Identity information management method and device of zero-trust system, medium and program product

Abstract

The embodiment of the invention provides an identity information management method and device of a zero-trust system, a medium and a program product, and relates to the technical field of network security. The method comprises the following steps: in response to an identity information management request, querying and obtaining an identity information attribute structure table from a database, and feeding back an identity information query page; responding to an identity information attribute configuration request initiated by a user, and feeding back an attribute configuration page; and obtaining attribute configuration information input by the user based on the attribute configuration page, updating and storing the identity information attribute structure table based on the attribute configuration information, and feeding back an updated identity information query page based on the updated identity information attribute structure table. According to the embodiment of the invention, the attribute field configuration function is set, so that the identity information attribute structure of the zero-trust system can be adaptively adjusted when the identity management systems of different service scenes are connected, and the flexibility and convenience of identity information management of different service scenes are effectively improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to an identity information management method, device, medium, and program product for a zero-trust system. Background Art

[0002] Zero trust is a network security protection concept. The central idea is that enterprises will not automatically trust anyone / things inside or outside the enterprise, and anyone / things attempting to access the enterprise system should be verified before authorization.

[0003] The zero-trust identity information management system is an important part of the zero-trust system. At present, the existing identity information management technology usually pre-configures the corresponding identity information attribute structure in the system, collects user information based on these pre-configured identity information attribute structures, and then performs authorization management based on specific user information or organizational structure.

[0004] However, when managing identity information in different business scenarios such as different fields, different institutions or different departments, since the attribute structures of user identity information in different business scenarios are different, the zero-trust system needs to configure corresponding identity information attribute storage structures for these different business scenarios respectively, and collect specific identity information of the corresponding structures for authorization management respectively. However, it is impossible to adopt a unified attribute authorization management strategy for users in different business scenarios, resulting in the lack of flexibility and convenience of the zero-trust system when managing identity information in different business scenarios. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide an identity information management method, device, medium and program product for a zero-trust system, so as to improve the flexibility and convenience of the zero-trust system in managing identity information in different business scenarios.

[0006] In a first aspect, an embodiment of the present application provides an identity information management method for a zero-trust system, including:

[0007] In response to a user's identity information management request for the zero-trust system, query and obtain a currently stored identity information attribute structure table from a database, and feed back an identity information query page based on the identity information attribute structure table;

[0008] Responding to an identity information attribute configuration request initiated by a user based on the identity information query page, and feeding back an attribute configuration page corresponding to the identity information attribute configuration request;

[0009] Acquire the attribute configuration information input by the user based on the attribute configuration page, update and store the identity information attribute structure table based on the attribute configuration information, and feed back an updated identity information query page based on the updated identity information attribute structure table.

[0010] In an embodiment of the present application, by setting the attribute field configuration function, the identity information attribute structure of the zero-trust system can be adaptively adjusted when connecting to the identity management system of different business scenarios, thereby providing a basis for user identity information attributes for adopting a unified attribute authorization strategy, effectively improving the flexibility and convenience of identity information management in different business scenarios.

[0011] In some possible embodiments, the identity information management method of the zero-trust system further includes:

[0012] In response to a user's attribute authorization management request, query and obtain a currently stored attribute authorization control table from the database, and feed back an attribute authorization management page based on the attribute authorization control table;

[0013] responding to an attribute authorization configuration request initiated by a user based on the attribute authorization management page, and feeding back an attribute authorization configuration page corresponding to the attribute authorization configuration request;

[0014] Acquire the attribute authorization configuration information input by the user based on the attribute authorization configuration page, update and store the attribute authorization control table based on the attribute authorization configuration information, and feed back an updated attribute authorization management page based on the updated attribute authorization control table.

[0015] In the embodiment of the present application, by setting the function of attribute authorization configuration, a unified attribute authorization strategy can be used to perform identity information attribute authorization management on users in different business scenarios, further improving the flexibility and convenience of identity information management in different business scenarios.

[0016] In some possible embodiments, the information item of the attribute configuration information includes an authorization type, and the authorization type is used to indicate whether each attribute field of the identity information attribute structure table allows attribute authorization;

[0017] The responding to the attribute authorization configuration request initiated by the user based on the attribute authorization management page and feeding back an attribute authorization configuration page corresponding to the attribute authorization configuration request includes:

[0018] In response to an attribute authorization addition request initiated by a user based on the attribute authorization management page, several attribute fields configured to allow attribute authorization in the identity information attribute structure table are used as optional configuration objects, and an attribute authorization configuration page is fed back based on the optional configuration objects.

[0019] In the embodiment of the present application, by adding the configuration information item of authorization type, the permission configuration of attribute authorization can be performed separately for different attribute fields, thereby further improving the flexibility of attribute authorization configuration.

[0020] In some possible embodiments, the attribute field of the identity information attribute structure table includes an identity type, and the identity type is used to indicate a subject type to which the user object belongs, and the identity type includes at least one of a device, a user, and an application;

[0021] The obtaining of attribute authorization configuration information input by the user based on the attribute authorization configuration page, updating and storing the attribute authorization control table based on the attribute authorization configuration information, and feeding back an updated attribute authorization management page based on the updated attribute authorization control table, includes:

[0022] Acquire attribute authorization configuration information input by the user based on the attribute authorization configuration page; wherein the attribute authorization configuration information includes an identity type, an identity attribute field selected based on the identity type, an authorization attribute value corresponding to the identity attribute field, an authorization object type, a business resource attribute field selected based on the authorization object type, and a business resource attribute value corresponding to the business resource attribute field;

[0023] The attribute authorization control table is updated and stored based on the attribute authorization configuration information, and an updated attribute authorization management page is fed back based on the updated attribute authorization control table.

[0024] In the embodiment of the present application, the flexibility of attribute authorization configuration is further improved by classifying and configuring the managed user objects according to identity types.

[0025] In some possible embodiments, responding to an identity information attribute configuration request initiated by a user based on the identity information query page and feeding back an attribute configuration page corresponding to the identity information attribute configuration request includes:

[0026] In response to a request for adding an identity information attribute initiated by a user based on the identity information query page, obtaining a second identity information attribute structure table of the current identity management system to be connected, and determining attribute difference information between the second identity information attribute structure table and the identity information attribute structure table;

[0027] An attribute configuration page corresponding to the identity information attribute addition request is fed back based on the attribute difference information.

[0028] In the embodiment of the present application, by adaptively feeding back the corresponding attribute configuration page according to the difference in identity information storage structure between the identity management system and the zero-trust system to be connected as needed, the convenience of identity information attribute configuration is further improved.

[0029] In some possible embodiments, responding to an attribute authorization configuration request initiated by a user based on the attribute authorization management page and feeding back an attribute authorization configuration page corresponding to the attribute authorization configuration request includes:

[0030] In response to an attribute authorization addition request initiated by a user based on the attribute authorization management page, several attribute fields that were most recently updated and configured in the identity information attribute structure table are used as optional configuration objects, and an attribute authorization configuration page is fed back based on the optional configuration objects.

[0031] In the embodiment of the present application, the convenience of attribute authorization configuration is further improved by using the most recently updated attribute field as an optional object for attribute authorization configuration.

[0032] In some possible embodiments, the identity information management method of the zero-trust system further includes:

[0033] Responding to a business resource access request from a user, and extracting corresponding identity information and target business resource information based on the business resource access request;

[0034] Determining a number of target attribute fields configured to allow attribute authorization based on the currently stored identity information attribute structure table, and acquiring identity attribute information corresponding to the number of target attribute fields based on the identity information;

[0035] The currently stored attribute authorization control table is queried and obtained from the database, information matching is performed on the attribute authorization control table based on the identity attribute information and the target business resource information, and access control is performed on the business resource access request of the user based on the information matching.

[0036] In the embodiment of the present application, user identity information access control is implemented by means of attribute authorization, which further improves the flexibility and convenience of identity information management in different business scenarios.

[0037] In a second aspect, an embodiment of the present application provides an identity information management device of a zero-trust system, including:

[0038] A query response module, configured to respond to a user's identity information management request for a zero-trust system, query and obtain a currently stored identity information attribute structure table from a database, and feed back an identity information query page based on the identity information attribute structure table;

[0039] A configuration response module, used to respond to an identity information attribute configuration request initiated by a user based on the identity information query page, and to feed back an attribute configuration page corresponding to the identity information attribute configuration request;

[0040] The attribute update module is used to obtain the attribute configuration information input by the user based on the attribute configuration page, update and store the identity information attribute structure table based on the attribute configuration information, and feed back an updated identity information query page based on the updated identity information attribute structure table.

[0041] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement the method described in any embodiment of the first aspect when executing the program.

[0042] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented.

[0043] In a fifth aspect, an embodiment of the present application provides a computer program product, wherein the computer program product includes a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A flowchart of an identity information management method for a zero-trust system provided in an embodiment of the present application;

[0046] Figure 2 A schematic diagram of an identity information query page provided in an embodiment of the present application;

[0047] Figure 3 A schematic diagram of an attribute authorization configuration page provided in an embodiment of the present application;

[0048] Figure 4 A schematic diagram of an attribute configuration page for a newly added attribute field provided in an embodiment of the present application;

[0049] Figure 5A schematic diagram of the structure of an identity information management device for a zero-trust system provided in an embodiment of the present application;

[0050] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0052] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0053] like Figure 1 As shown, the embodiment of the present application provides an identity information management method for a zero-trust system, which may include the following steps:

[0054] S1. In response to a user's identity information management request for a zero-trust system, query and obtain a currently stored identity information attribute structure table from a database, and feed back an identity information query page based on the identity information attribute structure table.

[0055] It can be understood that the identity information management method of the zero-trust system of the embodiment of the present application can be executed on the zero-trust system, and the user can implement the identity information attribute management of the zero-trust system on the front end such as the browser of the management terminal.

[0056] It should be noted that when the zero-trust system needs to be applied to different business scenarios, it is necessary to connect the zero-trust system with the identity management system of the business scenario. Since the identity management systems of different business scenarios usually use different user identity information storage institutions, users (usually system administrators) can modify and configure the identity information attribute structure of the zero-trust system according to their needs.

[0057] Specifically, the user can initiate an identity information management request to the zero-trust system at the front end. After receiving the identity information management request initiated by the user, the zero-trust system queries the database through the table name of the identity information storage table, and obtains the table structure (identity information attribute structure table) used to store user identity information from the database, and then feeds back the identity information query page to the front-end browser based on the identity information attribute structure table.

[0058] Exemplarily, the identity information attribute structure table may include attribute fields such as identity ID, identity identification, name, and ID number, and each attribute field has corresponding configuration information that is preset or set by default, such as attribute name, attribute English name, attribute character type, attribute enablement status, authorization type, whether required, etc. Each attribute field of the identity information attribute structure table and the configuration information corresponding to each attribute field can be displayed in a browser page as an identity information query page based on a preset layout, such as Figure 2 shown.

[0059] S2. Respond to the identity information attribute configuration request initiated by the user based on the identity information query page, and feed back an attribute configuration page corresponding to the identity information attribute configuration request.

[0060] Specifically, based on the query results, users can view the attribute fields and their configurations of the identity information attribute structure table currently stored in the zero-trust system on the identity information query page. According to the current identity information management requirements that need to be connected, an identity information attribute configuration request for the current identity information attribute structure table can be initiated on the identity information query page. For example, each attribute field of the identity information attribute structure table can be configured and edited, or the corresponding attribute fields can be deleted or added. Accordingly, the identity information attribute configuration requests initiated by the user can be identity information attribute editing requests, identity information attribute deletion requests, and identity information attribute addition requests.

[0061] After receiving the user's identity information attribute configuration request, the zero trust system will feedback the corresponding attribute configuration page according to different identity information attribute configuration requests. For example, when the identity information attribute configuration request is an identity information attribute edit request for a certain attribute field, the configuration information edit page of the attribute field will be fed back; when the identity information attribute configuration request is an identity information attribute delete request for a certain attribute field, a prompt page asking whether to delete the attribute field will be fed back; when the identity information attribute configuration request is an identity information attribute addition request, the corresponding new attribute field configuration page will be fed back.

[0062] S3. Acquire the attribute configuration information input by the user based on the attribute configuration page, update and store the identity information attribute structure table based on the attribute configuration information, and feed back an updated identity information query page based on the updated identity information attribute structure table.

[0063] Specifically, according to the attribute configuration information entered by the user on the attribute configuration page, that is, according to the user's configuration operation on the attribute field, the identity information attribute structure table is updated and overwritten and stored in the database. At the same time, the identity information query page is fed back based on the updated identity information attribute structure table so that the user can view the attribute fields and their configuration status of the updated identity information attribute structure table.

[0064] Based on this, the embodiment of the present application provides an attribute field configuration function, which can adaptively adjust the identity information attribute structure of the zero-trust system according to needs when connecting to identity management systems in different business scenarios, thereby providing an information basis for user identity information attributes for adopting a unified attribute authorization strategy, thereby achieving more fine-grained and multi-dimensional access control, and effectively improving the flexibility and convenience of identity information management in different business scenarios.

[0065] In some possible embodiments, the identity information management method of the zero-trust system may further include the steps of:

[0066] S4. In response to the user's attribute authorization management request, query and obtain the currently stored attribute authorization control table from the database, and feedback the attribute authorization management page based on the attribute authorization control table;

[0067] S5. responding to the attribute authorization configuration request initiated by the user based on the attribute authorization management page, and feeding back an attribute authorization configuration page corresponding to the attribute authorization configuration request;

[0068] S6. Acquire the attribute authorization configuration information input by the user based on the attribute authorization configuration page, update and store the attribute authorization control table based on the attribute authorization configuration information, and feed back an updated attribute authorization management page based on the updated attribute authorization control table.

[0069] It is understandable that attribute authorization refers to the authorization of access to a certain object or a certain type of object based on the specific attribute information of a certain attribute field. For example, all users whose specific attribute information of the attribute field "gender" is "male" are configured as authorized access, or users whose specific attribute information of the attribute field "user name" is "Zhang San" are configured as authorized access.

[0070] When a user needs to perform attribute authorization management, he can initiate an attribute authorization management request. After the zero-trust system receives the attribute authorization management request, it can query the currently stored attribute authorization control table from the database. It can be understood that the attribute authorization control table is used to represent the current authorization policy, including which attribute fields and which specific attribute information are allowed to be authorized, as well as the corresponding authorized object information. Based on the information represented by the attribute authorization control table, the zero-trust system can return the corresponding attribute authorization management page in the browser, where the user can view which attribute fields are currently configured with attribute authorization, as well as the specific attribute authorization configuration information.

[0071] Users can initiate attribute authorization configuration requests in the attribute authorization management page, including attribute authorization addition requests, attribute authorization deletion requests for a certain attribute field, and attribute authorization editing requests for a certain attribute field. Accordingly, the system will return the corresponding attribute authorization configuration page. For example, if the attribute authorization configuration request is an attribute authorization addition request, the specific attribute authorization custom configuration page will be returned; if the attribute authorization configuration request is an attribute authorization deletion request for a certain attribute field, a prompt page asking whether to confirm the deletion will be returned; if the attribute authorization configuration request is an attribute authorization editing request for a certain attribute field, the attribute authorization custom configuration page of the corresponding attribute field will be returned.

[0072] Users can enter the corresponding attribute authorization configuration information in the corresponding attribute authorization configuration page according to their needs and submit it. The system will then add, delete or modify the attribute authorization control table based on the attribute authorization configuration information, and overwrite and store it in the database based on the updated attribute authorization control table; at the same time, the attribute authorization management page will be fed back based on the updated attribute authorization control table so that users can view the updated attribute authorization configuration.

[0073] In some possible embodiments, the information item of the attribute configuration information includes an authorization type, and the authorization type is used to indicate whether each attribute field of the identity information attribute structure table allows attribute authorization;

[0074] Step S5, responding to the attribute authorization configuration request initiated by the user based on the attribute authorization management page and feeding back an attribute authorization configuration page corresponding to the attribute authorization configuration request, may include:

[0075] S501. In response to an attribute authorization addition request initiated by a user based on an attribute authorization management page, several attribute fields configured to allow attribute authorization in the identity information attribute structure table are used as optional configuration objects, and an attribute authorization configuration page is fed back based on the optional configuration objects.

[0076] It should be noted that the configuration information of the attribute field may include an information item called authorization type, which is used to configure whether the attribute field allows attribute authorization. For example, the attribute field "ID number" can be configured as "authorizable" or "non-authorizable". If it is configured as "authorizable", the access control policy for attribute authorization can be configured based on the attribute field during the attribute authorization configuration process. Otherwise, the access control policy for attribute authorization cannot be configured for the attribute field.

[0077] In step S5, if the attribute authorization configuration request is an attribute authorization addition request, that is, adding a new attribute authorization control policy, the process may be performed according to step S501.

[0078] Specifically, in response to a new attribute authorization request, the system only uses attribute fields that are configured as "authorizable" as optional configuration objects. In the attribute authorization configuration page that is fed back, when the user selects the attribute field to be configured, they can only choose from the optional configuration objects determined by the system, and cannot perform attribute authorization configuration for attribute fields that are configured as "unauthorizable". If you want to perform attribute authorization configuration for an attribute field that is configured as "unauthorizable", you need to initiate an identity information attribute edit request for the attribute field (such as "ID number") in the identity information query page, and change its "authorization type" information item to "authorizable".

[0079] Based on this, by configuring the authorization type of each attribute field, the permission configuration of attribute authorization can be performed separately for different attribute fields, further improving the flexibility of attribute authorization configuration.

[0080] In some possible embodiments, the attribute field of the identity information attribute structure table includes an identity type, and the identity type is used to indicate the subject type to which the user object belongs, and the identity type includes at least one of a device, a user, and an application;

[0081] Step S6, obtaining the attribute authorization configuration information input by the user based on the attribute authorization configuration page, updating and storing the attribute authorization control table based on the attribute authorization configuration information, and feeding back an updated attribute authorization management page based on the updated attribute authorization control table, may include:

[0082] S601. Acquire attribute authorization configuration information input by a user based on an attribute authorization configuration page; wherein the attribute authorization configuration information includes an identity type, an identity attribute field selected based on the identity type, an authorization attribute value corresponding to the identity attribute field, an authorization object type, a business resource attribute field selected based on the authorization object type, and a business resource attribute value corresponding to the business resource attribute field;

[0083] S602: Update and store the attribute authorization control table based on the attribute authorization configuration information, and feed back an updated attribute authorization management page based on the updated attribute authorization control table.

[0084] It should be noted that in a zero-trust system, different managed objects can be classified and managed according to identity type, for example, managed objects can be classified according to devices, users, and applications.

[0085] Specifically, when configuring the identity information attribute structure table, a field of "identity type" may be added. When collecting identity information, classification management may be performed according to the attribute field of "identity type" based on the identity information of each managed object.

[0086] like Figure 3 As shown, when performing attribute authorization configuration on the attribute authorization configuration page, it is mainly divided into subject information configuration and object information configuration, wherein subject information refers to the information of the object that needs to be accessed. Exemplarily, the subject information configuration includes identity type (such as device, user, application, etc.). After determining the specific identity type, you can select the corresponding identity attribute field based on the identity type, such as "name", "ID number", "identity identification", etc. After selecting the identity attribute field, enter the specific authorization attribute value that needs to be authorized. For example, the user whose authorization attribute value of the attribute field "name" is equal to (or contains) "zltest" is used as the authorization subject, or the user whose authorization attribute value of the attribute field "ID number" contains "1999" is used as the authorization subject.

[0087] Object information refers to the information of business resources that are configured to allow the subject to access, including the authorized object type (such as application, service, device, etc.). After determining the specific authorized object type, select the corresponding business resource attribute field, such as "application name", "application number", etc. After selecting the business resource attribute field, enter the specific business resource attribute value, for example, set the application with "application name" equal to "testlink" as the authorized object, etc.

[0088] In some possible embodiments, step S2, responding to an identity information attribute configuration request initiated by a user based on an identity information query page and feeding back an attribute configuration page corresponding to the identity information attribute configuration request, may include:

[0089] S201, in response to a request for adding an identity information attribute initiated by a user based on an identity information query page, obtaining a second identity information attribute structure table of the current identity management system to be connected, and determining attribute difference information between the second identity information attribute structure table and the identity information attribute structure table;

[0090] S202: Feedback an attribute configuration page corresponding to the identity information attribute addition request based on the attribute difference information.

[0091] It should be noted that when adding a new attribute field, the table structure for storing identity information in the identity management system to be connected can be obtained (the second identity information attribute structure table), and then the difference between the second identity information attribute structure table and the identity information attribute structure table of the zero trust system can be compared and determined (attribute difference information). Exemplarily, the difference between the two can be that the second identity information attribute structure table has one more attribute field than the identity information attribute structure table (for example, an additional attribute field of "gender" is added). Then, when the attribute configuration page corresponding to the request for adding new identity information attributes is fed back, the configuration information about the attribute field of "gender" can be automatically generated in the attribute configuration page.

[0092] like Figure 4 As shown, exemplarily, in the attribute configuration page of the newly added attribute field, the content corresponding to the attribute field name is displayed as "gender", the content corresponding to the attribute English name is displayed as "gender", the content corresponding to the attribute character type is displayed as "text", etc.; in addition, the options corresponding to the option configuration items such as the authorization type can be selected as "authorizable" or "non-authorizable" by default. In this way, the configuration information about the attribute field to be added is automatically generated according to the default settings, and the user can directly submit the default generated attribute configuration page after confirmation, thereby further improving the convenience of identity information attribute configuration.

[0093] In some possible embodiments, step S5, responding to an attribute authorization configuration request initiated by a user based on an attribute authorization management page and feeding back an attribute authorization configuration page corresponding to the attribute authorization configuration request, may include:

[0094] S502: In response to an attribute authorization addition request initiated by the user based on the attribute authorization management page, several attribute fields that were recently updated and configured in the identity information attribute structure table are used as optional configuration objects, and an attribute authorization configuration page is fed back based on the optional configuration objects.

[0095] Specifically, when initiating a request for adding attribute authorization in the attribute authorization management page, the several attribute fields that were most recently updated and configured can be determined based on the difference between the currently stored identity information attribute structure table and the identity information attribute structure table stored last time (or in a certain period of time in history), and these recently added attribute fields can be used as only these optional configuration objects as selectable configurations and objects in the attribute authorization configuration page.

[0096] Based on this, by using the most recently updated attribute field as an optional object for the new attribute authorization configuration, the user is less likely to see other attribute fields that do not need to be newly managed, which improves the simplicity of the attribute authorization configuration and further improves the convenience of the attribute authorization configuration.

[0097] In some possible embodiments, the identity information management method of the zero-trust system may further include:

[0098] S701, responding to a business resource access request from a user, and extracting corresponding identity information and target business resource information based on the business resource access request;

[0099] S702: Determine a number of target attribute fields configured to allow attribute authorization based on the currently stored identity information attribute structure table, and acquire identity attribute information corresponding to the number of target attribute fields based on the identity information;

[0100] S703: Query and obtain the currently stored attribute authorization control table from the database, match the attribute authorization control table based on the identity attribute information and the target business resource information, and perform access control on the user's business resource access request based on the information matching.

[0101] It should be noted that after configuring attribute authorization, you can verify the attribute authorization function, for example, by logging in to the client using a user that meets the attribute authorization policy and accessing attribute-authorized business resources. If the access is successful, the attribute authorization configuration is successfully completed.

[0102] Specifically, in the process of using attribute authorization strategy for resource access control, after receiving the user's business resource access request, the zero trust system first extracts the current user's identity information and the target business resource information to be accessed based on the business resource access request.

[0103] Then, determine which attribute fields are configured to allow attribute authorization based on the identity information attribute structure table currently stored in the zero trust system, and obtain identity attribute information of the attribute fields configured to allow attribute authorization from the identity information.

[0104] Then query the attribute authorization control table currently stored in the database, and match each identity attribute information and target business resource information with the attribute authorization control table respectively. If the attribute authorization control table successfully matches a certain identity attribute information, and the attribute authorization control table and the authorization object information corresponding to the identity attribute information and the target business resource information also successfully match, the user is allowed to access the corresponding target business resource, otherwise access is denied.

[0105] Please refer to Figure 5 , Figure 5FIG. 1 shows a block diagram of an identity information management device of a zero-trust system provided by some embodiments of the present application. It should be understood that the identity information management device of the zero-trust system is similar to the above-mentioned Figure 1 Corresponding to the method embodiment, the various steps involved in the above method embodiment can be executed. The specific functions of the identity information management device of the zero-trust system can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0106] Figure 5 The identity information management device of the zero-trust system includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the identity information management device of the zero-trust system, and the identity information management device of the zero-trust system includes:

[0107] The query response module 510 is used to query and obtain the currently stored identity information attribute structure table from the database in response to the user's identity information management request for the zero-trust system, and feedback the identity information query page based on the identity information attribute structure table;

[0108] Configuration response module 520, used to respond to the identity information attribute configuration request initiated by the user based on the identity information query page, and feedback the attribute configuration page corresponding to the identity information attribute configuration request;

[0109] The attribute update module 530 is used to obtain the attribute configuration information input by the user based on the attribute configuration page, update and store the identity information attribute structure table based on the attribute configuration information, and feed back an updated identity information query page based on the updated identity information attribute structure table.

[0110] It can be understood that the above-mentioned device item embodiment corresponds to the method item embodiment of the present invention. The identity information management device of a zero-trust system provided by the embodiment of the present invention can implement the identity information management method of a zero-trust system provided by any method item embodiment of the present invention.

[0111] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0112] like Figure 6 As shown, some embodiments of the present application provide an electronic device 600, which includes: a memory 610, a processor 620, and a computer program stored in the memory 610 and executable on the processor 620, wherein the processor 620 reads the program from the memory 610 through a bus 630 and executes the program to implement a method of any embodiment of the identity information management method of the zero-trust system described above.

[0113] Processor 620 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 620 can be a microprocessor.

[0114] The memory 610 may be used to store instructions executed by the processor 620 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 620 of the disclosed embodiment may be used to execute instructions in the memory 610 to implement the method shown above. The memory 610 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0115] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon. The computer program is executed by a processor to execute the method described in the method embodiment.

[0116] Some embodiments of the present application further provide a computer program product, which, when executed on a computer, enables the computer to execute the method described in the method embodiment.

[0117] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0118] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0119] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0120] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0121] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0122] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0123] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for managing identity information of a zero-trust system, characterized in that: include: In response to a user's identity information management request for the zero-trust system, query and obtain a currently stored identity information attribute structure table from a database, and feed back an identity information query page based on the identity information attribute structure table; Responding to an identity information attribute configuration request initiated by a user based on the identity information query page, and feeding back an attribute configuration page corresponding to the identity information attribute configuration request; Acquire the attribute configuration information input by the user based on the attribute configuration page, update and store the identity information attribute structure table based on the attribute configuration information, and feed back an updated identity information query page based on the updated identity information attribute structure table.

2. The identity information management method of the zero-trust system according to claim 1, characterized in that: Also includes: In response to a user's attribute authorization management request, query and obtain a currently stored attribute authorization control table from the database, and feed back an attribute authorization management page based on the attribute authorization control table; responding to an attribute authorization configuration request initiated by a user based on the attribute authorization management page, and feeding back an attribute authorization configuration page corresponding to the attribute authorization configuration request; Acquire the attribute authorization configuration information input by the user based on the attribute authorization configuration page, update and store the attribute authorization control table based on the attribute authorization configuration information, and feed back an updated attribute authorization management page based on the updated attribute authorization control table.

3. The identity information management method of the zero-trust system according to claim 2, characterized in that: The information item of the attribute configuration information includes an authorization type, and the authorization type is used to indicate whether each attribute field of the identity information attribute structure table allows attribute authorization; The responding to the attribute authorization configuration request initiated by the user based on the attribute authorization management page and feeding back an attribute authorization configuration page corresponding to the attribute authorization configuration request includes: In response to an attribute authorization addition request initiated by a user based on the attribute authorization management page, several attribute fields configured to allow attribute authorization in the identity information attribute structure table are used as optional configuration objects, and an attribute authorization configuration page is fed back based on the optional configuration objects.

4. The identity information management method of the zero-trust system according to claim 2, characterized in that: The attribute field of the identity information attribute structure table includes an identity type, where the identity type is used to indicate the subject type to which the user object belongs, and the identity type includes at least one of a device, a user, and an application; The obtaining of attribute authorization configuration information input by the user based on the attribute authorization configuration page, updating and storing the attribute authorization control table based on the attribute authorization configuration information, and feeding back an updated attribute authorization management page based on the updated attribute authorization control table, includes: Acquire attribute authorization configuration information input by the user based on the attribute authorization configuration page; wherein the attribute authorization configuration information includes an identity type, an identity attribute field selected based on the identity type, an authorization attribute value corresponding to the identity attribute field, an authorization object type, a business resource attribute field selected based on the authorization object type, and a business resource attribute value corresponding to the business resource attribute field; The attribute authorization control table is updated and stored based on the attribute authorization configuration information, and an updated attribute authorization management page is fed back based on the updated attribute authorization control table.

5. The identity information management method of the zero-trust system according to claim 1, characterized in that: The responding to the identity information attribute configuration request initiated by the user based on the identity information query page and feeding back an attribute configuration page corresponding to the identity information attribute configuration request includes: In response to a request for adding an identity information attribute initiated by a user based on the identity information query page, obtaining a second identity information attribute structure table of the current identity management system to be connected, and determining attribute difference information between the second identity information attribute structure table and the identity information attribute structure table; An attribute configuration page corresponding to the identity information attribute addition request is fed back based on the attribute difference information.

6. The identity information management method of the zero-trust system according to claim 1, characterized in that: The responding to the attribute authorization configuration request initiated by the user based on the attribute authorization management page and feeding back an attribute authorization configuration page corresponding to the attribute authorization configuration request includes: In response to an attribute authorization addition request initiated by a user based on the attribute authorization management page, several attribute fields that were most recently updated and configured in the identity information attribute structure table are used as optional configuration objects, and an attribute authorization configuration page is fed back based on the optional configuration objects.

7. The identity information management method of the zero-trust system according to claim 1, characterized in that: Also includes: Responding to a business resource access request from a user, and extracting corresponding identity information and target business resource information based on the business resource access request; Determine a number of target attribute fields configured to allow attribute authorization based on the currently stored identity information attribute structure table, and acquire identity attribute information corresponding to the number of target attribute fields based on the identity information; The currently stored attribute authorization control table is queried and obtained from the database, information matching is performed on the attribute authorization control table based on the identity attribute information and the target business resource information, and access control is performed on the business resource access request of the user based on the information matching.

8. An electronic device, characterized in that: It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the identity information management method of the zero-trust system described in any one of claims 1-7 can be implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the identity information management method of the zero-trust system as described in any one of claims 1-7 is executed.

10. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the identity information management method of the zero-trust system described in any one of claims 1-7 is implemented.

Images