Data transmission processing method and device based on zero trust, and computer program product

Abstract

The invention discloses a data transmission processing method and device based on zero trust and a computer program product. The method comprises the following steps: after establishing a trusted connection with a metadata service MDS server, obtaining a security access strategy set sent by the MDS server; after credible connections with the client and the server are established respectively, selecting a security access strategy of the client from the security access strategy set based on an access request sent by the client; sending the security access strategy to the client and the server, and verifying the access request by using the client based on the security access strategy; and sending the resource access credential of the client to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credential. The technical problem that the use effect of a zero-trust data transmission management technology is affected due to the fact that an existing zero-trust-based data transmission security protection measure is prone to being large in authorization granularity in the use process is solved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a zero-trust-based data transmission processing method and device, and a computer program product. Background Art

[0002] Traditional data transmission security measures mainly rely on hardware devices such as firewalls and intrusion detection systems, as well as encryption, authentication and other technologies. However, these measures still have many security risks in practical applications, such as internal threats and password leaks. Therefore, how to achieve more secure and reliable data transmission has become a problem that needs to be solved urgently.

[0003] The Zero Trust model is a new network security concept, the core idea of ​​which is "never trust, always verify". That is, in the network, any user and device must undergo strict identity authentication and authorization before accessing any resource. This model can effectively reduce the risk of internal threats and password leakage to a certain extent, and improve the security of data transmission.

[0004] The zero-trust logical architecture of SDP (Software-Defined Perimeter) is usually composed of three main components: SDP controller, IH (Initiator Host) and AH (Accepter Host). Based on the IH identity or role, flexible authorization is achieved through the SDP controller, and the IH client is used to isolate the client in combination with the access policy, and different control policies can be implemented for different user roles or users.

[0005] However, the existing zero-trust technology still has certain limitations in practical applications, such as complex authentication processes, inefficient resource utilization, etc. At present, the trusted connection of the SDP zero-trust architecture mainly focuses on the IH client, SDP controller and AH receiving server, and does not manage the security of metadata services. During use, the authorization granularity will be too large, affecting the use of zero-trust data transmission management technology.

[0006] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0007] The embodiments of the present invention provide a zero-trust-based data transmission processing method and device, and a computer program product, so as to at least solve the technical problem that the existing zero-trust-based data transmission security protection measures are prone to the problem of how large the authorization granularity is during use, which affects the use effect of zero-trust data transmission management technology.

[0008] According to one aspect of an embodiment of the present invention, a data transmission processing method based on zero trust is provided, comprising: after establishing a trusted connection with a metadata service MDS server, obtaining a security access policy set sent by the MDS server; after establishing trusted connections with a client and a server respectively, selecting a security access policy of the client from the security access policy set based on an access request sent by the client; sending the security access policy to the client and the server, so that the client verifies the access request based on the security access policy, wherein the client sends the access request to the server when the access request is verified based on the security access policy, so that the server controls the data access behavior of the client based on the security access policy and the access request; sending the resource access credential of the client to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credential, wherein the MDS server authenticates the data resource access behavior of the client based on the resource access credential, and accepts the data resource access behavior of the client when the data resource access behavior is authenticated.

[0009] Optionally, after establishing a trusted connection with a metadata service MDS server, obtaining a security access policy set sent by the MDS server, including: sending a first trusted connection request to the MDS server; when the MDS server verifies the trusted connection request, obtaining security policy update data fed back by the MDS server; and using the security policy update data to update the original security access policy set to obtain the security access policy set.

[0010] Optionally, after establishing trusted connections with the client and the server respectively, selecting a security access policy of the client from the security access policy set based on an access request sent by the client, including: receiving a second trusted connection request sent by the client and a third trusted connection request sent by the server; when the second trusted connection request and the third trusted connection request are verified, selecting the security access policy corresponding to the client from the security access policy set based on the access request, wherein the security access policy includes: an identifier and signature information of the client.

[0011] Optionally, the resource access credentials of the client are sent to the client and the MDS server so that the client initiates data resource access to the MDS server based on the resource access credentials, including: generating the resource access credentials of the client; determining the accessible resources of the client; signing the accessible resources to obtain the signed accessible resources; sending the signed accessible resources and the resource access credentials to the client and the MDS server so that the client initiates data resource access to the MDS server based on the resource access credentials.

[0012] Optionally, the zero-trust based data transmission processing method also includes: when receiving the prohibited access information sent by the MDS server, when the target client corresponds to the client identifier carried in the prohibited access information, the target client is added to the blacklist, wherein the prohibited access information is the information including the client identifier of the target client that is fed back to the MDS server when the server monitors that the target client initiates a predetermined number of prohibited access behaviors.

[0013] Optionally, the zero-trust based data transmission processing method also includes: when receiving change information of the client, selecting a new security access policy from the security access policy set based on the change information; sending the new security access policy to the server and the client, so that the client performs data resource access behavior according to the new security access policy, and the server controls the data resource access behavior of the client according to the new security access policy.

[0014] According to another aspect of an embodiment of the present invention, a data transmission processing device based on zero trust is also provided, including: an acquisition unit, used to acquire a security access policy set sent by a metadata service MDS server after establishing a trusted connection with the MDS server; a selection unit, used to select a security access policy of the client from the security access policy set based on an access request sent by the client after establishing trusted connections with the client and the server respectively; a verification unit, used to send the security access policy to the client and the server, so that the client can verify the access request based on the security access policy, wherein the client sends the access request to the server when the access request is verified based on the security access policy, so that the server controls the data access behavior of the client based on the security access policy and the access request; an access unit, used to send the resource access credential of the client to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credential, wherein the MDS server authenticates the data resource access behavior of the client based on the resource access credential, and accepts the data resource access behavior of the client when the data resource access behavior is authenticated.

[0015] Optionally, the acquisition unit includes: a sending module, used to send a first trusted connection request to the MDS server; an acquisition module, used to obtain security policy update data fed back by the MDS server when the MDS server verifies the trusted connection request; and an update module, used to update the original security access policy set using the security policy update data to obtain the security access policy set.

[0016] Optionally, the selection unit includes: a receiving module for receiving a second trusted connection request sent by the client and a third trusted connection request sent by the server; a selection module for selecting, when the second trusted connection request and the third trusted connection request are verified, the security access policy corresponding to the client from the security access policy set based on the access request, wherein the security access policy includes: an identifier and signature information of the client.

[0017] Optionally, the access unit includes: a generation module for generating the resource access credential of the client; a determination module for determining the accessible resources of the client; a signature module for signing the accessible resources to obtain the signed accessible resources; and an initiation module for sending the signed accessible resources and the resource access credential to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credential.

[0018] Optionally, the data transmission processing device based on zero trust also includes: an adding unit, which is used to add the target client corresponding to the client identifier carried in the prohibited access information to the blacklist when receiving the prohibited access information sent by the MDS server, wherein the prohibited access information is information including the client identifier of the target client that is fed back to the MDS server when the server monitors that the target client has initiated a predetermined number of prohibited access behaviors.

[0019] Optionally, the zero-trust based data transmission processing device also includes: the selection unit, which is also used to select a new security access policy from the security access policy set based on the change information when receiving the change information of the client; a control unit, which is used to send the new security access policy to the server and the client, so that the client performs data resource access behavior according to the new security access policy, and the server controls the data resource access behavior of the client according to the new security access policy.

[0020] According to another aspect of an embodiment of the present invention, a zero-trust-based data transmission management system is also provided, and the zero-trust-based data transmission management system uses any one of the zero-trust-based data transmission processing methods described above.

[0021] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium includes a stored program, wherein the program executes any one of the above-mentioned zero-trust-based data transmission processing methods.

[0022] According to another aspect of an embodiment of the present invention, a processor is further provided, wherein the processor is used to run a program, wherein the program executes any one of the above-mentioned zero-trust-based data transmission processing methods when running.

[0023] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including computer instructions, which, when executed by a processor, perform any one of the above-mentioned zero-trust-based data transmission processing methods.

[0024] In an embodiment of the present invention, after establishing a trusted connection with a metadata service MDS server, a security access policy set sent by the MDS server is obtained; after establishing trusted connections with a client and a server respectively, a security access policy of the client is selected from the security access policy set based on an access request sent by the client; the security access policy is sent to the client and the server, so that the client can verify the access request based on the security access policy, wherein the client sends the access request to the server when the access request is verified based on the security access policy, so that the server controls the data access behavior of the client based on the security access policy and the access request; the resource access credentials of the client are sent to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credentials, wherein the MDS server authenticates the data resource access behavior of the client based on the resource access credentials, and accepts the data resource access behavior of the client when the data resource access behavior is authenticated. Through the technical solution provided by the present invention, the SDP server sends the security access policy of the client to the client and the server, the client sends an access request to the server according to the security access policy, and the server manages the access to the client through the access request and the security access policy, and establishes a software-based network access boundary for each access object, thereby reducing the security risks when the client accesses data, and further solves the technical problem that the existing zero-trust-based data transmission security protection measures are prone to have too large authorization granularity during use, which affects the use effect of zero-trust data transmission management technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0026] Figure 1 It is a hardware structure block diagram of a mobile terminal of a data transmission processing method based on zero trust according to an embodiment of the present invention;

[0027] Figure 2 is a flowchart of a data transmission processing method based on zero trust according to an embodiment of the present invention. Figure 2 As shown;

[0028] Figure 3is a schematic diagram of a zero-trust-based data transmission management system according to an embodiment of the present invention;

[0029] Figure 4 is a flowchart of an optional zero-trust-based data transmission processing method according to an embodiment of the present invention;

[0030] Figure 5 is a flowchart of another optional zero-trust-based data transmission processing method according to an embodiment of the present invention;

[0031] Figure 6 is a flowchart of another optional zero-trust-based data transmission processing method according to an embodiment of the present invention;

[0032] Figure 7 is a flowchart of a preferred zero-trust-based data transmission processing method according to an embodiment of the present invention;

[0033] Figure 8 is a schematic diagram of a zero-trust-based data transmission processing device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0035] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0036] As introduced in the background technology, the existing zero-trust-based data transmission security protection measures are prone to authorization granularity during use, which affects the use effect of zero-trust data transmission management technology. In view of the above defects, a zero-trust-based data transmission processing method and device, a zero-trust-based data transmission management system, a computer-readable storage medium, a processor, and a computer program product are provided in the embodiments of the present invention.

[0037] The zero-trust data transmission processing method provided in the embodiment of the present invention is based on a zero-trust SDP architecture, which is composed of an SDP controller, an IH initiator, an AH receiver, a metadata service MDS, a data service provider DSP and data resources.

[0038] The SDP controller is the core technology of the zero-trust framework. It is responsible for determining the resources and access rights that each user can access, forming access policy files, and managing the access policies of the SDP.

[0039] The IH initiator is the initiator of the connection and the client that needs to obtain resources. When a user initiates an access request, the IH agent authenticates the SDP controller and decides whether the corresponding resources can be accessed based on the access policy. The client can only access the resources allowed in the policy file. The client uses the access policy to achieve micro-isolation. At the same time, it can also authorize users to access resources across network segments.

[0040] The above-mentioned AH receiver is the gateway or proxy program that must be passed through to access network resources. After AH is started, it clears its own access policy, first authenticates the identity to the SDP controller, and obtains a new access policy. Then, AH checks the access request from IH according to the new access policy and implements access control. As a practical technology for the implementation of the zero-trust concept, through the SDP concept of focusing on boundary protection, a software-based network access boundary is established for each access object, and single-package authorization technology is used to solve the problem of excessive authorization granularity in traditional data security systems, which is of great significance to data security protection.

[0041] It should be noted that the specific operation of the zero-trust SDP architecture is that zero trust is based on identity or role, and flexible authorization is achieved through the SDP controller; the IH client is used in combination with the access policy to micro-isolate the client; the zero-trust architecture is introduced into data security management, and different control strategies can be implemented for different user roles or users.

[0042] In addition, the system composition of the SDP controller is a role-based access control RBAC (Role-Based Access Control) and / or attribute-based access control ABAC (Attribute-Based Access Control) model to formulate the access control policy of IH to DSP. The administrator can specify the access rights of different users / groups to data through the management program, set different data life cycle stages and data categories and levels.

[0043] The data attributes of the metadata include: at least one of a resource name, a server name, a data life stage, a data level, and a data category; the resource name is used to indicate the storage name and location of the data resource.

[0044] The data life stages include: one of the stages of collection, storage, processing, sharing, archiving and destruction; when the data life stage of a data resource is the collection or destruction stage, the data resource cannot be accessed, and when the data life stage of a data resource is the archiving stage, the data resource cannot be modified; the data level and data category are used to determine whether a client can access the data resource.

[0045] Here, the system composition of the IH initiator is composed of all network accesses of the IH proxy client, which works according to the access control policy from the SDP. The metadata server MDS stores the metadata of the data resources, and uses the automatic update mechanism to keep the information between the server and the data resources synchronized, synchronizes the metadata to the SDP controller in real time, and can realize automatic management of the metadata. The data service provider DSP verifies and checks the access from the IH according to the policy issued by the SDP, and maintains the session, thus ending the data transmission management process.

[0046] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0047] The method embodiments provided in the embodiments of the present invention can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 1 is a hardware structure block diagram of a mobile terminal of a data transmission processing method based on zero trust in an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0048] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the data transmission processing method based on zero trust in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific network example may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0049] According to an embodiment of the present invention, a method embodiment of a zero-trust-based data transmission processing method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in an order different from that shown here.

[0050] Figure 2 is a flowchart of a data transmission processing method based on zero trust according to an embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0051] Step S202: After establishing a trusted connection with the metadata service MDS server, obtain a security access policy set sent by the MDS server.

[0052] In this embodiment, after the SDP server is online, it will start the authentication service and load the relevant policies. Then, the MDS establishes a trusted connection with the SDP and synchronizes the metadata. The metadata server synchronizes the metadata to the SDP controller so that the SDP controller updates the security policy library according to the metadata; the SDP controller sends the client's security access policy to the client and the server.

[0053] It should be noted that here MDS and SDP establish a trusted connection and synchronize metadata. MDS establishes a trusted connection to SDP based on digital certificates and synchronizes metadata. SDP updates the security policy library based on the received metadata. When the data on the data server changes, such as creating, writing, deleting, etc. files or directories, the metadata update will be triggered and synchronized to MDS and SDP in a timely manner.

[0054] Figure 3 is a schematic diagram of a data transmission management system based on zero trust according to an embodiment of the present invention, such as Figure 3 As shown, the technical solution provided by the embodiment of the present invention is implemented based on the zero-trust SDP architecture, which is composed of an SDP controller, an IH initiator, and an AH receiver. Here, the SDP controller is the core technology of the zero-trust framework, responsible for determining the resources and access rights accessible to each user, forming an access policy file, and managing the access policy of the SDP.

[0055] The IH initiator (i.e., the connection initiating host, client IH) is the initiator of the connection and is the client that needs to obtain resources. When the user initiates an access request, the IH agent authenticates the SDP controller and decides whether the corresponding resources can be accessed based on the access policy. The client can only access the resources allowed in the policy file. The client uses the access policy to achieve micro-isolation. At the same time, it can also authorize users for resources across network segments.

[0056] Here, the AH receiver (i.e., the connection receiving host) is the gateway or proxy program that must be passed through to access network resources. After AH is started, it clears its own access policy, first authenticates the identity to the SDP controller, and obtains a new access policy. Then, AH checks the access request from IH according to the new access policy and implements access control. The specific operation of the zero-trust SDP architecture is to achieve flexible authorization based on identity or role through the SDP controller; use the IH client in combination with the access policy to micro-isolate the client; introduce the zero-trust architecture into data security management, and implement different control strategies for different user roles or users. The system composition of the SDP controller is to formulate the access control strategy of IH to DSP based on RBAC and / or ABAC model. The administrator can specify the access rights of different users / groups to data through the management program, and set different data The life cycle stage and the category and level of the data. The system composition of the IH initiator is all network access of the IH proxy client, which works according to the access control policy from the SDP. The metadata server MDS stores the metadata of the data resources, and uses the automatic update mechanism to keep the information between the server and the data resources synchronized. It synchronizes the metadata to the SDP controller in real time and can realize automatic management of the metadata. The data service provider DSP verifies and checks the access from the IH according to the policy issued by the SDP, and maintains the session, thus ending the data transmission management process. It can be used as a practical technology for the implementation of the zero-trust concept. Through the concept of SDP focusing on boundary protection, a software-based network access boundary is established for each access object, and the single-package authorization technology is used to solve the problem of excessive authorization granularity in traditional data security systems, which is of great significance to data security protection.

[0057] Figure 4 is a flowchart of an optional zero-trust-based data transmission processing method according to an embodiment of the present invention, such as Figure 4 As shown, the metadata server synchronizes the metadata to the SDP controller, so that the SDP controller updates the security policy library according to the metadata; the data service provider DSP stores and manages the client's control policy and access policy throughout the declaration cycle; then the SDP controller sends the client's security access policy to the client and the server, and the security access policy is the client's security access policy obtained from the security access policy library; the client sends an access request to the server according to the security access policy; finally, the data transmission management system performs access management on the client based on the access request and the security access policy.

[0058] Step S204: After establishing trusted connections with the client and the server respectively, a security access policy for the client is selected from a security access policy set based on an access request sent by the client.

[0059] In this embodiment, after the SDP server establishes trusted connections with the client (IH end) and the server end respectively, it can select the client's security access policy from the security access policy set according to the access request sent by the client.

[0060] Step S206, sending the security access policy to the client and the server, so that the client can verify the access request based on the security access policy. When the client verifies the access request based on the security access policy, the client sends the access request to the server, so that the server controls the client's data access behavior based on the security access policy and the access request.

[0061] In this embodiment, the SDP server may send the security access policy to the client and the server, so that the client may verify the access request based on the security access policy.

[0062] like Figure 3 As shown, IH establishes a trusted connection with SDP. When the trusted connection is successfully established, the client's security access policy is obtained from the security policy library. The security access policy includes the client identifier and SDP signature generated by the SDP controller. The client IH receives the security policy. IH establishes a trusted connection with DSP and initiates access.

[0063] Step S208, sending the client's resource access credentials to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credentials, wherein the MDS server authenticates the client's data resource access behavior based on the resource access credentials, and accepts the client's data resource access behavior if the data resource access behavior is authenticated.

[0064] As can be seen from the above, in an embodiment of the present invention, after establishing a trusted connection with a metadata service MDS server, a security access policy set sent by the MDS server is obtained; after establishing trusted connections with a client and a server respectively, a security access policy of the client is selected from the security access policy set based on an access request sent by the client; the security access policy is sent to the client and the server, so that the client can verify the access request based on the security access policy, wherein, when the client verifies the access request based on the security access policy, the client sends the access request to the server, so that the server controls the data access behavior of the client based on the security access policy and the access request; the resource access credentials of the client are sent to the client and the server. MDS server, so that the client initiates data resource access to the MDS server based on resource access credentials, wherein the MDS server authenticates the client's data resource access behavior based on the resource access credentials, and accepts the client's data resource access behavior if the data resource access behavior is authenticated, thereby realizing that the SDP server sends the client's security access policy to the client and the server, and the client sends an access request to the server based on the security access policy, and the server manages the access to the client through the access request and the security access policy, establishes a software-based network access boundary for each access object, and reduces the security risks existing when the client accesses data.

[0065] Therefore, the technical solution provided by the embodiment of the present invention solves the technical problem that the existing zero-trust-based data transmission security protection measures are prone to have too large authorization granularity during use, which affects the use effect of zero-trust data transmission management technology.

[0066] According to the above embodiment of the present invention, after establishing a trusted connection with the metadata service MDS server, obtaining the security access policy set sent by the MDS server may include: sending a first trusted connection request to the MDS server; when the MDS server verifies the trusted connection request, obtaining security policy update data fed back by the MDS server; and updating the original security access policy set using the security policy update data to obtain the security access policy set.

[0067] In this embodiment, the SDP server is online. After the SDP server is online, the authentication service is started and the relevant policies are loaded.

[0068] Here, MDS establishes a trusted connection with SDP and synchronizes metadata. The metadata server synchronizes the metadata to the SDP controller so that the SDP controller updates the security policy library according to the metadata. The metadata server is a server used to store and manage data. It is responsible for managing metadata in the storage system, that is, information that describes and organizes data. Metadata includes attributes such as the name, size, creation time, modification time, access rights, and the logical organization structure and index information of the file. When a client requests to read or write data, it can obtain metadata by querying the metadata server to locate and access the required data blocks or files. The metadata in the metadata server includes data on the server data and data on the client security access policy and other related data. After the SDP controller goes online, the metadata server establishes a trusted connection to the SDP controller based on the digital certificate, and then synchronizes the metadata to the SDP controller. The SDP updates the security policy library according to the received metadata. In addition, the metadata server can be a single server or a metadata server cluster consisting of multiple servers.

[0069] The security access policy stored on the SDP controller specifies the resources that the client can access and the access method thereof. The security access policy of the SDP controller may be as shown in Table 1:

[0070] Table 1

[0071]

[0072] Among them, in the above Table 1, identifier: when the client passes the identity authentication of the SDP controller, the SDP controller generates the identifier of the client, including UID (used to represent the user) and GID (used to identify the group); role and user name: when role authorization is adopted, the role represents the specific role to which the user belongs. When specific user authorization is adopted, the role is empty; server name: used to indicate the server that the client can use for access request; resource path: represents the accessible resource, which can be a directory, a file, or a database, table or field, etc.; access mode and provision method: can be used to represent the access operation that the user can perform on the resource, mainly including read, write, download, desensitize, delete, create subdirectory, create file and other operations. It can be associated with data category and / or data level. Generally, the higher the data level and data category, the stricter the access mode and provision method required. It mainly includes prohibiting caching, desensitizing, sending to the client after anonymization, encrypted sending, encrypted sending after authentication, local encrypted storage, prohibiting plain text display, etc. For gateway servers, it indicates how the client processes the data after it is sent to the client (e.g., desensitization, anonymization, encrypted storage, etc.); Whether to cache: indicates whether the data can be cached locally. For sensitive or important data, the client is not allowed to cache; Whether to store locally: indicates whether the data can be saved locally on the client. For data that is accessed by downloading, if local storage is not allowed, the client will clean up the files downloaded locally after exiting; Data category and data level: used to support ABAC access policies. It specifies that users can access data of a certain category and level under a specified folder. The category can specify a specific category, including 0 or more. If no category is specified, only the specified resource can be accessed. The level can specify a specific level; SDP signature: indicates that after the client passes the identity authentication of the SDP controller, the SDP controller sends the client a list of accessible resources with an additional SHA256 signature value. The signature covers the client IP, user name, and resource list, etc., to prevent the client identity from being impersonated.

[0073] According to the above embodiment of the present invention, after establishing trusted connections with the client and the server respectively, selecting the client's security access policy from the security access policy set based on the access request sent by the client, including: receiving a second trusted connection request sent by the client and a third trusted connection request sent by the server; when the second trusted connection request and the third trusted connection request are verified, selecting a security access policy corresponding to the client from the security access policy set based on the access request, wherein the security access policy includes: an identifier and signature information of the client.

[0074] In this embodiment, the IH end and the server end can respectively send a trusted connection request to the SDP server. When the SDP server verifies the trusted connection request, it establishes a trusted connection with the IH end and the server end.

[0075] It should be noted that the IH establishes a trusted connection with the DSP and initiates access, and the client sends an access request to the server according to the security access policy. When the client initiates an access request to the server, the client can verify the access request according to the security access policy of the client sent by the SDP controller. If the access request of the client passes the verification of the security access policy, the client can send the verified access request to the server. The server manages the access of the client through the access request and the security access policy.

[0076] Figure 5 is a flowchart of another optional zero-trust-based data transmission processing method according to an embodiment of the present invention, such as Figure 5 As shown, after the SDP controller authenticates the client, the SDP controller establishes a trusted connection between the client and the SDP controller; when the trusted connection is successfully established, the SDP controller obtains the security access policy of the client from the security policy library, wherein the security access policy includes: the client identifier and SDP signature generated by the SDP controller; the data service provider DSP stores and manages the control policy and access policy of the client during its lifecycle; the data service provider DSP verifies the credentials and detects whether the security rules can access the corresponding data resources.

[0077] In addition, it should be noted that the IH establishes a trusted connection with the SDP, and the SDP controller sends the client's security access policy to the client and the server; the security access policy is the client's security access policy obtained from the security policy library; the client receives the security policy.

[0078] According to the above embodiment of the present invention, the resource access credentials of the client are sent to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credentials, including: generating the resource access credentials of the client; determining the accessible resources of the client; signing the accessible resources to obtain the signed accessible resources; sending the signed accessible resources and the resource access credentials to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credentials.

[0079] In this embodiment, MDS establishes a trusted connection with SDP and synchronizes metadata. MDS establishes a trusted connection with SDP based on digital certificates and synchronizes metadata. SDP updates the security policy library according to the received metadata. When the data on the data server changes, such as creating, writing, deleting, etc. on files or directories, the metadata update will be triggered and synchronized to MDS and SDP in time. In step three, IH establishes a trusted connection with SDP and receives the security policy. After the IH is authenticated, it establishes a trusted connection with SDP. SDP generates access credentials to list the currently accessible resources of IH, and sends them to IH and DSP at the same time after signing.

[0080] Figure 6 is a flowchart of another optional zero-trust-based data transmission processing method according to an embodiment of the present invention, such as Figure 6 As shown, the client establishes a trusted connection with the server; when the trusted connection is successfully established, the client sends an access request to the server according to the security access policy; the server verifies the identifier and SDP signature of the client in the access request according to the security access policy; after the verification is passed, the server performs access management on the client through the security access policy; finally, the data transmission management system performs access management on the client based on the access request and the security access policy.

[0081] According to the above embodiment of the present invention, the zero-trust based data transmission processing method also includes: when receiving the prohibited access information sent by the MDS server, when the target client corresponds to the client identifier carried in the prohibited access information, the target client is added to the blacklist, wherein the prohibited access information is information including the client identifier of the target client that is fed back to the MDS server when the server monitors that the target client initiates a predetermined number of prohibited access behaviors.

[0082] In this embodiment, when IH accesses DSP, it needs to provide an identifier and an SDP signature value as identity credentials. After the client program IH verifies the resource list, identifier and SDP signature, it saves and locks the policy file to access the corresponding data resources. In step 4, IH establishes a trusted connection with DSP and initiates access. The establishment of a secure link can be done by automatic negotiation, or key distribution can be performed by SDP. IH carries information such as the identifier and SDP signature value, and sends an access request to DSP. DSP verifies the credentials and decides whether the corresponding data resources can be accessed based on the matching rules. After passing the DSP verification, the specified file can be accessed, and the database can be fully accessed. Access to the database requires specifying the DSP name and directory name, data category or level information. Figure 7 is a flowchart of a preferred zero-trust-based data transmission processing method according to an embodiment of the present invention. Figure 7As shown, after multiple prohibited behaviors occur, DSP can disconnect and blacklist the IH, and at the same time feedback information to SDP. SDP can blacklist the IH. When DSP provides data, the proxy DSP will perform data desensitization, anonymization and other processing according to the security policy; finally, the data transmission management system manages the access request and security access policy to the client.

[0083] According to the above embodiment of the present invention, the zero-trust based data transmission processing method also includes: when receiving change information from the client, selecting a new security access policy from the security access policy set based on the change information; sending the new security access policy to the server and the client, so that the client performs data resource access behavior according to the new security access policy, and the server controls the client's data resource access behavior according to the new security access policy.

[0084] In this embodiment, the gateway-type DSP is completed by the IH according to the security policy. When the logged-in IH changes, the information will be synchronized to the DSP in real time, and the SDP will give the access policy in time; when the SDP security policy changes, the security policies on the IH and DSP will be updated synchronously, and the update of the MDS metadata will also trigger the security policy update, thereby improving the operation of the device.

[0085] Through the above scheme, the metadata server synchronizes the metadata to the SDP controller, so that the SDP controller updates the security policy library according to the metadata; the SDP controller sends the client's security access policy to the client and the server; the security access policy is the client's security access policy obtained from the security policy library; the client sends an access request to the server according to the security access policy; the server manages access to the client through the access request and the security access policy. By synchronizing the metadata between the metadata server and the SDP controller, metadata-based security access management can be implemented, which can reduce the security risks when the client accesses data, solve the metadata full life cycle management in the zero-trust system, and solve the problem of excessive authorization granularity in most uses of the zero-trust system, which affects the use effect of zero-trust data transmission management technology.

[0086] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0087] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0088] According to an embodiment of the present invention, a zero-trust-based data transmission processing device for implementing the above-mentioned zero-trust-based data transmission processing method is also provided. Figure 8 is a schematic diagram of a data transmission processing device based on zero trust according to an embodiment of the present invention, such as Figure 8 As shown, the device includes: an acquisition unit 801, a selection unit 803, a verification unit 805 and an access unit 807. The data transmission processing device based on zero trust is described in detail below.

[0089] The acquisition unit 801 is used to acquire a security access policy set sent by a metadata service MDS server after establishing a trusted connection with the MDS server.

[0090] The selection unit 803 is used to select a security access policy of the client from the security access policy set based on the access request sent by the client after establishing trusted connections with the client and the server respectively.

[0091] The verification unit 805 is used to send the security access policy to the client and the server, so that the client can verify the access request based on the security access policy. When the client verifies the access request based on the security access policy, the client sends the access request to the server, so that the server controls the client's data access behavior based on the security access policy and the access request.

[0092] Access unit 807 is used to send the client's resource access credentials to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credentials, wherein the MDS server authenticates the client's data resource access behavior based on the resource access credentials, and accepts the client's data resource access behavior if the data resource access behavior is authenticated.

[0093] It should be noted here that the above-mentioned acquisition unit 801, selection unit 803, verification unit 805 and access unit 807 correspond to steps S202 to S208 in the above-mentioned embodiments, and the four units are the same as the instances and application scenarios implemented by the corresponding steps, but are not limited to the contents disclosed in the above-mentioned embodiments.

[0094] As can be seen from the above, in the scheme recorded in the above-mentioned embodiment of the present invention, the acquisition unit can be used to acquire the security access policy set sent by the metadata service MDS server after establishing a trusted connection with the MDS server; the selection unit can be used to select the client's security access policy from the security access policy set based on the access request sent by the client after establishing trusted connections with the client and the server respectively; the verification unit can be used to send the security access policy to the client and the server, so that the client can verify the access request based on the security access policy, wherein the client sends the access request to the server when the access request is verified based on the security access policy, so that the server controls the client's data access behavior based on the security access policy and the access request; the access unit can be used to send the client's security access policy to the server, so that the server can control the client's data access behavior based on the security access policy and the access request. The resource access credentials of the client are sent to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credentials, wherein the MDS server authenticates the data resource access behavior of the client based on the resource access credentials, and accepts the data resource access behavior of the client if the data resource access behavior is authenticated, thereby realizing that the SDP server sends the client's security access policy to the client and the server, the client sends an access request to the server based on the security access policy, and the server manages the access to the client through the access request and the security access policy, establishes a software-based network access boundary for each access object, and reduces the security risks existing when the client accesses data.

[0095] Therefore, the technical solution provided by the embodiment of the present invention solves the technical problem that the existing zero-trust-based data transmission security protection measures are prone to have too large authorization granularity during use, which affects the use effect of zero-trust data transmission management technology.

[0096] Optionally, the acquisition unit includes: a sending module for sending a first trusted connection request to the MDS server; an acquisition module for obtaining security policy update data fed back by the MDS server when the MDS server verifies the trusted connection request; and an update module for updating the original security access policy set using the security policy update data to obtain the security access policy set.

[0097] Optionally, the selection unit includes: a receiving module for receiving a second trusted connection request sent by the client and a third trusted connection request sent by the server; a selection module for selecting a security access policy corresponding to the client from the security access policy set based on the access request when the second trusted connection request and the third trusted connection request are verified, wherein the security access policy includes: an identifier and signature information of the client.

[0098] Optionally, the access unit includes: a generation module for generating resource access credentials for the client; a determination module for determining the accessible resources of the client; a signature module for signing the accessible resources to obtain the signed accessible resources; and an initiation module for sending the signed accessible resources and resource access credentials to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credentials.

[0099] Optionally, the data transmission processing device based on zero trust also includes: an adding unit, which is used to add the target client to the blacklist when the target client corresponds to the client identifier carried in the prohibited access information when receiving the prohibited access information sent by the MDS server, wherein the prohibited access information is information including the client identifier of the target client that is fed back to the MDS server when the server monitors that the target client has initiated a predetermined number of prohibited access behaviors.

[0100] Optionally, the zero-trust based data transmission processing device also includes: a selection unit, which is also used to select a new security access policy from the security access policy set based on the change information when receiving the change information of the client; a control unit, which is used to send the new security access policy to the server and the client, so that the client executes data resource access behavior according to the new security access policy, and the server controls the client's data resource access behavior according to the new security access policy.

[0101] According to another aspect of an embodiment of the present invention, a zero-trust-based data transmission management system is also provided. The zero-trust-based data transmission management system uses any of the above-mentioned zero-trust-based data transmission processing methods.

[0102] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored program, wherein the program executes any one of the above-mentioned zero-trust-based data transmission processing methods.

[0103] Optionally, in this embodiment, the computer-readable storage medium may be located in any one of the computer terminals in a computer terminal group in a computer network, or in any one of the communication devices in a communication device group.

[0104] Optionally, in this embodiment, a computer-readable storage medium is configured to store program code for performing the following steps: after establishing a trusted connection with a metadata service MDS server, obtaining a security access policy set sent by the MDS server; after establishing trusted connections with a client and a server respectively, selecting a security access policy for the client from the security access policy set based on an access request sent by the client; sending the security access policy to the client and the server so that the client can verify the access request based on the security access policy, wherein the client sends the access request to the server when the access request is verified based on the security access policy, so that the server controls the client's data access behavior based on the security access policy and the access request; sending the client's resource access credentials to the client and the MDS server so that the client initiates data resource access to the MDS server based on the resource access credentials, wherein the MDS server authenticates the client's data resource access behavior based on the resource access credentials, and accepts the client's data resource access behavior when the data resource access behavior is authenticated.

[0105] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: sending a first trusted connection request to the MDS server; when the MDS server verifies the trusted connection request, obtaining security policy update data fed back by the MDS server; and updating the original security access policy set using the security policy update data to obtain a security access policy set.

[0106] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: receiving a second trusted connection request sent by the client and a third trusted connection request sent by the server; and in a case where the second trusted connection request and the third trusted connection request are verified, selecting a security access policy corresponding to the client from a security access policy set based on the access request, wherein the security access policy includes: an identifier and signature information of the client.

[0107] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: generating a resource access credential for the client; determining the accessible resources of the client; signing the accessible resources to obtain the signed accessible resources; sending the signed accessible resources and the resource access credential to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credential.

[0108] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: when receiving the prohibited access information sent by the MDS server, when the target client corresponds to the client identifier carried in the prohibited access information, the target client is added to the blacklist, wherein the prohibited access information is information including the client identifier of the target client that is fed back to the MDS server when the server monitors that the target client initiates a predetermined number of prohibited access behaviors.

[0109] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: when receiving change information from the client, selecting a new security access policy from the security access policy set based on the change information; sending the new security access policy to the server and the client, so that the client performs data resource access behavior according to the new security access policy, and the server controls the client's data resource access behavior according to the new security access policy.

[0110] According to another aspect of an embodiment of the present invention, a processor is further provided, and the processor is used to run a program, wherein when the program is running, any one of the above-mentioned zero-trust-based data transmission processing methods is executed.

[0111] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including computer instructions, which, when executed by a processor, execute any one of the above-mentioned zero-trust-based data transmission processing methods.

[0112] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0113] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0114] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0115] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0116] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0117] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0118] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data transmission processing method based on zero trust, characterized in that: include: After establishing a trusted connection with a metadata service MDS server, obtaining a security access policy set sent by the MDS server; After establishing trusted connections with the client and the server respectively, selecting a security access policy of the client from the security access policy set based on an access request sent by the client; Sending the security access policy to the client and the server, so that the client can verify the access request based on the security access policy, wherein the client sends the access request to the server when the access request is verified based on the security access policy, so that the server controls the data access behavior of the client based on the security access policy and the access request; The resource access credentials of the client are sent to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credentials, wherein the MDS server authenticates the data resource access behavior of the client based on the resource access credentials, and accepts the data resource access behavior of the client if the data resource access behavior is authenticated.

2. The data transmission processing method based on zero trust according to claim 1 is characterized in that: After establishing a trusted connection with the metadata service MDS server, obtaining a security access policy set sent by the MDS server includes: Sending a first trusted connection request to the MDS server; When the MDS server successfully verifies the trusted connection request, obtaining security policy update data fed back by the MDS server; The original security access policy set is updated using the security policy update data to obtain the security access policy set.

3. The data transmission processing method based on zero trust according to claim 1 is characterized in that: After establishing trusted connections with the client and the server respectively, selecting a security access policy of the client from the security access policy set based on an access request sent by the client includes: Receiving a second trusted connection request sent by the client and a third trusted connection request sent by the server; When the second trusted connection request and the third trusted connection request are verified successfully, the security access policy corresponding to the client is selected from the security access policy set based on the access request, wherein the security access policy includes: an identifier and signature information of the client.

4. The data transmission processing method based on zero trust according to claim 1, characterized in that: Sending the resource access credential of the client to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credential, comprising: generating the resource access credential of the client; Determining accessible resources of the client; Signing the accessible resource to obtain the signed accessible resource; The signed accessible resource and the resource access credential are sent to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credential.

5. The data transmission processing method based on zero trust according to claim 1, characterized in that: Also includes: When receiving the prohibited access information sent by the MDS server, the target client corresponding to the client identifier carried in the prohibited access information is added to the blacklist, wherein the prohibited access information is information including the client identifier of the target client that is fed back to the MDS server when the server monitors that the target client initiates a predetermined number of prohibited access behaviors.

6. The data transmission processing method based on zero trust according to claim 1 is characterized in that: Also includes: When receiving the change information of the client, selecting a new security access policy from the security access policy set based on the change information; The new security access policy is sent to the server and the client, so that the client performs data resource access behavior according to the new security access policy, and the server controls the data resource access behavior of the client according to the new security access policy.

7. A data transmission processing device based on zero trust, characterized in that: include: An acquisition unit, configured to acquire a security access policy set sent by a metadata service MDS server after establishing a trusted connection with the MDS server; A selection unit, configured to select a security access policy of the client from the security access policy set based on an access request sent by the client after establishing trusted connections with the client and the server respectively; a verification unit, configured to send the security access policy to the client and the server, so as to use the client to verify the access request based on the security access policy, wherein the client sends the access request to the server when the access request is verified based on the security access policy, so that the server controls the data access behavior of the client based on the security access policy and the access request; An access unit is used to send the resource access credentials of the client to the client and the MDS server, so that the client initiates data resource access to the MDS server based on the resource access credentials, wherein the MDS server authenticates the data resource access behavior of the client based on the resource access credentials, and accepts the data resource access behavior of the client if the data resource access behavior is authenticated.

8. A data transmission management system based on zero trust, characterized in that: The zero-trust-based data transmission management system uses the zero-trust-based data transmission processing method described in any one of claims 1 to 6 above.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program executes the zero-trust-based data transmission processing method described in any one of claims 1 to 6.

10. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by the processor, the zero-trust-based data transmission processing method described in any one of claims 1 to 6 is performed.

Images