Network communication method and device based on zero-trust system, equipment and medium

Abstract

The embodiment of the invention provides a network communication method and device based on a zero-trust system, equipment and a medium. The method comprises the following steps: receiving a request message sent by user equipment; generating header enhancement information for the request message according to the related information of the user equipment, and performing header enhancement processing on the request message by adopting the header enhancement information; and sending the request message after the head enhancement processing to a zero-trust system network element so as to perform permission verification on the user equipment through the head enhancement information. According to the embodiment of the invention, the authority verification is carried out according to the header enhancement information of the message in the zero-trust system, the network security is improved, and the security requirement is met.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and in particular to a network communication method, device, equipment and medium based on a zero-trust system. Background Art

[0002] With the rapid development of Internet technology, network security issues have become increasingly serious, causing great losses to users' personal information, property, etc.

[0003] In existing technologies, a boundary-based network security architecture is usually adopted, which often relies on fixed network boundaries and static authentication mechanisms. However, as attack methods become more and more diverse, the traditional boundary-based network security architecture can no longer meet security needs. Summary of the invention

[0004] In view of the above problems, a network communication method, apparatus, device and medium based on a zero-trust system are proposed to overcome the above problems or at least partially solve the above problems, including:

[0005] A network communication method based on a zero-trust system, the method comprising:

[0006] Receiving a request message sent by a user device;

[0007] Generate header enhancement information for the request message according to the relevant information of the user equipment, and perform header enhancement processing on the request message using the header enhancement information;

[0008] The request message after header enhancement processing is sent to the zero-trust system network element to verify the authority of the user device through the header enhancement information.

[0009] Optionally, the adopting the header enhancement information to perform header enhancement processing on the request message includes:

[0010] The header enhancement information is inserted into the header of the request message.

[0011] Optionally, the request message is a request message for user authentication, the zero-trust system network element is a zero-trust controller, and the request message after header enhancement processing is sent to the zero-trust system network element to perform authority verification on the user device through the header enhancement information, including:

[0012] The request message after header enhancement processing is sent to the zero trust controller to perform user identity authentication on the user device through the header enhancement information.

[0013] Optionally, after sending the request message after the header enhancement processing to the zero trust controller to perform user identity authentication on the user device through the header enhancement information, it also includes:

[0014] A response message returned in response to the request message after the enhancement processing is received, and the response message is sent to the user equipment so that the message content is displayed on the user equipment.

[0015] Optionally, the request message is a request message for user resource access, the zero-trust system network element is a zero-trust gateway, and the request message after header enhancement processing is sent to the zero-trust system network element to perform permission verification on the user device through the header enhancement information, including:

[0016] The request message after header enhancement processing is sent to the zero-trust gateway to authenticate the resource access permission of the user device through the header enhancement information, and access the resource server if the resource access permission authentication is passed.

[0017] Optionally, the relevant information of the user equipment includes any one or more of the following: user identity information, accessed network information, and geographic location information.

[0018] Optionally, the request message is a message based on Hypertext Transfer Protocol or Hypertext Transfer Protocol Security.

[0019] A network communication device based on a zero-trust system, the device comprising:

[0020] A request message receiving module, used to receive a request message sent by a user device;

[0021] A header enhancement module, configured to generate header enhancement information for the request message according to relevant information of the user equipment, and perform header enhancement processing on the request message using the header enhancement information;

[0022] The authority verification module is used to send the request message after header enhancement processing to the zero-trust system network element, so as to verify the authority of the user device through the header enhancement information.

[0023] An electronic device comprises a processor, a memory and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the method described above when executed by the processor.

[0024] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0025] The embodiments of the present invention have the following advantages:

[0026] In an embodiment of the present invention, by receiving a request message sent by a user device, header enhancement information for the request message is generated according to relevant information of the user device, and the header enhancement information is used to perform header enhancement processing on the request message, and the request message after the header enhancement processing is sent to a zero-trust system network element to perform authority verification on the user device through the header enhancement information, thereby realizing authority verification based on the header enhancement information of the message in the zero-trust system, improving the security of the network, and thus meeting security requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solution of the present invention, the accompanying drawings required for use in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0028] Figure 1 is a flowchart of a network communication method based on a zero-trust system provided by some embodiments of the present invention;

[0029] Figure 2a is a schematic diagram of a system architecture provided by some embodiments of the present invention;

[0030] Figure 2b is a flowchart of another network communication method based on a zero-trust system provided by some embodiments of the present invention;

[0031] Figure 2c is a flowchart of another network communication method based on a zero-trust system provided by some embodiments of the present invention;

[0032] Figure 3 is a flowchart of another network communication method based on a zero-trust system provided by some embodiments of the present invention;

[0033] Figure 4 is a flowchart of another network communication method based on a zero-trust system provided by some embodiments of the present invention;

[0034] Figure 5 It is a structural block diagram of a network communication device based on a zero-trust system provided by some embodiments of the present invention. DETAILED DESCRIPTION

[0035] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] At present, Hypertext Transfer Protocol (HTTP), as one of the basic protocols of the Internet, was originally designed without considering security issues. The data transmitted by the HTTP protocol is in plain text and is easily eavesdropped and tampered with, which brings security risks to network applications.

[0037] In order to solve the security problem of HTTP, Hypertext Transfer Protocol Secure (HTTPS) came into being. HTTPS adds SSL (Secure Socket Layer) / TLS (Transport Layer Security) protocol on the basis of HTTP to encrypt data transmission and improve the confidentiality and integrity of data. However, HTTPS itself does not contain the transmission mechanism of user identity information.

[0038] In related technologies, strict identity authentication and access control of visitors are achieved by binding user MSISDN (Mobile Station International Subscriber Directory Number, international standard telephone number) information with campus information, combining the header enhancement function of the UPF (User Plane Function) device, the secondary authentication of the security gateway module, the session authentication list management, and the anomaly detection mechanism for multi-device access.

[0039] In the embodiment of the present invention, dynamic network access authorization is achieved by performing identity recognition based on HTTP / HTTPS header enhancement in the zero-trust system. Through the application of the zero-trust model and header enhancement, the system no longer relies on the network location to determine the trustworthiness of the visitor, but performs strict identity authentication and authorization on each access request. This model minimizes the scope of trust and only grants necessary permissions, thereby greatly reducing security risks.

[0040] Through the embodiments of the present invention, it is possible to easily adapt to a variety of network environments, business scenarios and user authentication requirements, and support a wider range of application scenarios. In addition, through HTTP / HTTPS header enhancement technology, the new technology can use richer user information for identity identification, thereby providing more sophisticated access control strategies to meet the security requirements in different business scenarios. Moreover, through the introduction of the zero-trust architecture stealth mechanism, the access security between users and protected resources is further enhanced, and resource utilization is optimized, reducing unnecessary network traffic and computing resource consumption.

[0041] In the embodiments of the present invention, the core purpose is to provide a more secure, flexible and easy-to-manage network access control solution, which specifically includes the following aspects:

[0042] Enhanced security: Through the application of zero-trust model and header enhancement, the system no longer relies on network location to judge the trustworthiness of visitors, but performs strict identity authentication and authorization on each access request. This model reduces the scope of trust to a minimum and only grants necessary permissions, thereby greatly reducing security risks.

[0043] Improve flexibility: The system does not require users to install any software or plug-ins. Users can access network resources through standard HTTP / HTTPS protocols. This design not only simplifies the deployment and management process, but also enables the system to easily adapt to various complex network environments, including cross-platform, cross-device and cross-network situations.

[0044] Optimize user experience: Users do not need to care about the underlying authentication and authorization mechanisms, but only need to focus on the business itself. At the same time, the system can automatically handle complex authentication and authorization processes, reducing user waiting time and operational complexity, thereby improving user experience.

[0045] Simplified management: Through centralized zero-trust configuration and management, administrators can easily manage the entire network access control system. The system provides a wealth of configuration options and monitoring tools, allowing administrators to monitor network access in real time, adjust access policies, and respond to potential security threats.

[0046] Support dynamic authorization: The system can make dynamic authorization decisions based on HTTP / HTTPS header information and other contextual information (such as device status, network environment, etc.). This authorization mechanism based on real-time information enables the system to more accurately assess the credibility of visitors and grant appropriate permissions.

[0047] The present invention will be further described below in conjunction with the accompanying drawings:

[0048] Reference Figure 1, showing a step flow chart of a network communication method based on a zero-trust system provided by some embodiments of the present invention. As an emerging security architecture, the Zero Trust system assumes that no one inside or outside the network should be automatically trusted. No matter where the user is located, strict identity authentication and authorization are required to access network resources. It emphasizes continuous verification and dynamic authorization of all access subjects, and no longer relies on fixed network boundaries.

[0049] In some examples, the zero trust system includes three modules: zero trust policy controller, zero trust gateway, and header enhancement. The main functions of the modules are as follows:

[0050] ① Zero Trust Policy Controller: The head enhances the information control and collection function, collects user identity information, access network information, geographic location, etc., and sends the collected information to the zero trust gateway.

[0051] ②Zero Trust Gateway: Responsible for the Zero Trust Policy Controller to collect HTTP / HTTPS request headers for enhanced information verification, and allow access to the target business system (such as resource server) after verification.

[0052] ③Header enhancement: Insert one or more of the relevant information of the user device (such as user number, accessed operator network, accessed geographic location, etc.) into the HTTP / HTTPS request message header and pass it to the zero trust gateway so that zero trust can identify user information.

[0053] like Figure 2a , Figure 2b , Figure 2c , a network based on a zero-trust system includes the following network elements:

[0054] SDP-GATEWAY: Software Defined Perimeter (SDP) gateway is a key component in the SDP architecture. The main function of the SDP gateway is to serve as the execution point of access control, responsible for establishing a secure connection between the client and the protected resources, and ensuring that only authenticated and authorized users can access these resources.

[0055] SDP-CONTROLER: Software Defined Border Controller is the core component in the SDP architecture and is responsible for managing all authentication and access processes. It is often referred to as the "brain" of the solution, where access policies are defined and evaluated, and serves as a zero-trust policy decision point.

[0056] SC (Service Classifier): Located at the edge of the SRV6 SFC service chain network, it is the source node of the service chain path. SC can use different diversion methods to introduce service data into the SRV6 TE Policy tunnel for forwarding.

[0057] UE (User Equipment): Equipment used by end users, such as smartphones, tablet computers, etc.

[0058] AMF (Access and Mobility Management Function): responsible for performing registration, connection, reachability, mobility management and other functions, and providing a session management message transmission channel for UE and SMF.

[0059] SMF (Session Management Function): responsible for user session management, including tunnel maintenance, IP address allocation and management, UP function selection, policy implementation and QoS control.

[0060] PCRF / PCF (Policy and Charging Rules Function / Policy Control Function): responsible for managing and controlling network policies and charging.

[0061] (R)AN (Radio Access Network): Responsible for the transmission and reception of wireless signals and serves as a bridge between user equipment and the core network.

[0062] PDN (Public Data Network / Packet Data Network): A wide area network established by telecommunications operators that provides packet switching or circuit switching services.

[0063] eNB (Evolved Node B): eNB is a base station device in a 5G network, responsible for communicating with the UE and forwarding the user's traffic to the core network. In some cases, eNB can work with gNB (next generation base station), but currently only single eNB and single UE scenarios are generally supported.

[0064] UPF (User Plane Function): UPF is responsible for processing user plane data packets and ensuring that the data is correctly routed to the destination.

[0065] ISP (Internet Service Provider): An ISP provides Internet access services, ensuring that user devices can connect to the Internet and access the required resources. Although the specific role of the ISP is not directly mentioned in the evidence, it plays a vital role in the overall network architecture, ensuring that data can be transmitted between different networks.

[0066] In some examples, embodiments of the present invention require cooperation between GW and PCRF.

[0067] Among them, the main functions of PCRF / PCF and SDP-CONTROLER are: PCRF and SDP-CONTROLER merge and issue preset rules, and execute services that match the preset rules to trigger the header enhancement function. The main function of UPF / GW-U is: to perform content enhancement processing on the HTTP / HTTPS message header, add one or more information in the user information (such as APN, IMEI, etc.) to the HTTP / HTTPS message header and pass it to the zero-trust gateway. The main function of SDP-GATEWAY is: to identify the user identity information in the HTTP / HTTPS message header, and establish a zero-trust secure connection between users and resources based on dynamic identity access control

[0068] Specifically, the following steps may be included:

[0069] Step 101: Receive a request message sent by a user equipment.

[0070] In some examples, the request message may be a message based on the Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Secure (HTTPs). HTTP is a protocol for transmitting hypertext from a website server to a local browser. It allows users to access web pages and other resources over the Internet. HTTPS is a secure version of HTTP that adds an SSL / TLS encryption layer on top of HTTP to ensure the security and integrity of data during transmission.

[0071] In actual applications, the user equipment (UE) can send a request message to the UPF. The request message can be a request message for user authentication, a request message for user resource access, or other types of request messages.

[0072] In some examples, before the user device sends a request message to the UPF, a TCP connection can be established between the user device and the UPF, and communication can be performed through the TCP connection.

[0073] Step 102: Generate header enhancement information for the request message according to the relevant information of the user equipment, and use the header enhancement information to perform header enhancement processing on the request message.

[0074] Since a message based on the Hypertext Transfer Protocol (HTTP) or the Hypertext Transfer Protocol Secure (HTTPs) does not carry relevant information about the user device, the relevant information about the user device can be obtained, and then the relevant information about the user device is used to generate header enhancement information for the request message. After obtaining the header enhancement information, the header enhancement information can be used to perform header enhancement processing on the request message, so that the request message can carry relevant information about the user device.

[0075] In some examples, UPF identifies the protocol type of the message, parses the message after successful protocol identification, and performs policy matching based on the parsed message feature information (such as the message feature information may be the address port corresponding to the service requested to access). When the request message matches the header enhancement processing, the local predefined configuration and user-related information can be extracted, and the header enhancement information can be inserted into the request message header to implement header enhancement processing of the request message.

[0076] In some examples, because UPF adds header enhancement information to the message, it is also necessary to adjust certain field values ​​of the TCP layer and IP layer according to the protocol requirements, such as the length and check fields.

[0077] In some embodiments of the present invention, the relevant information of the user equipment includes any one or more of the following: user identity information, accessed network information, and geographic location information.

[0078] In some examples, the HTTP / HTTPS header enhancement information may include the following types of information: IMSI / SUPI (International mobile subscriber identity / Subscription permanent identifier, IMSI is a unique number used to identify mobile users in 2G / 3G / 4G networks, and SUPI is a unique number used to identify mobile users in 5G networks), MSISDN / GPSI (Mobile station international ISDN number / Generic public subscription identifier), RATTYPE (Radio access technology type), APN (Access point name, access point name, for 4G access, the APN is sent from GW-C to GW-U, which can be the APN requested by the user or the APN actually used by the user or the specified APN), IMEI / PEI (International mobile equipment identity / Permanent equipment identifier), SGWADDR (SGSN / SGW IP address, service gateway address), USRADDR (User IP address, user IP address), RATTYPES (Radio access technology type (string), radio access technology type), ULI (User location information, user location information), PGWADDR (GGSN / PGW IP address, gateway address), TIMESTAMP (UTC time, timestamp), USERDEF (User defined fields, user defined fields), etc.

[0079] In some examples, each header enhancement field name can be user-defined.

[0080] In some embodiments of the present invention, the using the header enhancement information to perform header enhancement processing on the request message includes: inserting the header enhancement information into the header of the request message.

[0081] In practical applications, after the header enhancement information is generated, the header enhancement information is encoded into an Extension field and inserted into the end of the header of the request message.

[0082] Table 1 below is the original request message, and Table 2 is the request message after header enhancement processing.

[0083] IP header TCP header Client Hello message header Original Extension

[0084] Table 1

[0085] IP header TCP header Client Hello message header Original Extension Insert Extension

[0086] Table 2

[0087] In some examples, the inserted Extension field can also be protected from fraud. When the request message before header enhancement processing contains the same bytes as the Extension field to be inserted, the request message is considered to be a fraudulent message, and an anti-fraud strategy can be implemented on the fraudulent message.

[0088] Step 103, sending the request message after header enhancement processing to the zero-trust system network element to verify the authority of the user device through the header enhancement information.

[0089] After the head enhancement processing, the request message after the head enhancement processing can be sent to the zero-trust system network element, and the zero-trust system network element can then obtain the head enhancement information from the request message after the head enhancement processing, and then perform authority verification on the user device based on the relevant information of the user device carried in the head enhancement information to complete the user verification process.

[0090] In some embodiments of the present invention, the request message is a request message for user authentication, the zero-trust system network element is a zero-trust controller, and the request message after header enhancement processing is sent to the zero-trust system network element to perform authority verification on the user device through the header enhancement information, including: sending the request message after header enhancement processing to the zero-trust controller to perform user identity authentication on the user device through the header enhancement information.

[0091] In some embodiments of the present invention, after sending the request message after header enhancement processing to the zero trust controller to perform user authentication on the user device through the header enhancement information, it also includes: receiving a response message returned for the request message after enhancement processing, and sending the response message to the user device to display the message content on the user device.

[0092] For request messages used for user authentication, after obtaining the request after header enhancement processing, the zero-trust controller can perform user identity authentication based on the header enhancement information itself, or forward it to a third-party authentication system to perform user identity authentication based on the header enhancement information.

[0093] After authentication, the user authorization policy can be queried to notify the zero-trust gateway to release user access control, and a response message can be returned to the UPF. After parsing the message and adjusting the sequence number, the UPF forwards it to the UE. The UE receives and displays the message content to the user.

[0094] In some embodiments of the present invention, the request message is a request message for user resource access, the zero-trust system network element is a zero-trust gateway, and the request message after header enhancement processing is sent to the zero-trust system network element to perform permission verification on the user device through the header enhancement information, including: sending the request message after header enhancement processing to the zero-trust gateway to perform resource access permission authentication on the user device through the header enhancement information, and accessing the resource server if the resource access permission authentication is passed.

[0095] For request messages for user resource access, after receiving the request message after header enhancement processing, the zero-trust gateway can allow or reject the user's resource access request based on the controller's policy and the matched header enhancement information, and forward the legitimate user requests that match the policy to the corresponding resource server for processing.

[0096] In an embodiment of the present invention, by receiving a request message sent by a user device, header enhancement information for the request message is generated according to relevant information of the user device, and the header enhancement information is used to perform header enhancement processing on the request message, and the request message after the header enhancement processing is sent to a zero-trust system network element to perform authority verification on the user device through the header enhancement information, thereby realizing authority verification based on the header enhancement information of the message in the zero-trust system, improving the security of the network, and thus meeting security requirements.

[0097] Under the architecture of the zero-trust system, the method of using head enhancement to achieve identity recognition and dynamic network access authorization has shown many significant advantages and positive effects, as follows:

[0098] First, it greatly improves the accuracy of identity authentication. By adding additional user information to the HTTP / HTTPS request header, such as the user number, the carrier network accessed, the geographic location accessed, etc., the system can more comprehensively understand the user's identity and perform more accurate identity authentication based on this. This fine-grained identity recognition method effectively reduces the security risks caused by identity fraud or forgery.

[0099] Secondly, HTTP / HTTPS header enhancements have also significantly increased the flexibility of dynamic access control. Traditional access control policies are often based on static permission allocation, while this method can dynamically adjust access permissions based on real-time user information and behavior. This means that the system can more intelligently determine the user's access intent and grant appropriate permissions accordingly, which not only ensures security but also improves user experience.

[0100] Furthermore, the clientless design greatly simplifies the deployment and management of the client. Users do not need to install additional software or plug-ins, and can access network resources through standard HTTP / HTTPS protocols. This not only reduces the complexity of the system, but also reduces the security risks caused by client software vulnerabilities or user misoperation.

[0101] In addition, HTTP / HTTPS header enhancement can also help improve user experience. Since there is no need to install additional software or plug-ins, users can access network resources more conveniently, reducing waiting time and operational complexity. At the same time, since the system can more accurately identify user identities and provide personalized services accordingly, users can also get a more intimate and satisfactory experience.

[0102] Finally, from the perspective of business continuity, HTTP / HTTPS header enhancement also helps maintain the stable operation of services. Through precise identity recognition and dynamic network access authorization, the system can ensure that only verified entities can access network resources, thus avoiding service interruptions or data leaks caused by unauthorized access.

[0103] The following combination Figure 2b and Figure 2c The present invention is exemplified as follows:

[0104] like Figure 2b The network includes UE, eNB, SMF, UPF, and ISP, and specifically includes the following processes:

[0105] 1. UE establishes a TCP link with ISP;

[0106] 2. The UE sends an HTTPS Client Hello Request (seq_0, len_0) (i.e., a request message for user authentication) to the UPF. After receiving the message, the UPF performs header enhancement by len_1.

[0107] 3. UPF sends HTTPS Client Hello Request (seq_0, len_0+len_1) to the ISP (i.e., the request message after header enhancement processing);

[0108] 4. ISP returns HTTPS Response (seq_0, len_0+len1) (i.e. response message) to UPF, and UPF adjusts the sequence number by len_1;

[0109] 5. UPF sends HTTPS Response (seq_0, len_0) (i.e. response message) to UE.

[0110] like Figure 2c The network includes UE, UPF, SDP CONTREOLER, SDP GATEWAY, PCRF, and PCF, which specifically include two processes: user authentication and user resource access:

[0111] The user authentication process is as follows:

[0112] 1. The user goes online and establishes a TCP connection. When the TCP connection establishment message reaches UPF, UPF allows it to pass.

[0113] 2. The UE initiates an HTTP / HTTPS service, and the HTTP / HTTPS Client Hello Request message (i.e., the request message used for user authentication) sent by the UE arrives at the UPF. The UPF identifies the protocol type of the message, parses the message after successful protocol identification, matches the policy based on the parsed message feature information, and performs billing or execution based on the matching results. When it is determined that the message matches the HTTP / HTTPS header enhancement action and HTTP / HTTPS header enhancement processing is required, the local predefined configuration and user-related information are extracted, and the header enhancement information is inserted into the HTTP / HTTPS Client Hello Request message header. Since the UPF adds data information to the message, it is also necessary to adjust certain field values ​​of the TCP layer and the IP layer in accordance with the protocol specifications, such as the length and check fields.

[0114] 3. UPF sends the HTTP / HTTPS Client Hello Request message with header enhancement information added to the zero trust controller.

[0115] 4. After receiving the HTTP / HTTPS Client Hello Request message, the zero-trust controller obtains the current user's information (i.e., the relevant information of the user device carried in the header enhancement information) to identify the user's identity (or forwards it to a third-party authentication system to identify the user's identity), constructs and returns a personalized response message to the UPF user.

[0116] 5. After authentication is passed, the user authorization policy is queried, and the gateway is notified to release the user access control. The UPF parses the received HTTP / HTTPS Response message (i.e., the response message) and adjusts the sequence number before forwarding it to the UE. The UE receives and displays the content of the HTTP / HTTPS Response message to the user. The UE is not aware of the UPF's enhanced processing of the HTTP / HTTPS header of the service message.

[0117] The process of user resource access is as follows:

[0118] 6. The user initiates a resource access request. After the message reaches UPF, UPF allows it to pass.

[0119] 7. When UPF determines that the message matches the HTTP / HTTPS header enhancement action and needs to perform HTTP / HTTPS header enhancement processing, it extracts the local predefined configuration and user-related information, and inserts the header enhancement information into the HTTP / HTTPS Client Hello Request message (that is, the request message used for user resource access) header.

[0120] 8. UPF routes user requests to the zero trust gateway.

[0121] 9. The zero-trust gateway allows or rejects the user's resource access request based on the controller's policy and the matched user header enhanced identity information.

[0122] 10. Forward legitimate user requests that match the policy to the corresponding resource server for processing.

[0123] Reference Figure 3 , shows a flowchart of another network communication method based on a zero-trust system provided by some embodiments of the present invention, which may specifically include the following steps:

[0124] Step 301: Receive a request message sent by a user device; wherein the request message is a request message for user authentication.

[0125] Step 302: Generate header enhancement information for the request message according to the relevant information of the user equipment, and use the header enhancement information to perform header enhancement processing on the request message.

[0126] Step 303: Send the request message after the header enhancement processing to the zero trust controller to perform user identity authentication on the user device through the header enhancement information.

[0127] Step 304: Receive a response message returned for the request message after the enhanced processing, and send the response message to the user equipment so that the message content is displayed on the user equipment.

[0128] Reference Figure 4 , shows a flowchart of another network communication method based on a zero-trust system provided by some embodiments of the present invention, which may specifically include the following steps:

[0129] Step 401: Receive a request message sent by a user device; wherein the request message is a request message for user resource access.

[0130] Step 402: Generate header enhancement information for the request message according to the relevant information of the user equipment, and use the header enhancement information to perform header enhancement processing on the request message.

[0131] Step 403, sending the request message after header enhancement processing to the zero trust gateway, so as to authenticate the resource access permission of the user device through the header enhancement information, and access the resource server if the resource access permission authentication is passed.

[0132] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0133] Reference Figure 5 , shows a schematic diagram of the structure of a network communication device based on a zero-trust system provided by some embodiments of the present invention, which may specifically include the following modules:

[0134] The request message receiving module 501 is used to receive the request message sent by the user equipment;

[0135] A header enhancement module 502, configured to generate header enhancement information for the request message according to relevant information of the user equipment, and perform header enhancement processing on the request message using the header enhancement information;

[0136] The authority verification module 503 is used to send the request message after the header enhancement processing to the zero-trust system network element, so as to verify the authority of the user device through the header enhancement information.

[0137] In some embodiments of the present invention, the step of using the header enhancement information to perform header enhancement processing on the request message includes:

[0138] The header enhancement information is inserted into the header of the request message.

[0139] In some embodiments of the present invention, the request message is a request message for user authentication, the zero-trust system network element is a zero-trust controller, and the request message after header enhancement processing is sent to the zero-trust system network element to perform permission verification on the user device through the header enhancement information, including:

[0140] The request message after header enhancement processing is sent to the zero trust controller to perform user identity authentication on the user device through the header enhancement information.

[0141] In some embodiments of the present invention, after the request message after the header enhancement processing is sent to the zero trust controller to perform user identity authentication on the user device through the header enhancement information, the method further includes:

[0142] A response message returned in response to the request message after the enhancement processing is received, and the response message is sent to the user equipment so that the message content is displayed on the user equipment.

[0143] In some embodiments of the present invention, the request message is a request message for user resource access, the zero-trust system network element is a zero-trust gateway, and the request message after header enhancement processing is sent to the zero-trust system network element to perform permission verification on the user device through the header enhancement information, including:

[0144] The request message after header enhancement processing is sent to the zero-trust gateway to authenticate the resource access permission of the user device through the header enhancement information, and access the resource server if the resource access permission authentication is passed.

[0145] In some embodiments of the present invention, the relevant information of the user equipment includes any one or more of the following: user identity information, accessed network information, and geographic location information.

[0146] In some embodiments of the present invention, the request message is a message based on Hypertext Transfer Protocol or Hypertext Transfer Protocol Secure.

[0147] Some embodiments of the present invention further provide an electronic device, comprising a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the above method is implemented when the computer program is executed by the processor.

[0148] Some embodiments of the present invention further provide a computer-readable storage medium, on which a computer program is stored, and the computer program implements the above method when executed by a processor.

[0149] Some embodiments of the present invention further provide a computer program product, including a computer program, which implements the above method when executed by a processor.

[0150] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0151] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0152] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0153] Those skilled in the art will appreciate that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0154] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0155] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0156] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0157] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0158] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the above elements.

[0159] The network communication method, device, equipment and medium based on the zero-trust system are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A network communication method based on a zero-trust system, characterized in that: The method comprises: Receiving a request message sent by a user device; Generate header enhancement information for the request message according to the relevant information of the user equipment, and perform header enhancement processing on the request message using the header enhancement information; The request message after header enhancement processing is sent to the zero-trust system network element to verify the authority of the user device through the header enhancement information.

2. The method according to claim 1, characterized in that The adopting the header enhancement information to perform header enhancement processing on the request message includes: The header enhancement information is inserted into the header of the request message.

3. The method according to claim 1 or 2, characterized in that: The request message is a request message for user authentication, the zero-trust system network element is a zero-trust controller, and the request message after header enhancement processing is sent to the zero-trust system network element to perform permission verification on the user device through the header enhancement information, including: The request message after header enhancement processing is sent to the zero trust controller to perform user identity authentication on the user device through the header enhancement information.

4. The method according to claim 3, characterized in that After the request message after the header enhancement processing is sent to the zero trust controller to perform user identity authentication on the user device through the header enhancement information, it also includes: A response message returned in response to the enhanced request message is received, and the response message is sent to the user equipment so that the message content is displayed on the user equipment.

5. The method according to claim 1 or 2, characterized in that: The request message is a request message for user resource access, the zero-trust system network element is a zero-trust gateway, and the request message after header enhancement processing is sent to the zero-trust system network element to perform permission verification on the user device through the header enhancement information, including: The request message after header enhancement processing is sent to the zero-trust gateway to authenticate the resource access permission of the user device through the header enhancement information, and access the resource server if the resource access permission authentication is passed.

6. The method according to claim 1, characterized in that The relevant information of the user equipment includes any one or more of the following: user identity information, accessed network information, and geographic location information.

7. The method according to claim 1, characterized in that The request message is a message based on Hypertext Transfer Protocol or Hypertext Transfer Protocol Security.

8. A network communication device based on a zero-trust system, characterized in that: The device comprises: A request message receiving module, used to receive a request message sent by a user device; A header enhancement module, configured to generate header enhancement information for the request message according to relevant information of the user equipment, and perform header enhancement processing on the request message using the header enhancement information; The authority verification module is used to send the request message after header enhancement processing to the zero-trust system network element, so as to verify the authority of the user device through the header enhancement information.

9. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the method according to any one of claims 1 to 7 when executed by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images