A zero-trust entity security assessment method, device and system

Abstract

The present application provides a zero-trust entity security assessment method, device and system, the method comprising: after receiving a data packet, obtaining tuple information from the data packet, the tuple information including source entity information, target entity information, resource identifier and request type; if the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow the transmission of the data packet, then the data packet is sent to the zero-trust agent so that the zero-trust agent performs zero-trust access control on the data packet; if the policy configuration file does not have a target resource access policy corresponding to the tuple information, or the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit the transmission of the data packet, then the data packet is discarded. Through the scheme of the present application, the data security of the resource entity can be guaranteed.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a zero-trust entity security assessment method, device and system. Background Art

[0002] Cyber ​​Security refers to the protection of the hardware, software and data in the network system, which will not be damaged, altered or leaked due to accidental or malicious reasons, and the continuous and reliable operation of the network system and uninterrupted network services. Cyber ​​Security is based on the physical boundary defense of the firewall. The network inside the firewall is regarded as the intranet. All the office equipment and data resources of the enterprise are in the intranet, and the intranet is completely trustworthy, that is, the devices in the intranet are safe when accessing each other. With the continuous rise of emerging technologies such as cloud computing, big data, and the Internet of Things, the enterprise IT architecture is changing from "bounded" to "borderless", and the traditional security boundaries are gradually disintegrating. With the continuous advancement of new infrastructure represented by 5G and industrial Internet, the evolution process of "borderless" will be further accelerated.

[0003] Zero-trust security has gradually become a new concept and new architecture for solving network security problems in the new era. Zero-trust security represents a new generation of network security protection concepts. The key is to break the default "trust", that is, "continuous verification, never trust". By default, no one, device, or system inside or outside the enterprise network is trusted. The trust foundation of access control is rebuilt based on identity authentication and authorization to ensure that identities, devices, applications, and links are trusted. Based on zero trust, terminal security, link security, and access control security can be guaranteed. However, how to achieve zero-trust access management has not yet been effectively implemented in related technologies, that is, it is impossible to perform zero-trust access to resource entities, and the data security of resource entities cannot be guaranteed. Summary of the invention

[0004] The present application provides a zero-trust entity security assessment method, which is applied to a zero-trust gateway, wherein the zero-trust gateway stores a policy configuration file corresponding to a resource entity, wherein the policy configuration file includes multiple resource access policies, and the resource entity is deployed with a zero-trust agent. The method includes:

[0005] After receiving a data packet sent by the terminal entity to the resource entity, obtaining tuple information from the data packet, the tuple information including source entity information, target entity information, resource identifier and request type;

[0006] If the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow transmission of data packets, the data packet is sent to the zero trust agent so that the zero trust agent performs zero trust access control on the data packet;

[0007] If the policy configuration file does not contain a target resource access policy corresponding to the tuple information, or if the policy configuration file contains a target resource access policy corresponding to the tuple information and the permission type of the target resource access policy is to prohibit the transmission of data packets, the data packet is discarded.

[0008] The present application provides a zero-trust entity security assessment method, which is applied to a zero-trust agent, wherein the zero-trust agent is deployed in a resource entity, and the zero-trust agent stores a policy configuration file corresponding to the resource entity, wherein the policy configuration file includes multiple resource access policies, and the method includes:

[0009] After receiving a data packet sent by the terminal entity to the resource entity, obtaining tuple information from the data packet, the tuple information including source entity information, target entity information, resource identifier and request type;

[0010] If the policy configuration file does not contain a target resource access policy corresponding to the tuple information, or if the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit the transmission of data packets, then the data packet is discarded;

[0011] If the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow the transmission of data packets, then obtaining authentication information from the data packet, and authenticating the data packet based on the authentication information;

[0012] If the authentication of the data packet is successful, the data packet is sent to the resource entity;

[0013] If the authentication of the data packet fails, the data packet is discarded.

[0014] The present application provides a zero-trust entity security assessment device, which is applied to a zero-trust gateway, wherein the zero-trust gateway stores a policy configuration file corresponding to a resource entity, wherein the policy configuration file includes multiple resource access policies, and the resource entity is deployed with a zero-trust agent, wherein the device includes: an acquisition module, which is used to acquire tuple information from the data packet after receiving a data packet sent by a terminal entity to a resource entity, wherein the tuple information includes source entity information corresponding to the terminal entity, target entity information corresponding to the resource entity, a resource identifier, and a request type;

[0015] A sending module, configured to send the data packet to the zero trust agent if the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow the transmission of the data packet, so that the zero trust agent performs zero trust access control on the data packet;

[0016] A processing module is used to discard the data packet if the policy configuration file does not contain a target resource access policy corresponding to the tuple information, or the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit the transmission of data packets.

[0017] The present application provides a zero-trust entity security assessment system, the zero-trust entity security assessment system comprising: a zero-trust gateway and a zero-trust agent, the zero-trust gateway stores a policy configuration file corresponding to a resource entity, the zero-trust agent is deployed in the resource entity, the zero-trust agent stores a policy configuration file corresponding to the resource entity, the policy configuration file includes multiple resource access policies, wherein:

[0018] The zero-trust gateway is used to obtain tuple information from a data packet after receiving a data packet sent by a terminal entity to a resource entity, wherein the tuple information includes source entity information, target entity information, resource identifier, and request type; if the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow transmission of data packets, then the data packet is sent to the zero-trust agent; if the policy configuration file does not have a target resource access policy corresponding to the tuple information, or the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit transmission of data packets, then the data packet is discarded;

[0019] The zero-trust agent is used to obtain tuple information from the data packet after receiving the data packet, and the tuple information includes source entity information, target entity information, resource identifier and request type; if the policy configuration file does not have a target resource access policy corresponding to the tuple information, or the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit the transmission of data packets, then the data packet is discarded; if the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow the transmission of data packets, then authentication information is obtained from the data packet, and the data packet is authenticated based on the authentication information; if the authentication of the data packet is successful, the data packet is sent to the resource entity; if the authentication of the data packet fails, the data packet is discarded.

[0020] The present application provides an electronic device, comprising: a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor; the processor is used to execute the machine-executable instructions to implement the zero-trust entity security assessment method of the above example.

[0021] The present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the zero-trust entity security assessment method of the above example.

[0022] The present application provides a machine-readable storage medium, which stores machine-executable instructions that can be executed by a processor; wherein the processor is used to execute the machine-executable instructions to implement the above-mentioned zero-trust entity security assessment method.

[0023] As can be seen from the above technical solutions, in the embodiment of the present application, the zero-trust gateway stores the policy configuration file corresponding to the resource entity, and the policy configuration file includes multiple resource access policies corresponding to multiple service resources of the resource entity. Based on the policy configuration file, the data packet is managed with zero-trust access, thereby performing zero-trust access on the resource entity, realizing the management of zero-trust access, and ensuring the data security of the resource entity. It is possible to achieve secure access to the zero-trust network for various resources of the resource entity, realize the combing and security management of each entity in zero trust, and the security management of access between entities, ensuring the overall network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a flowchart of a zero-trust entity security assessment method in one implementation of the present application;

[0025] Figure 2 It is a flowchart of a zero-trust entity security assessment method in one implementation of the present application;

[0026] Figure 3 It is a structural diagram of a zero-trust entity security assessment system in one embodiment of the present application;

[0027] Figure 4 is a schematic diagram of a resource entity registration process in one implementation of the present application;

[0028] Figure 5 is a schematic diagram of a zero-trust access management process for a data packet in one embodiment of the present application;

[0029] Figure 6 It is a schematic diagram of a permission policy update process of a resource entity in one implementation mode of the present application;

[0030] Figure 7A-7Cis a schematic diagram of a model structure in one embodiment of the present application;

[0031] Fig. 8A It is a structural schematic diagram of a zero-trust entity security assessment device in one embodiment of the present application;

[0032] Figure 8B It is a structural schematic diagram of a zero-trust entity security assessment device in one embodiment of the present application;

[0033] Fig. 9 It is a hardware structure diagram of an electronic device in one embodiment of the present application. DETAILED DESCRIPTION

[0034] A zero-trust entity security assessment method is proposed in an embodiment of the present application. The method can be applied to a zero-trust gateway. The zero-trust gateway can store a policy configuration file corresponding to a resource entity, and the policy configuration file can include multiple resource access policies. The resource entity can be deployed with a zero-trust agent.

[0035] See also Figure 1 FIG. 4 is a flow chart of the method, which may include:

[0036] Step 101: After receiving a data packet sent by a terminal entity to a resource entity, tuple information is obtained from the data packet, where the tuple information includes source entity information, target entity information, resource identifier, and request type.

[0037] Step 102: If the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow the transmission of data packets, the data packet is sent to the zero trust agent so that the zero trust agent performs zero trust access control on the data packet.

[0038] Step 103: If the policy configuration file does not contain a target resource access policy corresponding to the tuple information, or if the policy configuration file contains a target resource access policy corresponding to the tuple information and the permission type of the target resource access policy is to prohibit the transmission of data packets, the data packet is discarded.

[0039] Exemplarily, before the zero-trust gateway stores the policy configuration file corresponding to the resource entity, it may also include: sending an entity configuration request to the zero-trust agent, receiving the entity configuration response returned by the zero-trust agent, the entity configuration response may include the entity information and resource identification list of the resource entity, and the resource identification list includes the resource identification of multiple service resources supported by the resource entity. For each service resource, the entity information and request type of the terminal entity that is allowed to access the service resource, and / or the entity information and request type of the terminal entity that is prohibited from accessing the service resource are obtained. A resource access policy corresponding to the service resource is generated, the resource access policy including the entity information of the resource entity, the entity information of the terminal entity, the resource identification of the service resource, and the request type of the terminal entity; wherein, if the terminal entity is allowed to access the service resource using the request type, the permission type of the resource access policy is to allow the transmission of data packets; if the terminal entity is prohibited from accessing the service resource using the request type, the permission type of the resource access policy is to prohibit the transmission of data packets. A policy configuration file is generated based on the resource access policy corresponding to each service resource.

[0040] Exemplarily, after the zero-trust gateway stores the policy configuration file corresponding to the resource entity, it may also include: generating a public key and a private key for the resource entity based on an asymmetric algorithm, and sending the public key to the zero-trust agent; receiving a first random number returned by the zero-trust agent, where the first random number is obtained by encrypting a second random number generated by the zero-trust agent itself using a public key; decrypting the first random number using a private key to obtain a second random number, encrypting the policy configuration file using a symmetric algorithm based on the second random number to obtain an encrypted policy configuration file; sending the encrypted policy configuration file to the zero-trust agent, so that the zero-trust agent decrypts the encrypted policy configuration file using a symmetric algorithm based on the second random number to obtain the policy configuration file, and performing zero-trust access control on the data packet based on the policy configuration file.

[0041] Exemplarily, after receiving a response data packet sent by a resource entity to a terminal entity, a security check may be performed on the resource files in the response data packet; if the security check result indicates that the resource file contains information of a specified type, the response data packet is discarded; if the security check result indicates that the resource file does not contain information of a specified type, the response data packet is sent to the terminal entity. The specified type of information may include, but is not limited to, sensitive information and / or confidential information. The security check on the resource files in the response data packet may include, but is not limited to: building an independent virtual space in a zero-trust gateway, running a sandbox in the independent virtual space, and performing a security check on the resource files in the response data packet through the sandbox.

[0042] Exemplarily, after the zero-trust gateway stores the policy configuration file corresponding to the resource entity, it may also include: statically checking the system basic configuration information and / or system file information of the resource entity to obtain a static security score; the system basic configuration information represents the information of the system basic configuration associated with security, and the system file information represents the information of the system file associated with security. Dynamically checking the access behavior information of the resource entity to obtain a dynamic security score; the access behavior information indicates whether the response data packet sent by the resource entity contains information of a specified type. Determine the target security score based on the static security score and the dynamic security score; if the target security score is less than a preset threshold, query the resource access policy corresponding to the resource entity from the policy configuration file, and modify the permission type of the resource access policy to prohibit the transmission of data packets.

[0043] Exemplarily, for each resource access policy, the policy configuration file also includes the last access time of the resource access policy; after each receipt of a data packet matching the resource access policy, the reception time of the data packet is updated to the last access time of the resource access policy;

[0044] If the time interval between the current time and the last access time of the resource access policy is greater than a preset time threshold, the resource access policy may be deleted from the policy configuration file.

[0045] Exemplarily, after the zero-trust gateway stores the policy configuration file corresponding to the resource entity, it may also include: obtaining data to be detected of at least one data type corresponding to the resource entity; for each data type, inputting the data to be detected of the data type into the target base class model of the data type to obtain the target data feature corresponding to the data type; splicing the target data features corresponding to all data types to obtain the target multimodal feature corresponding to the resource entity. The target multimodal feature is input into multiple trained target classification models to obtain the initial security score output by each target classification model; wherein, multiple target classification models can use the same network structure, and multiple target classification models can use different network parameters. Determine the target security score based on the initial security score output by each target classification model; wherein, the smaller the target security score, the lower the security of the data to be detected. If the target security score is less than the preset threshold, the resource access policy corresponding to the resource entity can be queried from the policy configuration file, and the permission type of the resource access policy can be modified to prohibit the transmission of data packets.

[0046] As can be seen from the above technical solutions, in the embodiment of the present application, the zero-trust gateway stores the policy configuration file corresponding to the resource entity, and the policy configuration file includes multiple resource access policies corresponding to multiple service resources of the resource entity. Based on the policy configuration file, the data packet is managed with zero-trust access, thereby performing zero-trust access on the resource entity, realizing the management of zero-trust access, and ensuring the data security of the resource entity. It is possible to achieve secure access to the zero-trust network for various resources of the resource entity, realize the combing and security management of each entity in zero trust, and the security management of access between entities, ensuring the overall network security.

[0047] A zero-trust entity security assessment method is proposed in an embodiment of the present application. The method can be applied to a zero-trust agent, and the zero-trust agent can be deployed in a resource entity. The zero-trust agent can store a policy configuration file corresponding to the resource entity, and the policy configuration file can include multiple resource access policies.

[0048] See also Figure 2 FIG. 4 is a flow chart of the method, which may include:

[0049] Step 201: After receiving a data packet sent by a terminal entity to a resource entity, tuple information is obtained from the data packet, where the tuple information includes source entity information, target entity information, resource identifier, and request type.

[0050] Step 202: If the policy configuration file does not contain a target resource access policy corresponding to the tuple information, or if the policy configuration file contains a target resource access policy corresponding to the tuple information and the permission type of the target resource access policy is to prohibit transmission of data packets, the data packet is discarded.

[0051] Step 203: If the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow transmission of data packets, then authentication information is obtained from the data packet, and the data packet is authenticated based on the authentication information.

[0052] Step 204: If the authentication of the data packet is successful, the data packet is sent to the resource entity.

[0053] Step 205: If the authentication of the data packet fails, the data packet is discarded.

[0054] Exemplarily, before the zero-trust agent stores the policy configuration file corresponding to the resource entity, it may also include: receiving an entity configuration request sent by the zero-trust gateway, returning an entity configuration response to the zero-trust gateway, the entity configuration response including the entity information and resource identifier list of the resource entity, and the resource identifier list including the resource identifiers of multiple service resources supported by the resource entity, so that the zero-trust gateway generates a resource access policy corresponding to each service resource based on the entity configuration response, and generates a policy configuration file based on the resource access policy corresponding to each service resource. Wherein, for each service resource, the resource access policy corresponding to the service resource includes the entity information of the resource entity, the entity information of the terminal entity, the resource identifier of the service resource, and the request type of the terminal entity; if the terminal entity is allowed to access the service resource using the request type, the permission type of the resource access policy is to allow the transmission of data packets; if the terminal entity is prohibited from accessing the service resource using the request type, the permission type of the resource access policy is to prohibit the transmission of data packets.

[0055] Exemplarily, before the zero-trust agent stores the policy configuration file corresponding to the resource entity, it may also include: receiving a public key sent by the zero-trust gateway, where the public key is generated by the zero-trust gateway for the resource entity based on an asymmetric algorithm; generating a second random number, encrypting the second random number with the public key to obtain a first random number, and sending the first random number to the zero-trust gateway so that the zero-trust gateway uses a private key to decrypt the first random number to obtain a second random number. Receive an encrypted policy configuration file sent by the zero-trust gateway, where the encrypted policy configuration file is obtained by encrypting the policy configuration file using a symmetric algorithm based on the second random number. Decrypt the encrypted policy configuration file using a symmetric algorithm based on the second random number to obtain a policy configuration file, and then store the policy configuration file to implement zero-trust access control.

[0056] Exemplarily, after receiving a response data packet sent by a resource entity to a terminal entity, a security check may be performed on the resource files in the response data packet; if the security check result indicates that the resource file contains information of a specified type, the response data packet is discarded; if the security check result indicates that the resource file does not contain information of a specified type, the response data packet is sent to a zero-trust gateway. The specified type of information may include, but is not limited to, sensitive information and / or confidential information. The security check on the resource files in the response data packet may include, but is not limited to: constructing an independent virtual space in the resource entity, running a sandbox in the independent virtual space, and performing a security check on the resource files in the response data packet through the sandbox.

[0057] As can be seen from the above technical solutions, in the embodiment of the present application, the zero-trust gateway stores the policy configuration file corresponding to the resource entity, and the policy configuration file includes multiple resource access policies corresponding to multiple service resources of the resource entity. Based on the policy configuration file, the data packet is managed with zero-trust access, thereby performing zero-trust access on the resource entity, realizing the management of zero-trust access, and ensuring the data security of the resource entity. It is possible to achieve secure access to the zero-trust network for various resources of the resource entity, realize the combing and security management of each entity in zero trust, and the security management of access between entities, ensuring the overall network security.

[0058] The technical solution of the embodiment of the present application is described below in conjunction with specific application scenarios.

[0059] In the embodiment of the present application, a zero-trust entity security assessment method is proposed, which can be applied to a zero-trust entity security assessment system. Figure 3 As shown, it is a structural diagram of the zero-trust entity security assessment system. The zero-trust entity security assessment system may include but is not limited to resource entities, zero-trust gateways and terminal entities.

[0060] Resource entities can be hardware entities or software entities. Hardware entities can be hardware platforms or hardware devices, such as video management platforms, view management platforms, and integrated video management platforms. There are no restrictions on hardware entities, as long as they can provide service resources for terminal entities. Software entities can be software services or software applications, such as facial query services and vehicle query services. There are no restrictions on software entities, as long as they can provide service resources for terminal entities. Service resources can be any resource that can be accessed by the terminal entity, such as any resource that can be queried or any resource that can be downloaded. There are no restrictions on this.

[0061] The resource entity needs to install a zero-trust agent. For example, the person in charge of the resource entity installs the zero-trust agent. The zero-trust agent can be in the form of software or hardware.

[0062] For example, if the resource entity is a software entity, you can install a zero-trust agent in software form, such as downloading a zero-trust agent in software form on the device where the software entity is located, or you can install a zero-trust agent in hardware form, such as inserting a zero-trust agent in hardware form into the device where the software entity is located. If the resource entity is a hardware entity, you can install a zero-trust agent in software form, such as downloading a zero-trust agent in software form on the hardware entity, or you can install a zero-trust agent in hardware form, such as inserting a zero-trust agent in hardware form into the hardware entity.

[0063] For example, if a resource entity provides a single system independent service with a single hardware, a hardware-based zero trust agent can be installed. If a resource entity provides services with a virtual cloud service, a software-based zero trust agent can be installed. If a resource entity provides services with a single hardware container, a software-based zero trust agent can be installed. Of course, the above are just examples, and there is no restriction on this installation method.

[0064] For hardware-based zero-trust agents, zero-trust agents can be implemented through USBKey, which is a hardware device with a USB interface. USBKey has a built-in intelligent processing circuit and a certain storage space, and can be used for login authentication. In this embodiment, USBKey can be used as a zero-trust agent and installed on a resource entity, thereby implementing zero-trust access management through USBKey.

[0065] The terminal entity is any entity that can access the service resources of the resource entity, such as a personal computer, laptop, smart phone, etc. There is no restriction on the type of this terminal entity. The terminal entity can install a zero-trust agent or not. If the terminal entity installs a zero-trust agent, the person in charge of the terminal entity shall install the zero-trust agent, and the zero-trust agent is a hardware-based zero-trust agent. For hardware-based zero-trust agents, the zero-trust agent can be implemented through a USBKey, that is, the USBKey is used as a zero-trust agent and installed on the terminal entity to achieve zero-trust access management.

[0066] The zero-trust gateway is located between the terminal entity and the resource entity. When the terminal entity sends a data packet to the resource entity, the data packet will pass through the zero-trust gateway, and the zero-trust gateway will perform zero-trust access management on the data packet. When the resource entity sends a response data packet to the terminal entity, the response data packet will also pass through the zero-trust gateway, and the zero-trust gateway will perform zero-trust access management on the response data packet.

[0067] In the above application scenario, this embodiment involves a resource entity registration process, a terminal entity registration process, a zero-trust access management process for data packets, a zero-trust access management process for response data packets, a resource entity permission policy update process, a resource entity permission policy cancellation process, and a resource entity security management process (i.e., updating permission policies for unsafe resource entities), which are explained below.

[0068] First, the resource entity registration process, that is, the automated registration process of the resource entity.

[0069] See also Figure 4 FIG. 1 is a schematic diagram of a resource entity registration process, which may include:

[0070] Step 401: The zero trust gateway sends an entity configuration request to the zero trust agent.

[0071] Step 402: The zero trust agent returns an entity configuration response to the zero trust gateway.

[0072] For example, the zero trust gateway can send entity configuration requests via broadcast packets (such as LAN broadcasts or cross-VLAN broadcasts, etc.). For resource entities that have installed zero trust agents, after receiving the entity configuration request, the zero trust agent can return an entity configuration response to the zero trust gateway.

[0073] Exemplarily, the entity configuration request is used to request entity information and a resource identifier list of a resource entity. Therefore, the entity configuration response may include entity information and a resource identifier list of the resource entity, and the resource identifier list may include resource identifiers of multiple service resources supported by the resource entity.

[0074] For example, the entity information of the resource entity may include an entity identifier of the resource entity and / or an IP address of the resource entity. The entity identifier is used to represent a unique identifier of the resource entity, such as a device identifier.

[0075] For example, the resource identification list can also be called a resource description list. Assuming that the resource entity supports service resource a1, service resource a2, and service resource a3, the resource identification list may include the resource identification of service resource a1, the resource identification of service resource a2, and the resource identification of service resource a3. The resource identification may be a unique identification of the service resource, such as an API interface, an STP directory, etc. as a resource identification.

[0076] In addition to entity information and a list of resource identifiers, the entity configuration response may also include a resource description for each service resource. The resource description is used to describe the service resource, such as whether the service resource allows access using GET or POST, etc. There is no restriction on this resource description.

[0077] Step 403: For each service resource supported by the resource entity, the zero trust gateway obtains the entity information and request type of the terminal entity that is allowed to access the service resource (i.e., the terminal entity is allowed to access the service resource using the request type), and / or the zero trust gateway obtains the entity information and request type of the terminal entity that is prohibited from accessing the service resource (i.e., the terminal entity is prohibited from accessing the service resource using the request type).

[0078] For example, the user may configure the entity information and request type of the terminal entity that is allowed to access the service resource, and the user may configure the entity information and request type of the terminal entity that is prohibited from accessing the service resource.

[0079] The user can refer to the resource description of the service resource to learn which request types are allowed to access the service resource and which request types are prohibited from accessing the service resource, and the user can learn which terminal entities are allowed to access the service resource and which terminal entities are prohibited from accessing the service resource. On this basis, the entity information and request types of the terminal entities that are allowed to access the service resource can be configured, and the entity information and request types of the terminal entities that are prohibited from accessing the service resource can be configured, and there is no restriction on this process.

[0080] For example, the zero trust gateway can determine the entity information and request type of the terminal entity that is allowed to access the service resources, and determine the entity information and request type of the terminal entity that is prohibited from accessing the service resources.

[0081] The zero-trust gateway refers to the resource description of the service resource to learn which request types are allowed to access the service resource and which request types are prohibited from accessing the service resource. The zero-trust gateway can learn the IP network segment that is allowed to access the service resource. Obviously, terminal entities within the IP network segment are allowed to access the service resource, while terminal entities outside the IP network segment are prohibited from accessing the service resource. On this basis, the zero-trust gateway can determine the entity information and request type of the terminal entity that is allowed to access the service resource, and determine the entity information and request type of the terminal entity that is prohibited from accessing the service resource, without limiting this process.

[0082] The request type may be a request type of a data packet, and the request type may be GET (query), POST (add), PUT (modify), DELETE (delete), etc. There is no restriction on this request type.

[0083] Step 404: For each service resource supported by the resource entity, the zero-trust gateway generates a resource access policy corresponding to the service resource. The resource access policy includes the entity information of the resource entity, the entity information of the terminal entity, the resource identifier of the service resource, and the request type of the terminal entity.

[0084] Exemplarily, if the terminal entity is allowed to access the service resource using the request type, the permission type of the resource access policy may be to allow data packets to be transmitted. If the terminal entity is prohibited from accessing the service resource using the request type, the permission type of the resource access policy may be to prohibit data packets from being transmitted.

[0085] For example, for service resource a1, if terminal entity 1 is allowed to access the service resource using GET, and terminal entity 1 is prohibited from accessing the service resource using DELETE, then resource access policy b1 and resource access policy b2 corresponding to service resource a1 are generated. Resource access policy b1 includes entity information of resource entity, entity information of terminal entity 1, resource identifier of service resource a1, and request type GET. The permission type of resource access policy b1 is to allow data packets to be transmitted. Resource access policy b2 includes entity information of resource entity, entity information of terminal entity 1, resource identifier of service resource a1, and request type DELETE. The permission type of resource access policy b2 is to prohibit data packets from being transmitted. If terminal entity 2 is allowed to access the service resource using GET, then resource access policy b3 corresponding to service resource a1 is generated. Resource access policy b3 includes entity information of resource entity, entity information of terminal entity 2, resource identifier of service resource a1, and request type GET. The permission type of resource access policy b3 is to allow data packets to be transmitted.

[0086] Obviously, for each service resource supported by the resource entity, multiple resource access policies corresponding to the service resource can be obtained, and these resource access policies can also correspond to multiple terminal entities.

[0087] Step 405: The zero-trust gateway generates a policy configuration file based on the resource access policy corresponding to each service resource. For example, the policy configuration file includes multiple resource access policies corresponding to service resource a1, multiple resource access policies corresponding to service resource a2, and multiple resource access policies corresponding to service resource a3.

[0088] At this point, the zero-trust gateway generates a policy configuration file for the resource entity. When there are multiple resource entities, a policy configuration file needs to be generated separately for each resource entity. Here, one resource entity is taken as an example.

[0089] Step 406: The zero trust gateway generates a public key and a private key for the resource entity based on an asymmetric algorithm, and sends the public key to the zero trust agent, which receives the public key sent by the zero trust gateway.

[0090] For example, the zero-trust gateway can encode the public key using base64 encoding and send the encoded public key to the zero-trust agent. After receiving the encoded public key, the zero-trust agent decodes the encoded public key using base64 decoding to obtain the public key before encoding.

[0091] Step 407: The zero-trust agent generates a second random number, encrypts the second random number using a public key to obtain a first random number, and sends the first random number to the zero-trust gateway. The zero-trust gateway receives the first random number, and decrypts the first random number using a private key to obtain a second random number.

[0092] Step 408: Based on the second random number, the zero trust gateway uses a symmetric algorithm to encrypt the policy configuration file to obtain an encrypted policy configuration file, and sends the encrypted policy configuration file to the zero trust agent.

[0093] Exemplarily, after obtaining the second random number, the second random number may be used as a symmetric key of a symmetric algorithm, so that the policy configuration file may be encrypted using the symmetric algorithm.

[0094] Step 409: The zero trust agent receives the encrypted policy configuration file, and based on the second random number, uses a symmetric algorithm to decrypt the encrypted policy configuration file to obtain the policy configuration file.

[0095] Exemplarily, the zero trust agent may use the second random number (generated by itself) as a symmetric key of a symmetric algorithm, so that the encrypted policy configuration file may be decrypted using the symmetric algorithm.

[0096] In summary, the zero trust gateway can obtain the policy configuration file corresponding to the resource entity and store the policy configuration file. In addition, the zero trust agent (the zero trust agent deployed on the resource entity) can also obtain the policy configuration file corresponding to the resource entity and store the policy configuration file.

[0097] Second, the terminal entity registration process.

[0098] If the terminal entity installs a zero-trust agent, the zero-trust agent can send a permission request message to the zero-trust gateway. The zero-trust gateway queries all resource access policies associated with the terminal entity from the policy configuration file, that is, the resource access policy includes the entity information of the terminal entity (such as IP address).

[0099] Then, the zero-trust gateway sends a permission response message to the zero-trust agent, which may include all resource access policies associated with the terminal entity, so that the zero-trust agent can obtain these resource access policies and then write them into the zero-trust agent. For example, the zero-trust gateway can also encrypt these resource access policies before transmission, and the zero-trust agent decrypts them.

[0100] Exemplarily, the zero-trust gateway can also use an asymmetric algorithm to generate a public key and a private key for the terminal entity, and write the public key into the zero-trust agent. In this way, when the zero-trust agent sends a data packet to the zero-trust gateway, it can use the public key to encrypt the data packet and send the encrypted data packet to the zero-trust gateway. The zero-trust gateway can use the private key to decrypt the encrypted data packet to obtain a decrypted data packet.

[0101] Third, the zero-trust access management process for data packets. Figure 5 As shown, it is a schematic diagram of the zero trust access management process of a data packet, and the zero trust access management process may include:

[0102] Step 501: The terminal entity sends a data packet to the resource entity.

[0103] Exemplarily, if the terminal entity does not have a zero-trust agent installed, the terminal entity directly sends the data packet to the zero-trust gateway. If the terminal entity has a zero-trust agent installed, the zero-trust agent can intercept the data packet.

[0104] After receiving the data packet, the zero-trust agent can obtain tuple information from the data packet. The tuple information may include source entity information (such as entity information of the terminal entity), target entity information (such as entity information of the resource entity), resource identifier and request type (such as GET, PUT, etc.).

[0105] If there is a target resource access policy corresponding to the tuple information among all resource access policies stored locally by the zero trust agent, and the permission type of the target resource access policy is to allow the transmission of data packets, the zero trust agent sends the data packet to the zero trust gateway. When sending the data packet to the zero trust gateway, the zero trust agent can encrypt the data packet using a public key and send the encrypted data packet to the zero trust gateway.

[0106] If there is no target resource access policy corresponding to the tuple information among all resource access policies locally stored by the zero trust agent, or if there is a target resource access policy corresponding to the tuple information among all resource access policies locally stored by the zero trust agent, and the permission type of the target resource access policy is to prohibit the transmission of data packets, the zero trust agent discards the data packet and does not send the data packet to the zero trust gateway.

[0107] At this point, the zero-trust agent can take over the network permissions of the terminal entity and implement zero-trust access management on the terminal entity, that is, the zero-trust agent can implement zero-trust access control of data packets.

[0108] Step 502: The zero-trust gateway receives a data packet sent by the terminal entity to the resource entity.

[0109] Step 503: After receiving the data packet, the zero-trust gateway obtains tuple information from the data packet. The tuple information may include source entity information, target entity information, resource identifier, and request type.

[0110] Exemplarily, the source entity information may be entity information of a terminal entity, such as an IP address of the terminal entity, etc., and the data packet may include entity information of the terminal entity, so the zero-trust gateway may obtain entity information of the terminal entity from the data packet. In addition, the target entity information may be entity information of a resource entity, such as an IP address and / or entity identifier of the resource entity, and the data packet may include entity information of the resource entity, so the zero-trust gateway may obtain entity information of the resource entity from the data packet.

[0111] The data packet may also include a resource identifier, indicating that the terminal entity needs to request the service resource corresponding to the resource identifier, so the zero trust gateway can obtain the resource identifier from the data packet. The data packet may also include a request type, so the zero trust gateway can obtain the request type from the data packet.

[0112] Step 504: The zero-trust gateway queries the policy configuration file through the tuple information to determine whether the policy configuration file contains a target resource access policy corresponding to the tuple information.

[0113] If no, step 505 may be executed, and if yes, step 506 may be executed.

[0114] Step 505: The zero-trust gateway discards the data packet, that is, does not send the data packet to the resource entity.

[0115] Step 506: The zero-trust gateway determines whether the permission type of the target resource access policy is to allow the transmission of data packets. If yes, that is, the permission type is to allow the transmission of data packets, then step 507 can be executed. If no, that is, the permission type is to prohibit the transmission of data packets, then step 505 can be executed, that is, the data packet is discarded.

[0116] Step 507: The zero trust gateway sends the data packet to the resource entity, and then executes step 508.

[0117] Exemplarily, since the tuple information includes source entity information, target entity information, resource identifier and request type, and the resource access policy includes entity information of the resource entity, entity information of the terminal entity, resource identifier of the service resource, and request type of the terminal entity, therefore, for a certain resource access policy, if the source entity information in the tuple information is the same as the entity information of the terminal entity in the resource access policy, and the target entity information in the tuple information is the same as the entity information of the resource entity in the resource access policy, and the resource identifier in the tuple information is the same as the resource identifier in the resource access policy, and the request type in the tuple information is the same as the request type in the resource access policy, then it is determined that the resource access policy is the target resource access policy corresponding to the tuple information. Otherwise, if any of the above items is not true, it is determined that the resource access policy is not the target resource access policy corresponding to the tuple information.

[0118] After obtaining the target resource access policy, the permission type of the target resource access policy may also be determined. The permission type may be to allow transmission of data packets or to prohibit transmission of data packets.

[0119] In a possible implementation, the resource access policy may also include a protocol type, i.e., a protocol type of a data packet, such as a TCP type, a UDP type, etc., and the tuple information may also include a protocol type. Based on this, if the protocol type in the tuple information is different from the protocol type in the resource access policy, it is determined that the resource access policy is not the target resource access policy corresponding to the tuple information. If the protocol type in the tuple information is the same as the protocol type in the resource access policy, combined with the comparison of other conditions, it can be determined whether the resource access policy is the target resource access policy corresponding to the tuple information.

[0120] In a possible implementation, before sending the data packet to the resource entity, the zero-trust gateway may also check whether the data packet contains attack behaviors, such as SQL (Structured Query Language) injection, XSS (Cross-Site Scripting) attack, and other attack behaviors. If so, the data packet is discarded; if not, the data packet is sent to the resource entity.

[0121] In a possible implementation, the resource entity itself acts as a resource provider, and the resource access policy includes a set of resource identifiers that can access the resource entity and the entity that the resource entity can access, and specifically also includes a list of specific resources or interfaces that the resource entity can access. The terminal entity acts as a resource accessor or requestor, and the resource access policy includes a set of resource identifiers that can access the resource entity, and specifically also includes a list of specific resources or interfaces that each terminal entity can access. There is no restriction on this resource access policy.

[0122] Step 508: The resource entity receives the data packet sent by the terminal entity to the resource entity, and the zero-trust agent of the resource entity intercepts the data packet, that is, the zero-trust agent receives the data packet sent by the terminal entity to the resource entity.

[0123] Step 509: After receiving the data packet, the zero trust agent obtains tuple information from the data packet. The tuple information may include source entity information, target entity information, resource identifier, and request type.

[0124] Exemplarily, the processing process of step 509 can refer to step 503, which will not be described in detail here.

[0125] Step 510: The zero trust agent queries the policy configuration file through the tuple information to determine whether the policy configuration file contains a target resource access policy corresponding to the tuple information.

[0126] If no, step 511 may be executed, and if yes, step 512 may be executed.

[0127] Step 511: The zero-trust agent discards the data packet, that is, does not send the data packet to the resource entity.

[0128] Step 512: The zero trust agent determines whether the permission type of the target resource access policy is to allow the transmission of data packets. If yes, that is, the permission type is to allow the transmission of data packets, then step 513 can be executed. If no, that is, the permission type is to prohibit the transmission of data packets, then step 511 can be executed, that is, the data packet is discarded.

[0129] Step 513: The zero-trust agent obtains authentication information from the data packet, authenticates the data packet based on the authentication information, and determines whether the authentication of the data packet is successful.

[0130] If yes, that is, the authentication of the data packet succeeds, step 514 may be executed; if no, that is, the authentication of the data packet fails, step 515 may be executed.

[0131] Step 514: The zero trust agent sends the data packet to the resource entity.

[0132] Step 515: The zero-trust agent discards the data packet, that is, does not send the data packet to the resource entity.

[0133] For example, the authentication information may be information such as a user name and password, and the zero-trust agent may authenticate the data packet based on the user name and password. Alternatively, the authentication information may be token information, and the zero-trust agent may authenticate the data packet based on the token information. Alternatively, the authentication information may be token information, and the zero-trust agent may authenticate the data packet based on the token information.

[0134] Of course, the above are just a few examples of authentication and there is no limitation on the authentication process.

[0135] At this point, the zero-trust agent can take over the network permissions of the resource entity and implement zero-trust access management on the resource entity, that is, the zero-trust agent can implement zero-trust access control of data packets.

[0136] Fourth, the zero-trust access management process of the response data packet.

[0137] The resource entity sends a response data packet (i.e., a response packet to the data packet) to the terminal entity.

[0138] If the resource entity has a zero-trust agent installed, the zero-trust agent can intercept the response data packet. The zero-trust agent can perform a security check on the resource file in the response data packet. If the security check result indicates that the resource file contains information of the specified type, the zero-trust agent discards the response data packet and does not send the response data packet to the zero-trust gateway. If the security check result indicates that the resource file does not contain information of the specified type, the zero-trust agent can send the response data packet to the zero-trust gateway.

[0139] Exemplarily, the specified type of information is information that is prohibited from being disclosed, and the specified type of information may include but is not limited to sensitive information and / or confidential information, and there is no restriction on this specified type of information.

[0140] Exemplarily, the zero trust agent can check whether the resource file of the response data packet (i.e., the resource file requested by the terminal entity) contains information of a specified type. If so, the zero trust agent discards the response data packet; if not, the zero trust agent sends the response data packet to the zero trust gateway.

[0141] In one possible implementation, in order to perform a security check on the resource files in the response data packet, the zero trust agent can build an independent virtual space in the resource entity, run a sandbox in the independent virtual space, and perform a security check on the resource files in the response data packet through the sandbox to obtain a security check result.

[0142] For example, the zero-trust agent builds an independent virtual space inside the resource entity and runs a sandbox in the independent virtual space. The sandbox is a security software that constructs a container to allow various operations to be performed, such as file-related operations, system-related operations, etc., and can perform kernel-level detection and container restoration on these operations.

[0143] For response data packets that need to be sent out, the zero-trust agent can send the response data packets to the sandbox, and perform security checks on the resource files in the response data packets through the sandbox. For example, if the terminal entity requests a resource file of the resource entity (such as a picture containing a license plate, a picture containing a face, etc.), the response data packet can include the resource file, and the resource file in the response data packet can be security checked through the sandbox to determine whether the resource file contains information of a specified type. There is no restriction on the sandbox check process. Obviously, by performing security checks on resource files through the sandbox, the scope of influence of malicious file requests or malicious programs can be controlled to be limited to the virtual environment (i.e., an independent virtual space).

[0144] If the zero-trust agent sends the response data packet to the zero-trust gateway, the zero-trust gateway can intercept the response data packet and perform a security check on the resource file in the response data packet. If the security check result indicates that the resource file contains information of the specified type, the zero-trust gateway discards the response data packet and does not send the response data packet to the terminal entity. If the security check result indicates that the resource file does not contain information of the specified type, the zero-trust gateway can send the response data packet to the terminal entity.

[0145] Exemplarily, the zero-trust gateway may check whether the resource file of the response data packet (i.e., the resource file requested by the terminal entity) contains information of a specified type. If so, the zero-trust gateway discards the response data packet; if not, the zero-trust gateway sends the response data packet to the terminal entity.

[0146] In one possible implementation, in order to perform a security check on the resource files in the response data packet, the zero trust gateway can build an independent virtual space on the zero trust gateway, run a sandbox in the independent virtual space, and perform a security check on the resource files in the response data packet through the sandbox to obtain a security check result.

[0147] If the zero-trust gateway sends the response data packet to the terminal entity, the zero-trust agent of the terminal entity can intercept the response data packet and send the response data packet to the terminal entity. Of course, the zero-trust agent of the terminal entity can also perform a security check on the resource file in the response data packet. If the security check result indicates that the specified type of information exists in the resource file, the response data packet is discarded. If the security check result indicates that the specified type of information does not exist in the resource file, the response data packet is sent to the terminal entity.

[0148] Fifth, the resource entity's permission policy update process. Figure 6 FIG. 1 is a schematic diagram of a rights policy update process of a resource entity. The rights policy update process may include:

[0149] Step 601: The zero-trust gateway performs a static check on the system basic configuration information and / or system file information of the resource entity to obtain a static security score. The system basic configuration information represents information on the system basic configuration associated with security, and the system file information represents information on the system files associated with security.

[0150] For example, the initial value of the static security score is a first value (such as 50 points). If the system basic configuration information indicates that the system basic configuration will lead to reduced security, the static security score is lowered. For example, if the resource entity is not configured with a password update policy (that is, the system basic configuration is the password update policy, and the system basic configuration will lead to reduced security), the static security score is lowered, such as by 5 points. For another example, if the password strength of the resource entity is insufficient (that is, the system basic configuration is the password strength, and the system basic configuration will lead to reduced security), the static security score is lowered, such as by 5 points. Of course, the above are just two examples of statically checking the system basic configuration information of the resource entity, and there is no limitation to this.

[0151] For example, if the system file information indicates that the system file will cause security to be reduced, the static security score will be reduced. For example, if a malicious program exists in the resource entity (i.e., the malicious program is a system file, and the system file will cause security to be reduced), the static security score will be reduced, such as by 5 points. For another example, if a security defect service exists in the resource entity (i.e., the security defect service is a system file, and the system file will cause security to be reduced), the static security score will be reduced, such as by 5 points. Of course, the above are just two examples of statically checking the system file information of a resource entity, and there is no limitation to this.

[0152] In summary, on the basis of the initial value of the static security score, the static security score is reduced based on the system basic configuration information and / or system file information to obtain a reduced static security score.

[0153] Step 602: The zero-trust gateway dynamically checks the access behavior information of the resource entity to obtain a dynamic security score. The access behavior information indicates whether the response data packet sent by the resource entity contains information of a specified type.

[0154] For example, the initial value of the dynamic security score is a second value (such as 50 points). If the response data packet sent by the resource entity contains information of a specified type (such as sensitive information and / or confidential information), the dynamic security score is reduced. Each time the resource entity sends a response data packet containing information of a specified type, the dynamic security score is reduced. If the response data packet sent by the resource entity does not contain information of a specified type, the dynamic security score is not reduced. Among them, if the resource entity sends a response data packet containing information of a specified type, it means that the resource entity has sent malicious requests and sent malicious files, and therefore, the dynamic security score is reduced.

[0155] In summary, on the basis of the initial value of the dynamic security score, after the dynamic security score is reduced based on the access behavior information of the resource entity, a reduced dynamic security score can be obtained.

[0156] Step 603: The zero-trust gateway determines a target security score based on the static security score and the dynamic security score. For example, the sum of the static security score and the dynamic security score can be used as the target security score, or the static security score and the dynamic security score can be weighted to obtain the target security score.

[0157] Step 604: If the target security score is less than a preset threshold (which can be configured based on experience), the zero trust gateway queries the resource access policy corresponding to the resource entity from the policy configuration file, and modifies the permission type of the resource access policy to prohibit the transmission of data packets, thereby prohibiting the sending of data packets to the resource entity.

[0158] Exemplarily, when the target security score of a resource entity is less than a preset threshold, it indicates that the security of the resource entity is relatively poor, and the access rights of the resource entity need to be automatically reduced. For example, all resource access policies corresponding to the resource entity can be queried from the policy configuration file, that is, these resource access policies all include entity information of the resource entity. On this basis, the permission types of these resource access policies are all modified to prohibit the transmission of data packets, to avoid sending data packets to the resource entity, and the resource entity will not return a response data packet, thereby not allowing the resource entity to access the zero-trust network and revoking all permissions of the resource entity.

[0159] For example, when the target security score of a resource entity is less than a preset threshold, it indicates that the security of the resource entity is relatively poor. The zero-trust gateway can also perform security processing on the resource entity by means of configuration item correction, password modification, and leak scanning reinforcement to improve the security of the resource entity and improve the security score.

[0160] Exemplarily, since the permissions of the terminal entity may change constantly, the terminal entity can reapply for permissions. For example, if the terminal entity does not have permissions for a specific resource entity, it can submit an application to the zero-trust gateway and needs to provide [entity information of the terminal entity, entity information of the resource entity, resource identification, authentication information]. After the zero-trust gateway approves the application, it can update the resource access policy of the terminal entity, that is, update the policy configuration file, and send the updated policy configuration file to the zero-trust agent of the resource entity through the public key, private key and random number. The process can refer to the above embodiment.

[0161] For example, since the permissions of resource entities may change constantly, resource entities can reapply for permissions. For example, if a resource entity removes a service resource, an application can be submitted to the zero-trust gateway, and the zero-trust gateway deletes all resource access policies corresponding to the service resource from the policy configuration file. For another example, if a resource entity adds a new service resource, an application can be submitted to the zero-trust gateway, and the zero-trust gateway adds all resource access policies corresponding to the service resource to the policy configuration file.

[0162] Sixth, the permission policy cancellation process of the resource entity.

[0163] For each resource access policy, the policy configuration file may further include the last access time of the resource access policy, which indicates the time when a data packet matching the resource access policy was last received.

[0164] After receiving each data packet that matches the resource access policy, the zero trust gateway can update the time of receiving the data packet to the last access time of the resource access policy. The zero trust gateway can periodically count the time interval between the current time and the last access time of the resource access policy. If the time interval is not greater than the preset time threshold, the resource access policy can be retained. If the time interval is greater than the preset time threshold, the resource access policy can be deleted from the policy configuration file.

[0165] After receiving each data packet that matches the resource access policy, the zero trust agent of the resource entity updates the time of receiving the data packet to the last access time of the resource access policy. The zero trust agent can periodically count the time interval between the current time and the last access time of the resource access policy. If the time interval is not greater than the preset time threshold, the resource access policy can be retained. If the time interval is greater than the preset time threshold, the resource access policy can be deleted from the policy configuration file.

[0166] In summary, if the resource access policy of a resource entity has not been executed for a long time, the resource access policy can be automatically destroyed, that is, the corresponding permissions can be destroyed. For example, the zero-trust gateway automatically generates a permission destruction work order, and the operation and maintenance personnel confirm and destroy the corresponding permissions, and then update the terminal entity and resource entity synchronously.

[0167] Seventh, the security management process of resource entities.

[0168] During the operation of the resource entity, the zero-trust gateway can obtain data to be detected of at least one data type corresponding to the resource entity, and then analyze whether the resource entity is safe based on the data to be detected. When the resource entity is not safe, the permission type of the resource access policy of the resource entity is modified to prohibit the transmission of data packets, thereby preventing the resource entity from transmitting data packets and realizing the security management of the resource entity.

[0169] In order to implement the security management process of resource entities, a model training process and a security detection process of resource entities may be involved. The model training process and the security detection process of resource entities are described below.

[0170] Regarding the model training process, the model training process may include the following steps:

[0171] Step S11: Obtain a sample data set corresponding to each data type and an initial base class model corresponding to each data type, and the initial base class model may be a configured base class model.

[0172] For example, behaviors in a zero-trust network will generate data of multiple dimensions, such as traffic data, log data, and possibly involved file data. Data of multiple dimensions correspond to multiple data types, and multiple data types may include but are not limited to: file data type, pcap data type, and log data type.

[0173] The data of file data type is file data carried by HTTP file transfer protocol, file data carried by SFTP file transfer protocol, etc., and there is no restriction on this. The data of pcap data type is access data, such as HTTP request data, HTTP response data, SFTP authentication data, etc., and there is no restriction on this. The data of log data type can be login log, security log, core software log, etc., and there is no restriction on this.

[0174] For example, normal behavior can be constructed (such as constructing normal behavior for resource entities or terminal entities), and normal behavior triggers the generation of pcap data, log data, and file data labeled as normal, and adds the pcap data labeled as normal to the sample data set corresponding to the pcap data type, adds the log data labeled as normal to the sample data set corresponding to the log data type, and adds the file data labeled as normal to the sample data set corresponding to the file data type. In addition, abnormal / malicious behavior can be constructed (such as constructing abnormal / malicious behavior for resource entities or terminal entities), and abnormal / malicious behavior triggers the generation of pcap data, log data, and file data labeled as abnormal, and adds the pcap data labeled as abnormal to the sample data set corresponding to the pcap data type, adds the log data labeled as abnormal to the sample data set corresponding to the log data type, and adds the file data labeled as abnormal to the sample data set corresponding to the file data type.

[0175] Exemplarily, the initial base class model of the file data type can be preconfigured (referred to as the initial base class model a1), and the initial base class model a1 can adopt a DNN structure or other structures, without limitation. The initial base class model of the pcap data type can be preconfigured (referred to as the initial base class model a2), and the initial base class model a2 can adopt a CNN structure or other structures, without limitation. The initial base class model of the log data type can be preconfigured (referred to as the initial base class model a3), and the initial base class model a3 can adopt an LSTM structure or other structures, without limitation.

[0176] In summary, we obtain a sample data set of file data type (denoted as sample data set b1) and initial base class model a1, a sample data set of pcap data type (denoted as sample data set b2) and initial base class model a2, and a sample data set of log data type (denoted as sample data set b3) and initial base class model a3.

[0177] See also Fig. 7A As shown, it is a schematic diagram of the initial base class model. Different neural networks have different capabilities for processing data types. Therefore, the initial base class model a1 (corresponding to file data, i.e., file) includes a DNN sub-network and a sigmod neural layer, and uses the DNN sub-network for feature extraction. The initial base class model a2 (corresponding to access data, i.e., pcap) includes a CNN sub-network and a sigmod neural layer, and uses the CNN sub-network for feature extraction. The initial base class model a3 (corresponding to log data, i.e., log) includes an LSTM sub-network and a sigmod neural layer, and uses the LSTM sub-network for feature extraction.

[0178] Step S12: for each data type, the initial base class model corresponding to the data type is trained based on the sample data set corresponding to the data type to obtain a trained base class model.

[0179] For example, the initial base class model a1 can be trained based on the sample data set b1 to obtain the trained base class model c1 of the file data type, the initial base class model a2 can be trained based on the sample data set b2 to obtain the trained base class model c2 of the pcap data type, and the initial base class model a3 can be trained based on the sample data set b3 to obtain the trained base class model c3 of the log data type.

[0180] For the convenience of description, the following will take the training process of the initial base class model for a data type as an example. For example, the positive sample data and negative sample data in the sample data set b1 can be input into the initial base class model a1, and the DNN sub-network of the initial base class model a1 performs feature extraction. After extraction, the features are passed through the sigmod neural layer to obtain the predicted anomaly score, and the loss value can be calculated based on the predicted anomaly score and the label (such as the label of the positive sample is 1, and the label of the negative sample is 0). Based on the loss value, the network parameters of the initial base class model a1 are adjusted to obtain the trained base class model c1. For example, the network parameters of the initial base class model a1 are adjusted by using the gradient descent method, and there is no restriction on the training process of the initial base class model a1.

[0181] Step S13, based on the average value of the network parameters in the trained base class model and the obtained reference network parameters, the optimized network parameters are determined, and the reference network parameters are the average value of the network parameters in the trained base class model of all training rounds before the current training round. For example, the optimized network parameters are determined based on the average value of the network parameters in the trained base class model c1 and the reference network parameters. For example, in the first round of training, the reference network parameters are 0, in the second round of training, the reference network parameters are the average value of the network parameters in the trained base class model of the first round of training, and so on. In the tenth round of training, the reference network parameters are the average value of the network parameters in the trained base class model of the 1st to 9th rounds of training.

[0182] Exemplarily, the optimized network parameters may be determined using the following formula: , the left side of the formula w SWA Represents the optimized network parameters, the right side of the formula w SWA represents the reference network parameters, n models represents the total number of training rounds before the current training round, w Represents the network parameters in the trained base model.

[0183] Step S14, determine whether the base class model has converged after training. For example, if the loss value is less than the loss value threshold, the base class model has converged after training, and if the loss value is not less than the loss value threshold, the base class model has not converged after training. For another example, if the total number of training rounds reaches the number threshold, the base class model has converged after training, and if the total number of training rounds does not reach the number threshold, the base class model has not converged after training.

[0184] If the base class model does not converge after training, step S15 is executed.

[0185] If the base class model has converged after training, step S16 is executed.

[0186] Step S15: Update the trained base class model to the initial base class model, update the optimized network parameters to the reference network parameters, return to execute step S12, and train the initial base class model based on the sample data set.

[0187] Step S16: Use the optimized network parameters as the network parameters of the initial base class model to obtain the trained target base class model, that is, use the optimized network parameters to replace the network parameters of the initial base class model, and use the updated base class model as the target base class model. For example, the target base class model can use the optimized network parameters, that is, the target base class model uses the average value of the network parameters of all training rounds.

[0188] In summary, we can obtain the target base class model D1 of the file data type (the sigmod neural layer of the updated base class model can be removed as the target base class model D1), the target base class model D2 of the pcap data type (the sigmod neural layer can be removed as the target base class model D2), and the target base class model D3 of the log data type (the sigmod neural layer can be removed as the target base class model D3).

[0189] In the above training process, considering the huge number of parameters of the overall model and the large structural differences of each initial base class model, each initial base class model can be trained separately. Independently training each initial base class model in steps can better reduce the complexity of training and better complete the extraction of corresponding modal features based on the model structure. After the model training is completed, the model parameters of each model are fixed.

[0190] In the above training process, a supervised model framework of multiple initial base class models is constructed. Each data has a label, and each framework is trained independently in the training phase. Each initial base class model outputs a vector of fixed length in a single round. The vector is input into the sigmoid neural layer for anomaly scoring, and the loss between the predicted anomaly score and the label is calculated. The purpose of model training is achieved by minimizing the loss.

[0191] For example, the labels of each data are determined by time. For example, the logs and raw traffic data of the same device at the same time can both be used to detect malicious behaviors, which are multimodal features of an event.

[0192] In step S12, when the initial base class model is trained based on the sample data set, the data in the sample data set can also be preprocessed, so that the log data, file data and pcap data can be processed into a data format that can be input to the initial base class model. For example, each independent word in the log data can be processed into a vector through word-embedding, and then the words contained in the entire log are converted into vectors and then spliced ​​into a vector, and multiple logs are processed into multiple independent vectors. For example, the file data can be converted into binary data, the binary data can be encoded into a vector, and multiple file data can be processed into multiple independent vectors. For example, the pcap data can be converted into binary data, the binary data can be encoded into a vector, and then the vector can be cropped into a two-dimensional matrix (such as a 256*256 two-dimensional matrix), the excess data can be truncated, the insufficient data can be padded with zeros, and multiple pcap data can be processed into multiple independent two-dimensional matrices.

[0193] Regarding the model training process, the model training process may further include the following steps:

[0194] Step S21: Obtain an overall network model, which may include a target base class model corresponding to each data type, a feature concatenation layer, and a configured initial classification model.

[0195] For example, see Figure 7B As shown, it is a structural diagram of the overall network model. The overall network model may include a target base class model d1 for file data type, a target base class model d2 for pcap data type, a target base class model d3 for log data type, a feature concatenation layer and an initial classification model. The initial classification model may be a fully connected layer or other network layer as long as it can output a prediction score.

[0196] Step S22: for each data type, input the sample data of the data type into the target base class model of the data type to obtain the sample data features corresponding to the data type; and concatenate the sample data features corresponding to all data types to obtain the concatenated sample multimodal features.

[0197] For example, the sample data in the sample data set b1 is input into the target base class model d1 to obtain the sample data feature e1, the sample data in the sample data set b2 is input into the target base class model d2 to obtain the sample data feature e2, and the sample data in the sample data set b3 is input into the target base class model d3 to obtain the sample data feature e3. The sample data in the sample data set b1, the sample data in the sample data set b2, and the sample data in the sample data set b3 can be data for the same event (such as a normal event or an abnormal event) and correspond to the same label. Then, the sample data feature e1, the sample data feature e2, and the sample data feature e3 are input into the feature splicing layer, and the feature splicing layer splices these sample data features to obtain the spliced ​​sample multimodal features. For example, the splicing method can be a simple connection or a complex operation such as merging or superposition, and there is no restriction on this feature splicing method.

[0198] For example, the features (vectors) of each sample data can be concatenated to obtain a 3*N two-dimensional matrix, where N is the output result of each target base class model, and the two-dimensional matrix is ​​input into the initial classification model.

[0199] Step S23: input the sample multimodal features into the initial classification model to obtain the sample safety score output by the initial classification model (i.e., the prediction score of the initial classification model, used to indicate safety).

[0200] Step S24, determine the loss value based on the sample safety score; adjust the network parameters of the initial classification model based on the loss value to obtain an adjusted classification model. For example, the loss value can be calculated based on the sample safety score and the label (such as the label of the positive sample is 1, and the label of the negative sample is 0), and the network parameters of the initial classification model are adjusted based on the loss value to obtain the adjusted classification model, such as using a gradient descent method to adjust the network parameters of the initial classification model, and there is no restriction on the adjustment method of the network parameters.

[0201] Step S25, calculate the difference between the loss value and the loss value of the previous training round, that is, the difference between the loss value output by the current training round and the loss value output by the previous training round. If the difference is greater than the threshold, the network parameters in the adjusted classification model are stored as target network parameters. If the difference is not greater than the threshold, it is prohibited to store the network parameters in the adjusted classification model as target network parameters. For example, regarding the threshold, a value can be configured as the threshold based on experience, such as 0.1, 0.2, etc.

[0202] Step S26, determine whether the adjusted classification model has converged. For example, if the loss value is less than the loss value threshold, the adjusted classification model has converged; if the loss value is not less than the loss value threshold, the adjusted classification model has not converged. For another example, if the total number of training rounds reaches the number threshold, the adjusted classification model has converged; if the total number of training rounds does not reach the number threshold, the adjusted classification model has not converged.

[0203] If the adjusted classification model does not converge, execute step S27.

[0204] If the adjusted classification model has converged, step S28 is executed.

[0205] Step S27: Update the adjusted classification model to the initial classification model, and return to execute step S23.

[0206] Step S28, obtaining all stored target network parameters; for each target network parameter, using the target network parameter as a network parameter of an initial classification model to obtain a target classification model.

[0207] For example, assuming that the target network parameter f1, target network parameter f2 and target network parameter f3 have been stored, the target network parameter f1 is used as the network parameter of the initial classification model to obtain the target classification model g1, the target network parameter f2 is used as the network parameter of the initial classification model to obtain the target classification model g2, and the target network parameter f3 is used as the network parameter of the initial classification model to obtain the target classification model g3.

[0208] In summary, multiple target classification models can be obtained, wherein the multiple target classification models can use the same network structure, and the multiple target classification models can use different network parameters.

[0209] The security detection process for resource entities may include:

[0210] Step S31: Acquire data to be detected of at least one data type corresponding to a resource entity.

[0211] For example, at least one of the data to be detected of the file data type, the pcap data type, and the log data type is obtained. For the data to be detected of the file data type, the zero-trust gateway can obtain the data packet transmitted between the resource entity and the terminal entity, and obtain the file data (such as the file data carried by the HTTP file transfer protocol, the file data carried by the SFTP file transfer protocol, etc.) from the data packet. For the data to be detected of the pcap data type, the zero-trust gateway can obtain the data packet transmitted between the resource entity and the terminal entity, and obtain the pcap data (such as HTTP request data, HTTP response data, SFTP authentication data) from the data packet. For the data to be detected of the log data type, the zero-trust agent deployed in the resource entity (or terminal entity) can collect the log data of the resource entity (such as login log, security log, core software log), and send the log data to the zero-trust gateway.

[0212] Step S32: for each data type, input the data to be detected of the data type into the target base class model of the data type to obtain the target data features corresponding to the data type; concatenate the target data features corresponding to all data types to obtain the target multimodal features corresponding to the resource entity.

[0213] Exemplarily, step S32 is similar to step S22 and will not be repeated here.

[0214] Step S33: input the target multimodal features into multiple target classification models to obtain an initial safety score output by each target classification model, that is, a prediction score of the target classification model, which is used to represent safety.

[0215] For example, see Figure 7C As shown, it is a schematic diagram of multiple target classification models. The target multimodal features are input to the target classification model g1 to obtain the initial security score (score) output by the target classification model g1. There is no restriction on the processing process of the target classification model g1. The target multimodal features are input to the target classification model g2 to obtain the initial security score output by the target classification model g2. The target multimodal features are input to the target classification model g3 to obtain the initial security score output by the target classification model g3.

[0216] Step S34: determine a target security score based on the initial security score output by each target classification model; wherein, the smaller the target security score is, the lower the security of the data to be detected is.

[0217] For example, the average of all initial safety scores can be calculated and used as the target safety score. Alternatively, the maximum of all initial safety scores can be determined and used as the target safety score. Of course, the above are just two examples, and there is no limitation on the method of determining the target safety score.

[0218] Step S35: If the target security score is less than a preset threshold, the resource access policy corresponding to the resource entity is queried from the policy configuration file, and the permission type of the resource access policy is modified to prohibit the transmission of data packets.

[0219] Exemplarily, step S35 may refer to step 604, which will not be repeated here.

[0220] As can be seen from the above technical solutions, in the embodiment of the present application, the zero-trust gateway stores the policy configuration file corresponding to the resource entity, and the policy configuration file includes multiple resource access policies corresponding to multiple service resources of the resource entity. Based on the policy configuration file, the data packet is managed for zero-trust access, thereby performing zero-trust access to the resource entity, realizing the management of zero-trust access, and ensuring the data security of the resource entity. It is possible to achieve secure access to the zero-trust network for various resources of the resource entity, realize the combing and security management of each entity in zero trust, and the security management of access between entities, and ensure the overall network security. The terminal entity of the zero-trust network is transformed without feeling, which meets the requirements of the zero-trust network. After accessing the zero-trust agent, the user can complete the zero-trust network access without feeling, and the construction of the zero-trust architecture can be quickly realized. The zero-trust agent mainly realizes the reuse of various security resources in the zero-trust network, does not rely on the resources of each resource entity itself, and has the least impact on the actual business. Not only can it realize the security management and control of access actions, but it can also link security resources to realize resource entity security scoring, policy adjustment, and scoring optimization. Based on USBKey and various security resources within the zero-trust security architecture system, secure access to each entity in the zero-trust network is achieved, and the combing and security management of each entity in zero trust, as well as the security management of access between entities, are achieved. Multi-level and multi-angle inspections are performed at the sending, transmission, and receiving ends to ensure overall network security. Instead of relying entirely on permission policies for control, permissions can also be automatically adjusted based on dimensions such as entity scoring and entity behavior to ensure minimum permissions. Resource entity security scoring, policy adjustment, and scoring optimization can be achieved based on the data to be detected by the resource entity.

[0221] Based on the same application concept as the above method, the embodiment of the present application proposes a zero-trust entity security assessment device, which is applied to a zero-trust gateway. The zero-trust gateway stores a policy configuration file corresponding to a resource entity, and the policy configuration file includes multiple resource access policies. The resource entity is deployed with a zero-trust agent, see Fig. 8A FIG. 1 is a schematic diagram of the structure of the device, wherein the device comprises:

[0222] The acquisition module 811 is used to acquire tuple information from the data packet after receiving the data packet sent by the terminal entity to the resource entity, wherein the tuple information includes source entity information corresponding to the terminal entity, target entity information corresponding to the resource entity, resource identifier and request type;

[0223] A sending module 812 is configured to send the data packet to the zero trust agent if the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow the transmission of the data packet, so that the zero trust agent performs zero trust access control on the data packet;

[0224] Processing module 813 is used to discard the data packet if the policy configuration file does not contain a target resource access policy corresponding to the tuple information, or the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit the transmission of data packets.

[0225] Exemplarily, the sending module 812 is also used to send an entity configuration request to the zero trust agent, and receive an entity configuration response returned by the zero trust agent, wherein the entity configuration response includes the entity information and resource identification list of the resource entity, and the resource identification list includes the resource identification of multiple service resources supported by the resource entity; the acquisition module 811 is also used to obtain, for each service resource, the entity information and request type of the terminal entity allowed to access the service resource, and / or, the entity information and request type of the terminal entity prohibited from accessing the service resource; the processing module 813 is also used to generate a resource access policy corresponding to the service resource; wherein the resource access policy includes the entity information of the resource entity, the entity information of the terminal entity, the resource identification of the service resource, and the request type of the terminal entity; wherein, if the terminal entity is allowed to access the service resource using the request type, the permission type of the resource access policy is to allow the transmission of data packets; if the terminal entity is prohibited from accessing the service resource using the request type, the permission type of the resource access policy is to prohibit the transmission of data packets; and, the policy configuration file is generated based on the resource access policy corresponding to each service resource.

[0226] Exemplarily, the sending module 812 is also used to generate a public key and a private key for the resource entity based on an asymmetric algorithm, and send the public key to the zero trust agent; receive a first random number returned by the zero trust agent, where the first random number is obtained by the zero trust agent encrypting a second random number generated by itself using the public key; the processing module 813 is also used to decrypt the first random number using the private key to obtain a second random number, and encrypt the policy configuration file using a symmetric algorithm based on the second random number to obtain an encrypted policy configuration file; the sending module 812 is also used to send the encrypted policy configuration file to the zero trust agent, so that the zero trust agent decrypts the encrypted policy configuration file using a symmetric algorithm based on the second random number to obtain the policy configuration file, and performs zero trust access control on the data packet based on the policy configuration file.

[0227] Exemplarily, the processing module 813 is further configured to, after receiving a response data packet sent by the resource entity to the terminal entity, perform a security check on the resource file in the response data packet; if the security check result indicates that the resource file contains information of a specified type, discard the response data packet; if the security check result indicates that the resource file contains information of a specified type, send the response data packet to the terminal entity; wherein the information of the specified type includes sensitive information and / or confidential information;

[0228] Among them, when the processing module 813 performs a security check on the resource files in the response data packet, it is specifically used to: build an independent virtual space in the zero-trust gateway, run a sandbox in the independent virtual space, and perform a security check on the resource files in the response data packet through the sandbox.

[0229] Exemplarily, the processing module 813 is also used to obtain data to be detected of at least one data type corresponding to the resource entity; for each data type, the data to be detected of the data type is input into the target base class model of the data type to obtain the target data feature corresponding to the data type; the target data features corresponding to all data types are concatenated to obtain the target multimodal feature corresponding to the resource entity; the target multimodal feature is input into multiple trained target classification models to obtain the initial security score output by each target classification model; multiple target classification models use the same network structure, and multiple target classification models use different network parameters; the target security score is determined based on the initial security score output by each target classification model; if the target security score is smaller, it means that the security of the data to be detected is lower; if the target security score is less than a preset threshold, the resource access policy corresponding to the resource entity is queried from the policy configuration file, and the permission type of the resource access policy is modified to prohibit the transmission of data packets.

[0230] The processing module 813 is also used to train the target base class model of each data type in the following manner: obtain a sample data set corresponding to the data type and a configured initial base class model; train the initial base class model based on the sample data set to obtain a trained base class model; determine the optimized network parameters based on the average value of the network parameters in the trained base class model and the obtained reference network parameters, and judge whether the trained base class model has converged; if not, update the trained base class model to the initial base class model, update the optimized network parameters to the reference network parameters, and return to execute the operation of training the initial base class model based on the sample data set to obtain the trained base class model; if yes, use the optimized network parameters as the network parameters of the initial base class model to obtain the trained target base class model; wherein, the target base class model of the file data type adopts a DNN structure, the target base class model of the pcap data type adopts a CNN structure, and the target base class model of the log data type adopts an LSTM structure.

[0231] The processing module 813 is also used to train multiple target classification models in the following manner: for each data type, input the sample data of the data type into the target base class model of the data type to obtain the sample data features corresponding to the data type; splice the sample data features corresponding to all data types to obtain sample multimodal features; input the sample multimodal features into the initial classification model to obtain the sample safety score output by the initial classification model; determine the loss value based on the sample safety score; adjust the network parameters of the initial classification model based on the loss value to obtain an adjusted classification model; if the difference between the loss value and the loss value of the previous training round is greater than a threshold, store the network parameters in the adjusted classification model as target network parameters; determine whether the adjusted classification model has converged; if not, update the adjusted classification model to the initial classification model, and return to execute the operation of inputting the sample multimodal features into the initial classification model; if yes, obtain all stored target network parameters; for each target network parameter, use the target network parameter as the network parameter of the initial classification model to obtain the target classification model.

[0232] Based on the same application concept as the above method, the embodiment of the present application proposes a zero-trust entity security assessment device, which is applied to a zero-trust agent, wherein the zero-trust agent is deployed in a resource entity, and the zero-trust agent stores a policy configuration file corresponding to the resource entity, wherein the policy configuration file includes multiple resource access policies, see Figure 8B FIG. 1 is a schematic diagram of the structure of the device, wherein the device comprises:

[0233] The acquisition module 821 is used to acquire tuple information from the data packet after receiving the data packet sent by the terminal entity to the resource entity, wherein the tuple information includes source entity information corresponding to the terminal entity, target entity information corresponding to the resource entity, resource identifier and request type;

[0234] Processing module 822, for discarding the data packet if the policy configuration file does not have a target resource access policy corresponding to the tuple information, or the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit the transmission of the data packet;

[0235] An authentication module 823 is used to obtain authentication information from the data packet, and authenticate the data packet based on the authentication information if the policy configuration file contains a target resource access policy corresponding to the tuple information and the permission type of the target resource access policy is to allow transmission of the data packet;

[0236] The sending module 824 is used to send the data packet to the resource entity if the authentication of the data packet is successful; if the authentication of the data packet fails, discard the data packet.

[0237] Based on the same application concept as the above method, the embodiment of the present application proposes a zero-trust entity security assessment system, including: a zero-trust gateway and a zero-trust agent, wherein the zero-trust gateway stores a policy configuration file corresponding to the resource entity, and the zero-trust agent is deployed in the resource entity, and the zero-trust agent stores a policy configuration file corresponding to the resource entity, and the policy configuration file includes multiple resource access policies. The zero-trust gateway is used to obtain tuple information from the data packet after receiving the data packet sent by the terminal entity to the resource entity, and the tuple information includes source entity information, target entity information, resource identifier and request type; if the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow the transmission of the data packet, then the data packet is sent to the zero-trust agent; if the policy configuration file does not have a target resource access policy corresponding to the tuple information, or the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit the transmission of the data packet, then the data packet is discarded; the zero-trust agent is used to obtain tuple information from the data packet after receiving the data packet. information, the tuple information including source entity information, target entity information, resource identifier and request type; if the policy configuration file does not contain a target resource access policy corresponding to the tuple information, or the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit the transmission of data packets, then the data packet is discarded; if the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow the transmission of data packets, then authentication information is obtained from the data packet, and the data packet is authenticated based on the authentication information; if the authentication of the data packet is successful, the data packet is sent to the resource entity; if the authentication of the data packet fails, the data packet is discarded.

[0238] Based on the same application concept as the above method, an electronic device (such as the zero-trust gateway or zero-trust agent in the above embodiment) is proposed in the embodiment of the present application. Fig. 9 As shown, the electronic device may include: a processor 91 and a machine-readable storage medium 92, the machine-readable storage medium 92 storing machine-executable instructions that can be executed by the processor 91; the processor 91 is used to execute the machine-executable instructions to implement the zero-trust entity security assessment method of the above example of this application.

[0239] Based on the same application concept as the above method, the embodiment of the present application also provides a machine-readable storage medium, on which a number of computer instructions are stored. When the computer instructions are executed by the processor, the zero-trust entity security assessment method disclosed in the above example of the present application can be implemented. Among them, the above-mentioned machine-readable storage medium can be any electronic, magnetic, optical or other physical storage device, which can contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium can be: RAM (Radom Access Memory, random access memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as optical disk, DVD, etc.), or similar storage medium, or a combination thereof.

[0240] Based on the same application concept as the above method, an embodiment of the present application provides a computer program product, including a computer program; when the computer program is executed by a processor, a zero-trust entity security assessment method is implemented.

[0241] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of the claims of the present application.

Claims

1. A zero-trust entity security assessment method, characterized in that: Applied to a zero-trust gateway, the zero-trust gateway stores a policy configuration file corresponding to a resource entity, the policy configuration file includes multiple resource access policies, and the resource entity is deployed with a zero-trust agent, the method includes: After receiving a data packet sent by the terminal entity to the resource entity, obtaining tuple information from the data packet, the tuple information including source entity information, target entity information, resource identifier and request type; If the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow transmission of data packets, the data packet is sent to the zero trust agent so that the zero trust agent performs zero trust access control on the data packet; If the policy configuration file does not contain a target resource access policy corresponding to the tuple information, or if the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit the transmission of data packets, then the data packet is discarded; Wherein, the zero trust agent is deployed in the resource entity, the zero trust agent stores a policy configuration file corresponding to the resource entity, and the policy configuration file stored in the zero trust agent is the same as the policy configuration file stored in the zero trust gateway; The zero-trust agent performs zero-trust access control on the data packet, including: After receiving a data packet sent by the terminal entity to the resource entity, obtaining tuple information from the data packet; If the policy configuration file does not contain a target resource access policy corresponding to the tuple information, or if the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit the transmission of data packets, then the data packet is discarded; If the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow the transmission of data packets, then the authentication information is obtained from the data packet, and the data packet is authenticated based on the authentication information; if the authentication of the data packet is successful, the data packet is sent to the resource entity; if the authentication of the data packet fails, the data packet is discarded.

2. The method according to claim 1, characterized in that Before the zero-trust gateway stores a policy configuration file corresponding to the resource entity, the method further includes: Sending an entity configuration request to the zero trust agent, and receiving an entity configuration response returned by the zero trust agent, wherein the entity configuration response includes entity information and a resource identification list of the resource entity, and the resource identification list includes resource identifications of multiple service resources supported by the resource entity; For each service resource, obtaining entity information and request type of a terminal entity that is allowed to access the service resource, and / or entity information and request type of a terminal entity that is prohibited from accessing the service resource; Generate a resource access policy corresponding to the service resource, the resource access policy including entity information of the resource entity, entity information of the terminal entity, resource identifier of the service resource, and request type of the terminal entity; wherein, if the terminal entity is allowed to access the service resource using the request type, the permission type of the resource access policy is to allow transmission of data packets; if the terminal entity is prohibited from accessing the service resource using the request type, the permission type of the resource access policy is to prohibit transmission of data packets; The policy configuration file is generated based on the resource access policy corresponding to each service resource.

3. The method according to claim 1, characterized in that After the zero-trust gateway stores a policy configuration file corresponding to the resource entity, the method further includes: Generate a public key and a private key for the resource entity based on an asymmetric algorithm, and send the public key to the zero trust agent; receive a first random number returned by the zero trust agent, where the first random number is obtained by encrypting a second random number generated by the zero trust agent using the public key; Decrypting the first random number using the private key to obtain a second random number, and encrypting the policy configuration file using a symmetric algorithm based on the second random number to obtain an encrypted policy configuration file; The encrypted policy configuration file is sent to the zero trust agent, so that the zero trust agent uses a symmetric algorithm to decrypt the encrypted policy configuration file based on the second random number to obtain the policy configuration file, and performs zero trust access control on the data packet based on the policy configuration file.

4. The method according to claim 1, characterized in that The method further comprises: After receiving a response data packet sent by the resource entity to the terminal entity, performing a security check on the resource file in the response data packet; if the security check result indicates that the resource file contains information of a specified type, discarding the response data packet; if the security check result indicates that the resource file does not contain information of a specified type, sending the response data packet to the terminal entity; Wherein, the specified type of information includes sensitive information and / or confidential information; The step of performing a security check on the resource file in the response data packet includes: An independent virtual space is constructed in the zero-trust gateway, a sandbox is run in the independent virtual space, and a security check is performed on the resource files in the response data packet through the sandbox.

5. The method according to any one of claims 1 to 4, characterized in that: After the zero-trust gateway stores a policy configuration file corresponding to the resource entity, the method further includes: Acquire data to be detected of at least one data type corresponding to the resource entity; For each data type, the data to be detected of the data type is input into the target base class model of the data type to obtain the target data features corresponding to the data type; the target data features corresponding to all data types are concatenated to obtain the target multimodal features corresponding to the resource entity; Inputting the target multimodal features into multiple trained target classification models to obtain an initial security score output by each target classification model; wherein the multiple target classification models use the same network structure and different network parameters; Determine a target security score based on the initial security score output by each target classification model; wherein, if the target security score is smaller, it means that the security of the data to be detected is lower; If the target security score is less than a preset threshold, the resource access policy corresponding to the resource entity is queried from the policy configuration file, and the permission type of the resource access policy is modified to prohibit the transmission of data packets.

6. The method according to claim 5, characterized in that For the target base class model of each data type, the training process of the target base class model includes: Get the sample data set corresponding to the data type and the configured initial base class model; The initial base class model is trained based on the sample data set to obtain a trained base class model; the optimized network parameters are determined based on the average value of the network parameters in the trained base class model and the obtained reference network parameters, and it is determined whether the trained base class model has converged; If not, the trained base class model is updated to the initial base class model, the optimized network parameters are updated to the reference network parameters, and the operation of training the initial base class model based on the sample data set to obtain the trained base class model is returned; if yes, the optimized network parameters are used as the network parameters of the initial base class model to obtain the trained target base class model; Among them, the target base class model of the file data type adopts the DNN structure, the target base class model of the pcap data type adopts the CNN structure, and the target base class model of the log data type adopts the LSTM structure; And / or, the training process of the multiple target classification models includes: For each data type, input the sample data of the data type into the target base class model of the data type to obtain the sample data features corresponding to the data type; concatenate the sample data features corresponding to all data types to obtain the sample multimodal features; Inputting the sample multimodal features into the initial classification model to obtain a sample safety score output by the initial classification model; determining a loss value based on the sample safety score; adjusting the network parameters of the initial classification model based on the loss value to obtain an adjusted classification model; if the difference between the loss value and the loss value of the previous training round is greater than a threshold, storing the network parameters in the adjusted classification model as target network parameters; Determining whether the adjusted classification model has converged; If not, updating the adjusted classification model to the initial classification model, and returning to execute the operation of inputting the sample multimodal features into the initial classification model; If yes, then all stored target network parameters are obtained; for each target network parameter, the target network parameter is used as a network parameter of an initial classification model to obtain a target classification model.

7. A zero-trust entity security assessment device, characterized in that: Applied to a zero-trust gateway, the zero-trust gateway stores a policy configuration file corresponding to a resource entity, the policy configuration file includes multiple resource access policies, the resource entity is deployed with a zero-trust agent, and the device includes: an acquisition module, configured to acquire tuple information from a data packet after receiving the data packet sent by the terminal entity to the resource entity, wherein the tuple information includes source entity information corresponding to the terminal entity, target entity information corresponding to the resource entity, a resource identifier, and a request type; A sending module, configured to send the data packet to the zero trust agent if the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow the transmission of the data packet, so that the zero trust agent performs zero trust access control on the data packet; a processing module, configured to discard the data packet if the policy configuration file does not contain a target resource access policy corresponding to the tuple information, or if the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit transmission of data packets; Wherein, the zero trust agent is deployed in the resource entity, the zero trust agent stores a policy configuration file corresponding to the resource entity, and the policy configuration file stored in the zero trust agent is the same as the policy configuration file stored in the zero trust gateway; The zero-trust agent performs zero-trust access control on data packets in the following manner: after receiving a data packet sent by a terminal entity to a resource entity, obtaining tuple information from the data packet; if the policy configuration file does not contain a target resource access policy corresponding to the tuple information, or the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit the transmission of data packets, then discard the data packet; if the policy configuration file contains a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow the transmission of data packets, then obtain authentication information from the data packet, and authenticate the data packet based on the authentication information; if the authentication of the data packet is successful, then send the data packet to the resource entity; if the authentication of the data packet fails, then discard the data packet.

8. A zero-trust entity security assessment system, characterized in that: The system includes: a zero-trust gateway and a zero-trust agent, wherein the zero-trust gateway stores a policy configuration file corresponding to a resource entity, the zero-trust agent is deployed on the resource entity, the zero-trust agent stores a policy configuration file corresponding to the resource entity, and the policy configuration file stored in the zero-trust agent is the same as the policy configuration file stored in the zero-trust gateway, and the policy configuration file includes multiple resource access policies, wherein: The zero-trust gateway is used to obtain tuple information from a data packet after receiving a data packet sent by a terminal entity to a resource entity, wherein the tuple information includes source entity information, target entity information, resource identifier, and request type; if the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow transmission of data packets, then the data packet is sent to the zero-trust agent; if the policy configuration file does not have a target resource access policy corresponding to the tuple information, or the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit transmission of data packets, then the data packet is discarded; The zero-trust agent is used to obtain tuple information from the data packet after receiving the data packet, and the tuple information includes source entity information, target entity information, resource identifier and request type; if the policy configuration file does not have a target resource access policy corresponding to the tuple information, or the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to prohibit the transmission of data packets, then the data packet is discarded; if the policy configuration file has a target resource access policy corresponding to the tuple information, and the permission type of the target resource access policy is to allow the transmission of data packets, then authentication information is obtained from the data packet, and the data packet is authenticated based on the authentication information; if the authentication of the data packet is successful, the data packet is sent to the resource entity; if the authentication of the data packet fails, the data packet is discarded.

9. An electronic device, characterized in that: include: a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor; The processor is used to execute machine executable instructions to implement the method described in any one of claims 1-6.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images