Zero trust b / s application method, electronic device, storage medium and program product

Abstract

The application provides a zero-trust B / S application method, an electronic device, a readable storage medium and a computer program product. The method comprises the following steps: sending an encrypted access traffic request to a to-be-accessed application through a browser; performing flow diversion on the encrypted access traffic request according to a flow diversion rule and a rule matching order; performing decryption processing on the encrypted access traffic request to obtain plaintext data; performing label injection on the plaintext data to obtain to-be-sent data in an http data structure; the user identifier corresponding to the to-be-sent data is a preset user identifier; performing encryption encapsulation on the to-be-sent data to obtain an encrypted data packet; and performing flow diversion on the encrypted data packet to a zero-trust gateway according to the flow diversion rule and the rule matching order, so that the zero-trust gateway performs dynamic access control according to the encrypted data packet. The method can efficiently and quickly realize data flow diversion, and can realize docking and adaptation with different zero-trust gateways by dynamically injecting labels, thereby improving the scalability and flexibility of the system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of zero trust, in particular to a zero trust B / S application method, an electronic device, a readable storage medium and a computer program product. BACKGROUND

[0002] Zero trust client B / S application access is a security access mode that applies the zero trust concept to the B / S architecture application scenario. The B / S application mainly relies on the HTTP protocol family for data transmission and interaction. In the prior art, a socks is usually used to establish a link to communicate with a dedicated zero trust gateway, which has low adaptability. In addition, the existing socks connection technology also lacks label injection capability, and cannot formulate complex access control policies according to actual needs, thereby weakening the scalability and flexibility of the system. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a zero trust B / S application method, an electronic device, a readable storage medium and a computer program product, which can efficiently and quickly realize data diversion, and can dynamically inject labels to realize docking and adaptation with different zero trust gateways, thereby improving the scalability and flexibility of the system.

[0004] The first aspect of the present application provides a zero trust B / S application method, comprising:

[0005] A specific user, a diversion rule and a rule matching order of the diversion rule are created in advance; wherein the user identifier of the specific user is a preset user identifier;

[0006] A forwarding module is run based on the specific user, so that the user identifier corresponding to all traffic sent by the forwarding module is the preset user identifier;

[0007] An encrypted access traffic request is sent to a to-be-accessed application through a browser;

[0008] The encrypted access traffic request is diverted to a traffic loading / unloading module of the forwarding module according to the diversion rule and the rule matching order;

[0009] The encrypted access traffic request is decrypted by the traffic loading / unloading module to obtain plaintext data;

[0010] The plaintext data is subjected to label injection by a secure transmission module of the forwarding module to obtain to-be-sent data in an http data structure; the user identifier corresponding to the to-be-sent data is the preset user identifier;

[0011] The to-be-sent data is encrypted and packaged by the secure transmission module to obtain an encrypted data packet;

[0012] According to the flow rules and the rule matching order, the encrypted data packet is diverted to the zero trust gateway, so that the zero trust gateway performs dynamic access control according to the encrypted data packet.

[0013] In the above implementation process, the method can ensure high pertinence of traffic processing by predefining specific users and their corresponding flow rules and matching orders. Secondly, running the forwarding module based on specific users can ensure that the forwarding module manages and audits traffic. Then, by accurately matching the flow rules, the encrypted access traffic request can be directed to the appropriate processing path to manage the traffic. After that, decryption processing enables the original data to be restored, which provides a basis for subsequent data processing and analysis. The label injection method can increase the controllability of data, facilitating precise control in subsequent data transmission and processing, thereby improving the security of the system. In addition, encryption packaging can ensure the security of data during transmission, thereby strengthening the security protection capability of the system. Finally, dynamic access control through the zero trust gateway can achieve fine management and control of traffic, thereby improving the security and compliance of the system.

[0014] Further, the pre-creation of specific users, flow rules, and rule matching orders of the flow rules includes:

[0015] The specific user is pre-created, and the flow rules and rule matching orders are pre-formulated by calling the flow module in the forwarding module.

[0016] In the above implementation process, the method can ensure the efficiency and accuracy of traffic management, providing a solid foundation for dynamic access control of the system.

[0017] Further, the flow rules include a first rule and a second rule.

[0018] The first rule is to pass all traffic with the preset user identifier as the user identifier.

[0019] The second rule is to introduce all traffic accessing the zero trust gateway into the traffic loading / unloading module of the forwarding module.

[0020] In the above implementation process, the method can ensure smooth traffic of specific users, while strengthening the management and control of access traffic to the zero trust gateway, improving the security and flexibility of the system.

[0021] Further, the diversion of the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the flow rules and the rule matching order includes:

[0022] The encrypted access traffic request is sent to a kernel protocol stack, wherein a request address of the encrypted access traffic request is a domain name address of the application to be accessed, and the domain name address of the application to be accessed points to the zero-trust gateway;

[0023] In the kernel protocol stack, the first rule and the encrypted access traffic request are matched according to the rule matching order to obtain a first matching result, wherein the first matching result is that the encrypted access traffic request fails to match the first rule and succeeds to match the second rule;

[0024] According to the first matching result, the encrypted access traffic request is diverted to a traffic loading / unloading module of the forwarding module.

[0025] In the above implementation process, the method can ensure that the traffic meeting the specific condition is effectively diverted to the traffic loading / unloading module of the forwarding module, thereby enhancing the accuracy of traffic management and the security of the system.

[0026] Further, the decryption processing of the encrypted access traffic request by the traffic loading / unloading module obtains plaintext data, including:

[0027] The encrypted access traffic request is decrypted by the traffic loading / unloading module to obtain original data;

[0028] The original data is parsed according to the http format to obtain plaintext data.

[0029] In the above implementation process, the method can accurately restore the plaintext data to provide a reliable basis for subsequent data processing and ensure the integrity and accuracy of data transmission.

[0030] Further, the label injection of the plaintext data by the security transmission module of the forwarding module obtains the to-be-sent data of the http data structure, including:

[0031] Obtain execution point transmission information, wherein the execution point transmission information at least includes an identity token, a preset user identifier, and a data label;

[0032] Generate a custom key-value pair according to the execution point transmission information;

[0033] In the security transmission module, the custom key-value pair is inserted into the http request header of the plaintext data as a label to obtain the to-be-sent data of the http data structure.

[0034] In the above implementation process, the method can enhance the identification and security of data to provide key information support for subsequent data processing and access control.

[0035] Further, the encryption and packaging of the to-be-sent data by the secure transmission module includes:

[0036] Obtaining a correspondence between an access resource domain name and a zero-trust gateway from a zero-trust control center;

[0037] Converting the to-be-sent data into a target HTTP data packet according to the correspondence;

[0038] Encrypting the target HTTP data packet by the secure transmission module to obtain an encrypted data packet.

[0039] In the above implementation process, the method can ensure the security and target of data transmission, thereby improving the overall protection capability of the system.

[0040] Further, the directing of the encrypted data packet to a zero-trust gateway according to the directing rule and the rule matching order includes:

[0041] Downlinking the encrypted data packet to a kernel protocol stack by the secure transmission module; wherein the user identifier of the encrypted data packet is the preset user identifier;

[0042] Matching the directing rule and the encrypted data packet according to the rule matching order by the kernel protocol stack to obtain a second matching result; wherein the second matching result is that the encrypted data packet matches the first rule successfully;

[0043] Determining a zero-trust gateway to be sent according to the correspondence;

[0044] Sending the encrypted data packet to the zero-trust gateway according to the second matching result.

[0045] In the above implementation process, the method can ensure the security and accuracy of data transmission, thereby realizing the docking and adaptation with different zero-trust gateways, and further improving the scalability and flexibility of the system.

[0046] The second aspect of the application provides a zero-trust B / S application device, which comprises:

[0047] A creating unit is configured to pre-create a specific user, a directing rule, and a rule matching order of the directing rule; wherein the user identifier of the specific user is a preset user identifier;

[0048] A running unit is configured to run a forwarding module based on the specific user, so that the user identifier corresponding to all traffic sent by the forwarding module is the preset user identifier;

[0049] a sending unit configured to send, through a browser, an encrypted access traffic request to an application to be accessed;

[0050] a diversion unit configured to divert, according to the diversion rule and the rule matching order, the encrypted access traffic request to a traffic loading / unloading module of the forwarding module;

[0051] a decryption unit configured to perform decryption processing on the encrypted access traffic request through the traffic loading / unloading module to obtain plaintext data;

[0052] an injection unit configured to perform label injection on the plaintext data through a secure transmission module of the forwarding module to obtain to-be-sent data in an http data structure; a user identifier corresponding to the to-be-sent data is the preset user identifier;

[0053] an encapsulation unit configured to perform encryption encapsulation on the to-be-sent data through the secure transmission module to obtain an encrypted data packet;

[0054] The diversion unit is further configured to divert, according to the diversion rule and the rule matching order, the encrypted data packet to a zero trust gateway, so that the zero trust gateway performs dynamic access control according to the encrypted data packet.

[0055] Further, the creating unit is specifically configured to pre-create a specific user and call a diversion module in the forwarding module to pre-establish the diversion rule and the rule matching order.

[0056] Further, the diversion rule includes a first rule and a second rule.

[0057] The first rule is to pass all traffic whose user identifier is the preset user identifier.

[0058] The second rule is to introduce all traffic accessing the zero trust gateway into the traffic loading / unloading module of the forwarding module.

[0059] Further, the diversion unit includes:

[0060] a delivery sub-unit configured to deliver the encrypted access traffic request to a kernel protocol stack; wherein a request address of the encrypted access traffic request is a domain name address of the application to be accessed, and the domain name address of the application to be accessed points to a zero trust gateway;

[0061] a matching sub-unit configured to match, in the kernel protocol stack, the diversion rule and the encrypted access traffic request according to the rule matching order to obtain a first matching result; wherein the first matching result is that the encrypted access traffic request fails to match the first rule and succeeds to match the second rule.

[0062] a flow steering subunit configured to steer the encrypted access traffic request to a traffic load / unload module of the forwarding module according to the first matching result.

[0063] Further, the decryption unit comprises:

[0064] a decryption subunit configured to perform decryption processing on the encrypted access traffic request through the traffic load / unload module to obtain original data;

[0065] a parsing subunit configured to perform parsing processing on the original data according to an http format to obtain plaintext data.

[0066] Further, the injection unit comprises:

[0067] a first acquisition subunit configured to acquire execution point transmission information; wherein the execution point transmission information at least comprises an identity token, a preset user identifier, and a data label;

[0068] a generation subunit configured to generate a custom key-value pair according to the execution point transmission information;

[0069] an injection subunit configured to insert the custom key-value pair as a label into an http request header of the plaintext data in the secure transmission module to obtain to-be-sent data in an http data structure.

[0070] Further, the encapsulation unit comprises:

[0071] a second acquisition subunit configured to acquire a corresponding relationship between an access resource domain name and a zero-trust gateway from a zero-trust control center;

[0072] a conversion subunit configured to convert the to-be-sent data into a target http data packet according to the corresponding relationship;

[0073] an encapsulation subunit configured to perform encryption processing on the target http data packet through the secure transmission module to obtain an encrypted data packet.

[0074] Further, the flow steering unit comprises:

[0075] a delivery subunit configured to deliver the encrypted data packet to a kernel protocol stack through the secure transmission module; wherein a user identifier of the encrypted data packet is the preset user identifier;

[0076] a matching subunit configured to match the flow steering rule and the encrypted data packet according to the rule matching order through the kernel protocol stack to obtain a second matching result; wherein the second matching result is that the encrypted data packet and the first rule are successfully matched.

[0077] The matching unit is further configured to determine a zero-trust gateway to be sent according to the correspondence;

[0078] The drainage sub-unit is configured to send the encrypted data packet to the zero-trust gateway according to the second matching result.

[0079] The third aspect of the present application provides an electronic device, the electronic device includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to make the electronic device execute the zero-trust B / S application method in any one of the first aspect of the present application.

[0080] The fourth aspect of the present application provides a computer readable storage medium, the readable storage medium stores computer program instructions, and the computer program instructions are read and run by a processor to execute the zero-trust B / S application method in any one of the first aspect of the present application.

[0081] The fifth aspect of the present application provides a computer program product, the computer program product includes a computer program, and the computer program is run by a processor to execute the zero-trust B / S application method in any one of the first aspect of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0082] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0083] Figure 1 The flowchart of the zero-trust B / S application method provided by the embodiments of the present application is shown in the figure;

[0084] Figure 2 The flowchart of another zero-trust B / S application method provided by the embodiments of the present application is shown in the figure;

[0085] Figure 3 The flowchart of the zero-trust B / S application method provided by the embodiments of the present application is shown in the figure;

[0086] Figure 4 The structure diagram of the zero-trust B / S application device provided by the embodiments of the present application is shown in the figure;

[0087] Figure 5 The structure diagram of another zero-trust B / S application device provided by the embodiments of the present application is shown in the figure. DETAILED DESCRIPTION

[0088] The zero-trust B / S application method refers to a way of accessing an application based on a B / S (Browser / Server) architecture through a zero-trust client under a zero-trust security framework. Specifically, the method involves that a zero-trust management platform determines application policy information according to a request of the zero-trust client, and then the zero-trust client establishes a connection with the application policy information in a local browser, encrypts and encapsulates data generated by accessing a target application, and sends the data to a corresponding zero-trust gateway, which then decrypts and forwards the data, thereby realizing secure access to the B / S application.

[0089] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

[0090] It should be noted that similar reference numerals and letters refer to similar items in the following drawings, and therefore, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", and the like are only used for differentiation and cannot be understood as indicating or implying relative importance.

[0091] Embodiment 1

[0092] Please refer to Figure 1 , Figure 1 A flowchart of a zero-trust B / S application method provided in the present embodiment is shown. The zero-trust B / S application method includes the following steps.

[0093] S101, a specific user, a flow diversion rule, and a rule matching order of the flow diversion rule are pre-created, wherein a user identifier of the specific user is a preset user identifier.

[0094] S102, a forwarding module is run based on the specific user, so that all traffic sent by the forwarding module corresponds to the preset user identifier.

[0095] S103, an encrypted access traffic request is sent to a to-be-accessed application through a browser.

[0096] S104, the encrypted access traffic request is diverted to a traffic loading / unloading module of the forwarding module according to the flow diversion rule and the rule matching order.

[0097] S105, the encrypted access traffic request is decrypted by the traffic loading / unloading module to obtain plaintext data.

[0098] S106, the plaintext data is subjected to label injection by a secure transmission module of the forwarding module to obtain to-be-sent data in an http data structure, wherein a user identifier corresponding to the to-be-sent data is the preset user identifier.

[0099] S107, the security transmission module is used for encrypting and packaging the to-be-sent data to obtain an encrypted data packet.

[0100] S108, the encrypted data packet is introduced to the zero-trust gateway according to the flow directing rule and the rule matching sequence, so that the zero-trust gateway performs dynamic access control according to the encrypted data packet.

[0101] By implementing the embodiment, the traffic can be introduced to the local proxy service, the protocol content can be parsed, and the label can be inserted into each data packet according to different scenarios. Meanwhile, the traffic can be proxied to the zero-trust gateway without changing the type of the http protocol family.

[0102] In the embodiment, the execution subject of the method can be a computer, a server or other computing device, and the embodiment does not make any limitation on this.

[0103] In the embodiment, the execution subject of the method can also be a smart phone, a tablet computer or other smart device, and the embodiment does not make any limitation on this.

[0104] It can be seen that, by implementing the zero-trust B / S application method described in the embodiment, the data flow directing can be efficiently and quickly realized, the label can be dynamically injected, the connection and adaptation with different zero-trust gateways can be realized, and the scalability and flexibility of the system are improved.

[0105] Embodiment 2

[0106] Please refer to Figure 2 , Figure 2 A flowchart of a zero-trust B / S application method provided in the embodiment is shown. The zero-trust B / S application method includes the following steps.

[0107] S201, a specific user is created in advance, and a flow directing module in a forwarding module is called to pre-establish a flow directing rule and a rule matching sequence; wherein the user identifier of the specific user is a preset user identifier.

[0108] In the embodiment, the method can create a specific user A that is not root in the system of the access terminal through the control module of the zero-trust client (referred to as the client) to form a user ID (i.e., a user representation), UIDA (i.e., a preset user identifier).

[0109] In the embodiment, the flow directing rule includes a first rule and a second rule.

[0110] The first rule is to pass all traffic with the preset user identifier.

[0111] The second rule is to introduce all traffic accessing the zero-trust gateway into the traffic loading / unloading module of the forwarding module.

[0112] In this embodiment, the method can call the flow directing module in the forwarding module through the control module of the client to formulate two types of flow directing rules. The rules are formulated in sequence, i.e., rule (1) and rule (2) are formulated in sequence, as follows:

[0113] Rule (1): All traffic in specific user A is released, i.e., all traffic with uid-owner as UIDA is released.

[0114] Rule (2): All traffic accessing the zero trust gateway is introduced to the port developed by the traffic loading / unloading module of the client.

[0115] S202, running the forwarding module based on the specific user, so that the user identifier corresponding to all traffic sent by the forwarding module is the preset user identifier.

[0116] In this embodiment, the method can run the forwarding module based on the specific user A, so that the uid-owner of the traffic forwarded by the forwarding module is UIDA.

[0117] S203, sending an encrypted access traffic request to the application to be accessed through the browser.

[0118] S204, sending the encrypted access traffic request to the kernel protocol stack; wherein the request address of the encrypted access traffic request is the domain name address of the application to be accessed, and the domain name address of the application to be accessed points to the zero trust gateway.

[0119] In this embodiment, the browser on the access terminal initiates an encrypted access traffic to the application, the request address of the encrypted access traffic is a domain name address, and the domain name of all applications points to the zero trust gateway. The data packet of the browser is sent to the kernel protocol stack by default.

[0120] S205, matching the flow directing rules and the encrypted access traffic request in the kernel protocol stack according to the rule matching order to obtain a first matching result; wherein the first matching result is that the encrypted access traffic request fails to match the first rule, and the encrypted access traffic request successfully matches the second rule.

[0121] In this embodiment, the method matches rule (1) in sequence through the kernel protocol stack. If the owner of the browser is the current user, the rule matching fails. At this time, rule (2) is continuously matched. If the destination application address of the access request is the zero trust gateway address, the matching succeeds. When the matching succeeds, the method can introduce the traffic to the port opened by the traffic loading / unloading module, so that the original data is obtained by decrypting the traffic in the subsequent steps.

[0122] S206, directing the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the first matching result.

[0123] S207, the encrypted access traffic request is decrypted by the traffic loading / unloading module to obtain original data.

[0124] S208, the original data is parsed according to the http format to obtain plaintext data.

[0125] According to the method, the decrypted original data can be parsed according to the http format, a queue is created, the plaintext data is cached according to the http data structure, and the plaintext data is transmitted to the secure transmission module.

[0126] S209, obtaining execution point transmission information; wherein the execution point transmission information at least includes an identity token, a preset user identifier and a data label.

[0127] S210, generating a custom key-value pair according to the execution point transmission information.

[0128] S211, inserting the custom key-value pair as a label into the http request header of the plaintext data in the secure transmission module to obtain the to-be-sent data of the http data structure; the user identifier corresponding to the to-be-sent data is the preset user identifier.

[0129] In the embodiment, the secure transmission module can obtain the identity token, the application token, the preset user identifier, the data label and other information that need to be transmitted to the execution point from the control module. Then, a custom key-value pair is made for the above information, which is inserted into the http request header as a label to form a new http data structure.

[0130] The identity token, the application token, the preset user identifier, the data label and other information reported by the control module can be obtained from different data sources through the interface adapter on the control module.

[0131] S212, obtaining the corresponding relationship between the access resource domain name and the zero trust gateway from the zero trust control center.

[0132] S213, converting the to-be-sent data into a target http data packet according to the corresponding relationship.

[0133] S214, encrypting the target http data packet by the secure transmission module to obtain an encrypted data packet.

[0134] In the embodiment, the control module can obtain the corresponding relationship between the domain name of the access resource and the zero trust gateway from the zero trust control center, convert the new http data structure into a new http data packet, and encrypt the new http data packet to obtain an encrypted data packet.

[0135] S215, distribute the encrypted data packet to the kernel protocol stack through the secure transmission module; wherein the user identifier of the encrypted data packet is a preset user identifier.

[0136] In this embodiment, the method can send the encrypted http data packet to the corresponding zero trust gateway according to the domain name and zero trust gateway correspondence.

[0137] In this embodiment, the method can distribute the encrypted http data packet to the kernel protocol stack by default.

[0138] S216, match the flow diversion rule and the encrypted data packet according to the rule matching order through the kernel protocol stack, and obtain a second matching result; wherein the second matching result is that the encrypted data packet matches the first rule successfully.

[0139] In this embodiment, the owner of the secure transmission module that sends the encrypted data packet is a specific user A, and the user ID thereof is UIDA. The kernel protocol stack matches the rule (1) in order and successfully, and realizes flow release.

[0140] S217, determine the zero trust gateway to be sent according to the correspondence.

[0141] In this embodiment, the flow is forwarded to the corresponding zero trust gateway by the protocol stack.

[0142] S218, send the encrypted data packet to the zero trust gateway according to the second matching result, so that the zero trust gateway performs dynamic access control according to the encrypted data packet.

[0143] In this embodiment, the zero trust gateway can obtain the data label of the http message by analyzing the key-value pair in the http message header, and then perform fine-grained dynamic access control according to the label.

[0144] In this embodiment, the execution subject of the method can be a computer, a server, or other computing devices, which are not limited in this embodiment.

[0145] In this embodiment, the execution subject of the method can also be a smart phone, a tablet computer, or other smart devices, which are not limited in this embodiment.

[0146] As can be seen, the zero trust B / S application method described in this embodiment can efficiently and quickly realize data flow diversion, dynamically inject labels, realize docking and adaptation with different zero trust gateways, and improve the scalability and flexibility of the system.

[0147] Embodiment 3

[0148] This embodiment shows an example process of a zero trust B / S application method. Please refer to Figure 3 ,Figure 3 A flow architecture diagram of a zero-trust B / S application method is shown. In this example, the zero-trust B / S application method can be applied to the zero-trust authentication client in the public security industry zero-trust system. Specifically, the authentication service in the public security industry zero-trust system corresponds to the zero-trust control center, and the trusted access control in the public security industry zero-trust system corresponds to the zero-trust gateway.

[0149] In this example, the environment perception service in the public security industry zero-trust system provides terminal data tags. The authentication client needs to interface with trusted access controls from different manufacturers and different environment perception services, and needs a standard transmission protocol and flexible tag adaptation function.

[0150] Based on this, the example process of the zero-trust B / S application method is as follows:

[0151] (1) Create a special user when installing the authentication client, which exists continuously.

[0152] (2) The authentication client obtains the unique identifier of the current terminal from the interface adapted with the environment perception service after running.

[0153] (3) Create a local reverse proxy service and run it on the special user. Deploy certificates for traffic encryption and decryption.

[0154] (4) After the client authentication is successful, the domain name address list returned by the authentication service and the identity token after the user authentication is successful, use the DNS resolution service to resolve the returned application domain name into the address of the trusted access control.

[0155] (5) Make firewall rules to pass traffic belonging to the special user.

[0156] (6) Make firewall rules to introduce requests to access the trusted access control to the local proxy service.

[0157] (7) Set up the reverse proxy service according to the correspondence between the application domain name and the trusted access control address.

[0158] (8) The user operates the browser to access the application using the https protocol.

[0159] (9) The traffic of the browser is introduced to the reverse proxy service through the protocol stack.

[0160] (10) The authentication client obtains the access application information according to the domain name information and obtains the permission from the authentication service and generates the application token.

[0161] (11) The reverse proxy service uses the deployed certificate to unload the https protocol.

[0162] (12) The reverse proxy service applies for a user token, an application token and preset user identification information from the control module of the authentication client, and writes the above information into the request header of https according to the specification requirements.

[0163] (13) When the reverse proxy server transmits upstream proxy traffic, the firewall rules are matched. Since the owner of the reverse proxy service is a special user installed by the client, even if the destination address is a trusted access control, the access traffic is still released.

[0164] It can be seen that the zero-trust B / S application method described in the embodiment can achieve flexible and large-scale label injection. At the same time, the rule matching of the flow guide is completed in the kernel, which can efficiently solve the problem of circulating flow guide of data. In addition, the standard https protocol can be used to adapt to the docking and adaptation of label data sources of different manufacturers of zero-trust gateways, thereby realizing the adaptation of the environment.

[0165] Embodiment 4

[0166] Please refer to Figure 4 , Figure 4 A structural schematic diagram of a zero-trust B / S application device provided by the embodiment. As Figure 4 shown, the zero-trust B / S application device comprises:

[0167] The creation unit 310 is configured to pre-create a specific user, a flow guide rule and a rule matching order of the flow guide rule; wherein the user identification of the specific user is a preset user identification;

[0168] The running unit 320 is configured to run the forwarding module based on the specific user, so that the user identification corresponding to all the traffic sent by the forwarding module is the preset user identification;

[0169] The sending unit 330 is configured to send an encrypted access traffic request to a to-be-accessed application through a browser;

[0170] The flow guide unit 340 is configured to guide the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the flow guide rule and the rule matching order;

[0171] The decryption unit 350 is configured to perform decryption processing on the encrypted access traffic request through the traffic loading / unloading module to obtain plaintext data;

[0172] The injection unit 360 is configured to perform label injection on the plaintext data through the secure transmission module of the forwarding module to obtain to-be-sent data in an http data structure; the user identification corresponding to the to-be-sent data is the preset user identification;

[0173] The encapsulation unit 370 is configured to perform encryption encapsulation on the to-be-sent data through the secure transmission module to obtain an encrypted data packet;

[0174] The flow unit 340 is also configured to flow the encrypted data packet to the zero trust gateway according to the flow rule and the rule matching sequence, so that the zero trust gateway performs dynamic access control according to the encrypted data packet.

[0175] In this embodiment, the explanation and description of the zero trust B / S application device can refer to the description in Embodiment 1 or Embodiment 2, and the same will not be repeated here.

[0176] It can be seen that the zero trust B / S application device described in this embodiment can efficiently and quickly realize data flow, and can dynamically inject labels to realize docking and adaptation with different zero trust gateways, thereby improving the scalability and flexibility of the system.

[0177] Embodiment 5

[0178] Please refer to Figure 5 , Figure 5 A structural schematic diagram of a zero trust B / S application device provided in this embodiment. As shown in Figure 5 The zero trust B / S application device comprises:

[0179] The creation unit 310 is configured to pre-create a specific user, a flow rule, and a rule matching sequence of the flow rule; wherein the user identifier of the specific user is a preset user identifier;

[0180] The running unit 320 is configured to run the forwarding module based on the specific user, so that the user identifier corresponding to all the traffic sent by the forwarding module is the preset user identifier;

[0181] The sending unit 330 is configured to send an encrypted access traffic request to the application to be accessed through the browser;

[0182] The flow unit 340 is configured to flow the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the flow rule and the rule matching sequence;

[0183] The decryption unit 350 is configured to perform decryption processing on the encrypted access traffic request through the traffic loading / unloading module to obtain plaintext data;

[0184] The injection unit 360 is configured to perform label injection on the plaintext data through the secure transmission module of the forwarding module to obtain to-be-sent data in the http data structure; the user identifier corresponding to the to-be-sent data is the preset user identifier;

[0185] The encapsulation unit 370 is configured to perform encryption encapsulation on the to-be-sent data through the secure transmission module to obtain an encrypted data packet;

[0186] The flow unit 340 is further configured to flow the encrypted data packet to the zero trust gateway according to the flow rule and the rule matching sequence, so that the zero trust gateway performs dynamic access control according to the encrypted data packet.

[0187] As an optional implementation, the creating unit 310 is specifically configured to pre-create a specific user and call the flow module in the forwarding module to pre-establish the flow rule and the rule matching sequence.

[0188] In this embodiment, the flow rule includes a first rule and a second rule;

[0189] The first rule is to release all traffic whose user identifier is a preset user identifier.

[0190] The second rule is to introduce all traffic accessing the zero trust gateway into the traffic loading / unloading module of the forwarding module.

[0191] As an optional implementation, the flow unit 340 includes:

[0192] The issuing sub-unit 341 is configured to issue the encrypted access traffic request to the kernel protocol stack, wherein the request address of the encrypted access traffic request is a domain name address of the to-be-accessed application, and the domain name address of the to-be-accessed application points to the zero trust gateway.

[0193] The matching sub-unit 342 is configured to match the flow rule and the encrypted access traffic request according to the rule matching sequence in the kernel protocol stack to obtain a first matching result, wherein the first matching result is that the encrypted access traffic request fails to match the first rule and succeeds to match the second rule.

[0194] The flow sub-unit 343 is configured to flow the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the first matching result.

[0195] As an optional implementation, the decryption unit 350 includes:

[0196] The decryption sub-unit 351 is configured to perform decryption processing on the encrypted access traffic request through the traffic loading / unloading module to obtain original data.

[0197] The parsing sub-unit 352 is configured to perform parsing processing on the original data according to an http format to obtain plaintext data.

[0198] As an optional implementation, the injection unit 360 includes:

[0199] The first obtaining sub-unit 361 is configured to obtain execution point transmission information, wherein the execution point transmission information at least includes an identity token, a preset user identifier, and a data label.

[0200] The generating sub-unit 362 is configured to generate a custom key-value pair according to the execution point transmission information;

[0201] The injecting sub-unit 363 is configured to insert the custom key-value pair as a label into an HTTP request header of the plaintext data in the secure transmission module to obtain the to-be-sent data of the HTTP data structure.

[0202] As an optional implementation, the encapsulating unit 370 includes:

[0203] The second obtaining sub-unit 371 is configured to obtain, from the zero-trust control center, a correspondence between an access resource domain name and a zero-trust gateway.

[0204] The converting sub-unit 372 is configured to convert the to-be-sent data into a target HTTP data packet according to the correspondence.

[0205] The encapsulating sub-unit 373 is configured to perform encryption processing on the target HTTP data packet through the secure transmission module to obtain an encrypted data packet.

[0206] As an optional implementation, the diversion unit 340 includes:

[0207] The delivering sub-unit 341 is configured to deliver the encrypted data packet to the kernel protocol stack through the secure transmission module, where a user identifier of the encrypted data packet is a preset user identifier.

[0208] The matching sub-unit 342 is configured to match, through the kernel protocol stack, the diversion rule and the encrypted data packet according to a rule matching order to obtain a second matching result, where the second matching result is that the encrypted data packet is successfully matched with the first rule.

[0209] The matching sub-unit 342 is further configured to determine, according to the correspondence, a zero-trust gateway to be sent.

[0210] The diversion sub-unit 343 is configured to send the encrypted data packet to the zero-trust gateway according to the second matching result.

[0211] In this embodiment, the explanation and description of the zero-trust B / S application apparatus can refer to the description in Embodiment 1 or Embodiment 2, and no more details are added herein.

[0212] As can be seen, the zero-trust B / S application apparatus described in this embodiment can efficiently and quickly implement data diversion, dynamically inject labels, implement interfacing and adapting with different zero-trust gateways, and improve the scalability and flexibility of the system.

[0213] The electronic device provided in the embodiments of the present application comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the zero trust B / S application method in the embodiments 1 or 2 of the present application.

[0214] The computer readable storage medium provided in the embodiments of the present application stores computer program instructions, and the computer program instructions are read and run by a processor to execute the zero trust B / S application method in the embodiments 1 or 2 of the present application.

[0215] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can also be implemented by other manners. The apparatus embodiments described above are only schematic, for example, the flow charts and block diagrams in the drawings show the possible implementation architectures, functions and operations of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flow charts or block diagrams can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logical functions. It should also be noted that, in some alternative implementations, the functions noted in the blocks can occur in different orders from those noted in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flow charts, and the combination of blocks in the block diagrams and / or flow charts, can be implemented by a dedicated hardware-based system for executing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0216] In addition, each functional module in the embodiments of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0217] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts of the prior art that make contributions or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0218] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0219] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0220] It should be noted that, in this document, the terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.

Claims

1. A zero trust B / S application method, characterized in that, The method comprises the following steps: Pre-creating a specific user, a flow diversion rule, and a rule matching order of the flow diversion rule; wherein the user identifier of the specific user is a preset user identifier; Running a forwarding module based on the specific user, so that all traffic sent by the forwarding module corresponds to the preset user identifier; Sending an encrypted access traffic request to a to-be-accessed application through a browser; Diverting the encrypted access traffic request to a traffic loading / unloading module of the forwarding module according to the flow diversion rule and the rule matching order; Decrypting the encrypted access traffic request through the traffic loading / unloading module to obtain plaintext data; Injecting a label into the plaintext data through a secure transmission module of the forwarding module to obtain to-be-sent data in an http data structure; the to-be-sent data corresponds to the preset user identifier; Encrypting and packaging the to-be-sent data through the secure transmission module to obtain an encrypted data packet; Diverting the encrypted data packet to a zero-trust gateway according to the flow diversion rule and the rule matching order, so that the zero-trust gateway performs dynamic access control according to the encrypted data packet.

2. The zero trust B / S application method of claim 1, wherein, The pre-creating a specific user, a flow diversion rule, and a rule matching order of the flow diversion rule comprises: Pre-creating a specific user, and calling a flow diversion module in a forwarding module to pre-establish a flow diversion rule and a rule matching order.

3. The zero trust B / S application method of claim 1, wherein, The flow diversion rule comprises a first rule and a second rule; The first rule is to pass all traffic whose user identifier is the preset user identifier; The second rule is to introduce all traffic accessing the zero-trust gateway into a traffic loading / unloading module of the forwarding module.

4. The zero trust B / S application method of claim 3, wherein, The diverting the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the flow diversion rule and the rule matching order comprises: Downlinking the encrypted access traffic request to a kernel protocol stack; wherein the request address of the encrypted access traffic request is a domain name address of the to-be-accessed application, and the domain name address of the to-be-accessed application points to a zero-trust gateway; Matching the flow diversion rule and the encrypted access traffic request in the kernel protocol stack according to the rule matching order to obtain a first matching result; wherein the first matching result is that the encrypted access traffic request fails to match the first rule, and the encrypted access traffic request succeeds in matching the second rule; Diverting the encrypted access traffic request to the traffic loading / unloading module of the forwarding module according to the first matching result.

5. The zero trust B / S application method according to claim 1, characterized in that, The decrypting the encrypted access traffic request through the traffic loading / unloading module to obtain plaintext data comprises: Decrypting the encrypted access traffic request through the traffic loading / unloading module to obtain original data; Parsing and processing the original data according to an http format to obtain plaintext data.

6. The zero trust B / S application method according to claim 1, characterized in that, The injecting a label into the plaintext data through the secure transmission module of the forwarding module to obtain to-be-sent data in an http data structure comprises: Obtain an execution point transmission information, wherein the execution point transmission information at least includes an identity token, a preset user identifier and a data label; Generate a custom key-value pair according to the execution point transmission information; Insert the custom key-value pair as a label into an HTTP request header of the plaintext data in the secure transmission module to obtain to-be-sent data in an HTTP data structure.

7. The zero trust B / S application method according to claim 3, characterized in that, The encryption and packaging of the to-be-sent data by the secure transmission module to obtain an encrypted data packet, comprising: Obtain a corresponding relationship between an access resource domain name and a zero-trust gateway from a zero-trust control center; Convert the to-be-sent data into a target HTTP data packet according to the corresponding relationship; Perform encryption processing on the target HTTP data packet by the secure transmission module to obtain an encrypted data packet.

8. The zero trust B / S application method of claim 7, wherein, The directing of the encrypted data packet to a zero-trust gateway according to the directing rule and the rule matching order, comprising: Downlink the encrypted data packet to a kernel protocol stack by the secure transmission module, wherein the user identifier of the encrypted data packet is the preset user identifier; Match the directing rule and the encrypted data packet according to the rule matching order by the kernel protocol stack to obtain a second matching result, wherein the second matching result is that the encrypted data packet matches the first rule successfully; Determine a to-be-sent zero-trust gateway according to the corresponding relationship; Send the encrypted data packet to the zero-trust gateway according to the second matching result.

9. An electronic device, comprising: The electronic device comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to make the electronic device execute the zero-trust B / S application method in any one of claims 1 to 8.

10. A readable storage medium, characterized by, The readable storage medium stores computer program instructions, and the computer program instructions are read and run by a processor to execute the zero-trust B / S application method in any one of claims 1 to 8.

11. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program is run by a processor to execute the zero-trust B / S application method in any one of claims 1 to 8.

Images