A quadruple port concealment method and device based on a zero trust architecture

Abstract

A quadruple port hiding method and device based on a zero trust architecture belong to the field of computer network security and comprise a first knock operation and a terminal trust evaluation method based on a space-time matrix fusion multi-factor model, a multi-element identity authentication based on trust, a tunnel port knock, and a service port knock.The quadruple port hiding zero trust access control scheme is adopted to knock the zero trust security management platform, the identity authentication port, the VPN tunnel port in the SDP gateway, and the service port, so that the comprehensive protection enhancement of user access and service is realized.The quadruple port hiding technology increases an additional security layer, so that it is difficult for an attacker to easily find an effective attack entry point;meanwhile, the identity authentication mechanism based on trust can realize more refined access control and can adapt to a complex network environment, so that the security vulnerabilities existing in the traditional SPA mechanism are avoided.

Description

Technical Field

[0001] The present invention belongs to the field of computer network security technology, and specifically relates to a quadruple port hiding method and device based on a zero-trust architecture. Background Art

[0002] SPA (Single Packet Authorization) is a lightweight security protocol that uses only a single data packet for access requests. This simplifies the knocking process by integrating all necessary information into a single packet. Before granting network access, the device and user identity are verified, achieving "network invisibility" and preventing attackers from finding service addresses and ports. Compared to the traditional TCP protocol, SPA offers numerous technical advantages, including minimum authorization, micro-segmentation, and dynamic authorization. It can help enterprises reduce their attack surface, mitigate DDoS attacks, and protect against zero-day vulnerabilities, making it the cornerstone of a zero-trust security system. Depending on the knocking packet, it can be categorized as TCP SPA knocking and UDP SPA knocking. However, TCP SPA knocking carries risks such as port leaks, leading to the widespread adoption of UDP SPA knocking.

[0003] Before the user logs in to the authentication service system, the authentication port of the SDP controller is hidden and needs to be opened through UDP SPA knocking. The overall process of UDP SPA knocking is as follows: Figure 1 As shown, it is divided into the following steps:

[0004] (1) Key negotiation and distribution: The SDP controller acts as a central management node and is responsible for negotiating keys with each SDP client. This process usually involves generating temporary keys or using preset keys. Once the key negotiation is completed, the SDP controller distributes the corresponding keys to the corresponding SDP clients. These keys will be used to construct UDP knock packets. (2) SPA key calculation: The SDP client calculates the SPA key based on the client's unique identifier (such as MAC address or device ID), the client's random number, and the SPA private key to ensure that the SPA key of each SDP client is unique and difficult to predict. (3) Construct and send a UDP knock packet: The SDP client seals the calculated SPA key with its own information (such as the client's unique identifier) ​​and the authentication port number to be accessed. The UDP packet is then packaged into a UDP data packet, which is then sent to the SDP controller as a "knock" signal for the initial contact; (4) Verify the SPA key: After receiving the UDP knock packet, the SDP controller uses the SPA private key previously negotiated with the SDP client to calculate the SPA key and compare it with the received SPA key. If the SPA key matches successfully, it indicates that the identity of the SDP client has been preliminarily confirmed; (5) Authentication port is opened: If the SPA key is successfully verified, the SDP controller will open the authentication port number so that the SDP client can proceed to the next step of the identity authentication process; (6) Initiate a login request: After a period of time, the SDP client initiates a formal login request. This interval is to prevent attackers from using knock packets for detection.

[0005] As a key technology in the zero-trust security model, SPA single packet knocking improves network security to a certain extent, but it still has some limitations and potential security risks. Specifically:

[0006] (1) Limitations of single-knock technology: Traditional zero-trust products such as SPA rely on a single-knock mechanism, which is vulnerable to complex and changing network attacks. Attackers may gain access to the entire network by cracking a single entry point. Since the network exposure of business resources under the SPA mechanism is relatively large, they are more likely to become targets of attacks.

[0007] (2) SPA vulnerability of shared public IP: When multiple LAN terminals share the same public IP, if one terminal successfully passes SPA verification, other terminals can access business resources without re-verification. This situation exposes the security vulnerability of the traditional SPA mechanism under specific network configurations, namely, the lack of the ability to independently and securely verify each terminal.

[0008] (3) Insufficient depth of identity authentication and access control: A single identity authentication step cannot fully guarantee the rigor of user access. Once the authentication link is breached, subsequent business service protection will be meaningless. The lack of a deep access control mechanism means that even legitimate users may cause security vulnerabilities due to improper permission management.

[0009] Driven by digital transformation, enterprise network boundaries are becoming increasingly blurred, posing a significant challenge to traditional perimeter-based network security strategies. Zero Trust, a next-generation security concept, emphasizes "never trust, always verify," requiring continuous verification of all users, devices, and services to ensure only authenticated and authorized entities can access enterprise resources. However, traditional Zero Trust products often rely on a single knock-on technology (such as Single Packet Authorization). While this mechanism can provide a certain level of security, its protection capabilities are insufficient in the face of complex network environments and evolving attack vectors. Summary of the Invention

[0010] The purpose of this invention is to enhance network security and prevent unauthorized access, thereby providing a quadruple port hiding method and device based on a zero-trust architecture. This invention adds an additional layer of security through quadruple port hiding technology, making it difficult for attackers to easily find effective attack entry points. At the same time, the trust-based identity authentication mechanism enables more refined access control and is adaptable to complex network environments, thus avoiding the security vulnerabilities existing in traditional SPA mechanisms.

[0011] The technical solutions adopted by the present invention to solve the technical problems are as follows:

[0012] The present invention provides a quadruple port hiding method based on a zero-trust architecture, which mainly includes the following steps:

[0013] Step S1: Authentication port knocking;

[0014] Step S1.1: first knock operation;

[0015] Step S1.2: Terminal trust assessment method based on spatiotemporal matrix fusion multi-trust factor model;

[0016] First, a spatiotemporal matrix of multiple trust factors with spatiotemporal attributes is constructed to calculate and update the terminal trust level. Then, the subjective analytic hierarchy process and the objective entropy method are used to adaptively weight the multiple trust factors. Finally, the terminal trust level for the current period is calculated by integrating the spatiotemporal matrix of multiple trust factors and the dynamically assigned trust factor weights.

[0017] Step S2: trust-based multi-factor authentication;

[0018] Step S2.1: Initial state: low trust level;

[0019] Step S2.2: Intermediate trust level;

[0020] Step S2.3: Advanced trust level;

[0021] Step S2.4: Dynamic trust level adjustment method based on continuous monitoring of user behavior;

[0022] Before a user logs into the system, the system collects terminal device information and calls the trust assessment interface to obtain the user's initial trust level. After the user logs into the system, the system continues to collect terminal device information and regularly updates the trust level. If the user's trust level drops below the initial trust level, the system will disconnect and require the user to log in again.

[0023] Step S3: Tunnel port knocking;

[0024] The SDP client initiates a tunnel connection request to the SDP controller. After receiving the tunnel connection request, the SDP controller verifies the identity of the SDP client. After the SDP client passes the identity verification, the SDP controller sends a command to the SDP gateway, instructing it to open the tunnel port. The SDP gateway then creates an encrypted tunnel for the SDP client.

[0025] Step S4: knock on the service port;

[0026] Prepare a knocking packet containing a business access request; the SDP client sends the knocking packet to the SDP gateway through the established tunnel; after receiving the knocking packet, the SDP gateway verifies the legitimacy of the request based on the unique identifier of the SDP client and other relevant information. If the request is legitimate, the SDP gateway will send a confirmation message to the SDP controller; the SDP controller will verify the identity of the SDP client and its access rights again. If the verification is successful, the SDP controller will instruct the SDP gateway to open the corresponding business port and allow the SDP client to access the specified business resources; after the SDP gateway opens the business port according to the instructions of the SDP controller, the SDP client can interact directly with the business system.

[0027] Furthermore, the specific implementation process of step S1.1 is as follows:

[0028] Step S1.1.1: key negotiation and distribution;

[0029] The SDP controller, as the central management node, is responsible for negotiating keys with each SDP client, generating temporary keys or using pre-set keys. After the key negotiation is complete, the SDP controller distributes the corresponding keys to the corresponding SDP clients. These keys will be used to construct UDP knock packets.

[0030] Step S1.1.2: SPA key calculation;

[0031] The SDP client calculates the SPA key based on the client unique identifier, the client random number, and the SPA private key, ensuring that the SPA key of each SDP client is unique and difficult to predict;

[0032] Step S1.1.3: Build and send a UDP knock packet;

[0033] The SDP client encapsulates the calculated SPA key, its own information, and the authentication port number to be accessed into a UDP packet, which is then sent to the SDP controller as a knock signal for initial contact.

[0034] Furthermore, the UDP knocking packet includes: a unique identifier of the SDP client, a trust value of the SDP client user, and private key information carried by the SDP client.

[0035] Furthermore, in step S1.2, the terminal attack behaviors captured by the EDR deployed on the terminal and the SDP gateway attack detection engine are correlated and analyzed, and the passing traffic is parsed using the SDP gateway protocol parsing engine, and analyzed according to five common traffic anomaly models; the attack behaviors and abnormal behaviors associated with the SDP controller side generate alarms in the SDP controller, and the terminal trust level is updated.

[0036] Furthermore, in step S1.2, in the subjective hierarchical analysis method, subjective weights are assigned through the process of establishing a hierarchical expert model, constructing a discriminant matrix, hierarchical single sorting and consistency test, hierarchical total sorting and consistency test to ensure the rationality of the expert scoring. The specific calculation formula is:

[0037]

[0038] Among them, CI represents the consistency index, λ max represents the maximum characteristic root, n represents the characteristic dimension, Represents weights, CI1, CI2,…, CI n Indicates the consistency index of different features.

[0039] Furthermore, in step S1.2, in the objective entropy method, the objective weight factor is obtained through standardization / dimensionless transformation, indicator weight comparison, indicator information entropy calculation, and weight calculation steps, and then the objective weight is assigned. The specific calculation formula is:

[0040]

[0041] Among them, H(x) represents the information entropy of the indicator, P(xi ) represents the probability of indicator i, x i represents the i-th index, represents the objective weight of the i-th indicator, and k represents the number of indicators.

[0042] Furthermore, in step S2.4, the specific implementation process of the dynamic trust level adjustment method based on continuous monitoring of user behavior is as follows:

[0043] When a user logs into the system for the first time, their initial trust level is the lowest level, and the user name and password + SMS verification code + UKey key are used for authentication;

[0044] After a user successfully logs into the system for the first time, the system continuously monitors the user's behavior, calculates the trust risk value, and compares it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust level remains low. When the trust risk value is less than the risk threshold, the system raises the user's trust level to medium. During this process, the system continuously learns the user's regular behavior patterns until the user's login behavior and usage habits gradually stabilize. When the user logs into the system again, the system automatically raises their trust level to medium. At the medium trust level, user name and password + SMS verification code are used for authentication.

[0045] After a user successfully logs in to the system multiple times, the system continues to monitor the user's behavior, calculates the trust risk value, and compares it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust level remains low. When the trust risk value is less than the risk threshold, the system raises the user's trust level to high. During this process, the system continuously learns the user's regular behavior patterns until the user's login behavior and usage habits gradually stabilize. When the user logs in to the system again, the system automatically raises their trust level to high. With a high trust level, authentication is performed using username and password.

[0046] After a user successfully logs in to the system multiple times, the system continues to monitor the user's behavior, calculates the trust risk value, and compares it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust level remains medium or low.

[0047] Furthermore, in step S2.1, when a user logs into the system for the first time, his initial trust level is set to the lowest level, and the identity authentication methods at this time are: username and password authentication, SMS verification code authentication, and UKey key authentication.

[0048] The application provides a four-port hiding device based on a zero-trust architecture, comprising a memory and a processor; the memory stores executable instructions, and the processor is configured to execute the executable instructions in the memory to implement the steps of the four-port hiding method based on the zero-trust architecture.

[0049] The application has the following advantages:

[0050] (1) Enhanced security: in view of the vulnerability of the SPA single-package knocking technology in front of the network attack surface, the application significantly enhances the security of the system and reduces the risk of being attacked through multi-level identity verification and trust evaluation and a four-port knocking mechanism;

[0051] (2) Fine access control: in view of the insufficient depth of identity verification and access control in the SPA mechanism, the application realizes more fine access control through dynamic adjustment of trust levels and strict permission management, and ensures that even legitimate users can only access authorized resources;

[0052] (3) Adapt to complex network environment: in view of the security vulnerabilities of the SPA mechanism in specific network configurations (such as shared public IP), the application can maintain high security in complex and variable network environments through the four-port hiding technology and continuous terminal trust state monitoring;

[0053] (4) User experience optimization: the application automatically simplifies the authentication process according to the user's behavior patterns and historical records through dynamic adjustment of trust levels, improving the user experience while not affecting the security;

[0054] (5) Continuous terminal trust state monitoring: the application detects the terminal trust state before and after login to ensure the continuous effectiveness of the user identity, and takes security measures immediately if the trust level decreases, further enhancing the overall security of the system. BRIEF DESCRIPTION OF DRAWINGS

[0055] Figure 1 The overall flowchart of the UDP SPA knocking.

[0056] Figure 2 The flowchart of the four-port hiding method based on the zero-trust architecture provided by the application.

[0057] Figure 3 The flowchart of the multi-factor continuous trust evaluation and update method.

[0058] Figure 4 The flowchart of the trust level adjustment method based on continuous user behavior monitoring. DETAILED DESCRIPTION

[0059] The present invention provides a quadruple port hiding method based on zero trust architecture, which is built on the basis of zero trust architecture. Its components mainly include SDP client, SDP controller, SDP gateway and business system containing resources. Figure 2 As shown, the quadruple port hiding method based on zero-trust architecture of the present invention mainly includes four stages: authentication and authorization stage, tunnel establishment stage, continuous evaluation stage, and access control stage.

[0060] The present invention is mainly implemented using a quadruple port hidden zero-trust access control solution. The quadruple port hidden zero-trust access control solution is an innovative security measure. Different from the traditional SPA single knocking technology, this solution implements a quadruple port knocking mechanism to achieve comprehensive protection enhancement for user access and business services. This solution achieves "true invisibility" of business applications by knocking on the zero-trust security management platform (SDP controller), identity authentication port, VPN tunnel port in the SDP gateway, and business port. In addition, the solution also integrates diversified identity authentication strategies, encrypted data transmission, and strict authority management technology, which greatly reduces the exposure of business resources in the network, thereby significantly reducing security threats such as port scanning and DDoS attacks.

[0061] The present invention provides a quadruple port hiding method based on a zero-trust architecture, which mainly adopts a quadruple port hiding zero-trust access control solution. The specific implementation process is as follows:

[0062] Step S1: Authentication port knocking;

[0063] The user first needs to submit an authentication request to the SDP controller, which is the first step in identity verification. This stage ensures that only legitimate users can continue the subsequent authentication process.

[0064] Based on this, the specific implementation process of authentication port knocking is as follows:

[0065] Step S1.1: first knock operation;

[0066] Before the SDP client initiates an authentication request to the SDP controller, the SDP controller must open the relevant authentication ports to ensure it can receive the authentication request. To achieve this, the SDP client must perform the first knock. This operation not only marks the beginning of the quadruple port-hiding zero-trust access control solution but also serves as a key step in enhancing user access and business service protection.

[0067] Wherein, the door knocking is performed to the zero trust security management platform (SDP controller), identity authentication port, VPN tunnel port in SDP gateway and service port, and the specific process of each door knocking adopts the following steps S1.1.1-S1.1.3, the difference lies in the different knocked ports and different door knocking positions:

[0068] Step S1.1.1: Key negotiation and distribution;

[0069] The SDP controller serves as a central management node, responsible for key negotiation with each SDP client. This process usually involves generating temporary keys or using pre-set keys. Once the key negotiation is completed, the SDP controller distributes the corresponding keys to the corresponding SDP client, which will be used to build the UDP door knocking packet.

[0070] Step S1.1.2: SPA key calculation;

[0071] The SDP client calculates the SPA key based on the client unique identifier (such as MAC address or device ID), client random number and SPA private key, ensuring that the SPA key of each SDP client is unique and difficult to predict.

[0072] Step S1.1.3: Build and send UDP door knocking packet;

[0073] The SDP client encapsulates the calculated SPA key, its own information (such as client unique identifier) and the authentication port number to be accessed into a UDP data packet, which is then sent to the SDP controller as the "knocking" signal for the first contact.

[0074] Wherein, the specific content contained in the UDP door knocking packet is as follows:

[0075] (1) SDP client unique identifier: The SDP client must contain an information that can uniquely identify its own identity. This information can be a device ID, MAC address or other forms of unique identifier, which helps the SDP controller to identify and track the status of a specific SDP client.

[0076] (2) Trust value of SDP client user: The SDP client needs to carry a value representing the user's trust level. This value representing the user's trust level can be determined according to the user's static attribute information, dynamic behavior information, historical behavior, etc., which can help the SDP controller to evaluate the credibility of the user and adjust the subsequent security policy accordingly.

[0077] (3) Private key information carried by the SDP client: To ensure communication security, the SDP client also needs to carry a private key. This private key will be used to encrypt and decrypt communications with the SDP controller to protect sensitive information from being intercepted by third parties. The transmission of private key information must ensure its security and confidentiality to prevent it from being eavesdropped by unauthorized parties.

[0078] Step S1.2: Terminal trust assessment method based on spatiotemporal matrix fusion multi-trust factor model;

[0079] In the terminal trust assessment phase, this paper innovatively proposes a terminal trust assessment method based on a spatiotemporal matrix fusion multi-trust factor model. By integrating multiple key information parameters such as the terminal's operational behavior over time, geographic location changes, hardware performance indicators, and operating system version upgrades, it aims to accurately quantify the terminal's trust level. This proposed terminal trust assessment method based on a spatiotemporal matrix fusion multi-trust factor model not only dynamically adjusts the terminal's trust rating based on its real-time network and business behavior, but also establishes a threshold screening mechanism to effectively block access by terminals that do not meet business system security specifications.

[0080] like Figure 3 As shown, the left part describes multiple trust factors, specifically: Are there any abnormalities in user login time, number of logins, password similarity, keyboard and mouse behavior, etc.? Are there any abnormalities in terminal device information and information captured by host security protection? Are there any abnormalities in large traffic, number of accesses, access intervals, state transitions, and authorization lists? Has the base station information and environmental information changed? Use the EDR deployed on the terminal to determine whether a host security attack has occurred? Use the protocol parsing engine and attack detection engine to determine whether there is abnormal traffic behavior? The trust factors described above are normalized to obtain multiple trust factors x1, x2,…, x m , according to the collected multiple trust factors x1,x2,…,x m , constructing a spatiotemporal matrix of multiple trust factors with spatiotemporal attributes to calculate and update the terminal trust level; then, using the subjective hierarchical analysis method and the objective entropy value method, adaptively assign weights to the multiple trust factors, which can be dynamically configured; finally, based on the spatiotemporal matrix of multiple trust factors and the dynamically assigned trust factor weights, the terminal trust level for the current period is calculated. At the same time, the EDR deployed on the terminal is used to conduct correlation analysis with the terminal attack behaviors captured by the SDP gateway attack detection engine, and the SDP gateway protocol parsing engine is used to parse the passing traffic and analyze it based on five common traffic anomaly models (high traffic anomaly model, abnormal access number model, abnormal access interval model, state transition matrix model, and authorization list, etc.). The attack and abnormal behaviors associated with the SDP controller generate alarms in the SDP controller, and the terminal trust level is updated.

[0081] like Figure 3 As shown in Figure 2, the constructed multi-trust factor spatiotemporal matrix is ​​as follows:

[0082]

[0083] Among them, T1, T2, …, T m Represents the trust score of each trust factor.

[0084] Subjective weights are assigned using the subjective hierarchical analysis method. The subjective weights are assigned through the process of establishing a hierarchical expert model, constructing a discriminant matrix, hierarchical single sorting and consistency testing, hierarchical total sorting and consistency testing to ensure the rationality of the expert scoring. The specific calculation formula is as follows:

[0085]

[0086] Among them, CI represents the consistency index, λ max represents the maximum characteristic root, n represents the characteristic dimension, Represents weights, CI1, CI2,…, CI n Indicates the consistency index of different features.

[0087] The objective weights use the common objective entropy method, which overcomes the drawbacks of subjective assignment while offering high computational efficiency and meeting the model's lightweight requirements. Through standardization / dimensionless transformation, indicator weight comparison, indicator information entropy calculation, and weight calculation, the objective weight factor is obtained, and the objective weight is then assigned. The specific calculation formula is as follows:

[0088]

[0089] Among them, H(x) represents the information entropy of the indicator, P(x i ) represents the probability of indicator i, x i represents the i-th index, represents the objective weight of the i-th indicator, and k represents the number of indicators.

[0090] Combining the subjective weight assignment results and the objective weight assignment results, the comprehensive weight value is obtained. The specific calculation formula is as follows:

[0091]

[0092] Among them, W i Represents the comprehensive weight value, represents the subjective weight of indicator i, represents the objective weight of indicator i, and k represents the number of indicators.

[0093] Finally, the different trust factors are adaptively integrated to obtain the trust value. The specific calculation formula of the trust value is as follows:

[0094] T(t)=w1·T user +w2·T ter +w3·T env +w4·T beh

[0095] Where T(t) represents the trust value, w1 represents the weight of the user trust factor, w2 represents the weight of the terminal trust factor, w3 represents the weight of the environment trust factor, w4 represents the weight of the behavior trust factor, and T user represents the user trust factor, T ter represents the terminal trust factor, T env represents the environmental trust factor, T beh Represents the behavioral trust factor.

[0096] Step S2: trust-based multi-factor authentication;

[0097] After passing the first barrier, users will enter the deep identity authentication phase. This phase uses a diversified authentication strategy, including but not limited to username, password, and other verification information such as SMS verification codes and U-Key. This phase is based on trust-guided dynamic feedback from diversified authentication.

[0098] In order to ensure the security of the identity authentication process, the present invention designs a multi-factor authentication system based on dynamic trust evaluation, which allows the system to dynamically adjust the trust level according to the user's login behavior and usage habits. This function can not only improve the user experience of most users with high trust levels, but also screen out risky login behaviors, thereby ensuring the legitimacy of the logged-in user's identity to the greatest extent.

[0099] Based on this, the specific implementation process of trust-based multi-identity authentication is as follows:

[0100] Step S2.1: Initial state: low trust level;

[0101] When a user logs into the system for the first time, their initial trust level is set to the lowest level. This means that the user needs to prove their identity through the most stringent authentication method. This usually includes the following three main factors:

[0102] (1) Username and password authentication;

[0103] (2) SMS verification code authentication;

[0104] (3) UKey (U Shield) key authentication.

[0105] UKey authentication requires users to install a dedicated SDP client (such as the NetCert Secure SDP client) on their terminal and call the JavaScript interface provided by the SDP client to perform key authentication. This is a very secure but relatively complex authentication method, suitable for first-time logins or unusual logins.

[0106] Step S2.2: Intermediate trust level;

[0107] As users log in and use the system more frequently, the system begins to learn their regular behavior patterns, including login time, location, device type, etc. When a user's login behavior and usage habits gradually stabilize, the system automatically raises their trust level to medium.

[0108] At the intermediate trust level, the user authentication process is simplified to just a username and password, along with an SMS verification code. This not only improves the user experience but also maintains adequate security. During this stage, the system continues to monitor user behavior and further refines user profiles based on newly acquired data.

[0109] Step S2.3: Advanced trust level;

[0110] For users who consistently maintain a consistent login mode and operating habits, the system will further elevate their trust level to high. At this point, users only need to enter their username and password to complete the login process. This simplified authentication method greatly improves user convenience while also reducing unnecessary authentication steps.

[0111] Step S2.4: Dynamic trust level adjustment;

[0112] A dynamic trust level adjustment method based on continuous monitoring of user behavior is designed, so that users of different trust levels can dynamically improve their trust levels after a period of standardized login and use, thereby improving ease of use. At the same time, for users with dangerous login or operation behaviors, their trust levels are lowered, making their login verification methods more complex and requiring more verification processes. Even at intermediate and advanced trust levels, the system will continue to monitor the user's login environment and usage behavior. If an abnormal login event occurs, such as a change in the login environment or user behavior that is inconsistent with historical records, the system will immediately lower the user's trust level and require a more complex authentication method, such as re-enabling UKey key authentication.

[0113] Trust level reductions are determined based on the severity of the abnormal behavior. For example, a minor change in the login environment might result in a one-level trust reduction. However, if a serious abnormality is detected, such as excessive password attempts, the system might directly reduce the trust level to the lowest level.

[0114] In addition, the system also has a U-Shield status detection function, that is, after logging in with the UKey, it will continue to detect the insertion status of the UKey. Once the UKey is unplugged, the system will automatically log out and require the user to log in again.

[0115] Terminal trust status detection plays a role throughout the entire user login process. Before login, the system immediately collects terminal device information and calls the trust assessment API to obtain the user's initial trust level. After login, the system continues to collect terminal device information and regularly updates the trust level. If the user's trust level drops below the initial trust level, the system disconnects the user and requires them to log in again.

[0116] like Figure 4 As shown, the specific implementation process of the above-mentioned trust level adjustment method based on continuous monitoring of user behavior is as follows:

[0117] When a user logs into the system for the first time, the initial trust level is the lowest level, and the user name and password + SMS verification code + UKey (U shield) key are used for authentication;

[0118] After a user successfully logs into the system for the first time, an initial trust value (such as 0.5) is assigned. The system continuously monitors user behavior, including trust parameter calculation, attack behavior detection, abnormal behavior analysis, etc. The trust score is calculated based on the weight matrix and compared with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust is still low. When the trust risk value is less than the risk threshold, the system raises the user's trust level to medium. During this process, the system continuously learns the user's regular behavior patterns, including login time, location, device type, etc., until the user's login behavior and usage habits gradually stabilize. When the user logs into the system again, the system automatically raises their trust level to medium. In the trust level, username and password + SMS verification code are used for authentication.

[0119] After a user successfully logs into the system multiple times, the system continues to monitor the user's behavior, including trust parameter calculation, attack behavior detection, abnormal behavior analysis, etc., calculates the trust risk value, and compares it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust level is still low. When the trust risk value is less than the risk threshold, the system raises the user's trust level to high. During this process, the system continuously learns the user's regular behavior patterns, including login time, location, device type, etc., until the user's login behavior and usage habits gradually stabilize. When the user logs into the system again, the system automatically raises their trust level to high. A high trust level uses username and password for authentication.

[0120] After the user successfully logs in the system for multiple times, the system continues to monitor the user behavior, including trust parameter calculation, attack behavior detection, abnormal behavior analysis, etc., to calculate the trust risk value and compare it with the risk threshold value, and when the trust risk value is greater than the risk threshold value, the system returns to the login interface, and the trust degree of the user is still medium or low.

[0121] According to the trust level of the user, the complexity of the authentication mode is dynamically adjusted from the multi-authentication of the lowest trust level to the simplified authentication of the highest trust level, and through the multi-level identity authentication and trust evaluation method, the security can be ensured and the user experience can be improved.

[0122] Step S3: tunnel port knocking;

[0123] After completing the deep identity authentication, the user needs to apply for establishing a secure tunnel connection to the SDP gateway through the system guidance, and the establishment of the secure tunnel provides encryption protection for data transmission, further enhancing the security of the system.

[0124] After the deep identity authentication is passed, the SDP client needs to initiate a tunnel connection request to the SDP controller, so as to open the tunnel connection port of the SDP gateway side and establish a connection, and the specific implementation process is as follows:

[0125] Step S3.1: the SDP client initiates a tunnel connection request;

[0126] The SDP client application or device applies to access the protected target resource, and sends a tunnel connection request to the SDP controller. The tunnel connection request may contain the basic information of the SDP client, such as the device ID or IP address.

[0127] Step S3.2: identity authentication;

[0128] After receiving the request, the SDP controller verifies the identity of the SDP client. Since the identity authentication operation has been passed before, the identity authentication at this time mainly focuses on confirming the unique identification of the SDP client, and ensuring that the request comes from the verified SDP client user.

[0129] Step S3.3: establish a tunnel;

[0130] Once the SDP client passes the identity authentication, the SDP controller sends an instruction to the SDP gateway to open the tunnel port. The SDP gateway creates an encrypted tunnel for the SDP client. Usually, SSL / TLS protocol or other encryption means are used to ensure the security of data transmission.

[0131] Through the above steps, the SDP client can establish a secure tunnel connection with the SDP gateway, providing protection for subsequent data transmission. This process not only enhances security, but also ensures that only authenticated SDP clients can access protected target resources.

[0132] Step S4: knock on the service port;

[0133] Finally, after establishing a secure tunnel, the SDP client knocks on the tunnel door, requesting access to the service port. The system strictly restricts access to the service port based on the authenticated user's role permissions, ensuring that only users with the appropriate permissions can access specific resources. Strict control of role permissions ensures that even legitimate users can only access the resources they are authorized to access, further strengthening system security.

[0134] In the quadruple port hiding zero-trust access control solution, after establishing a secure tunnel, the SDP client still needs to knock on the service port to access the business system. The specific implementation process is as follows:

[0135] Step S4.1: prepare knock data packet;

[0136] After establishing a secure tunnel, the SDP client needs to prepare a knocking packet containing a service access request. The knocking packet may contain the unique identifier of the SDP client and information about the service resources requested for access.

[0137] Step S4.2: Send a knock packet;

[0138] The SDP client sends a knock packet to the SDP gateway through the established secure tunnel. The destination of the knock packet is the service port, which is the specific service resource that the SDP client wants to access.

[0139] Step S4.3: The SDP gateway processes the knock request;

[0140] After receiving the knock packet, the SDP gateway verifies the legitimacy of the request based on the unique identifier of the SDP client and other relevant information. If the request is legitimate, the SDP gateway sends a confirmation message to the SDP controller.

[0141] Step S4.4: SDP controller verification;

[0142] The SDP controller re-verifies the identity and access rights of the SDP client. If the verification is successful, the SDP controller instructs the SDP gateway to open the corresponding service port, allowing the SDP client to access the specified service resources.

[0143] Step S4.5: Open the service port;

[0144] The SDP gateway opens the service port according to the instructions of the SDP controller, and the SDP client can now interact directly with the business system.

[0145] The present invention hides a zero-trust access control solution through a quadruple port, that is, a knocking process through four stages: authentication port, trust-based multi-identity authentication, tunnel port, and business port, which greatly increases the difficulty for attackers to discover effective attack paths.

[0146] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A quadruple port hiding method based on zero trust architecture, characterized in that: The following steps are involved: Step S1: Authentication port knocking; Step S1.1: first knock operation; Step S1.2: Terminal trust assessment method based on spatiotemporal matrix fusion multi-trust factor model; Firstly, a multi-trust factor spatiotemporal matrix with spatiotemporal attributes is constructed to calculate and update the terminal trust level; Then, subjective analytic hierarchy process and objective entropy method are used to adaptively weight multiple trust factors; Finally, the terminal trust level of the current period is calculated based on the multi-trust factor spatiotemporal matrix and the dynamically assigned trust factor weights; The EDR deployed on the terminal is used to correlate and analyze terminal attack behaviors captured by the SDP gateway attack detection engine. The SDP gateway protocol parsing engine parses the passing traffic and analyzes it based on five common traffic anomaly models. The associated attack and anomaly behaviors on the SDP controller side generate alarms in the SDP controller, and the terminal trust level is updated. In the subjective hierarchical analysis method, the subjective weight is assigned through the process of establishing a hierarchical expert model, constructing a discriminant matrix, hierarchical single sorting and consistency test, hierarchical total sorting and consistency test. The specific calculation formula is: Among them, CI represents the consistency index, λ max represents the maximum characteristic root, n represents the characteristic dimension, Represents weights, CI1, CI2,…, CI n Indicators representing consistency across different features; In the objective entropy method, the objective weight factor is obtained through standardization / dimensionless transformation, indicator weight comparison, indicator information entropy calculation, and weight calculation steps, and then the objective weight is assigned. The specific calculation formula is: Among them, H(x) represents the information entropy of the indicator, P(x i ) represents the probability of indicator i, x i represents the i-th index, represents the objective weight of the i-th indicator, and k represents the number of indicators; Combining the subjective weight assignment results and the objective weight assignment results, the comprehensive weight value is obtained. The specific calculation formula is as follows: Among them, W i Represents the comprehensive weight value, represents the subjective weight of indicator i, represents the objective weight of indicator i, and k represents the number of indicators; Finally, different trust factors are adaptively integrated to obtain the trust value, and its specific calculation formula is as follows: T(t)=w1·T user +w2·T ter +w3·T env +w4·T beh Where T(t) represents the trust value, w1 represents the weight of the user trust factor, w2 represents the weight of the terminal trust factor, w3 represents the weight of the environment trust factor, w4 represents the weight of the behavior trust factor, and T user represents the user trust factor, T ter represents the terminal trust factor, T env represents the environmental trust factor, T beh represents the behavioral trust factor; Step S2: Trust-based multi-factor authentication; Step S2.1: Initial state: low trust level; Step S2.2: Intermediate trust level; Step S2.3: Advanced trust level; Step S2.4: Dynamic trust level adjustment method based on continuous monitoring of user behavior; Before a user logs into the system, the system collects terminal device information and calls the trust assessment interface to obtain the user's initial trust level. After the user logs into the system, the system continues to collect terminal device information and regularly updates the trust level. If the user's trust level drops below the initial trust level, the system will disconnect and require the user to log in again. Step S3: Tunnel port knocking; The SDP client initiates a tunnel connection request to the SDP controller. After receiving the tunnel connection request, the SDP controller verifies the identity of the SDP client. After the SDP client passes the identity verification, the SDP controller sends a command to the SDP gateway, instructing it to open the tunnel port. The SDP gateway then creates an encrypted tunnel for the SDP client. Step S4: knock on the service port; Prepare a knocking packet containing a business access request; the SDP client sends the knocking packet to the SDP gateway through the established tunnel; after receiving the knocking packet, the SDP gateway verifies the legitimacy of the request based on the unique identifier of the SDP client and other relevant information. If the request is legitimate, the SDP gateway will send a confirmation message to the SDP controller; the SDP controller will verify the identity of the SDP client and its access rights again. If the verification is successful, the SDP controller will instruct the SDP gateway to open the corresponding business port and allow the SDP client to access the specified business resources; after the SDP gateway opens the business port according to the instructions of the SDP controller, the SDP client can interact directly with the business system.

2. A quadruple port hiding method based on zero trust architecture according to claim 1, characterized in that: The specific implementation process of step S1.1 is as follows: Step S1.1.1: key negotiation and distribution; The SDP controller, as the central management node, is responsible for negotiating keys with each SDP client, generating temporary keys or using pre-set keys. After the key negotiation is complete, the SDP controller distributes the corresponding keys to the corresponding SDP clients. These keys will be used to construct UDP knock packets. Step S1.1.2: SPA key calculation; The SDP client calculates the SPA key based on the client unique identifier, the client random number, and the SPA private key, ensuring that the SPA key of each SDP client is unique and difficult to predict; Step S1.1.3: Build and send a UDP knock packet; The SDP client encapsulates the calculated SPA key, its own information, and the authentication port number to be accessed into a UDP packet, which is then sent to the SDP controller as a knock signal for initial contact.

3. A quadruple port hiding method based on zero trust architecture according to claim 2, characterized in that: The UDP knocking packet includes: a unique identifier of the SDP client, a trust value of the SDP client user, and private key information carried by the SDP client.

4. A quadruple port hiding method based on zero trust architecture according to claim 1, characterized in that: In step S2.4, the specific implementation process of the dynamic trust level adjustment method based on continuous monitoring of user behavior is as follows: When a user logs into the system for the first time, their initial trust level is the lowest level, and the user name and password + SMS verification code + UKey key are used for authentication; After a user successfully logs into the system for the first time, the system continuously monitors the user's behavior, calculates the trust risk value, and compares it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust level remains low. When the trust risk value is less than the risk threshold, the system raises the user's trust level to medium. During this process, the system continuously learns the user's regular behavior patterns until the user's login behavior and usage habits gradually stabilize. When the user logs into the system again, the system automatically raises their trust level to medium. At the medium trust level, user name and password + SMS verification code are used for authentication. After a user successfully logs in to the system multiple times, the system continues to monitor the user's behavior, calculates the trust risk value, and compares it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust level remains low. When the trust risk value is less than the risk threshold, the system raises the user's trust level to high. During this process, the system continuously learns the user's regular behavior patterns until the user's login behavior and usage habits gradually stabilize. When the user logs in to the system again, the system automatically raises their trust level to high. With a high trust level, authentication is performed using username and password. After a user successfully logs in to the system multiple times, the system continues to monitor the user's behavior, calculates the trust risk value, and compares it with the risk threshold. When the trust risk value is greater than the risk threshold, the system returns to the login interface and the user's trust level remains medium or low.

5. A quadruple port hiding method based on zero trust architecture according to claim 1, characterized in that: In step S2.1, when a user logs into the system for the first time, his / her initial trust level is set to the lowest level. At this time, the identity authentication methods are: username and password authentication, SMS verification code authentication and UKey key authentication.

6. A quadruple port hiding device based on zero trust architecture, characterized in that: include: memory and processor; The memory stores executable instructions, and the processor is configured to execute the executable instructions in the memory to implement the steps of a quadruple port hiding method based on a zero trust architecture as described in any one of claims 1 to 5.

Images