A network access system, method and storage medium based on a zero trust gateway

Abstract

The application provides a network access system and method based on a zero-trust gateway and a storage medium, and belongs to the technical field of communication. The system comprises a plurality of zero-trust gateways, a zero-trust DNS service cluster and an intranet DNS service cluster, and the zero-trust DNS service cluster stores domain name resolution results corresponding to any target domain name request. In response to an access operation of a current user, any zero-trust gateway acquires a current target domain name request, executes a first security check strategy and, when passing, acquires a target source station address corresponding to the current target domain name request in the zero-trust DNS service cluster and accesses the target source station address. When the intranet DNS service cluster responds to any target domain name request, a non-domain name resolution result corresponding to the target domain name request is returned, and a security response strategy is executed. The security response strategy is used to hide a source station address corresponding to the target domain name request. The application aims to improve the security of network access based on a zero-trust gateway.

Description

TECHNICAL FIELD

[0001] The embodiments of the present application relate to the technical field of communication, in particular, to a network access system, method and storage medium based on a zero trust gateway. BACKGROUND

[0002] The zero trust gateway is a key component of the zero trust system, is usually deployed at the network entrance or the front end of the application service, separates the user and the resource, and forcibly executes the access control policy on all traffic. The zero trust gateway also provides a unified entrance for the background application, integrates the authentication and authorization, the access control, the behavior audit and the security protection and the like, effectively reduces the attack risk, improves the employee office experience and the business data security, and the employee can access the internal application through the zero trust gateway at any time, and no longer needs to rely on the network access or the VPN (Virtual Private Network) and the like to enter the internal network.

[0003] Since the zero trust gateway provides the unified entrance for the background application, the zero trust gateway needs to bear the responsibility of maintaining the source station addresses of various background applications, and usually adopts the manual maintenance or the way of obtaining the source address based on the internal network DNS (Domain Name System) service cluster.

[0004] However, the manual maintenance of the source address increases the operation and maintenance pressure, and is not conducive to the application access and the horizontal expansion. Although the internal network DNS service cluster has high efficiency in obtaining the source address, there are many source station addresses maintained on the internal network DNS service cluster, and once the attacker breaks through the network boundary, the internal network DNS service cluster can be used to bypass the zero trust gateway to directly attack the source station, so that the network access security based on the zero trust gateway is low. SUMMARY

[0005] The embodiments of the present application provide a network access system, method and storage medium based on a zero trust gateway, aiming at improving the security when the network is accessed based on the zero trust gateway.

[0006] In a first aspect, the embodiments of the present application provide a network access system based on a zero trust gateway, the system comprising a plurality of zero trust gateways, a zero trust DNS service cluster and an internal network DNS service cluster, the zero trust DNS service cluster storing a domain name resolution result corresponding to any target domain name request, the target domain name request being a domain name request accessed based on any zero trust gateway, the domain name resolution result comprising at least one source station address corresponding to the target domain name request;

[0007] Any zero-trust gateway is configured to, in response to an access operation of a current user, acquire a current target domain name request, and execute a first security verification policy for verifying identity information of the current user, when the first security verification policy passes, acquire a target source station address corresponding to the current target domain name request in the zero-trust DNS service cluster, and access the target source station address corresponding to the current target domain name request, wherein the target source station address is any source station address in a domain name resolution result corresponding to the current target domain name request.

[0008] When the intranet DNS service cluster responds to any target domain name request, a non-domain name resolution result corresponding to the target domain name request is returned, and the non-domain name resolution result includes a security response policy corresponding to the target domain name request, and the security response policy is used to hide a source station address corresponding to the target domain name request.

[0009] Optionally, in response to an access operation of a current user, any zero-trust gateway acquires a current target domain name request, and executes a first security verification policy for verifying identity information of the current user, and the zero-trust gateway is configured to:

[0010] In response to an access operation of a current user, the current target domain name request is acquired, and it is detected whether the current target domain name request carries identity information of the current user.

[0011] When the identity information of the current user is carried, it is determined whether the identity information of the current user is correct according to an allowed access list maintained by the zero-trust gateway itself and the identity information of the current user, wherein the allowed access list includes identity information of a plurality of users.

[0012] Optionally, the allowed access list further includes access permissions of the plurality of users, and the access permission of any user is used to represent all target domain name requests allowed to be accessed by the user, and when the identity information of the current user is correct, the zero-trust gateway is further configured to:

[0013] According to the allowed access list, it is determined whether the current user has access permission of the current target domain name request.

[0014] Optionally, when the first security verification policy passes, the zero-trust gateway is further configured to send the current target domain name request carrying a security identifier of the zero-trust gateway to the zero-trust DNS service cluster.

[0015] The zero-trust DNS service cluster comprises a plurality of zero-trust DNS servers, a master server in the plurality of zero-trust DNS servers is configured to execute a second security verification policy for verifying the identity of the zero-trust gateway, and when the second security verification policy is passed, the master server sends the current target domain name request to a zero-trust DNS server closest to the zero-trust gateway.

[0016] The zero-trust DNS server closest to the zero-trust gateway is configured to resolve a domain name resolution result corresponding to the current target domain name request and, after determining a target source station address corresponding to the current target domain name request in the domain name resolution result, send the target source station address to the zero-trust gateway.

[0017] Optionally, when the first security verification policy is passed, the zero-trust gateway is further configured to send the current target domain name request carrying the security identifier of the zero-trust gateway to the zero-trust DNS service cluster.

[0018] The zero-trust DNS service cluster is configured to send the current target domain name request to a zero-trust DNS server of the zero-trust DNS service cluster closest to the zero-trust gateway based on an anycast technology.

[0019] The zero-trust DNS server closest to the zero-trust gateway is configured to execute a second security verification policy for verifying the identity of the zero-trust gateway, and when the second security verification policy is passed, resolve a domain name resolution result corresponding to the current target domain name request, and after determining a target source station address corresponding to the current target domain name request in the domain name resolution result, send the target source station address to the zero-trust gateway.

[0020] Optionally, when the domain name resolution result corresponding to the current target domain name request comprises a plurality of source station addresses, the zero-trust DNS server closest to the zero-trust gateway is configured to determine the distance between the devices corresponding to the plurality of source station addresses and the zero-trust gateway, and take the closest source station address as the target source station address.

[0021] Optionally, the security response policy corresponding to any target domain name request comprises returning an illegal response or returning the address of a security honeypot.

[0022] Optionally, the system further comprises a configuration module configured to configure the domain name or address of any zero-trust gateway, configure the DNS service of the zero-trust DNS server, and configure the security response policy corresponding to any target domain name request in the intranet DNS service cluster.

[0023] Optionally, the configuration module is further configured to, in response to an addition operation of the zero-trust gateway, configure a domain name or an address for pointing to the zero-trust DNS service cluster for the added zero-trust gateway.

[0024] Optionally, the configuration module is further configured to, in response to an addition operation of the zero-trust DNS server, perform access configuration for the added zero-trust DNS server and store a domain name resolution result corresponding to each target domain name request in the added zero-trust DNS server.

[0025] Optionally, the configuration module is further configured to, in response to an addition operation of the target domain name request, store a domain name resolution result corresponding to the added target domain name request in the zero-trust DNS service cluster, and change the domain name resolution result corresponding to the added target domain name request in the intranet DNS service cluster to a non-domain name resolution result.

[0026] In a second aspect, an embodiment of the present application provides a network access method based on a zero-trust gateway, applied to the network access system based on the zero-trust gateway in the first aspect, and the method comprises the following steps:

[0027] Any zero-trust gateway acquires a current target domain name request in response to an access operation of a current user, executes a first security verification strategy for verifying identity information and access authority of the current user, and sends the current target domain name request to a zero-trust DNS service cluster when the first security verification strategy passes.

[0028] The zero-trust DNS service cluster acquires a domain name resolution result corresponding to the current target domain name request, determines a target source station address corresponding to the current target domain name request, and sends the target source station address to the zero-trust gateway.

[0029] The zero-trust gateway accesses the target source station address after receiving the target source station address.

[0030] In a third aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program. When the computer program is executed by a processor, the network access method based on the zero-trust gateway in the second aspect is implemented.

[0031] Advantages:

[0032] The embodiment provides a network access system based on a zero-trust gateway, which comprises a plurality of zero-trust gateways, a zero-trust DNS service cluster, and an intranet DNS service cluster. The zero-trust DNS service cluster stores a domain name resolution result corresponding to any target domain name request. The target domain name request is a domain name request for accessing based on any zero-trust gateway. The domain name resolution result comprises at least one source station address corresponding to the target domain name request.

[0033] Any zero-trust gateway, in response to the access operation of the current user, acquires the current target domain name request and executes a first security verification strategy for verifying the identity information of the current user. When the first security verification strategy passes, the target source station address corresponding to the current target domain name request is acquired in the zero-trust DNS service cluster, and the target source station address corresponding to the current target domain name request is accessed. By verifying the identity information of the current user initiating the current target domain name request through the zero-trust gateway, an attacker can be prevented from accessing the source station address corresponding to the target domain name request through the zero-trust gateway.

[0034] Instead of storing the real source station address of any target domain name request, the intranet DNS service cluster stores a non-domain name resolution result of any target domain name request. The non-domain name resolution result includes a security response strategy corresponding to the target domain name request. The security response strategy is used to hide the source station address corresponding to the target domain name request. When the target domain name request is sourced back through the intranet DNS service cluster, the real source station address cannot be acquired. Even if an attacker enters the intranet, the source station address cannot be acquired from the intranet DNS service cluster for attack, thereby improving the security of network access based on the zero-trust gateway. BRIEF DESCRIPTION OF DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the description of the embodiments of the present application will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0036] Figure 1 is a schematic diagram of the existing source back address acquisition based on the intranet DNS service cluster;

[0037] Figure 2 is a structural schematic diagram of the network access system based on the zero-trust gateway according to an embodiment of the present application;

[0038] Figure 3 is a step flowchart of the network access method based on the zero-trust gateway according to an embodiment of the present application;

[0039] Figure 4 is an execution schematic diagram of the network access method based on the zero-trust gateway according to an embodiment of the present application;

[0040] Figure 5 is a schematic diagram of the computer readable storage medium according to an embodiment of the present application. DETAILED DESCRIPTION

[0041] With reference to the drawings of the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described. Obviously, the described embodiments are some of the embodiments of the present application, but not all of the embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts are within the scope of the present application.

[0042] VPN: Virtual Private Network, virtual private network;

[0043] DNS: Domain Name System, domain name system.

[0044] Compared with the traditional gateway, the zero-trust gateway integrates the authentication and authorization and access control security functions on the basis of the traditional gateway. As an extended form of the gateway, the zero-trust gateway needs to bear the responsibility of maintaining the source station addresses of various background applications. Users can access internal applications through the zero-trust gateway at any time, reducing the dependence on network access or VPN.

[0045] Usually, the source address is obtained by manual maintenance or based on an intranet DNS service cluster. Manual maintenance of the source address increases the operation and maintenance pressure and is not conducive to application access and horizontal expansion. In the method of obtaining the source address based on the intranet DNS service cluster, the intranet DNS service cluster maintains the mapping relationship between the domain name request and the source station address.

[0046] Referring to Figure 1 , an existing schematic diagram for obtaining a source address based on an intranet DNS service cluster is shown. When the zero-trust gateway 1 obtains a domain name request 1 of a user: site1.example.com, the domain name request 1 is sent to the intranet DNS service cluster. The intranet DNS service cluster maintains all domain name requests and corresponding source station addresses in the intranet. After the intranet DNS service cluster resolves the domain name request 1, the source station address 10.0.0.1 corresponding to the domain name request 1 is determined, that is, the IP address (Internet Protocol Address) of the source station is returned to the zero-trust gateway 1. When the zero-trust gateway 2 obtains a domain name request 2 of a user: site2.example.com, after the intranet DNS service cluster resolves the domain name request 2, the source station address 10.0.0.3 corresponding to the domain name request 2 is determined, and the zero-trust gateway 2 is returned.

[0047] However, in the method of obtaining the source address through the intranet DNS service cluster, once the attacker breaks through the network boundary, the attacker can bypass the zero-trust gateway to directly attack the source station by using the intranet DNS service cluster, so that the network access security based on the zero-trust gateway is low.

[0048] Based on this, the embodiment of the application provides a network access system based on a zero-trust gateway, which can improve the security of network access based on the zero-trust gateway.

[0049] Referring to Figure 2 , a structure schematic diagram of a network access system based on a zero-trust gateway in the embodiment of the application is shown, as Figure 2 , the system comprises a plurality of zero-trust gateways, a zero-trust DNS service cluster, and an intranet DNS service cluster.

[0050] Each zero-trust gateway is configured to provide a user with a portal for network access, configured to obtain a domain name request of the user, and configured to access a source station address corresponding to the domain name request. Each zero-trust gateway has the functions of identity verification, security protection, and application audit, and has high security. The number of zero-trust gateways can be configured according to the actual application requirements, and the embodiment does not limit any zero-trust gateway to process a domain name request initiated by a user in any region.

[0051] In actual implementation, the target domain name request corresponding to the zero-trust gateway can be determined according to the business requirements. The target domain name request is a domain name request configured to be accessed through the zero-trust gateway. When the domain name request from the user is any target domain name request, the target domain name request is sent to the zero-trust gateway. For example, enterprise A includes business website 1 and business website 2. The domain name request corresponding to the zero-trust gateway can be set as the domain name request for accessing business website 1. When any user wants to access business website 1, the domain name request of business website 1 is sent to the zero-trust gateway. In actual application, the website that needs to be accessed through the zero-trust gateway can be determined according to the actual application requirements.

[0052] In a feasible implementation manner, the zero-trust gateway pre-maintains an allowed access list. The allowed access list maintains the identity information of a plurality of users allowed to access. When any user initiates a target domain name request, the identity information of the current user is first verified.

[0053] When the user initiates the current target domain name request to the zero-trust gateway through an access operation on the device side, the current target domain name request carries the identity information of the current user. When the zero-trust gateway receives the current target domain name request, a first security verification strategy is executed. The first security verification strategy is configured to detect the identity information of the user.

[0054] Specifically, when the first security verification policy is executed, the zero trust gateway detects whether the identity information is carried in the target domain name request. For example, the identity information can be a cookie or a token with a user ID and a password. When the target domain name request does not carry the identity information, the current user can be prompted to log in, such as displaying a login prompt page on the current web interface of the user.

[0055] When the target domain name request carries the identity information, the identity information of each user in the allowed access list is matched. If the matching is unsuccessful, it indicates that the identity information of the current user is incorrect, and the current user can be prompted to log in again. If the matching is successful, it indicates that the identity information of the current user is correct.

[0056] In another possible implementation, after determining that the identity information of the current user is correct, it can be further determined whether the current user has the access right to the current target domain name request. For example, the allowed access list can further include the access right of each user. The access right of any user is used to represent all target domain name requests that the user is allowed to access.

[0057] When the zero trust gateway determines that the identity information of the current user is correct, it is determined according to the allowed access list whether the current user has the right to access the current target domain name request. If the current user does not have the right to access the target domain name request, the current user can be prompted that he or she does not have the right, or the current user can be prompted to apply for the right to access the target domain name request, such as displaying a prompt page indicating that the user does not have the right or displaying a prompt page for applying for the right to access the target domain name request on the current web interface of the user.

[0058] If the identity information and the access right of the current user are verified, the zero trust gateway sends the current target domain name request to the zero trust DNS service cluster to obtain the target source station address corresponding to the current target domain name request.

[0059] By verifying the identity information and the access right of the user through the zero trust gateway after receiving the current target domain name request, the security of accessing the source station address corresponding to the target domain name request can be improved. When any attacker attempts to attack the zero trust gateway, the attacker can be prevented from accessing the source station address corresponding to the target domain name request through the zero trust gateway due to the limitation of the identity information and the access right verification.

[0060] The zero-trust DNS service cluster in the system provides DNS services for multiple zero-trust gateways, the zero-trust DNS service cluster includes multiple zero-trust DNS servers distributed in different geographical locations, and each of the zero-trust DNS servers in the zero-trust DNS service cluster stores a plurality of domain name resolution results corresponding to respective target domain name requests, wherein the domain name resolution results include at least one source station address corresponding to the target domain name request. In actual application, one target domain name request can correspond to only one source station address or multiple source station addresses.

[0061] In a feasible implementation, in order to further protect the source station address, a second security verification policy between the zero-trust DNS service cluster and the multiple zero-trust gateways can also be configured, and the second security verification policy is used to verify the identity of any zero-trust gateway.

[0062] When any zero-trust gateway sends a current target domain name request to the zero-trust DNS service cluster, the zero-trust DNS service cluster can verify the identity of the zero-trust gateway according to the target domain name request sent by the zero-trust gateway, and then determine whether the target domain name request is a legal request, thereby avoiding that an attacker obtains the source station address corresponding to any target domain name request by attacking the zero-trust DNS service cluster, and further improving the security when accessing the source station address.

[0063] The second security verification policy between the zero-trust DNS service cluster and the multiple zero-trust gateways can be configured according to actual needs. For example, one or more zero-trust gateways can be pre-registered on the zero-trust DNS service cluster, and each registered zero-trust gateway is assigned a unique security identifier. When any zero-trust gateway forwards a current target domain name request to the zero-trust DNS service cluster, the security identifier registered by the zero-trust gateway on the zero-trust DNS service cluster is carried in the forwarded target domain name request.

[0064] When the second security verification policy is executed, the zero-trust DNS service cluster detects whether the received target domain name request carries a security identifier, and then verifies whether the security identifier is the unique security identifier assigned to the zero-trust gateway when it is registered. If yes, the verification is passed, and the target domain name request can be further analyzed. If not, the verification is failed, and an error prompt can be returned.

[0065] By configuring the second security verification policy between the zero-trust DNS service cluster and the multiple zero-trust gateways, attacks initiated by an attacker directly to the source station address maintained in the zero-trust DNS service cluster can be avoided, and the security when accessing the source station address is further improved.

[0066] In an implementable embodiment, since the zero-trust DNS service cluster includes multiple zero-trust DNS servers, and the same mapping relationship between the target domain name request and the domain name resolution result is maintained on each zero-trust DNS server, but the IP published by the multiple zero-trust DNS servers is the same, that is, one zero-trust DNS service cluster has one IP.

[0067] In order to improve the efficiency of source returning, a selection thread can be set in the zero-trust DNS service cluster. When the zero-trust DNS service cluster receives a target domain name request sent by any zero-trust gateway, the selection thread is executed to determine the zero-trust DNS server closest to the zero-trust gateway according to the set address of each zero-trust gateway and the set address of each zero-trust DNS server, and send the target domain name request to the zero-trust DNS server closest to the zero-trust gateway, so that the zero-trust DNS server closest to the zero-trust gateway resolves the target domain name request and sends the target source station address corresponding to the current target domain name request to the zero-trust gateway.

[0068] In actual implementation, a master server can be determined in the multiple zero-trust DNS servers of the zero-trust DNS service cluster, and the second security check strategy and the selection thread between the zero-trust DNS service cluster and the multiple zero-trust gateways are set on the master server.

[0069] The zero-trust gateway can first send the current target domain name request to the master server, and the master server first performs the second security check strategy on the current target domain name request. When the second security check strategy passes, the master server sends the current target domain name request to the zero-trust DNS server closest to the zero-trust gateway. The master server can also monitor the fault state of the multiple zero-trust DNS servers in the zero-trust DNS service cluster in real time to ensure that the zero-trust DNS server closest to the zero-trust gateway and healthy is selected.

[0070] In actual implementation, the zero-trust DNS service cluster can also achieve DNS response acceleration through Anycast (Anycast or Anycast) technology, that is, the current target domain name request is sent to the zero-trust DNS server closest to the zero-trust gateway in the zero-trust DNS service cluster, and then the second security check strategy is performed by the zero-trust DNS server closest to the zero-trust gateway. When the second security check strategy passes, the zero-trust DNS server closest to the zero-trust gateway resolves the target domain name request.

[0071] In the embodiment, the target domain name request is resolved by selecting the zero-trust DNS server closest to the zero-trust gateway in the zero-trust DNS service cluster, and the target source station address corresponding to the target domain name request is determined, thereby improving the efficiency of DNS source returning. The closest in the embodiment refers to the minimum physical communication distance between the zero-trust DNS server and the zero-trust gateway.

[0072] For example, there is one zero-trust DNS server in Beijing and one in Shanghai. When the zero-trust gateway serving Beijing sends a target domain name request to the zero-trust DNS service cluster, the zero-trust DNS server in Beijing in the zero-trust DNS service cluster is preferred to provide domain name resolution services. If the zero-trust DNS server in Beijing fails or goes offline, the zero-trust DNS server in the zero-trust DNS service cluster closest to the zero-trust gateway serving Beijing can be selected to provide domain name resolution services.

[0073] Further, since some target domain name requests may include multiple source station addresses in the domain name resolution results, in order to further improve the efficiency of source returning, when the target domain name request corresponds to a domain name resolution result including multiple source station addresses, the zero-trust DNS server resolving the target domain name request can determine the setting addresses of the devices corresponding to the multiple source station addresses, select the source station address closest to the zero-trust gateway receiving the target domain name request as the target source station address, and return it, i.e., return the source station address closest to the zero-trust gateway.

[0074] If the current target domain name request is not found in the zero-trust DNS server resolving the target domain name request, the domain name resolution result representing the target domain name request is not pre-configured in the zero-trust DNS service cluster, therefore, the zero-trust DNS server resolving the target domain name request can return a resolution failure response to the zero-trust gateway.

[0075] Because the domain name resolution result corresponding to the target domain name request is maintained in the zero-trust DNS service cluster, the domain name resolution result corresponding to the target domain name request previously maintained in the intranet DNS service cluster needs to be deleted or replaced, and the source station address of the attack target domain name request can be attacked in the intranet DNS service cluster after an attacker attacks the intranet.

[0076] In a feasible implementation, the non-domain name resolution result of each target domain name request can be configured in the intranet DNS service cluster, that is, the intranet DNS service cluster stores the non-domain name resolution result corresponding to each target domain name request, and the non-domain name resolution result of any target domain name request includes a security response strategy corresponding to the target domain name request, and the security response strategy is used to hide the source station address corresponding to the target domain name request. When the intranet DNS service cluster responds to the target domain name request from the attacker, the security response strategy can be executed, so that the attacker who breaks through the network boundary cannot obtain the source station address corresponding to the target domain name request in the intranet DNS service cluster.

[0077] The system stores the source station address corresponding to any target domain name request in a separate zero-trust DNS service cluster, and stores the non-domain name resolution result corresponding to each target domain name request in the intranet DNS service cluster. The non-domain name resolution result corresponding to any target domain name request includes a security response strategy, but does not include a source station address, that is, the source station addresses of multiple target domain name requests are hidden in the intranet DNS service cluster. Therefore, after the zero-trust gateway obtains the current target domain name request of the user, the target source station address corresponding to the current target domain name request can be obtained in the zero-trust DNS service cluster, and the target source station address corresponding to the current target domain name request is accessed.

[0078] The intranet DNS service cluster only stores the non-domain name resolution result corresponding to each target domain name request, and hides the domain name resolution result corresponding to each target domain name request maintained by the zero-trust DNS service cluster. Even if the attacker enters the intranet, the source station address corresponding to the target domain name request cannot be obtained from the intranet DNS service cluster for attack. When the source station address of the target domain name request is obtained based on the intranet DNS service cluster, the security response strategy for hiding the source station address corresponding to the target domain name request is executed, thereby improving the security of network access based on the zero-trust gateway.

[0079] In a feasible implementation, the system further includes a configuration module for building a system providing zero-trust services and modifying or editing the zero-trust services.

[0080] In actual implementation, the network access system based on the zero-trust gateway can include the following steps:

[0081] A1: A set of zero-trust DNS servers are built in the intranet to form a zero-trust DNS service cluster.

[0082] The number of zero-trust DNS servers in the zero-trust DNS service cluster can be customized according to actual application requirements.

[0083] A2: configuring the zero-trust gateway and the zero-trust DNS service cluster based on the configuration module.

[0084] The configuration module configures the DNS service of the zero-trust DNS service cluster in response to the access control configuration operation of the zero-trust DNS service cluster, including configuring the zero-trust gateway object of the zero-trust DNS service cluster providing the DNS service, and configuring the domain name resolution result of multiple target domain name requests in the zero-trust DNS service cluster.

[0085] Specifically, the access control of the zero-trust DNS service cluster is performed by means of ACL (Access Control List) and the like. The ACL is a list of instructions applied to the interface of the router, which is used to configure which data packets of the zero-trust gateway can be received and which data packets need to be rejected. Whether the data packet is received or rejected can be determined by specific indication conditions such as source address, destination address, port number, etc. The zero-trust gateway providing the DNS service of the zero-trust DNS service cluster can be determined by the ACL. For example, the IP or domain name of the zero-trust gateway that the zero-trust DNS service cluster can receive can be configured by the ACL, so that the zero-trust DNS service cluster provides the DNS service for the zero-trust gateway. In other embodiments, other ways can also be used to configure the access control of the zero-trust DNS service cluster.

[0086] Then, the configuration module can also configure the domain name resolution result of multiple target domain name requests in the zero-trust DNS service cluster. The domain name resolution result of multiple target domain name requests can be stored on all zero-trust DNS servers of the zero-trust DNS service cluster. The source station address included in the domain name resolution result of one target domain name request can be one or multiple. When accessed, only one source station address needs to be selected as the target source station address in the domain name resolution result.

[0087] A3: configuring multiple zero-trust gateways.

[0088] In addition to configuring the DNS service of the zero-trust DNS service cluster, the domain name or IP of each zero-trust gateway also needs to be configured, so that each zero-trust gateway can point to the zero-trust DNS service cluster.

[0089] For example, assuming that the IP of a zero-trust gateway should be configured as 10.100.100.100, the following two ways can be used for configuration:

[0090] 1) Modify the DNS of the zero-trust gateway host to 10.100.100.100;

[0091] 2) Modify the DNS of the zero trust gateway service, for example, add the configuration item "resolver 10.100.100.100 valid=60s;" to NGINX. This configuration indicates that the DNS resolution result is updated based on the response of 10.100.100.100 every 60 seconds.

[0092] In addition, the configuration module can determine the target domain name request for access through the plurality of zero trust gateways in response to the access control configuration operation of the zero trust gateway.

[0093] A4: Modify the domain name resolution result of the plurality of target domain name requests stored in the intranet DNS service cluster.

[0094] For the target domain name request that has published the domain name resolution result on the zero trust DNS service cluster, delete or modify the domain name resolution result stored in the intranet DNS service cluster, hide the source station address of the target domain name on the intranet DNS service cluster. For example, the domain name resolution result corresponding to the target domain name request in the intranet DNS service cluster can be changed to a non-domain name resolution result, and the non-domain name resolution result includes the security response policy corresponding to the target domain name request.

[0095] For any target domain name request, the security response policy corresponding thereto can be set to return an illegal response, such as NX Domain representing a resolution failure, or 127.0.0.1, etc.

[0096] For any target domain name request, the security response policy corresponding thereto can also be set to return the address of a security honeypot. The security honeypot is a network active defense technology that achieves the purpose of deceiving attackers, luring attacks, increasing attack costs, and reducing security threats to actual systems or services by constructing simulated systems or services. For example, the security honeypot can be a service, a web page, a database, or a complete operating system, or even a monitored file. In the process of the honeypot being intruded, the attack traffic, behavior, and data of the attacker are recorded and audited in real time. The intranet DNS service cluster returns the address of the security honeypot for subsequent target domain name requests, thereby guiding the attacker to access the security honeypot and providing data or evidence support for security tracing.

[0097] In other embodiments, the security response policy corresponding to any target domain name request can also be in other forms according to actual application requirements, as long as the domain name resolution result corresponding to the target domain name request can be hidden.

[0098] Reference Figure 3, a step flow chart of a network access method based on a zero-trust gateway is shown, the method is applied to the network access system based on the zero-trust gateway, and the method specifically includes the following steps:

[0099] S101: In response to an access operation of a current user, any zero-trust gateway acquires a current target domain name request, executes a first security verification strategy for verifying identity information of the current user, and when the first security verification strategy passes, sends the current target domain name request to a zero-trust DNS service cluster.

[0100] Any target domain name request is a domain name request configured to be accessed through a zero-trust gateway; for example, the current target domain name request can be site1.example.com.

[0101] When the zero-trust gateway receives the current target domain name request, the first security verification strategy for detecting the identity information of the current user is executed, and the first security verification strategy can also include determining whether the current user has access permission to access the current target domain name request.

[0102] Specifically, according to the allowed access list maintained by the zero-trust gateway itself and the identity information carried in the current target domain name request, the identity information and access permission of the current user are verified, and if the identity information and access permission of the current user are verified, that is, the first security verification strategy passes, the zero-trust gateway sends the target domain name request to the zero-trust DNS service cluster to acquire a source station address corresponding to the target domain name request.

[0103] Based on the user verification and security protection function of the zero-trust gateway, when any one of the identity information not carried in any target domain name request, the current user identity information error, and the access permission of the current user not passing the verification exists, the zero-trust gateway will not send the current target domain name request to the zero-trust DNS service cluster, at this time, the source station address corresponding to the target domain name request cannot be acquired through the zero-trust gateway, which can improve the security of accessing the source station address corresponding to the target domain name request, so that it is difficult for an attacker to access the source station address through the zero-trust gateway.

[0104] S102: The zero-trust DNS service cluster acquires a domain name resolution result corresponding to the current target domain name request, determines a target source station address corresponding to the current target domain name request, and sends the target source station address to the zero-trust gateway.

[0105] Specifically, any of the zero-trust DNS servers in the zero-trust DNS service cluster can perform a second security verification policy after receiving the current target domain name request sent by the zero-trust gateway. When the second security verification policy passes, the domain name resolution result corresponding to the current target domain name request is resolved and sent to the zero-trust gateway.

[0106] However, in order to improve the efficiency of source returning, a master server can be set in the zero-trust DNS service cluster, and the master server performs the second security verification policy to determine whether the current target domain name request sent by the zero-trust gateway carries a security identifier and verifies the security identifier.

[0107] When the master server determines that the second security verification policy passes, a selection thread is executed, and the current target domain name request is sent to the zero-trust DNS server closest to the zero-trust gateway, so that the zero-trust DNS server closest to the zero-trust gateway resolves the current target domain name request.

[0108] Alternatively, the zero-trust DNS service cluster can use Anycast technology to achieve DNS response acceleration, that is, when the current target domain name request is routed between multiple zero-trust DNS servers in the zero-trust DNS service cluster, the current target domain name request is first sent to the zero-trust DNS server closest to the zero-trust gateway based on Anycast technology. The zero-trust DNS server performs the second security verification policy, that is, verifies the security identifier in the current target domain name request. When the second security verification policy passes, the zero-trust DNS server resolves the current target domain name request.

[0109] When any of the zero-trust DNS servers resolves the domain name resolution result corresponding to the current target domain name request, if there is only one source station address in the domain name resolution result, the source station address is the target source station address corresponding to the current target domain name request.

[0110] Since part of the target domain name request corresponds to a domain name resolution result including multiple source station addresses, in order to further improve the efficiency of source returning, when the domain name resolution result includes multiple source station addresses, the setting address of the device corresponding to the multiple source station addresses is determined, the source station address of the device closest to the zero-trust gateway is selected as the target source station address corresponding to the current target domain name request, and finally the target source station address is returned to the zero-trust gateway.

[0111] If the current target domain name request is not found in the zero-trust DNS service cluster, the domain name resolution result representing the target domain name request is not pre-configured in the zero-trust DNS service cluster, therefore, the zero-trust DNS server responsible for resolving the current target domain name request can return a resolution failure response.

[0112] S103: After receiving the target source station address, the zero-trust gateway accesses the target source station address.

[0113] When the zero-trust gateway receives the target source station address returned by the zero-trust DNS server in response to the current target domain name request, the target source station address can be accessed.

[0114] In an available implementation, the method further includes the following steps:

[0115] S104: When the intranet DNS service cluster responds to any target domain name request, the non-domain name resolution result corresponding to the target domain name request is obtained, and a security response strategy in the non-domain name resolution result is executed.

[0116] Since in the process of constructing the system, for the target domain name request that has published the domain name resolution result on the zero-trust DNS service cluster, the domain name resolution result stored in the intranet DNS service cluster is deleted or modified, the source station address of the target domain name on the intranet DNS service cluster is hidden; and the target domain name request of the user is based on the domain name request processed by the zero-trust gateway, the zero-trust gateway will directly forward any target domain name request to the zero-trust DNS service cluster for resolution and source return, that is, the target domain name request is not based on the intranet DNS service cluster to realize address source return; if the intranet DNS service cluster responds to any target domain name request at this time, it indicates that the attacker may have broken through the network boundary, and there is a security risk that any source station address is attacked.

[0117] When the intranet DNS service cluster responds to any target domain name request, the non-domain name resolution result corresponding to the target domain name request is obtained, and a security response strategy in the non-domain name resolution result is executed. For example, when the security response strategy is to return an illegal response, the intranet DNS service cluster returns NX Domain indicating that the resolution fails, or 127.0.0.1, etc.; when the security response strategy is to return the address of a security honeypot, the intranet DNS service cluster returns the address of the security honeypot to guide the attacker to enter the security honeypot, and real-time record and audit the attack traffic, behavior and data of the attacker, and provide data or evidence support for security tracing.

[0118] Referring to Figure 4 , an execution schematic diagram of a network access method based on a zero-trust gateway provided by an embodiment of the present application is shown, Figure 4The system in the figure shows two zero trust gateways: zero trust gateway 1 and zero trust gateway 2, a zero trust DNS service cluster, and an intranet DNS service cluster. When zero trust gateway 1 sends a target domain name request 1: site1.example.com to the zero trust DNS service cluster, the zero trust DNS service cluster obtains a domain name resolution result 1 corresponding to the target domain name request 1, which includes two source station addresses: 10.0.0.1 and 10.0.0.2. The zero trust DNS service cluster returns the source station address 10.0.0.1 closest to zero trust gateway 1 in the domain name resolution result 1 as a target source station address to zero trust gateway 1.

[0119] As Figure 4 When zero trust gateway 2 sends a target domain name request 2: site2.example.com to the zero trust DNS service cluster, the zero trust DNS service cluster obtains a domain name resolution result 2 corresponding to the target domain name request 2, which includes two source station addresses: 10.0.0.3 and 10.0.0.4. The zero trust DNS service cluster returns the source station address 10.0.0.3 closest to zero trust gateway 2 in the domain name resolution result 2 as a target source station address to zero trust gateway 2.

[0120] As Figure 4 When the intranet DNS service cluster responds to the target domain name request 1: site1.example.com, the target domain name request 1 may be initiated by an attacker directly to the intranet DNS service cluster through attack software. At this time, the intranet DNS service cluster executes a security response strategy corresponding to the target domain name request 1, and returns a response corresponding to the target domain name request 1 as 127.0.0.1.

[0121] As Figure 4 When the intranet DNS service cluster responds to the target domain name request 2, the target domain name request 2 may be initiated by an attacker directly to the intranet DNS service cluster through attack software. At this time, the intranet DNS service cluster executes a security response strategy corresponding to the target domain name request 2, and returns a response corresponding to the target domain name request 2 as NX Domain.

[0122] The zero trust gateway 1 and the zero trust gateway 2 send the target domain name request initiated by the user to the zero trust DNS service cluster for source returning. For other non-target domain name requests, the intranet DNS service cluster can still be sent for source returning. Even if an attacker attacks the zero trust gateway and directly obtains the target domain name request from the intranet DNS service cluster through the zero trust gateway, because the intranet DNS service cluster maintains a non-domain name resolution result of the target domain name request, the real source station address of the target domain name request cannot be obtained.

[0123] In an implementable embodiment, during the application of the system, the zero trust gateway, the zero trust DNS server and the modification of the corresponding security response policy of any target domain name request in the intranet DNS service cluster are also allowed to be extended; the configuration module in the system can be used for configuring the domain name of any zero trust gateway, configuring the DNS service of the zero trust DNS server and configuring the corresponding security response policy of any target domain name request in the intranet DNS service cluster.

[0124] Specifically, the configuration module is configured to respond to the addition operation of the zero trust gateway, and configure the domain name or address of the added zero trust gateway for pointing to the zero trust DNS service cluster, thereby realizing the provision of DNS service for the added zero trust gateway and having the effect of horizontally extending the zero trust gateway.

[0125] The configuration module is configured to respond to the addition operation of the zero trust DNS server, and perform access configuration for the added zero trust DNS server and store the domain name resolution results corresponding to the plurality of target domain name requests in the added zero trust DNS server, so that a new zero trust DNS server can be added to the zero trust DNS cluster to provide better and faster DNS service.

[0126] The configuration module is configured to respond to the addition operation of the target domain name request, and store the domain name resolution result corresponding to the added target domain name request in the zero trust DNS service cluster; and change the domain name resolution result corresponding to the added target domain name request in the intranet DNS service cluster to a non-domain name resolution result, so that different applications and source stations can be flexibly added.

[0127] The system provided in the embodiment realizes the source returning of the domain name request based on the zero trust gateway and the zero trust DNS service cluster, and the zero trust gateway checks the user identity and authority of the target domain name request by executing the first security check policy, and the zero trust DNS server in the zero trust DNS service cluster checks the identity of the zero trust gateway based on the second security check policy, so that the attacker is prevented from obtaining the source station address corresponding to any target domain name request by attacking the zero trust gateway and the zero trust DNS service cluster, and the security of the source station address is further improved.

[0128] At the same time, the domain name resolution result of the target domain name request in the intranet DNS service cluster is modified, that is, a non-domain name resolution result is configured for the target domain name request in the intranet DNS service cluster, and the real source station address of the target domain name request in the intranet DNS service cluster is hidden.

[0129] The system can effectively protect the security of the real source station address in the intranet DNS service cluster in the zero trust service, reduce the risk of malicious attacks on the intranet DNS service cluster by attackers; at the same time, the zero trust gateway and the zero trust DNS service cluster providing the zero trust service can be extended, thereby providing better and faster DNS service; and compared with statically configuring the source station address corresponding to the domain name request in the gateway, obtaining the source station address by resolving the target domain name request can reduce the operation and maintenance cost of the gateway, and determining the nearest zero trust DNS server and the nearest source station address can improve the source returning efficiency.

[0130] Referring to Figure 5 , a schematic diagram of a computer readable storage medium provided by an embodiment of the application is shown, the computer readable storage medium 500 stores a computer program 501, and the computer program 501 is executed by a processor to implement the network access method based on the zero trust gateway as described in the embodiments.

[0131] Each of the embodiments in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same or similar parts between the embodiments can be referred to each other.

[0132] Those skilled in the art should understand that the embodiments of the embodiments of the application can be provided as a method, device, or computer program product. Therefore, the embodiments of the application can adopt a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the embodiments of the application can adopt the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) containing computer usable program code.

[0133] The embodiments of the application are described with reference to the flowcharts and / or block diagrams according to the method, terminal device (system), and computer program product of the embodiments of the application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the computer or other programmable data processing terminal device produce a device for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 The device for implementing the functions specified in one flow or multiple flows and / or blocks. Figure 1 The device for implementing the functions specified in one flow or multiple flows and / or blocks.

[0134] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flow Figure 1 The flow or flows and / or blocks Figure 1 The flow or flows and / or blocks

[0135] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flow Figure 1 The flow or flows and / or blocks Figure 1 The flow or flows and / or blocks

[0136] Although preferred embodiments of the application have been described, those skilled in the art will recognize that additional modifications and changes can be made thereto without departing from the scope of the present application. Accordingly, the appended claims are intended to cover all such modifications and changes as fall within the scope of the application.

[0137] Finally, it should be noted that the terms "first", "second", and the like, herein do not denote any order, quantity, combination, or importance, but rather are used to distinguish one element from another, and are not intended to denote a particular order, quantity, combination, or importance of, or between, the elements so designated. Also, the use of the terms "including", "containing", or "comprising" and variations thereof, is meant to encompass the inclusion of zero or more elements, steps, or components, and is not meant to exclude the addition of other elements, steps, or components, or groups thereof. Additionally, the use of the indefinite article "a" or "an" is meant to encompass the addition of zero or more elements, steps, or components, and is not meant to exclude the addition of other elements, steps, or components, or groups thereof.

[0138] The principles and implementations of the present application have been described above with the specific examples. The above descriptions are only used to help understand the method and its core idea of the present application; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation and application range can be changed; in summary, the content of the present description should not be understood as the limitation of the present application.

Claims

1. A network access system based on zero-trust gateway, characterized in that: The system comprises a plurality of zero-trust gateways, a zero-trust DNS service cluster, and an intranet DNS service cluster, the zero-trust DNS service cluster stores a domain name resolution result corresponding to any target domain name request, the target domain name request is a domain name request accessed based on any zero-trust gateway, and the domain name resolution result comprises at least one source station address corresponding to the target domain name request; Any zero-trust gateway is configured to, in response to an access operation of a current user, acquire a current target domain name request, and execute a first security verification strategy for verifying identity information of the current user, when the first security verification strategy passes, acquire a target source station address corresponding to the current target domain name request in the zero-trust DNS service cluster, and access the target source station address corresponding to the current target domain name request, wherein the target source station address is any source station address in the domain name resolution result corresponding to the current target domain name request; When the intranet DNS service cluster responds to any target domain name request, a non-domain name resolution result corresponding to the target domain name request is acquired, and the non-domain name resolution result comprises a security response strategy corresponding to the target domain name request, and the security response strategy is used for hiding a source station address corresponding to the target domain name request.

2. The system of claim 1, wherein, Any zero-trust gateway is configured to, in response to an access operation of a current user, acquire a current target domain name request, and execute a first security verification strategy for verifying identity information of the current user, when the first security verification strategy passes, acquire a target source station address corresponding to the current target domain name request in the zero-trust DNS service cluster, and access the target source station address corresponding to the current target domain name request, wherein the target source station address is any source station address in the domain name resolution result corresponding to the current target domain name request; When the intranet DNS service cluster responds to any target domain name request, a non-domain name resolution result corresponding to the target domain name request is acquired, and the non-domain name resolution result comprises a security response strategy corresponding to the target domain name request, and the security response strategy is used for hiding a source station address corresponding to the target domain name request. When the first security verification strategy passes, the zero-trust gateway is further configured to send the current target domain name request carrying a security identifier of the zero-trust gateway to the zero-trust DNS service cluster; 3. The system of claim 2, wherein, The zero-trust DNS service cluster comprises a plurality of zero-trust DNS servers, a master server in the plurality of zero-trust DNS servers is configured to execute a second security verification strategy for verifying the identity of the zero-trust gateway, when the second security verification strategy passes, the master server sends the current target domain name request to a zero-trust DNS server closest to the zero-trust gateway; ​ 4. The system of claim 1, wherein, ​ ​ The zero-trust DNS server closest to the zero-trust gateway is configured to resolve a domain name resolution result corresponding to the current target domain name request, and after determining a target source station address corresponding to the current target domain name request in the domain name resolution result, send the target source station address to the zero-trust gateway.

5. The system of claim 1, wherein, When the first security verification strategy passes, the zero-trust gateway is further configured to send a current target domain name request carrying a security identifier of the zero-trust gateway to the zero-trust DNS service cluster. The zero-trust DNS service cluster is configured to send the current target domain name request to a zero-trust DNS server closest to the zero-trust gateway in the zero-trust DNS service cluster based on an anycast technology. The zero-trust DNS server closest to the zero-trust gateway is configured to execute a second security verification strategy for verifying the identity of the zero-trust gateway, and when the second security verification strategy passes, resolve a domain name resolution result corresponding to the current target domain name request, and after determining a target source station address corresponding to the current target domain name request in the domain name resolution result, send the target source station address to the zero-trust gateway.

6. The system of claim 4 or 5, wherein, When the domain name resolution result corresponding to the current target domain name request includes multiple source station addresses, the zero-trust DNS server closest to the zero-trust gateway is configured to determine the distance between the devices corresponding to the multiple source station addresses and the zero-trust gateway, and take the closest source station address as the target source station address.

7. The system of claim 1, wherein, The security response strategy corresponding to any target domain name request includes returning an illegal response or returning the address of a security honeypot.

8. The system of claim 1, wherein, The system further includes a configuration module configured to configure the domain name or address of any zero-trust gateway, configure the DNS service of the zero-trust DNS server, and configure the security response strategy corresponding to any target domain name request in the intranet DNS service cluster.

9. The system of claim 8, wherein, The configuration module is further configured to, in response to an addition operation of a zero-trust gateway, configure a domain name or address of the added zero-trust gateway for pointing to the zero-trust DNS service cluster.

10. The system of claim 8, wherein, The configuration module is further configured to, in response to an addition operation of a zero-trust DNS server, perform access configuration on the added zero-trust DNS server and store domain name resolution results corresponding to multiple target domain name requests in the added zero-trust DNS server.

11. The system of claim 8, wherein, The configuration module is further configured to, in response to an addition operation of a target domain name request, store a domain name resolution result corresponding to the added target domain name request in the zero-trust DNS service cluster; and change the domain name resolution result corresponding to the added target domain name request in the intranet DNS service cluster to a non-domain name resolution result.

12. A method for network access based on a zero trust gateway, characterized in that, The method is applied to the zero-trust gateway-based network access system of any one of claims 1-11, and the method comprises: Any zero-trust gateway is configured to, in response to an access operation of a current user, acquire a current target domain name request, execute a first security verification strategy for verifying the identity information of the current user, and when the first security verification strategy passes, send the current target domain name request to a zero-trust DNS service cluster; The zero-trust DNS service cluster resolves the domain name resolution result corresponding to the current target domain name request, determines a target source station address corresponding to the current target domain name request, and sends the target source station address to the zero-trust gateway; After receiving the target source station address, the zero-trust gateway accesses the target source station address.

13. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the network access method based on the zero-trust gateway in claim 12.

Images