Security service product opening method based on zero trust

Abstract

The invention relates to the field of infrastructure and IT support, security, transmission and bearing, in particular to a zero-trust-based security service product opening method, which comprises the following steps of: receiving zero-trust product service data, and finishing service acceptance; an optimal routing strategy is searched through an ant colony algorithm, IP address resource data is allocated by adopting a self-adaptive dichotomy, and scheme design is completed based on zero-trust product service data; the zero-trust service capability gateway completes resource opening configuration according to an automatic design scheme; terminal simulation service verification is completed; and archiving, storing and archiving configuration data, scheme design and implementation steps in the whole opening process. The invention provides a set of online standardized process support service system, which realizes online real-time distribution, receiving, arrangement and analysis of business data and resource data, schedules, arranges and enables various resources and capabilities, and achieves the purpose of agile distribution of businesses.

Description

Technical Field

[0001] The present invention belongs to the fields of infrastructure and IT support, security, transmission and bearing, and specifically relates to a method for activating a security service product based on zero trust. Background Art

[0002] In recent years, with the application of information and digital technologies such as artificial intelligence, cloud computing, big data, the Internet of Things, and blockchain, a new generation of scientific and technological revolution and industrial revolution has begun to emerge in all walks of life. However, with the in-depth development of digital transformation, enterprises have moved from closed to open, and security issues have emerged in an endless stream. Traditional security protection methods can no longer meet the information and data security needs brought about by digitalization.

[0003] In order to cope with the ever-changing network security threats, a new security service model - zero-trust security service has emerged. Zero-trust security, also known as "immediate countermeasures", mainly refers to not trusting anyone and any device in the network, and requires strict authentication, authorization and access control for each request to protect network security. Zero-trust security services rely on the development of cloud, network, security, AI, and big data technologies to improve the overall security of information systems and networks, and have broad application prospects.

[0004] The emergence of zero-trust security services also means that network applications are more flexible and diverse, and there are higher requirements for business processing, networking solution design, resource deployment, intelligent scheduling, and automated operation and maintenance of zero-trust security service products. At present, the demand for zero-trust security service products is gradually pouring in. Business opening and deployment are all based on traditional network technology. There are a large number of manual processing nodes, which mainly rely on offline manual design of networking, solution confirmation, and data production. The offline process involves negotiation and communication between account managers, multiple professional departments (product groups, resource groups, professional offices), and zero-trust software manufacturers, deployment and debugging, and there are many manual processing nodes. The accuracy of data processing is not high, and the overall construction cycle is long.

[0005] With the rapid development of zero-trust-based security products, the requirements for related business activation processes are more flexible and diverse, and there are very high requirements for rapid product activation and delivery, intelligent scheduling, etc. The existing activation model has the following problems:

[0006] 1. No online process, manual offline communication and processing are required, which is time-consuming;

[0007] The traditional zero-trust security service product activation process is as follows:

[0008] 1) The account manager applies for product ordering and network resources offline;

[0009] 2) After the application is approved, the support department coordinates with the manufacturer to implement the instantiation, activation and deployment of zero-trust resources;

[0010] 3) After deployment, notify the core network and cloud private network professional departments offline to perform docking and debugging.

[0011] This activation model involves a large number of manual offline processing steps and lacks online standardized process support. Business work orders are time-consuming and the process is cumbersome, making it impossible to achieve the purpose of rapid activation.

[0012] 2. Parameter settings during the activation process need to be manually determined, which is inefficient.

[0013] During the activation of traditional zero-trust security service products, various types of related data need to be manually sorted out, and the values ​​of dynamic parameters such as routing and IP resources are filled in and reviewed based on personnel experience. The processing time is long, and it is impossible to efficiently support network service operations and the automated activation of computing domain capabilities, making it difficult to achieve efficient, agile, and flexible business delivery.

[0014] In addition, zero-trust security services require multiple security authentications for the operations of each access device, and have high requirements for the efficiency of routing and IP address allocation.

[0015] Therefore, it is urgent to build an end-to-end activation system for zero-trust security service products to achieve the transformation and upgrade from offline traditional mode configuration to online automatic activation. At the same time, in the activation process, the ant colony algorithm and adaptive dichotomy are combined to realize the routing strategy generation and IP resource allocation of security service activation scenarios, effectively improving data configuration efficiency. Summary of the invention

[0016] In order to transform the original cumbersome traditional mode of zero-trust security service product activation into an online end-to-end product support process, and provide business acceptance, solution design, zero-trust resource activation configuration, business verification, work order archiving and other functions, and support the optimal routing strategy selection and IP resource dynamic allocation capabilities, the present invention provides a method based on the zero-trust security service product activation process, the method includes:

[0017] Receiving zero-trust product business data, wherein the zero-trust product business data includes a zero-trust networking mode and an access control policy;

[0018] Design the topological structure of security service product deployment based on the zero-trust networking mode, design a dynamic routing strategy through the ant colony algorithm, allocate the service flow and authentication flow of user access control during product activation and security authentication, use the adaptive dichotomy method to dynamically allocate the IP address resource data of access devices and zero-trust service gateways in real time, and adjust the update rule of pheromone concentration in the ant colony algorithm based on the result of IP address resource allocation;

[0019] The zero-trust service gateway connects various devices required for the security service product according to the topology structure, and completes zero-trust resource instance configuration and product deployment based on the access control policy;

[0020] After the zero-trust resource instance is activated and configured, terminal verification is initiated, and traffic data is extracted from the zero-trust service capability gateway for analysis. The authentication traffic and business traffic are extracted. If both have normal traffic information, the activation is considered successful.

[0021] The method of finding the optimal routing strategy by using the ant colony algorithm includes:

[0022] Initialize the paths between the communication nodes of the zero-trust security service through node broadcast information;

[0023] Calculate the probability according to the state transition rule, select the next node based on the probability, and gradually build a complete path from the source node to the destination node;

[0024] After the network node position is adjusted, the pheromone level and node position information in the pheromone list are updated;

[0025] Repeat the path selection and pheromone update steps until the preset conditions of the optimal strategy are met, and output the path with the highest pheromone concentration as the optimal routing strategy.

[0026] The method of allocating IP address resource data by using the adaptive binary method includes:

[0027] Determine the address range that needs to be allocated and create an available address pool to record address occupancy;

[0028] Use the entire address range as the initial search interval, calculate the midpoint address, and search for unoccupied sub-intervals;

[0029] When the search interval is narrowed down to only one address, it is determined whether the address is occupied. If not, it is allocated and marked as occupied in the available address pool.

[0030] Allocate the required number of IP addresses within the determined IP address range and record the allocation results in the available address pool;

[0031] According to network requirements, the allocated IP addresses are dynamically adjusted, and unused IP address resources are recovered through adaptive binary search and reintegrated into the available address pool.

[0032] The receiving of zero-trust product business data includes:

[0033] Based on the message notification mechanism, zero-trust product business data is received in real time, and nginx is used to balance the load.

[0034] The authentication traffic is obtained by filtering the source address and destination address sent from the terminal to the zero trust controller, and the business traffic is identified from the zero trust proxy gateway message.

[0035] After the zero-trust security service product is activated, the product instance and resource instance data will be associated, and the cloud private network interconnection data will be stored uniformly to facilitate rapid location of the root cause of the problem, identification of potential security incidents, and automated operation and maintenance.

[0036] The update rule for adjusting the pheromone concentration in the ant colony algorithm based on the result of IP address resource allocation includes:

[0037] Calculate the IP address resource utilization of each micro-segment;

[0038] Set feedback factors based on the utilization of IP address resources;

[0039] The pheromone concentration of each path is adjusted based on the IP address resource utilization.

[0040] The present invention has the following advantages:

[0041] 1. The present invention provides a set of online standardized process support service systems to realize the online real-time distribution, reception, arrangement and analysis of business data and resource data, and to schedule, arrange and enable various resources and capabilities to achieve the purpose of agile business release.

[0042] 2. The present invention processes a large amount of zero-trust security service work order data in real time, and combines the ant colony algorithm and adaptive dichotomy to support the automatic execution of routing strategy generation and resource allocation for various business scenarios, supports the rapid distribution of configuration data, and effectively improves the accuracy of configuration data and significantly reduces the activation time. By dynamically allocating traffic and IP addresses, it can quickly respond to the security authentication of access devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A flowchart of a method for activating a zero-trust security service product provided by an embodiment of the present invention;

[0044] Figure 2 A schematic diagram of an ant colony algorithm for a method for activating a zero-trust security service product provided in an embodiment of the present invention;

[0045] Figure 3 A framework diagram of a zero-trust-based security service product activation system provided in one embodiment of the present invention. DETAILED DESCRIPTION

[0046] The best mode of implementation of the present invention is described below by way of example. It should be understood that the specific embodiments herein are used to explain the present invention in detail and should not be construed as limiting the present invention. It should be noted that various changes and modifications may be made under the premise of following the principles and core scope of the present invention, and these changes should all be deemed to be within the scope of protection of the present invention. In conjunction with the accompanying drawings, the specific implementation steps of the present invention are described in detail.

[0047] The zero-trust security service product activation method refers to a series of steps and processes that need to be followed when deploying and activating a trust security service product in a zero-trust architecture. This process ensures the successful configuration of the service and that all security policies and functions are functioning properly.

[0048] The method for activating a zero-trust security service product provided by the present invention includes:

[0049] Step 1: Receive zero-trust product business data and complete business acceptance;

[0050] Based on the message notification mechanism, zero-trust product business data is received in real time, and nginx load balancing is used. The main purpose of load balancing is to evenly distribute client requests to multiple servers (back-end servers) to avoid overloading a single server, thereby improving the reliability and response speed of the system, and handling high-concurrency requests while maintaining efficient services.

[0051] In a specific embodiment, the data accepted by the business includes product instance identification, group customer information, package number, zero-trust networking mode (software delivery, sensed authentication including cloud hosts, senseless authentication including cloud hosts), PaaS domain resource pool information, number of orders, number of user accesses, etc.

[0052] Step 2: Design the topological structure of security service product deployment based on the zero-trust networking mode, design a dynamic routing strategy through the ant colony algorithm, allocate business traffic and authentication traffic for user access control during product activation and security authentication, and use adaptive dichotomy to dynamically allocate IP address resource data of access devices and zero-trust service gateways in real time. Adjust the update rules of pheromone concentration in the ant colony algorithm based on the results of IP address resource allocation.

[0053] Define dynamic access control policies based on product instance identification, group customer information, package number, zero-trust networking mode, PaaS domain resource pool information, number of orders, number of user accesses, etc. in the zero-trust product business data.

[0054] Determine the location and connection relationships of the core components in the zero trust framework, including the zero trust service gateway, authentication server, resource pool, data storage, etc.

[0055] According to the network segmentation and isolation strategy, the network is divided into different areas (such as secure area, unsafe area, isolation area, etc.), and the connection method between them is designed.

[0056] In the zero-trust security service activation scenario, all terminal access requests are directed to the core network through virtual tunnels and all need to undergo zero-trust authentication. Through the automated design of networking solutions, authentication strategies can be applied quickly and accurately, and dynamically adjusted according to actual operating conditions to ensure the effectiveness and sustainability of the entire zero-trust security framework. However, in the zero-trust authentication process, there is an inherent conflict between authentication traffic and business process routing.

[0057] Authentication traffic refers to traffic for user identity authentication in networks and information systems. Its main purpose is to ensure that only authorized users or devices can access system resources. Business process routing involves path selection and processing of business data and transactions in information systems to optimize system performance and resource utilization.

[0058] Authentication traffic consumes network bandwidth and computing resources for encryption, decryption, and identity authentication. Business process routing also requires network bandwidth and computing resources for data transmission and load balancing. When resources are limited, authentication traffic and business process routing may compete for the same network bandwidth and computing resources, affecting system performance.

[0059] In the present invention, the ant colony algorithm is used to find the optimal routing strategy and the adaptive binary method is used to allocate IP address resource data. The optimal routing strategy found by the ant colony algorithm ensures efficient routing of business processes while taking into account the special needs of authentication traffic. When allocating IP address resources, the adaptive binary method can be dynamically adjusted according to changes in the routing strategy to ensure that both authentication traffic and business traffic can obtain appropriate resource configuration.

[0060] In a specific embodiment, the steps include:

[0061] 2.1 Generate the optimal network topology by analyzing the zero-trust networking mode, including the arrangement and connection methods of nodes (such as routers, switches, and servers). Automatically generate configuration files for each device based on predefined configuration templates, such as IP addresses, routing policies, security policies, etc. In the zero-trust architecture, the network is broken down into micro-segments, each of which has its own independent security boundary and IP address space.

[0062] 2.2 Find the optimal routing strategy through ant colony algorithm;

[0063] Ant Colony Optimization (ACO) is a heuristic algorithm that simulates the behavior of ant colonies and is used to solve combinatorial optimization problems. The ACO finds the optimal solution to the problem by simulating the behavior of ants releasing pheromones in the process of searching for food.

[0064] In a specific embodiment, the steps include:

[0065] 2.2.1 Initialize the paths between the communication nodes of the zero-trust security service through node broadcast information;

[0066] In a specific embodiment, the paths between the communication nodes of the zero-trust security service are initialized, and the initialization information is quickly transmitted to all nodes through node broadcast information. The nodes, pheromone concentrations and link information of the ant colony algorithm are initialized, and these nodes correspond to the various micro-segments in the zero-trust architecture.

[0067] The broadcast data frame format includes ID, Position_x, Position_y, source node / destination node information and sending sequence.

[0068] ID indicates the different ID assigned to each node; Positiony indicates the position coordinates (x, y) of each node when the zero-trust security service is activated; the source node / destination node information indicates the sending status of the node. If the node has a demand for sending traffic data, this field is set to 1, and the destination node field is set to the destination node ID, and the sending sequence is numbered in the sending sequence field; if there is no demand for sending data, this field is set to 0.

[0069] 2.2.2 Calculate the probability according to the state transition rule, select the next node based on the probability, and gradually build a complete path from the source node to the destination node;

[0070] The state transfer rule determines the probability of the source node selecting the next node. Let the distance between the source node and the destination node address of the zero-trust security service process be d. xy , The pheromone concentration on the path between the source node and the destination node can represent the quality of each path in the zero-trust security service network, such as load and bandwidth. The path with higher pheromone concentration is often a path with lighter load, wider bandwidth and lower latency, and is therefore considered to be the preferred path. This is just like ants choosing paths with high pheromone concentrations. When the network is making routing selections, it will also give priority to paths with high pheromone concentrations to optimize network performance. represents the probability of the kth ant going from node x to node y.

[0071]

[0072] where ηxy It is a heuristic function, which represents the expected degree from x to y, usually taking the inverse of the distance between x and y. z represents the set of next nodes that can be selected at node x.

[0073] In a specific embodiment, the ant randomly selects the next node to move to based on the calculated probability.

[0074] Record the nodes that have been visited to prevent ants from going back and forming a loop.

[0075] When the ant reaches the destination node, the path is constructed and saved as a candidate solution in this iteration.

[0076] Among them, each process communication node maintains its own pheromone list, which contains the pheromone concentration of the current node and the distance from other nodes at this moment, including: pheromone concentration, Position_x, Position_y, neighbor node list and distance list.

[0077] The pheromone concentration represents the quality of each path in the zero-trust security service network, Position_x and Position_y represent the node position coordinates, the neighbor node list represents the adjacent nodes of the current node, and the distance list represents the distance between the current node and the adjacent nodes.

[0078] 2.2.3 After the network node position is adjusted, the pheromone level and node position information in the pheromone list are updated;

[0079] After all ants have completed the path construction, they update the pheromone according to the quality of the path (usually path length, load, delay, etc.). The pheromone update includes two steps:

[0080] ① Pheromone volatilization: To prevent the paths discovered early from excessively influencing subsequent choices, a pheromone volatilization mechanism is usually set up, that is, the pheromone concentration on all paths is weakened in each iteration to simulate the natural volatilization process of pheromones.

[0081] ②Pheromone release: Ants on high-quality paths will release more pheromones on the path they pass through to increase the probability of the path being selected in subsequent iterations.

[0082] In a specific embodiment, when the network node position is adjusted, the pheromone concentration and node position information in the pheromone list are updated through pheromone volatilization and pheromone release, and the number of iterations is accumulated.

[0083] 2.2.4 Repeat the path selection and pheromone update steps until the preset conditions of the optimal strategy are met, and output the path with the highest pheromone concentration as the optimal routing strategy.

[0084] In a specific embodiment, when the number of iterations reaches a preset maximum value, or the quality of the optimal path found no longer significantly improves, it can be considered that convergence has occurred. From all the paths generated during the iterations, a path with the highest pheromone concentration or the best path quality is selected as the final optimal routing strategy.

[0085] The ant colony algorithm optimizes the routing selection process and continuously updates the routing selection rules to obtain the optimal routing strategy. It can help the zero-trust security service network to perform adaptive routing selection in a load environment, allocate business traffic and authentication traffic for user access control during product activation and security authentication, improve network performance, reduce latency and congestion, and achieve efficient data transmission and network performance optimization.

[0086] 2.3 Adopting adaptive binary method to allocate IP address resource data:

[0087] In a zero-trust architecture, since user and device authentication is dynamic and context-based, IP address allocation also needs to be flexible and accurate. Adaptive dichotomy can dynamically adjust the IP address allocation strategy based on the current network status and needs, making it more adaptable to complex and changing network environments.

[0088] Adaptive binary search is a search algorithm used to find values ​​that meet conditions in a continuous interval. The core idea is to gradually narrow the search interval and continue searching only in the interval that is not excluded. Compared with the ordinary binary search, the adaptive binary search will dynamically adjust the size and search range of the search interval according to the length of the current search interval and the changes in known conditions, so as to find the value that meets the conditions as quickly as possible.

[0089] The adaptive IP address allocation method will decompose the customer's address application according to the power of 2, and perform the best adaptation of the idle blocks in the order of the decomposed blocks from large to small, thereby resolving the contradiction between address utilization and aggregation. If the allocatable idle address block can meet the user's application, the address space will be divided at this position to meet the user's address allocation request.

[0090] When each allocatable free address block cannot satisfy the user's request, but the total amount can still satisfy the address allocation request, the following method is adopted to split the application: n+1 Perform a power decomposition of 2:

[0091] A n+1 =Σ2 n

[0092] The decomposed components are inserted into the free blocks in descending order. After each successful split and adaptation of a larger address block, the remaining address applications are treated as new applications and a new insertion process is performed.

[0093] In a specific embodiment, the following are the steps of the adaptive binary address allocation IP method:

[0094] 2.3.1 Determine the address range to be allocated and create an available address pool to record the address occupancy;

[0095] Determine the address range that needs to be allocated and create an available address pool to record the address occupancy. Initially, all addresses are idle.

[0096] 2.3.2 Take the entire address range as the initial search interval, calculate the midpoint address, and search for unoccupied sub-intervals;

[0097] The entire address range is used as the initial search interval, including the left boundary and the right boundary. The left boundary L is the starting address of the address range, and the right boundary R is the ending address of the address range.

[0098] Calculate the center point mid = (L + R) / 2, and check whether the addresses before and after mid are occupied. If the address before mid is occupied, it means that the unallocated address is after mid, and update the left boundary L to mid + 1; if the address after mid is occupied, it means that the unallocated address is before mid, and update the right boundary R to mid - 1;

[0099] 2.3.3 When the search interval is narrowed down to only one address, determine whether the address is occupied. If not, allocate it and mark it as occupied in the available address pool;

[0100] 2.3.4: Allocate the required number of IP addresses within the determined IP address range and record the allocation results in the available address pool;

[0101] 2.3.5 Dynamically adjust the allocated IP addresses according to network requirements, recycle unused IP address resources through adaptive binary search and reintegrate them into the available address pool.

[0102] The IP address allocation method based on adaptive binary division can efficiently allocate continuous addresses. The search interval is reduced by half each time the search is performed. The IP address allocation request that is larger than any free address block in the address space is split into powers of 2, avoiding the search of enumerating all addresses. At the same time, this adaptive binary address allocation method has the characteristics of adapting to address allocation needs at different levels, such as being able to make corresponding adjustments based on the number of allocated addresses or continuity requirements.

[0103] The IP address allocation of the zero-trust security service traffic path adopts an adaptive binary search method, which fully improves the utilization rate of the address space while ensuring the aggregation of the address space. In addition, the use of the adaptive binary search method can meet the IP address allocation needs of different scales in each node link of the zero-trust security service authentication / business process, and ensure that IP addresses can be evenly allocated between addresses in different locations and ranges.

[0104] 2.4 Adjust the pheromone update rules according to the IP address resource utilization of each micro-segment.

[0105] Calculate the IP address resource utilization of each micro-segment to examine whether each micro-segment is allocated sufficient but not wasted IP addresses. The utilization rate is measured by the ratio of the number of IP addresses actually used to the number of allocated IP addresses.

[0106]

[0107] The feedback factor is set according to the utilization of IP address resources. For paths with high resource utilization, a positive feedback factor PF is set; for paths with low resource utilization, a negative feedback factor PF is set.

[0108] For the paths with good IP resource allocation effect, increase their pheromone concentration.

[0109] τ new =τ old +PF*Δτ

[0110] For paths with unreasonable resource allocation, reduce their pheromone concentration.

[0111] τ new =τ old -PF*Δτ

[0112] where τ old It represents the current pheromone concentration on the path, reflecting the pheromone value accumulated by the path in the previous round of ant colony algorithm.

[0113] τ new Indicates the pheromone concentration on the path after update (i.e. after the current round ends). This value will be used as the basis for decision-making when ants choose paths in the next round.

[0114] PF stands for Positive Feedback Factor, which reflects the enhancement factor calculated according to the path performance. In a specific embodiment, the feedback factor can be set to 0.3.

[0115] Δτ represents a reference value of the pheromone change amount, and in a specific embodiment, it may be an average value calculated from the pheromone concentrations of all paths.

[0116] 2.5 Path Reselection

[0117] Through multiple rounds of iterations of the ant colony algorithm to optimize path selection and IP address allocation, the global optimal configuration of the entire zero-trust network is gradually achieved.

[0118] Step 3: The zero-trust service gateway connects the various devices required for the security service product according to the topology structure, and completes the zero-trust resource instance configuration and product deployment based on the access control policy;

[0119] When the business data meets the input conditions of the processing program and reaches the specified time, the application processing mechanism will automatically complete the data parsing and conversion processing.

[0120] After the execution is completed, the activation configuration module carries the processed activation data (including customer information, number of user instances, zero-trust instance specifications, zero-trust instance address segment range, cloud private network interconnection IP address, sub-interface, VLAN and zero-trust detailed address segment, etc.) to initiate a zero-trust resource activation configuration request to the zero-trust service capability gateway.

[0121] The zero-trust service capability gateway (which directly manages and controls all internal and external communication traffic) configures the access control policies of various resources (such as servers, databases, application systems, etc.) according to the content of the solution design, and completes operations such as tenant creation, zero-trust resource instance and host resource information configuration, cloud private network PE interconnection data configuration, and edge cloud PaaS domain zero-trust VPC and cloud private network tenant VRF docking data configuration.

[0122] In a specific embodiment, it includes:

[0123] Authentication mechanism configuration: Configure authentication systems, such as multi-factor authentication, single sign-on, etc., to ensure that only authenticated users and devices can access resources.

[0124] Encrypted communication settings: Set up encrypted communication protocols such as TLS / SSL to ensure that all data transmissions are encrypted to prevent data leakage.

[0125] Apply the principle of least privilege: Configure permissions for users and devices to ensure that each entity can access only the minimum resources and data they need.

[0126] In a specific embodiment, after the zero-trust resource instance is activated and configured, terminal verification can also be initiated, and traffic data can be extracted from the zero-trust service capability gateway for analysis, and the authentication traffic and business traffic can be extracted. If both have normal traffic information, the activation is considered successful. The purpose of terminal verification is to ensure that the resource can be accessed normally on the actual terminal device and that all security configurations are valid.

[0127] Among them, authentication traffic refers to the network traffic generated by the identity authentication process between terminal devices and resource instances under the zero trust framework. It includes authentication requests, responses, data exchange during the authentication process, etc., and is filtered and obtained from the source address and destination address sent from the terminal to the zero trust controller; business traffic refers to the traffic generated during the actual business operation process, such as data reading, writing, application requests, etc. These traffic reflect the normal operating status of the system and are identified from the zero trust agent gateway message.

[0128] If during the verification process, both the authentication traffic and the business traffic appear to be normal, then it can be considered that the zero-trust resource instance has been successfully activated and can be put into actual use.

[0129] After resources are activated, use simulated or real terminal devices and users to conduct access tests to verify whether the configured zero-trust policies can be effectively implemented. Ensure that measures such as identity authentication, permission control, and network segmentation function normally in the actual business environment.

[0130] In a specific embodiment, product instance and resource instance data can be associated and stored uniformly with cloud private network interconnection data to quickly locate the root cause of the problem, identify potential security incidents, and automate operation and maintenance.

[0131] After the business verification is passed, the system automatically archives information such as zero-trust product instances, service resource instances, and cloud hosts, and associates product instance and resource instance data, and stores the cloud private network interconnection data pre-allocated by the solution design node in a unified manner. When a problem occurs, the associated data helps quickly locate the root cause of the problem, helps identify potential security incidents, and supports security audits and compliance requirements.

[0132] The zero-trust-based security service product activation system proposed in the present invention includes a configuration module, a terminal and a zero-trust service gateway.

[0133] Among them, the terminal is the device from which the user or application initiates the access request;

[0134] The configuration module is responsible for developing detailed zero-trust solutions based on business needs, configuring access rights, network routing, IP address allocation and other resources for terminals and applications, and ensuring that resources are correctly allocated and configured according to the zero-trust strategy;

[0135] The zero-trust service gateway is responsible for verifying and authorizing access requests from terminals based on the zero-trust policy formulated by the configuration module; analyzing traffic data in real time, extracting authentication traffic and business traffic, blocking unauthorized traffic, and generating access logs to facilitate operation and maintenance audits.

Claims

1. A method for activating a security service product based on zero trust, characterized in that: include: Receiving zero-trust product business data, wherein the zero-trust product business data includes a zero-trust networking mode and an access control policy; Design the topological structure of security service product deployment based on the zero-trust networking mode, design a dynamic routing strategy through the ant colony algorithm, allocate the service flow and authentication flow of user access control during product activation and security authentication, use the adaptive dichotomy method to dynamically allocate the IP address resource data of access devices and zero-trust service gateways in real time, and adjust the update rule of pheromone concentration in the ant colony algorithm based on the result of IP address resource allocation; The zero-trust service gateway connects the various devices required for the security service product according to the topology structure, and completes the zero-trust resource instance configuration and product deployment based on the access control policy.

2. The method according to claim 1, characterized in that: The following steps are also included: After the zero-trust resource instance is activated and configured, terminal verification is initiated, and traffic data is extracted from the zero-trust service capability gateway for analysis. The authentication traffic and business traffic are extracted. If both have normal traffic information, the activation is considered successful.

3. The method according to claim 1, characterized in that: The step of designing a dynamic routing strategy by using an ant colony algorithm specifically includes: Initialize the paths between the communication nodes of the zero-trust security service through node broadcast information; Calculate the probability according to the state transition rule, select the next node based on the probability, and gradually build a complete path from the source node to the destination node; After the network node position is adjusted, the pheromone level and node position information in the pheromone list are updated; Repeat the path selection and pheromone update steps until the preset conditions of the optimal strategy are met, and output the path with the highest pheromone concentration as the optimal routing strategy.

4. The method according to claim 1, characterized in that: The step of dynamically allocating IP address resource data of access devices and zero-trust service gateways in real time using the adaptive dichotomy method specifically includes: Determine the address range that needs to be allocated and create an available address pool to record address occupancy; Use the entire address range as the initial search interval, calculate the midpoint address, and search for unoccupied sub-intervals; When the search interval is narrowed down to only one address, it is determined whether the address is occupied. If not, it is allocated and marked as occupied in the available address pool. Allocate the required number of IP addresses within the determined IP address range and record the allocation results in the available address pool; According to network requirements, the allocated IP addresses are dynamically adjusted, and unused IP address resources are recovered through adaptive binary search and reintegrated into the available address pool.

5. The method according to claim 1, characterized in that: The step of receiving zero-trust product business data specifically includes: Based on the message notification mechanism, zero-trust product business data is received in real time, and nginx is used to balance the load.

6. The method according to claim 2, characterized in that: The authentication traffic is obtained by filtering the source address and destination address sent from the terminal to the zero trust controller, and the business traffic is identified from the zero trust proxy gateway message.

7. The method according to claim 1, characterized in that: After the zero-trust security service product is activated, the product instance and resource instance data will be associated and stored uniformly with the cloud private network interconnection data.

8. The method according to claim 1, characterized in that: The step of adjusting the updating rule of pheromone concentration in the ant colony algorithm based on the result of IP address resource allocation specifically includes: Calculate the IP address resource utilization of each micro-segment; Set feedback factors based on the utilization of IP address resources; The pheromone concentration of each path is adjusted based on the IP address resource utilization.

Images