Zero-trust B / S application method, electronic device, storage medium and program product

Abstract

The invention provides a zero-trust B / S (Browser / Server) application method, electronic equipment, a readable storage medium and a computer program product. The method comprises the following steps: sending an encrypted access traffic request to a to-be-accessed application through a browser; the encrypted access traffic request is drained according to a drainage rule and a rule matching sequence; performing decryption processing on the encrypted access flow request to obtain plaintext data; performing label injection on the plaintext data to obtain to-be-sent data of an http data structure; the user identifier corresponding to the to-be-sent data is a preset user identifier; encrypting and packaging the to-be-sent data to obtain an encrypted data packet; and draining the encrypted data packet to the zero-trust gateway according to the drainage rule and the rule matching sequence, so that the zero-trust gateway performs dynamic access control according to the encrypted data packet. According to the method, data drainage can be efficiently and quickly realized, and docking adaptation with different zero-trust gateways is realized by dynamically injecting labels, so that the expandability and flexibility of the system are improved.

Description

Technical Field

[0001] The present application relates to the field of zero-trust technology, and more specifically, to a zero-trust B / S application method, electronic device, readable storage medium, and computer program product. Background Art

[0002] Zero-trust client B / S application access is a secure access mode that applies the zero-trust concept to B / S architecture application scenarios. B / S applications mainly rely on the HTTP protocol family for data transmission and interaction. In the existing technology, socks is usually used to establish a link to communicate with a dedicated zero-trust gateway, which has low adaptability. In addition, the existing socks connection technology lacks the ability to inject tags and cannot formulate complex access control policies according to actual needs, thereby weakening the scalability and flexibility of the system. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a zero-trust B / S application method, electronic device, readable storage medium and computer program product, which can efficiently and quickly realize data diversion, and can dynamically inject tags to achieve docking and adaptation with different zero-trust gateways, thereby improving the scalability and flexibility of the system.

[0004] The first aspect of the present application provides a zero-trust B / S application method, including:

[0005] Pre-creating a specific user, a traffic diversion rule, and a rule matching order of the traffic diversion rule; wherein the user identifier of the specific user is a preset user identifier;

[0006] Running a forwarding module based on the specific user so that the user identifier corresponding to all traffic sent by the forwarding module is the preset user identifier;

[0007] Send an encrypted access traffic request to the application to be accessed through the browser;

[0008] Directing the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the traffic directing rule and the rule matching order;

[0009] Decrypting the encrypted access traffic request through the traffic loading / unloading module to obtain plaintext data;

[0010] The label is injected into the plaintext data by the secure transmission module of the forwarding module to obtain the data to be sent in the http data structure; the user identifier corresponding to the data to be sent is the preset user identifier;

[0011] Encrypting and encapsulating the data to be sent by the secure transmission module to obtain an encrypted data packet;

[0012] The encrypted data packet is directed to the zero-trust gateway according to the diversion rule and the rule matching order, so that the zero-trust gateway performs dynamic access control according to the encrypted data packet.

[0013] In the above implementation process, the method can ensure that the traffic processing is highly targeted by pre-defining specific users and their corresponding diversion rules and matching orders. Secondly, running the forwarding module based on specific users can ensure that the forwarding module manages and audits the traffic. Then, by accurately matching the diversion rules, the encrypted access traffic request can be directed to the appropriate processing path to achieve traffic management. After that, the decryption process allows the original data to be restored, which can provide a basis for subsequent data processing and analysis. The label injection method can increase the controllability of the data and facilitate precise control in the subsequent data transmission and processing process, thereby improving the security of the system. In addition, encryption encapsulation can ensure the security of data during transmission, thereby strengthening the security protection capabilities of the system. Finally, dynamic access control through the zero-trust gateway can achieve refined management and control of traffic, thereby improving the security and compliance of the system.

[0014] Furthermore, the pre-created specific user, the traffic diversion rule, and the rule matching order of the traffic diversion rule include:

[0015] Create specific users in advance, and call the diversion module in the forwarding module to pre-formulate diversion rules and rule matching order.

[0016] In the above implementation process, this method can ensure the efficiency and accuracy of traffic management and provide a solid foundation for the system's dynamic access control.

[0017] Furthermore, the diversion rule includes a first rule and a second rule;

[0018] The first rule is to allow all traffic whose user identifier is the preset user identifier;

[0019] The second rule introduces all traffic accessing the zero-trust gateway into the traffic loading / unloading module of the forwarding module.

[0020] In the above implementation process, this method can ensure that the traffic of specific users is unimpeded, while strengthening the management and control of zero-trust gateway access traffic, thereby improving the security and flexibility of the system.

[0021] Further, the step of directing the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the traffic directing rule and the rule matching order includes:

[0022] Sending the encrypted access traffic request to the kernel protocol stack; wherein the request address of the encrypted access traffic request is the domain name address of the application to be accessed, and the domain name address of the application to be accessed points to the zero-trust gateway;

[0023] In the kernel protocol stack, the traffic diversion rule and the encrypted access traffic request are matched according to the rule matching order to obtain a first matching result; wherein the first matching result is that the encrypted access traffic request fails to match the first rule, and the encrypted access traffic request successfully matches the second rule;

[0024] The encrypted access traffic request is directed to a traffic loading / unloading module of the forwarding module according to the first matching result.

[0025] In the above implementation process, the method can ensure that traffic that meets specific conditions is effectively directed to the traffic loading / unloading module of the forwarding module, thereby enhancing the accuracy of traffic management and the security of the system.

[0026] Further, the decrypting of the encrypted access traffic request by the traffic loading / unloading module to obtain plaintext data includes:

[0027] Decrypting the encrypted access traffic request through the traffic loading / unloading module to obtain original data;

[0028] The original data is parsed and processed according to the http format to obtain plain text data.

[0029] In the above implementation process, the method can accurately restore the plaintext data, provide a reliable basis for subsequent data processing, and ensure the integrity and accuracy of data transmission.

[0030] Furthermore, the secure transmission module of the forwarding module injects a label into the plaintext data to obtain data to be sent in an http data structure, including:

[0031] Obtaining execution point transmission information; wherein the execution point transmission information at least includes an identity token, a preset user identifier, and a data tag;

[0032] Generate a custom key-value pair according to the execution point transmission information;

[0033] In the secure transmission module, the custom key-value pair is inserted as a tag into the http request header of the plaintext data to obtain the data to be sent in the http data structure.

[0034] In the above implementation process, the method can enhance the identification and security of data and provide key information support for subsequent data processing and access control.

[0035] Further, the encrypting and encapsulating the data to be sent by the secure transmission module to obtain an encrypted data packet includes:

[0036] Obtain the correspondence between the access resource domain name and the zero trust gateway from the zero trust control center;

[0037] Convert the data to be sent into a target http data packet according to the corresponding relationship;

[0038] The target http data packet is encrypted by the secure transmission module to obtain an encrypted data packet.

[0039] In the above implementation process, the method can ensure the security and targeting of data transmission, thereby improving the overall protection capability of the system.

[0040] Further, directing the encrypted data packet to the zero-trust gateway according to the diversion rule and the rule matching order includes:

[0041] Sending the encrypted data packet to the kernel protocol stack through the secure transmission module; wherein the user identifier of the encrypted data packet is the preset user identifier;

[0042] Through the kernel protocol stack, the diversion rule and the encrypted data packet are matched according to the rule matching order to obtain a second matching result; wherein the second matching result is that the encrypted data packet successfully matches the first rule;

[0043] Determine the zero-trust gateway to be sent according to the corresponding relationship;

[0044] The encrypted data packet is sent to the zero trust gateway according to the second matching result.

[0045] In the above implementation process, the method can ensure the security and accuracy of data transmission, thereby enabling docking and adaptation with different zero-trust gateways, thereby improving the scalability and flexibility of the system.

[0046] A second aspect of the present application provides a zero-trust B / S application device, the zero-trust B / S application device comprising:

[0047] A creation unit, used to pre-create a specific user, a traffic diversion rule, and a rule matching order of the traffic diversion rule; wherein the user identifier of the specific user is a preset user identifier;

[0048] An operation unit, configured to operate a forwarding module based on the specific user, so that a user identifier corresponding to all traffic sent by the forwarding module is the preset user identifier;

[0049] A sending unit, used for sending an encrypted access traffic request to the application to be accessed through a browser;

[0050] A traffic diversion unit, configured to divert the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the traffic diversion rule and the rule matching order;

[0051] A decryption unit, used for decrypting the encrypted access traffic request through the traffic loading / unloading module to obtain plaintext data;

[0052] An injection unit is used to perform label injection on the plaintext data through the secure transmission module of the forwarding module to obtain data to be sent in an http data structure; the user identifier corresponding to the data to be sent is the preset user identifier;

[0053] An encapsulation unit, configured to encrypt and encapsulate the data to be sent through the secure transmission module to obtain an encrypted data packet;

[0054] The diversion unit is also used to divert the encrypted data packet to the zero trust gateway according to the diversion rule and the rule matching order, so that the zero trust gateway performs dynamic access control according to the encrypted data packet.

[0055] Furthermore, the creation unit is specifically used to pre-create a specific user, and call the diversion module in the forwarding module to pre-formulate diversion rules and rule matching order.

[0056] Furthermore, the diversion rule includes a first rule and a second rule;

[0057] The first rule is to allow all traffic whose user identifier is the preset user identifier;

[0058] The second rule introduces all traffic accessing the zero-trust gateway into the traffic loading / unloading module of the forwarding module.

[0059] Furthermore, the drainage unit comprises:

[0060] A sending subunit, used to send the encrypted access traffic request to the kernel protocol stack; wherein the request address of the encrypted access traffic request is the domain name address of the application to be accessed, and the domain name address of the application to be accessed points to the zero-trust gateway;

[0061] A matching subunit, configured to match the diversion rule and the encrypted access traffic request in the kernel protocol stack according to the rule matching order to obtain a first matching result; wherein the first matching result is that the encrypted access traffic request fails to match the first rule, and the encrypted access traffic request successfully matches the second rule;

[0062] A traffic diversion subunit is used to divert the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the first matching result.

[0063] Furthermore, the decryption unit comprises:

[0064] A decryption subunit, configured to decrypt the encrypted access traffic request through the traffic loading / unloading module to obtain original data;

[0065] The parsing subunit is used to parse the original data according to the http format to obtain plain text data.

[0066] Furthermore, the injection unit comprises:

[0067] A first acquisition subunit is used to acquire execution point transmission information; wherein the execution point transmission information at least includes an identity token, a preset user identifier and a data tag;

[0068] A generating subunit, used for generating a custom key-value pair according to the execution point transmission information;

[0069] The injection subunit is used to insert the custom key-value pair as a label into the http request header of the plaintext data in the secure transmission module to obtain the data to be sent in the http data structure.

[0070] Furthermore, the packaging unit includes:

[0071] The second acquisition subunit is used to obtain the corresponding relationship between the access resource domain name and the zero trust gateway from the zero trust control center;

[0072] A conversion subunit, used for converting the data to be sent into a target http data packet according to the corresponding relationship;

[0073] The encapsulation subunit is used to encrypt the target http data packet through the secure transmission module to obtain an encrypted data packet.

[0074] Furthermore, the drainage unit comprises:

[0075] A sending subunit, used for sending the encrypted data packet to the kernel protocol stack through the secure transmission module; wherein the user identifier of the encrypted data packet is the preset user identifier;

[0076] A matching subunit, configured to match the diversion rule and the encrypted data packet according to the rule matching order through the kernel protocol stack to obtain a second matching result; wherein the second matching result is that the encrypted data packet successfully matches the first rule;

[0077] The matching subunit is further used to determine the zero-trust gateway to be sent according to the corresponding relationship;

[0078] A traffic diversion sub-unit is used to send the encrypted data packet to the zero trust gateway according to the second matching result.

[0079] A third aspect of the present application provides an electronic device, comprising a memory and a processor, the memory being used to store a computer program, the processor running the computer program to enable the electronic device to execute the zero-trust B / S application method described in any one of the first aspects of the present application.

[0080] A fourth aspect of the present application provides a computer-readable storage medium, which stores computer program instructions. When the computer program instructions are read and executed by a processor, the zero-trust B / S application method described in any one of the first aspects of the present application is executed.

[0081] A fifth aspect of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it executes the zero-trust B / S application method described in any one of the first aspects of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0083] Figure 1 A flowchart of a zero-trust B / S application method provided in an embodiment of the present application;

[0084] Figure 2 A flowchart of another zero-trust B / S application method provided in an embodiment of the present application;

[0085] Figure 3 A schematic diagram of the process architecture of a zero-trust B / S application method provided in an embodiment of the present application;

[0086] Figure 4 A schematic diagram of the structure of a zero-trust B / S application device provided in an embodiment of the present application;

[0087] Figure 5 A schematic diagram of the structure of another zero-trust B / S application device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0088] The zero-trust B / S application method refers to the way of accessing applications based on the B / S (Browser / Server) architecture through a zero-trust client under the zero-trust security framework. Specifically, the method involves the zero-trust management platform performing a trust assessment based on the request of the zero-trust client, determining the application policy information, and then the zero-trust client establishing a connection with the application policy information in the local browser, encrypting and encapsulating the data generated by accessing the target application and sending it to the corresponding zero-trust gateway, which is then decrypted by the zero-trust gateway and forwarded by a proxy, thereby achieving secure access to the B / S application.

[0089] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0090] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0091] Example 1

[0092] Please see Figure 1 , Figure 1 A flowchart of a zero-trust B / S application method provided in this embodiment. The zero-trust B / S application method includes:

[0093] S101. Pre-create a specific user, a traffic diversion rule, and a rule matching order of the traffic diversion rule; wherein the user identifier of the specific user is a preset user identifier.

[0094] S102: Run a forwarding module based on a specific user, so that the user identifier corresponding to all traffic sent by the forwarding module is a preset user identifier.

[0095] S103: Send an encrypted access traffic request to the application to be accessed through the browser.

[0096] S104: Direct the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the traffic directing rule and the rule matching order.

[0097] S105. Decrypt the encrypted access traffic request through the traffic loading / unloading module to obtain plaintext data.

[0098] S106. A label is injected into the plaintext data through the secure transmission module of the forwarding module to obtain data to be sent in an http data structure; the user identifier corresponding to the data to be sent is a preset user identifier.

[0099] S107: Encrypt and encapsulate the data to be sent through a secure transmission module to obtain an encrypted data packet.

[0100] S108. Divert the encrypted data packet to the zero-trust gateway according to the diversion rules and the rule matching order, so that the zero-trust gateway performs dynamic access control based on the encrypted data packet.

[0101] This implementation method can direct traffic to a local proxy service, parse the protocol content, and insert labels into each data packet according to different scenarios. At the same time, the traffic can be proxied to a zero-trust gateway without changing the HTTP protocol family type.

[0102] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0103] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0104] It can be seen that implementing the zero-trust B / S application method described in this embodiment can efficiently and quickly realize data diversion, and can dynamically inject tags to achieve docking and adaptation with different zero-trust gateways, thereby improving the scalability and flexibility of the system.

[0105] Example 2

[0106] Please see Figure 2 , Figure 2 A flowchart of a zero-trust B / S application method provided in this embodiment. The zero-trust B / S application method includes:

[0107] S201. Pre-create a specific user, and call the traffic diversion module in the forwarding module to pre-formulate traffic diversion rules and rule matching order; wherein the user identifier of the specific user is a preset user identifier.

[0108] In this embodiment, the method can create a non-root specific user A in the system of the access terminal through the control module of the zero-trust client (referred to as the client), forming a user ID (i.e. user representation), UIDA (i.e. preset user identification).

[0109] In this embodiment, the traffic diversion rules include a first rule and a second rule;

[0110] The first rule is to allow all traffic with a user ID that is a preset user ID;

[0111] The second rule introduces all traffic accessing the zero-trust gateway into the traffic loading / unloading module of the forwarding module.

[0112] In this embodiment, the method can formulate two types of diversion rules by calling the diversion module in the forwarding module through the control module of the client. Formulate the rules in order, and formulate rule (1) and rule (2) in turn, as follows:

[0113] Rule (1): Allow all traffic from specific user A, that is, allow all traffic with uid-owner UIDA.

[0114] Rule (2): All traffic accessing the Zero Trust Gateway is directed to the client’s traffic loading / unloading port.

[0115] S202: Run a forwarding module based on a specific user, so that the user identifier corresponding to all traffic sent by the forwarding module is a preset user identifier.

[0116] In this embodiment, the method may run the forwarding module based on a specific user A, so that the uid-owner of the traffic forwarded by the forwarding module is UIDA.

[0117] S203: Send an encrypted access traffic request to the application to be accessed through the browser.

[0118] S204. Send the encrypted access traffic request to the kernel protocol stack; wherein the request address of the encrypted access traffic request is the domain name address of the application to be accessed, and the domain name address of the application to be accessed points to the zero-trust gateway.

[0119] In this embodiment, the browser on the access terminal initiates encrypted access traffic to the application. The request address of the encrypted access traffic is the domain name address. The domain names of all applications point to the zero-trust gateway, and the browser's data packet is sent to the kernel protocol stack by default.

[0120] S205. In the kernel protocol stack, the diversion rule and the encrypted access traffic request are matched according to the rule matching order to obtain a first matching result; wherein the first matching result is that the encrypted access traffic request fails to match the first rule, and the encrypted access traffic request successfully matches the second rule.

[0121] In this embodiment, the method first matches rule (1) in order through the kernel protocol stack. If the owner of the browser is the current user, the rule matching fails. At this time, the rule (2) is matched. If the destination application address of the access request is the zero-trust gateway address, the match is successful. When the match is successful, the method can direct the traffic to the port opened by the traffic loading / unloading module so that the subsequent steps can obtain the original data by decrypting the traffic.

[0122] S206: Direct the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the first matching result.

[0123] S207: Decrypt the encrypted access traffic request through the traffic loading / unloading module to obtain original data.

[0124] S208, parsing and processing the original data according to the http format to obtain plain text data.

[0125] This method can parse the decrypted original data according to the http format, create a queue, cache the plaintext data according to the http data structure, and pass it to the secure transmission module.

[0126] S209, obtaining execution point transmission information; wherein the execution point transmission information at least includes an identity token, a preset user identifier, and a data tag.

[0127] S210: Generate a custom key-value pair according to the execution point transmission information.

[0128] S211. In the secure transmission module, insert the custom key-value pair as a tag into the http request header of the plaintext data to obtain the data to be sent in the http data structure; the user identifier corresponding to the data to be sent is the preset user identifier.

[0129] In this embodiment, the secure transmission module can obtain the identity token, application token, preset user identifier, data tag and other information to be transmitted to the execution point from the control module. Then, a custom key-value pair is formulated for the above information and inserted into the http request header as a tag to form a new http data structure.

[0130] Among them, the identity token, application token, preset user identifier, data tag and other information reported by the control module can be obtained from different data sources through the interface adapter on the control module.

[0131] S212. Obtain the correspondence between the access resource domain name and the zero trust gateway from the zero trust control center.

[0132] S213: Convert the data to be sent into a target http data packet according to the corresponding relationship.

[0133] S214, encrypting the target http data packet through the secure transmission module to obtain an encrypted data packet.

[0134] In this embodiment, the control module can obtain the correspondence between the domain name of the access resource and the zero trust gateway from the zero trust control center, and convert the new http data structure into a new http data packet, and then encrypt the new http data packet to obtain an encrypted data packet.

[0135] S215. Send the encrypted data packet to the kernel protocol stack through the secure transmission module; wherein the user identifier of the encrypted data packet is a preset user identifier.

[0136] In this embodiment, the method can send the encrypted http data packet to the corresponding zero trust gateway according to the correspondence between the domain name and the zero trust gateway.

[0137] In this embodiment, the method can send the encrypted http data packet to the kernel protocol stack by default.

[0138] S216. Match the diversion rule and the encrypted data packet according to the rule matching order through the kernel protocol stack to obtain a second matching result; wherein the second matching result is that the encrypted data packet successfully matches the first rule.

[0139] In this embodiment, the owner of the secure transmission module that sends the encrypted data packet is a specific user A, whose user ID is UIDA. The kernel protocol stack matches rule (1) in order and matches successfully, thus releasing the traffic.

[0140] S217. Determine the zero-trust gateway to be sent according to the corresponding relationship.

[0141] In this embodiment, the traffic is forwarded by the protocol stack to the corresponding zero-trust gateway.

[0142] S218. Send the encrypted data packet to the zero trust gateway according to the second matching result, so that the zero trust gateway performs dynamic access control according to the encrypted data packet.

[0143] In this embodiment, the zero-trust gateway can obtain the data label of the http message by parsing the key-value pair in the http message header, and then perform fine-grained dynamic access control based on the label.

[0144] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0145] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0146] It can be seen that implementing the zero-trust B / S application method described in this embodiment can efficiently and quickly realize data diversion, and can dynamically inject tags to achieve docking and adaptation with different zero-trust gateways, thereby improving the scalability and flexibility of the system.

[0147] Example 3

[0148] This embodiment shows an example process of a zero-trust B / S application method. Figure 3 , Figure 3 A process architecture diagram of a zero-trust B / S application method is shown. The zero-trust B / S application method in this example can be applied to the zero-trust authentication client in the zero-trust system of the public security industry. Specifically, the authentication service in the zero-trust system of the public security industry corresponds to the zero-trust control center, and the trusted access prosecution in the zero-trust system of the public security industry corresponds to the zero-trust gateway.

[0149] In this example, the environment perception service in the zero-trust system of the public security industry provides terminal data tags. The authentication client needs to connect to the trusted access prosecution and different environment perception services of different manufacturers, which requires standard transmission protocols and flexible tag adaptation functions.

[0150] Based on this, the example process of the zero-trust B / S application method is as follows:

[0151] (1) A special user is created when the authentication client is installed and this user persists.

[0152] (2) After the authentication client is running, it obtains the unique identifier of the current terminal from the interface adapted to the environment perception service.

[0153] (3) Create a local reverse proxy service and run it on a special user. Deploy certificates for traffic encryption and decryption.

[0154] (4) After the client is successfully authenticated, the authentication service returns a list of domain name addresses and an identity token after the user is successfully authenticated. The DNS resolution service is used to resolve the returned application domain name into a trusted access control address.

[0155] (5) Establish firewall rules to allow access traffic from special users.

[0156] (6) Establish firewall rules to direct access requests with the purpose of trusted access prosecution to the local proxy service.

[0157] (7) Set up a reverse proxy service based on the correspondence between the application domain name and the trusted access control address.

[0158] (8) The user uses the browser to access the application using the https protocol.

[0159] (9) The browser traffic is directed to the reverse proxy service through the protocol stack.

[0160] (10) The authentication client obtains access application information based on the domain name information and obtains permissions from the authentication service and generates an application token.

[0161] (11) The reverse proxy service uses the deployed certificate to offload the https protocol.

[0162] (12) The reverse proxy service applies for a user token, application token, and preset user identification information from the control module of the authentication client, and writes the above information into the https request header in accordance with the specification requirements.

[0163] (13) When the reverse proxy server proxies traffic upstream, it matches the firewall rules. Since the owner of the reverse proxy service is a special user during client installation, the access traffic is still allowed even if the destination address is a trusted access control.

[0164] It can be seen that the implementation of the zero-trust B / S application method described in this embodiment can achieve flexible and large-scale label injection. At the same time, the matching of diversion rules is completed in the kernel, which can effectively solve the problem of data being circulated. In addition, the standard https protocol can be used to adapt the label data source to the docking of zero-trust gateways from different manufacturers, thereby achieving environmental adaptation.

[0165] Example 4

[0166] Please see Figure 4 , Figure 4 A schematic diagram of the structure of a zero-trust B / S application device provided in this embodiment. Figure 4 As shown, the zero-trust B / S application device includes:

[0167] A creation unit 310 is used to pre-create a specific user, a traffic diversion rule, and a rule matching order of the traffic diversion rule; wherein the user identifier of the specific user is a preset user identifier;

[0168] An operation unit 320 is used to operate the forwarding module based on a specific user so that the user identifier corresponding to all traffic sent by the forwarding module is a preset user identifier;

[0169] The sending unit 330 is used to send an encrypted access traffic request to the application to be accessed through the browser;

[0170] A traffic diversion unit 340, configured to divert the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the traffic diversion rule and the rule matching order;

[0171] The decryption unit 350 is used to decrypt the encrypted access traffic request through the traffic loading / unloading module to obtain plain text data;

[0172] The injection unit 360 is used to inject a label into the plaintext data through the secure transmission module of the forwarding module to obtain the data to be sent in the http data structure; the user identifier corresponding to the data to be sent is a preset user identifier;

[0173] The encapsulation unit 370 is used to encrypt and encapsulate the data to be sent through the secure transmission module to obtain an encrypted data packet;

[0174] The diversion unit 340 is also used to divert the encrypted data packet to the zero trust gateway according to the diversion rules and the rule matching order, so that the zero trust gateway performs dynamic access control according to the encrypted data packet.

[0175] In this embodiment, the explanation of the zero-trust B / S application device can refer to the description in Example 1 or Example 2, and will not be further elaborated in this embodiment.

[0176] It can be seen that the implementation of the zero-trust B / S application device described in this embodiment can efficiently and quickly realize data diversion, and can dynamically inject tags to achieve docking and adaptation with different zero-trust gateways, thereby improving the scalability and flexibility of the system.

[0177] Example 5

[0178] Please see Figure 5 , Figure 5 A schematic diagram of the structure of a zero-trust B / S application device provided in this embodiment. Figure 5 As shown, the zero-trust B / S application device includes:

[0179] A creation unit 310 is used to pre-create a specific user, a traffic diversion rule, and a rule matching order of the traffic diversion rule; wherein the user identifier of the specific user is a preset user identifier;

[0180] An operation unit 320 is used to operate the forwarding module based on a specific user so that the user identifier corresponding to all traffic sent by the forwarding module is a preset user identifier;

[0181] The sending unit 330 is used to send an encrypted access traffic request to the application to be accessed through the browser;

[0182] A traffic diversion unit 340, configured to divert the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the traffic diversion rule and the rule matching order;

[0183] The decryption unit 350 is used to decrypt the encrypted access traffic request through the traffic loading / unloading module to obtain plain text data;

[0184] The injection unit 360 is used to inject a label into the plaintext data through the secure transmission module of the forwarding module to obtain the data to be sent in the http data structure; the user identifier corresponding to the data to be sent is a preset user identifier;

[0185] The encapsulation unit 370 is used to encrypt and encapsulate the data to be sent through the secure transmission module to obtain an encrypted data packet;

[0186] The diversion unit 340 is also used to divert the encrypted data packet to the zero trust gateway according to the diversion rules and the rule matching order, so that the zero trust gateway performs dynamic access control according to the encrypted data packet.

[0187] As an optional implementation, the creation unit 310 is specifically used to pre-create a specific user and call the diversion module in the forwarding module to pre-formulate diversion rules and rule matching order.

[0188] In this embodiment, the traffic diversion rules include a first rule and a second rule;

[0189] The first rule is to allow all traffic with a user ID that is a preset user ID;

[0190] The second rule introduces all traffic accessing the zero-trust gateway into the traffic loading / unloading module of the forwarding module.

[0191] As an optional implementation, the drainage unit 340 includes:

[0192] The sending subunit 341 is used to send the encrypted access traffic request to the kernel protocol stack; wherein the request address of the encrypted access traffic request is the domain name address of the application to be accessed, and the domain name address of the application to be accessed points to the zero trust gateway;

[0193] The matching subunit 342 is used to match the diversion rule and the encrypted access traffic request in the kernel protocol stack according to the rule matching order to obtain a first matching result; wherein the first matching result is that the encrypted access traffic request fails to match the first rule, and the encrypted access traffic request successfully matches the second rule;

[0194] The traffic diversion sub-unit 343 is used to divert the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the first matching result.

[0195] As an optional implementation, the decryption unit 350 includes:

[0196] The decryption subunit 351 is used to decrypt the encrypted access traffic request through the traffic loading / unloading module to obtain the original data;

[0197] The parsing subunit 352 is used to parse the original data according to the http format to obtain plain text data.

[0198] As an optional implementation, the injection unit 360 includes:

[0199] The first acquisition subunit 361 is used to acquire the execution point transmission information; wherein the execution point transmission information at least includes an identity token, a preset user identifier and a data tag;

[0200] A generating subunit 362, for generating a custom key-value pair according to the execution point transmission information;

[0201] The injection subunit 363 is used to insert the custom key-value pair as a tag into the http request header of the plaintext data in the secure transmission module to obtain the data to be sent in the http data structure.

[0202] As an optional implementation, the encapsulation unit 370 includes:

[0203] The second acquisition subunit 371 is used to obtain the corresponding relationship between the access resource domain name and the zero trust gateway from the zero trust control center;

[0204] The conversion subunit 372 is used to convert the data to be sent into a target http data packet according to the corresponding relationship;

[0205] The encapsulation subunit 373 is used to encrypt the target http data packet through the secure transmission module to obtain an encrypted data packet.

[0206] As an optional implementation, the drainage unit 340 includes:

[0207] The sending subunit 341 is used to send the encrypted data packet to the kernel protocol stack through the secure transmission module; wherein the user identifier of the encrypted data packet is a preset user identifier;

[0208] The matching subunit 342 is used to match the diversion rule and the encrypted data packet according to the rule matching order through the kernel protocol stack to obtain a second matching result; wherein the second matching result is that the encrypted data packet successfully matches the first rule;

[0209] The matching subunit 342 is further used to determine the zero-trust gateway to be sent according to the corresponding relationship;

[0210] The traffic diversion sub-unit 343 is used to send the encrypted data packet to the zero-trust gateway according to the second matching result.

[0211] In this embodiment, the explanation of the zero-trust B / S application device can refer to the description in Example 1 or Example 2, and will not be further elaborated in this embodiment.

[0212] It can be seen that the implementation of the zero-trust B / S application device described in this embodiment can efficiently and quickly realize data diversion, and can dynamically inject tags to achieve docking and adaptation with different zero-trust gateways, thereby improving the scalability and flexibility of the system.

[0213] An embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the zero-trust B / S application method in embodiment 1 or embodiment 2 of the present application.

[0214] An embodiment of the present application provides a computer-readable storage medium storing computer program instructions. When the computer program instructions are read and executed by a processor, the zero-trust B / S application method in Embodiment 1 or Embodiment 2 of the present application is executed.

[0215] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0216] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0217] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0218] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0219] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0220] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A zero-trust B / S application method, characterized in that: include: Pre-creating a specific user, a traffic diversion rule, and a rule matching order of the traffic diversion rule; wherein the user identifier of the specific user is a preset user identifier; Running a forwarding module based on the specific user so that the user identifier corresponding to all traffic sent by the forwarding module is the preset user identifier; Send an encrypted access traffic request to the application to be accessed through the browser; Directing the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the traffic directing rule and the rule matching order; Decrypting the encrypted access traffic request through the traffic loading / unloading module to obtain plaintext data; The label is injected into the plaintext data by the secure transmission module of the forwarding module to obtain the data to be sent in the http data structure; the user identifier corresponding to the data to be sent is the preset user identifier; Encrypting and encapsulating the data to be sent by the secure transmission module to obtain an encrypted data packet; The encrypted data packet is directed to the zero-trust gateway according to the diversion rule and the rule matching order, so that the zero-trust gateway performs dynamic access control according to the encrypted data packet.

2. The zero-trust B / S application method according to claim 1, characterized in that: The pre-created specific user, the traffic diversion rule, and the rule matching order of the traffic diversion rule include: Create specific users in advance, and call the diversion module in the forwarding module to pre-formulate diversion rules and rule matching order.

3. The zero-trust B / S application method according to claim 1, characterized in that: The diversion rules include a first rule and a second rule; The first rule is to allow all traffic whose user identifier is the preset user identifier; The second rule introduces all traffic accessing the zero-trust gateway into the traffic loading / unloading module of the forwarding module.

4. The zero-trust B / S application method according to claim 3, characterized in that: The step of directing the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the traffic directing rule and the rule matching order includes: Sending the encrypted access traffic request to the kernel protocol stack; wherein the request address of the encrypted access traffic request is the domain name address of the application to be accessed, and the domain name address of the application to be accessed points to the zero-trust gateway; In the kernel protocol stack, the traffic diversion rule and the encrypted access traffic request are matched according to the rule matching order to obtain a first matching result; wherein the first matching result is that the encrypted access traffic request fails to match the first rule, and the encrypted access traffic request successfully matches the second rule; The encrypted access traffic request is directed to a traffic loading / unloading module of the forwarding module according to the first matching result.

5. The zero-trust B / S application method according to claim 1, characterized in that: The decrypting of the encrypted access traffic request by the traffic loading / unloading module to obtain plaintext data includes: Decrypting the encrypted access traffic request through the traffic loading / unloading module to obtain original data; The original data is parsed and processed according to the http format to obtain plain text data.

6. The zero-trust B / S application method according to claim 1, characterized in that: The step of injecting a label into the plaintext data through the secure transmission module of the forwarding module to obtain data to be sent in an http data structure includes: Obtaining execution point transmission information; wherein the execution point transmission information at least includes an identity token, a preset user identifier, and a data tag; Generate a custom key-value pair according to the execution point transmission information; In the secure transmission module, the custom key-value pair is inserted as a tag into the http request header of the plaintext data to obtain the data to be sent in the http data structure.

7. The zero-trust B / S application method according to claim 3, characterized in that: The step of encrypting and encapsulating the data to be sent by the secure transmission module to obtain an encrypted data packet includes: Obtain the correspondence between the access resource domain name and the zero trust gateway from the zero trust control center; Convert the data to be sent into a target http data packet according to the corresponding relationship; The target http data packet is encrypted by the secure transmission module to obtain an encrypted data packet.

8. The zero-trust B / S application method according to claim 7, characterized in that: Directing the encrypted data packet to the zero-trust gateway according to the diversion rule and the rule matching order includes: Sending the encrypted data packet to the kernel protocol stack through the secure transmission module; wherein the user identifier of the encrypted data packet is the preset user identifier; Through the kernel protocol stack, the diversion rule and the encrypted data packet are matched according to the rule matching order to obtain a second matching result; wherein the second matching result is that the encrypted data packet successfully matches the first rule; Determine the zero-trust gateway to be sent according to the corresponding relationship; The encrypted data packet is sent to the zero trust gateway according to the second matching result.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the zero-trust B / S application method according to any one of claims 1 to 8.

10. A readable storage medium, characterized in that: The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the zero-trust B / S application method according to any one of claims 1 to 8 is executed.

11. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the zero-trust B / S application method according to any one of claims 1 to 8 is executed.

Images