Zero-trust network access control method, apparatus, device, medium and program product

Abstract

The invention provides a zero-trust network access control method which can be applied to the technical field of network security. The method comprises the steps of obtaining an access strategy matched with identity information of a target object in response to the access of the target object to a target application in a cloud native environment, and verifying the permission of the target object to access the target application based on the access strategy; when the permission verification of the target object is passed, obtaining a target resource of the target application from the cloud native environment and returning the target resource to the target object; the zero-trust network access module serves as a side vehicle service to be integrated into a cloud native environment, and in the running process of the zero-trust network access module, traffic characteristics of traffic data of a target application are extracted, and the traffic characteristics are used for evaluating risks and matching an access strategy of a target object; and performing risk assessment based on the traffic characteristics, and optimizing an access strategy of the target object based on a risk assessment result. The invention further provides a zero-trust network access control device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a zero-trust network access control method, apparatus, device, medium and program product. Background Art

[0002] With the continuous evolution of cloud computing technology, cloud computing has entered the cloud-native era. The notable feature of this stage is the widespread adoption of new architectures based on containers, service meshes, microservices, etc. to build and deploy applications. Cloud-native applications and services have brought unprecedented flexibility and scalability to the IT architecture of enterprises due to their high dynamic elasticity and complex dependencies between applications. However, this new architecture also poses severe challenges to traditional security protection mechanisms.

[0003] Currently, a common approach to cloud-native security protection is to implement network access control based on software-defined networking (SDN). SDN controllers can dynamically manage and adjust network policies, thereby achieving fine-grained access control to a certain extent. This solution enhances network-level security by centrally controlling network traffic.

[0004] Although the SDN-based network access control solution has made certain contributions to improving the security of cloud-native environments, it still has significant defects. First, the control granularity of the solution is limited to the network level, and it cannot go deep into applications and services. It lacks understanding of specific application behaviors and contexts, resulting in limited control accuracy and effectiveness. Second, existing network boundary protection methods, such as firewalls and VPNs, rely on fixed network boundaries, which do not match the dynamic and flexibility of cloud-native architectures and are difficult to effectively respond to frequently changing instances and access requests. Furthermore, the traditional IP-centric access control mechanism is powerless in cloud-native environments, because the frequent changes in IP addresses and instances make it difficult for IP-based access control policies to maintain their effectiveness. In addition, although tunnel technologies such as VPN can control north-south traffic to a certain extent, they cannot achieve fine-grained access control, and their internal trust model is contrary to the zero-trust security concept and cannot adapt to the high security requirements of cloud-native environments. Finally, existing solutions often cannot continuously verify the identity of users or processes, increasing the risk of malicious exploitation, thereby reducing the security controllability of cloud-native environments. Summary of the invention

[0005] In view of the above problems, the present disclosure provides a zero-trust network access control method, apparatus, device, medium and program product that improve security protection capabilities.

[0006] According to a first aspect of the present disclosure, a zero-trust network access control method is provided, the method comprising: in response to a target object accessing a target application in a cloud-native environment, authenticating the target object based on a zero-trust network access module, including: obtaining an access policy that matches the identity information of the target object, and verifying the target object's access rights to the target application based on the access policy; when the target object's rights verification passes, obtaining a target resource of the target application from the cloud-native environment and returning it to the target object; wherein the zero-trust network access module is integrated into the cloud-native environment as a sidecar service, and during the operation of the zero-trust network access module, the method comprises: extracting traffic data of the target application, performing risk assessment based on the traffic data, and optimizing the access policy of the target object based on the risk assessment result.

[0007] According to an embodiment of the present disclosure, before authenticating the target object based on the zero-trust network access module, the method also includes: monitoring the service network topology of the target application and extracting traffic data in the service network topology; extracting and executing the identity information of the target object based on the traffic data, and generating an initial access policy for the identity information, wherein the initial access policy characterizes the behavioral characteristics of the target object accessing the target application; simulating the target object's access to the target object based on the initial access policy, and performing a risk assessment on the simulated access behavior; adjusting the initial access policy based on the risk assessment result to obtain an access policy that matches the identity information of the target object.

[0008] According to an embodiment of the present disclosure, obtaining an access policy that matches the identity information of the target object and verifying the target object's permission to access the target application based on the access policy include: matching the target object's identity information with access policies in a preset access policy library to obtain an access policy that matches the target object's identity information; verifying whether the target object's access behavior complies with the access policy; and determining that the target object has permission to access the target application when the target object's access behavior complies with the access policy.

[0009] According to an embodiment of the present disclosure, extracting the traffic data of the target application, performing risk assessment based on the traffic data, and optimizing the access policy of the target object based on the risk assessment result includes: obtaining the traffic data of the target application, extracting the traffic characteristics of the traffic data, the traffic characteristics at least including the identity information of the target object, which is used to assess the risk and match the access policy of the target object; performing risk assessment based on the traffic characteristics to obtain a risk score; and adjusting the policy parameters of the access policy based on the risk score to reduce the risk score to obtain the optimized access policy.

[0010] According to an embodiment of the present disclosure, the risk assessment based on the traffic characteristics to obtain the risk score includes: evaluating the identity information trust level and content sensitivity of the traffic characteristics, the identity information trust level characterizing the proportion of trusted behaviors of the identity information included in the traffic characteristics in historical access behaviors, and the content sensitivity characterizing the compliance level of the traffic characteristics; performing weighted calculation on the identity information trust level and content sensitivity to obtain the risk score.

[0011] According to an embodiment of the present disclosure, the evaluation of the identity information trust level and content sensitivity of the traffic characteristics includes: identifying the identity type of the identity information included in the traffic characteristics, and obtaining the trust weight corresponding to the identity type; calculating the identity information trust level based on the score of the historical access behavior of the identity type and the trust weight; identifying sensitive features in the traffic characteristics, and analyzing the semantics of the traffic data where the sensitive features are located; and performing a grade evaluation based on the semantics of the sensitive features to obtain the content sensitivity.

[0012] The second aspect of the present disclosure provides a zero-trust network access control device, the device comprising: an access receiving module, for authenticating the target object based on the zero-trust network access module in response to the target object accessing the target application in the cloud-native environment, including: an identity authentication unit, for obtaining an access policy that matches the identity information of the target object, and verifying the target object's permission to access the target application based on the access policy; a resource acquisition unit, for obtaining the target resource of the target application from the cloud-native environment and returning it to the target object when the permission verification of the target object passes; a policy optimization module, for extracting the traffic data of the target application during the operation of the zero-trust network access module, performing risk assessment based on the traffic data, and optimizing the access policy of the target object based on the risk assessment result. Wherein, the zero-trust network access module is integrated into the cloud-native environment as a sidecar service.

[0013] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium on which a computer program or instruction is stored, and the steps of the above method are implemented when the above computer program or instruction is executed by a processor.

[0015] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above contents and other purposes, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0017] Figure 1 A flowchart of a zero-trust network access control method according to an embodiment of the present disclosure is schematically shown;

[0018] Figure 2 A flowchart of target object identity authentication according to an embodiment of the present disclosure is schematically shown;

[0019] Figure 3 A flowchart of deploying a strategy according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 4 Schematically shows a flow chart of continuous risk assessment and strategy optimization according to an embodiment of the present disclosure;

[0021] Figure 5 A structural block diagram of a zero-trust network access control device according to an embodiment of the present disclosure is schematically shown; and

[0022] Figure 6 A block diagram of an electronic device suitable for implementing a zero-trust network access control method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0023] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0024] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0025] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0026] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0027] It should be noted that the zero-trust network access control method and device provided by the present disclosure can be used for network security applications in the financial field, and can also be used in any field other than the financial field. The application field of the zero-trust network access control method and device provided by the present disclosure is not limited.

[0028] The acquisition, transmission, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations. It should be noted that in the embodiments of this application, some existing solutions in the industry such as certain software, components, and models may be mentioned, and they should be considered as exemplary. Their purpose is only to illustrate the feasibility of the implementation of the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0029] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0030] Figure 1 A flowchart of a zero-trust network access control method according to an embodiment of the present disclosure is schematically shown.

[0031] like Figure 1 As shown, the zero-trust network access control method of this embodiment includes operations S210 to S220, and the transaction processing method can be executed sequentially.

[0032] In operation S210 , in response to a target object accessing a target application in a cloud-native environment, identity authentication is performed on the target object based on a zero-trust network access module, including S211 - S212 .

[0033] In an embodiment of the present disclosure, the target object may be a user or a program process, and before obtaining the user's information, the user or program process may obtain consent or authorization. For example, before operation S210, a request to obtain identity information may be issued to the user or program process. When the user or program process agrees or authorizes that the user information may be obtained, operation S210 is performed.

[0034] "Zero Trust" is a modern network security model, the core idea of ​​which is that in the network, no matter where or when a user or device is, it cannot be trusted by default. It subverts the traditional security concept of "trust the inside and distrust the outside" and emphasizes that all access needs to be authenticated, authorized and monitored. In order to improve security, users need to provide multiple credentials, such as passwords, biometrics, smart cards, etc., to ensure that each user and program process has a unique identity. Based on identity information, each user and device can only obtain the minimum permissions required to complete their work, rather than broad access rights. Through continuous authentication, access control and monitoring, the zero-trust network access module can significantly reduce security risks and protect applications and data in cloud-native environments.

[0035] In the disclosed embodiment, the zero-trust network access module is integrated into the cloud-native environment as a sidecar service. The prior art adopts a network access control solution based on software-defined networking (SDN). The SDN controller can dynamically manage network policies and achieve a certain degree of fine-grained access control. However, this solution is limited to network-level control and cannot go deep into applications and services. It lacks understanding of specific application behaviors and contexts, so the control granularity and accuracy are limited. The present disclosure adopts a zero-trust network access strategy to maintain the security of the cloud-native environment, integrates access control into the service mesh sidecar service, rather than an external network device, and does not rely on fixed network boundaries.

[0036] In operation S211, an access policy matching the identity information of the target object is obtained, and the permission of the target object to access the target application is verified based on the access policy.

[0037] In the disclosed embodiment, the preset policy library matches the identity information of the target object. Among them, an access policy in the policy library can be used to verify whether the access behavior of the target object is normal. When the access behavior of the target object is normal, the target object has the right to access the target application. For each target access object, different access policies can be bound based on the identity information. Another access policy of the policy library is used to require the user to provide multiple credentials to prove his identity. These credentials usually include at least two different types of authentication factors, such as what the user knows (such as a password), what the user has (such as a mobile phone, a smart card), and user biometrics (such as fingerprints, facial recognition), etc. For example, the user first needs to enter the user name and password, and then complete the secondary verification through the mobile phone verification code or fingerprint recognition to successfully access the target application. The policy library also includes at least one access policy for access control based on user role assignment permissions to ensure that only users with appropriate roles can access the target application. For example, only users with the "administrator" role can access a specific target application. The policy library also includes at least one access policy for authenticating users through third-party authentication services (such as OAuth, OpenID Connect, etc.), and federated authentication can simplify the authentication process and enhance security. For example, users can log in to target applications using credentials from their social media accounts or enterprise identity providers such as Azure AD, Google Workspace, etc. without having to remember multiple passwords.

[0038] In operation S212 , when the permission verification of the target object passes, the target resources of the target application are obtained from the cloud native environment and returned to the target object.

[0039] When the target object's permission verification passes, it means that the target object's access is safe, and the target application can be accessed normally and the target resources can be obtained. When the target object's permission verification fails, the target object's access request is rejected and an error response prompt is returned.

[0040] Through fine-grained verification and control of the target object through access policy, the behavior of the target object can be restricted so that the target object can access the target application within a safe range.

[0041] In operation S220, during the operation of the zero-trust network access module, traffic data of the target application is extracted, risk assessment is performed based on the traffic data, and the access policy of the target object is optimized based on the risk assessment result.

[0042] In a zero-trust network environment, all traffic accessing the target application will pass through one or more security gateways. These gateways will capture and analyze the traffic data passing through, including but not limited to IP addresses, port numbers, protocol types, packet sizes, transmission times, session durations, etc. In addition, technologies such as Fake DNS will be used to identify specific access applications to ensure the accuracy of traffic data.

[0043] After extracting the traffic data, the zero-trust system will use a variety of algorithms and models to analyze the data to assess the risks in the access behavior. Risk assessment may involve the following aspects: First, abnormal behavior detection, by comparing the difference between the current traffic and the normal behavior pattern, identifying abnormal access behavior, for example, a user suddenly accessed a large amount of sensitive data in a short period of time, or accessed internal applications from a non-office location; second, threat intelligence matching, comparing the IP address, domain name and other information in the traffic data with the known threat intelligence library to detect whether there are known malicious activities; third, user behavior analysis, combining the user's historical access records, authentication methods, device information and other multi-dimensional data to evaluate whether the user's access behavior is credible.

[0044] In the disclosed embodiment, during the operation of the zero-trust network access module, by performing risk assessment on traffic data, the access policy can be adjusted in real time according to the risk, and the access policy can be continuously updated to adapt to the dynamic changes of the cloud-native environment and enhance the security protection capabilities of the cloud-native environment.

[0045] According to the zero-trust network access control method provided by the present invention, a zero-trust network access policy is adopted and executed as a sidecar service in a cloud-native environment. It does not rely on fixed network boundaries and is more in line with the dynamic nature of the cloud-native architecture. The access policy is continuously updated during the application process, and the identity information of the access object is continuously verified with the new policy to cope with the characteristics of frequent changes in cloud-native environment instances and access, and to continuously maintain the security and controllability of the cloud-native environment.

[0046] Figure 2 A flowchart of target object identity authentication according to an embodiment of the present disclosure is schematically shown.

[0047] like Figure 2 As shown, according to operation S210, the identity authentication process of the target object in the disclosed embodiment includes: when a user accesses a cloud native environment, the user's identity is verified by a zero-trust network access module mounted on a sidecar service of the cloud native environment, wherein an authorization policy library is required before verification, and an access policy matching the user's identity information is obtained from the policy library; based on the access policy, whether the user's access behavior is normal is verified, and when the user's behavior is verified to be normal, the user is allowed to access the target application and obtain the target resources, and when the user's behavior is abnormal, the user's access request is rejected.

[0048] In operation S211, an access policy matching the identity information of the target object is obtained, and the permission of the target object to access the target application is verified based on the access policy, including S2111-S2113.

[0049] In operation S2111, the access policy in the preset access policy library is matched based on the identity information of the target object to obtain an access policy that matches the identity information of the target object.

[0050] In operation S2111, the identity information of the target object may include, but is not limited to, user name, password, digital certificate, biometric features (such as fingerprint, facial recognition), and possible IP address or device identification. The zero-trust network access module matches these details with the preset access policy library in detail. The access policy library is a predefined, structured collection that contains access permission rules set for different user roles, user groups, or specific users. These rules may be based on factors such as time (such as access during working hours), location (such as access only from the company's internal network), resource type (such as read-only access or full access), and specific operation behaviors (such as data modification permissions). Through complex logical judgment and conditional matching, the zero-trust network access module can accurately identify access policies that fully or partially match the identity information of the target object.

[0051] In operation S2112, it is verified whether the access behavior of the target object complies with the access policy.

[0052] The zero-trust network access module strictly verifies the actual access behavior of the target object based on the matched access policy. This step not only checks whether the user attempts to access authorized resources, but also involves a compliance review of the access method. For example, if the access policy requires that a certain type of data must be transmitted through an encrypted channel, the zero-trust network access module will verify whether the current access meets this security requirement. In addition, the zero-trust network access module will also monitor and record access behavior for subsequent auditing and tracking. Through real-time behavioral analysis technology, the zero-trust network access module can quickly identify abnormal or potential violations, such as attempts to access unauthorized resources and the use of illegal means to bypass security controls.

[0053] In operation S2113 , when the access behavior of the target object complies with the access policy, it is determined that the target object has the authority to access the target application.

[0054] In operation S2113, once the zero-trust network access module confirms that the target object's access behavior fully complies with the matching access policy, it will immediately grant the target object the corresponding access rights, allowing it to access the target application or resource. This process may be completed automatically without human intervention, greatly improving the efficiency and user experience of the zero-trust network access module. At the same time, the zero-trust network access module will generate a detailed access log to record the time, method, resource details of the access, and any related security events, providing strong support for subsequent security audits and compliance checks.

[0055] Figure 3 The flowchart of deploying a strategy according to an embodiment of the present disclosure is schematically shown.

[0056] like Figure 3 As shown, in the embodiment of the present disclosure, before authenticating the target object based on the zero-trust network access module, the method also includes deploying a policy library, specifically including S310~S340.

[0057] In operation S310 , a service network topology of a target application is monitored, and traffic data in the service network topology is extracted.

[0058] Network monitoring technologies such as network traffic analysis, service discovery protocol (such as Consul, Eureka) monitoring, and API gateway log collection can be used to comprehensively monitor the service network topology of the target application. This process not only involves identifying the dependencies, communication protocols, and port information between application services, but also includes real-time capture and recording of network traffic. The zero-trust network access module parses data packets in network traffic through intelligent algorithms to extract key information such as source IP, destination IP, port number, request timestamp, request type (HTTP, HTTPS, TCP, UDP, etc.) and possible payload content (such as JSON, XML data).

[0059] In operation S320, identity information of the target object is extracted based on the traffic data, and an initial access policy of the identity information is generated. The initial access policy represents a behavior feature of the target object accessing the target application.

[0060] The zero-trust network access module uses technologies such as machine learning, data mining, or rule engines to extract the identity information of the target object from network traffic data. This information may be hidden in the header of the HTTP request, session tokens, cookies, or digital certificates and keys transmitted through encrypted channels. Once the identity information is accurately identified, the zero-trust network access module automatically generates an initial access policy based on this information and preset access control rules. The initial access policy not only characterizes the basic access rights of the target object, but also records in detail its behavioral characteristics of accessing the target application, such as access frequency, access time period, and accessed resource types.

[0061] Extracting identity information based on traffic data can include the following steps: By analyzing the device type, operating system, browser version and other information in the traffic data, a unique device fingerprint can be generated; Observe the behavior patterns of the target object during the access process, such as request frequency, access time, access path, etc. These behavior patterns can be used as one of the bases for identifying the identity of the target object; If the traffic data contains authentication information (such as username, password hash value, digital certificate, etc.), it can be directly used to verify the identity of the target object; After identifying the identity information of the target object, the zero-trust network architecture will generate initial access policies based on its behavioral characteristics. These policies are designed to limit the target object's access rights to the target application and ensure that only legitimate and trusted access requests are allowed. The initial access policy may include the following aspects: According to the identity and role of the target object, assign corresponding access rights to it. For example, ordinary users may only be able to access some public information, while administrators can access all sensitive data; Set the time period during which the target object can access the target application; For example, prohibit access to sensitive data during non-working hours; According to the geographic location information of the target object, limit its access rights, for example, only allow access to sensitive applications from the company's internal network, Session management: Monitor the session activity of the target object and automatically log out of its access rights at the end of the session. This helps prevent security threats such as session hijacking.

[0062] In operation S330, the target object is simulated to access the target object based on the initial access policy, and a risk assessment is performed on the simulated access behavior.

[0063] Use virtualization or containerization technology to create a simulation environment similar to the target application environment. Then, based on the initial access policy, the zero-trust network access module simulates the access behavior of the target object in the environment. During the simulation, the zero-trust network access module records in detail each access operation, requested data, returned results, and any potential anomalies or violations. Through the built-in risk assessment model, the zero-trust network access module conducts a comprehensive assessment of these simulated access behaviors to identify possible security risks, performance bottlenecks, or compliance issues.

[0064] In operation S340, the initial access policy is adjusted based on the risk assessment result to obtain an access policy that matches the identity information of the target object.

[0065] Based on the risk assessment results in S330 operations, the Zero Trust Network Access Module automatically or manually adjusts the initial access policy. This process may involve adding additional security controls (such as multi-factor authentication, IP whitelisting), limiting access rights to specific resources, adjusting access frequency limits, etc. Through refined adjustments, the Zero Trust Network Access Module can ensure that access policies meet both business needs and security compliance requirements while minimizing potential security risks.

[0066] In the above method, the user access process can be simulated according to the characteristics of the cloud native environment, and the initial access policy can be generated according to the traffic data generated by the simulated user access. First, the zero-trust network access module creates a series of virtual users or test users according to the architecture and deployment of the cloud native application. Then, these users perform access operations in the simulated cloud native environment according to the preset access scenarios and processes. The zero-trust network access module records and collects all data generated during these simulated access processes, including request information, response data, log records, etc., as an important basis for generating the initial access policy. Through in-depth analysis of the access simulation data, the zero-trust network access module can more accurately understand the user's behavior pattern in the cloud native environment, so as to formulate a more practical access control policy. If the risk of the initial access policy is too high, the policy can be adjusted to reduce the risk; if the risk of the access policy is within the allowable range, the access policy can be deployed in the policy library.

[0067] During the operation of the zero-trust network access module, in order to deal with the risks generated during its operation, the present disclosure also proposes a method for continuously optimizing the access strategy.

[0068] Figure 4 The flowchart of continuous risk assessment and strategy optimization according to an embodiment of the present disclosure is schematically shown.

[0069] like Figure 4 As shown, in operation S220, traffic data of the target application is extracted, risk assessment is performed based on the traffic data, and the access strategy of the target object is optimized based on the risk assessment result, including S221~S223.

[0070] In operation S221, traffic data of a target application is acquired, and traffic features of the traffic data are extracted. The traffic features include at least identity information of a target object, which is used to assess risks and match access policies of the target object.

[0071] In order to comprehensively and accurately obtain the traffic data of the target application, first ensure that the network monitoring tool has been properly deployed on key network nodes, such as firewalls, gateways, or server entrances. These data are collected through real-time capture technology (such as network packet capture), covering all network communications in and out of the target application. Next, advanced data parsing technology (such as regular expression matching, protocol parsing library, etc.) is used to deeply analyze the captured traffic data to extract rich traffic features. Traffic features include at least target identity, request content, CONTEXT and other elements.

[0072] Traffic characteristics should also include at least the following aspects: traffic size and rate, used to analyze the total amount of data transmission and rate changes per unit time, and identify abnormal traffic patterns; packet characteristics, including packet length, type (such as TCP, UDP, ICMP, etc.), protocol details (such as HTTP request method, URL, etc.), used to identify potential security threats or malicious behavior; session behavior: tracking session duration, request frequency, response status code, etc., to evaluate the normality or abnormality of access patterns; geographic location information, through the IP address to resolve the geographic location of the request source, used to assist in analyzing the rationality of access behavior; timestamp and periodicity, used to record the specific time when the traffic occurs, analyze the trend of traffic changes over time, and identify periodic or sudden abnormal traffic. After extracting these traffic characteristics, use machine learning or statistical models for preprocessing, such as normalization, feature selection, etc., to improve the efficiency and accuracy of subsequent analysis.

[0073] In operation S222, risk assessment is performed based on the traffic characteristics to obtain a risk score.

[0074] In the embodiment of the present disclosure, the traffic characteristics mainly include identity trust level and content sensitivity, etc. The risk assessment can calculate the risk score based on factors such as identity trust level and content sensitivity, including S2221~S2222.

[0075] In operation S2221, the identity information trust level and content sensitivity of the traffic feature are evaluated. The identity information trust level represents the proportion of credible behaviors of the identity information included in the traffic feature in historical access behaviors, and the content sensitivity represents the compliance level of the traffic feature.

[0076] In the disclosed embodiments, the identity type of the identity information included in the traffic characteristics can be identified to obtain the trust weight corresponding to the identity type; the trust level of the identity information can be calculated based on the score of the historical access behavior of the identity type and the trust weight; the sensitive features in the traffic characteristics can be identified, and the semantics of the traffic data where the sensitive features are located can be analyzed; and the level evaluation can be performed based on the semantics of the sensitive features to obtain the content sensitivity.

[0077] In operation S2222, a weighted calculation is performed on the identity information trust level and the content sensitivity to obtain a risk score.

[0078] In the embodiment of the present disclosure, the risk score is calculated as follows:

[0079] Risk score R = α * identity credibility factor + β * content sensitivity factor;

[0080] Among them, α and β are weight coefficients, indicating the importance of each factor.

[0081] In operation S223 , the policy parameters of the access policy are adjusted based on the risk score to reduce the risk score, thereby obtaining an optimized access policy.

[0082] Dynamically adjust the policy parameters of the access policy according to the risk score, including but not limited to: access rights adjustment, restricting or downgrading the access rights of high-risk objects to reduce potential damage; authentication and authorization enhancement, requiring high-risk objects to undergo stricter identity authentication or secondary authorization; traffic restriction, implementing rate restrictions or bandwidth restrictions on high-risk traffic to prevent resource exhaustion or DDoS attacks; isolation and monitoring, placing high-risk objects in an isolated environment and strengthening the monitoring and auditing of their activities; automated response, setting thresholds, and automatically triggering security incident response processes once the risk score exceeds a predetermined level, such as notifying administrators, recording logs, and executing preset security measures. Through this series of operations, not only can the risks faced by the target application be effectively reduced, but the access policy can also be continuously optimized according to real-time conditions to improve the overall security protection level.

[0083] In the disclosed embodiment, the adoption of the zero-trust model can significantly improve the security protection capability. By default, any internal or external entity is not trusted, internal threats are effectively reduced and possible security defects of trusted roles are avoided, thereby ensuring the security of the cloud environment. In addition, the model also demonstrates strong adaptability. The access policy can be automatically adjusted as the cloud application changes. At the same time, it is compatible with a variety of cloud native frameworks without the need to modify the application code, which greatly facilitates the operation and management of the cloud environment. At the control level, the zero-trust model realizes fine-grained access management that is unmatched by traditional network boundary protection, and extends access control into applications and services to ensure precise control of resource access. More importantly, it not only relies on boundary protection, but also can identify and respond to potential threats internally. The risk-driven adaptive access strategy further enhances the continuity and effectiveness of defense. Finally, the model also meets the requirements of data compliance and network security-related regulations, which helps enterprises to ensure the legality and compliance of business operations while enjoying the convenience brought by the cloud environment.

[0084] Based on the above zero-trust network access control zero-trust network access control method, the present disclosure also provides a zero-trust network access control device. Figure 5 The device is described in detail.

[0085] Figure 5 The structural block diagram of a zero-trust network access control device according to an embodiment of the present disclosure is schematically shown.

[0086] like Figure 5 As shown, the zero-trust network access control device 500 of this embodiment includes an access receiving module 510 and a policy optimization module 520 .

[0087] The access receiving module 510 is used to authenticate the target object based on the zero-trust network access module in response to the target object accessing the target application in the cloud native environment. In one embodiment, the access receiving module 510 can be used to perform the operation S210 described above, which is not repeated here. The zero-trust network access module is integrated into the cloud native environment as a sidecar service.

[0088] The access receiving module 510 includes an identity authentication unit 511 and a resource acquisition unit 512 .

[0089] The identity authentication unit 511 is used to obtain an access policy that matches the identity information of the target object, and verify the target object's permission to access the target application based on the access policy.

[0090] The resource acquisition unit 512 is used to obtain the target resources of the target application from the cloud native environment and return them to the target object when the permission verification of the target object passes.

[0091] The policy optimization module 520 is used to extract the traffic data of the target application during the operation of the zero-trust network access module, perform risk assessment based on the traffic data, and optimize the access policy of the target object based on the risk assessment result. In one embodiment, the policy optimization module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0092] According to an embodiment of the present disclosure, any multiple modules in the access receiving module module 510 and the policy optimization module 520 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the access receiving module module 510 and the policy optimization module 520 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the access receiving module module 510 and the policy optimization module 520 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0093] Figure 6 A block diagram of an electronic device suitable for implementing a zero-trust network access control method according to an embodiment of the present disclosure is schematically shown.

[0094] like Figure 6 As shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0095] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0096] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the input / output (I / O) interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0097] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0098] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0099] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the zero-trust network access control method provided by the embodiment of the present disclosure.

[0100] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 601. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0101] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0102] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0103] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0104] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0105] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0106] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A zero-trust network access control method, characterized in that: The method comprises: In response to the target object accessing the target application in the cloud native environment, the target object is authenticated based on the zero-trust network access module, including: Acquire an access policy that matches the identity information of the target object, and verify the target object's permission to access the target application based on the access policy; When the permission verification of the target object passes, the target resource of the target application is obtained from the cloud native environment and returned to the target object; The zero-trust network access module is integrated into the cloud-native environment as a sidecar service. During the operation of the zero-trust network access module, the method includes: Extracting traffic data of the target application, performing risk assessment based on the traffic data, and optimizing the access policy of the target object based on the risk assessment result.

2. The method according to claim 1, characterized in that Before authenticating the target object based on the zero-trust network access module, the method further includes: Monitoring the service network topology of the target application and extracting traffic data in the service network topology; Extracting and executing identity information of the target object based on the traffic data, generating an initial access policy for the identity information, wherein the initial access policy represents a behavior feature of the target object accessing the target application; Simulate the target object to access the target object based on the initial access policy, and perform risk assessment on the simulated access behavior; The initial access policy is adjusted based on the risk assessment result to obtain an access policy that matches the identity information of the target object.

3. The method according to claim 1, characterized in that The acquiring of an access policy matching the identity information of the target object and verifying the target object's permission to access the target application based on the access policy includes: Based on the identity information of the target object, the access policy in the preset access policy library is matched to obtain the access policy matching the identity information of the target object; Verifying whether the access behavior of the target object complies with the access policy; When the access behavior of the target object complies with the access policy, it is determined that the target object has the permission to access the target application.

4. The method according to claim 1, characterized in that: The extracting the traffic data of the target application, performing risk assessment based on the traffic data, and optimizing the access policy of the target object based on the risk assessment result includes: Acquire traffic data of the target application, extract traffic features of the traffic data, wherein the traffic features at least include identity information of the target object, and are used to assess risks and match access policies of the target object; Perform risk assessment based on the traffic characteristics to obtain a risk score; The policy parameters of the access policy are adjusted based on the risk score to reduce the risk score, thereby obtaining the optimized access policy.

5. The method according to claim 4, characterized in that The risk assessment based on the traffic characteristics to obtain the risk score includes: Evaluate the identity information trust level and content sensitivity of the traffic feature, the identity information trust level represents the proportion of credible behaviors of the identity information included in the traffic feature in historical access behaviors, and the content sensitivity represents the compliance level of the traffic feature; The risk score is obtained by performing a weighted calculation on the identity information trust level and content sensitivity.

6. The method according to claim 1, characterized in that The evaluation of the identity information trust level and content sensitivity of the traffic characteristics includes: Identify the identity type of the identity information included in the traffic feature, and obtain a trust weight corresponding to the identity type; Calculate the trust level of the identity information based on the score of the historical access behavior of the identity type and the trust weight; Identify sensitive features in the traffic features, and analyze the semantics of the traffic data containing the sensitive features; A level evaluation is performed based on the semantics of the sensitive feature to obtain the content sensitivity.

7. A zero-trust network access control device, characterized in that: The device comprises: The access receiving module is used to authenticate the target object based on the zero-trust network access module in response to the target object accessing the target application in the cloud native environment, including: An identity authentication unit, configured to obtain an access policy matching the identity information of the target object, and verify the target object's permission to access the target application based on the access policy; A resource acquisition unit, configured to acquire a target resource of the target application from the cloud native environment and return it to the target object when the permission verification of the target object passes; A policy optimization module is used to extract the traffic data of the target application during the operation of the zero-trust network access module, perform risk assessment based on the traffic data, and optimize the access policy of the target object based on the risk assessment result. The zero-trust network access module is integrated into the cloud-native environment as a sidecar service.

8. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images