Business system access control method and device based on zero trust, equipment and medium

Abstract

The invention relates to a service system access control method and device based on zero trust, equipment and a medium, and the method comprises the steps: triggering a session management function network element or an AAA server in a network core network function network element to send a user re-authentication request to a user terminal, so as to enable the user terminal to return current user information to the AAA server; when the AAA server verifies that the current user identity information is consistent with the user identity information corresponding to the target user, an identity authentication success result is determined; and based on the identity authentication success result and the current user identity information, the AAA server initiates a biological characteristic authentication request to the user terminal, so that the AAA server detects whether the latest biological characteristic information of the target user returned by the user terminal is matched with the pre-stored biological characteristic information of the target user, and if yes, the target user is authenticated. And if yes, returning a biological feature authentication success result to the user terminal to authorize the target user to continuously access the target service system. According to the invention, many security problems such as illegal control of legal equipment can be avoided.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a zero-trust-based business system access control method, corresponding device, electronic device and computer-readable storage medium. Background Art

[0002] Zero trust has been a hot topic in the field of network security in recent years. The main reason is the change in security threats brought about by the huge changes in IT (Information Technology) infrastructure. In other words, under the trend of IT infrastructure changes such as de-bordering, cloudification and service-oriented, traditional security protection measures lack effectiveness, and zero trust provides a key to solve these security threats. The main feature of zero trust is "never trust, continuous authentication", that is, trust is relative trust, which is only valid for a short time and needs to be continuously authenticated to ensure user identity security and network security. The zero trust model fundamentally subverts the traditional network security concept. It no longer trusts the internal network, but regards each user and device as a potential security threat. That is, it assumes that there may be attackers inside and outside the network, and regards each user and device as a potential security threat. All access requests must pass strict identity authentication and access control to protect network resources, and perform continuous verification and authorization to ensure network security.

[0003] Zero Trust emphasizes automated dynamic authentication, permission changes, and policy enforcement, providing a centralized way to define and enforce access control policies across distributed, heterogeneous infrastructures. It emphasizes identity-centricity and access control through dynamic policies. It can be seen that implementing Zero Trust is a long-term and continuously evolving project.

[0004] On the other hand, smart manufacturing has emerged as a new production model. The industrial Internet, which effectively combines the smart manufacturing process with the Internet of Things, can realize dynamic monitoring of each production link and is an important basic network in the field of smart manufacturing. The new generation of information and communication technology 5G (fifth generation mobile communication technology) with large bandwidth, low latency and wide connection provides the possibility of improving the degree of production automation and efficiency, and also provides a new way to realize the digitalization, networking and intelligent development of the industry. Especially in the field of manufacturing industry, 5G technology has gradually become the core technology for the transformation and development of the entire industry, providing important key support for industrial development. However, in the specific application of 5G technology in the smart manufacturing industry, it often faces many security issues, such as: business data is stolen, legal equipment is illegally controlled, legal identity is impersonated, etc. These security issues are likely to cause unpredictable consequences at a specific moment.

[0005] To sum up, the 5G technology in the existing technology faces many security issues in the intelligent manufacturing industry, such as business data theft, illegal control of legal equipment, and impersonation of legal identities, which may easily cause unpredictable consequences at specific moments. The applicant has made corresponding explorations to solve this problem. Summary of the invention

[0006] The purpose of this application is to solve the above-mentioned problems and provide a business system access control method based on zero trust, a corresponding device, an electronic device and a computer-readable storage medium.

[0007] In order to meet the various objectives of this application, this application adopts the following technical solutions:

[0008] A zero-trust-based business system access control method proposed to meet one of the purposes of this application includes:

[0009] When the network side detects that a user terminal that has passed the network access authentication and the service system access authentication continues to access the target service system, the preset zero-trust security model is called, and according to the preset access control policy, the session management function network element or the AAA server in the network core network function network element is triggered to send a user re-authentication request to the user terminal, so that the user terminal returns the current user information to the AAA server, wherein the user terminal includes one or more target users;

[0010] When the AAA server verifies that the current user identity information is consistent with the user identity information corresponding to the target user, the identity authentication is successful.

[0011] Based on the identity authentication success result and the current user identity information, the AAA server initiates a biometric authentication request to the user terminal, so that the AAA server detects whether the latest biometric information of the target user returned by the user terminal matches the pre-stored biometric information of the target user, and if so, returns a biometric authentication success result to the user terminal to authorize the target user to continue to access the target service system;

[0012] The above steps are executed cyclically based on the access control policy until the target user ends access to the target business system, so as to complete the access control of the business system based on zero trust.

[0013] Optionally, the network core network function network element includes a 5G core network function network element and a 6G core network function network element, wherein the 5G core network function network element includes an access and mobility management function network element, a session management function network element, a user plane function network element, a multi-access edge computing function network element and an AAA server;

[0014] The access control strategy includes periodic continuous re-authentication, event-based continuous re-authentication, and periodic and event-based continuous re-authentication, wherein the periodic continuous re-authentication includes periodic user identity continuous authentication based on time, the event-based continuous re-authentication includes user identity continuous authentication based on terminal location and user identity continuous authentication based on network security situation awareness, and the periodic and event-based continuous re-authentication includes user identity continuous authentication based on terminal location and time;

[0015] The user identity information includes user account, user password, token or certificate;

[0016] The biometric information includes user fingerprint features, user facial features or user iris features;

[0017] The user re-authentication request includes an EAP request.

[0018] Optionally, calling a preset zero-trust security model, triggering a session management function network element or an AAA server in a network core network function network element to send a user re-authentication request to a user terminal according to a preset access control policy, so that the user terminal returns current user information to the AAA server, includes:

[0019] The session management function network element or the AAA server initiates the time-based periodic user identity continuous authentication, and the timer module in the session management function network element or the AAA server continuously detects whether the system access time interval of the target user reaches a preset time interval;

[0020] If the target user's system access duration interval reaches a preset time interval, the session management function network element or the AAA server sends an EAP request to the user terminal, so that the user terminal returns the current user identity information to the AAA server.

[0021] Optionally, calling a preset zero-trust security model, triggering a session management function network element or an AAA server in a network core network function network element to send a user re-authentication request to a user terminal according to a preset access control policy, so that the user terminal returns current user information to the AAA server, includes:

[0022] The session management function network element initiates a continuous user identity authentication based on the terminal location, and the session management function network element obtains the wireless location accessed by the target user uploaded by the access and mobility management function network element, and the wireless location includes a cell, a base station or a tracking area;

[0023] When the session management function network element detects that the target user enters a re-authentication location area that requires the target user to re-authenticate, the session management function network element sends an EAP request to the user terminal, so that the user terminal returns current user identity information to the AAA server.

[0024] Optionally, after the step of the session management function network element detecting that the target user enters a re-authentication location area requiring the target user to re-authenticate, the step includes:

[0025] The session management function network element initiates a continuous user identity authentication based on the terminal location and time, and the timer module in the session management function network element continuously detects whether the system access time interval when the target user enters the re-authentication location area reaches a preset time interval;

[0026] If so, the session management function network element continues to execute the steps after sending an EAP request to the user terminal so that the user terminal returns the current user identity information to the AAA server.

[0027] Optionally, calling a preset zero-trust security model, triggering a session management function network element or an AAA server in a network core network function network element to send a user re-authentication request to a user terminal according to a preset access control policy, so that the user terminal returns current user information to the AAA server, includes:

[0028] The session management function network element initiates continuous user identity authentication based on network security situation awareness, and uses the multi-access edge computing function network element or the user plane function network element to continuously perceive the network security situation of the user terminal according to a preset security situation awareness strategy, wherein the network security situation includes abnormal user behavior, and the abnormal user behavior includes abnormal login address or time, abnormal data transmission characteristics, and access to restricted areas, and the security situation awareness strategy includes a machine learning model or user behavior analysis;

[0029] The session management function network element sends an EAP request to the user terminal according to the network security situation, so that the user terminal returns the current user identity information to the AAA server.

[0030] Optionally, based on the successful identity authentication result and the current user identity information, the AAA server initiates a biometric authentication request to the user terminal, so that the AAA server detects whether the latest biometric information of the target user returned by the user terminal matches the pre-stored biometric information of the target user, and if they match, returns a successful biometric authentication result to the user terminal to authorize the target user to continue to access the target business system, including:

[0031] Based on the successful identity authentication result and the current user identity information, the AAA server initiates a biometric authentication request to the user terminal;

[0032] The terminal re-authentication module in the user terminal calls the biometric collection module to collect the latest biometric information of the target user, and the AAA re-authentication module in the AAA server calls the pre-stored biometric information of the target user in the biometric storage module;

[0033] The AAA server detects whether the latest biometric information of the target user returned by the user terminal matches the pre-stored biometric information of the target user. If so, it returns a biometric authentication success result to the user terminal to authorize the target user to continue accessing the target business system.

[0034] A zero-trust-based business system access control device provided to meet another purpose of the present application includes:

[0035] The re-authentication trigger module is configured to call a preset zero-trust security model when the network side detects that a user terminal that has passed the network access authentication and the service system access authentication continues to access the target service system, and trigger the session management function network element or the AAA server in the network core network function network element to send a user re-authentication request to the user terminal according to the preset access control policy, so that the user terminal returns the current user information to the AAA server, wherein the user terminal includes one or more target users;

[0036] A user identity authentication module, configured to determine a successful identity authentication result when the AAA server verifies that the current user identity information is consistent with the user identity information corresponding to the target user;

[0037] a biometric authentication module, configured to cause the AAA server to initiate a biometric authentication request to the user terminal based on the identity authentication success result and the current user identity information, so that the AAA server detects whether the latest biometric information of the target user returned by the user terminal matches the pre-stored biometric information of the target user, and if so, returns a biometric authentication success result to the user terminal to authorize the target user to continue to access the target service system;

[0038] The access control module is configured to cyclically execute the above steps based on the access control policy until the target user ends access to the target business system, so as to complete the access control of the business system based on zero trust.

[0039] An electronic device provided to meet another purpose of the present application includes a central processing unit and a memory, wherein the central processing unit is used to call and run a computer program stored in the memory to execute the steps of the zero-trust-based business system access control method described in the present application.

[0040] A computer-readable storage medium is provided to meet another purpose of the present application, which stores a computer program implemented according to the zero-trust-based business system access control method in the form of computer-readable instructions. When the computer program is called and executed by a computer, the steps included in the corresponding method are executed.

[0041] Compared with the prior art, this application aims at the many security issues faced by 5G technology in the prior art in the intelligent manufacturing industry, such as business data being stolen, legal equipment being illegally controlled, and legal identity being impersonated, which may easily cause unpredictable consequences at a specific moment. This application includes but is not limited to the following beneficial effects:

[0042] This application adopts the 5G re-authentication process and zero-trust security model to achieve continuous verification of the identity of users accessing the background business system and ensure the security of the background business system. When continuously verifying the identity of the user, corresponding identity authentication is required based on the access control policy. The access control policy includes that the re-authentication process can be triggered periodically or event-based, where the periodic re-authentication duration is the cycle time that meets the security requirements. Event-based re-authentication trigger conditions include re-authentication based on user terminal location, re-authentication based on network security situation awareness, etc. For re-authentication based on terminal location, the location can be the wireless location of the terminal, such as a cell, base station or tracking area. Since the wireless network knows the cell, base station or tracking area where the terminal is located, the 5G base station / access and mobility management function (AMF) network element needs to notify the session management function (SMF) network element of the location of the terminal, so as to trigger the session management function (SMF) network element to initiate a re-authentication process based on the location area; in re-authentication based on network security situation awareness, the network security situation also includes user access anomalies, that is, when the user is performing business, the user plane function (UPF) network element or the multi-access edge computing (MEC) function network element continuously monitors user access anomalies and network security situation, and adopts continuous intelligent risk assessment, such as based on machine learning and behavior analysis technology, to report to the SMF in real time to assess the risk level of users and networks, and dynamically adjust the user's access control policy and permissions to cope with the ever-changing threats and environment to prevent unauthorized access.

[0043] When users re-authenticate, multi-factor authentication with biometrics is used, that is, the latest biometrics of users such as fingerprints, facial features, or irises are used to ensure the authenticity of the identity of users accessing the business system. In order to accurately trace the source when a security incident occurs, the system also records the security authentication log information of each user.

[0044] Furthermore, the present application can run in any environment, such as home, cafe, hotel, etc., instead of a relatively secure enterprise intranet environment on the user terminal. This can avoid security threats such as user identity impersonation due to user terminal loss, phishing attacks and watering hole attacks that target users may suffer, and avoid many security issues such as theft of business data of 5G technology in the smart manufacturing industry, illegal control of legitimate equipment, and impersonation of legitimate identities. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0046] Figure 1 An exemplary network architecture adopted by the 5G standard re-authentication process in the embodiment of the present application;

[0047] Figure 2 This is a flow chart of 5G terminal user authentication access service in an embodiment of the present application;

[0048] Figure 3 This is a flowchart of a method for controlling access to a business system based on zero trust in an embodiment of the present application;

[0049] Figure 4 is an exemplary principle block diagram of a user terminal in an embodiment of the present application;

[0050] Figure 5 This is an exemplary principle block diagram of the AAA server in an embodiment of the present application;

[0051] Figure 6 This is an exemplary principle block diagram of a session management function network element in an embodiment of the present application;

[0052] Figure 7 This is an exemplary principle block diagram of a user plane functional network element or a multi-access edge computing functional network element in an embodiment of the present application;

[0053] Figure 8 An exemplary network architecture for initiating time-based periodic user identity continuous authentication by a session management function network element in an embodiment of the present application;

[0054] Fig. 9An exemplary network architecture for initiating time-based periodic user identity continuous authentication by an AAA server in an embodiment of the present application;

[0055] Fig.10 An exemplary network architecture in which a session management function network element initiates continuous user identity authentication based on terminal location in an embodiment of the present application;

[0056] Fig.11 An exemplary network architecture in which a session management function network element initiates continuous user identity authentication based on terminal location and time in an embodiment of the present application;

[0057] Fig.12 An exemplary network architecture for initiating continuous user identity authentication based on network security situation awareness by a multi-access edge computing functional network element or a user plane functional network element in an embodiment of the present application;

[0058] Fig.13 It is an exemplary schematic block diagram of a business system access control device based on zero trust in an embodiment of the present application;

[0059] Fig.14 It is a schematic diagram of the structure of the computer device in the embodiment of the present application. DETAILED DESCRIPTION

[0060] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0061] Unless the mutually exclusive relationship between the embodiments to be disclosed in this application is explicitly stated, the relevant technical features involved in each embodiment can be cross-combined to flexibly construct a new embodiment, as long as such combination does not deviate from the creative spirit of this application and can meet the needs of the prior art or solve certain deficiencies in the prior art. Those skilled in the art should be aware of this flexibility.

[0062] The authentication and authorization of user terminals accessing the network in the 5G standard process mainly includes three parts, namely, the primary authentication of 5G terminals to access the 5G core network, the secondary authentication of 5G terminals, and the re-authentication of 5G terminal user authentication when accessing services (the standard defaults to only one re-authentication). For details, please refer to the 3GPP TS33.501 standard document, which together provide 5G terminal access network access and access control capabilities. Among them, the primary authentication ensures that only legitimate terminals can access the 5G core network, the secondary authentication ensures that only legitimate users using the terminal can access the service network, and the re-authentication ensures that only legitimate users using the terminal can continue to interact with services, preventing illegal users from using the terminal for service interaction.

[0063] See also Figure 1 Among them, UE (User Equ ipment) is a 5G terminal, gNB is a 5G base station, and the 5G core network functional network elements include access and mobility management function (Access and Mobility Management Function, AMF) network element, session management function (Session Management Function, SMF) network element, user plane function (User Plane Function, UPF) network element, AAA (Authentication / Authorization / Accounting) server, authentication server function (Authentication Server Function, AUSF) network element, multi-access edge computing (Multi-Access Edge Computing, MEC) functional network element, etc.

[0064] The re-certification process of the 5G standard includes:

[0065] Step 11: UE and 5G network complete the main authentication process;

[0066] Step 12: UE (User EQ ipmen) completes the secondary authentication process with the AAA (Authentication / Authorization / Accounting) server and establishes business interaction with the background business system;

[0067] Step 13: The session management function (SMF) network element determines to initiate a secondary re-authentication;

[0068] Step 13a: The AAA server determines to initiate a secondary re-authentication;

[0069] Step 13b, the AAA server forwards the secondary re-authentication request to the session management function (SMF) network element through the user plane function (UPF) network element, and the secondary re-authentication request includes the user's GPS I and IP / MAC address;

[0070] Since the session management function (SMF) network element or the AAA server can initiate secondary re-authentication, it is divided into step 3 and step 3a. If the re-authentication is initiated by the session management function (SMF) network element, step 3a and step 3b are skipped; if the re-authentication is initiated by the AAA server, step 3a and step 3b should replace step 3.

[0071] Step 14: The session management function (SMF) network element sends an EAP identity request (Request / Identity) message to the UE;

[0072] Step 15: UE responds to EAP Fast-Reauth Identity.

[0073] Step 16: The AAA server and the UE transmit necessary authentication information (user password) through EAP request / response messages;

[0074] Step 17: The AAA server sends a re-authentication success result to the session management function (SMF) network element and the user terminal (UE) via an EAP success message.

[0075] In some embodiments, the "Research on Security Protection Technology for 5G Empowering Intelligent Manufacturing" in the 4th issue of "Communication Technology" in 2024 mentioned that three-layer authentication is based on 5G primary authentication to access the 5G core network, 5G secondary authentication to access the enterprise intranet, and multi-user identity authentication in scenarios where multiple people share 5G terminals to access specific services. Among them, both 5G primary authentication and secondary authentication use the 5G standard primary authentication and secondary authentication processes; in terms of networking methods, 5G networks include three private networking modes: independent networking, hybrid networking, and virtual private networking. The differences between the three networking methods are mainly different from the degree of sharing between wireless networks and core networks. This technical research mainly adds the scenario of multiple people sharing 5G terminals in the enterprise private networking mode under independent networking, and after the identity authentication system is deployed, the user using the terminal must be authenticated before he can be allowed to access specific services.

[0076] After the 5G terminal is authenticated and authorized to enter the network, in the scenario where multiple people share the 5G terminal, an identity authentication system still needs to be deployed to authenticate the user using the terminal before allowing them to access specific services.

[0077] See also Figure 2 , 5G terminal user authentication access service, the specific operation process includes:

[0078] Step 21: The user clicks on the identity authentication app to initiate the authentication process;

[0079] Step 22: The identity authentication App initiates certificate authentication to the identity authentication system. The identity authentication system verifies the legitimacy of the identity and returns an identity token.

[0080] Step 23: The user clicks on the application App, initiates the single sign-on process through the application App, and requests the identity authentication App to obtain the code corresponding to the application. The identity authentication App carries the obtained token information and requests the code from the identity authentication system;

[0081] Step 24: After the identity authentication system verifies the legitimacy of the token, it generates a code and returns it to the identity authentication App. The identity authentication App returns the code to the application App for single sign-on, and the application App passes the code to the application system.

[0082] Steps 25 to 26: The application system carries the code to request access to the ticket information from the identity authentication system, which verifies the legitimacy of the ticket and returns the user information;

[0083] Step 27. Apply single sign-on successfully and access the backend business system.

[0084] Based on the above exemplary scenarios, please refer to Figure 3 In one embodiment, the zero-trust-based business system access control method of the present application includes:

[0085] Step S10: When the network side detects that a user terminal that has passed the network access authentication and the service system access authentication continues to access the target service system, the preset zero-trust security model is called, and the session management function network element or the AAA server in the network core network function network element is triggered according to the preset access control policy to send a user re-authentication request to the user terminal, so that the user terminal returns the current user information to the AAA server, wherein the user terminal includes one or more target users;

[0086] Specifically, a user terminal refers to an industrial terminal device used by a target user that requires zero-trust authentication. The target user can access the protected target business system through the user terminal. The target business system includes protected internal production resources, where internal production resources usually refer to business resources that are controlled by an enterprise or factory and have ownership and use rights. Usually, only internal personnel of the enterprise are allowed to access them. For example, internal factory resources are only allowed to be used by managers and production personnel of the factory. With the introduction of the concept of zero-trust security, internal resources that originally had to be accessed on the enterprise intranet can now be accessed by internal personnel of the enterprise from any location. Therefore, user terminals are no longer running in a relatively secure enterprise intranet environment, but may run in any environment, such as home, cafe, hotel, etc. In these environments, the loss of user terminals leads to the impersonation of user identities, and the target users are potentially exposed to phishing attacks, watering hole attacks and other security threats that increase greatly. Therefore, when the target user initiates a service access request through the user terminal, the network side detects that the user terminal that has passed the 5G access authentication and service system access authentication continues to access the target service system. The preset zero-trust security model is called to trigger the session management function element or AAA server in the network core network function element to send a user re-authentication request, that is, identity authentication, to the user terminal according to the preset access control policy.

[0087] In some embodiments, the network includes a 5G network, a 6G network, and a future network, etc., and the network core network functional network element includes a 5G core network functional network element, a 6G core network functional network element, etc. This application takes the 5G network as an example and does not limit this application. The 5G core network functional network element includes an access and mobility management functional network element, a session management functional network element, a user plane functional network element, a multi-access edge computing functional network element, and an AAA server; the access control strategy includes periodic continuous re-authentication, event-based continuous re-authentication, and periodic and event-based continuous re-authentication, wherein the periodic continuous re-authentication includes a time-based periodic user identity continuous authentication, the event-based continuous re-authentication includes but is not limited to a user identity continuous authentication based on the terminal location and a user identity continuous authentication based on network security situation awareness, and the periodic and event-based continuous re-authentication includes but is not limited to a user identity continuous authentication based on the terminal location and time; the user identity information includes but is not limited to a user account, a user password, a token or a certificate; the biometric information includes but is not limited to a user fingerprint feature, a user face feature, or a user iris feature; the user re-authentication request includes but is not limited to an EAP request.

[0088] The main feature of zero trust is "never trust, continuous authentication", that is, trust is relative trust, which is only valid for a short period of time and needs to be continuously authenticated to ensure user identity security and network security. The zero trust model fundamentally subverts the traditional concept of network security. It no longer trusts the internal network, but regards each user and device as a potential security threat. It assumes that there may be attackers both inside and outside the network, and regards each user and device as a potential security threat. All access requests must pass strict identity authentication and access control to protect network resources, and perform continuous verification and authorization to ensure network security.

[0089] As mentioned above, the target user has accessed the 5G core network through the primary authentication and can access the backend business system through the secondary authentication. In order to ensure the security of access to the backend business system and the legitimacy of the user's identity, it is necessary to use zero-trust technology to continuously verify the user's identity and use the 5G re-authentication process to achieve continuous verification of the user's identity accessing the backend business system, thereby ensuring the security of the backend business system to the greatest extent.

[0090] When continuously verifying the user's identity, it is necessary to perform corresponding identity authentication based on the preset access control policy, wherein the access control policy includes periodic continuous re-authentication or event-based continuous re-authentication, wherein the periodic continuous re-authentication duration is a periodic time that meets security requirements. You can choose to configure a timer module in the session management function (SMF) network element or AAA server, that is, configure the timer parameters for service re-authentication in the session management function (SMF) network element or AAA server. When the user accesses the service system, the session management function (SMF) network element or AAA server starts the timer. When the timer expires, the re-authentication process is started, and the timer is reset for the next re-authentication process, and this cycle continues until the timer is released when the access to the background service system is terminated.

[0091] Event-based continuous re-authentication trigger conditions include but are not limited to re-authentication based on user terminal location, re-authentication based on network security situation awareness, etc., where, for re-authentication based on terminal location, the location can be the wireless location of the terminal, such as a cell, base station or tracking area, etc. Since the wireless network knows the cell, base station or tracking area where the user terminal is located, the 5G base station or access and mobility management function (AMF) network element needs to cooperate to inform the session management function (SMF) network element of the changed location of the user terminal, so as to trigger the session management function (SMF) network element to initiate a re-authentication process for the user terminal.

[0092] Furthermore, in the continuous re-authentication based on the user terminal location, security can also be improved by combining with time, that is, the first re-authentication is triggered when the user terminal enters the set wireless location. If the user terminal has been in the wireless location, the timer is started and the periodic continuous re-authentication process begins.

[0093] In the re-authentication based on network security situation awareness, the network security situation also includes user access anomalies, that is, for users in the process of business, the network elements that continuously monitor user access anomalies and network security situation include but are not limited to: user plane function (UPF) network elements or multi-access edge computing (MEC) function network elements. User plane function (UPF) network elements or multi-access edge computing (MEC) function network elements can use risk assessment of continuous analysis of user behavior technology, or use artificial intelligence technology based on machine learning for continuous risk assessment, so as to assess the risk level of users and networks in real time, trigger the continuous re-authentication process in a timely manner, and dynamically adjust the user's access control policy and permissions to cope with the ever-changing threats and environment to prevent unauthorized access. User plane function (UPF) network elements or multi-access edge computing (MEC) function network elements need to have built-in ability to perceive network security situation, and be able to diagnose abnormal user access and report it to session management function (SMF) network elements in real time to trigger the user identity re-authentication process.

[0094] In the user re-authentication process, the user identity information of multi-factor authentication and the latest acquired biometric features such as user fingerprint features, facial features or iris features are used to ensure the authenticity of the user identity who continues to access the business system. In this application, the target user has saved his or her own biometric data in the AAA server. Therefore, a biometric acquisition module is configured in the user terminal to extract the fingerprint features, facial features or iris features of the target user, and interact with the re-authentication process through an interface to provide the re-authentication process with the latest acquired biometric features to prevent the user terminal and identity from being stolen.

[0095] In some embodiments, the access control strategy includes but is not limited to: periodic user identity continuous authentication based on time, user identity continuous authentication based on terminal location, user identity continuous authentication based on terminal location and time, and user identity continuous authentication based on network security situation awareness; the user identity information includes but is not limited to user account, user password, token, authentication credential or certificate; the biometric information includes but is not limited to user fingerprint features, user facial features or user iris features.

[0096] In some embodiments, see Figure 4The user terminal includes a biometric collection module and a terminal re-authentication module, wherein the biometric collection module is used to collect the user's biometric information; the terminal re-authentication module is used to respond to the re-authentication request of the AAA server or the session management function (SMF) network element, and interact with the biometric collection module to obtain biometric information for re-authentication; specifically, the terminal re-authentication module has the function of supporting continuous re-authentication of the AAA server, and it has no authentication function, and only has the function of cooperating with the AAA server to complete re-authentication.

[0097] See also Figure 5 The AAA server includes a first re-authentication timer module, an AAA re-authentication module, a biometric storage module and a first security authentication log module, wherein the first re-authentication timer module is used to continuously detect whether the target user's system access time interval reaches a preset time interval to initiate time-based re-authentication; the AAA re-authentication module is used to verify the user's identity and biometrics; the biometric storage module is used to store the user's biometric information; the first security authentication log module is used to record each user's security authentication log information.

[0098] See also Figure 6 The session management function (SMF) network element includes a security policy module, a re-authentication location module, a second re-authentication timer module and a second security authentication log module; the security policy module is used to initiate re-authentication based on the security authentication of the network security situation, time and / or location; the re-authentication location module is used to detect whether the wireless location of the user terminal has changed to initiate location-based re-authentication; the second re-authentication timer module is used to continuously detect whether the system access time interval of the target user reaches a preset time interval to initiate time-based re-authentication; the second security authentication log module is used to record the security authentication log information of each user.

[0099] See also Figure 7 The user plane function (UPF) network element or the multi-access edge computing (MEC) function network element includes a security situation awareness module and a security situation notification module, wherein the security situation awareness module is used to perceive and detect the network security situation to determine the network situation detection result, wherein the network security situation includes abnormal user behavior, and the security situation notification module is used to notify the session management function (SMF) network element of the network situation detection result for re-authentication.

[0100] Step S20: When the AAA server verifies that the current user identity information is consistent with the user identity information corresponding to the target user, the identity authentication is successful.

[0101] According to the preset access control policy, the session management function network element or AAA server in the network core network function network element is triggered to send a user re-authentication request to the user terminal, so that the user terminal returns the current user information to the AAA server. After that, the AAA server verifies that the current user identity information is consistent with the user identity information corresponding to the target user, so as to determine the success result of the identity authentication and the current user identity information.

[0102] Step S30: Based on the identity authentication success result and the current user identity information, the AAA server initiates a biometric authentication request to the user terminal, so that the AAA server detects whether the latest biometric information of the target user returned by the user terminal matches the pre-stored biometric information of the target user. If they match, the AAA server returns a biometric authentication success result to the user terminal to authorize the target user to continue to access the target service system.

[0103] When the AAA server verifies that the current user identity information is consistent with the user identity information corresponding to the target user, to determine a successful authentication result, the AAA server initiates a multi-factor authentication biometric authentication request to the user terminal based on the successful authentication result and the current user identity information, so that the AAA server detects whether the latest biometric information of the target user returned by the user terminal matches the pre-stored biometric information of the target user. If they match, the AAA server returns a successful biometric authentication result to the user terminal to authorize the target user to continue to access the target business system.

[0104] Specifically, based on the identity authentication success result and the current user identity information, the AAA server initiates a biometric authentication request to the user terminal, so that the AAA server detects whether the latest biometric information of the target user returned by the user terminal matches the pre-stored biometric information of the target user, and if they match, returns a biometric authentication success result to the user terminal to authorize the target user to continue to access the target business system, including:

[0105] Step S301: Based on the successful identity authentication result and the current user identity information, the AAA server initiates a biometric authentication request to the user terminal;

[0106] Step S302: the terminal re-authentication module in the user terminal calls the biometric feature collection module to collect the latest biometric feature information of the target user, and the AAA re-authentication module in the AAA server calls the pre-stored biometric feature information of the target user in the biometric feature storage module;

[0107] Step S303: The AAA server detects whether the latest biometric information of the target user returned by the user terminal matches the pre-stored biometric information of the target user. If so, the AAA server returns a biometric authentication success result to the user terminal to authorize the target user to continue accessing the target business system.

[0108] More specifically, based on the successful result of identity authentication and the current user identity information, the AAA server initiates a biometric-based authentication request, that is, requests the biometric information of the target user, wherein the biometric information may be a user fingerprint feature, a user face feature, or a user iris feature, etc., and is determined by the Vendor-Type in the extended type; wherein the Vendor-Type may be set according to the provided biometric feature, for example, the fingerprint feature is set to 261, the face feature is set to 262, the iris feature is set to 263, etc., the terminal re-authentication module in the user terminal collects the corresponding biometric information by calling the biometric collection module, and sends the corresponding biometric information to the AAA server for verification through the extended data packet format of the EAP response message; the AAA server calls the pre-stored biometric information of the target user in the biometric storage module through the re-authentication module, and compares it with the latest user biometric of the target user. If a match is found, the biometric authentication success result is returned, and a biometric authentication success message is sent to the user terminal, and the user terminal can continue to access the background service system; if a match is found, a failure message is returned to the user terminal, and the session management function (SMF) network element is notified to initiate a 5G standard PDN session release process.

[0109] In some embodiments, the camera in the user terminal can directly collect the user facial features or user iris features of the target user to push the latest biometric information such as the user facial features or user iris features of the target user to the AAA server for biometric authentication. The AAA server calls the pre-stored biometric information of the target user in the biometric storage module through the re-authentication module, and compares it with the latest user biometric features of the target user. If they match, the biometric authentication success result is returned, and a biometric authentication success message is sent to the user terminal, and the user terminal can continue to access the background business system; if they do not match, a failure message is returned to the user terminal, and the session management function (SMF) network element is notified to initiate a 5G standard PDN session release process to enable the target user to end access to the target business system.

[0110] Step S40: cyclically execute the above steps based on the access control policy until the target user completes access to the target business system, so as to complete access control of the business system based on zero trust.

[0111] In order to prevent the loss of user terminals leading to user identity impersonation and potential security threats such as phishing attacks and watering hole attacks on target users, when a user terminal that has passed 5G access authentication and business system access authentication continues to access the target business system, access control strategies such as time-based periodic user identity continuous authentication, terminal location-based user identity continuous authentication, network security situation awareness-based user identity continuous authentication, and terminal location and time-based user identity continuous authentication will cyclically execute the above steps until the target user's access to the target business system ends, thereby completing access control of the zero-trust business system.

[0112] On the basis of any of the above embodiments, calling a preset zero-trust security model, triggering a session management function network element or an AAA server in a network core network function network element to send a user re-authentication request to a user terminal according to a preset access control policy, so that the user terminal returns current user information to the AAA server, comprising:

[0113] Step S101: the session management function network element or the AAA server initiates the time-based periodic user identity continuous authentication, and the timer module in the session management function network element or the AAA server continuously detects whether the system access time interval of the target user reaches a preset time interval;

[0114] Step S102: If the target user's system access duration interval reaches a preset time interval, the session management function network element or the AAA server sends an EAP request to the user terminal, so that the user terminal returns the current user identity information to the AAA server.

[0115] Specifically, see Figure 8 , the session management function (SMF) network element initiates time-based periodic user identity continuous authentication, and its specific process includes:

[0116] Step 31, when the 5G target user continuously accesses the background service system, the second re-authentication timer module built into the session management function (SMF) network element reaches the set second re-authentication timer module, that is, the target user's system access time interval to the background service system reaches a preset time interval, and the re-authentication process of the target user is started;

[0117] Step 32: The session management function (SMF) network element sends an EAP request to the user terminal (UE) to request a user identity, so that the user terminal returns current user identity information;

[0118] Step 33: The terminal re-authentication module in the user terminal responds with a fast re-authentication identity (current user identity information) to the AAA server, and the AAA server verifies that the current user identity information is consistent with the user identity information corresponding to the target user, so as to determine a successful identity authentication result;

[0119] Step 34: Based on the successful authentication result and the current user identity information, the AAA server initiates a biometric authentication request, i.e., requests the biometric information of the target user, wherein the biometric information may be a user fingerprint feature, a user face feature, or a user iris feature, etc., and is determined by the Vendor-Type in the extended type;

[0120] Step 35: The terminal re-authentication module in the user terminal collects the corresponding biometric information by calling the biometric collection module, and sends the corresponding biometric information to the AAA server for verification in the extended data packet format of the EAP response message;

[0121] In some embodiments, the terminal re-authentication module in the user terminal collects the corresponding biometric information by calling the biometric collection module, and sends the corresponding biometric information and current user information such as user account, user password, token or certificate to the AAA server for verification through the extended data packet format of the EAP response message to perform multi-factor identity authentication.

[0122] Step 36: The AAA re-authentication module in the AAA server calls the pre-stored biometric information of the target user in the biometric storage module and compares it with the latest user biometric information of the target user. If they are the same, the identity authentication is passed, and a biometric authentication success message is sent to the terminal, and the user terminal can continue to access the background service system; if they are not the same, a failure message is returned to the user terminal, and the session management function (SMF) network element is notified to initiate a 5G standard PDN session release process;

[0123] Step 37: The AAA server continuously initiates periodic re-authentication when the timing is reached according to the built-in timer parameters, and repeats steps 32 to 36.

[0124] In some embodiments, see Fig. 9 , the AAA server initiates time-based periodic user identity authentication, the specific process includes:

[0125] Step 41: When the 5G target user continues to access the backend service system, the first re-authentication timer module built into the AAA server starts the user re-authentication process when the set re-authentication timer expires;

[0126] Step 42: The AAA server sends an EAP request to the user terminal (UE) to request the current user identity information, so that the user terminal returns the current user identity information;

[0127] Step 43: The terminal re-authentication module in the user terminal responds with a fast re-authentication identity (current user identity information) to the AAA server, and the AAA server verifies that the current user identity information is consistent with the user identity information corresponding to the target user, so as to determine a successful identity authentication result;

[0128] Step 44: Based on the successful authentication result and the current user identity information, the AAA server initiates a biometric authentication request, i.e., requests the biometric information of the target user, wherein the biometric information may be a user fingerprint feature, a user face feature, or a user iris feature, etc., and is determined by the Vendor-Type in the extended type;

[0129] Step 45: The terminal re-authentication module in the user terminal collects the corresponding biometric information by calling the biometric collection module, and sends the corresponding biometric information to the AAA server for verification in the extended data packet format of the EAP response message;

[0130] Step 46: The AAA re-authentication module in the AAA server calls the pre-stored biometric information of the target user in the biometric storage module and compares it with the latest user biometric information of the target user. If they are the same, the identity authentication is passed, and a biometric authentication success message is sent to the terminal, and the user terminal can continue to access the background service system; if they are not the same, a failure message is returned to the user terminal, and the session management function (SMF) network element is notified to initiate a 5G standard PDN session release process;

[0131] Step 47: The AAA server initiates periodic re-authentication based on the built-in timer parameters when the timer expires, and repeats steps 42 to 46.

[0132] On the basis of any of the above embodiments, calling a preset zero-trust security model, triggering a session management function network element or an AAA server in a network core network function network element to send a user re-authentication request to a user terminal according to a preset access control policy, so that the user terminal returns current user information to the AAA server, comprising:

[0133] Step S1001: The session management function network element initiates a user identity continuous authentication based on the terminal location, and the session management function network element obtains the wireless location accessed by the target user uploaded by the access and mobility management function network element, and the wireless location includes a cell, a base station or a tracking area;

[0134] Step S1002: When the session management function network element detects that the target user enters a re-authentication location area that requires the target user to re-authenticate, the session management function network element sends an EAP request to the user terminal so that the user terminal returns the current user identity information to the AAA server.

[0135] Specifically, see Fig.10 The session management function network element initiates continuous user identity authentication based on the terminal location, and the specific process includes:

[0136] Step 50: If the location re-authentication is based on the cell, the 5G base station (gNB) needs to report to the access and mobility management function (AMF) network element;

[0137] Step 51, the access and mobility management function (AMF) network element can report the location information to the session management function (SMF) network element, that is, when the cell or base station or tracking area (TA) accessed by the user changes, it needs to be reported to the session management function (SMF) network element;

[0138] Step 52: When the target user continues to access the backend service system, the re-authentication location module built into the session management function (SMF) network element detects that the target user enters a location area that requires re-authentication, and then starts the user re-authentication process;

[0139] Step 53: The session management function (SMF) network element sends an EAP request to the user terminal (UE) to request the current user identity information. The subsequent message flow is the same as steps 32 to 36 in the above embodiment, which will not be described in detail here.

[0140] Step 54: The re-authentication location module built into the session management function (SMF) network element continuously monitors the location of the user terminal and detects whether it enters a new re-authentication location area, so as to continue to trigger the re-authentication process.

[0141] On the basis of any of the above embodiments, after the step of the session management function network element detecting that the target user enters a re-authentication location area requiring the target user to re-authenticate, the step includes:

[0142] Step S10021, the session management function network element initiates a continuous user identity authentication based on the terminal location and time, and the timer module in the session management function network element continuously detects whether the system access time interval when the target user enters the re-authentication location area reaches a preset time interval;

[0143] Step S10022: If reached, continue to execute the steps after the session management function network element sends an EAP request to the user terminal so that the user terminal returns the current user identity information to the AAA server.

[0144] Specifically, see Fig.11 The session management function network element initiates continuous user identity authentication based on terminal location and time, and the specific process includes:

[0145] Step 60: If the location re-authentication is based on the cell, the 5G base station (gNB) is required to report the access and mobility management function (AMF) network element;

[0146] Step 61, the access and mobility management function (AMF) network element is configured to report location information to the session management function (SMF) network element, that is, when the cell or base station or tracking area (TA) accessed by the user changes, it needs to be reported to the session management function (SMF) network element;

[0147] Step 62: When the target user continues to access the backend service system, the re-authentication location module built into the session management function (SMF) network element detects that the target user enters a location area that requires re-authentication, and then starts the re-authentication process for the target user;

[0148] Step 63, the session management function (SMF) network element requests the user terminal (UE) for identity through an EAP request message, and the subsequent message flow is the same as the re-authentication process from step 32 to step 36 in the above embodiment;

[0149] Step 64: When the user is in a location area where the re-authentication process has been started for a long time, in order to enhance user security, as mentioned above, the session management function (SMF) network element is also configured with a second re-authentication timer module. Therefore, when the user enters the location-based re-authentication process, the second re-authentication timer module is started. Once the second re-authentication timer module reaches a preset time interval, the session management function (SMF) network element triggers the re-authentication process.

[0150] Step 65, the subsequent process is to continuously repeat the re-authentication process of steps 32 to 36 in the above embodiment; in addition, when the user enters a new re-authentication location area, the re-authentication process of steps 51 to 54 in the above embodiment is continuously triggered.

[0151] On the basis of any of the above embodiments, calling a preset zero-trust security model, triggering a session management function network element or an AAA server in a network core network function network element to send a user re-authentication request to a user terminal according to a preset access control policy, so that the user terminal returns current user information to the AAA server, comprising:

[0152] Step S100, the session management function network element initiates continuous user identity authentication based on network security situation awareness, and uses the multi-access edge computing function network element or the user plane function network element to continuously perceive the network security situation of the user terminal according to a preset security situation awareness strategy, wherein the network security situation includes abnormal user behavior, and the abnormal user behavior includes abnormal login address or time, abnormal data transmission characteristics, and access to restricted areas, and the security situation awareness strategy includes a machine learning model or user behavior analysis;

[0153] Step S200: The session management function network element sends an EAP request to the user terminal according to the network security situation, so that the user terminal returns the current user identity information to the AAA server.

[0154] In some embodiments, see Fig.12 , the multi-access edge computing (MEC) functional network element continuously authenticates the user identity based on abnormal user behavior or network security situation awareness. The specific process includes:

[0155] Step 71: When a multi-access edge computing (MEC) functional network element has a built-in security situation awareness module, the multi-access edge computing (MEC) functional network element continuously senses the network security situation, and can use a machine learning model or user behavior analysis technology, wherein the network security situation includes abnormal user behavior, and the abnormal user behavior includes an abnormal login address or time, abnormal data transmission characteristics, and access to restricted areas;

[0156] Step 72: If the multi-access edge computing (MEC) functional network element continuously senses the network security situation, the multi-access edge computing (MEC) functional network element notifies the session management function (SMF) network element in real time to inform the network security situation;

[0157] Step 73, the security policy module of the session management function (SMF) network element presets the access control policy and network security situation, and starts the user re-authentication process in a timely manner;

[0158] Step 74: adopt the re-authentication process of steps 32 to 36 in the above embodiment; and continue the re-authentication process of steps 71 to 73 in this embodiment.

[0159] In some embodiments, the user plane function (UPF) network element continuously authenticates the user identity based on network security situation awareness, and the specific process includes:

[0160] Step 71a: When the user plane function (UPF) network element has a built-in security situation awareness module, the user plane function (UPF) network element continuously senses the network security situation, and can use machine learning models or user behavior analysis and other technologies, wherein the network security situation includes abnormal user behavior, and the abnormal user behavior includes abnormal login location or time, abnormal data transmission volume or frequency, and access to restricted areas;

[0161] Step 72a: If the user plane function (UPF) network element continuously senses the network security situation, the user plane function (UPF) network element notifies the session management function (SMF) network element in real time to inform the network security situation;

[0162] Step 73a, the security policy module of the session management function (SMF) network element starts the user re-authentication process in a timely manner according to the preset access control policy and network security situation;

[0163] Step 74a, adopt the re-authentication process of steps 32 to 36 in the above embodiment, and continue the process of steps 71a to 73a in this embodiment.

[0164] In the above embodiment, both the SMF and the AAA server will start the security authentication log module to record the re-authentication log records so that the security problem can be accurately traced when a security incident occurs.

[0165] It can be seen from the above embodiments that, compared with the prior art, the present application aims at the many security issues faced by 5G technology in the prior art in the intelligent manufacturing industry, such as business data being stolen, legal equipment being illegally controlled, and legal identity being impersonated, which may easily cause unpredictable consequences at a specific moment. The present application includes but is not limited to the following beneficial effects:

[0166] This application adopts the 5G re-authentication process and zero-trust security model to achieve continuous verification of the identity of users accessing the background business system and ensure the security of the background business system. When continuously verifying the identity of the user, corresponding identity authentication is required based on the access control policy. The access control policy includes that the re-authentication process can be triggered periodically or event-based, where the periodic re-authentication duration is the cycle time that meets the security requirements. Event-based re-authentication trigger conditions include re-authentication based on user terminal location, re-authentication based on network security situation awareness, etc. For re-authentication based on terminal location, the location can be the wireless environment area where the terminal is located, such as a cell, base station or tracking area. Since the wireless network knows the cell, base station or tracking area where the terminal is located, the 5G base station / access and mobility management function (AMF) network element needs to notify the session management function (SMF) network element of the location of the terminal, so as to trigger the session management function (SMF) network element to initiate a re-authentication process based on the location area; in re-authentication based on network security situation awareness, the network security situation also includes user access anomalies, that is, when the user is performing business, the user plane function (UPF) network element or the multi-access edge computing (MEC) function network element continuously monitors user access anomalies and network security situation, and adopts continuous intelligent risk assessment, such as based on machine learning and behavior analysis technology, to report to the SMF in real time to assess the risk level of users and networks, and dynamically adjust the user's access control policy and permissions to cope with the ever-changing threats and environment to prevent unauthorized access.

[0167] When users re-authenticate, biometric identity authentication is used, that is, the latest user biometrics such as fingerprints, facial features, or iris features are used to ensure the authenticity of the user's identity accessing the business system. In order to accurately trace the source when a security incident occurs, the system also records the security authentication log information of each user.

[0168] Furthermore, the present application can run in any environment, such as home, cafe, hotel, etc., instead of a relatively secure enterprise intranet environment on the user terminal. This can avoid security threats such as user identity impersonation due to user terminal loss, phishing attacks and watering hole attacks that target users may suffer, and avoid many security issues such as theft of business data of 5G technology in the smart manufacturing industry, illegal control of legitimate equipment, and impersonation of legitimate identities.

[0169] In some embodiments, see Fig.13, a business system access control device based on zero trust is provided to meet one of the purposes of the present application, including a re-authentication trigger module 1100, a user identity authentication module 1200, a biometric authentication module 1300 and an access control module 1400. Among them, the re-authentication trigger module 1100 is configured to call a preset zero-trust security model when the network side detects that a user terminal that has passed the network access authentication and the business system access authentication continues to access the target business system, and triggers the session management function network element or the AAA server in the network core network function network element according to the preset access control policy to send a user re-authentication request to the user terminal, so that the user terminal returns the current user information to the AAA server, wherein the user terminal contains one or more target users; the user identity authentication module 1200 is configured to determine the success result of the identity authentication when the AAA server verifies that the current user identity information is consistent with the user identity information corresponding to the target user; the biometric authentication module 1300 is configured to detect that the user terminal has passed the network access authentication and the business system access authentication and continues to access the target business system. The authentication module 1300 is configured so that, based on the successful identity authentication result and the current user identity information, the AAA server initiates a biometric authentication request to the user terminal, so that the AAA server detects whether the latest biometric information of the target user returned by the user terminal matches the pre-stored biometric information of the target user. If they match, the biometric authentication success result is returned to the user terminal to authorize the target user to continue to access the target business system; the access control module 1400 is configured to loop the above steps based on the access control policy until the target user's access to the target business system is completed, so as to complete the access control of the business system based on zero trust.

[0170] In some embodiments, based on any embodiment of the present application, please refer to Fig.14 Another embodiment of the present application further provides an electronic device, which can be implemented by a computer device, such as Fig.14 As shown, a schematic diagram of the internal structure of a computer device. The computer device includes a processor, a computer-readable storage medium, a memory, and a network interface connected via a system bus. Among them, the computer-readable storage medium of the computer device stores an operating system, a database, and computer-readable instructions. The database may store a control information sequence. When the computer-readable instructions are executed by the processor, the processor can implement a business system access control method based on zero trust. The processor of the computer device is used to provide computing and control capabilities to support the operation of the entire computer device. The memory of the computer device may store computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor can execute the business system access control method based on zero trust of the present application. The network interface of the computer device is used to connect and communicate with a terminal. Those skilled in the art will understand that Fig.14The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0171] In some embodiments, the processor in this embodiment is used to execute Fig.13 The memory stores the program code and various data required to execute the above modules. The network interface is used to transmit data between user terminals or servers. The memory in this embodiment stores the program code and data required to execute all modules in the zero-trust-based business system access control device of this application, and the server can call the program code and data of the server to execute the functions of all sub-modules.

[0172] In some embodiments, the present application also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the zero-trust-based business system access control method described in any embodiment of the present application.

[0173] In some embodiments, the present application also provides a computer program product, including a computer program / instruction, which, when executed by one or more processors, implements the steps of the zero-trust-based business system access control method described in any embodiment of the present application.

[0174] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments of the present application can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a computer-readable storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0175] The above description is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

[0176] To sum up, the present application can run in any environment, such as home, cafe, hotel, etc., instead of a relatively secure enterprise intranet environment on the user terminal. It can avoid security threats such as user identity impersonation due to user terminal loss, phishing attacks and watering hole attacks that target users may suffer, and avoid many security issues such as the theft of business data of 5G technology in the smart manufacturing industry, illegal control of legitimate equipment, and impersonation of legitimate identities.

Claims

1. A business system access control method based on zero trust, characterized in that: include: When the network side detects that a user terminal that has passed the network access authentication and the service system access authentication continues to access the target service system, the preset zero-trust security model is called, and according to the preset access control policy, the session management function network element or the AAA server in the network core network function network element is triggered to send a user re-authentication request to the user terminal, so that the user terminal returns the current user information to the AAA server, wherein the user terminal includes one or more target users; When the AAA server verifies that the current user identity information is consistent with the user identity information corresponding to the target user, the identity authentication is successful. Based on the identity authentication success result and the current user identity information, the AAA server initiates a biometric authentication request to the user terminal, so that the AAA server detects whether the latest biometric information of the target user returned by the user terminal matches the pre-stored biometric information of the target user, and if so, returns a biometric authentication success result to the user terminal to authorize the target user to continue to access the target service system; The above steps are executed cyclically based on the access control policy until the target user ends access to the target business system, so as to complete the access control of the business system based on zero trust.

2. The zero-trust-based business system access control method according to claim 1, characterized in that: The network core network function network element includes a 5G core network function network element and a 6G core network function network element, wherein the 5G core network function network element includes an access and mobility management function network element, a session management function network element, a user plane function network element, a multi-access edge computing function network element and an AAA server; The access control strategy includes periodic continuous re-authentication, event-based continuous re-authentication, and periodic and event-based continuous re-authentication, wherein the periodic continuous re-authentication includes periodic user identity continuous authentication based on time, the event-based continuous re-authentication includes user identity continuous authentication based on terminal location and user identity continuous authentication based on network security situation awareness, and the periodic and event-based continuous re-authentication includes user identity continuous authentication based on terminal location and time; The user identity information includes user account, user password, token or certificate; The biometric information includes user fingerprint features, user facial features or user iris features; The user re-authentication request includes an EAP request.

3. The zero-trust-based business system access control method according to claim 2 is characterized in that: The step of calling a preset zero-trust security model and triggering a session management function network element or an AAA server in a network core network function network element to send a user re-authentication request to a user terminal according to a preset access control policy, so that the user terminal returns current user information to the AAA server includes: The session management function network element or the AAA server initiates the time-based periodic user identity continuous authentication, and the timer module in the session management function network element or the AAA server continuously detects whether the system access time interval of the target user reaches a preset time interval; If the target user's system access duration interval reaches a preset time interval, the session management function network element or the AAA server sends an EAP request to the user terminal, so that the user terminal returns the current user identity information to the AAA server.

4. The zero-trust-based business system access control method according to claim 2 is characterized in that: The step of calling a preset zero-trust security model and triggering a session management function network element or an AAA server in a network core network function network element to send a user re-authentication request to a user terminal according to a preset access control policy, so that the user terminal returns current user information to the AAA server includes: The session management function network element initiates a continuous user identity authentication based on the terminal location, and the session management function network element obtains the wireless location accessed by the target user uploaded by the access and mobility management function network element, and the wireless location includes a cell, a base station or a tracking area; When the session management function network element detects that the target user enters a re-authentication location area that requires the target user to re-authenticate, the session management function network element sends an EAP request to the user terminal, so that the user terminal returns current user identity information to the AAA server.

5. The zero-trust-based business system access control method according to claim 4 is characterized in that: After the step of the session management function network element detecting that the target user enters a re-authentication location area requiring the target user to re-authenticate, the step includes: The session management function network element initiates a continuous user identity authentication based on the terminal location and time, and the timer module in the session management function network element continuously detects whether the system access time interval when the target user enters the re-authentication location area reaches a preset time interval; If so, the session management function network element continues to execute the steps after sending an EAP request to the user terminal so that the user terminal returns the current user identity information to the AAA server.

6. The zero-trust-based business system access control method according to claim 2, characterized in that: The step of calling a preset zero-trust security model and triggering a session management function network element or an AAA server in a network core network function network element to send a user re-authentication request to a user terminal according to a preset access control policy, so that the user terminal returns current user information to the AAA server includes: The session management function network element initiates continuous user identity authentication based on network security situation awareness, and uses the multi-access edge computing function network element or the user plane function network element to continuously perceive the network security situation of the user terminal according to a preset security situation awareness strategy, wherein the network security situation includes abnormal user behavior, and the abnormal user behavior includes abnormal login address or time, abnormal data transmission characteristics, and access to restricted areas, and the security situation awareness strategy includes a machine learning model or user behavior analysis; The session management function network element sends an EAP request to the user terminal according to the network security situation, so that the user terminal returns the current user identity information to the AAA server.

7. The zero-trust-based business system access control method according to any one of claims 1 to 6, characterized in that: Based on the identity authentication success result and the current user identity information, the AAA server initiates a biometric authentication request to the user terminal, so that the AAA server detects whether the latest biometric information of the target user returned by the user terminal matches the pre-stored biometric information of the target user, and if they match, returns a biometric authentication success result to the user terminal to authorize the target user to continue to access the target service system, including: Based on the successful identity authentication result and the current user identity information, the AAA server initiates a biometric authentication request to the user terminal; The terminal re-authentication module in the user terminal calls the biometric collection module to collect the latest biometric information of the target user, and the AAA re-authentication module in the AAA server calls the pre-stored biometric information of the target user in the biometric storage module; The AAA server detects whether the latest biometric information of the target user returned by the user terminal matches the pre-stored biometric information of the target user. If so, it returns a biometric authentication success result to the user terminal to authorize the target user to continue accessing the target business system.

8. A business system access control device based on zero trust, characterized in that: include: The re-authentication trigger module is configured to call a preset zero-trust security model when the network side detects that a user terminal that has passed the network access authentication and the service system access authentication continues to access the target service system, and trigger the session management function network element or the AAA server in the network core network function network element to send a user re-authentication request to the user terminal according to the preset access control policy, so that the user terminal returns the current user information to the AAA server, wherein the user terminal includes one or more target users; A user identity authentication module, configured to determine a successful identity authentication result when the AAA server verifies that the current user identity information is consistent with the user identity information corresponding to the target user; a biometric authentication module, configured to cause the AAA server to initiate a biometric authentication request to the user terminal based on the identity authentication success result and the current user identity information, so that the AAA server detects whether the latest biometric information of the target user returned by the user terminal matches the pre-stored biometric information of the target user, and if so, returns a biometric authentication success result to the user terminal to authorize the target user to continue to access the target service system; The access control module is configured to cyclically execute the above steps based on the access control policy until the target user ends access to the target business system, so as to complete the access control of the business system based on zero trust.

9. An electronic device, comprising a central processing unit and a memory, characterized in that: The central processing unit is used to call and run the computer program stored in the memory to execute the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: It stores a computer program implemented according to the method described in any one of claims 1 to 7 in the form of computer-readable instructions, and when the computer program is called and executed by a computer, the steps included in the corresponding method are executed.

Images