Network access processing method and device based on zero trust

Abstract

The invention discloses a network access processing method and device based on zero trust. The method comprises the steps that identity verification information of a target object is acquired, and the identity verification information at least comprises an internet protocol address of a network connected with terminal equipment of the target object, a verification code received by the terminal equipment and biological characteristic information of the target object; performing identity verification on the target object based on the identity verification information to obtain a user type corresponding to the target object; when the user type shows that the target object is an identity verification passing object, login permission information of the target object is generated; and monitoring an access operation of the target object on the target network system based on the login permission information. According to the invention, the technical problem that the existing network information security verification management mode is inconvenient to carry out multi-party confirmation on employee login information and is easy to cause potential safety hazards is solved.

Description

Technical Field

[0001] The present invention relates to the field of network information security technology, and in particular to a network access processing method and device based on zero trust. Background Art

[0002] In the use of internal wireless communication networks in some enterprises, the permissions include operations such as querying, modifying and exporting internal information. For some confidential information, employees need to perform network information security verification when obtaining information to avoid leakage of internal information and improve company information security. In the use of such wireless communication networks, most of them need to use network information security verification management systems and methods. However, the existing network information security verification management systems and methods have the following problems when used:

[0003] Different employees have different permissions to access information, and permissions need to be managed. However, various means of information theft are emerging one after another. The existing network information security verification management system and method are not convenient for multiple confirmations and manual adjustments of employee login information. On the one hand, when conducting network information security verification, it is easy for employee information to be stolen, resulting in company information leakage. On the other hand, employee information will be adjusted, such as changing mobile phones and mobile phone numbers. If the corresponding adjustments are not made in time, it is easy to affect the work efficiency of employees.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a zero-trust-based network access processing method and device, so as to at least solve the technical problem that the existing network information security verification management method is not convenient for multiple parties to confirm employee login information and is prone to security risks.

[0006] According to one aspect of an embodiment of the present invention, a zero-trust based network access processing method is provided, comprising: obtaining identity authentication information of a target object, wherein the identity authentication information comprises at least: an Internet Protocol address of a network to which a terminal device of the target object is connected, a verification code received by the terminal device, and biometric information of the target object; authenticating the target object based on the identity authentication information to obtain a user type corresponding to the target object; generating login permission information of the target object when the user type indicates that the target object is an identity authentication passed object; and monitoring the target object's access operations to a target network system based on the login permission information.

[0007] Optionally, obtaining the identity authentication information of the target object includes: upon receiving the serial code of the terminal device input by the target object, generating the verification code based on the serial code; sending the verification code to the terminal device; upon receiving the verification code input by the target object and selecting login protocol information, obtaining the Internet Protocol address and the biometric information to obtain the identity authentication information.

[0008] Optionally, the target object is authenticated based on the identity authentication information to obtain a user type corresponding to the target object, including: matching the identity authentication information with predetermined authentication information to obtain a matching result; when the matching result indicates that the identity authentication information is inconsistent with the predetermined authentication information, determining that the user type is a new user; when the matching result indicates that the identity authentication information is consistent with the predetermined authentication information, determining that the user type is a whitelist user; when the matching result indicates that the identity authentication information is consistent with the abnormal list user information corresponding to the predetermined authentication information, determining that the user type is an abnormal list user.

[0009] Optionally, the zero-trust based network access processing method also includes: when it is determined that the user type is the new user, storing the user information of the new user in a temporary user list, wherein the temporary user list is used to store the user information within a predetermined time period, and releasing the user information when the predetermined time period arrives; when it is determined that the user type is the whitelist user, determining that the target object identity authentication has passed; when it is determined that the user type is the exception list user, determining that the target object identity authentication has failed.

[0010] Optionally, when the user type indicates that the target object is an object that has passed identity authentication, login permission information of the target object is generated, including: obtaining operation purpose information of the target object for the target network system; and generating the login permission information of the target object based on the user type of the target object according to the operation purpose information.

[0011] Optionally, the zero-trust based network access processing method further includes: after generating the login permission information of the target object, sending the login permission information to the terminal device, wherein the login permission information includes: the operable type of the target network system and the operable duration of the target network system.

[0012] Optionally, the zero-trust based network access processing method also includes: sending access requirement information of the target network system to the new user; when the access requirement information indicates that the new user still has access requirements within a predetermined period of time in the future, storing the user information of the new user in a whitelist user list.

[0013] Optionally, the zero-trust based network access processing method also includes: in the process of monitoring the target object's access operation to the target network system based on the login permission information, if it is monitored that the access operation has an abnormal operation that is not in the login permission information, generating and displaying an alarm message; after the display time of the alarm message exceeds a predetermined time length, if the abnormal operation is still not interrupted, disconnecting the target object's access operation to the target network system.

[0014] According to another aspect of an embodiment of the present invention, a zero-trust-based network access processing device is also provided, including: an acquisition unit, used to acquire identity authentication information of a target object, wherein the identity authentication information includes at least: an Internet Protocol address of a network to which a terminal device of the target object is connected, a verification code received by the terminal device, and biometric information of the target object; an identity authentication unit, used to authenticate the target object based on the identity authentication information to obtain a user type corresponding to the target object; a generation unit, used to generate login permission information of the target object when the user type indicates that the target object is an identity authentication passed object; and a monitoring unit, used to monitor the target object's access operation to a target network system based on the login permission information.

[0015] Optionally, the acquisition unit includes: a first generation module, which is used to generate the verification code based on the serial code when receiving the serial code of the terminal device input by the target object; a sending module, which is used to send the verification code to the terminal device; and a first acquisition module, which is used to acquire the Internet Protocol address and the biometric information when receiving the verification code input by the target object and selecting login protocol information to obtain the identity authentication information.

[0016] Optionally, the identity authentication unit includes: a matching module, used to match the identity authentication information with predetermined verification information to obtain a matching result; a first determination module, used to determine that the user type is a new user when the matching result indicates that the identity authentication information is inconsistent with the predetermined verification information; a second determination module, used to determine that the user type is a whitelist user when the matching result indicates that the identity authentication information is consistent with the predetermined verification information; and a third determination module, used to determine that the user type is an abnormal list user when the matching result indicates that the identity authentication information is consistent with the abnormal list user information corresponding to the predetermined verification information.

[0017] Optionally, the zero-trust based network access processing device also includes: a storage module, used to store the user information of the new user in a temporary user list when it is determined that the user type is the new user, wherein the temporary user list is used to store the user information within a predetermined time period, and release the user information when the predetermined time period arrives; a fourth determination module, used to determine that the identity authentication of the target object is passed when it is determined that the user type is the whitelist user; and a fifth determination module, used to determine that the identity authentication of the target object is not passed when it is determined that the user type is the exception list user.

[0018] Optionally, the generation unit includes: a second acquisition module, used to obtain the operation purpose information of the target object on the target network system; a second generation module, used to generate the login permission information of the target object according to the user type of the target object in the operation purpose information.

[0019] Optionally, the zero-trust based network access processing device also includes: a first sending unit, used to send the login permission information to the terminal device after generating the login permission information of the target object, wherein the login permission information includes: the operable type of the target network system and the operable duration of the target network system.

[0020] Optionally, the zero-trust based network access processing device also includes: a second sending unit, used to send access requirement information of the target network system to the new user; a storage unit, used to store the user information of the new user in the whitelist user list when the access requirement information indicates that the new user still has access requirements within a predetermined period of time in the future.

[0021] Optionally, the zero-trust based network access processing device also includes: a processing unit, used to generate and display an alarm message when it is detected that the access operation contains abnormal operations that are not in the login permission information during the process of monitoring the target object's access operation to the target network system based on the login permission information; a disconnection unit, used to disconnect the target object's access operation to the target network system when the abnormal operation is not interrupted after the display time of the alarm information exceeds a predetermined time.

[0022] According to another aspect of an embodiment of the present invention, a zero-trust-based network information processing system is also provided. The zero-trust-based network information processing system uses any one of the zero-trust-based network access processing methods described above.

[0023] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium includes a stored program, wherein the program executes any one of the zero-trust-based network access processing methods described above.

[0024] According to another aspect of an embodiment of the present invention, a processor is further provided, wherein the processor is used to run a program, wherein the program executes any one of the zero-trust-based network access processing methods described above when running.

[0025] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including computer instructions, which, when executed by a processor, perform any one of the zero-trust-based network access processing methods described above.

[0026] In an embodiment of the present invention, identity authentication information of the target object is obtained, wherein the identity authentication information includes at least: the Internet Protocol address of the network to which the terminal device of the target object is connected, the verification code received by the terminal device, and the biometric information of the target object; the target object is authenticated based on the identity authentication information to obtain the user type corresponding to the target object; when the user type indicates that the target object is an object that has passed the identity authentication, the login permission information of the target object is generated; and the target object's access operation to the target network system based on the login permission information is monitored. Through the technical solution provided by the present invention, it is realized that when performing identity authentication, information such as name, ID number and face recognition is added to perform a re-match of personnel information, and personnel permissions can be opened accordingly, and the purpose of preventing the risk of information being stolen can be achieved, thereby achieving the technical effect of reducing the risk of information being stolen, and further solving the technical problem that the existing network information security verification management method is not convenient for multi-party confirmation of employee login information and is prone to security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0028] Figure 1 is a schematic diagram of a zero-trust-based network information processing system according to an embodiment of the present invention;

[0029] Figure 2 It is a hardware structure block diagram of a mobile terminal of a network access processing method based on zero trust according to an embodiment of the present invention;

[0030] Figure 3 is a flowchart of a network access processing method based on zero trust according to an embodiment of the present invention;

[0031] Figure 4 is a schematic diagram of an identity authentication module according to an embodiment of the present invention;

[0032] Figure 5 is a schematic diagram of an information storage module according to an embodiment of the present invention;

[0033] Figure 6 is a schematic diagram of a permission control module according to an embodiment of the present invention;

[0034] Figure 7 is a schematic diagram of an optional permission control module according to an embodiment of the present invention;

[0035] Figure 8 is a schematic diagram of a zero-trust based network access processing device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0036] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0037] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0038] As introduced in the background technology, the existing network information security verification management method is not convenient for multiple parties to confirm employee login information, which is prone to security risks. In view of the above defects, a zero-trust-based network access processing method and device, a zero-trust-based network information processing system, a computer-readable storage medium, a processor, and a computer program product are provided in the embodiments of the present invention.

[0039] Figure 1 is a schematic diagram of a zero-trust based network information processing system according to an embodiment of the present invention. Figure 1 As shown, the network information processing system based on zero trust may include: a main control module, a login module, a data processing module, a permission control module and a background management module, wherein the main control module controls the login module page display, the login module is used to generate login information, the data processing module includes an identity authentication module and an information storage module, the identity authentication module is used to verify the login personnel information, the information storage module is used to store the login information, the permission control module includes a permission application module and an online authorization module, the permission application module is used to apply for operation permissions for the logged-in user, the online authorization module is used to process permissions according to user information, and the background management module is used to log in to the background to manage data.

[0040] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0041] The method embodiments provided in the embodiments of the present invention can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 2 1 is a hardware structure block diagram of a mobile terminal of a network access processing method based on zero trust according to an embodiment of the present invention. Figure 2 As shown, the mobile terminal may include one or more ( Figure 2 Only one is shown in the figure) a processor 202 (the processor 202 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 204 for storing data, wherein the mobile terminal may also include a transmission device 206 and an input / output device 208 for communication functions. It can be understood by those skilled in the art that Figure 2 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 2 More or fewer components as shown, or with Figure 2 Different configurations shown.

[0042] The memory 204 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the zero-trust network access processing method in the embodiment of the present invention. The processor 202 executes various functional applications and data processing by running the computer program stored in the memory 204, that is, the above method is implemented. The memory 204 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 204 may further include a memory remotely arranged relative to the processor 202, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 206 is used to receive or send data via a network. The above-mentioned specific network examples may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 206 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 206 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0043] According to an embodiment of the present invention, a method embodiment of a network access processing method based on zero trust is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0044] Figure 3 is a flowchart of a network access processing method based on zero trust according to an embodiment of the present invention. Figure 3 As shown, the zero-trust based network access processing method includes the following steps:

[0045] Step S302, obtaining identity authentication information of the target object, wherein the identity authentication information includes at least: the Internet Protocol address of the network to which the terminal device of the target object is connected, the verification code received by the terminal device, and the biometric information of the target object.

[0046] In this embodiment, the user (ie, the target object) can Figure 1Enter the mobile phone number on the login module page shown, log in with the account and password by obtaining the verification code, and check the user login agreement. The user login agreement may include: the IP address of the network to which the user's mobile phone (i.e., terminal device) is connected, the verification code received by the mobile phone, and the user's image information obtained by the mobile phone camera.

[0047] Step S304: Authentication of the target object is performed based on the authentication information to obtain the user type corresponding to the target object.

[0048] In this embodiment, the user's identity can be authenticated according to the identity authentication information obtained above, so that the user's type can be obtained to determine whether the user can log in to the target network system.

[0049] Step S306: When the user type indicates that the target object is an object that has passed identity authentication, the login authority information of the target object is generated.

[0050] In this embodiment, when it is determined that the user authentication is passed based on the user type determined above, the user's login authority information may be generated and sent to the user.

[0051] Step S308: monitoring the target object's access operation to the target network system based on the login authority information.

[0052] As can be seen from the above, in an embodiment of the present invention, identity authentication information of the target object can be obtained, wherein the identity authentication information at least includes: the Internet Protocol address of the network to which the terminal device of the target object is connected, the verification code received by the terminal device, and the biometric information of the target object; the target object is authenticated based on the identity authentication information to obtain the user type corresponding to the target object; when the user type indicates that the target object is an identity authentication passed object, the login permission information of the target object is generated; the target object's access operation to the target network system based on the login permission information is monitored, and it is realized that information such as name, ID number and face recognition is added during identity authentication, and the personnel information is matched again, so that the personnel permissions can be opened accordingly, and the risk of information being stolen can be prevented, thereby achieving the technical effect of reducing the risk of information being stolen.

[0053] Therefore, the above technical solution provided by the embodiment of the present invention solves the technical problem that the existing network information security verification management method is not convenient for multiple parties to confirm employee login information and is prone to security risks.

[0054] According to the above-mentioned embodiment of the present invention, obtaining the identity authentication information of the target object may include: upon receiving the serial code of the terminal device input by the target object, generating a verification code based on the serial code; sending the verification code to the terminal device; upon receiving the verification code input by the target object and selecting the login protocol information, obtaining the Internet Protocol address and biometric information to obtain the identity authentication information.

[0055] In this embodiment, when the mobile phone number (serial code) input by the user is received, a verification code can be generated based on the mobile phone number and sent to the mobile phone; when the user receives the verification code, he / she checks the login agreement and obtains the IP address of the network to which the mobile phone is connected and the avatar or fingerprint information collected by the camera.

[0056] Figure 4 is a schematic diagram of an identity authentication module according to an embodiment of the present invention, such as Figure 4 As shown, in the identity authentication module in the embodiment of the present invention, permission application is performed after the three-party verification of IP, mobile phone verification code and graphic is passed. Through the triple verification method of mobile phone IP, mobile phone number and graphic verification, the login person can be accurately matched to improve information security.

[0057] According to the above embodiment of the present invention, identity authentication is performed on a target object based on identity authentication information to obtain a user type corresponding to the target object, including: matching the identity authentication information with predetermined authentication information to obtain a matching result; when the matching result indicates that the identity authentication information is inconsistent with the predetermined authentication information, determining that the user type is a new user; when the matching result indicates that the identity authentication information is consistent with the predetermined authentication information, determining that the user type is a whitelist user; when the matching result indicates that the identity authentication information is consistent with the abnormal list user information corresponding to the predetermined authentication information, determining that the user type is an abnormal list user.

[0058] In this embodiment, the type of user may be determined based on the result of matching the identity verification information with the predetermined verification information.

[0059] Figure 5 is a schematic diagram of an information storage module according to an embodiment of the present invention, such as Figure 5 As shown, the information storage module includes a white list, an abnormal list and a temporary list. The abnormal list information stored in the information storage module is denied access when the identity authentication module is performed. The abnormal list is based on the inconsistency of the IP and mobile phone verification code. Through the setting of the white list, the abnormal list and the temporary list, on the basis of convenient login, a safe lock can be performed to prevent the mobile phone card from being stolen. At the same time, the use of the temporary list is convenient for new users to log in. The information storage module is pre-entered with the trusted personnel information by the background management module. By entering the information in advance, it can cooperate with the setting of the white list to facilitate the direct login of the staff.

[0060] Figure 6 is a schematic diagram of a permission control module according to an embodiment of the present invention, such as Figure 6 As shown, the permission control module interacts with the identity authentication module. The identity authentication of the permission control module includes user name, ID number and face recognition. By matching the user name, ID number and face information, the specific login person information can be obtained, which is convenient for permission identification.

[0061] Figure 7 is a schematic diagram of an optional permission control module according to an embodiment of the present invention, such as Figure 7 As shown, the permission control module interacts with the identity authentication module. The identity authentication of the permission control module includes user name, user position and user work number. By matching the user name, user position and user work number, the specific login personnel information can be obtained to facilitate permission identification.

[0062] According to the above embodiment of the present invention, the zero-trust based network access processing method also includes: when it is determined that the user type is a new user, storing the user information of the new user in a temporary user list, wherein the temporary user list is used to store the user information within a predetermined period of time, and releasing the user information when the predetermined period arrives; when it is determined that the user type is a whitelist user, determining that the target object identity authentication has passed; when it is determined that the user type is an exception list user, determining that the target object identity authentication has failed.

[0063] In this embodiment, different operations may be performed on the corresponding information according to different user types.

[0064] Above Figure 5 The new user information in the information storage module shown will enter the temporary list. The temporary list in the information storage module is manually verified by the background management module. By manually authenticating the temporary list, new users can be prevented from being denied access and the trouble of subsequent data adjustment can be reduced.

[0065] Here the main control module controls the identity authentication module, verifies the user login information, and matches it with the information storage module. If it is a new user logging in, the information is stored in a temporary list. If it is a whitelist, the login is allowed. If it is an abnormal list, the login is denied.

[0066] According to the above embodiment of the present invention, when the user type indicates that the target object is an object that has passed identity authentication, generating login permission information for the target object may include: obtaining the target object's operation purpose information for the target network system; and generating the target object's login permission information based on the user type of the target object in the operation purpose information.

[0067] In this embodiment, after the user logs in to the network system to be logged in, he applies for permission according to the operation purpose. The main control module controls the limit control module to display the application for permission and perform online authorization. After authorization, the user can perform the operation.

[0068] According to the above embodiment of the present invention, the zero-trust based network access processing method also includes: after generating the login permission information of the target object, sending the login permission information to the terminal device, wherein the login permission information includes: the operable type of the target network system and the operable duration of the target network system.

[0069] In this embodiment, after the user's login authority information is generated, it can be sent to the user's mobile phone, so that the user can know the type of operation, operation duration and other information of the network system that he needs to access.

[0070] According to the above embodiment of the present invention, the zero-trust based network access processing method also includes: sending access requirement information of the target network system to the new user; when the access requirement information indicates that the new user still has access requirements within a predetermined period of time in the future, storing the user information of the new user in the whitelist user list.

[0071] In this embodiment, for new users, the administrator logs into the background management module and manually reviews the temporary list. After the review is passed, the information is moved to the white list, and the user is allowed to perform subsequent permission operations.

[0072] According to the above embodiment of the present invention, the zero-trust based network access processing method also includes: in the process of monitoring the target object's access operation to the target network system based on login permission information, if it is monitored that the access operation has an abnormal operation that is not in the login permission information, an alarm message is generated and displayed; after the display time of the alarm message exceeds the predetermined time, when the abnormal operation is still not interrupted, the target object's access operation to the target network system is disconnected.

[0073] In this embodiment, the user's access operation to the network system to which he has applied for access can also be monitored. When the access behavior is monitored to be abnormal, an alarm message can be generated and popped up on the corresponding page; if the abnormal operation is not interrupted after the alarm message exceeds a predetermined time, the user's access operation to the network system can be directly disconnected.

[0074] In addition, in the embodiment of the present invention, the administrator can log in to the background management module, delete the information in the abnormal list, white list and temporary list, enter the information into the white list in advance according to the new user, and modify the authority authorization information according to the white list information. That is, the background management module modifies the list information by entering the background, and the background management module modifies the deletion, addition and transfer of the authority list, performs data processing in the background, and facilitates the management of personnel information and the replacement and adjustment of employee information.

[0075] It can be seen from the above that, through the technical solution provided by the above embodiment of the present invention, a white list, an abnormal list and a temporary list are set in the information storage module, wherein the white list data matches the user login data, and access can be allowed according to the user information, and the name, ID number and face recognition information are added to the identity authentication module to match the personnel information again, and the personnel authority can be opened accordingly, on the one hand, further preventing the risk of information being stolen, and on the other hand, it is equivalent to adding another firewall when obtaining authority, thereby improving the security of network information. At the same time, the setting of the abnormal list includes dual authentication of mobile phone IP and mobile phone number. If the mobile phone is changed, login is not allowed, which effectively prevents the risk of access to the network even if the mobile phone number is stolen. The setting of the temporary list can allow new users to log in temporarily and wait to obtain background permissions, thereby avoiding the trouble of new employees being unable to log in to the page, thereby achieving zero trust in the entire login verification process, and each login requires multi-party verification to improve network security.

[0076] In addition, by setting up a background management module, managers can modify the white list, exception list and temporary list in the background. New user information can be entered into the white list in advance to facilitate their direct login. At the same time, the information of resigned employees can be added to the exception list to prevent them from logging in privately. The information on the exception list can also be deleted. When adjustments are made for employees who have changed their mobile phones and cannot enter employee information in time, the use of temporary lists can be used to confirm the background information, which facilitates timely adjustments while ensuring network security.

[0077] The above technical solution effectively solves the problem of inconvenient multi-party confirmation and manual adjustment of employee login information during the use of wireless communication networks. At the same time, in view of the technical problem that the existing technical solutions are too single, a multi-party verification method is proposed, which can strictly review user login information, improve security performance, and avoid malicious login.

[0078] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0079] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0080] According to an embodiment of the present invention, a zero-trust based network access processing device for implementing the above-mentioned zero-trust based network access processing method is also provided. Figure 8 is a schematic diagram of a network access processing device based on zero trust according to an embodiment of the present invention. Figure 8 As shown, the network access processing device based on zero trust includes: an acquisition unit 81, an identity authentication unit 83, a generation unit 85 and a monitoring unit 87. The network access processing device based on zero trust is described below.

[0081] The acquisition unit 81 is used to acquire the identity authentication information of the target object, wherein the identity authentication information at least includes: the Internet Protocol address of the network to which the terminal device of the target object is connected, the verification code received by the terminal device, and the biometric information of the target object.

[0082] The identity authentication unit 83 is used to perform identity authentication on the target object based on the identity authentication information to obtain the user type corresponding to the target object.

[0083] The generating unit 85 is used to generate login permission information of the target object when the user type indicates that the target object is an object that has passed identity authentication.

[0084] The monitoring unit 87 is used to monitor the access operation of the target object to the target network system based on the login authority information.

[0085] It should be noted here that the above-mentioned acquisition unit 81, identity authentication unit 83, generation unit 85 and monitoring unit 87 correspond to steps S302 to S308 in the above-mentioned embodiments, and the four units are the same as the instances and application scenarios implemented by the corresponding steps, but are not limited to the contents disclosed in the above-mentioned embodiments.

[0086] As can be seen from the above, in the scheme recorded in the above-mentioned embodiment of the present invention, the acquisition unit can be used to obtain the identity authentication information of the target object, wherein the identity authentication information at least includes: the Internet Protocol address of the network to which the terminal device of the target object is connected, the verification code received by the terminal device, and the biometric information of the target object; the identity authentication unit is used to authenticate the target object based on the identity authentication information to obtain the user type corresponding to the target object; the generation unit is used to generate the login permission information of the target object when the user type indicates that the target object is an identity authentication passed object; the monitoring unit is used to monitor the target object's access operation to the target network system based on the login permission information, thereby realizing the addition of information such as name, ID number and face recognition during identity authentication, and re-matching of personnel information, which can open personnel permissions accordingly, and can prevent the risk of information being stolen, thereby achieving the technical effect of reducing the risk of information being stolen.

[0087] Therefore, the above technical solution provided by the embodiment of the present invention solves the technical problem that the existing network information security verification management method is not convenient for multiple parties to confirm employee login information and is prone to security risks.

[0088] Optionally, the acquisition unit includes: a first generation module, which is used to generate a verification code based on the serial code when receiving the serial code of the terminal device input by the target object; a sending module, which is used to send the verification code to the terminal device; a first acquisition module, which is used to obtain the Internet Protocol address and biometric information when receiving the verification code input by the target object and selecting the login protocol information to obtain the identity authentication information.

[0089] Optionally, the identity authentication unit includes: a matching module, used to match the identity authentication information with the predetermined verification information to obtain a matching result; a first determination module, used to determine that the user type is a new user when the matching result indicates that the identity authentication information is inconsistent with the predetermined verification information; a second determination module, used to determine that the user type is a whitelist user when the matching result indicates that the identity authentication information is consistent with the predetermined verification information; and a third determination module, used to determine that the user type is an abnormal list user when the matching result indicates that the identity authentication information is consistent with the abnormal list user information corresponding to the predetermined verification information.

[0090] Optionally, the zero-trust based network access processing device also includes: a storage module, used to store the user information of the new user in a temporary user list when it is determined that the user type is a new user, wherein the temporary user list is used to store the user information within a predetermined time period, and release the user information when the predetermined time period arrives; a fourth determination module, used to determine that the target object identity authentication has passed when it is determined that the user type is a whitelist user; and a fifth determination module, used to determine that the target object identity authentication has failed when it is determined that the user type is an exception list user.

[0091] Optionally, the generating unit includes: a second acquiring module for acquiring the target object's operation purpose information on the target network system; and a second generating module for generating the target object's login authority information according to the user type of the target object in the operation purpose information.

[0092] Optionally, the zero-trust based network access processing device also includes: a first sending unit, used to send the login permission information to the terminal device after generating the login permission information of the target object, wherein the login permission information includes: the operable type of the target network system and the operable duration of the target network system.

[0093] Optionally, the zero-trust based network access processing device also includes: a second sending unit, used to send access requirement information of the target network system to the new user; a storage unit, used to store the user information of the new user in the whitelist user list when the access requirement information indicates that the new user still has access requirements within a predetermined period of time in the future.

[0094] Optionally, the zero-trust based network access processing device also includes: a processing unit, which is used to generate and display an alarm message when it is detected that the access operation contains abnormal operations that are not in the login permission information during the process of monitoring the target object's access operation to the target network system based on the login permission information; a disconnection unit, which is used to disconnect the target object's access operation to the target network system when the abnormal operation is not interrupted after the display time of the alarm information exceeds a predetermined time.

[0095] According to another aspect of an embodiment of the present invention, a zero-trust-based network information processing system is also provided. The zero-trust-based network information processing system uses any one of the above-mentioned zero-trust-based network access processing methods.

[0096] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored program, wherein the program executes any one of the above-mentioned zero-trust-based network access processing methods.

[0097] Optionally, in this embodiment, the computer-readable storage medium may be located in any one of the computer terminals in a computer terminal group in a computer network, or in any one of the communication devices in a communication device group.

[0098] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: obtaining identity authentication information of the target object, wherein the identity authentication information includes at least: the Internet Protocol address of the network to which the terminal device of the target object is connected, the verification code received by the terminal device, and the biometric information of the target object; authenticating the target object based on the identity authentication information to obtain the user type corresponding to the target object; when the user type indicates that the target object is an object that has passed the identity authentication, generating login permission information of the target object; and monitoring the target object's access operations to the target network system based on the login permission information.

[0099] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: upon receiving a serial code of a terminal device input by a target object, generating a verification code based on the serial code; sending the verification code to the terminal device; upon receiving the verification code input by the target object and selecting login protocol information, obtaining an Internet Protocol address and biometric information to obtain identity authentication information.

[0100] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: matching the identity authentication information with the predetermined verification information to obtain a matching result; when the matching result indicates that the identity authentication information is inconsistent with the predetermined verification information, determining that the user type is a new user; when the matching result indicates that the identity authentication information is consistent with the predetermined verification information, determining that the user type is a whitelist user; when the matching result indicates that the identity authentication information is consistent with the abnormal list user information corresponding to the predetermined verification information, determining that the user type is an abnormal list user.

[0101] Optionally, in this embodiment, the computer-readable storage medium is configured to store program codes for executing the following steps: when it is determined that the user type is a new user, storing the user information of the new user in a temporary user list, wherein the temporary user list is used to store the user information within a predetermined period of time, and release the user information when the predetermined period arrives; when it is determined that the user type is a whitelist user, determining that the target object identity authentication has passed; when it is determined that the user type is an exception list user, determining that the target object identity authentication has failed.

[0102] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: obtaining operation purpose information of the target object on the target network system; generating login permission information of the target object according to the user type of the target object in the operation purpose information.

[0103] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: after generating login authority information of the target object, sending the login authority information to the terminal device, wherein the login authority information includes: the operable type of the target network system and the operable duration of the target network system.

[0104] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: sending access requirement information of the target network system to the new user; when the access requirement information indicates that the new user still has access requirements within a predetermined period of time in the future, storing the user information of the new user in the whitelist user list.

[0105] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: in the process of monitoring the target object's access operation to the target network system based on login permission information, if it is detected that the access operation has an abnormal operation that is not in the login permission information, an alarm message is generated and displayed; after the display time of the alarm message exceeds a predetermined time period and the abnormal operation is still not interrupted, the target object's access operation to the target network system is disconnected.

[0106] According to another aspect of an embodiment of the present invention, a processor is further provided, and the processor is used to run a program, wherein when the program is running, any one of the above-mentioned zero-trust-based network access processing methods is executed.

[0107] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including computer instructions, which, when executed by a processor, execute any one of the above-mentioned zero-trust-based network access processing methods.

[0108] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0109] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0110] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0111] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0112] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0113] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-On lyMemory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0114] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A network access processing method based on zero trust, characterized in that: include: Acquire identity authentication information of the target object, wherein the identity authentication information includes at least: an Internet Protocol address of a network to which a terminal device of the target object is connected, a verification code received by the terminal device, and biometric information of the target object; authenticating the target object based on the identity authentication information to obtain a user type corresponding to the target object; When the user type indicates that the target object is an object that has passed identity authentication, generating login permission information of the target object; The target object's access operation to the target network system based on the login authority information is monitored.

2. The zero-trust based network access processing method according to claim 1, characterized in that: Get the target object's authentication information, including: When receiving the serial code of the terminal device input by the target object, generating the verification code based on the serial code; Sending the verification code to the terminal device; When the verification code input by the target object is received and the login protocol information is selected, the Internet protocol address and the biometric information are acquired to obtain the identity authentication information.

3. The zero-trust based network access processing method according to claim 1, characterized in that: Authentication of the target object is performed based on the identity authentication information to obtain a user type corresponding to the target object, including: Matching the identity verification information with predetermined verification information to obtain a matching result; When the matching result indicates that the identity verification information is inconsistent with the predetermined verification information, determining that the user type is a new user; When the matching result indicates that the identity verification information is consistent with the predetermined verification information, determining that the user type is a whitelist user; When the matching result indicates that the identity verification information is consistent with the abnormal list user information corresponding to the predetermined verification information, the user type is determined to be an abnormal list user.

4. The zero-trust based network access processing method according to claim 3, characterized in that: Also includes: When determining that the user type is the new user, storing the user information of the new user in a temporary user list, wherein the temporary user list is used to store the user information within a predetermined period of time, and releasing the user information when the predetermined period of time arrives; When it is determined that the user type is the whitelist user, determining that the identity authentication of the target object is passed; When it is determined that the user type is the abnormal list user, it is determined that the target object identity authentication has failed.

5. The zero-trust based network access processing method according to claim 1, characterized in that: When the user type indicates that the target object is an object that has passed identity authentication, generating login permission information of the target object includes: Acquire information about the purpose of operation of the target object on the target network system; The login authority information of the target object is generated according to the user type of the target object in the operation purpose information.

6. The zero-trust based network access processing method according to claim 1, characterized in that: After generating the login permission information of the target object, the method further includes: The login permission information is sent to the terminal device, wherein the login permission information includes: the operable type of the target network system and the operable duration of the target network system.

7. The zero-trust based network access processing method according to claim 4, characterized in that: Also includes: Sending access requirement information of the target network system to the new user; When the access requirement information indicates that the new user still has access requirements within a future predetermined period of time, the user information of the new user is stored in a whitelist user list.

8. The zero-trust based network access processing method according to any one of claims 1 to 7, characterized in that: Also includes: In the process of monitoring the target object's access operation to the target network system based on the login authority information, if an abnormal operation not in the login authority information is detected in the access operation, an alarm message is generated and displayed; After the display time of the alarm information exceeds a predetermined time, if the abnormal operation is still not interrupted, the access operation of the target object to the target network system is disconnected.

9. A network access processing device based on zero trust, characterized in that: include: an acquiring unit, configured to acquire identity authentication information of a target object, wherein the identity authentication information includes at least: an Internet Protocol address of a network to which a terminal device of the target object is connected, a verification code received by the terminal device, and biometric information of the target object; An identity authentication unit, configured to authenticate the target object based on the identity authentication information to obtain a user type corresponding to the target object; A generating unit, configured to generate login permission information of the target object when the user type indicates that the target object is an object that has passed identity authentication; A monitoring unit is used to monitor the access operation of the target object to the target network system based on the login authority information.

10. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by the processor, the zero-trust-based network access processing method described in any one of claims 1 to 8 is performed.

Images