Data encryption transmission method based on zero-trust architecture

Abstract

The invention belongs to the technical field of information security, and relates to a data encryption transmission method based on a zero-trust architecture, which comprises the following steps: verifying the identity of a user based on an RSA encryption algorithm; the identity of a user is tightly bound with authorized terminal equipment by combining a hardware fingerprint technology, and a hardware fingerprint, an operation environment parameter and a certificate serial number are combined to generate a dynamic identity token; a strategy engine is introduced to analyze network environment data, a data sensitivity level and a risk assessment level of computer password; dynamically selecting a proper encryption algorithm by combining a low-risk score threshold and a high-risk score threshold; establishing an independent encryption tunnel based on a software definition boundary, and limiting a data transmission path by following a minimum permission principle; and each data packet is subjected to dynamic identity token verification, and if an abnormal behavior is detected, a session is terminated and a secondary authentication process is started. The problem that a traditional encryption method is difficult to adapt to continuously changing network environments and data sensitivity levels can be solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security and relates to a data encryption transmission method based on a zero-trust architecture. Background Art

[0002] In traditional communication encryption methods, data security often relies on the protection of network boundaries, that is, assuming that the inside of the network is trustworthy, while the outside is considered untrustworthy. However, with the increasing complexity of the network environment and the continuous evolution of attack methods, this trust model based on network boundaries has become difficult to ensure data security. Once attackers break through the network boundaries, they can move freely in the internal network and steal or tamper with sensitive data.

[0003] Traditional encryption methods often use static encryption strategies and fixed key management methods, which makes them difficult to adapt to the ever-changing network environment and data sensitivity level. Attackers can exploit these static characteristics to obtain sensitive data by cracking encryption algorithms or stealing keys. Traditional encryption methods also lack effective binding of user identities and terminal devices, which allows attackers to launch attacks by forging user identities or using infected terminal devices.

[0004] In response to the above problems, traditional encryption methods are difficult to adapt to the ever-changing network environment and data sensitivity level. Attackers can exploit these static characteristics to obtain sensitive data by cracking encryption algorithms or stealing keys. Summary of the invention

[0005] In order to solve the above problems, the present invention provides a data encryption transmission method based on a zero-trust architecture.

[0006] The data encryption transmission method based on the zero trust architecture includes the following steps:

[0007] S1. Verify the user's identity based on the RSA encryption algorithm;

[0008] S2. Combine the hardware fingerprint technology to closely bind the user's identity to the authorized terminal device, collect the operating environment parameters of the authorized terminal device, combine the hardware fingerprint, operating environment parameters, and certificate serial number to generate a dynamic identity token, which serves as a valid proof of the user's identity;

[0009] S3, introduce a policy engine to analyze network environment data, data sensitivity level, and calculate confidential risk assessment level;

[0010] S4. Based on the analysis results of the policy engine, the appropriate encryption algorithm is dynamically selected in combination with the low risk score threshold and the high risk score threshold, and the key life cycle is determined according to the actual situation to ensure the confidentiality and integrity of the data;

[0011] S5. Establish an independent encrypted tunnel based on software-defined boundaries and follow the principle of least privilege to limit the data transmission path;

[0012] S6. Verify the dynamic identity token for each data packet. If abnormal behavior is detected, the session will be terminated and the secondary authentication process will be started.

[0013] A further solution of the present invention, step S1, comprises the following steps:

[0014] The pre-set client collects the user's identity information, and the client calls the TPM2.0 security chip to generate an RSA-3072 key pair: public key PK user 、Private key SK user , public key PK user Upload to the Zero Trust Control Center, private key SK user Stored in TPM2.0 security chip;

[0015] The client initiates a user authentication request to the zero trust control center, and the zero trust control center generates a random number challenge code N once , using the public key PK user After encryption, it is sent to the client, and the client calls the private key SK of the TPM2.0 security chip user Decrypt the challenge code, calculate the response value and send it back to the zero trust control center;

[0016] The Zero Trust Control Center verifies the deviation between the response value and the timestamp. If the deviation is less than or equal to 3 seconds, the Zero Trust Control Center will issue a short-term identity certificate to the user. The validity period of the short-term identity certificate is less than or equal to 5 minutes.

[0017] A further solution of the present invention, step S2, comprises the following steps:

[0018] Collect the hardware features of the authorized terminal device, including the CPU microcode version, firmware hash value, and hard disk serial number, use the KMAC256 algorithm to generate the hardware fingerprint, tightly bind the user's identity to the authorized terminal device, and calculate the hardware fingerprint FP to meet the following formula:

[0019] FP = KMAC256 (H cpu ||U board ||S disk )

[0020] Among them, H cpu Indicates the CPU microcode version, U board Indicates the firmware hash value, S disk Indicates the hard disk serial number;

[0021] Monitor the operating environment parameters of the authorized terminal device, including geographic fences, network access points of the authorized terminal device, and operating system integrity check status; combine the hardware fingerprint FP, the serial number CertSN of the short-term identity certificate, and the operating environment parameters Env of the authorized terminal device with a hash function to generate a dynamic identity token Token.

[0022] A further solution of the present invention, step S3, comprises the following steps:

[0023] Collect network environment data, including network latency, number of open port anomalies, and threat intelligence matching degree; classify the sensitivity level of data according to GB / T35273 standard, including public L1, internal L2, confidential L3, and top secret L4;

[0024] Computer-generated risk assessment formulas,

[0025]

[0026] Where L is the network delay parameter; L Max is the maximum network delay parameter; P is the number of open port anomalies; T is the threat intelligence matching degree; S is the sensitivity level of the data; W1, W2, W3, and W4 are weight coefficients, which are allocated based on expert experience.

[0027] A further solution of the present invention, step S4, comprises the following steps:

[0028] Combine historical data and expert experience to set low risk scoring thresholds and high risk scoring thresholds, and dynamically select the appropriate encryption algorithm based on the analysis results of the policy engine and the combination of the low risk scoring threshold and the high risk scoring threshold;

[0029] Among them, encryption algorithms include AES-128-GCM encryption algorithm, AES-256-GCM encryption algorithm, and ChaCha20-Poly1305 encryption algorithm;

[0030] The key life cycle is dynamically determined based on the actual situation, including: the AES-128-GCM encryption algorithm requires key rotation every 24 hours, the AES-256-GCM encryption algorithm requires key rotation every 12 hours, and the ChaCha20-Poly1305 encryption algorithm requires key rotation every 1 hour.

[0031] A further solution of the present invention, based on the analysis result of the policy engine, dynamically selects a suitable encryption algorithm in combination with the low risk score threshold and the high risk score threshold, including the following steps:

[0032] Set the low risk score threshold to R1 and the high risk score threshold to R2, satisfying,

[0033] If R < R1, that is, the risk assessment level is low risk, select the AES-128-GCM encryption algorithm and rotate the key every 24 hours;

[0034] If R1 ≤ R < R2, that is, the risk assessment level is medium risk, select the AES-256-GCM encryption algorithm and rotate the key every 12 hours;

[0035] If R ≥ R2, that is, the risk assessment level is high risk, select the ChaCha20-Poly1305 encryption algorithm and rotate the key every 1 hour.

[0036] In a further aspect of the present invention, step S5 includes the following steps:

[0037] Deploy a controller architecture based on a cloud-native SDP controller cluster. The client submits a dynamic identity token Token and a session intent statement. The controller verifies the dynamic identity token Token. If the verification by the controller passes, the controller assigns short-lived temporary communication credentials to both parties of the communication, establishes a double-layer tunnel between the two parties of the communication, and ensures that the encrypted data of the two parties of the communication can only flow between authorized network nodes;

[0038] Among them, the lifecycle t of the temporary communication credential satisfies t ≤ 10 min.

[0039] In a further aspect of the present invention, the double-layer tunnel includes an inner application layer tunnel and an outer transport layer tunnel;

[0040] For the inner application layer tunnel, based on TLS1.3, use the key exchange algorithm of elliptic curve X25519 for key exchange, and adopt short-lived temporary communication credentials; the session intent statement is first encrypted through TLS1.3 to generate TLS records;

[0041] For the outer transport layer tunnel, build an efficient encrypted communication pipeline based on the QUIC protocol. Utilize the built-in header protection feature of the QUIC protocol to selectively encrypt and encode sensitive metadata in the handshake layer packet header, that is, the obfuscated packet header, to eliminate recognizable network features and resist traffic fingerprint analysis attacks; strict two-way mTLS verification is implemented in the QUIC handshake phase, and the short-term identity certificate of the client is bound to the dynamic identity token Token;

[0042] The TLS records of the inner application layer tunnel are segmented through the QUIC protocol, attach the obfuscated packet header and encrypt the entire QUIC frame, and restrict the data transmission path following the principle of least privilege.

[0043] In a further aspect of the present invention, step S6 includes the following steps:

[0044] Quantify the anomaly degree of traffic deviation from the baseline based on Z-Score, satisfying the following formula,

[0045]

[0046] Among them, Z represents the degree of deviation of the current traffic rate from the historical baseline. The larger the absolute value, the higher the probability of abnormality. X represents the current traffic rate, which is calculated by the network card throughput. μ represents the historical baseline mean, which is the average traffic value over a period of time. σ represents the traffic standard deviation, which reflects the stability of the baseline data.

[0047] A further solution of the present invention, step S6, further comprises the following steps:

[0048] Set the threshold of traffic mutation to Z'. If |Z|≤Z', the traffic rate is normal. If |Z|>Z', the traffic rate is abnormal and the fuse strategy is implemented, and the secondary authentication process is started.

[0049] Among them, the fuse strategy forces the closure of the encrypted tunnel and immediately terminates the session, and adds the MAC address / IP of the violating device to a temporary blacklist;

[0050] The secondary authentication process requires users to complete biometric verification or manual approval by the security team before access can be restored.

[0051] In summary, the present invention includes the following beneficial technical effects:

[0052] 1. Combining RSA encryption algorithm, hardware fingerprint technology and dynamic identity token, strict verification of user identity and close binding with authorized terminal devices are achieved; this multi-level identity authentication mechanism significantly enhances the security of data transmission and reduces the risk of illegal access or tampering; the use of dynamic identity tokens ensures that each data transmission is accompanied by identity authentication, ensuring the integrity and authenticity of the data;

[0053] 2. A policy engine is introduced to analyze network environment data and data sensitivity levels, thereby calculating the risk assessment level of confidentiality. Based on the risk assessment results, the system can dynamically select the appropriate encryption algorithm and key life cycle. This flexibility enables data transmission to be adaptively adjusted according to the security risk level in different scenarios, which not only ensures the demand for high-security data transmission, but also avoids unnecessary resource consumption;

[0054] 3. Establish an independent encrypted tunnel based on software-defined boundaries and follow the principle of least privilege to limit the data transmission path. This method effectively isolates the data transmission environment of the communicating parties and prevents the risk of data leakage. The double-layer tunnel design further enhances the security of communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1A flow chart of a data encryption transmission method based on a zero-trust architecture is disclosed.

[0056] Figure 2 A framework diagram of a data encryption transmission system based on a zero-trust architecture is disclosed. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0058] The following is combined with Figure 1-2 The preferred embodiments of the present invention are described in detail.

[0059] See attached Figure 1 The present invention proposes a data encryption transmission method based on a zero-trust architecture, comprising the following steps:

[0060] S1. Verify the user's identity based on the RSA encryption algorithm;

[0061] S2. Combine the hardware fingerprint technology to closely bind the user's identity to the authorized terminal device, collect the operating environment parameters of the authorized terminal device, combine the hardware fingerprint, operating environment parameters, and certificate serial number to generate a dynamic identity token, which serves as a valid proof of the user's identity;

[0062] S3, introduce a policy engine to analyze network environment data, data sensitivity level, and calculate confidential risk assessment level;

[0063] S4. Based on the analysis results of the policy engine, the appropriate encryption algorithm is dynamically selected in combination with the low risk score threshold and the high risk score threshold, and the key life cycle is determined according to the actual situation to ensure the confidentiality and integrity of the data;

[0064] S5. Establish an independent encrypted tunnel based on software-defined boundaries and follow the principle of least privilege to limit the data transmission path;

[0065] S6. Verify the dynamic identity token for each data packet. If abnormal behavior is detected, the session will be terminated and the secondary authentication process will be started.

[0066] In one embodiment of the present invention, step S1 includes the following steps:

[0067] The pre-set client collects the user's identity information, and the client calls the TPM2.0 security chip to generate an RSA-3072 key pair: public key PKuser 、Private key SK user , public key PK user Upload to the Zero Trust Control Center, private key SK user Stored in TPM2.0 security chip;

[0068] The client initiates a user authentication request to the zero trust control center, and the zero trust control center generates a random number challenge code N once (128bit), and then use the public key PK user After encryption, it is sent to the client, and the client calls the private key SK of the TPM2.0 security chip user Decrypt the challenge code and then calculate the response value Sign(N once ||Timestamp,SK user ) and transmit it back to the zero trust control center;

[0069] Zero Trust Control Center verifies the response value Sign(N once ||Timestamp,SK user ) and the timestamp. If the deviation is less than or equal to 3 seconds, the Zero Trust Control Center will issue a short-term identity certificate to the user. The validity period of the short-term identity certificate is less than or equal to 5 minutes.

[0070] In one embodiment of the present invention, step S2 comprises the following steps:

[0071] Collect the hardware features of the authorized terminal device, including the CPU microcode version, firmware hash value, and hard disk serial number, use the KMAC256 algorithm to generate the hardware fingerprint, tightly bind the user's identity to the authorized terminal device, and calculate the hardware fingerprint FP to meet the following formula:

[0072] FP = KMAC256 (H cpu ||U board ||S disk )

[0073] Among them, H cpu Indicates the CPU microcode version, U board Indicates the firmware hash value, S disk Indicates the hard disk serial number;

[0074] Monitor the operating environment parameters of the authorized terminal device, including the geographic fence, the network access point of the authorized terminal device, and the integrity check status of the operating system; combine the hardware fingerprint FP, the serial number CertSN of the short-term identity certificate, and the operating environment parameter Env of the authorized terminal device with a hash function to generate a dynamic identity token Token=Sign(FP||Env||CertSN), which serves as a valid proof of the user's identity;

[0075] Dynamic identity tokens are time-limited and will expire after a period of time, requiring users to log in again or perform secondary verification to obtain a new token.

[0076] For example, when a user logs in to the internal system of an authorized terminal device, he needs to submit a dynamic identity token. When the zero trust control center verifies that the dynamic identity token is valid, the user is allowed to access the internal system of the authorized terminal device.

[0077] If a user logs in to another authorized terminal device through a dynamic identity token, due to the differences in the operating environment parameters and hardware fingerprints of the authorized terminal device, the Zero Trust Control Center cannot verify the validity of the dynamic identity token and thus rejects the user's access request.

[0078] In one embodiment of the present invention, step S3 includes the following steps:

[0079] Collect network environment data, including network latency, number of abnormal open ports, and threat intelligence matching degree; classify the sensitivity level of data according to GB / T35273 standard, including public L1 (data sensitivity level 1), internal L2 (data sensitivity level 2), confidential L3 (data sensitivity level 3), and top secret L4 (data sensitivity level 4);

[0080] The risk assessment formula for computing confidentiality is:

[0081]

[0082] Where L is the network delay parameter; L Max is the maximum network delay parameter; P is the number of open port anomalies; T is the threat intelligence matching degree; S is the sensitivity level of the data; W1, W2, W3, and W4 are weight coefficients, which are allocated based on expert experience.

[0083] For example, the current delay value obtained through ICMP speed measurement is 85ms, and the set maximum network delay parameter is 100ms; compared with the baseline, two unauthorized ports are added, namely the database port and the debugging port; the threat intelligence system detects that the communication mode matching degree with the Mirai botnet C2 server is T=0.7; the sensitivity level of the data is confidential L3, that is, S=3;

[0084] According to expert experience, W1 = 0.2, W2 = 0.3, W3 = 0.3, W4 = 0.2;

[0085] Substituting into the confidential risk assessment formula, we get:

[0086]

[0087] In one embodiment of the present invention, step S4 includes the following steps:

[0088] Based on the data of historical records and the judgment of expert experience, set the low-risk score threshold and the high-risk score threshold, and dynamically select an appropriate encryption algorithm according to the analysis result of the policy engine and in combination with the low-risk score threshold and the high-risk score threshold;

[0089] Among them, the encryption algorithms include AES-128-GCM encryption algorithm, AES-256-GCM encryption algorithm, and ChaCha20-Poly1305 encryption algorithm;

[0090] Dynamically determine the key life cycle according to the actual situation, including: the AES-128-GCM encryption algorithm needs to rotate the key every 24 hours, the AES-256-GCM encryption algorithm needs to rotate the key every 12 hours, and the ChaCha20-Poly1305 encryption algorithm needs to rotate the key every 1 hour.

[0091] In one embodiment of the present invention, dynamically select an appropriate encryption algorithm according to the analysis result of the policy engine and in combination with the low-risk score threshold and the high-risk score threshold, including the following steps:

[0092] Set the low-risk score threshold as R1 and the high-risk score threshold as R2, satisfying:

[0093] If R < R1, that is, the risk assessment level is low risk, select the AES-128-GCM encryption algorithm and rotate the key every 24 hours;

[0094] If R1 ≤ R < R2, that is, the risk assessment level is medium risk, select the AES-256-GCM encryption algorithm and rotate the key every 12 hours;

[0095] If R ≥ R2, that is, the risk assessment level is high risk, select the ChaCha20-Poly1305 encryption algorithm and rotate the key every 1 hour.

[0096] Exemplarily, assume that the low-risk score threshold R1 = 1.5 and the high-risk score threshold R2 = 3;

[0097] Since 1.5 ≤ R = 1.58 < 3, it belongs to medium risk, select the AES-256-GCM encryption algorithm and rotate the key every 12 hours.

[0098] In one embodiment of the present invention, step S5 includes the following steps:

[0099] The controller architecture is deployed based on the cloud-native SDP controller cluster. The client submits a dynamic identity token Token and a session intent statement. The controller verifies the dynamic identity token Token = Sign(FP||Env||CertSN). If the controller verifies successfully, the controller allocates a short-life temporary communication credential to the communicating parties, and establishes a double-layer tunnel between the communicating parties to ensure that the encrypted data of the communicating parties can only flow between authorized network nodes.

[0100] Among them, the life cycle of temporary communication credentials is t≤10min;

[0101] Double-layer tunnel, including inner application layer tunnel and outer transport layer tunnel;

[0102] The inner application layer tunnel is based on TLS1.3 and uses the elliptic curve X25519 key exchange algorithm for key exchange and a short-lived temporary communication credential. The session intent statement is first encrypted through TLS1.3 to generate a TLS record.

[0103] The outer transport layer tunnel builds an efficient encrypted communication pipeline based on the QUIC protocol. It uses the built-in header protection feature of the QUIC protocol to selectively encrypt and encode sensitive metadata in the handshake layer packet header, i.e., an obfuscated packet header, eliminating identifiable network features and resisting traffic fingerprint analysis attacks. Strict two-way mTLS verification is implemented in the QUIC handshake phase, and the client's short-term identity certificate is bound to the dynamic identity token Token.

[0104] The TLS record of the inner application layer tunnel is segmented through the QUIC protocol, an obfuscated header is attached and the entire QUIC frame is encrypted to block access by counterfeit devices, thereby limiting the data transmission path in accordance with the principle of least privilege.

[0105] In one embodiment of the present invention, step S6 comprises the following steps:

[0106] Based on the Z-Score, the abnormal degree of traffic deviation from the baseline is quantified, satisfying the following formula:

[0107]

[0108] Among them, Z represents the degree of deviation of the current traffic rate from the historical baseline. The larger the absolute value, the higher the probability of abnormality. X represents the current traffic rate, which is calculated by the network card throughput. μ represents the historical baseline mean, which is the average traffic value over a period of time. σ represents the traffic standard deviation, which reflects the stability of the baseline data.

[0109] For example, the historical base mean μ of a server is 50MB / S, and the historical baseline standard deviation σ is 10MB / S;

[0110] When X = 60MB / S,

[0111] When X = 90MB / S,

[0112] Set the threshold of traffic mutation to Z'. If |Z|≤Z', the traffic rate is normal. If |Z|>Z', the traffic rate is abnormal and the fuse strategy is implemented, and the secondary authentication process is started.

[0113] Among them, the fuse strategy forces the closure of the encrypted tunnel and immediately terminates the session, and adds the MAC address / IP of the violating device to a temporary blacklist;

[0114] The secondary authentication process requires users to complete biometric verification or manual approval by the security team before access can be restored.

[0115] For example, assuming that the threshold of traffic mutation is Z ， =3, it can be judged that: when X = 60MB / S, the traffic rate is normal; when X = 90MB / S, the traffic rate is abnormal and the fuse strategy is implemented;

[0116] There are two application scenarios for |Z2|>Z'=3:

[0117] If Z2>3 is determined as a traffic peak attack, the fuse strategy is implemented and the secondary authentication process is started;

[0118] If Z2<-3 is determined as hidden data leakage, the connection will be blocked and the account will be frozen.

[0119] See attached Figure 2 , proposed a data encryption transmission system based on zero trust architecture, including user identity verification module, dynamic identity token generation module, risk assessment level calculation module, encryption algorithm selection module, independent encryption tunnel establishment module, and dynamic identity token verification module;

[0120] User identity verification module, based on RSA encryption algorithm, is used to verify the user's identity;

[0121] The dynamic identity token generation module combines the hardware fingerprint technology to closely bind the user's identity to the authorized terminal device, collects the operating environment parameters of the authorized terminal device, and combines the hardware fingerprint, operating environment parameters, and certificate serial number to generate a dynamic identity token;

[0122] The risk assessment level calculation module introduces a policy engine to analyze network environment data and data sensitivity levels to calculate confidential risk assessment levels;

[0123] The encryption algorithm selection module dynamically selects the appropriate encryption algorithm based on the analysis results of the policy engine and the low risk score threshold and high risk score threshold, and determines the key life cycle according to the actual situation;

[0124] Independent encrypted tunnel establishment module, used to establish an independent encrypted tunnel and restrict the data transmission path in accordance with the principle of least privilege;

[0125] The dynamic identity token verification module verifies the dynamic identity token for each data packet. If abnormal behavior is detected, the session will be terminated and the secondary authentication process will be started.

[0126] The modules described above may be implemented in whole or in part through software, hardware, or a combination thereof, supporting processors embedded in or independent of a computer device in hardware form, and also supporting memories stored in a computer device in software form, so that the processor can call and execute operations corresponding to the modules described above.

[0127] It should be noted that the user information (including but not limited to user device information and personal information, etc.) and data (including but not limited to data used for analysis, stored data and displayed data, etc.) involved in the present invention are all information and data authorized by the user or fully authorized by all parties, and the processing of relevant data needs to comply with relevant laws, regulations and standards.

[0128] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention is described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A data encryption transmission method based on a zero-trust architecture, characterized in that: The following steps are involved: S1. Verify the user's identity based on the RSA encryption algorithm; S2. Combine the hardware fingerprint technology to closely bind the user's identity to the authorized terminal device, collect the operating environment parameters of the authorized terminal device, combine the hardware fingerprint, operating environment parameters, and certificate serial number to generate a dynamic identity token, which serves as a valid proof of the user's identity; S3, introduce a policy engine to analyze network environment data, data sensitivity level, and calculate confidential risk assessment level; S4. Based on the analysis results of the policy engine, the appropriate encryption algorithm is dynamically selected in combination with the low risk score threshold and the high risk score threshold, and the key life cycle is determined according to the actual situation to ensure the confidentiality and integrity of the data; S5. Establish an independent encrypted tunnel based on software-defined boundaries and follow the principle of least privilege to limit the data transmission path; S6. Verify the dynamic identity token for each data packet. If abnormal behavior is detected, the session will be terminated and the secondary authentication process will be started.

2. The data encryption transmission method based on zero trust architecture according to claim 1 is characterized in that: Step S1 includes the following steps: The pre-set client collects the user's identity information, and the client calls the TPM2.0 security chip to generate an RSA-3072 key pair: public key PK user 、Private key SK user , public key PK user Upload to the Zero Trust Control Center, private key SK user Stored in TPM2.0 security chip; The client initiates a user authentication request to the zero trust control center, and the zero trust control center generates a random number challenge code N once , using the public key PK user After encryption, it is sent to the client, and the client calls the private key SK of the TPM2.0 security chip user Decrypt the challenge code, calculate the response value and send it back to the zero trust control center; The Zero Trust Control Center verifies the deviation between the response value and the timestamp. If the deviation is less than or equal to 3 seconds, the Zero Trust Control Center will issue a short-term identity certificate to the user. The validity period of the short-term identity certificate is less than or equal to 5 minutes.

3. The data encryption transmission method based on zero trust architecture according to claim 1 is characterized in that: Step S2 includes the following steps: Collect the hardware features of the authorized terminal device, including the CPU microcode version, firmware hash value, and hard disk serial number, use the KMAC256 algorithm to generate the hardware fingerprint, tightly bind the user's identity to the authorized terminal device, and calculate the hardware fingerprint FP to meet the following formula: FP=KMAC256(H cpu ||U board ||S disk ) Among them, H cpu Indicates the CPU microcode version, U board Indicates the firmware hash value, S disk Indicates the hard disk serial number; Monitor the operating environment parameters of the authorized terminal device, including geographic fences, network access points of the authorized terminal device, and operating system integrity check status; combine the hardware fingerprint FP, the serial number CertSN of the short-term identity certificate, and the operating environment parameters Env of the authorized terminal device with a hash function to generate a dynamic identity token Token.

4. The data encryption transmission method based on zero trust architecture according to claim 3 is characterized in that: Step S3 includes the following steps: Collect network environment data, including network latency, number of open port anomalies, and threat intelligence matching degree; classify the sensitivity level of data according to GB / T35273 standard, including public L1, internal L2, confidential L3, and top secret L4; Computer-generated risk assessment formulas, Where L is the network delay parameter; L Max is the maximum network delay parameter; P is the number of open port anomalies; T is the threat intelligence matching degree; S is the sensitivity level of the data; W1, W2, W3, and W4 are weight coefficients, which are allocated based on expert experience.

5. The data encryption transmission method based on zero trust architecture according to claim 3 is characterized in that: Step S4 includes the following steps: Combine historical data and expert experience to set low risk scoring thresholds and high risk scoring thresholds, and dynamically select the appropriate encryption algorithm based on the analysis results of the policy engine and the combination of the low risk scoring threshold and the high risk scoring threshold; Among them, encryption algorithms include AES-128-GCM encryption algorithm, AES-256-GCM encryption algorithm, and ChaCha20-Poly1305 encryption algorithm; The key life cycle is dynamically determined based on the actual situation, including: the AES-128-GCM encryption algorithm requires key rotation every 24 hours, the AES-256-GCM encryption algorithm requires key rotation every 12 hours, and the ChaCha20-Poly1305 encryption algorithm requires key rotation every 1 hour.

6. The data encryption transmission method based on zero trust architecture according to claim 5 is characterized in that: The analysis results of the policy engine, and dynamically select an appropriate encryption algorithm in combination with the low-risk score threshold and the high-risk score threshold, including the following steps: Set the low-risk score threshold as R1 and the high-risk score threshold as R2, satisfying R < R1, that is, the risk assessment level is low risk, select the AES-128-GCM encryption algorithm and rotate the key every 24 hours; R1 ≤ R < R2, that is, the risk assessment level is medium risk, select the AES-256-GCM encryption algorithm and rotate the key every 12 hours; R ≥ R2, that is, the risk assessment level is high risk, select the ChaCha20-Poly1305 encryption algorithm and rotate the key every 1 hour.

7. The data encryption transmission method based on zero trust architecture according to claim 5 is characterized in that: Step S5 includes the following steps: Deploy the controller architecture based on the cloud-native SDP controller cluster. The client submits a dynamic identity token Token and a session intent statement. The controller verifies the dynamic identity token Token. If the controller verification passes, the controller assigns short-lived temporary communication credentials to both parties of the communication, and establishes a double-layer tunnel between the two parties of the communication to ensure that the encrypted data of the communication parties can only flow between authorized network nodes; Among them, the lifecycle t of the temporary communication credential ≤ 10 min.

8. The data encryption transmission method based on zero trust architecture according to claim 7 is characterized in that: The double-layer tunnel includes an inner application layer tunnel and an outer transport layer tunnel; The inner application layer tunnel is based on TLS1.3, uses the key exchange algorithm of elliptic curve X25519 for key exchange, and adopts short-lived temporary communication credentials; the session intent statement is first encrypted through TLS1.3 to generate a TLS record; The outer transport layer tunnel constructs an efficient encrypted communication pipeline based on the QUIC protocol, uses the built-in header protection feature of the QUIC protocol to selectively encrypt and encode the sensitive metadata in the handshake layer packet header, that is, the obfuscated packet header, eliminates the recognizable network features, and resists traffic fingerprint analysis attacks; Strict two-way mTLS verification is implemented in the QUIC handshake phase, and the short-term identity certificate of the client is bound to the dynamic identity token Token; The TLS record of the inner application layer tunnel is segmented through the QUIC protocol, the obfuscated packet header is attached and the entire QUIC frame is encrypted, and the data transmission path is restricted according to the principle of least privilege.

9. The data encryption transmission method based on zero trust architecture according to claim 8 is characterized in that: Step S6 includes the following steps: Quantify the abnormal degree of the traffic deviation from the baseline based on Z-Score, satisfying the following formula where Z represents the deviation degree of the current traffic rate from the historical baseline, and the larger the absolute value, the higher the abnormal probability; X represents the current traffic rate, calculated through the network card throughput; μ represents the historical baseline mean, that is, the traffic average value for a period of time; σ represents the traffic standard deviation, reflecting the stability of the baseline data.

10. The data encryption transmission method based on zero trust architecture according to claim 9 is characterized in that: Step S6 also includes the following steps: Set the threshold of traffic mutation as Z'. If |Z| ≤ Z', it indicates that the traffic rate is normal. If |Z| > Z', it indicates that the traffic rate is abnormal and a fuse policy is performed, and the secondary authentication process is started; Among them, the fuse policy forcibly closes the encrypted tunnel and immediately terminates the session, and adds the MAC address / IP of the违规 device to the temporary blacklist; The secondary authentication process requires users to complete biometric verification or manual approval by the security team before access can be restored.

Images