Enterprise resource information access method and device based on zero-trust network security protection, equipment and medium

Abstract

The embodiment of the invention discloses an enterprise resource information access method and device based on zero-trust network security protection, equipment and a medium, and the method comprises the steps: firstly, based on an enterprise information security service, carrying out the protection management and control of a user terminal, and generating a desktop terminal management and control platform; and then, based on the desktop terminal management and control platform, carrying out virtualization operation on an operation system through a cloud technology, and generating a virtual desktop. Then, based on a zero-trust technology, a zero-trust gateway is generated by continuously and dynamically evaluating the security state of the user terminal. And finally, on the basis of a centralized management and control strategy, the zero-trust gateway connects the user terminal with the data service resource through the virtual desktop, and the secure access of the user terminal to the enterprise resource information is completed. According to the embodiment of the invention, the centralized management and control of the whole process from the terminal to the access system are realized, so that the overall detection of information network security protection is ensured, the security protection of the terminal is improved, and the security access of a service application is protected.

Description

Technical Field

[0001] The present disclosure relates to network security protection technology, and in particular to an enterprise resource information access method, apparatus, device and medium based on zero-trust network security protection. Background Art

[0002] In the context of the rapid development of information technology today, the importance of information network security protection has become increasingly prominent. With the frequent occurrence of cyber attacks and the emergence of data leaks, various organizations and enterprises are facing severe security challenges. In order to cope with these problems, many countries have introduced relevant laws and regulations to strengthen data protection and privacy supervision and encourage enterprises to operate in compliance. At the same time, the widespread use of cloud computing has enabled data and applications to migrate to the cloud, which has brought new security risks while providing convenience. Although information network security protection technology continues to advance, the rapid development of Internet of Things technology has also led to a surge in the number of devices, further expanding the potential targets of cyber attacks.

[0003] Many existing security protection measures, first of all, lag behind in the face of new attacks and cannot be updated in time to resist evolving threats. Secondly, existing security protection solutions are often too complicated, which may cause enterprises to encounter difficulties in implementing security policies and reduce the overall protection effect. In addition, many security tools also have the problem of high false alarm rates, which greatly affects normal business operations. For example, firewalls or intrusion detection systems may misjudge normal traffic as attack behavior, thereby blocking access to legitimate users and causing business losses.

[0004] In addition, information network security protection depends not only on technical means, but also on user behavior. However, many companies have insufficient investment in employee security awareness training, resulting in low user awareness and response capabilities to security threats. This lack of awareness may make it impossible to effectively prevent security incidents even with better technical protection measures.

[0005] Therefore, one or more methods are needed to solve the above problems.

[0006] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0007] The purpose of the present disclosure is to provide a method, apparatus, device and medium for accessing enterprise resource information based on zero-trust network security protection, thereby overcoming one or more problems caused by limitations and defects of related technologies at least to a certain extent.

[0008] According to one aspect of the present disclosure, a method for accessing enterprise resource information based on zero-trust network security protection is provided, comprising:

[0009] Based on the enterprise information security business, a desktop terminal management and control platform is generated by protecting and controlling user terminals;

[0010] Based on the desktop terminal management and control platform, the operating system is virtualized and operated through cloud technology to generate a virtual desktop;

[0011] Based on zero-trust technology, a zero-trust gateway is generated by continuously and dynamically evaluating the security status of the user terminal;

[0012] Based on the centralized management and control strategy, the zero-trust gateway connects the user terminal to the data service resources through the virtual desktop to complete the user terminal's secure access to enterprise resource information.

[0013] In an exemplary embodiment of the present disclosure, protection management and control is performed on a user terminal, including:

[0014] Based on the enterprise information security business, terminal behavior monitoring is completed by monitoring and managing the network behavior of the user terminal;

[0015] Based on the enterprise information security business, the authorization behavior of service resource data is securely managed to complete the behavior authorization control;

[0016] Based on the enterprise information security business, the vulnerabilities of the user terminals are repaired through patch distribution management to complete terminal vulnerability management;

[0017] Based on the enterprise information security business, virus protection management is completed by building a virus protection mechanism.

[0018] In an exemplary embodiment of the present disclosure, protection management and control is performed on a user terminal, including:

[0019] Based on the login operation log, the audit evaluation management is completed by performing associated audit on the operation information of the user terminal;

[0020] Based on the terminal behavior monitoring, behavior authorization management, terminal vulnerability management, virus protection management, and audit evaluation management, an integrated security protection platform for user terminals is constructed to generate a desktop terminal management and control platform.

[0021] In an exemplary embodiment of the present disclosure, virtualizing and running an operating system through cloud technology includes:

[0022] Based on the desktop terminal management and control platform, a virtual server is generated by virtualizing the physical server;

[0023] Based on the desktop usage environment, the virtual server version information is generated by dividing the virtual server into versions;

[0024] Based on the virtual server version information, the user terminal generates a virtual desktop by performing protocol access to the operating system.

[0025] In an exemplary embodiment of the present disclosure, continuously and dynamically evaluating the security status of the user terminal includes:

[0026] Based on the enterprise resource use management specifications, the account definition of preset level personnel is performed to generate trusted user management information;

[0027] Based on the standardized management specifications of enterprise assets, reliable asset management information is generated by collecting, maintaining and managing enterprise assets;

[0028] Based on the enterprise terminal device authentication management specifications, the trusted terminal management information is generated by binding the terminal device with the preset associated user identity;

[0029] Based on the trusted user management information, the trusted asset management information, and the trusted terminal management information, the trusted identity information is generated by constructing the identity information of the user terminal;

[0030] Based on the principle of least authorization, by defining the security access boundary of the trusted identity information, fine-grained authorization information is generated;

[0031] Based on the business needs of the enterprise, dynamic access authorization information is generated by dynamically adjusting the fine-grained authorization information;

[0032] Based on zero-trust technology, the access channel of the user terminal is constructed through the dynamic access authorization information to generate a zero-trust gateway.

[0033] In an exemplary embodiment of the present disclosure, by continuously and dynamically evaluating the security status of the user terminal, the method further includes:

[0034] Based on the AI ​​algorithm engine, a dynamic baseline library is generated by analyzing the dynamic behavior of enterprise users;

[0035] Based on the dynamic baseline library, generating a terminal environment trust assessment model by assessing the environmental risk level of the user terminal;

[0036] Based on the dynamic baseline library, generating a user access trust evaluation model by performing trust evaluation on the access behavior of the user terminal;

[0037] Based on the terminal environment trust assessment model and the user access trust assessment model, behavior visualization information is generated by monitoring the behavior of the user terminal requesting the zero trust gateway.

[0038] In an exemplary embodiment of the present disclosure, the zero-trust gateway connects the user terminal to the data service resource through the virtual desktop, including:

[0039] Based on the user's access application, the user terminal generates an application data package by integrating information of the access application;

[0040] Based on the single-packet authorization technology, an access application is made to the zero-trust gateway through the application data single packet, a connection between the virtual desktop and the data service resource is established, and the user terminal accesses the enterprise resource information. In one aspect of the present disclosure, a device for accessing enterprise resource information based on zero-trust network security protection is provided, comprising:

[0041] Desktop terminal management and control module, used to perform protection and control on user terminals;

[0042] A virtual desktop generation module is used to virtualize the operating system through cloud technology;

[0043] A zero-trust gateway establishment module is used to continuously and dynamically evaluate the security status of the user terminal;

[0044] The access connection module, the zero-trust gateway connects the user terminal to the data service resource through the virtual desktop.

[0045] In one aspect of the present disclosure, there is provided an electronic device, comprising:

[0046] Processor; and

[0047] A memory having computer-readable instructions stored thereon, wherein the computer-readable instructions, when executed by the processor, implement the method according to any one of the above items.

[0048] In one aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method according to any one of the above items is implemented.

[0049] Based on the embodiments of the present disclosure, first, according to the enterprise information security business, a desktop terminal management and control platform is generated by performing protection and control on user terminals. Afterwards, based on the desktop terminal management and control platform, the operating system is virtualized and operated through cloud technology to generate a virtual desktop. Then, based on zero-trust technology, a zero-trust gateway is generated by performing continuous dynamic evaluation of the security status of the user terminal. Finally, based on the centralized control strategy, the zero-trust gateway connects the user terminal to the data service resource through the virtual desktop to complete the user terminal's secure access to enterprise resource information. The embodiments of the present disclosure implement centralized control of the entire process from terminal to access system to ensure the overall detection of information network security protection, improve the security protection of the terminal, and protect the secure access to business applications.

[0050] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure.

[0051] The technical solution of the present disclosure is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0053] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0054] Figure 1 This is a flow chart of a method for accessing enterprise resource information based on zero-trust network security protection according to an embodiment of the disclosed method;

[0055] Figure 2 A decision logic flow chart of a method for accessing enterprise resource information based on zero-trust network security protection according to an embodiment of the disclosed method;

[0056] Figure 3 A patch distribution logic flow chart of an enterprise resource information access method based on zero-trust network security protection according to an embodiment of the disclosed method;

[0057] Figure 4 This is a structural block diagram of an enterprise resource information access device based on zero-trust network security protection in one embodiment of the disclosed method;

[0058] Figure 5 A block diagram of an electronic device according to an embodiment of the method disclosed herein. DETAILED DESCRIPTION

[0059] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be comprehensive and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The same reference numerals in the figures represent the same or similar parts, and thus their repeated description will be omitted.

[0060] In addition, the described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, materials, devices, steps, etc. may be adopted. In other cases, known structures, methods, devices, implementations, materials or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

[0061] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or these functional entities or parts of functional entities may be implemented in one or more software hardened modules, or these functional entities may be implemented in different networks and / or processor devices and / or microcontroller devices.

[0062] In the embodiment of the present disclosure, a method for accessing enterprise resource information based on zero-trust network security protection is first provided; Figure 1 As shown in , the enterprise resource information access method based on zero-trust network security protection may include the following steps:

[0063] Step S110, generating a desktop terminal management and control platform by performing protection management and control on user terminals based on the enterprise information security business;

[0064] Step S120, based on the desktop terminal management and control platform, virtualizing the operating system through cloud technology to generate a virtual desktop;

[0065] Step S130, based on zero trust technology, generating a zero trust gateway by continuously and dynamically evaluating the security status of the user terminal;

[0066] Step S140, based on the centralized management and control strategy, the zero-trust gateway connects the user terminal to the data service resources through the virtual desktop to complete the user terminal's secure access to enterprise resource information.

[0067] Below, as Figure 2As shown, a method for accessing enterprise resource information based on zero-trust network security protection in an embodiment of the present disclosure will be further explained.

[0068] In step S110, a desktop terminal management and control platform may be generated by performing protection management and control on user terminals based on the enterprise information security business.

[0069] In some optional embodiments of this example, in the first aspect, the terminal behavior monitoring of the network bandwidth occupation in the user terminal can be performed: first, the flow sampling threshold is set, and when the flow (including outgoing, incoming or total flow) exceeds a certain limit and lasts for a certain period of time, the relevant information is reported. After that, the reported current flow is summarized and sorted in real time, so that the network management personnel can quickly analyze whether it is a network security incident, thereby avoiding worm viruses and BT downloads and other behaviors that seriously occupy network bandwidth and cause congestion and paralysis of the network.

[0070] Preferably, the concurrent connection number threshold, the client's large number of packet sending behavior threshold, and the client's traffic online threshold can also be set. When behaviors exceeding these thresholds occur, automatic alarms, automatic blocking, client prompts and other management are performed.

[0071] In addition, it is also possible to manage the user terminal's website access behavior (controlling the user's access to certain websites, or prohibiting access to certain websites), the user terminal's usage time (synchronizing the usage time of all terminals), and the user terminal's system service disabling / enabling.

[0072] Secondly, the encrypted document permissions in the service resource library can be controlled by behavioral authorization: First, the core data is encrypted and stored to ensure that the data stored on the disk cannot be dumped and leaked, and can only be accessed through authorization. After that, follow the enterprise classification specifications to classify and grade key data, and users can customize the sensitive rule library and customize the file classification level. Finally, users authorize different institutions and personnel based on the classification and grading of the above data (authorization permissions are divided into three categories: read-only, editable, and full control permissions, and each type of permission can be attached with printing, distribution, offline, copying and other permissions). Preferably, when using important sensitive files on the user terminal, a watermark is automatically displayed to prevent leakage through taking pictures.

[0073] Thirdly, Figure 3As shown in the figure, terminal vulnerability management can be completed through patch distribution management: First, the downloaded patches are classified and built according to different operating systems, patch numbers, patch release times, patch risk levels, patch announcements, etc. to help managers quickly identify patches. After that, a distribution strategy for patches is formulated based on timing, periodicity, classification, range, department, client status, and user customization. Then, patches are automatically distributed according to the patch distribution strategy. Among them, for physically isolated intranets, incremental patch automatic separation technology is used to separate installed and non-installed patches in the external network and import them by category. Finally, by querying the patches (you can query the installed and non-installed patches of a certain device or query the devices that do not install a certain patch and export them), the installation of the patches can be improved.

[0074] Also, before the patch is installed, the patch is subject to necessary security testing; when the patch is installed, the bandwidth allowed for patch distribution is controlled; after the patch is installed, information about the patch installation status is queried.

[0075] Fourthly, virus protection management can be established: First, the virus library of the desktop terminal control platform is updated through the Internet or the administrator to ensure that it is the latest virus library. After that, a file trust zone is established so that files added to the trust zone are considered safe during the virus detection process to ensure the security of self-written code in certain systems. Then, active detection is started to actively initiate detection of sensitive system boundary entries such as web page access, program downloads, and file copies. At the same time, all processes, USB flash drives, and other connected hard drives during computer operation are monitored in real time. Finally, the risky files found in active detection, real-time protection, and USB flash drive protection are isolated in the abnormal file recovery area, where trusted files can be manually restored and isolated files can be completely deleted.

[0076] Through the above four aspects, we can cover functions such as security event management, behavior authorization management, and behavior monitoring management of user terminals, laying the foundation for building an integrated security protection desktop terminal management and control platform.

[0077] In some optional embodiments of this example, the log information of the user terminal's login, operation, authorization, protection and other behaviors can also be associated with the design evaluation to achieve the backtracking of the operation behavior, so as to improve the audit evaluation management of the installed software query, terminal process management, terminal service management, system operation resource viewing, patch query, virus detection log query and other aspects.

[0078] As a result, a unified, standardized, and deeply intelligent desktop terminal management and control platform was built, which enabled safe and visual operation of user terminals and provided all-round security services to employees of industrial companies.

[0079] In step S120, based on the desktop terminal management and control platform, the operating system can be virtualized and run through cloud technology to generate a virtual desktop.

[0080] In some optional embodiments of this example, first, a single physical server is divided into multiple virtual servers that share resources using server virtualization software, and desktop services are provided externally.

[0081] Afterwards, according to the cloud desktop usage environment with different scenarios and features, the virtual server version information is divided into standard version, professional version, and advanced version according to different functions. The standard version can meet the general application needs of users in multiple industries such as daily office, call center, vocational education, and hospital.

[0082] Finally, according to the production needs of the enterprise, based on different versions, the user terminal is connected to the virtual server through the cloud desktop protocol to establish a connection between the user terminal and the virtual desktop, so that users can complete their daily work through the virtual desktop just like accessing a traditional PC.

[0083] In this way, the operating system and application software are run on the virtual server through the virtual desktop, but the operations (input, output) are performed on the user terminal protected by the desktop terminal management and control platform. All input operations (such as mouse and keyboard) are synchronized to the virtual server for execution, and all output refreshes (such as screens) are also synchronized to the user terminal for display. Every time the user logs in, he or she can get a new dedicated desktop refreshed in restore mode. This fundamentally solves the problem of data leakage caused by users using terminals for office work.

[0084] In step S130, a zero-trust gateway may be generated by continuously and dynamically evaluating the security status of the user terminal based on zero-trust technology.

[0085] In some optional embodiments of this example, first, with identity as the center, various factors of the user's access to the business process are identified and digitized, and trusted identity information is constructed based on trusted user management information, trusted terminal management information, trusted asset management information, etc.

[0086] Among them, trusted user management information: based on the enterprise resource use management method, define accounts for all resource users of the enterprise, such as ordinary users, system managers, on-site maintenance personnel, partners, temporary staff, etc., and perform unified account management for them.

[0087] Trusted asset management information: Based on the standardized management specifications of enterprise assets, automatically collect, maintain and audit asset information to minimize management costs and work complexity.

[0088] Trusted terminal management information: Based on the enterprise terminal device authentication management specifications, it provides terminal device identity self-registration capabilities. Through the intervention of the administrator, the legitimacy and authenticity of the terminal device are reviewed. The fingerprint information of the terminal device that has passed the review is recorded and saved, and is bound to the relevant user identity to ensure the legitimacy of the user terminal and support multi-terminal secure login.

[0089] Afterwards, based on the static access control strategy of the principle of least authorization and combined with the dynamic access control method of the strategy, by establishing access authorization for access users and internal business resources, access permission for zero-trust clients and stealth gateways, and connection control between stealth gateways and business resources, the security access boundary definition of fine-grained authorization information is realized.

[0090] Finally, dynamic access authorization information is generated at any time according to business needs, and a zero-trust gateway is established to isolate the terminal installation status and application system. The access method of the NC system is linked to the security status of the terminal. If the terminal is non-compliant or cannot be verified, the terminal is prohibited from logging in. At the same time, the corresponding business addresses and ports are hidden so that they cannot be scanned and discovered, and the minimum permissions for identity-centric business access are set, ultimately achieving secure control of business access.

[0091] In some optional embodiments of this example, it may also include: by collecting the behavior history data of different users, analyzing the user behavior according to a certain time interval for different behaviors of the users through a rich AI algorithm engine (such as: time series prediction algorithm, statistical test algorithm, anomaly detection algorithm, distribution verification algorithm, etc.), and generating a dynamic baseline library for different users. In this way, abnormal user behavior can be identified in a timely manner, which facilitates administrators to make accurate judgments in the first place and protect business data security.

[0092] Afterwards, a terminal environment trust assessment model is constructed based on the dynamic baseline library of different users. The model establishes a terminal environment risk and trust assessment mechanism that adapts to access behavior, and completes the risk level of terminal environment access by setting risk configuration conditions.

[0093] In addition, a user access trust evaluation model is constructed based on the dynamic baseline library of different users. The model establishes an evaluation mechanism for the business value of adapted access assets, and comprehensively measures the business value of assets from dimensions such as asset security classification, sensitive assets, and usage stages. This completes the trust evaluation of the access behavior of user terminals, and thus makes operations such as blocking, releasing, and secondary intervention of user access behaviors.

[0094] Finally, based on the terminal environment trust assessment model and the user access trust assessment model, all business resource access traffic logs and user login behavior logs are collected to visually track the user behavior access trajectory. Preferably, the business access traffic of the zero-trust gateway can also be continuously monitored. The business access traffic is counted in real time, and the user's business access behavior is analyzed based on multiple dimensions such as time, IP, access protocol and traffic size to establish user behavior visualization information.

[0095] In step S140, based on the centralized management and control strategy, the zero-trust gateway connects the user terminal to the data service resources through the virtual desktop to complete the user terminal's secure access to enterprise resource information.

[0096] In some optional embodiments of this example, when a user applies for access to enterprise resources through a user terminal protected by a desktop terminal management and control platform, all necessary information is integrated into a single data packet based on single-packet authorization and dynamic port technology to generate an application data single packet. And through this application data single packet, an access application is made to the zero-trust gateway. This can avoid application failures caused by factors such as packet loss during the knocking process.

[0097] When user access behavior is abnormal, operation and maintenance personnel identify and discover abnormal malicious behavior based on behavioral visualization information, block suspicious business access for abnormal business access, and locate suspicious user accounts and terminals to conduct review and accountability for abnormal behavior.

[0098] When the user access behavior is approved, a connection is established between the user terminal and the virtual desktop, and secure access to enterprise data service resources is achieved through the virtual desktop.

[0099] It should be noted that, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0100] In addition, in this exemplary embodiment, a device for accessing enterprise resource information based on zero-trust network security protection is also provided. Figure 4 As shown, the enterprise resource information access device 400 based on zero-trust network security protection may include: 410, 420, 430 and 440. Among them:

[0101] The desktop terminal management and control module 410 is used to perform protection management and control on the user terminal;

[0102] A virtual desktop generation module 420 is used to virtualize the operating system through cloud technology;

[0103] A zero-trust gateway establishment module 430 is used to continuously and dynamically evaluate the security status of the user terminal;

[0104] Access connection module 440, the zero trust gateway connects the user terminal to the data service resource through the virtual desktop.

[0105] The enterprise resource information access device based on zero-trust network security protection of the embodiment of the present disclosure corresponds to the embodiment of the enterprise resource information access method based on zero-trust network security protection of the present disclosure, and the relevant contents can be referenced to each other, which will not be repeated here. The beneficial technical effects corresponding to the enterprise resource information access device based on zero-trust network security protection of the embodiment of the present disclosure can refer to the corresponding beneficial technical effects of the corresponding exemplary method part above, which will not be repeated here.

[0106] It should be noted that although several modules or units of the enterprise resource information access device 400 based on zero-trust network security protection are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiment of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0107] Below, reference Figure 5 The electronic device according to the embodiment of the present disclosure is described. The electronic device may be any one or both of the first device and the second device, or a stand-alone device independent of them, and the stand-alone device may communicate with the first device and the second device to receive the collected input signals from them.

[0108] Figure 5 A block diagram of an electronic device according to an embodiment of the present disclosure is illustrated.

[0109] like Figure 5 As shown, the electronic device includes one or more processors and memory.

[0110] The processor may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0111] The memory may store one or more computer program products, and the memory may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may include, for example, a read-only memory (ROM), a hard disk, a flash memory, etc. One or more computer program products may be stored on the computer-readable storage medium, and the processor may run the computer program product to implement the various embodiments of the present disclosure described above and / or other desired functions.

[0112] In one example, the electronic device may further include: an input device and an output device, and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0113] In addition, the input device may also include, for example, a keyboard, a mouse, and the like.

[0114] The output device can output various information to the outside, including the determined distance information, direction information, etc. The output device can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0115] Of course, to simplify, Figure 5 Only some of the components related to the present disclosure in the electronic device are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device may further include any other appropriate components.

[0116] In addition to the above methods and devices, an embodiment of the present disclosure may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the method according to various embodiments of the present disclosure described in the above part of this specification.

[0117] The computer program product may be written in any combination of one or more programming languages ​​to write program code for performing the operations of the disclosed embodiments, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0118] In addition, an embodiment of the present disclosure may also be a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, enables the processor to execute the steps of the method according to various embodiments of the present disclosure described in the above part of this specification.

[0119] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0120] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0121] Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system embodiment, since it basically corresponds to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0122] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0123] The method and apparatus of the present disclosure may be implemented in many ways. For example, the method and apparatus of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present disclosure may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present disclosure. Therefore, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

[0124] It should also be noted that in the apparatus, device and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0125] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0126] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A method for accessing enterprise resource information based on zero-trust network security protection, characterized in that: include: Based on the enterprise information security business, a desktop terminal management and control platform is generated by protecting and controlling user terminals; Based on the desktop terminal management and control platform, the operating system is virtualized and operated through cloud technology to generate a virtual desktop; Based on zero-trust technology, a zero-trust gateway is generated by continuously and dynamically evaluating the security status of the user terminal; Based on the centralized management and control strategy, the zero-trust gateway connects the user terminal to the data service resources through the virtual desktop to complete the user terminal's secure access to enterprise resource information.

2. The method according to claim 1, characterized in that Through the protection and control of user terminals, including: Based on the enterprise information security business, terminal behavior monitoring is completed by monitoring and managing the network behavior of the user terminal; Based on the enterprise information security business, the authorization behavior of service resource data is securely managed to complete the behavior authorization control; Based on the enterprise information security business, the vulnerabilities of the user terminals are repaired through patch distribution management to complete terminal vulnerability management; Based on the enterprise information security business, virus protection management is completed by building a virus protection mechanism.

3. The method according to claim 2, characterized in that Through the protection and control of user terminals, including: Based on the login operation log, the audit evaluation management is completed by performing associated audit on the operation information of the user terminal; Based on the terminal behavior monitoring, behavior authorization management, terminal vulnerability management, virus protection management, and audit evaluation management, an integrated security protection platform for the user terminal is constructed to generate a desktop terminal management and control platform.

4. The method according to claim 1, characterized in that The operating system is virtualized through cloud technology, including: Based on the desktop terminal management and control platform, a virtual server is generated by virtualizing the physical server; Based on the desktop usage environment, the virtual server version information is generated by dividing the virtual server into versions; Based on the virtual server version information, the user terminal generates a virtual desktop by performing protocol access to the operating system.

5. The method according to claim 1, characterized in that By continuously and dynamically evaluating the security status of the user terminal, including: Based on the enterprise resource use management specifications, the account definition of preset level personnel is performed to generate trusted user management information; Based on the standardized management specifications of enterprise assets, reliable asset management information is generated by collecting, maintaining and managing enterprise assets; Based on the enterprise terminal device authentication management specifications, the trusted terminal management information is generated by binding the terminal device with the preset associated user identity; Based on the trusted user management information, the trusted asset management information, and the trusted terminal management information, the trusted identity information is generated by constructing the identity information of the user terminal; Based on the principle of least authorization, by defining the security access boundary of the trusted identity information, fine-grained authorization information is generated; Based on the business needs of the enterprise, dynamic access authorization information is generated by dynamically adjusting the fine-grained authorization information; Based on zero-trust technology, the access channel of the user terminal is constructed through the dynamic access authorization information to generate a zero-trust gateway.

6. The method according to claim 5, characterized in that By continuously and dynamically evaluating the security status of the user terminal, it also includes: Based on the AI ​​algorithm engine, a dynamic baseline library is generated by analyzing the dynamic behavior of enterprise users; Based on the dynamic baseline library, generating a terminal environment trust assessment model by assessing the environmental risk level of the user terminal; Based on the dynamic baseline library, generating a user access trust evaluation model by performing trust evaluation on the access behavior of the user terminal; Based on the terminal environment trust assessment model and the user access trust assessment model, behavior visualization information is generated by monitoring the behavior of the user terminal requesting the zero trust gateway.

7. The method according to any one of claims 1 to 6, characterized in that: The zero-trust gateway connects the user terminal to the data service resource through the virtual desktop, including: Based on the user's access application, the user terminal generates an application data package by integrating information of the access application; Based on the single-package authorization technology, an access application is made to the zero-trust gateway through the application data single package, a connection between the virtual desktop and the data service resources is established, and the user terminal completes the access to the enterprise resource information.

8. An enterprise resource information access device based on zero-trust network security protection, characterized in that: include: Desktop terminal management and control module, used to perform protection and control on user terminals; A virtual desktop generation module is used to virtualize the operating system through cloud technology; A zero-trust gateway establishment module is used to continuously and dynamically evaluate the security status of the user terminal; The access connection module, the zero-trust gateway connects the user terminal to the data service resource through the virtual desktop.

9. An electronic device, characterized in that: include: a memory for storing a computer program product; A processor is used to execute the computer program product stored in the memory, and when the computer program product is executed, it implements the method described in any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method described in any one of claims 1 to 7 is implemented.

Images