A zero-trust micro-gateway-based access control method and system

Abstract

The present invention relates to an access control method and system based on a zero-trust micro-gateway, and belongs to the field of information security technology. The present invention establishes a zero-trust micro-gateway management center for a microservice architecture, and deploys a zero-trust micro-gateway policy execution center on the container where each microservice is located, that is, a containerized zero-trust micro-gateway firewall is established before each microservice to achieve network blocking of unauthorized access. The management center performs SPA authentication on the visitor of the microservice, opens the authentication service port to the visitor IP after the SPA authentication is passed, receives the visitor's authentication request data packet for access authentication, and generates a dynamic access control policy based on the visitor's environmental baseline data after the access authentication is passed and sends it to the execution center. The execution center controls the visitor's access according to the verified access control policy. The solution of the present invention hides the microservice behind the zero-trust micro-gateway, effectively realizes the invisibility of the application service to the network, and improves the security of the service.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to an access control method and system based on a zero-trust micro-gateway. Background Art

[0002] As the complexity of the system increases and the number of interdependencies increases, in order to achieve the principle of loose coupling between services and realize the relatively independent development and maintenance of each service, the microservice architecture has become the preferred architecture for most companies. This architecture can cope with high-concurrency and high-traffic business needs. By splitting the system into multiple microservices, they can be developed, deployed and expanded independently, improving the flexibility and scalability of the system.

[0003] Microservices are usually deployed in containerized clouds, and the security authentication method used is mainly service authentication of users. However, a large number of microservices deployed in containers lack sufficient security protection systems, and authentication between services usually has no or only weak authentication such as password authentication. At present, the mainstream microservice security architectures include Spring Security, Istio, OAuth2, OpenID Connect and Keycloak. These security architectures all emphasize identity authentication and access control at the application layer, while the security of services mainly depends on the security protection of microservices at the application layer by the deployed interceptors.

[0004] However, in addition to traditional application layer attacks, hacker attacks are more often launched from the network layer or by exploiting vulnerabilities in the application layer. That is, as long as the service is exposed to the network, hackers have network-reachable attack conditions, so the security protection of the application layer is flawed and insufficient; and the authentication and access control of these mainstream security architectures are static, which also poses a great security risk to application services; traditional access control is to release by verifying the carried authorization token or access credentials, and the token or credentials can be intercepted by hackers during network transmission and used for attacks. In other words, the services of the current mainstream microservice security framework are usually exposed to the network, and attackers only need to break through the service's password authentication to enter the service. Once they enter the microservice application, they can usually access other resources unimpeded, which brings huge potential risks to the security of a large number of microservice applications. Summary of the invention

[0005] In view of the above analysis, the present invention aims to provide an access control method and system based on a zero-trust micro-gateway, establish a zero-trust micro-gateway management center for the microservice architecture, and deploy a zero-trust micro-gateway policy execution center on the container where the microservice is located, that is, establish a containerized zero-trust micro-gateway firewall before each microservice to achieve network blocking of unauthorized access, effectively realize the network invisibility of application services, and greatly improve the security of microservice applications.

[0006] On the one hand, the present invention provides an access control method based on a zero-trust micro-gateway, which specifically includes the following steps:

[0007] The zero-trust micro-gateway management center performs SPA authentication on the visitor of the microservice. After the SPA authentication is passed, the authentication service port is opened to receive the authentication request data packet of the visitor for access authentication. After the access authentication is passed, a dynamic access control policy is generated based on the environmental baseline data of the visitor, and sent to the zero-trust micro-gateway policy execution center deployed in the same container as the microservice;

[0008] The execution center verifies the dynamic access control policy, and controls the visitor's access to the microservice based on the access control policy after the verification is passed.

[0009] Furthermore, the environmental baseline data includes source IP address, source MAC address, device hardware information, operating system information, and security protection information; the management center generates a dynamic access control strategy based on the visitor's environmental baseline data, including:

[0010] The management center performs an initial risk assessment based on the visitor's environmental baseline data to obtain a risk assessment score;

[0011] Based on the risk assessment score, visitor role and application resource access permission base score, obtain a list of resources that the visitor can access under the current risk assessment result;

[0012] The management center generates a digital signature for each data item including visitor identification, source IP address, visitor device identification, accessible resource list, current timestamp and access validity period using the management center identification private key, and generates a dynamic access control strategy based on the above data items and digital signatures.

[0013] Further, the execution center verifies the dynamic access control policy, and controls the visitor's access to the microservice based on the access control policy after the verification, including:

[0014] The execution center verifies the digital signature of the dynamic access control policy to verify the authenticity and integrity of the access control policy, and verifies the signature identifier to determine that the dynamic access control policy is signed by the management center, and opens access ports for source IP addresses and source MAC addresses according to the access validity period based on the verified dynamic access control policy;

[0015] After receiving the access authentication response from the management center, the visitor sends an application resource access request to the execution center;

[0016] The network layer security module of the execution center determines whether the source of the application resource access request is a whitelist based on the dynamic access control policy;

[0017] The application layer security module of the execution center performs a consistency check between the application layer visitor identifier and the network layer visitor identifier for the application resource access request from the whitelist;

[0018] The execution center sends the application resource access request that passes the visitor identification consistency check to the microservice;

[0019] The execution center returns the received response of the microservice to the application resource access request to the visitor.

[0020] Further, the authentication request data packet includes the visitor identification, application time, visitor IP address, visitor device identification and authentication request digital signature;

[0021] After the SPA authentication is passed, the management center opens the authentication service port to receive the authentication request data packet of the visitor to perform access authentication, including:

[0022] The management center opens the identity authentication service port to the IP address provided by the visitor within a first set time range after the SPA authentication is passed;

[0023] The management center verifies the digital signature of the received authentication request data packet based on the identity authentication service port to verify the integrity and authenticity of the authentication request data packet and the authenticity of the visitor's identification, and checks whether the visitor's identification is a registered identification and whether the application time is within a second set time range.

[0024] Furthermore, the first set time range is 30 seconds, and the second set time range is -30 to 30 seconds.

[0025] Furthermore, the access control method further includes:

[0026] The execution center monitors the visitor's network information data in real time and reports it to the management center. The visitor's network information data includes: the visitor's environmental baseline data, access time, resources requested for access, access behavior, and access traffic;

[0027] The management center updates the current dynamic access control strategy in real time based on the visitor's network information data;

[0028] The execution center implements access control on the visitor based on the updated dynamic access control policy.

[0029] Furthermore, the management center updates the dynamic access control strategy in real time based on the visitor's network information data, including:

[0030] The management center determines whether to implement enhanced authentication based on at least one of the resources applied for access by the visitor, the access behavior, the access flow, and the access time;

[0031] For visitors who do not need enhanced authentication or have passed enhanced authentication, a real-time risk assessment is performed based on the visitor's network information data to obtain a real-time assessment score;

[0032] Based on the real-time assessment score, visitor role and application resource access permission base score, obtain a list of resources that the visitor can access under the current risk assessment result;

[0033] The management center generates a digital signature for each data item including visitor identification, source IP address, visitor device identification, accessible resource list, current timestamp and access validity period using the management center identification private key, and updates the current dynamic access control policy based on the above data items and digital signatures.

[0034] On the other hand, the present invention also provides an access control system based on a zero-trust micro-gateway, including a zero-trust micro-gateway management center and a plurality of zero-trust micro-gateway policy execution centers, wherein:

[0035] The zero-trust micro-gateway management center is used to perform SPA authentication on the visitor of the microservice, open the authentication service port to receive the visitor's authentication request data packet for access authentication after the SPA authentication is passed, and generate the corresponding dynamic access control policy based on the visitor's environmental baseline data after the access authentication is passed, and send it to the zero-trust micro-gateway policy execution center deployed in the same container as the microservice;

[0036] Each of the zero-trust micro-gateway policy execution centers is deployed on the same container as the corresponding microservices, and is used to verify the received dynamic access control policy, and after the verification is passed, control the visitor's access to the microservices in the container based on the access control policy.

[0037] Furthermore, each of the zero-trust micro-gateway policy execution centers monitors the visitor's network information data in real time and reports it to the management center, and the visitor's network information data includes: the visitor's environmental baseline data, access time, resources requested for access, access behavior, and access traffic;

[0038] The management center updates the dynamic access control strategy in real time based on the visitor's network information data;

[0039] The execution center implements access control on the visitor based on the updated dynamic access control policy.

[0040] Furthermore, the zero-trust micro-gateway management center is also used to:

[0041] Manage and maintain visitor information, zero-trust micro-gateway policy execution center information, protected micro-service resource information, the association between the zero-trust micro-gateway policy execution center and micro-service resources, visitor-accessible micro-service service information, and access baseline conditions for micro-service resources; the visitor information includes user information and other application information that calls micro-service resources;

[0042] Perform key distribution management, including the generation, distribution, update, recovery and cancellation of visitor identification keys;

[0043] Identify and authenticate visitors.

[0044] The present invention can achieve at least one of the following beneficial effects:

[0045] The micro-gateway authentication management center authenticates visitors who access microservices. After the authentication is passed, the microservice execution center implements access control on the visitor according to the dynamic access control policy for the visitor issued by the management center. That is, it is the security policy that controls the access without generating access credentials. Therefore, visitors no longer need to carry access credentials or authorization tokens, which can effectively prevent hackers from attacking by stealing credentials, forging tokens, and other traditional attack methods.

[0046] By deploying the zero-trust micro-gateway execution center in the container where the protected application resource micro-service is located, it is equivalent to providing a door access system for the micro-service, blocking the network for unauthorized access, and effectively realizing the network invisibility of the application service. Even if the cloud host where the application micro-service is deployed is invaded by a virus or Trojan horse, it cannot detect the existence of the application service, let alone form an effective attack. At the same time, since the zero-trust micro-gateway execution center and the micro-service are deployed in the same container, the attack vulnerability caused by the need to interact through the network due to the separate deployment of zero trust and application in the traditional security architecture is avoided.

[0047] The present invention adopts the security concept of zero trust, blocks illegal access from the network layer and realizes network invisibility for application service resources, so that hackers cannot detect the existence of application service resources, adopts dynamic and fine-grained time-limited authorization strategies for legitimate visitors, and conducts continuous dynamic risk assessment based on multi-dimensional factors such as visitor's environmental information, access time, access resources, access behavior analysis, access traffic analysis, etc., dynamically adjusts the access control strategy according to the assessment results to determine whether the visitor continues to access or blocks the visitor's access, which can effectively prevent illegal access or unauthorized access by legitimate personnel and minimize the risk. There is no network point that can be illegally accessed, and even internal personnel cannot achieve illegal access. The logical isolation of the network can effectively solve the security risks brought about by the blurred network boundaries of the current cloud deployment.

[0048] Other features and advantages of the present invention will be described in the following description, and some advantages may become apparent from the description, or may be understood by practicing the present invention. The purpose and other advantages of the present invention may be realized and obtained through the contents particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings are only used for the purpose of illustrating specific embodiments and are not to be considered as limiting the present invention. In the entire drawings, the same reference symbols represent the same components;

[0050] Figure 1 is a flow chart of the method of the present invention;

[0051] Figure 2 This is a flow chart of step S1 of the present invention, i.e. visitor authentication;

[0052] Figure 3 A flow chart for generating a dynamic access control strategy in step S105 of the present invention;

[0053] Figure 4 This is a flow chart of step S2 of the present invention. DETAILED DESCRIPTION

[0054] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not used to limit the scope of the present invention.

[0055] Method Embodiment

[0056] A specific embodiment of the present invention discloses an access control method based on a zero-trust micro-gateway, which specifically includes the following steps:

[0057] Step S1, the zero-trust micro-gateway management center performs SPA authentication on the visitor of the microservice, and after the SPA authentication is passed, opens the authentication service port to receive the visitor's authentication request data packet for access authentication, and after the access authentication is passed, generates a dynamic access control policy based on the visitor's environmental baseline data, and sends it to the zero-trust micro-gateway policy execution center deployed in the same container as the microservice;

[0058] Step S2: The execution center verifies the dynamic access control policy, and controls the visitor's access to the microservice based on the access control policy after the verification is passed.

[0059] In this embodiment, the micro-gateway authentication management center authenticates the visitor who accesses the micro-service. After the authentication is passed, the micro-service execution center implements access control on the visitor according to the dynamic access control policy for the visitor issued by the management center, that is, the security policy is used to control the access without generating access credentials, so that the visitor no longer needs to carry access credentials or authorization tokens, which can effectively prevent hackers from attacking by stealing credentials, forging tokens and other traditional attack methods. By deploying the zero-trust micro-gateway execution center in the container where the protected application resource micro-service is located, it is equivalent to providing a door access system for the micro-service, realizing network blocking of unauthorized access, and effectively realizing the network invisibility of the application service. Even if the cloud host where the application micro-service is deployed is invaded by a virus or a Trojan horse, it cannot detect the existence of the application service, let alone form an effective attack. At the same time, since the zero-trust micro-gateway execution center and the micro-service are deployed in the same container, the attack vulnerability caused by the need to interact through the network caused by the separate deployment of zero trust and application in the traditional security architecture is avoided.

[0060] In a specific embodiment of the present invention, step S1 includes (such as Figure 2 shown):

[0061] S101: The visitor uses the shared key distributed by the management center for authentication to generate a SPA message and sends it to the management center;

[0062] The SPA message includes the visitor ID, the visitor device ID, the visitor IP address, the one-time password, the message sequence number and the HMAC check code, etc.

[0063] S102: The management center verifies the SPA message. If the verification is successful, the identity authentication service port is opened to the IP address provided by the visitor for a first set time range. Otherwise, the data packet is discarded without processing.

[0064] Wherein, the first set time range is 30 seconds;

[0065] Verify the SPA message, including: decrypt based on the shared key to obtain the visitor identification, visitor device identification, visitor IP address, one-time password, message sequence number and HMAC check code, etc.; further, verify the visitor identification to determine the identity of the visitor; verify the visitor device identification to confirm the request from the authorized device; verify whether the visitor IP address is consistent with the authorized network or IP range to prevent access from illegal IP addresses; verify whether the one-time password is valid, the one-time password is used to prevent replay attacks and ensure the uniqueness of each data packet; verify the message sequence number to ensure the order and integrity of the message to prevent replay and tampering of the message; verify the HMAC check code to confirm that the SPA message has not been tampered with;

[0066] S103: The visitor needs to send an authentication request data packet to the identity authentication service port opened by the management center within a first set time range after sending the SPA message;

[0067] The visitor digitally signs the data items including the visitor ID, application time, visitor IP address, and visitor device ID based on his / her private key to obtain the authentication request digital signature, and constructs the authentication request data packet based on the above data items and the authentication request digital signature;

[0068] S104: The management center performs access authentication based on the visitor's authentication request data packet, including:

[0069] The management center verifies the digital signature of the received authentication request data packet based on the identity authentication service port to verify the integrity and authenticity of the authentication request data packet and the authenticity of the visitor's ID, and checks whether the visitor's ID is a registered ID and whether the application time is within a second set time range; the second set time range is -30 to 30 seconds; if the verification fails, an authentication failure message is directly returned to the visitor (i.e., S107);

[0070] S105: When the access authentication is passed, the management center generates a dynamic access control policy based on the visitor's environmental baseline data;

[0071] S106: The management center sends the dynamic access control policy to the zero-trust micro-gateway policy execution center corresponding to the resources accessible to the visitor through a secure channel;

[0072] It should be noted that when access resources involve multiple microservices, the dynamic access control policy needs to be sent to multiple corresponding execution centers;

[0073] S107: The management center returns the authentication result to the visitor.

[0074] In this embodiment, a dynamic access control strategy of the network layer is adopted to replace the traditional application layer authorization token, so that illegal access is blocked from the network layer, that is, the network between illegal access and protected application service resources is unreachable, thereby improving the security of the microservice architecture.

[0075] Further, step S105 is a dynamic access control strategy generation process of the present invention (such as Figure 3 In a specific embodiment of the present invention, step S105 further includes:

[0076] S1051: The management center performs an initial risk assessment based on the environmental baseline data provided by the visitor during authentication to obtain a risk assessment score;

[0077] The environmental baseline data includes source IP address, source MAC address, device hardware information, operating system information, and security protection information;

[0078] S1052: Obtain a list of resources that the visitor can access under the current risk assessment result based on the risk assessment score, the visitor role, and the access permission basic score of the application resource;

[0079] The resource list includes: resource identifier, zero-trust micro-gateway policy execution center identifier where the resource is located, private domain name or virtualized IP, and port;

[0080] S1053: The management center generates a digital signature for each data item including the visitor ID, source IP address, visitor device ID, accessible resource list, current timestamp and access validity period using the management center ID private key, and generates a dynamic access control policy based on the above data items and the digital signature;

[0081] S1054: The management center sends the generated dynamic access control policy to each zero-trust micro-gateway access control policy execution center involved in the resource table allowed to access.

[0082] Exemplarily, in step S1051, the risk assessment score obtained by the initial risk assessment is the weighted sum of the scores of each environmental baseline data.

[0083] For example, the source IP address is distinguished between the intranet and the extranet, with the score for the intranet being 10 points and the score for the extranet being 5 points; the source MAC address is 10 points for whitelist devices, 0 points for blacklist devices, and 5 points for devices not in the blacklist or whitelist; the device hardware information is 10 points for domestically produced devices, 5 points for non-domestic devices, and 0 points for devices that are prohibited from use in certain enterprises or parts; the operating system information sets different scores according to the operating system type, such as 5 points for Windows, 6 points for CentOS, and 10 points for KylinOS or UOS; in the security protection information, 8 points for installing and enabling a firewall, 10 points for the latest version of the firewall, 6 points for versions that have not been updated for more than half a year, and 0 points for no firewall; the score distribution of antivirus software is similar to that of firewalls. Further, different data items have different weights, with a base value of 1, which fluctuates up and down according to importance and is set according to user needs. Further, a weighted calculation is performed based on the scores of each environmental baseline data to obtain a risk assessment score.

[0084] Exemplarily, in step S1052, the visitor's score = risk assessment score + visitor's basic score. Based on the visitor's role, the visitor's basic score corresponding to the visitor of different roles is obtained. Exemplarily, the administrator's visitor basic score is 50 points, the general user's basic score is 30 points, and the visitor's basic score is 10 points. Furthermore, different application resources require different access permission basic scores. When the visitor's score is above the access permission basic score required by the application resource, the application resource is added to the list of resources that the visitor can access. Exemplarily: the mail application requires more than 65 points. When the visitor's score is 75 points, this resource is added to the visitor's access control policy table. The office automation system requires 80 points. If the visitor's score is lower than 80 points, the office automation system cannot be accessed, and this resource cannot be added to the list of resources that the visitor can access.

[0085] Exemplarily, in step S1053, the access validity period is set to five minutes.

[0086] In this embodiment, by limiting the visitor's IP, device identification and access validity period, a limited-time dynamic access control policy is generated for the visitor, restricting legitimate visitors to only achieve limited-time access from the device and IP address specified during the authentication application. After the authorization time is exceeded, the dynamic access control policy is automatically closed. To achieve continuous access, the visitor needs to authenticate again before the policy expires to obtain the access release policy, that is, to achieve continuous identity authentication for the visitor; the dynamic access control policy is generated by the management center and directly issued and executed through a secure channel with the micro-gateway policy center, so the visitor no longer needs to carry an authorization token to access, and the attacker cannot obtain the access control policy for attack; further, the dynamic access control policy includes the visitor identification, source IP address, visitor device identification, private domain name or virtualized IP and port of the accessed resource; the access validity period and the digital signature of the management center can prevent counterfeiting and tampering attacks on policy information, and even if the attacker obtains the access control policy, it cannot be used for attack.

[0087] In a specific embodiment of the present invention, step S2 (such as Figure 4 shown) also includes:

[0088] S201: The execution center verifies the digital signature of the dynamic access control policy to verify the authenticity and integrity of the access control policy, and verifies the signature identifier to determine that the dynamic access control policy is signed by the management center; if the verification fails, the dynamic access control policy is discarded;

[0089] S202: The execution center opens access ports to the source IP address and the source MAC address according to the access validity period based on the verified dynamic access control policy;

[0090] S203: After receiving the access authentication response from the management center, the visitor sends an application resource access request to the execution center;

[0091] S204: The network layer security module of the execution center determines whether the source of the application resource access request is on the whitelist based on the dynamic access control policy; if so, the access request is allowed to enter the application layer security module; otherwise, the access request is discarded;

[0092] S205: The application layer security module of the execution center performs a consistency check between the application layer visitor identifier and the network layer visitor identifier for the application resource access request from the whitelist. If they are consistent, the access request is released; otherwise, the access request is discarded;

[0093] S206: The execution center sends the application resource access request that passes the visitor identifier consistency check to the microservice;

[0094] S207: The microservice sends a response to the application resource access request to the execution center;

[0095] S208: The execution center returns the received response to the visitor, that is, the visitor obtains the application resource to be accessed.

[0096] In this embodiment, by using the consistency check between the visitor identification and the authentication application device identification and IP address, it is possible to prevent illegal visitors from using devices that have obtained access control policies to gain illegal access, that is, even if the visitor's device is hacked, the protected application service resources cannot be accessed through this device.

[0097] In a specific embodiment of the present invention, an access control method based on a zero-trust micro-gateway also includes:

[0098] The execution center monitors the visitor's network information data in real time and reports it to the management center. The visitor's network information data includes: the visitor's environmental baseline data, access time, resources requested for access, access behavior, and access traffic;

[0099] The management center updates the current dynamic access control strategy in real time based on the visitor's network information data;

[0100] The execution center implements access control on the visitor based on the updated dynamic access control policy.

[0101] Furthermore, the management center updates the dynamic access control strategy in real time based on the visitor's network information data, including:

[0102] The management center determines whether to implement enhanced authentication based on at least one of the resources applied for access by the visitor, the access behavior, the access traffic, and the access time; exemplary scenarios for determining to implement enhanced access authentication include: a visitor with access rights to resource A initiates a request to access resource B; the visitor's access traffic suddenly exceeds the historical daily access traffic; the visitor's access time is different from the historical daily access time period, etc.; exemplary, the enhanced authentication can be to add SMS authentication on the basis of the original password authentication;

[0103] For visitors who do not need to implement enhanced authentication or have passed enhanced authentication, a real-time risk assessment is performed based on the visitor's network information data in addition to the environmental baseline data to obtain a real-time risk assessment score; for example, when a visitor's behavior or traffic is abnormal, the real-time risk assessment score can be obtained by subtracting the corresponding score of the abnormal behavior or traffic abnormality from the weighted sum of the scores of each environmental baseline data;

[0104] Based on the real-time risk assessment score, the visitor role and the access permission basic score of the application resource, a list of resources that the visitor can access under the current risk assessment result is obtained; it should be noted that the management center can also update the access permission basic score required for accessing the application resource in real time according to the frequency of application resource access and risk assessment; the management center can also update the visitor's role and permissions according to the visitor's behavior and historical access records. For example, if a visitor frequently accesses a certain type of resource, it can be considered to update his role to a permission level that is more suitable for accessing the resource;

[0105] The management center generates a digital signature for each data item including visitor identification, source IP address, visitor device identification, accessible resource list, current timestamp and access validity period using the management center identification private key, and updates the current dynamic access control policy based on the above data items and digital signatures.

[0106] In this embodiment, the management center provides a dynamic risk assessment function to conduct risk assessment on multiple factors such as the visitor's access location (IP), access time period, visitor's device environment baseline, access behavior, access traffic, etc., so as to update the access control policy, effectively prevent abnormal access by legitimate personnel, and minimize risk control; by using dynamic enhanced authentication when the resources, access behavior, access traffic, and access time applied for by the visitor are abnormal, attackers are prevented from stealing the visitor's identity, and visitors who fail the dynamic enhanced authentication are prohibited from continuing to access, thereby blocking the attacker's attack path.

[0107] System Example

[0108] An access control system based on a zero-trust micro-gateway includes a zero-trust micro-gateway management center and multiple zero-trust micro-gateway policy execution centers, wherein:

[0109] The zero-trust micro-gateway management center is used to perform SPA authentication on the visitor of the microservice, open the authentication service port to receive the visitor's authentication request data packet for access authentication after the SPA authentication is passed, and generate the corresponding dynamic access control policy based on the visitor's environmental baseline data after the access authentication is passed, and send it to the zero-trust micro-gateway policy execution center deployed in the same container as the microservice;

[0110] Each of the zero-trust micro-gateway policy execution centers is deployed on the same container as the corresponding microservices, and is used to verify the received dynamic access control policy, and after the verification is passed, control the visitor's access to the microservices in the container based on the access control policy.

[0111] Furthermore, the zero-trust micro-gateway management center is also used to:

[0112] Manage and maintain visitor information (including user information and other application information that calls microservice resources), zero-trust microgateway policy execution center information, protected microservice resource information, the association between the zero-trust microgateway policy execution center and microservice resources, microservice service information accessible to visitors, and access baseline conditions for microservice resources;

[0113] Perform key distribution management, including the generation, distribution, update, recovery and cancellation of visitor identification keys;

[0114] Identify and authenticate visitors.

[0115] Furthermore, each of the zero-trust micro-gateway policy execution centers monitors the visitor's network information data in real time and reports it to the management center, and the visitor's network information data includes: the visitor's environmental baseline data, access time, resources requested for access, access behavior, and access traffic;

[0116] The management center updates the dynamic access control strategy in real time based on the visitor's network information data;

[0117] The execution center implements access control on the visitor based on the updated dynamic access control policy.

[0118] The present embodiment discloses an access control system based on a zero-trust micro-gateway. A zero-trust micro-gateway management center is established for the microservice architecture. The center is responsible for the registration management, access authorization policy management, and key distribution management of all micro-gateways and related services, and provides authentication center services to perform identification and identity authentication functions for visitors to ensure that the visitor's identity is credible. The execution center executes the dynamic access control policy issued by the management center to realize the opening of a specific access control policy for a visitor, allowing the visitor to access specific authorized resources from the applied device and access location within the authorized policy time range and dynamically manage the access control policy, thereby realizing integrated verification of visitors and devices and preventing attackers from using the secure connection established by legitimate users to achieve illegal access.

[0119] It should be noted that the above embodiments are based on the same inventive concept and parts not described repeatedly can be used as reference for each other.

[0120] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. An access control method based on zero-trust micro-gateway, characterized in that: The steps include: The zero-trust micro-gateway management center performs SPA authentication on the visitor of the microservice. After the SPA authentication is passed, the authentication service port is opened to the visitor to receive the visitor's authentication request data packet for access authentication. After the access authentication is passed, a dynamic access control policy is generated based on the visitor's environmental baseline data, and sent to the zero-trust micro-gateway policy execution center deployed in the same container as the microservice; The execution center verifies the dynamic access control policy, and controls the visitor's access to the microservice based on the access control policy after the verification is passed; The execution center monitors the visitor's network information data in real time and reports it to the management center. The visitor's network information data includes: the visitor's environmental baseline data, access time, resources requested for access, access behavior, and access traffic; The management center updates the current dynamic access control policy in real time based on the visitor's network information data, including: the management center determines whether to implement enhanced authentication based on at least one of the resources applied for access by the visitor, access behavior, access traffic, and access time; for visitors who do not need to implement enhanced authentication or have passed enhanced authentication, a real-time risk assessment is performed based on the visitor's network information data to obtain a real-time assessment score; a list of resources that the visitor can access under the current risk assessment result is obtained based on the real-time assessment score, the visitor's role, and the access permission basic score of the application resource; the management center generates a digital signature for each data item including the visitor's identification, source IP address, visitor device identification, accessible resource list, current timestamp, and access validity period with the management center identification private key, and updates the current dynamic access control policy based on the above data items and the digital signature; The execution center implements access control on the visitor based on the updated dynamic access control policy.

2. The access control method according to claim 1, characterized in that: The environmental baseline data includes source IP address, source MAC address, device hardware information, operating system information, and security protection information; The management center generates a dynamic access control strategy based on the visitor's environmental baseline data, including: The management center performs an initial risk assessment based on the visitor's environmental baseline data to obtain a risk assessment score; Based on the risk assessment score, visitor role and application resource access permission base score, obtain a list of resources that the visitor can access under the current risk assessment result; The management center generates a digital signature for each data item including visitor identification, source IP address, visitor device identification, accessible resource list, current timestamp and access validity period using the management center identification private key, and generates a dynamic access control strategy based on the above data items and digital signatures.

3. The access control method according to claim 2, characterized in that: The execution center verifies the dynamic access control policy, and controls the visitor's access to the microservice based on the access control policy after the verification, including: The execution center verifies the digital signature of the dynamic access control policy to verify the authenticity and integrity of the access control policy, and verifies the signature identifier to determine that the dynamic access control policy is signed by the management center, and opens access ports for source IP addresses and source MAC addresses according to the access validity period based on the verified dynamic access control policy; After receiving the access authentication response from the management center, the visitor sends an application resource access request to the execution center; The network layer security module of the execution center determines whether the source of the application resource access request is a whitelist based on the dynamic access control policy; The application layer security module of the execution center performs a consistency check between the application layer visitor identifier and the network layer visitor identifier for the application resource access request from the whitelist; The execution center sends the application resource access request that passes the visitor identification consistency check to the microservice; The execution center returns the received response of the microservice to the application resource access request to the visitor.

4. The access control method according to claim 3, characterized in that: The authentication request data packet includes the visitor identification, application time, visitor IP address, visitor device identification and authentication request digital signature; After the SPA authentication is passed, the management center opens the authentication service port to receive the authentication request data packet of the visitor to perform access authentication, including: The management center opens the identity authentication service port to the IP address provided by the visitor within a first set time range after the SPA authentication is passed; The management center verifies the digital signature of the received authentication request data packet based on the identity authentication service port to verify the integrity and authenticity of the authentication request data packet and the authenticity of the visitor's identification, and checks whether the visitor's identification is a registered identification and whether the application time is within a second set time range.

5. The access control method according to claim 4, characterized in that: The first setting time range is 30 seconds, and the second setting time range is -30 to 30 seconds.

6. An access control system based on zero-trust micro-gateway, characterized in that: It includes a zero-trust micro-gateway management center and multiple zero-trust micro-gateway policy execution centers, among which: The zero-trust micro-gateway management center is used to perform SPA authentication on the visitor of the micro-service, open the authentication port to receive the visitor's authentication request data packet for access authentication after the SPA authentication is passed, generate the corresponding dynamic access control policy based on the visitor's environmental baseline data after the access authentication is passed, and send it to the zero-trust micro-gateway policy execution center deployed in the same container as the micro-service; and update the current dynamic access control policy in real time based on the visitor's network information data, including: the management center determines whether to access the resource, access behavior, access traffic, and access time requested by the visitor based on at least one of the following: Implement enhanced authentication; for visitors who do not need to implement enhanced authentication or have passed enhanced authentication, perform real-time risk assessment based on the visitor's network information data to obtain a real-time assessment score; obtain a list of resources that the visitor can access under the current risk assessment result based on the real-time assessment score, the visitor's role and the basic score for access permission of the application resource; the management center generates a digital signature for each data item including the visitor's ID, source IP address, visitor's device ID, the list of accessible resources, the current timestamp and the access validity period with the management center's ID private key, and updates the current dynamic access control policy based on the above data items and the digital signature; Each of the zero-trust micro-gateway policy execution centers is deployed on the same container as the corresponding microservices, and is used to verify the received dynamic access control policy, and control the visitor's access to the microservices in the container based on the access control policy after the verification; the execution center is also used to monitor the visitor's network information data in real time and report it to the management center. The visitor's network information data includes: the visitor's environmental baseline data, access time, resources requested for access, access behavior, and access traffic; the execution center is also used to implement access control on the visitor based on the updated dynamic access control policy.

7. The access control system according to claim 6, characterized in that: Each of the zero-trust micro-gateway policy execution centers monitors the visitor's network information data in real time and reports it to the management center. The visitor's network information data includes: the visitor's environmental baseline data, access time, resources requested for access, access behavior, and access traffic; The management center updates the dynamic access control strategy in real time based on the visitor's network information data; The execution center implements access control on the visitor based on the updated dynamic access control policy.

8. The access control system according to claim 6, characterized in that: The zero-trust micro-gateway management center is also used for: Manage and maintain visitor information, zero-trust microgateway policy execution center information, protected microservice resource information, the association between the zero-trust microgateway policy execution center and microservice resources, visitor-accessible microservice information, and baseline conditions for access to microservice resources; The visitor information includes user information and other application information that calls microservice resources; Perform key distribution management, including the generation, distribution, update, recovery and cancellation of visitor identification keys; Identify and authenticate visitors.

Images