Zero-trust security access control system and method

Abstract

The embodiment of the invention provides a zero-trust security access control system and method. Relates to the technical field of cloud services. The system comprises a zero-trust client, a zero-trust access gateway, a zero-trust control center and a zero-trust access control gateway, and the zero-trust client is used for collecting user terminal information, user behavior information and environment information; the zero-trust control center is used for issuing an admission permission command to the zero-trust admission gateway according to a preset security admission strategy; and, according to a preset access control authority, issuing a command whether to allow access to the zero-trust access control gateway, the zero-trust access gateway is used for allowing the zero-trust client to connect according to the access command; and the zero-trust access control gateway is used for allowing the zero-trust client to access the target application according to the access command. The method is used for achieving comprehensive visibility of user behaviors and network activities in a cloud desktop scene, and the effect of improving user experience is achieved.

Description

Technical Field

[0001] The present application relates to the field of cloud service technology, and in particular to a zero-trust security access control system and method. Background Art

[0002] With the development of online and mobile business and the emergence of remote work, the network security boundaries of enterprises are constantly expanding and becoming more blurred, which has led to many external risks and threats. Traditional network security protection frameworks are difficult to cope with internal and external threats such as blurred network boundaries, complex network structures, and diverse access modes. Therefore, how to effectively respond to the increasing network security risks, reduce the exposure rate of enterprise networks, and ensure network access security has become an urgent problem to be solved.

[0003] At present, based on the concept of zero trust, network location no longer determines access rights. Before access is allowed, all access subjects need to undergo identity authentication and authorization. Identity authentication is no longer just for users, but will also identify and authenticate multiple identities such as terminal devices and access applications, and identity authentication will be initiated multiple times during the access process.

[0004] However, in the cloud desktop scenario, zero trust needs to ensure that all users and devices are strictly authenticated and authorized when accessing cloud desktop resources, which leads to frequent verification and affects the user experience. Summary of the invention

[0005] The embodiments of the present application provide a zero-trust security access control system and method for achieving full visibility of user behavior and network activities in a cloud desktop scenario, thereby improving the user experience.

[0006] In a first aspect, an embodiment of the present application provides a zero-trust security access control system, including: a zero-trust client, a zero-trust access gateway, a zero-trust control center, and a zero-trust access control gateway, wherein:

[0007] The zero-trust client includes a first zero-trust client and a second zero-trust client, wherein the first zero-trust client is deployed in a user device and is used to collect user terminal information, user behavior information, and environmental information, and transmit the collected information to a zero-trust control center; the second zero-trust client is deployed in a cloud desktop virtual machine and is used to connect to a zero-trust access control gateway;

[0008] The zero trust control center is used to receive information sent by the zero trust client, and determine whether the user is in a safe state according to the preset security access policy, so as to issue a command to the zero trust access gateway whether to allow access; and receive access control sent by the zero trust client, and determine whether the user is allowed to access the target application according to the preset access control authority, so as to issue a command to the zero trust access control gateway whether to allow access;

[0009] Zero Trust Access Gateway, which is used to receive access permission commands issued by the Zero Trust Control Center and allow Zero Trust clients to connect based on the access commands;

[0010] The zero-trust access control gateway is used to receive access permission commands issued by the zero-trust control center, and allow the zero-trust client to access the target application based on the access commands.

[0011] In a second aspect, an embodiment of the present application provides a zero-trust security access control method, which is applied to a zero-trust client of a zero-trust security access control system. The zero-trust security access control system also includes a zero-trust admission gateway, a zero-trust control center, and a zero-trust access control gateway. The zero-trust security access control method includes:

[0012] When a user accesses the target application, user terminal information, user behavior information, and environment information are collected and transmitted to the zero trust control center;

[0013] If the user terminal information, user behavior information, and environment information are verified by the zero-trust control center, the cloud desktop virtual machine corresponding to the target application is accessed through the zero-trust access gateway;

[0014] If the user's access rights to the target application are verified through the Zero Trust Control Center, the target application is accessed through the Zero Trust Access Control Gateway.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0016] Memory stores computer-executable instructions;

[0017] The processor executes the computer execution instructions stored in the memory to implement the zero-trust security access control method as described in the second aspect.

[0018] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the zero-trust security access control method as in the second aspect.

[0019] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the zero-trust security access control method as in the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0021] Figure 1 A schematic diagram of the application scenario provided for this application;

[0022] Figure 2 A schematic diagram of the structure of the zero-trust security access control system provided for this application;

[0023] Figure 3 Schematic diagram of the zero-trust security access control method provided for this application Figure 1 ;

[0024] Figure 4 Schematic diagram of the zero-trust security access control method provided for this application Figure 2 ;

[0025] Figure 5 Schematic diagram of the zero-trust security access control method provided for this application Figure 3 ;

[0026] Figure 6 Schematic diagram of the zero-trust security access control method provided for this application Figure 4 ;

[0027] Figure 7 A schematic diagram of the structure of the electronic device provided in this application.

[0028] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0029] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0030] First, the terms involved in this application are explained:

[0031] Zero Trust: refers to a network security protection concept, the key of which is to break the default "trust" and adopt "continuous verification, never trust". That is, by default, any user, device and system inside or outside the enterprise network is not trusted, and the trust foundation of access control is rebuilt based on identity authentication and authorization, so as to ensure that the identity, device, application and link are trustworthy.

[0032] Cloud desktop: also known as "desktop virtualization" or "cloud computer", is a new model that replaces traditional computers. It means that after the user installs the client, he accesses the virtual host on the back-end server through a unique communication protocol to achieve interactive operations and achieve the same experience as a computer. Since the client obtains videos or images, it can achieve a strict data non-drop effect.

[0033] Figure 1 A schematic diagram of the application scenario provided for this application, such as Figure 1 As shown, the specific application scenarios of the present application include a cloud desktop virtual machine 101 and a target application 102. The user can install the client on the cloud desktop virtual machine 101, and then needs to be verified by an identity authentication system. The identity authentication system may include multi-factor authentication (Multi-Factor Authentication, MFA), such as passwords, SMS verification codes, biometrics, etc., to ensure the authenticity of the user's identity. Once the identity authentication is successful, the user needs additional network configuration, such as a virtual private network (Virtual Private Network, VPN) or a dedicated network channel to ensure a secure connection to the cloud desktop virtual machine 101. In a cloud desktop environment, users can access internal network resources, including the target application 102, through the internal network's access control list (Access Control List, ACL) or firewall rules.

[0034] Combined with the above scenario, it can be seen that in the prior art, for some enterprises with strict security requirements, in order to meet the requirement that data is not landed, cloud desktops will be used as a precondition for remote access, that is, after users need to log in to the zero-trust software-defined perimeter (SDP), they cannot directly access the internal applications of the enterprise, and need to log in to the cloud desktop again to access the enterprise intranet applications in the cloud desktop. However, since the zero-trust SDP is only installed on the user's Internet computer, and it is the cloud desktop that actually initiates access to the application, the access policy for accessing the application in the zero-trust SDP cannot play a role, and the user's access rights to the application cannot be dynamically adjusted according to the user's identity and security attributes. If the zero-trust SDP is installed again in the cloud desktop and multi-factor authentication is performed, there may be a high delay, which will involve resource consumption of the cloud desktop, resulting in problems such as poor user experience due to multiple logins and overlapping policy judgments.

[0035] The zero-trust security access control system provided by the present application deploys zero-trust client terminals in user devices and cloud desktop virtual machines respectively through functional tailoring, uses the first zero-trust client on the user device to collect security information, verifies the security access policy through the zero-trust access gateway connected to the client, and considers the user safe if the conditions are met, and can log in to the cloud desktop later; installs a lightweight second zero-trust client in the cloud desktop, reduces the number of user logins by transparently transmitting user credentials, and only performs access control permission verification, thereby realizing multi-strategy discrimination in remote access and cloud desktop scenarios. Specifically, step-by-step verification is performed through the zero-trust access gateway and the zero-trust access control gateway, that is, the user's security status is verified through the zero-trust access gateway, and after passing, the user-based access control is further verified through the zero-trust access control gateway, thereby performing part of the identity authentication and authorization in different environments respectively, without the need for frequent verification in cloud scenarios, and at the same time ensuring that only users and devices that have been verified at multiple levels can see and access specific resources. These gateways act as dynamic boundaries. While effectively ensuring that remote access data does not fall to the ground, they can give full play to the multi-policy verification of zero-trust access control and access control to achieve dynamic and refined access control. The zero-trust client in the cloud desktop virtual machine is lightweight and does not collect security information. The zero-trust access control gateway does not perform real-time security access verification, thereby achieving low resource consumption of the cloud desktop. In addition, the zero-trust client in the cloud desktop virtual machine does not need to be authenticated multiple times to improve the user experience.

[0036] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0037] Figure 2 This is a schematic diagram of the structure of the zero-trust security access control system provided for this application. Figure 2 As shown, the zero-trust security access control system includes: a zero-trust client, a zero-trust access gateway, a zero-trust control center, and a zero-trust access control gateway, wherein:

[0038] The zero-trust client includes a first zero-trust client and a second zero-trust client. The first zero-trust client is deployed in the user device and is used to collect user terminal information, user behavior information, and environmental information, and transmit the collected information to the zero-trust control center; the second zero-trust client is deployed in the cloud desktop virtual machine and is used to connect to the zero-trust access control gateway.

[0039] In this embodiment, the first zero-trust client is deployed on the user device and is responsible for collecting user terminal information, such as device type, operating system version, etc., user behavior information, such as login time, access frequency, etc., and environmental information, such as network location, IP address, etc. This information is transmitted to the zero-trust control center for evaluating the user's security status.

[0040] The second zero-trust client is deployed in the cloud desktop virtual machine and is responsible for connecting to the zero-trust access control gateway. It can also obtain the identity credentials transmitted by the first zero-trust client through the cloud desktop. The second zero-trust client does not collect security information, but verifies access control permissions through the zero-trust access control gateway connected to it to ensure that the user's operations in the cloud desktop environment comply with the preset security policies, so as to further access the target application.

[0041] It is understandable that by functionally tailoring the zero-trust client, the second client in the cloud desktop virtual machine does not need to perform multi-level verification, but instead adopts a lightweight deployment, which reduces the impact on device performance, effectively reduces system load, and improves overall operating efficiency.

[0042] The zero trust control center is used to receive information sent by the zero trust client, and determine whether the user is in a safe state based on the preset security access policy, so as to issue a command to the zero trust access gateway whether to allow access; and receive access control sent by the zero trust client, and determine whether the user is allowed to access the target application based on the preset access control permissions, so as to issue a command to the zero trust access control gateway whether to allow access.

[0043] In this embodiment, the zero trust control center serves as the core decision-making component of the system. On the one hand, it receives information from the first zero trust client, and uses this information to evaluate the user's security status according to the preset security access policy, determines whether the user is in a safe state, and then issues a command to the zero trust access gateway to allow access. On the other hand, it manages access control permissions, determines whether the user has the permission to access a specific target application, and then issues a command to the zero trust access control gateway to allow access. That is, it dynamically adjusts access permissions based on factors such as user identity, role, behavior, and environment.

[0044] Among them, the preset security access policy can refer to device compliance checks, such as operating system version, patch status, etc., user behavior patterns, such as abnormal login attempts, and network environment, such as IP address, geographic location, etc.

[0045] Furthermore, the zero-trust control center can implement refined access control management for target applications based on preset user role-based access control (RBAC) and other access control models and permissions as well as the user's security status. Then, a ternary relationship model is established based on the user, security status, and target application to be accessed, so that only the specified user can implement refined access control to the specified application or a uniform resource locator (URL) of the specified application in the specified security state. Therefore, when the user's security status is abnormal, the zero-trust control center can adjust the user's permissions in a timely manner, implement dynamic authorization, and prevent the user from passing the authentication of the zero-trust access control gateway.

[0046] It is understandable that through centralized policy management and real-time analysis, the zero-trust control center can quickly respond to security threats, ensure that only users and devices that meet security standards can access the system, and dynamically adjust access rights based on real-time information to achieve refined access control and adapt to the ever-changing security environment. Furthermore, through automated decision-making processes and policy management, human intervention is reduced and the system's response speed and efficiency are improved.

[0047] The zero-trust access gateway is used to receive access permission commands issued by the zero-trust control center, and allow zero-trust clients to connect based on the access commands.

[0048] In this embodiment, the zero-trust access gateway receives commands from the zero-trust control center and decides whether to allow the user device to connect to the system. It is the first line of defense for users to enter the system, ensuring that only verified users can enter the network, that is, only after the zero-trust control center confirms that the user and device comply with the security access policy, the zero-trust access gateway will allow the zero-trust client (the first zero-trust client on the user device) to establish a connection with the system.

[0049] It can be understood that by strictly controlling the initial connection request, the zero-trust access gateway can effectively prevent unauthorized devices and users from entering the network, reducing security risks. At the same time, the zero-trust access gateway can dynamically respond to the commands of the zero-trust control center and quickly adjust the connection status to respond to potential security threats or policy changes. In addition, by limiting the devices and users connected to the network, the zero-trust access gateway effectively reduces the attack surface of the system and improves overall security.

[0050] The zero-trust access control gateway is used to receive access permission commands issued by the zero-trust control center, and allow the zero-trust client to access the target application based on the access commands.

[0051] In this embodiment, the zero-trust access control gateway is responsible for receiving access commands from the zero-trust control center and deciding whether to allow users to access specific target applications. It ensures that users comply with all security policies and permission requirements when accessing resources, that is, only after the zero-trust control center confirms that the user complies with the access control policy, the zero-trust access control gateway will allow the zero-trust client (the second zero-trust client deployed on the cloud desktop virtual machine) to access specific applications or resources.

[0052] It is understandable that by strictly controlling user access to applications and resources, the zero-trust access control gateway can effectively prevent unauthorized access and protect sensitive data and applications. Through fine-grained permission control, the zero-trust access control gateway can meet complex business needs and ensure that users can only access their authorized resources. Similar to the zero-trust admission gateway, the zero-trust access control gateway can quickly receive access permission commands issued by the zero-trust control center, so that access permissions can be dynamically adjusted according to real-time information and policy changes, ensuring that the system can quickly respond to security threats and business needs.

[0053] As an example, in large enterprises, such as banks, employees need to remotely access internal company applications and data. By deploying the first zero-trust client on the employee's computer, the enterprise can collect device and behavior information to ensure that only devices that meet security standards can connect to the company network, while the second zero-trust client deployed on the cloud desktop virtual machine can ensure that employees can only access their authorized applications. The Zero Trust Control Center can be used to manage employees' network access rights. By analyzing employees' device and behavior information in real time, potential security threats can be quickly identified, and access rights can be adjusted to prevent data leakage. The Zero Trust Access Gateway can ensure that only verified employee devices can connect to the company network, and the Zero Trust Access Control Gateway can manage employees' access rights to internal applications, thereby enabling employees to remotely access internal company applications and data.

[0054] The zero-trust security access control system provided in this application can ensure that only users and devices that have passed multiple layers of verification can access resources through a multi-level verification mechanism, thereby reducing security risks. At the same time, the zero-trust control center can dynamically adjust security policies based on real-time information to achieve refined access control. The lightweight design of the second zero-trust client reduces the multiple authentication steps required in the cloud desktop virtual machine, improves the user experience, and reduces the consumption of cloud desktop and network resources.

[0055] Based on the above embodiments, Figure 3 Schematic diagram of the zero-trust security access control method provided for this application Figure 1 .like Figure 3 As shown, in this embodiment Figure 1 to Figure 2Based on the embodiment, the method is applied to a first zero-trust client and specifically includes the following steps:

[0056] S301. Obtain user terminal information, user behavior information, and environmental information to establish a risk profile of the user.

[0057] Among them, user terminal information can refer to device-related information, such as device type, operating system version, patch status, device security settings (such as firewall status, antivirus software status), etc. This information helps to evaluate the security and compliance of the device.

[0058] User behavior information may refer to the user's behavior patterns, including login time, access frequency, accessed applications and data, abnormal behavior (such as multiple failed login attempts), etc. This behavior information helps identify potential security threats and abnormal activities.

[0059] Environmental information may refer to the network environment information of the user, such as IP address, geographic location, network type (such as public wireless network, corporate network), network security (such as encryption status), etc. This information helps to determine the security of the user's current environment.

[0060] Risk profiling refers to a multi-dimensional assessment of the user's security status based on the above information, which helps the system identify potential security threats and provide a basis for subsequent access control decisions.

[0061] It is understandable that by comprehensively collecting and analyzing user information, the system can more accurately identify security threats and abnormal behaviors and improve overall security. Based on risk profiling, the system can formulate personalized security strategies for different users to ensure that the user experience is optimized while meeting security needs.

[0062] S302. Based on the user's risk profile, receive the access permission command transmitted by the zero-trust access gateway. If it is in a safe state, access the internal network.

[0063] Among them, the zero-trust access gateway transmits a command to the first zero-trust client to allow access according to the instructions of the zero-trust control center. This command is generated based on the user's risk profile and the preset security access policy. Since the risk profile provides a comprehensive view of the user's current security status, if the user is assessed to be in a safe state (that is, the risk profile does not show any abnormalities or potential threats), the access command allows the user to access the internal network, enabling the user to access company resources, applications and data.

[0064] It can be understood that through strict access control, the system ensures that only verified and secure users can access the internal network, preventing unauthorized access, and for users who are assessed to be secure, the system is able to quickly approve access requests, reducing unnecessary delays and interference.

[0065] Optionally, the second zero-trust client communicates with the first zero-trust client through the cloud desktop to obtain the user identity credentials of the first zero-trust client.

[0066] Among them, user identity credentials may include user name, password, two-factor authentication token, digital certificate and other information.

[0067] In this embodiment, the second zero-trust client is deployed in the cloud desktop virtual machine, and the first zero-trust client is deployed on the user device. A secure communication channel is established between the two to exchange necessary authentication information. After obtaining the user's identity credentials, the second zero-trust client can authenticate the user in the cloud desktop environment to ensure that the user's identity has been verified and complies with the access policy. This communication and step-by-step verification mechanism ensures that the operations in the cloud desktop are consistent with the identity status on the user's device.

[0068] The zero-trust security access control method provided in this application performs an initial risk verification on the first zero-trust client on the user's device, and conducts a real-time assessment of the user's security status based on the user's multi-dimensional information, so that the zero-trust security access control system can more accurately identify abnormal behavior and quickly respond to potential security threats.

[0069] Based on the above embodiments, Figure 4 Schematic diagram of the zero-trust security access control method provided for this application Figure 2 .like Figure 4 As shown, in this embodiment Figures 1 to 3 Based on the embodiment, the method is applied to a zero trust control center and specifically includes the following steps:

[0070] S401. When receiving the access control sent by the zero-trust client, perform access control on the target application based on the access control model, the user's access control authority, and the user security status data returned by the first zero-trust client.

[0071] The access control model defines the access rights of users under different conditions. In this embodiment, the access control model may refer to role-based access control (RBAC) or attribute-based access control (ABAC).

[0072] A user's access control permissions are pre-defined based on the user's role, responsibilities, historical behavior, and other relevant factors. Access control permissions determine which resources a user can access and which operations they can perform.

[0073] User security status data includes user terminal information, behavior information and environment information, reflecting the user's current security status.

[0074] The access control sent by the zero-trust client is initiated by the second zero-trust client deployed in the cloud desktop virtual machine, and is intended to access a specific target application. After receiving the above access control, the zero-trust control center comprehensively evaluates the user's access request based on the access control model, user permissions and security status data. If all conditions meet the security and policy requirements, the zero-trust control center will allow the user to access the target application, otherwise access will be denied.

[0075] It is understandable that by integrating multiple factors for access control, the system can more accurately identify and prevent potential security threats, ensuring that only verified users can access sensitive resources. At the same time, the combination of access control models and user permissions enables the system to achieve refined permission management, thereby meeting complex business needs.

[0076] S402: Authorize and control user access to resources in real time according to the user's security status and target application.

[0077] It should be noted that the Zero Trust Control Center analyzes the security requirements and access policies of the target application specified in the access request. Different applications may have different security levels and access control requirements. Based on the user's security status and the security requirements of the target application, the control center makes real-time authorization decisions, which include allowing, restricting or denying the user's access to specific resources. The Zero Trust Control Center's real-time authorization of user access to resources means that the system can dynamically adjust the user's access rights based on the latest security status and policy changes.

[0078] In this embodiment, the first zero trust client and the second zero trust client are both connected to the zero trust control center. The zero trust control center is specifically used to: uniformly manage and coordinate data from the first zero trust client and the second zero trust client, and dynamically adjust permissions and access policies based on the user's security status, user role, and target application.

[0079] The security status includes the security of the device, the user's behavior pattern, and the security of the environment. The user role defines the user's responsibilities and permissions in the organization. The security requirements of the target application determine the strictness of access control.

[0080] It should be noted that the first zero-trust client provides user terminal information, behavior information and environment information, while the second zero-trust client provides access requests and status information related to the cloud desktop. The zero-trust control center is responsible for receiving and managing data from the first zero-trust client and the second zero-trust client, and can integrate and analyze the data from the two clients to form a complete user security status view, so as to more accurately assess the user's security risks and access needs.

[0081] Understandably, the Zero Trust Control Center is able to implement access policies in real time, adjust user access rights based on the latest security status and business needs, and ensure that the system is always in a secure state.

[0082] The zero-trust security access control method provided by this application authorizes and controls user access to resources in real time based on the user's security status and target application through the zero-trust control center, ensuring that the system can quickly respond to security threats, prevent unauthorized access and potential data leakage, and dynamically adjust access rights based on real-time information to adapt to the ever-changing security environment and business needs. Furthermore, through real-time authorization, the system can reduce unnecessary access delays and improve user experience while ensuring security.

[0083] Based on the above embodiments, Figure 5 Schematic diagram of the zero-trust security access control method provided for this application Figure 3 .like Figure 5 As shown, in this embodiment Figures 1 to 4 Based on the embodiment, the method is applied to a zero-trust access gateway and specifically includes the following steps:

[0084] S501. When a user logs in, two-factor authentication is performed, and the two-factor authentication includes user authentication and security status authentication.

[0085] Among them, two-factor authentication (Two-Factor Authentication, 2FA) is a security process that requires users to provide two different types of verification information when accessing applications or systems. By adding an additional security layer to ensure the authenticity of the user's identity, even if one verification factor is leaked, the attacker still cannot access the user's account. Verification information includes knowledge factors (Something you know) and possession factors (Something you have). In this embodiment, user authentication is the first step of two-factor authentication, which usually involves entering a username and password, which is the knowledge factor and is used to preliminarily verify the user's identity; security status authentication is the second step of two-factor authentication, which involves verifying the security status of the user's device, including checking the device's operating system version, patch status, security software status, network environment, etc., which is the possession factor, to ensure that the user's device meets the organization's security standards and prevent unsafe devices from accessing the network.

[0086] In some embodiments, user authentication may also include biometric information, such as fingerprint or facial recognition, for enhanced security.

[0087] It should be noted that when a user attempts to log in, the zero-trust access gateway first requires the user to perform user authentication. After successfully passing the authentication, the user will perform security status authentication. Only when both authentications are successful will the user be allowed to access the cloud desktop virtual device.

[0088] It is understandable that two-factor authentication significantly improves the security of the system and prevents unauthorized access. Even if an attacker obtains the user's password, he or she cannot pass the security status authentication. By verifying the dual identities of the user and the device, the system can more accurately evaluate and trust the user's access request and reduce network risks.

[0089] S502: After the zero trust control center issues a command on whether to allow access, decide whether to allow the user to access.

[0090] The admission command usually contains detailed admission conditions and policies, and the gateway makes the final access decision based on these conditions.

[0091] In this embodiment, if the access command allows access, the zero-trust access gateway will execute the corresponding network configuration and policy to allow the user device to connect to the internal network. Correspondingly, if the command denies access, the zero-trust access gateway will block the user device's connection request and may trigger a security alert or notify the user to take further security measures. Regardless of whether the access request is allowed or denied, the zero-trust access gateway will feed back the result to the zero-trust control center and record relevant logs for audit and analysis.

[0092] It is understandable that by strictly enforcing the access commands issued by the control center, the zero-trust access gateway can effectively prevent unauthorized devices and users from entering the network and reduce security risks. By centrally managing and enforcing access policies, the system can ensure that all access requests meet preset security standards and compliance requirements.

[0093] In this embodiment, the zero-trust admission gateway and the first zero-trust client, and the zero-trust access control gateway and the second zero-trust client are all connected via an encrypted communication protocol.

[0094] Among them, the encrypted communication protocol refers to a protocol used to protect the security and privacy of data when it is transmitted on the network, and encryption technology is used to ensure that the data is not tampered with during the transmission process. In this embodiment, transmission or communication can be performed through communication protocols such as Transport Layer Security (TLS) or Internet Protocol Security (IPsec).

[0095] It can be understood that the first zero-trust client is connected to the zero-trust access gateway through an encrypted communication protocol to ensure that sensitive information such as the user's identity information and device status remains confidential and intact during transmission, and the second zero-trust client is connected to the zero-trust access control gateway through an encrypted communication protocol to ensure that the policy and permission information transmitted between the two is not intercepted or tampered with.

[0096] In some embodiments, the encrypted communication protocol usually includes an authentication mechanism to ensure that the identities of both parties in the communication are authentic. In addition, the protocol may also involve key management to securely generate, distribute and update encryption keys.

[0097] The zero-trust security access control method provided in this application performs two-factor authentication on users through a zero-trust access gateway when users log in, and decides whether to allow user access based on the access command issued by the zero-trust control center. This can enhance the security of the zero-trust security access control system, prevent device risks, and improve the trust level of the system.

[0098] Based on the above embodiments, Figure 6 Schematic diagram of the zero-trust security access control method provided for this application Figure 4 .like Figure 6 As shown, the method is applied to a zero-trust client of a zero-trust security access control system, and the zero-trust security access control system also includes a zero-trust admission gateway, a zero-trust control center, and a zero-trust access control gateway, and specifically includes the following steps:

[0099] S601. When a user accesses a target application, user terminal information, user behavior information, and environment information are collected, and the collected information is transmitted to a zero trust control center.

[0100] In this embodiment, when the zero-trust client transmits the collected information to the zero-trust control center, it also transmits it through an encrypted communication protocol to ensure the confidentiality and integrity of the data during the transmission process.

[0101] S602: If the user terminal information, user behavior information, and environment information are verified by the zero trust control center for the user's security status, the cloud desktop virtual machine corresponding to the target application is accessed through the zero trust access gateway.

[0102] In this embodiment, the cloud desktop virtual machine provides an isolated and secure environment, in which users can access required target applications and data without directly contacting the underlying physical resources.

[0103] It should be noted that after the user accesses the cloud desktop, the zero-trust security access control system will continue to monitor the user's behavior and environmental changes to ensure continued compliance with security policies. If an anomaly is detected, the system can take immediate action, such as restricting access or disconnecting.

[0104] S603. If the user's access rights to the target application are verified by the zero trust control center, the target application is accessed through the zero trust access control gateway.

[0105] In this embodiment, if the user's access rights verification is passed, it means that the user is authorized to access the target application, indicating that the user not only meets the security status requirements, but also has the legal authority to access the application.

[0106] Correspondingly, while the user is accessing the target application, the system also continuously monitors the user's behavior and environmental changes. If permission abuse or abnormal behavior is detected, the system can dynamically adjust permissions or terminate access.

[0107] In this embodiment, the zero trust control center dynamically adjusts user access to resources based on the user's security status and role permissions.

[0108] As an example, the assessment of security status and role permissions is dynamic and can reflect the user's current security risk in real time, thereby dynamically adjusting the user's access to resources. For example, when a user's security status changes from a secure network to an unsecure network, the system can temporarily restrict their access rights until the security status is restored.

[0109] In this embodiment, the zero-trust client performs a security check in the cloud desktop virtual machine and uploads the security status information to the zero-trust control center, so that the zero-trust control center adjusts the access control permissions based on the security status information.

[0110] It should be noted that the zero-trust client runs in the cloud desktop virtual machine and is responsible for performing a series of security checks, which may include: operating system and software updates: confirming whether the latest security patches have been applied to the operating system and key applications; security software status: checking whether firewalls, antivirus software and other security tools are operating normally; configuration compliance: verifying whether the system configuration complies with the organization's security policies and standards; behavior monitoring: monitoring user activities on the cloud desktop to identify abnormal behavior or potential threats.

[0111] Furthermore, after the inspection is completed, the zero-trust client uploads the security status information to the zero-trust control center through an encrypted communication protocol. The zero-trust control center receives and analyzes the security status information and assesses the security risks of the cloud desktop virtual machine. Based on the analysis results, the zero-trust control center can dynamically adjust the user's access rights. For example, if an increase in security risks is detected, the system may restrict the user's access to certain sensitive resources or require additional authentication.

[0112] The zero-trust security access control method provided in this application verifies the process of user access to the target application in steps through the zero-trust admission gateway and the zero-trust access control gateway. It can achieve dynamic and refined access control while ensuring that the cloud desktop virtual machine provides support for remote work and bring your own device strategy, thereby improving system flexibility and security, reducing system response latency, and improving user experience.

[0113] Figure 7 This is a schematic diagram of the structure of the electronic device provided in this application. Figure 7 As shown, the electronic device 70 provided in this embodiment includes: at least one processor 701 and a memory 702. Optionally, the electronic device 70 further includes a communication component 703. The processor 701, the memory 702 and the communication component 703 are connected via a bus 704.

[0114] In a specific implementation process, at least one processor 701 executes the computer-executable instructions stored in the memory 702, so that at least one processor 701 executes the above method.

[0115] The specific implementation process of the processor 701 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0116] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0117] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0118] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0119] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0120] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0121] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0122] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0123] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0124] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0125] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0126] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0127] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0128] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A zero-trust security access control system, characterized in that: include: Zero Trust Client, Zero Trust Admission Gateway, Zero Trust Control Center, Zero Trust Access Control Gateway, including: The zero-trust client includes a first zero-trust client and a second zero-trust client, wherein the first zero-trust client is deployed in a user device and is used to collect user terminal information, user behavior information, and environmental information, and transmit the collected information to the zero-trust control center; the second zero-trust client is deployed in a cloud desktop virtual machine and is used to connect to the zero-trust access control gateway; The zero trust control center is used to receive information sent by the zero trust client, and determine whether the user is in a safe state according to a preset security access policy, so as to issue a command to the zero trust access gateway whether to allow access; and receive access control sent by the zero trust client, and determine whether the user is allowed to access the target application according to the preset access control authority, so as to issue a command to the zero trust access control gateway whether to allow access; The zero-trust access gateway is used to receive an access permission command issued by the zero-trust control center, and allow the zero-trust client to connect according to the access command; The zero-trust access control gateway is used to receive a command issued by the zero-trust control center on whether to allow access, and allow the zero-trust client to access the target application according to the access command.

2. The zero-trust security access control system according to claim 1, characterized in that: The first zero-trust client is specifically used for: Acquire the user terminal information, the user behavior information, and the environment information to establish a risk profile of the user; According to the risk profile of the user, receive the access permission command transmitted by the zero-trust access gateway, and if it is in a safe state, access the internal network.

3. The zero-trust security access control system according to claim 2, characterized in that: The second zero-trust client communicates with the first zero-trust client through the cloud desktop to obtain the user identity credentials of the first zero-trust client.

4. The zero-trust security access control system according to any one of claims 1 to 3, characterized in that: The first zero-trust client and the second zero-trust client are both connected to the zero-trust control center, and the zero-trust control center is specifically used to: Centrally manage and coordinate data from the first zero-trust client and the second zero-trust client, and dynamically adjust permissions and access policies based on the user's security status, user role, and the target application.

5. The zero-trust security access control system according to claim 4, characterized in that: When receiving the access control sent by the zero trust client, the zero trust control center is specifically used to: Performing access control on access to the target application based on the access control model, the user's access control authority, and the user security status data returned by the first zero-trust client; According to the security status of the user and the target application, the user's access to resources is authorized and controlled in real time.

6. The zero-trust security access control system according to any one of claims 1 to 3, characterized in that: The zero-trust access gateway is specifically used for: When the user logs in, two-factor authentication is performed, the two-factor authentication including user authentication and security status authentication; After the zero trust control center issues a command on whether to allow access, it decides whether to allow the user to access.

7. The zero-trust security access control system according to claim 6, characterized in that: The zero-trust admission gateway and the first zero-trust client, and the zero-trust access control gateway and the second zero-trust client are all connected via an encrypted communication protocol.

8. A zero-trust security access control method, characterized in that: A zero-trust client applied to a zero-trust security access control system, wherein the zero-trust security access control system further includes a zero-trust admission gateway, a zero-trust control center, and a zero-trust access control gateway, and the zero-trust security access control method includes: When a user accesses a target application, user terminal information, user behavior information, and environment information are collected, and the collected information is transmitted to the zero trust control center; If the user terminal information, the user behavior information and the environment information are verified by the zero trust control center for the security status of the user, the cloud desktop virtual machine corresponding to the target application is accessed through the zero trust access gateway; If the zero trust control center verifies the user's access rights to the target application, the target application is accessed through the zero trust access control gateway.

9. The zero-trust security access control method according to claim 8, characterized in that: The zero trust control center dynamically adjusts user access to resources based on the user's security status and role permissions.

10. The zero-trust security access control method according to claim 8, characterized in that: The zero-trust client performs a security check in the cloud desktop virtual machine and uploads security status information to the zero-trust control center, so that the zero-trust control center adjusts access control permissions based on the security status information.

Images