Quadruple port hiding method and device based on zero-trust architecture

Abstract

The invention discloses a quadruple port hiding method and device based on a zero-trust architecture, and belongs to the field of computer network security. The quadruple port hiding method comprises a first door knocking operation and a terminal trust evaluation method based on a space-time matrix fusion multi-factor model; performing multiple identity authentication based on trust; knocking a door at a tunnel port; and knocking the service port. According to the invention, a quadruple-port hidden zero-trust access control scheme is adopted, and door knocking is carried out on a zero-trust security management platform, an identity authentication port, a VPN tunnel port in an SDP gateway and a service port, so that comprehensive protection enhancement of user access and service is realized. According to the invention, an additional security layer is added through a quadruple port hiding technology, so that an attacker is difficult to find an effective attack entry point easily; and meanwhile, more refined access control can be realized based on a trust identity authentication mechanism, and a complex network environment can be adapted, so that security vulnerabilities existing in a traditional SPA mechanism are avoided.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer network security, and in particular relates to a quadruple port hiding method and device based on a zero-trust architecture. Background Art

[0002] SPA (Single Packet Authorization) is a lightweight security protocol that uses only a single data packet for access requests. It simplifies the knocking process by integrating all necessary information in a single data packet. Before allowing access to the network, it first verifies the identity of the device and user, thereby achieving "network invisibility" and preventing attackers from finding service addresses and ports. Compared with the traditional TCP protocol, SPA single packet authorization has many technical advantages such as minimum authorization, micro-isolation, and dynamic authorization. It can help enterprises reduce the attack surface, mitigate DDoS attacks, and protect against 0day vulnerabilities. It is the cornerstone for enterprises to build a zero-trust security protection system. According to the different knocking packages, it is divided into TCP SPA knocking and UDP SPA knocking. However, the TCP SPA knocking solution has risks such as port leakage, so the UDP SPA knocking solution is more commonly used.

[0003] Before the user logs in to the authentication service system, the authentication port of the SDP controller is hidden and needs to be opened through UDP SPA knocking. The overall process of UDP SPA knocking is as follows: Figure 1 As shown, it is divided into the following steps:

[0004] (1) Key negotiation and distribution: The SDP controller, as the central management node, is responsible for key negotiation with each SDP client. This process usually involves generating temporary keys or using preset keys. Once the key negotiation is completed, the SDP controller distributes the corresponding keys to the corresponding SDP clients. These keys will be used to construct UDP knock packets. (2) SPA key calculation: The SDP client calculates the SPA key based on the client's unique identifier (such as MAC address or device ID), the client's random number, and the SPA private key to ensure that the SPA key of each SDP client is unique and difficult to predict. (3) Construct and send a UDP knock packet: The SDP client seals the calculated SPA key with its own information (such as the client's unique identifier) ​​and the authentication port number to be accessed. The UDP packet is then packaged into a UDP data packet, which is then sent to the SDP controller as a "knock" signal for initial contact; (4) Verify the SPA key: After receiving the UDP knock packet, the SDP controller uses the SPA private key previously negotiated with the SDP client to calculate the SPA key and compare it with the received SPA key. If the SPA key matches successfully, it indicates that the identity of the SDP client has been preliminarily confirmed; (5) Authentication port opening: If the SPA key verification is successful, the SDP controller will open the authentication port number so that the SDP client can proceed to the next identity authentication process; (6) Initiate a login request: After a period of time, the SDP client initiates a formal login request. This interval is to prevent attackers from using knock packets for detection.

[0005] As a key technology in the zero-trust security model, SPA single packet knocking improves network security to a certain extent, but it still has some limitations and potential security risks. Specifically:

[0006] (1) Limitations of single-knock technology: Traditional zero-trust products such as SPA rely on a single-knock mechanism, which is vulnerable to complex and changing network attacks. Attackers may gain access to the entire network by cracking a single entry point. Since the network exposure of business resources under the SPA mechanism is relatively large, they are more likely to become targets of attacks.

[0007] (2) SPA vulnerability of shared public IP: When multiple LAN terminals share the same public IP, if one terminal successfully passes SPA authentication, other terminals can access business resources without reauthentication. This situation exposes the security vulnerability of the traditional SPA mechanism under specific network configurations, namely, the lack of the ability to independently and securely authenticate each terminal.

[0008] (3) Insufficient depth of identity authentication and access control: A single identity authentication step cannot fully guarantee the rigor of user access. Once the authentication link is breached, subsequent business service protection will be meaningless. The lack of a deep access control mechanism means that even legitimate users may cause security vulnerabilities due to improper permission management.

[0009] Under the wave of digital transformation, the boundaries of enterprise networks are becoming increasingly blurred, and traditional boundary-based network security strategies face severe challenges. As a new generation of security concept, the zero-trust architecture emphasizes "never trust, always verify", requiring continuous verification of all users, devices, and services to ensure that only authenticated and authorized entities can access enterprise resources. However, traditional zero-trust products often rely on a single knocking technology (such as SPA, Single Packet Authorization). Although this mechanism can provide certain security guarantees, its protection capabilities are insufficient in the face of complex network environments and evolving attack methods. Summary of the invention

[0010] The purpose of the present invention is to enhance the security of the network and prevent unauthorized access, thereby providing a quadruple port hiding method and device based on zero trust architecture. The present invention adds an extra security layer through the quadruple port hiding technology, making it difficult for attackers to easily find effective attack entry points; at the same time, the trust-based identity authentication mechanism can achieve more refined access control and can adapt to complex network environments, thereby avoiding security vulnerabilities in the traditional SPA mechanism.

[0011] The technical solution adopted by the present invention to solve the technical problem is as follows:

[0012] The present invention provides a quadruple port hiding method based on zero trust architecture, which mainly includes the following steps:

[0013] Step S1: authentication port knocking;

[0014] Step S1.1: first knock operation;

[0015] Step S1.2: Terminal trust evaluation method based on spatiotemporal matrix fusion multi-factor model;

[0016] Firstly, a spatiotemporal matrix of multiple trust factors with spatiotemporal attributes is constructed to calculate and update the terminal trust level. Then, the subjective analytic hierarchy process and the objective entropy value method are used to adaptively weight the multiple trust factors. Finally, the terminal trust level of the current period is calculated based on the spatiotemporal matrix of multiple trust factors and the dynamically allocated trust factor weights.

[0017] Step S2: trust-based multi-factor authentication;

[0018] Step S2.1: Initial state: low trust level;

[0019] Step S2.2: Intermediate trust level;

[0020] Step S2.3: Advanced trust level;

[0021] Step S2.4: Dynamic trust level adjustment method based on continuous monitoring of user behavior;

[0022] Before the user logs in to the system, the system will collect terminal device information and call the trust assessment interface to obtain the user's initial trust level; after the user logs in to the system, the system will continue to collect terminal device information and regularly update the trust level; if the user's trust level drops below the initial trust level, the system will disconnect and require the user to log in again;

[0023] Step S3: Tunnel port knocking;

[0024] The SDP client initiates a tunnel connection request to the SDP controller; after receiving the tunnel connection request, the SDP controller verifies the identity of the SDP client; after the SDP client passes the identity authentication, the SDP controller sends an instruction to the SDP gateway, instructing it to open the tunnel port, and the SDP gateway creates an encrypted tunnel for the SDP client;

[0025] Step S4: knocking on the service port;

[0026] Prepare a knocking packet containing a business access request; the SDP client sends the knocking packet to the SDP gateway through the established tunnel; after receiving the knocking packet, the SDP gateway verifies the legitimacy of the request based on the unique identifier of the SDP client and other relevant information. If the request is legitimate, the SDP gateway sends a confirmation message to the SDP controller; the SDP controller verifies the identity of the SDP client and its access rights again. If the verification is successful, the SDP controller instructs the SDP gateway to open the corresponding business port and allow the SDP client to access the specified business resources; after the SDP gateway opens the business port according to the instructions of the SDP controller, the SDP client can interact directly with the business system.

[0027] Furthermore, the specific implementation process of step S1.1 is as follows:

[0028] Step S1.1.1: key negotiation and distribution;

[0029] As the central management node, the SDP controller is responsible for key negotiation with each SDP client, generating temporary keys or using preset keys. After the key negotiation is completed, the SDP controller distributes the corresponding keys to the corresponding SDP clients. These keys will be used to construct UDP knock packets;

[0030] Step S1.1.2: SPA key calculation;

[0031] The SDP client calculates the SPA key based on the client unique identifier, the client random number, and the SPA private key to ensure that the SPA key of each SDP client is unique and difficult to predict;

[0032] Step S1.1.3: construct and send a UDP knock packet;

[0033] The SDP client encapsulates the calculated SPA key, its own information, and the authentication port number to be accessed into a UDP packet, which is then sent to the SDP controller as a knock signal for initial contact.

[0034] Furthermore, the UDP knocking packet includes: a unique identifier of the SDP client, a trust value of the SDP client user, and private key information carried by the SDP client.

[0035] Furthermore, in step S1.2, the EDR deployed on the terminal is used to correlate and analyze the terminal attack behaviors captured by the SDP gateway attack detection engine, and the SDP gateway protocol parsing engine is used to parse the passing traffic, and the analysis is performed based on five common traffic anomaly models; the attack behaviors and abnormal behaviors associated with the SDP controller side generate alarms in the SDP controller, and the terminal trust level is updated.

[0036] Furthermore, in step S1.2, in the subjective analytic hierarchy process, the subjective weights are assigned through the process of establishing a hierarchical expert model, constructing a discriminant matrix, hierarchical single sorting and consistency test, hierarchical total sorting and consistency test to ensure the rationality of the expert scoring. The specific calculation formula is:

[0037]

[0038] Among them, CI represents the consistency index, λ max represents the maximum characteristic root, n represents the characteristic dimension, represents weights, CI1, CI2,…, CI n Indicates the consistency index of different features.

[0039] Furthermore, in step S1.2, in the objective entropy value method, an objective weight factor is obtained through standardization / dimensionless, indicator weight comparison, indicator information entropy calculation, and weight calculation steps, and then the objective weight is assigned. The specific calculation formula is:

[0040]

[0041] Among them, H(x) represents the information entropy of the indicator, P(xi ) represents the probability of index i, x i represents the i-th index, represents the objective weight of the ith indicator, and k represents the number of indicators.

[0042] Furthermore, in step S2.4, the specific implementation process of the dynamic trust level adjustment method based on continuous monitoring of user behavior is as follows:

[0043] When a user logs in to the system for the first time, the initial trust level is the lowest level, and the trust level is low. The user name and password + SMS verification code + UKey key are used for authentication;

[0044] After the user successfully logs into the system for the first time, the system will continue to monitor the user's behavior, calculate the trust risk value, and compare it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust is still low. When the trust risk value is less than the risk threshold, the system raises the user's trust level to medium. In this process, the system continuously learns the user's regular behavior patterns until the user's login behavior and usage habits gradually stabilize. When the user logs into the system again, the system will automatically raise their trust level to medium. In the trust level, the user name and password + SMS verification code are used for authentication.

[0045] After the user successfully logs in to the system multiple times, the system continues to monitor the user's behavior, calculates the trust risk value, and compares it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust is still low. When the trust risk value is less than the risk threshold, the system raises the user's trust level to high. In this process, the system continuously learns the user's regular behavior patterns until the user's login behavior and usage habits gradually stabilize. When the user logs in to the system again, the system automatically raises his trust level to high. The high trust level uses the username and password for authentication.

[0046] After the user successfully logs in to the system multiple times, the system continues to monitor the user's behavior, calculates the trust risk value, and compares it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust level is still medium or low.

[0047] Furthermore, in step S2.1, when the user logs into the system for the first time, the initial trust level is set to the lowest level, and the identity authentication methods are: username and password authentication, SMS verification code authentication and UKey key authentication.

[0048] The present invention provides a quadruple port hiding device based on a zero-trust architecture, comprising: a memory and a processor; the memory stores executable instructions, and the processor is configured to execute the executable instructions in the memory to implement the steps of a quadruple port hiding method based on a zero-trust architecture.

[0049] The beneficial effects of the present invention are:

[0050] (1) Enhanced security: In view of the vulnerability of SPA single-packet knocking technology to network attacks, the present invention significantly enhances the security of the system and reduces the risk of attacks through multi-level identity authentication and trust evaluation, as well as a quadruple port knocking mechanism;

[0051] (2) Refined access control: To address the problem of insufficient depth of identity authentication and access control in the SPA mechanism, the present invention implements more refined access control by dynamically adjusting the trust level and strict permission management, ensuring that even legitimate users can only access authorized resources;

[0052] (3) Adaptability to complex network environments: To address the security vulnerabilities of the SPA mechanism under specific network configurations (such as shared public IP), the present invention uses quadruple port hiding technology and continuous terminal trust status monitoring to maintain a high degree of security in complex and changing network environments;

[0053] (4) User experience optimization: The present invention improves user experience without affecting security by dynamically adjusting the trust level and automatically simplifying the authentication process based on the user's behavior patterns and historical records;

[0054] (5) Continuous monitoring of terminal trust status: The present invention detects the terminal trust status before and after login to ensure the continued validity of the user's identity. Once the trust level drops, security measures are taken immediately, further enhancing the overall security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 The overall flow chart of knocking on the door for UDP SPA.

[0056] Figure 2 A flowchart of a quadruple port hiding method based on a zero-trust architecture provided by the present invention.

[0057] Figure 3 Flowchart of the multi-factor continuous trust assessment and update method.

[0058] Figure 4 The present invention is a flow chart of a trust level adjustment method based on continuous monitoring of user behavior. DETAILED DESCRIPTION

[0059] The invention provides a quadruple port hiding method based on zero trust architecture, which is constructed based on zero trust architecture, and its components mainly include SDP client, SDP controller, SDP gateway and business system containing resources. Figure 2 As shown, a quadruple port hiding method based on zero-trust architecture of the present invention mainly includes four stages: authentication and authorization stage, tunnel establishment stage, continuous evaluation stage, and access control stage.

[0060] The present invention is mainly implemented by a quadruple port hidden zero-trust access control solution. The quadruple port hidden zero-trust access control solution is an innovative security measure. Different from the traditional SPA single knocking technology, this solution implements a quadruple port knocking mechanism to achieve comprehensive protection enhancement for user access and business services. This solution achieves "true invisibility" of business applications by knocking on the zero-trust security management platform (SDP controller), identity authentication port, VPN tunnel port in the SDP gateway, and business port. In addition, the solution also integrates diversified identity authentication strategies, encrypted data transmission, and strict permission management technology, which greatly reduces the exposure of business resources in the network, thereby significantly reducing security threats such as port scanning and DDoS attacks.

[0061] The present invention provides a quadruple port hiding method based on a zero-trust architecture, which mainly adopts a quadruple port hiding zero-trust access control solution. The specific implementation process is as follows:

[0062] Step S1: authentication port knocking;

[0063] The user first needs to submit an authentication request to the SDP controller, which is the first step of identity authentication. This stage ensures that only legitimate users can continue the subsequent authentication process.

[0064] Based on this, the specific implementation process of authentication port knocking is as follows:

[0065] Step S1.1: first knock operation;

[0066] Before the SDP client initiates an authentication request to the SDP controller, in order to ensure that the SDP controller can receive the authentication request from the SDP client, the SDP controller needs to open the authentication-related ports. To achieve this, the SDP client must perform the first knock operation. This operation is not only the beginning of the entire quadruple port hidden zero-trust access control solution, but also one of the key steps to achieve user access and business service protection enhancement.

[0067] Among them, knocking is performed on the zero-trust security management platform (SDP controller), the identity authentication port, the VPN tunnel port in the SDP gateway, and the service port. The specific process of each knocking adopts the following steps S1.1.1-S1.1.3. The difference is that the ports knocked are different and the knocking locations are different:

[0068] Step S1.1.1: key negotiation and distribution;

[0069] As the central management node, the SDP controller is responsible for key negotiation with each SDP client. This process usually involves generating temporary keys or using preset keys. Once the key negotiation is completed, the SDP controller distributes the corresponding keys to the corresponding SDP clients. These keys will be used to construct UDP knock packets.

[0070] Step S1.1.2: SPA key calculation;

[0071] The SDP client calculates the SPA key based on the client's unique identifier (such as MAC address or device ID), the client random number, and the SPA private key to ensure that the SPA key of each SDP client is unique and difficult to predict.

[0072] Step S1.1.3: construct and send a UDP knock packet;

[0073] The SDP client encapsulates the calculated SPA key, its own information (such as the client's unique identifier), and the authentication port number to be accessed into a UDP data packet, which is then sent to the SDP controller as a "knock" signal for initial contact.

[0074] The specific contents of the UDP knock packet are as follows:

[0075] (1) SDP client unique identifier: The SDP client must contain information that can uniquely identify itself. This information can be a device ID, MAC address, or other unique identifiers. Such identifiers help the SDP controller identify and track the status of a specific SDP client.

[0076] (2) Trust value of SDP client user: The SDP client needs to carry a value indicating the user's trust level. This value indicating the user's trust level can be determined based on multiple factors such as the user's static attribute information, dynamic behavior information, and historical behavior. It can help the SDP controller evaluate the user's credibility and adjust subsequent security policies accordingly.

[0077] (3) Private key information carried by the SDP client: To ensure the security of communication, the SDP client also needs to carry a private key. This private key will be used to encrypt and decrypt the communication content with the SDP controller to protect sensitive information from being intercepted by a third party. The transmission of private key information must ensure its security and confidentiality to prevent it from being stolen by unauthorized parties.

[0078] Step S1.2: Terminal trust evaluation method based on spatiotemporal matrix fusion multi-factor model;

[0079] In the terminal trust assessment link, the present invention innovatively proposes a terminal trust assessment method based on a spatiotemporal matrix fusion multi-factor model, which aims to achieve accurate quantitative judgment of the terminal trust level by integrating multiple key information parameters such as the terminal's operating behavior in time series, geographical location changes, hardware performance indicators, and operating system version upgrades. The terminal trust assessment method based on a spatiotemporal matrix fusion multi-factor model proposed by the present invention can not only dynamically adjust the trust rating of the terminal according to the real-time network and business behavior of the terminal, but also set a threshold screening mechanism to effectively intercept terminal access that does not meet the security specifications of the business system.

[0080] like Figure 3 As shown, the left part describes multiple trust factors, specifically: Are there any abnormalities in user login time, number of logins, password similarity, keyboard and mouse behavior, etc.? Are there any abnormalities in terminal device information and information captured by host security protection? Are there any abnormalities in large traffic, number of visits, access intervals, state transitions, and authorization lists? Has the base station information and environmental information changed? Use the EDR deployed on the terminal to determine whether a host security attack has occurred? Use the protocol parsing engine and attack detection engine to determine whether there is abnormal traffic behavior? The trust factors described above are normalized to obtain multiple trust factors x1, x2,…, x m , according to the collected multiple trust factors x1,x2,…,x m , construct a multi-trust factor spatiotemporal matrix with spatiotemporal attributes to calculate and update the terminal trust level; then use the subjective hierarchical analysis method and the objective entropy value method to adaptively weight the multiple trust factors, which can be dynamically configured; finally, according to the multi-trust factor spatiotemporal matrix and the dynamically allocated trust factor weights, the terminal trust level of the current period is calculated by fusion. At the same time, the EDR deployed on the terminal is used to associate the terminal attack behavior captured by the SDP gateway attack detection engine, and the SDP gateway protocol parsing engine is used to parse the passing traffic, and the analysis is performed according to five common traffic anomaly models (large traffic anomaly model, abnormal access number model, abnormal access interval model, state transition matrix model and authorization list, etc.). The attack behavior and abnormal behavior associated with the SDP controller side generate alarms in the SDP controller, and the terminal trust level is updated.

[0081] like Figure 3 As shown in the figure, the constructed multi-trust factor spatiotemporal matrix is ​​as follows:

[0082]

[0083] Among them, T1, T2, …, T m Represent the trust score of each trust factor respectively.

[0084] Subjective weights are assigned using the subjective analytic hierarchy process, which ensures the rationality of expert scoring by establishing a hierarchical expert model, constructing a discriminant matrix, hierarchical single sorting and consistency test, hierarchical total sorting and consistency test. The specific calculation formula is as follows:

[0085]

[0086] Among them, CI represents the consistency index, λ max represents the maximum characteristic root, n represents the characteristic dimension, represents weights, CI1, CI2,…, CI n Indicates the consistency index of different features.

[0087] Among them, the objective weight adopts the common objective entropy value method, which has high calculation efficiency while overcoming the defects of subjective assignment, and can meet the model's demand for lightweight. Through standardization / dimensionless, indicator weight comparison, indicator information entropy calculation, weight calculation and other steps, the objective weight factor is obtained, and then the objective weight is assigned. The specific calculation formula is as follows:

[0088]

[0089] Among them, H(x) represents the information entropy of the indicator, P(x i ) represents the probability of index i, x i represents the i-th index, represents the objective weight of the ith indicator, and k represents the number of indicators.

[0090] Combining the subjective weight assignment results with the objective weight assignment results, we get the comprehensive weight value, and its specific calculation formula is as follows:

[0091]

[0092] Among them, W i Represents the comprehensive weight value, represents the subjective weight of indicator i, represents the objective weight of indicator i, and k represents the number of indicators.

[0093] Finally, different trust factors are adaptively integrated to obtain the trust value. The specific calculation formula of the trust value is as follows:

[0094] T(t)=w1·T user +w2·T ter +w3·T env +w4·T beh

[0095] Where T(t) represents the trust value, w1 represents the weight of the user trust factor, w2 represents the weight of the terminal trust factor, w3 represents the weight of the environment trust factor, w4 represents the weight of the behavior trust factor, and T user represents the user trust factor, T ter represents the terminal trust factor, T env represents the environmental trust factor, T beh Represents the behavioral trust factor.

[0096] Step S2: trust-based multi-factor authentication;

[0097] After passing the first barrier, users will enter the deep identity authentication stage. This stage adopts a diversified authentication strategy, including but not limited to user name, password and other authentication information, such as SMS verification code, U-Key, etc. This stage is based on trust-guided diversified authentication dynamic feedback.

[0098] In order to ensure the security of the identity authentication process, the present invention designs a multi-factor authentication system based on dynamic trust evaluation, which allows the system to dynamically adjust the trust level according to the user's login behavior and usage habits. This function can not only improve the user experience of most users with high trust levels, but also screen risky login behaviors to ensure the legitimacy of the logged-in user's identity to the greatest extent.

[0099] Based on this, the specific implementation process of trust-based multi-identity authentication is as follows:

[0100] Step S2.1: Initial state: low trust level;

[0101] When a user logs into the system for the first time, their initial trust level is set to the lowest level. This means that the user needs to prove their identity through the most stringent authentication method. This usually includes the following three main factors:

[0102] (1) Username and password authentication;

[0103] (2) SMS verification code authentication;

[0104] (3) UKey (U-Shield) key authentication.

[0105] Among them, UKey key authentication means that the user needs to use the dedicated SDP client (such as the NetCertificate Security SDP Client) installed on the terminal to call the JS interface provided by the SDP client for key authentication. This is a very secure but relatively complex authentication method, suitable for first-time login or unconventional login situations.

[0106] Step S2.2: Intermediate trust level;

[0107] As the frequency of users logging in and using the system increases, the system begins to learn the user's regular behavior patterns, including login time, location, device type, etc. When the user's login behavior and usage habits gradually stabilize, the system will automatically upgrade their trust level to medium.

[0108] At the intermediate trust level, the user's authentication process is simplified to only a username and password and a text message verification code. This not only improves the user experience, but also maintains sufficient security. At this stage, the system continues to monitor user behavior and further optimizes user profiles based on newly acquired data.

[0109] Step S2.3: Advanced trust level;

[0110] For users who always maintain consistent login modes and operating habits, the system will further increase their trust level to high. At this time, users only need to enter their username and password to complete the login process. This simplified authentication method greatly improves user convenience and reduces unnecessary authentication steps.

[0111] Step S2.4: Dynamic trust level adjustment;

[0112] Design a dynamic trust level adjustment method based on continuous monitoring of user behavior, so that users with different trust levels can dynamically improve their trust levels after standardized login and use for a period of time, so as to improve the convenience of use. At the same time, for users with dangerous login or operation behaviors, their trust levels are lowered, making their login verification methods more complicated and requiring more verification processes. Even at intermediate and advanced trust levels, the system will continue to monitor the user's login environment and usage behavior. If an abnormal login event occurs, such as a change in the login environment or user behavior that is inconsistent with historical records, the system will immediately lower the user's trust level and require a more complex authentication method, such as re-enabling UKey key authentication.

[0113] The trust level reduction is determined by the severity of the abnormal behavior. For example, if only a minor change in the login environment occurs, the trust level may be reduced by one level. However, if serious abnormal behavior is detected, such as too many password attempts, the system may directly reduce the trust level to the lowest level.

[0114] In addition, the system also has a U-shield status detection function, that is, after logging in with UKey, it will continue to detect the insertion status of UKey. Once the UKey is unplugged, the system will automatically log out and require the user to log in again.

[0115] The terminal trust status detection plays a role in the entire user login process. Before login, the system will immediately collect terminal device information and call the trust evaluation interface to obtain the user's initial trust level. After login, the system will continue to collect terminal device information and regularly update the trust level. If the user's trust level drops below the initial trust level, the system will disconnect and require the user to log in again.

[0116] like Figure 4 As shown, the specific implementation process of the above-mentioned trust level adjustment method based on continuous monitoring of user behavior is as follows:

[0117] When a user logs in to the system for the first time, the initial trust level is the lowest level, and the trust level is low. The user name and password + SMS verification code + UKey (U shield) key is used for authentication;

[0118] After the user successfully logs into the system for the first time, an initial trust value (such as 0.5) is assigned. The system continuously monitors user behavior, including: trust parameter calculation, attack behavior detection, abnormal behavior analysis, etc. The trust score is calculated according to the weight matrix and compared with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust is still low. When the trust risk value is less than the risk threshold, the system raises the user's trust level to medium. In this process, the system continuously learns the user's regular behavior patterns, including login time, location, device type, etc., until the user's login behavior and usage habits gradually stabilize. When the user logs into the system again, the system automatically raises its trust level to medium. In the trust level, the user name and password + SMS verification code are used for authentication.

[0119] After the user successfully logs in to the system multiple times, the system continues to monitor the user's behavior, including: trust parameter calculation, attack behavior detection, abnormal behavior analysis, etc., calculate the trust risk value, and compare it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface, and the user's trust is still low. When the trust risk value is less than the risk threshold, the system upgrades the user's trust level to high. In this process, the system continuously learns the user's regular behavior patterns, including login time, location, device type, etc., until the user's login behavior and usage habits gradually stabilize. When the user logs in to the system again, the system automatically upgrades his trust level to high. The high trust level uses the username and password for authentication.

[0120] After the user successfully logs in to the system multiple times, the system continues to monitor the user's behavior, including: trust parameter calculation, attack behavior detection, abnormal behavior analysis, etc., calculates the trust risk value, and compares it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust level is still medium or low.

[0121] The present invention dynamically adjusts the complexity of the authentication method according to the user's trust level, from multiple authentications at the lowest trust level to simplified authentication at the highest trust level. Through a multi-level identity authentication and trust evaluation method, it can both ensure security and improve user experience.

[0122] Step S3: Tunnel port knocking;

[0123] After completing the deep identity authentication, the user needs to apply to the SDP gateway through system guidance to establish a secure tunnel connection. The establishment of a secure tunnel provides encryption protection for data transmission, further enhancing the security of the system.

[0124] After deep identity authentication is passed, the SDP client needs to initiate a tunnel connection request to the SDP controller in order to open the tunnel connection port on the SDP gateway side and establish a connection. The specific implementation process is as follows:

[0125] Step S3.1: The SDP client initiates a tunnel connection request;

[0126] The SDP client application or device requests access to protected target resources by sending a tunnel connection request to the SDP controller. This tunnel connection request may contain basic information of the SDP client, such as device ID or IP address.

[0127] Step S3.2: identity verification;

[0128] After receiving the request, the SDP controller verifies the identity of the SDP client. Since the identity authentication operation has been completed before, the identity authentication at this time mainly focuses on confirming the unique identity of the SDP client and ensuring that the request comes from a verified SDP client user.

[0129] Step S3.3: Establish a tunnel;

[0130] Once the SDP client passes the authentication, the SDP controller sends instructions to the SDP gateway to open the tunnel port. The SDP gateway creates an encrypted tunnel for the SDP client. SSL / TLS protocol or other encryption methods are usually used to ensure the security of data transmission.

[0131] Through the above steps, the SDP client can establish a secure tunnel connection with the SDP gateway to provide protection for subsequent data transmission. This process not only enhances security, but also ensures that only authenticated SDP clients can access protected target resources.

[0132] Step S4: knocking on the service port;

[0133] The last step is to establish a secure tunnel. The SDP client knocks on the door in the tunnel and requests access to the service port. The system will strictly limit the opening of the service port according to the role permissions of the verified user to ensure that only users with corresponding permissions can access specific resources. Strict control of role permissions ensures that even legitimate users can only access the resources they are authorized to access, further strengthening the security of the system.

[0134] In the quadruple port hidden zero-trust access control solution, after establishing a secure tunnel, the SDP client also needs to knock on the business port to access the business system. The specific implementation process is as follows:

[0135] Step S4.1: prepare knock data packet;

[0136] After establishing a secure tunnel, the SDP client needs to prepare a knocking packet containing a service access request. The knocking packet may contain the unique identifier of the SDP client, information about the service resources requested for access, etc.

[0137] Step S4.2: Send a knock packet;

[0138] The SDP client sends a knock packet to the SDP gateway through the established secure tunnel. The destination of the knock packet is the service port, that is, the specific service resource that the SDP client wants to access.

[0139] Step S4.3: The SDP gateway processes the knock request;

[0140] After receiving the knock packet, the SDP gateway verifies the legitimacy of the request based on the unique identifier of the SDP client and other relevant information. If the request is legitimate, the SDP gateway sends a confirmation message to the SDP controller.

[0141] Step S4.4: SDP controller verification;

[0142] The SDP controller verifies the identity of the SDP client and its access rights again. If the verification is successful, the SDP controller will instruct the SDP gateway to open the corresponding service port and allow the SDP client to access the specified service resources.

[0143] Step S4.5: business port opening;

[0144] The SDP gateway opens the service port according to the instructions of the SDP controller, and the SDP client can now interact directly with the business system.

[0145] The present invention hides a zero-trust access control solution through a quadruple port, that is, a knocking process through four stages: authentication port, trust-based multi-identity authentication, tunnel port, and business port, which greatly increases the difficulty for attackers to discover effective attack paths.

[0146] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A quadruple port hiding method based on zero trust architecture, characterized in that: The following steps are involved: Step S1: authentication port knocking; Step S1.1: first knock operation; Step S1.2: Terminal trust evaluation method based on spatiotemporal matrix fusion multi-factor model; Firstly, a multi-trust factor spatiotemporal matrix with spatiotemporal attributes is constructed to calculate and update the terminal trust level; Then, subjective analytic hierarchy process and objective entropy value method are used to adaptively weight multiple trust factors; Finally, the terminal trust level of the current period is calculated based on the multi-trust factor spatiotemporal matrix and the dynamically allocated trust factor weights; Step S2: trust-based multi-factor authentication; Step S2.1: Initial state: low trust level; Step S2.2: Intermediate trust level; Step S2.3: Advanced trust level; Step S2.4: Dynamic trust level adjustment method based on continuous monitoring of user behavior; Before the user logs into the system, the system will collect terminal device information and call the trust assessment interface to obtain the user's initial trust level; After the user logs into the system, the system will continue to collect terminal device information and regularly update the trust level; If the user's trust level drops below the initial trust level, the system will disconnect and require the user to log in again; Step S3: Tunnel port knocking; The SDP client initiates a tunnel connection request to the SDP controller; after receiving the tunnel connection request, the SDP controller verifies the identity of the SDP client; after the SDP client passes the identity authentication, the SDP controller sends an instruction to the SDP gateway, instructing it to open the tunnel port, and the SDP gateway creates an encrypted tunnel for the SDP client; Step S4: knocking on the service port; Prepare a knock packet containing a service access request; the SDP client sends the knock packet to the SDP gateway through the established tunnel; After receiving the knock data packet, the SDP gateway verifies the legitimacy of the request based on the unique identifier of the SDP client and other relevant information. If the request is legitimate, the SDP gateway sends a confirmation message to the SDP controller; the SDP controller verifies the identity of the SDP client and its access rights again. If the verification is successful, the SDP controller instructs the SDP gateway to open the corresponding service port and allow the SDP client to access the specified service resources; after the SDP gateway opens the service port according to the instructions of the SDP controller, the SDP client can interact directly with the service system.

2. According to a quadruple port hiding method based on zero trust architecture according to claim 1, it is characterized in that: The specific implementation process of step S1.1 is as follows: Step S1.1.1: key negotiation and distribution; As the central management node, the SDP controller is responsible for key negotiation with each SDP client, generating temporary keys or using preset keys. After the key negotiation is completed, the SDP controller distributes the corresponding keys to the corresponding SDP clients. These keys will be used to construct UDP knock packets; Step S1.1.2: SPA key calculation; The SDP client calculates the SPA key based on the client unique identifier, the client random number, and the SPA private key to ensure that the SPA key of each SDP client is unique and difficult to predict; Step S1.1.3: construct and send a UDP knock packet; The SDP client encapsulates the calculated SPA key, its own information, and the authentication port number to be accessed into a UDP packet, which is then sent to the SDP controller as a knock signal for initial contact.

3. A quadruple port hiding method based on zero trust architecture according to claim 2, characterized in that: The UDP knocking packet includes: a unique identifier of the SDP client, a trust value of the SDP client user, and private key information carried by the SDP client.

4. According to a quadruple port hiding method based on zero trust architecture according to claim 1, it is characterized in that: In step S1.2, the EDR deployed on the terminal is used to perform correlation analysis with the terminal attack behavior captured by the SDP gateway attack detection engine, and the SDP gateway protocol parsing engine is used to parse the passing traffic, and the analysis is performed according to five common traffic anomaly models; Attack behaviors and abnormal behaviors associated with the SDP controller generate alarms in the SDP controller and update the terminal trust level.

5. A quadruple port hiding method based on zero trust architecture according to claim 1, characterized in that: In step S1.2, in the subjective analytic hierarchy process, the subjective weights are assigned through the process of establishing a hierarchical expert model, constructing a discriminant matrix, hierarchical single sorting and consistency test, hierarchical total sorting and consistency test to ensure the rationality of the expert scoring. The specific calculation formula is: Among them, CI represents the consistency index, λ max represents the maximum characteristic root, n represents the characteristic dimension, represents weights, CI1, CI2,…, CI n Indicates the consistency index of different features.

6. A quadruple port hiding method based on zero trust architecture according to claim 1, characterized in that: In step S1.2, in the objective entropy value method, the objective weight factor is obtained through standardization / dimensionless, indicator weight comparison, indicator information entropy calculation, and weight calculation steps, and then the objective weight is assigned. The specific calculation formula is: Among them, H(x) represents the information entropy of the indicator, P(x i ) represents the probability of index i, x i represents the i-th index, represents the objective weight of the ith indicator, and k represents the number of indicators.

7. A quadruple port hiding method based on zero trust architecture according to claim 1, characterized in that: In step S2.4, the specific implementation process of the dynamic trust level adjustment method based on continuous monitoring of user behavior is as follows: When a user logs in to the system for the first time, the initial trust level is the lowest level, and the trust level is low. The user name and password + SMS verification code + UKey key are used for authentication; After the user successfully logs into the system for the first time, the system will continue to monitor the user's behavior, calculate the trust risk value, and compare it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust is still low. When the trust risk value is less than the risk threshold, the system raises the user's trust level to medium. In this process, the system continuously learns the user's regular behavior patterns until the user's login behavior and usage habits gradually stabilize. When the user logs into the system again, the system will automatically raise their trust level to medium. In the trust level, the user name and password + SMS verification code are used for authentication. After the user successfully logs in to the system multiple times, the system continues to monitor the user's behavior, calculates the trust risk value, and compares it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust is still low. When the trust risk value is less than the risk threshold, the system raises the user's trust level to high. In this process, the system continuously learns the user's regular behavior patterns until the user's login behavior and usage habits gradually stabilize. When the user logs in to the system again, the system automatically raises his trust level to high. The high trust level uses the username and password for authentication. After the user successfully logs in to the system multiple times, the system continues to monitor the user's behavior, calculates the trust risk value, and compares it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust level is still medium or low.

8. A quadruple port hiding method based on zero trust architecture according to claim 1, characterized in that: In step S2.1, when the user logs in to the system for the first time, his initial trust level is set to the lowest level. At this time, the identity authentication methods are: username and password authentication, SMS verification code authentication and UKey key authentication.

9. A quadruple port hiding device based on zero trust architecture, characterized in that: include: Memory and processor; The memory stores executable instructions, and the processor is configured to execute the executable instructions in the memory to implement the steps of a quadruple port hiding method based on a zero trust architecture as described in any one of claims 1 to 8.

Images