 Flowchart of the session information authentication method provided by the embodiments of the present application Figure Four The session information authentication method is applied to a zero trust gateway, as shown in Figure 6 The session information authentication method comprises the following steps:

[0148] S601: In the case that the access request message for the zero trust server sent by the zero trust client is received, the second session information included in the access request message is obtained;

[0149] S602: Whether the target authentication session information matching the second session information exists in the target database is found, and a finding result is obtained;

[0150] S603: Whether to forward or intercept the access request message is determined according to the finding result.

[0151] In the embodiments of the present application, the authentication module caches the session information of the business (and the protected business system). The zero trust gateway can verify the http request session information based on the cached business session information, can perform session verification on the session information carried by the access request of the non-authentication authentication interface, and can intercept the access request without carrying the session or with invalid session.

[0152] In some embodiments, the above step S602 comprises:

[0153] Step 2-1): The second session information included in the access request message is taken as a key, and authentication session information matching the key is found in the target database;

[0154] Step 2-2): In the case that the authentication session information matching the key does not exist in the target database, or the field value of the scope in the authentication session information matching the key in the target database does not match the resource information accessed by the access request message, it is determined that the target authentication session information matching the second session information does not exist in the target database.

[0155] In the embodiment of the present application, the zero-trust gateway acquires the session information in the access request message, takes the session information in the access request message as a keyword, and searches the authentication session information matching the session information in the target database. If the authentication session information matching the session information is not found in the target database, or although the authentication session information matching the session information is found in the target database, the field value of the scope of the found authentication session information does not match the resource to be accessed by the access request message, it is considered that the session information in the access request message fails to be checked.

[0156] In some embodiments, the authentication module continuously monitors the server response result, and updates the session state according to the session expiration response status code or response content predefined by the user, which can ensure that the cached session is synchronized with the business session state. Specifically, the following steps can be implemented:

[0157] Step 3-1): In the case of forwarding the access request message according to the search result, the access request message is forwarded to the zero-trust server.

[0158] Step 3-2): Receive the response message corresponding to the access request message returned by the zero-trust server.

[0159] Step 3-3): Determine whether the response message meets the predetermined session information invalidation condition. If it meets, send an indication information to the authentication module; the indication information includes the second session information, and the indication information is used for the authentication module to deregister the second session information in the target database.

[0160] For example, the predetermined session information invalidation condition includes that the response message includes a response status code of 401, 302, etc., or the response message includes "session expiration" or the like.

[0161] Figure 7 The session verification process of the zero-trust gateway provided in the embodiment of the present application is shown in the following figure: Figure 3 The client in the figure is a zero-trust client, and the server is a zero-trust server. As shown in the figure, the session verification of the zero-trust gateway includes the following steps c1 to c9: Figure 7

[0162] c1, send an access request.

[0163] The client initiates a resource access request to the server; it should be noted that the access request is an access request to an interface other than the authentication interface of the server. ​

[0164] c2, session verification.

[0165] The zero trust gateway will verify the session information in the request, and the verification process includes the following steps:

[0166] c2.1, obtain the storage location, field name, etc. of the session from the service protection configuration;

[0167] c2.2, from the access request message, obtain the session value according to the above information;

[0168] c2.3, search in the redis cache with the above session value as the key, and obtain the session data in the redis cache that matches the above session value. If the following situations occur, it is considered that the session in the access request message is invalid:

[0169] 1. The corresponding session record cannot be found in redis;

[0170] 2. After querying the corresponding session record in redis, the scope field value in the corresponding session record does not match the resource accessed by the current client;

[0171] c3, verification failure, intercept access request.

[0172] If the zero trust gateway fails to verify the session in the access request message, the zero trust gateway will intercept the access request message and respond to the custom protection prompt.

[0173] Here, the custom protection prompt can be, for example, a prompt such as "Your access is not authorized, please authenticate and retry" and the like.

[0174] c4, verification success, forward access request.

[0175] If the zero trust gateway successfully verifies the session in the access request message, the zero trust gateway will send the access request message to the service end.

[0176] c5, send response message.

[0177] After receiving the access request message forwarded by the zero trust gateway, the service end will return a response message corresponding to the access request message according to the information contained in the access request message.

[0178] c6, judge the response state.

[0179] The service end returns the response message to the zero trust gateway, the zero trust gateway processes the response state of the service end, checks whether the response state code and the response content match the session expiration condition predefined by the business, such as the response state code being 401 or 302, or the response content containing'session expiration' and the like.

[0180] c7, if the check passes, the response message is sent.

[0181] If the zero trust gateway determines that the response state of the service end is normal, the response message sent by the service end is forwarded to the client.

[0182] c8, the session expiration is identified.

[0183] c9, the session is logged out.

[0184] If the zero trust gateway checks the session expiration in the response message of the service end, the session is redirected to the session logout interface of the authentication module as a parameter, the session cached in the redis is deleted, and the content specified by the business is responded to the client, such as 302 redirection.

[0185] The embodiments of the application can ensure that the cached session is synchronized with the business session state by continuously monitoring the response result of the service end by the authentication module, updating the session state according to the session expiration response state code or response content predefined by the user

[0186] The scheme of the embodiments of the application has the following advantages:

[0187] When authenticating the access user, the traditional zero trust system needs to perform authentication of the zero trust system and authentication of the protected business system respectively, such as adopting a single sign-on scheme, which needs to be reformed in code, and at the same time, a user access control list needs to be maintained on the zero trust system; the embodiments of the application realize adaptive authentication of the zero trust system to the application system by the authentication module, without the need for code reforming to realize one-time authentication, and at the same time, the authentication mode, the account system and the access control rule of the zero trust system and the application system are kept consistent, without the need for manual maintenance and without changing the user experience.

[0188] In the transmission layer flow proxy scheme, the tunnel encapsulation technology is adopted, which needs to be used in cooperation with a dedicated client, and the use process of the original system is changed; the embodiments of the application are based on the application layer reverse proxy technology, without the need for the user to install a dedicated client.

[0189] In the application layer traffic proxy solution, additional zero-trust application layer session information needs to be added in each request session to identify the identity information of the user, and in the mobile application use scenario or the cross-domain access scenario, the operation system and the browser characteristics bring great adaptation and modification costs; the authentication module in the embodiment of the application processes the authentication process of the application system, and realizes the self-adaptation of the authentication session of the zero-trust gateway to the application system, so that the client request can pass through the access control of the zero-trust system by using the original application system session information, without the need of application system modification and adaptation.

[0190] Figure 8 The session information authentication process provided by the embodiment of the application and the process diagram of the business protection using the authentication session information are shown. Figure 8 In the embodiment, the authentication process of the session information includes two stages of observation and analysis stage and configuration stage; the business protection using the authentication session information is realized through the protection stage. Next, the stages included in the embodiment are introduced as follows. Figure 8 In the embodiment, the stages included in the embodiment are introduced as follows.

[0191] 1. Observation and analysis stage: configure a business authentication interface on the zero-trust system, send the traffic information of the interface to the authentication module, and analyze the request and response characteristics of the traffic of the business authentication interface by the authentication module.

[0192] 2. Configuration stage: based on the analysis result of the authentication module to the traffic information of the business authentication interface, the configuration personnel confirms the request and response rules of the authentication interface, including the request method, the request parameter, the request type, and the response status code, the response data format, the response session parameter name, etc., forms the authentication interface authentication baseline, and configures to the authentication module to generate the adaptive authentication service instance.

[0193] 3. Protection stage:

[0194] Configure the zero-trust gateway to realize the authentication traffic interception. The traffic of the authentication interface is intercepted to the adaptive authentication module service instance, the authentication request is recognized and forwarded by the authentication module, the session content of the server response is obtained and saved as the security session of the zero-trust gateway;

[0195] Configure the zero-trust gateway to realize the boundary access control. Based on the business session rules, configure the zero-trust gateway to obtain the position and parameter name of the session information in the access request, enable the protection function, and the zero-trust gateway will intercept the request without carrying the security session information or the session information not matching.

[0196] The scheme of the embodiment of the application has the following advantages:

[0197] 1. The authentication session information can be adapted, and the application system and its user transparent to access zero trust, without modifying the front-end and back-end applications, without installing zero trust client, without changing the user experience;

[0198] 2. Since the zero trust system uses the session information of the application system, it is not necessary to maintain the access control list (ACL) of the user to the application system, and it is not necessary to maintain the unified account system.

[0199] 3. Based on the optimization of the zero trust application layer traffic proxy scheme, compared with the transmission layer tunnel proxy scheme, the access control strategy can be fine to the application layer URL, and it can adapt to complex protection scenarios.

[0200] Figure 9 The structure of a session information authentication device 900 provided by the embodiments of the application is shown in the figure Figure One The session information authentication device 900 is applied to an authentication module, as shown in the figure Figure 9 The session information authentication device 900 comprises:

[0201] A first receiving unit 901 is configured to receive at least one first authentication request message for an authentication interface of a zero trust server forwarded by a zero trust gateway and at least one first authentication response message corresponding to the at least one first authentication request message;

[0202] A first determining unit 902 is configured to determine an authentication baseline of the authentication interface of the zero trust server by using the at least one first authentication request message and the at least one first authentication response message;

[0203] A second receiving unit 903 is configured to receive at least one second authentication request message for the authentication interface of the zero trust server forwarded by the zero trust gateway and at least one second authentication response message corresponding to the at least one second authentication request message;

[0204] A matching unit 904 is configured to match the at least one second authentication request message and the at least one second authentication response message with the authentication baseline to obtain authentication session information of the authentication interface, and save the authentication session information into a target database.

[0205] In some embodiments, the first determining unit is configured to analyze each item of information contained in each first authentication request message in the at least one first authentication request message, and analyze each item of information contained in each first authentication response message in the at least one first authentication response message, to obtain the authentication baseline of the authentication interface of the zero trust server; the authentication baseline comprises an authentication request baseline and an authentication response baseline.

[0206] In some embodiments, the authentication baseline comprises an authentication request baseline and an authentication response baseline, the matching unit is configured to, for each second authentication request message in the at least one second authentication request message, match the second authentication request message with the authentication request baseline; forward the second authentication request message in the at least one second authentication request message that matches the authentication request baseline to a zero-trust server; receive the at least one second authentication response message returned by the zero-trust server; the at least one second authentication response message is an authentication response message corresponding to the second authentication request message that matches the authentication request baseline; match each second authentication response message in the at least one second authentication response message with the authentication response baseline; analyze each second authentication response message in the at least one second authentication response message that matches the authentication response baseline to obtain first session information contained in the second authentication response message that matches the authentication response baseline; and confirm the first session information as authentication session information of the authentication interface.

[0207] In some embodiments, the at least one second authentication request message is authentication request information sent by at least one client to the authentication interface of the zero-trust server via the zero-trust gateway, and the number of second authentication request messages sent by each client in the at least one client is one or more. The session information authentication device further comprises:

[0208] The statistical unit is configured to, for each client in the at least one client, count a first number of second authentication request messages corresponding to the client that do not match the authentication request baseline, and / or a second number of second authentication response messages corresponding to the client that do not match the authentication response baseline.

[0209] The second determination unit is configured to determine whether to mark the client as an attack client according to the first number and / or the second number corresponding to the client.

[0210] Those skilled in the art should understand that, Figure 9 The implementation functions of each unit in the session information authentication device shown can be understood with reference to the related description of the foregoing session information authentication method. Figure 9 The functions of each unit in the session information authentication device shown can be implemented by a program running on a processor, or by a specific logic circuit.

[0211] Figure 10 A structure of a session information authentication device 1000 provided by an embodiment of the present application is shown in FIG. 10. Figure Two The session information authentication device 1000 is applied to a zero-trust gateway, for example. Figure 10As shown, the authentication device 1000 of the session information comprises:

[0212] a third receiving unit 1001, configured to receive at least one first authentication request message sent by a zero-trust client and directed to an authentication interface of a zero-trust server, and at least one first authentication response message sent by the zero-trust server and corresponding to the at least one first authentication request message;

[0213] a first forwarding unit 1002, configured to forward the at least one first authentication request message and the at least one first authentication response message to an authentication module; the at least one first authentication request message and the at least one first authentication response message are used by the authentication module to determine an authentication baseline of the authentication interface of the zero-trust server;

[0214] a fourth receiving unit 1003, configured to receive at least one second authentication request message sent by the zero-trust client and directed to the authentication interface of the zero-trust server, and at least one second authentication response message sent by the zero-trust server and corresponding to the at least one second authentication request message; the at least one second authentication request message and the at least one second authentication response message are used by the authentication module to match the at least one second authentication request message and the at least one second authentication response message with the authentication baseline to obtain authentication session information of the authentication interface, and save the authentication session information into a target database.

[0215] In some embodiments, the authentication device of the session information further comprises:

[0216] an obtaining unit, configured to, in a case where an access request message sent by the zero-trust client and directed to the zero-trust server is received, obtain second session information included in the access request message;

[0217] a searching unit, configured to search the target database to determine whether there is target authentication session information matching the second session information, and obtain a searching result;

[0218] a third determining unit, configured to determine, according to the searching result, whether to forward or block the access request message.

[0219] In some embodiments, the searching unit is configured to search, as a key, the second session information included in the access request message in the target database for authentication session information matching the key; and determine that the target authentication session information matching the second session information does not exist in the target database in a case where the target authentication session information matching the key does not exist in the target database, or a field value of a scope in the target authentication session information matching the key does not match resource information accessed by the access request message.

[0220] In some embodiments, the session information authentication apparatus further includes:

[0221] The second forwarding unit is configured to forward the access request message to the zero-trust server in a case where it is determined to forward the access request message according to the searching result.

[0222] The fifth receiving unit is configured to receive a response message corresponding to the access request message returned by the zero-trust server.

[0223] The fourth determining unit is configured to determine whether the response message meets a predetermined condition of session information invalidation; and send indication information to the authentication module if the response message meets the condition, wherein the indication information includes the second session information, and the indication information is used for the authentication module to log out the second session information in the target database.

[0224] Those skilled in the art should understand that, Figure 10 The implementation functions of each unit in the session information authentication apparatus can be understood with reference to the related descriptions of the session information authentication method. Figure 10 The functions of each unit in the session information authentication apparatus can be implemented by a program running on a processor, or by a specific logic circuit.

[0225] The embodiments of the present application also provide an electronic device. Figure 11 A schematic diagram of the hardware structure of the electronic device of the embodiments of the present application is shown in FIG. 11. Figure 11 As shown in FIG. 11, the electronic device includes a communication component 1103 for data transmission, at least one processor 1101, and a memory 1102 for storing a computer program capable of running on the processor 1101. Each component in the terminal is coupled together through a bus system 1104. It can be understood that the bus system 1104 is used to realize the connection and communication between the components. In addition to the data bus, the bus system 1104 also includes a power bus, a control bus, and a status signal bus. However, for the purpose of clear illustration, all kinds of buses are marked as the bus system 1104 in FIG. 11. Figure 11 ​

[0226] wherein the processor 1101, when executing the computer program, is caused to perform at least the steps of the method as shown in any of the Figures 1 to 4

[0227] ​It can be appreciated that the memory 1102 can be volatile memory or nonvolatile memory, or both. Access to memory 1102 by other components of the system 1100 can be controlled by a memory controller. Nonvolatile memory can be, for example, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (MRAM), flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM). The magnetic surface memory can be a magnetic disc memory or a magnetic tape memory. Volatile memory can be, for example, random access memory (RAM), used as an external cache. By way of example, and not limitation, many forms of RAM can be used, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memory 1102 described in the embodiments of this application is intended to include, but is not limited to, these and any other suitable types of memory.

[0228] The methods disclosed in the embodiments of this application can be applied to processor 1101, or implemented by processor 1101. Processor 1101 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 1101 or by instructions in the form of software. The processor 1101 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 1101 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory 1102. Processor 1101 reads the information in memory 1102 and completes the steps of the aforementioned method in combination with its hardware.

[0229] In an exemplary embodiment, the electronic device may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned session information authentication method.

[0230] This application also provides a computer-readable storage medium storing a computer program thereon, characterized in that the program, when executed by a processor, is at least used to perform... Figures 1 to 4 The steps of any of the methods shown in the diagram. The computer-readable storage medium may specifically be a memory. The memory may be, for example, Figure 11 The memory 1102 shown.

[0231] The technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0232] In several embodiments provided in the present application, it should be understood that the disclosed method and intelligent device can be implemented in other manners. The embodiments described above are merely exemplary, for example, the division of the units is only a logical function division, and there can be another division manner in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed coupling, or direct coupling or communication connection between any two components can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or in other forms.

[0233] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, can be located in one place or distributed on a plurality of network units; part or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0234] In addition, each functional unit in each embodiment of the present application can be integrated into a second processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional unit.

[0235] The above is merely a specific implementation of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application.

Claims

1. A method for authenticating session information, characterized in that, The method is applied to the authentication module, and the method includes: Receive at least one first authentication request message forwarded by the zero trust gateway for the authentication interface of the zero trust server, and at least one first authentication response message corresponding to the at least one first authentication request message; The authentication baseline of the authentication interface of the zero-trust server is determined by using the at least one first authentication request message and the at least one first authentication response message; Receive at least one second authentication request message forwarded by the zero trust gateway for the authentication interface of the zero trust server, and at least one second authentication response message corresponding to the at least one second authentication request message; The at least one second authentication request message and the at least one second authentication response message are matched with the authentication baseline to obtain the authentication session information of the authentication interface, and the authentication session information is saved to the target database.

2. The method according to claim 1, characterized in that, Determining the authentication baseline of the authentication interface of the zero-trust server using the at least one first authentication request message and the at least one first authentication response message includes: The authentication baseline of the authentication interface of the zero-trust server is obtained by analyzing the information contained in each of the at least one first authentication request messages and the information contained in each of the at least one first authentication response messages; the authentication baseline includes the authentication request baseline and the authentication response baseline.

3. The method according to claim 1, characterized in that, The authentication baseline includes an authentication request baseline and an authentication response baseline. Matching the at least one second authentication request message and the at least one second authentication response message with the authentication baseline to obtain the authentication session information of the authentication interface includes: For each of the at least one second authentication request messages, match each second authentication request message with the authentication request baseline; Forward the second authentication request message that matches the authentication request baseline from the at least one second authentication request message to the zero trust server; Receive at least one second authentication response message returned by the zero-trust server; the at least one second authentication response message is an authentication response message corresponding to a second authentication request message that matches the authentication request baseline; Match each of the at least one second authentication response messages with the authentication response baseline; Parse each second authentication response message that matches the authentication response baseline in the at least one second authentication response message to obtain the first session information contained in each second authentication response message that matches the authentication response baseline; The first session information is confirmed as the authentication session information of the authentication interface.

4. The method according to claim 3, characterized in that, The at least one second authentication request message is authentication request information sent by at least one client to the authentication interface of the zero-trust server via the zero-trust gateway. Each of the at least one client sends one or more second authentication request messages. The method further includes: For each of the at least one client, count the first number of second authentication request messages that do not match the authentication request baseline, and / or the second number of second authentication response messages that do not match the authentication response baseline. Whether to mark a client as an attacking client is determined based on the first and / or second number corresponding to the client.

5. A method for authenticating session information, characterized in that, The method is applied to a zero-trust gateway, and the method includes: The system receives at least one first authentication request message sent by a zero-trust client to the authentication interface of a zero-trust server, and at least one first authentication response message sent by the zero-trust server corresponding to the at least one first authentication request message. The at least one first authentication request message and the at least one first authentication response message are forwarded to the authentication module; the at least one first authentication request message and the at least one first authentication response message are used by the authentication module to determine the authentication baseline of the authentication interface of the zero trust server; The system receives at least one second authentication request message sent by a zero-trust client to the authentication interface of the zero-trust server, and at least one second authentication response message sent by the zero-trust server corresponding to the at least one second authentication request message; the at least one second authentication request message and the at least one second authentication response message are used by the authentication module to match the at least one second authentication request message and the at least one second authentication response message with the authentication baseline to obtain the authentication session information of the authentication interface, and save the authentication session information to the target database.

6. The method according to claim 5, characterized in that, The method further includes; Upon receiving an access request message for the zero-trust server sent by the zero-trust client, the second session information included in the access request message is obtained; Search the target database to see if there is target authentication session information that matches the second session information, and obtain the search results; Based on the search results, determine whether to forward or block the access request message.

7. The method according to claim 6, characterized in that, The step of searching the target database for target authentication session information that matches the second session information, and obtaining the search results, includes: Using the second session information included in the access request message as a keyword, the authentication session information matching the keyword is searched in the target database; If no authentication session information matching the keyword exists in the target database, or if the field value of the scope in the authentication session information matching the keyword in the target database does not match the resource information accessed by the access request message, it is determined that no target authentication session information matching the second session information exists in the target database.

8. The method according to claim 6 or 7, characterized in that, The method further includes: If the search result determines that the access request message should be forwarded, the access request message is forwarded to the zero-trust server. Receive the response message returned by the zero-trust server that corresponds to the access request message; Determine whether the response message meets the predetermined conditions for session information expiration; if it does, send indication information to the authentication module; the indication information includes the second session information, and the indication information is used by the authentication module to deregister the second session information in the target database.

9. A session information authentication device, characterized in that, The device is used in the authentication module, and the device includes: The first receiving unit is configured to receive at least one first authentication request message forwarded by the zero trust gateway for the authentication interface of the zero trust server, and at least one first authentication response message corresponding to the at least one first authentication request message. The first determining unit is configured to determine the authentication baseline of the authentication interface of the zero-trust server using the at least one first authentication request message and the at least one first authentication response message. The second receiving unit is configured to receive at least one second authentication request message forwarded by the zero trust gateway for the authentication interface of the zero trust server, and at least one second authentication response message corresponding to the at least one second authentication request message. The matching unit is used to match the at least one second authentication request message and the at least one second authentication response message with the authentication baseline to obtain the authentication session information of the authentication interface, and save the authentication session information to the target database.

10. A session information authentication device, characterized in that, The device is used in a zero-trust gateway, and the device includes: The third receiving unit is configured to receive at least one first authentication request message sent by the zero-trust client to the authentication interface of the zero-trust server, and at least one first authentication response message sent by the zero-trust server corresponding to the at least one first authentication request message. The first forwarding unit is used to forward the at least one first authentication request message and the at least one first authentication response message to the authentication module; the at least one first authentication request message and the at least one first authentication response message are used by the authentication module to determine the authentication baseline of the authentication interface of the zero-trust server. The fourth receiving unit is configured to receive at least one second authentication request message sent by the zero-trust client for the authentication interface of the zero-trust server, and at least one second authentication response message sent by the zero-trust server corresponding to the at least one second authentication request message; the at least one second authentication request message and the at least one second authentication response message are used by the authentication module to match the at least one second authentication request message and the at least one second authentication response message with the authentication baseline to obtain the authentication session information of the authentication interface, and save the authentication session information to the target database.

11. An electronic device, characterized in that, The electronic device includes a memory and a processor, wherein the memory stores computer-executable instructions, and the processor, when executing the computer-executable instructions in the memory, can implement the method of any one of claims 1 to 4, or claims 5 to 8.

12. A computer storage medium, characterized in that, The storage medium stores executable instructions that, when executed by a processor, implement the method of any one of claims 1 to 4, or claims 5 to 8.

Images