Zero trust network access control method, apparatus, device, medium and program product

Abstract

This disclosure provides a zero-trust network access control method applicable to the field of network security technology. The method includes: in response to a target object accessing a target application in a cloud-native environment, obtaining an access policy matching the target object's identity information, and verifying the target object's access permissions to the target application based on the access policy; when the target object's permission verification is successful, retrieving the target application's target resources from the cloud-native environment and returning them to the target object; integrating a zero-trust network access module as a sidecar service into the cloud-native environment, extracting traffic characteristics of the target application's traffic data during the operation of the zero-trust network access module, using these traffic characteristics to assess risk and match the target object's access policy; performing risk assessment based on the traffic characteristics, and optimizing the target object's access policy based on the risk assessment results. This disclosure also provides a zero-trust network access control device, equipment, storage medium, and program product.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and specifically to a zero-trust network access control method, apparatus, device, medium, and program product. Background Technology

[0002] With the continuous evolution of cloud computing technology, cloud computing has entered the cloud-native era. A significant characteristic of this stage is the widespread adoption of new architectures such as containers, service meshes, and microservices for building and deploying applications. Cloud-native applications and services, due to their high dynamic elasticity and complex dependencies between applications, bring unprecedented flexibility and scalability to enterprise IT architectures. However, this new architecture also poses serious challenges to traditional security mechanisms.

[0003] Currently, a common approach to security protection in cloud-native environments is to implement network access control based on Software-Defined Networking (SDN). SDN controllers can dynamically manage and adjust network policies, thereby achieving fine-grained access control to a certain extent. This approach enhances network-level security by centrally controlling network traffic.

[0004] While SDN-based network access control schemes have contributed to improving the security of cloud-native environments, they still have significant shortcomings. First, the control granularity of these schemes is limited to the network layer, failing to penetrate into the application and service levels and lacking an understanding of specific application behaviors and contexts, thus limiting control precision and effectiveness. Second, existing network perimeter protection methods, such as firewalls and VPNs, rely on fixed network boundaries, which is incompatible with the dynamic and flexible nature of cloud-native architectures, making it difficult to effectively handle frequently changing instances and access requests. Third, traditional IP-centric access control mechanisms are inadequate in cloud-native environments because frequent changes in IP addresses and instances make it difficult to maintain the effectiveness of IP-based access control policies. Furthermore, while VPNs and other tunneling technologies can control north-south traffic to some extent, they cannot achieve fine-grained access control, and their internal trust models contradict the zero-trust security philosophy, failing to meet the high security requirements of cloud-native environments. Finally, existing solutions often fail to continuously verify the identity of users or processes, increasing the risk of malicious exploitation and thus reducing the security controllability of cloud-native environments. Summary of the Invention

[0005] In view of the above problems, this disclosure provides methods, apparatus, devices, media and program products for zero-trust network access control to improve security protection capabilities.

[0006] According to a first aspect of this disclosure, a zero-trust network access control method is provided. The method includes: in response to a target object accessing a target application in a cloud-native environment, authenticating the target object based on a zero-trust network access module, including: obtaining an access policy matching the identity information of the target object; verifying the target object's permission to access the target application based on the access policy; and when the permission verification of the target object is successful, retrieving the target resource of the target application from the cloud-native environment and returning it to the target object; wherein the zero-trust network access module is integrated into the cloud-native environment as a sidecar service, and during the operation of the zero-trust network access module, the method includes: extracting traffic data of the target application; performing a risk assessment based on the traffic data; and optimizing the access policy of the target object based on the risk assessment result.

[0007] According to embodiments of this disclosure, before authenticating the target object based on the zero-trust network access module, the method further includes: monitoring the service network topology of the target application and extracting traffic data from the service network topology; extracting the identity information of the target object based on the traffic data and generating an initial access policy for the identity information, wherein the initial access policy characterizes the behavioral characteristics of the target object accessing the target application; simulating the target object accessing the target object based on the initial access policy and performing a risk assessment on the simulated access behavior; and adjusting the initial access policy based on the risk assessment results to obtain an access policy that matches the identity information of the target object.

[0008] According to embodiments of this disclosure, obtaining an access policy that matches the identity information of the target object, and verifying the target object's permission to access the target application based on the access policy, includes: matching the target object's identity information with access policies in a preset access policy library to obtain an access policy that matches the target object's identity information; verifying whether the target object's access behavior conforms to the access policy; and determining that the target object has permission to access the target application when the target object's access behavior conforms to the access policy.

[0009] According to embodiments of this disclosure, the steps of extracting traffic data of the target application, performing risk assessment based on the traffic data, and optimizing the access strategy of the target object based on the risk assessment results include: acquiring traffic data of the target application; extracting traffic features from the traffic data, wherein the traffic features include at least the identity information of the target object, used to assess risk and match the access strategy of the target object; performing risk evaluation based on the traffic features to obtain a risk score; and adjusting the strategy parameters of the access strategy based on the risk score to reduce the risk score, thereby obtaining the optimized access strategy.

[0010] According to embodiments of this disclosure, the risk assessment based on the traffic characteristics to obtain a risk score includes: evaluating the trust level of the identity information and the sensitivity of the content of the traffic characteristics, wherein the trust level of the identity information represents the proportion of credible behavior of the identity information included in the traffic characteristics in historical access behavior, and the sensitivity of the content represents the compliance level of the traffic characteristics; and performing a weighted calculation on the trust level of the identity information and the sensitivity of the content to obtain the risk score.

[0011] According to embodiments of this disclosure, the evaluation of the trust level and content sensitivity of the identity information of the traffic features includes: identifying the identity type of the identity information included in the traffic features, and obtaining the trust weight corresponding to the identity type; calculating the trust level of the identity information based on the score of the historical access behavior of the identity type and the trust weight; identifying sensitive features in the traffic features, and analyzing the semantics of the traffic data in which the sensitive features are located; and performing a level evaluation based on the semantics of the sensitive features to obtain the content sensitivity.

[0012] A second aspect of this disclosure provides a zero-trust network access control device, comprising: an access receiving module, configured to, in response to a target object accessing a target application in a cloud-native environment, authenticate the target object based on a zero-trust network access module, including: an authentication unit, configured to acquire an access policy matching the identity information of the target object, and verify the target object's permission to access the target application based on the access policy; a resource acquisition unit, configured to, when the target object's permission verification is successful, acquire target resources of the target application from the cloud-native environment and return them to the target object; and a policy optimization module, configured to, during the operation of the zero-trust network access module, extract traffic data of the target application, perform risk assessment based on the traffic data, and optimize the target object's access policy based on the risk assessment results. The zero-trust network access module is integrated into the cloud-native environment as a sidecar service.

[0013] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0014] A fourth aspect of this disclosure also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0015] The fifth aspect of this disclosure also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0016] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0017] Figure 1 A flowchart illustrating a zero-trust network access control method according to an embodiment of the present disclosure is shown schematically.

[0018] Figure 2 A flowchart illustrating target object authentication according to an embodiment of the present disclosure is shown schematically;

[0019] Figure 3 A flowchart illustrating a deployment strategy according to an embodiment of this disclosure is shown schematically;

[0020] Figure 4 A flowchart illustrating continuous risk assessment and strategy optimization according to embodiments of this disclosure is shown schematically;

[0021] Figure 5 A schematic block diagram of a zero-trust network access control device according to an embodiment of the present disclosure is shown; and

[0022] Figure 6 A block diagram of an electronic device suitable for implementing a zero-trust network access control method according to an embodiment of the present disclosure is shown schematically. Detailed Implementation

[0023] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0024] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0025] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0026] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0027] It should be noted that the zero-trust network access control method and apparatus provided in this disclosure can be used in the financial field for network security applications, and can also be used in any field other than the financial field. The application fields of the zero-trust network access control method and apparatus provided in this disclosure are not limited.

[0028] The acquisition, transmission, storage, use, and processing of data in this application comply with relevant national laws and regulations. It should be noted that certain software, components, models, and other existing industry solutions may be mentioned in the embodiments of this application. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0029] In the technical solution disclosed herein, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse.

[0030] Figure 1 A flowchart illustrating a zero-trust network access control method according to an embodiment of the present disclosure is shown.

[0031] like Figure 1 As shown, the zero-trust network access control method of this embodiment includes operations S210 to S220, and the transaction processing method can be executed sequentially.

[0032] In operation S210, in response to the target object accessing the target application in the cloud-native environment, the target object is authenticated based on the zero-trust network access module, including S211~S212.

[0033] In embodiments of this disclosure, the target object may be a user or a program process. Before obtaining the user's information, the user's or program process's consent or authorization may be obtained. For example, before operation S210, a request to obtain identity information may be sent to the user or program process. If the user or program process consents or authorizes the acquisition of user information, operation S210 is executed.

[0034] Zero Trust is a modern network security model whose core idea is that users and devices should never be trusted by default, regardless of when or where they are on the network. It overturns the traditional security concept of "trusting internally and distrusting externally," emphasizing that all access requires authentication, authorization, and monitoring. To enhance security, users must provide multiple credentials, such as passwords, biometrics, and smart cards, ensuring that each user and program process has a unique identity. Each user and device is granted only the minimum permissions necessary to complete its task based on their identity information, rather than broad access permissions. Through continuous authentication, access control, and monitoring, Zero Trust network access modules can significantly reduce security risks and protect applications and data in cloud-native environments.

[0035] In this embodiment, the zero-trust network access module is integrated into the cloud-native environment as a sidecar service. Existing technologies employ network access control schemes based on Software-Defined Networking (SDN). SDN controllers can dynamically manage network policies, achieving a certain degree of fine-grained access control. However, this approach is limited to network-level control and cannot penetrate deep into applications and services, lacking understanding of specific application behaviors and contexts; therefore, the granularity and precision of control are limited. This disclosure uses a zero-trust network access strategy to maintain the security of the cloud-native environment, integrating access control into the service mesh sidecar service, rather than as an external network device, and not relying on fixed network boundaries.

[0036] In operation S211, an access policy matching the identity information of the target object is obtained, and the access policy is used to verify the target object's permission to access the target application.

[0037] In this embodiment, a preset policy library matches the identity information of the target object. One access policy in the policy library can be used to verify whether the target object's access behavior is normal. When the target object's access behavior is normal, the target object has permission to access the target application. Different access policies can be bound to each target access object based on its identity information. Another access policy in the policy library requires the user to provide multiple credentials to prove their identity. These credentials typically include at least two different types of authentication factors, such as those known to the user (e.g., password), those owned by the user (e.g., mobile phone, smart card), and biometrics (e.g., fingerprint, facial recognition). For example, the user first needs to enter a username and password, and then complete secondary verification via mobile phone verification code or fingerprint recognition to successfully access the target application. The policy library also includes at least one access policy for access control based on user roles, ensuring that only users with appropriate roles can access the target application. For example, only users with the "administrator" role can access a specific target application. The policy library also includes at least one access policy for authenticating users through third-party authentication services (e.g., OAuth, OpenID Connect, etc.). Federated authentication can simplify the authentication process and enhance security. For example, users can log in to target applications using their social media accounts or credentials from enterprise identity providers such as Azure AD, Google Workspace, etc., without having to remember multiple passwords.

[0038] In operation S212, when the target object's permissions are verified, the target application's target resources are retrieved from the cloud-native environment and returned to the target object.

[0039] When the target object's permissions are verified, it indicates that the target object's access request is secure, and it can normally access the target application and obtain the target resources. When the target object's permissions are verified, the access request is denied, and an error response is returned.

[0040] Fine-grained verification control of target objects through access policies can restrict the behavior of target objects, enabling them to access target applications within a secure scope.

[0041] During the operation of S220 and the zero-trust network access module, traffic data of the target application is extracted, risk assessment is performed based on the traffic data, and access strategies for the target object are optimized based on the risk assessment results.

[0042] In a zero-trust network environment, all traffic accessing the target application passes through one or more security gateways. These gateways capture and analyze the traffic data, including but not limited to IP address, port number, protocol type, packet size, transmission time, and session duration. Furthermore, they utilize techniques such as Fake DNS to identify the specific application accessing the network, ensuring the accuracy of the traffic data.

[0043] After extracting traffic data, the Zero Trust system uses various algorithms and models to analyze this data to assess the risks present in access behavior. Risk assessment may involve the following aspects: First, abnormal behavior detection, which identifies abnormal access behavior by comparing the current traffic with normal behavior patterns. For example, a user suddenly accesses a large amount of sensitive data in a short period of time, or accesses internal applications from a non-office location. Second, threat intelligence matching, which compares information such as IP addresses and domain names in the traffic data with known threat intelligence databases to detect the presence of known malicious activities. Third, user behavior analysis, which combines multi-dimensional data such as the user's historical access records, authentication methods, and device information to assess the trustworthiness of the user's access behavior.

[0044] In this embodiment of the disclosure, during the operation of the zero-trust network access module, by performing risk assessment on traffic data, the access policy can be adjusted in real time according to the risk, thereby achieving continuous updates of the access policy, adapting to the dynamic changes of the cloud-native environment, and improving the security protection capability of the cloud-native environment.

[0045] According to the zero-trust network access control method provided in this disclosure, a zero-trust network access policy is adopted and executed as a sidecar service mounted in the cloud-native environment. It does not rely on a fixed network boundary and is more in line with the dynamic nature of the cloud-native architecture. During the application process, the access policy is continuously updated and the identity information of the access object is continuously verified with the new policy to cope with the frequent changes of cloud-native environment instances and access, and to continuously maintain the security and controllability of the cloud-native environment.

[0046] Figure 2 A flowchart illustrating target object authentication according to an embodiment of this disclosure is shown schematically.

[0047] like Figure 2 As shown, according to operation S210, the identity verification process of the target object in this embodiment of the present disclosure includes: when a user accesses the cloud-native environment, the user's identity is verified through the zero-trust network access module mounted on the sidecar service of the cloud-native environment. Before verification, the authorization policy library needs to be authorized, and the access policy matching the user's identity information is obtained from the policy library; the user's access behavior is verified based on the access policy to determine whether it is normal. When the user's behavior is verified to be normal, the user is allowed to access the target application and obtain the target resources. When the user's behavior is abnormal, the user's access request is rejected.

[0048] In operation S211, an access policy matching the identity information of the target object is obtained, and the access policy is used to verify the target object's permission to access the target application, including S2111~S2113.

[0049] In operation S2111, the identity information of the target object is matched with the access policies in the preset access policy library to obtain the access policy that matches the identity information of the target object.

[0050] In operation S2111, the target object's identity information may include, but is not limited to, username, password, digital certificate, biometrics (such as fingerprints, facial recognition), and possibly IP address or device identifier. The Zero Trust Network Access Module performs a thorough match of this detailed information against a pre-defined access policy library. The access policy library is a predefined, structured collection containing access permission rules set for different user roles, user groups, or specific users. These rules may be based on factors such as time (e.g., access during working hours), location (e.g., access only allowed from the company's internal network), resource type (e.g., read-only access or full access), and specific operational behaviors (e.g., data modification permissions). Through complex logical judgments and conditional matching, the Zero Trust Network Access Module can accurately identify access policies that fully or partially match the target object's identity information.

[0051] In operation S2112, verify whether the access behavior of the target object conforms to the access policy.

[0052] The Zero Trust Network Access Module rigorously verifies the actual access behavior of the target object based on the matched access policy. This step not only checks whether the user is attempting to access authorized resources but also involves a compliance review of the access method. For example, if the access policy requires that certain types of data must be transmitted through an encrypted channel, the Zero Trust Network Access Module will verify whether the current access meets this security requirement. Furthermore, the Zero Trust Network Access Module monitors and records access behavior for subsequent auditing and tracing. Through real-time behavioral analysis technology, the Zero Trust Network Access Module can quickly identify abnormal or potential violations, such as attempting to access unauthorized resources or using illegal means to bypass security controls.

[0053] In operation S2113, when the access behavior of the target object conforms to the access policy, it is determined that the target object has the permission to access the target application.

[0054] In operation S2113, once the Zero Trust Network Access Module confirms that the target object's access behavior fully complies with the matching access policy, it immediately grants the target object the corresponding access permissions, allowing it to access the target application or resource. This process may be automated, requiring no manual intervention, greatly improving the efficiency of the Zero Trust Network Access Module and the user experience. Simultaneously, the Zero Trust Network Access Module generates detailed access logs, recording the time, method, resource details, and any related security events, providing strong support for subsequent security audits and compliance checks.

[0055] Figure 3 A flowchart illustrating a deployment strategy according to an embodiment of this disclosure is shown schematically.

[0056] like Figure 3 As shown in this embodiment of the disclosure, before authenticating the target object based on the zero-trust network access module, the method further includes deploying a policy library, specifically including S310~S340.

[0057] When operating S310, monitor the service network topology of the target application and extract traffic data from the service network topology.

[0058] Network monitoring technologies, such as network traffic analysis, service discovery protocol (such as Consul and Eureka) monitoring, and API gateway log collection, can be used to comprehensively monitor the service network topology of the target application. This process involves not only identifying dependencies, communication protocols, and port information between application services, but also real-time capture and recording of network traffic. The zero-trust network access module uses intelligent algorithms to parse data packets in network traffic and extract key information, such as source IP, destination IP, port number, request timestamp, request type (HTTP, HTTPS, TCP, UDP, etc.), and possible payload content (such as JSON and XML data).

[0059] In operation S320, the identity information of the target object is extracted based on traffic data, and an initial access policy for the identity information is generated. The initial access policy characterizes the behavioral characteristics of the target object when accessing the target application.

[0060] Zero-trust network access modules utilize technologies such as machine learning, data mining, or rule engines to extract the identity information of target objects from network traffic data. This information may be hidden in HTTP request headers, session tokens, cookies, or digital certificates and keys transmitted over encrypted channels. Once the identity information is accurately identified, the zero-trust network access module automatically generates an initial access policy based on this information and preset access control rules. The initial access policy not only characterizes the basic access permissions of the target object but also records in detail its behavioral characteristics when accessing the target application, such as access frequency, access time period, and types of resources accessed.

[0061] Extracting identity information from traffic data can involve the following steps: Analyzing traffic data for information such as device type, operating system, and browser version generates a unique device fingerprint; observing the target's behavioral patterns during access, such as request frequency, access time, and access path, serves as one basis for identifying the target; if the traffic data contains authentication information (such as username, password hash, digital certificate, etc.), it can be directly used to verify the target's identity; after identifying the target's identity, the zero-trust network architecture generates initial access policies based on its behavioral characteristics. These policies aim to restrict the target's access to the target application and ensure that only legitimate and trusted access requests are allowed. Initial access policies may include the following aspects: assigning appropriate access permissions based on the target's identity and role (e.g., ordinary users may only be able to access some public information, while administrators can access all sensitive data); setting time periods during which the target can access the target application (e.g., prohibiting access to sensitive data outside of working hours); restricting access permissions based on the target's geographical location (e.g., only allowing access to sensitive applications from the company's internal network); and session management: monitoring the target's session activity and automatically revoking access permissions when the session ends. This helps prevent security threats such as session hijacking.

[0062] When operating S330, the target object is simulated to access the target object based on the initial access policy, and a risk assessment is performed on this simulated access behavior.

[0063] Using virtualization or containerization technologies, a simulated environment similar to the target application environment is created. Then, based on the initial access policy, the zero-trust network access module simulates the target object's access behavior in this environment. During the simulation, the zero-trust network access module records every access operation, requested data, returned results, and any potential anomalies or violations in detail. Through a built-in risk assessment model, the zero-trust network access module comprehensively evaluates these simulated access behaviors, identifying potential security risks, performance bottlenecks, or compliance issues.

[0064] In operation S340, the initial access policy is adjusted based on the risk assessment results to obtain an access policy that matches the identity information of the target object.

[0065] Based on the risk assessment results during S330 operations, the Zero Trust Network Access Module adjusts the initial access policy automatically or with manual intervention. This process may involve adding additional security controls (such as multi-factor authentication and IP whitelisting), restricting access to specific resources, and adjusting access frequency limits. Through fine-tuning, the Zero Trust Network Access Module can ensure that the access policy meets both business needs and security compliance requirements, while minimizing potential security risks.

[0066] The above method simulates user access processes tailored to the characteristics of cloud-native environments, generating initial access policies based on traffic data generated by these simulated user accesses. First, the zero-trust network access module creates a series of virtual or test users based on the architecture and deployment of the cloud-native application. Then, these users perform access operations in the simulated cloud-native environment according to preset access scenarios and processes. The zero-trust network access module records and collects all data generated during these simulated accesses, including request information, response data, and log records, serving as a crucial basis for generating the initial access policy. Through in-depth analysis of the access simulation data, the zero-trust network access module can more accurately understand user behavior patterns in the cloud-native environment, thereby formulating more realistic access control policies. If the initial access policy carries too high a risk, the policy can be adjusted to reduce the risk; if the risk of the access policy is within acceptable limits, the access policy can be deployed in the policy library.

[0067] In order to address the risks that arise during the operation of the zero-trust network access module, this disclosure also proposes a method for continuously optimizing the access strategy.

[0068] Figure 4 A flowchart illustrating continuous risk assessment and strategy optimization according to embodiments of this disclosure is shown.

[0069] like Figure 4 As shown, in operation S220, traffic data of the target application is extracted, risk assessment is performed based on the traffic data, and access strategy of the target object is optimized based on the risk assessment results, including S221~S223.

[0070] In operation S221, traffic data of the target application is obtained, and traffic characteristics of the traffic data are extracted. The traffic characteristics include at least the identity information of the target object, which is used to assess risks and match the access policies of the target object.

[0071] To obtain comprehensive and accurate traffic data for the target application, first ensure that network monitoring tools are correctly deployed on critical network nodes, such as firewalls, gateways, or server entry points. This data is collected using real-time capture techniques (such as network packet capture), covering all network communications entering and leaving the target application. Next, advanced data parsing techniques (such as regular expression matching and protocol parsing libraries) are used to perform deep analysis on the captured traffic data to extract rich traffic features. These traffic features include at least elements such as target identity, request content, and CONTEXT.

[0072] Traffic characteristics should also include at least the following aspects: traffic size and rate, used to analyze the total amount of data transmitted per unit time and the rate changes, and to identify abnormal traffic patterns; packet characteristics, including packet length, type (such as TCP, UDP, ICMP, etc.), and protocol details (such as HTTP request methods, URLs, etc.), used to identify potential security threats or malicious behavior; session behavior: tracking session duration, request frequency, response status codes, etc., to assess the normality or abnormality of access patterns; geographic location information, resolving the geographic location of the request source through IP address, used to assist in analyzing the rationality of access behavior; timestamps and periodicity, used to record the specific time of traffic occurrence, analyze the trend of traffic changes over time, and identify periodic or sudden abnormal traffic. After extracting these traffic characteristics, preprocessing is performed using machine learning or statistical models, such as normalization and feature selection, to improve the efficiency and accuracy of subsequent analysis.

[0073] In operation S222, risk assessment is performed based on traffic characteristics to obtain a risk score.

[0074] In this embodiment of the disclosure, traffic characteristics mainly include the degree of identity trust and content sensitivity. Risk assessment can calculate a risk score based on factors such as the degree of identity trust and content sensitivity, including S2221~S2222.

[0075] In operation S2221, the trust level of identity information and the sensitivity of content of traffic features are evaluated. The trust level of identity information represents the proportion of credible behavior of the identity information included in the traffic features in historical access behavior, and the sensitivity of content represents the compliance level of the traffic features.

[0076] In this embodiment of the disclosure, the trust weight corresponding to the identity type can be obtained by identifying the identity type of the identity information included in the traffic features; the trust level of the identity information can be calculated based on the score of the historical access behavior of the identity type and the trust weight; sensitive features in the traffic features can be identified and the semantics of the traffic data in which the sensitive features are located can be analyzed; and a level evaluation can be performed based on the semantics of the sensitive features to obtain the content sensitivity.

[0077] In operation S2222, a risk score is obtained by weighting the degree of trust in identity information and the sensitivity of content.

[0078] In this embodiment of the disclosure, the risk score is calculated as follows:

[0079] Risk score R = α * Identity credibility impact factor + β * Content sensitivity impact factor;

[0080] Here, α and β are weighting coefficients, representing the importance of each factor.

[0081] In operation S223, the policy parameters of the access policy are adjusted based on the risk score to reduce the risk score, thereby obtaining an optimized access policy.

[0082] The policy parameters of access policies are dynamically adjusted based on risk scores, including but not limited to: adjusting access permissions, restricting or downgrading access permissions for high-risk objects to reduce potential damage; enhancing authentication and authorization, requiring high-risk objects to perform stricter identity verification or secondary authorization; traffic limiting, implementing rate or bandwidth limits on high-risk traffic to prevent resource exhaustion or DDoS attacks; isolation and monitoring, placing high-risk objects in isolated environments and strengthening the monitoring and auditing of their activities; and automated response, setting thresholds to automatically trigger security incident response processes once the risk score exceeds a predetermined level, such as notifying administrators, logging, and executing preset security measures. Through this series of operations, not only can the risks faced by target applications be effectively reduced, but access policies can also be continuously optimized based on real-time conditions to improve the overall level of security protection.

[0083] In this embodiment, the zero-trust model significantly enhances security capabilities. By default distrusting any internal or external entities, it effectively reduces internal threats and avoids potential security vulnerabilities in trusted roles, thereby ensuring the security of the cloud environment. Furthermore, this model exhibits strong adaptability; access policies automatically adjust as cloud applications change, while remaining compatible with various cloud-native frameworks without requiring application code modifications, greatly simplifying cloud environment operation and management. At the control level, the zero-trust model achieves fine-grained access management unmatched by traditional network perimeter protection, penetrating access control into applications and services to ensure precise control over resource access. More importantly, it not only relies on perimeter protection but also identifies and responds to potential threats internally; risk-driven adaptive access policies further enhance the continuity and effectiveness of defense. Finally, this model complies with data compliance and cybersecurity regulations, helping enterprises enjoy the convenience of the cloud environment while ensuring the legality and compliance of their business operations.

[0084] Based on the above-described zero-trust network access control method, this disclosure also provides a zero-trust network access control device. The following will be combined with... Figure 5 The device is described in detail.

[0085] Figure 5 A schematic block diagram of a zero-trust network access control device according to an embodiment of the present disclosure is shown.

[0086] like Figure 5 As shown, the zero-trust network access control device 500 of this embodiment includes an access receiving module 510 and a policy optimization module 520.

[0087] The access receiving module 510 is used to authenticate the target object based on the zero-trust network access module in response to the target object accessing the target application in the cloud-native environment. In one embodiment, the access receiving module 510 can be used to perform the operation S210 described above, which will not be repeated here. The zero-trust network access module is integrated into the cloud-native environment as a sidecar service.

[0088] The access receiving module 510 includes an authentication unit 511 and a resource acquisition unit 512.

[0089] The authentication unit 511 is used to obtain the access policy that matches the identity information of the target object, and to verify the target object's permission to access the target application based on the access policy.

[0090] The resource acquisition unit 512 is used to acquire the target application's target resources from the cloud-native environment and return them to the target object when the target object's permission verification is successful.

[0091] The policy optimization module 520 is used to extract traffic data of the target application during the operation of the zero-trust network access module, perform risk assessment based on the traffic data, and optimize the access policy of the target object based on the risk assessment results. In one embodiment, the policy optimization module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0092] According to embodiments of this disclosure, any plurality of modules in the access receiving module 510 and the policy optimization module 520 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules may be combined with at least a portion of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the access receiving module 510 and the policy optimization module 520 may be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the access receiving module 510 and the policy optimization module 520 may be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0093] Figure 6 A block diagram of an electronic device suitable for implementing a zero-trust network access control method according to an embodiment of the present disclosure is shown schematically.

[0094] like Figure 6 As shown, an electronic device 600 according to an embodiment of this disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this disclosure.

[0095] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 602 and / or RAM 603. It should be noted that programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0096] According to embodiments of this disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0097] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0098] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0099] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the zero-trust network access control method provided in embodiments of this disclosure.

[0100] When the computer program is executed by the processor 601, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0101] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0102] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0103] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0104] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0105] Those skilled in the art will understand that the features described in the various embodiments of this disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments of this disclosure can be combined and / or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0106] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A zero-trust network access control method, characterized in that, The method includes: In response to a target object accessing a target application in a cloud-native environment, the target object is authenticated based on the zero-trust network access module, including: Obtain an access policy that matches the identity information of the target object, and verify the target object's permission to access the target application based on the access policy; When the permission verification of the target object is successful, the target resource of the target application is obtained from the cloud-native environment and returned to the target object; The zero-trust network access module is integrated into the cloud-native environment as a sidecar service. During the operation of the zero-trust network access module, the method includes: Traffic data of the target application is extracted, a risk assessment is performed based on the traffic data, and the access strategy of the target object is optimized based on the risk assessment results. The risk assessment results include a risk score, and the method for obtaining the risk score includes: The trust level of identity information and the sensitivity of content of the traffic features of the traffic data are evaluated. The trust level of identity information represents the proportion of credible behavior of the identity information included in the traffic features in historical access behavior, and the sensitivity of content represents the compliance level of the traffic features. The risk score is obtained by weighting the trust level of the identity information and the sensitivity of the content.

2. The method according to claim 1, characterized in that, Before authenticating the target object based on the zero-trust network access module, the method further includes: Monitor the service network topology of the target application and extract traffic data from the service network topology; Based on the traffic data, the identity information of the target object is extracted and executed, and an initial access policy for the identity information is generated. The initial access policy characterizes the behavioral features of the target object when accessing the target application. Based on the initial access strategy, the target object is simulated to access the target object, and a risk assessment is performed on this simulated access behavior; The initial access strategy is adjusted based on the risk assessment results to obtain an access strategy that matches the identity information of the target object.

3. The method according to claim 1, characterized in that, The step of obtaining an access policy that matches the identity information of the target object, and verifying the target object's permission to access the target application based on the access policy, includes: Based on the identity information of the target object, the access policies in the preset access policy library are matched to obtain the access policy that matches the identity information of the target object; Verify whether the access behavior of the target object conforms to the access policy; When the access behavior of the target object conforms to the access policy, it is determined that the target object has the permission to access the target application.

4. The method according to claim 1, characterized in that, The steps of extracting traffic data from the target application, performing risk assessment based on the traffic data, and optimizing the access strategy for the target object based on the risk assessment results include: Obtain traffic data of the target application, extract traffic features from the traffic data, the traffic features including at least the identity information of the target object, for assessing risk and matching the access policy of the target object; Risk assessment is performed based on the aforementioned traffic characteristics to obtain a risk score; The access strategy parameters are adjusted based on the risk score to reduce the risk score, thereby obtaining an optimized access strategy.

5. The method according to claim 1, characterized in that, The assessment of the trust level of identity information and content sensitivity of the traffic characteristics includes: Identify the identity type of the identity information included in the traffic characteristics, and obtain the trust weight corresponding to the identity type; The trust level of the identity information is calculated based on the score of the historical access behavior of the identity type and the trust weight; Identify sensitive features among the traffic characteristics and analyze the semantics of the traffic data containing the sensitive features; The content sensitivity is obtained by performing a level evaluation based on the semantics of the aforementioned sensitive features.

6. A zero-trust network access control device, characterized in that, The device includes: The access receiving module is used to respond to a target object's access to a target application in a cloud-native environment. Based on the zero-trust network access module, it performs identity authentication on the target object, including: An authentication unit is used to obtain an access policy that matches the identity information of the target object, and to verify the target object's permission to access the target application based on the access policy. The resource acquisition unit is used to acquire the target application's target resources from the cloud-native environment and return them to the target object when the target object's permission verification is passed. The strategy optimization module is used to extract traffic data of the target application during the operation of the zero-trust network access module, perform risk assessment based on the traffic data, and optimize the access policy of the target object based on the risk assessment results. The risk assessment results include a risk score, and the method for obtaining the risk score includes: The trust level of identity information and the sensitivity of content of the traffic features of the traffic data are evaluated. The trust level of identity information represents the proportion of credible behavior of the identity information included in the traffic features in historical access behavior, and the sensitivity of content represents the compliance level of the traffic features. The risk score is obtained by weighting the trust level of the identity information and the sensitivity of the content. The zero-trust network access module is integrated into the cloud-native environment as a sidecar service.

7. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 5.

Images