Node trusted connection authentication method and system based on zero-trusted network access

Abstract

The invention discloses a node trusted connection authentication method and system based on zero-trusted network access. The method comprises the following steps: initiating a connection request by a node, authenticating a user identity, authenticating a node state, selecting a resource to be accessed, performing connection access control, and recording an access log of node connection. The system comprises a trusted authentication system, a resource platform and a special proxy client. According to the method, the resource platform is accessed by using the special proxy client and the predefined encryption method, and then the authorization of accessing the specific resource is obtained through the resource platform, so that the data security and the resource hiding in the communication process are ensured, and the access connection and the resource isolation are also realized; and meanwhile, by continuously and dynamically authenticating the state information of the node, the node abnormity can be found in time, the access connection is interrupted, the risk range is limited, and the safe and stable operation of the power grid system is ensured.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a node trusted connection authentication method and system based on zero-trust network access. Background Art

[0002] As power grids evolve toward automation and intelligence, cybersecurity threats are also emerging. Traditional network security is typically perimeter-based, dividing the network into external and internal networks. The assumption is that network security threats originate from the external network, while the internal network is a trusted domain. However, in reality, power grid network security issues arise not only from external threats, such as various hacker attacks, viruses, and Trojans, but also from internal threats, such as access to or tampering with inappropriate data and potential vulnerabilities in network equipment or software. In the face of threats both internally and externally, ensuring trusted connections between power grid nodes is a pressing issue.

[0003] Traditional network perimeter protection is a key approach to protecting internal networks from unauthorized external access and attacks. In this approach, enterprises divide their networks into external and internal networks, assuming the internal network is secure and its devices and personnel are trustworthy. By building protective infrastructure at the boundary between the internal and external networks, such as deploying firewalls, IPS, and other security devices, external network threats are kept out while access that passes protection policies is deemed trustworthy. However, with the rapid development of cloud computing, virtualization, the Internet of Things, and remote work, the number of mobile devices has skyrocketed, and network boundaries are becoming increasingly blurred. Traditional perimeter-centric protection approaches are no longer applicable to these new scenarios.

[0004] The emergence of virtual private networks (VPNs) stems from the increasing demand for remote work and remote access to internal enterprise resources, as well as the security risks inherent in traditional remote access methods. Zero Trust Network Access (ZTNA) applies the concept of zero trust to network security access practices. It is a model for providing controlled access to a minimal range of resources within and outside the network perimeter, enabling users to complete their daily tasks. In ZTNA, all objects involved in network access, including devices, services, applications, and data, are managed as resources. In the ZTNA model, application or data access is treated separately from network access. Connecting to a network does not automatically grant access to applications or data. ZTNA also does not expose IP addresses to the network, making the rest of the network invisible to connected devices, except for the applications or services they connect to. Furthermore, ZTNA can assess risk associated with additional factors, such as user location, the time and frequency of requests, and the requested applications and data.

[0005] Although ZTNA has been valued and applied in the field of network security in recent years, it has not been widely used in trusted authentication. Therefore, it is necessary to apply ZTNA to the needs of new power systems and node trusted connection authentication. Summary of the Invention

[0006] Purpose of the invention: The purpose of the present invention is to provide a node trusted connection authentication method and system based on zero-trust network access.

[0007] Technical solution: The node trusted connection authentication method based on zero-trust network access described in the present invention includes the following steps:

[0008] (1) Node initiates connection request: The node accessing the grid system resources starts a dedicated client and initiates a connection request to the resource platform;

[0009] (2) User identity authentication: The trusted authentication system receives the connection request from the client, checks whether the user is initiating the connection, whether the username and password are correct, and obtains the user's role and accessible resource information;

[0010] (3) Node status authentication: The trusted authentication system checks the node status information nodeStatus in the connection request to determine the current security status of the node to determine whether to allow access to the resource platform. If the node status is safe and trustworthy, it will enter the resource platform;

[0011] (4) Selecting the resource to be accessed: Based on the role of user U and the accessible resource information obtained in step (2), a resource platform interface containing the accessible resources is displayed on the node's dedicated client, and the user selects the specific resource to be accessed in the interface;

[0012] (5) Connection access control: Only allow the node to access the resources it needs and limit its access scope; at the same time, continuously and dynamically verify the connection trust status and take corresponding measures if an anomaly is found;

[0013] (6) Record the access log of the node connection: The trusted authentication system records all event logs of the entire process of the node connecting to access the specific resource, and saves them as reference data for future connection authentication.

[0014] Furthermore, the step (1) includes:

[0015] (1.1) The node starts the pre-installed dedicated proxy client. The ZTNA-based trusted authentication system generates a verification code and sends it to the client. The user fills in the user information and then sends a connection request to the resource platform using a pre-defined encryption method.

[0016] (1.2) After the dedicated proxy client is started, it collects node status information nodeStatus, including the node's operating system, running processes, network environment, geographical location, and access frequency, and sends it together with the user information.

[0017] Furthermore, the step (2) includes:

[0018] (2.1) The ZTNA-based trusted authentication system accepts the account information that attempts to establish a connection with the resource platform, and first checks the verification code V. If V is inconsistent with the verification code generated in advance by the trusted authentication system, the access is denied and a new verification code is generated and sent to the client, and then returns to step (1);

[0019] (2.2) The trusted authentication system checks whether the username U and password P are correct. If the username U or password P is incorrect, access is denied. Otherwise, the next step is executed.

[0020] (2.3) Determine whether user U currently has the authority to access the resource platform. If not, deny access. Otherwise, obtain user U's role and accessible resource information.

[0021] Furthermore, the step (3) includes:

[0022] (3.1) Check the process information in nodeStatus to determine whether the node has any dangerous processes running, such as viruses, backdoors, etc. If so, deny access, otherwise proceed to the next step;

[0023] (3.2) Check the network environment and geographic location in nodeStatus, check the network port information of the connected node, and determine whether the node has an unsafe network configuration, such as no antivirus software installed. If so, deny access. Otherwise, determine the node's geographic location through the IP address or nodeStatus location information and proceed to the next step of the inspection;

[0024] (3.3) Check the network access frequency information in nodeStatus. If it is found that the frequency of a node sending a large number of connection requests or data to other nodes exceeds the threshold set by the trusted authentication system, access is denied.

[0025] Furthermore, the step (4) includes:

[0026] (4.1) The resource platform displays a list of resources that user U can access in his current state. These resources are a subset of all resources on the resource platform.

[0027] (4.2) User U selects a specific resource from the resource list and initiates an access request. The resource platform grants the user an interface-level access token for the selected resource, i.e., authorization is performed based on the principle of least privilege.

[0028] Furthermore, the step (5) includes:

[0029] (5.1) Node connections access selected resources through interface-level access tokens. The authentication system monitors the access process and limits access operations to the current resource scope.

[0030] (5.2) Continuously and dynamically verify the trusted status of the connection. The dedicated client continuously sends the status information of the current node to the authentication system. Step 3 is executed in parallel. If the node status is abnormal, the access policy is dynamically adjusted or the connection access is interrupted.

[0031] Furthermore, the step (6) includes: the trusted authentication system records all event logs of the entire process of the node connecting to access the specific resource, and saves them as reference data for future connection authentication.

[0032] The node trusted connection authentication system based on zero-trust network access described in the present invention includes a trusted authentication system, a resource platform and a dedicated proxy client; the trusted authentication system checks the node status information nodeStatus in the connection request, determines the current security status of the node, and determines whether access to the resource platform is allowed. If the node status is safe and trustworthy, it will enter the resource platform.

[0033] Furthermore, the trusted authentication system checks the node status information nodeStatus in the connection request to determine the current security status of the node to determine whether access to the resource platform is allowed. If the node status is safe and trustworthy, it will enter the resource platform; the trusted authentication system records all event logs of the entire process of the node connecting to access the specific resource, and saves them as reference data for future connection authentication.

[0034] Furthermore, after the dedicated proxy client is started, it collects node status information nodeStatus, including the node's operating system, running process, network environment, geographical location, and access frequency, and sends it together with the user information.

[0035] Beneficial effects: Compared with the existing technology, the present invention has the following significant advantages: the present invention applies the zero-trust concept framework to the trusted connection authentication of node access to power grid system resources, obtains authorization to access resources by authenticating user identity and node status, and performs continuous dynamic authentication on the access connection to ensure the trustworthiness of the entire access process; uses a dedicated proxy client and a predefined encryption method to access the resource platform, and then obtains authorization to access specific resources through the resource platform, which not only ensures data security and resource hiding in the communication process, but also realizes the isolation of access connections and resources; at the same time, through continuous dynamic authentication of node status information, it can timely detect node anomalies and interrupt access connections, limit the scope of risks, and ensure the safe and stable operation of the power grid system. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A structural diagram of the access nodes, resources, resource platforms, and trusted connection authentication system;

[0037] Figure 2 A schematic diagram of the process for Engineer1 to access the data resource Rdata. DETAILED DESCRIPTION

[0038] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0039] There are currently two main mainstream implementations of Zero Trust Network Access (ZTNA): agent-based ZTNA and service-based (or cloud-based) ZTNA. Agent-based ZTNA requires the installation of a software application called an "agent" on all terminal devices; service-based or cloud-based ZTNA is a cloud service, not a terminal application. It does not require the use or installation of an agent. Service-based ZTNA may be easy to integrate with cloud applications, but not easy to integrate with internal infrastructure. If all network traffic must flow from internal terminal devices to the cloud and then back to the internal infrastructure, performance and reliability may be greatly affected. The present invention takes into account the characteristics of the power grid system and the feasibility of implementation, and adopts agent-based ZTNA as an implementation reference for node trusted connection authentication.

[0040] Resources are target objects in the power grid system operated by users (node connections). They can be devices, files, data, applications, etc. They are consistent with the resources defined in ZTNA. Resources need to be properly managed to ensure their security and availability. The resource platform is responsible for managing and controlling access to resources in the power grid system. All resources are mapped to the resource platform, which implements the isolation of actual resources and access connections. At the same time, the resource platform provides users with a unified resource management interface. After passing the trusted authentication, users can obtain the corresponding access token of the resource platform and access specific resources at the interface level. The relationship between access nodes, resources, resource platforms and trusted connection authentication systems is as follows: Figure 1 shown.

[0041] The User-Role-Permission (URP) matrix is an effective model for managing user access rights in a system. This model simplifies permission management by assigning users to different roles and assigning specific permissions to each role. In the URP model, there are three main components: users are the actual users of the system, such as system administrators, employees, managers, and suppliers; roles are a collection of permissions that define groups of users with the same permissions. For example, the "normal user" role may only have access to a subset of functions; and permissions are authorizations to access system resources or perform system operations, such as viewing data, editing data, and deleting data.

[0042] The User-Resource-Operation (URO) matrix is a model used to describe the operations that users can perform on resources in a power grid system. The URO model also has three main components: Users are the actual users of nodes, interacting with the system through an interface. In the URO matrix, users are the initiators of operations; Resources are the targets of user operations and are centrally managed by the resource platform; Operations are the actions that users (node connections) perform on resources, such as reading, writing, deleting, and modifying. Different users may have different operational permissions for the same resource. For example, the following is an example of a URO matrix, which represents the operation matrix of four users (A, B, C, D) on four different resources (R1, R2, R3, R4). The rows and columns correspond to users and resources respectively. 0 represents no permission, 1 represents read permission, 2 represents read and write permission, and 3 represents read, write, and delete permission. The first row of the matrix shows that user A's operation permissions on R1, R2, R3, and R4 are: no permission, read, read and write, and read. The user-resource-operation (URO) matrix of the trusted authentication system is shown below:

[0043]

[0044] A CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a public, fully automated procedure that distinguishes whether a user is a computer or a human. On the server side, a CAPTCHA generation algorithm generates a random string and sends it to the client. The client displays an image of this string and asks the user to verify their input. The server verifies that the string entered by the user matches the original generated string, thereby determining whether the user is a robot. CAPTCHAs can also effectively prevent hackers from repeatedly attempting to log in to a specific user through brute force.

[0045] Node status information (nodeStatus) is a comprehensive data set that details the current status of a node in the network. Key components of nodeStatus include the node's operating system, running processes, network environment, geographic location, and access frequency. The node's operating system describes the type and version of the operating system currently running on the node, such as Windows 10 x64 or Android 11 ARM. The node's running processes lists all processes currently running on the node, along with their associated information (such as process ID, name, start time, and resource usage), with particular attention paid to the running status of less common processes such as non-system and non-service processes. The network environment includes the node's IP address, including public and / or private IP addresses; network configuration information, such as network interface card (NIC) information, subnet mask, gateway address, and DNS server; and firewall and security settings, including whether antivirus software is installed and firewall settings. The geographic location describes the node's location, such as city and carrier. This information, combined with the IP address, determines whether the node is currently inside or outside the power grid. Access frequency is a statistic of the node's network traffic and the number of access requests issued. Network traffic statistics include inbound and outbound network traffic statistics, including total traffic, peak traffic, etc.; the number of access requests issued by a node is a statistic of the number of access connection requests issued by the node to other specific nodes / resources within a period of time (per second / per minute), and is represented by a list.

[0046] Dangerous processes usually refer to processes such as malware, viruses, and adware that are related to the security of computer nodes. Lists of known dangerous processes can usually be obtained from the virus databases of antivirus and security software, as well as security communities and forums. Common antivirus software such as Windows Defender, McAfee, and Huorong will provide lists of dangerous processes. Users in security communities and forums will share information about new viruses and malware they encounter, including lists of dangerous processes. In addition, suspicious ports usually refer to ports used by malware, viruses, or unauthorized services. Similar to dangerous processes, users in security communities and forums will also share information and attack cases about suspicious ports. Users can use port scanning tools (such as Nmap) to scan open ports on nodes and identify which ports are suspicious.

[0047] The trusted connection authentication method provided by the present invention is based on the demand for computing nodes to access power grid system resources, and is guided by the concept framework of zero-trust network access. It performs trusted authentication on the node access connection from the perspectives of user identity, node status, etc., controls the scope of connection access, and continuously performs dynamic authentication during the process of accessing resources, ensuring the credibility of the node connection from initiation to termination throughout the entire cycle, and realizing safe and reliable access to power grid system resources.

[0048] To achieve the above objectives, the present invention adopts the following technical solutions:

[0049] (1) The node initiates a connection request through a dedicated proxy client. The node that wants to access the power grid system resources starts the dedicated proxy client. The client will automatically connect to the trusted authentication system using a predefined encryption method (such as the commonly used encryption algorithm DES, RSA, etc.). The trusted authentication system randomly generates a verification code and sends it to the client. The client enters the login interface and accepts the user input of the username U, password P, and verification code V. At the same time, the client collects the node status information nodeStatus, including the node's operating system, running processes, network environment, geographical location, access frequency, etc. When the user information is submitted on the login interface, the nodeStatus is sent together.

[0050] (2) Perform user identity authentication for node connections. The trusted authentication system receives the connection request from the client and first checks the verification code V. If V is inconsistent with the pre-generated verification code, access is denied and a new verification code is generated and sent to the client, returning to step (1). If the verification code V is correct, the user name U and password P are checked for correctness. If the user name U or password P is incorrect, access is denied, returning to step (1). If the user name U and password P are correct, the role and resource operation permissions of user U are obtained through the URP matrix and the URO matrix. If the values in the rows corresponding to user U in the URO matrix are all 0, user U currently has no permission to access the resource platform and access is denied. Otherwise, the resource information accessible to user U is obtained.

[0051] (3) Authenticate the security status of the node. The trusted authentication system first obtains the operating system information in nodeStatus, and then excludes the system processes and service processes in the running process information based on the operating system information. Then, the remaining process information is compared with the existing dangerous process list. If a dangerous process is found in the current node, the node connection is denied. Otherwise, the network environment in nodeStatus is continued to be checked. If suspicious open ports and / or antivirus software is not installed, the node connection is denied. Otherwise, the access frequency information in nodeStatus is continued to be checked. If the network traffic of the node and / or the number of access requests issued exceeds the set threshold, such as the network traffic threshold set by the trusted authentication system is 5Gb / min and the number of access requests issued is 100 times / min, the node network status is considered abnormal and further access is denied. Otherwise, the location of the node and whether it is located inside the power grid system are determined through the geographic location information in nodeStatus.

[0052] (4) Select the resource to be accessed and obtain an access token. User U enters the resource platform. Based on the role of user U and the accessible resource information, the resource platform displays an interface containing the user role and accessible resource icons (list) on the node's dedicated client. The user selects the specific resource R to be accessed in this interface, and the resource platform grants the interface-level access token for the connection R.

[0053] (5) Control the operation and scope of connection access. Node connections access the selected resource R through an interface-level access token. The authentication system monitors the access process, restricts access operation permissions (consistent with the URO matrix), and limits access to resource R.

[0054] (6) Continuously and dynamically verify the trusted state of the connection. The trusted authentication system continuously and dynamically verifies the trusted state of the connection, continuously obtains the status information of the current node nodeStatus', and executes the inspection process of step (3) in parallel. If the node status is found to be abnormal, such as the emergence of a new dangerous process, a suspicious open port, a location change, etc., the resource platform saves the current execution state, and then the trusted authentication system interrupts the connection access. Otherwise, the current access connection continues to execute until it ends.

[0055] (7) Record the access log of the node connection. The trusted authentication system records all event logs of the entire process from the node initiating the connection request, performing the relevant authentication, accessing the specific resource R, until the access is completed or interrupted, and saves them as a reference for future connection authentication.

[0056] In the above steps, (5) and (6) are executed in parallel; when (6) is executed, (3) is called and executed in parallel.

[0057] The execution process of the entire method is described in detail as follows:

[0058] Node trusted connection authentication method based on zero-trust network access

[0059] Input: user information, node status information and target resources

[0060] Output: Full process access log

[0061] 1: The node initiates a connection request through a dedicated proxy client, sending user information (user name U, password P, verification code V) and node status information nodeStatus;

[0062] 2: The trusted authentication system authenticates the user identity of the node connection, checks the user information, and determines the user role and accessible resource information after successful authentication;

[0063] 3: The trusted authentication system authenticates the security status of the node, checks the operating system, running processes, network environment, access frequency and other information in the nodeStatus, and obtains the node location after confirming the node is secure;

[0064] 4: User U enters the resource platform and selects a specific resource R to access. The resource platform grants an interface-level access token for the connection R.

[0065] 5: The node connects to access resource R. At the same time, the authentication system monitors the access process and restricts the access operation to be consistent with the URO matrix and only access to resource R;

[0066] 6: The trusted authentication system continuously obtains the node status information nodeStatus' and executes the check process in step 3 in parallel. If the node status is abnormal, the connection access is interrupted; otherwise, the access is continued until the end;

[0067] 7: The trusted authentication system records the entire access log of the node from the initiation of the connection request to the end of the access or interruption.

[0068] Example:

[0069] This embodiment simulates the trusted connection authentication process of a power grid system technical engineer Engineerl remotely accessing the data resource Rdata within the power grid system through a portable laptop (node). The operating system used by the node is Windows 10x64, and the Huorong security software and a dedicated proxy client for accessing power grid system resources are installed. No other suspicious software is installed. The resources in the power grid system have been uniformly mapped to the resource platform for unified management. The resources and resource platform are all within the trust boundary of the trusted authentication system based on ZTNA. The user-role-permission (URP) matrix, user-resource-operation (URO) matrix, dangerous process list, suspicious port list, etc. are all stored in the trusted authentication system and dynamically updated according to actual conditions.

[0070] According to the above method, the process of Engineerl accessing the data resource Rdata is as follows: Figure 2 The specific steps are as follows:

[0071] In the first step, technical engineer Engineer1 starts the node's dedicated proxy client and enters his own username U = "Engineer1" and password P (encrypted) and verification code V = "5916" on the login interface; the node status information nodeStatus, including the node's operating system, running processes, network environment, geographical location, access frequency, etc., is automatically collected by the client, and clicks the "Login" button to issue a connection request.

[0072] In the second step, the trusted authentication system receives the connection request from the client, and first checks whether the verification code V = "5916" is consistent with the verification code generated in advance; if the verification code V is correct, then check whether the username U = "Engineerl" and password P (encrypted) are correct; if the username U and password P are correct, obtain the role and resource operation permissions of user Engineer1 from the URP matrix and URO matrix stored in the trusted authentication system, and obtain the resource information accessible to user Engineer1.

[0073] In the third step, the trusted authentication system first obtains the operating system information "Windows10x64" in nodeStatus, and then excludes the system processes and service processes of Windows 10x64 in the running process information, and then compares the remaining process information with the existing dangerous process list. Some common dangerous process lists are shown in Table 1. It is found that there are no dangerous processes on the current node (no other suspicious software is installed); continue to check the network environment in nodeStatus, and find that the Huorong security software has been installed and there are no suspicious open ports; continue to check the access frequency information in nodeStatus, and find that the node's network traffic and the number of access requests issued do not exceed the set threshold; through the geographic location information (or IP address) in nodeStatus, determine the location of the node and whether it is inside the power grid system.

[0074] Table 1: List of some common dangerous processes

[0075]

[0076] In the fourth step, user Engineerl enters the resource platform. Based on the role of user Engineerl and the accessible resource information, the resource platform displays an interface containing the user role and accessible resource icons on the node's dedicated client. User Engineerl selects the specific resource Rdata to be accessed in the interface, and the resource platform grants the interface-level access token for the connection Rdata.

[0077] In the fifth step, user Engineer1 (node connection) uses the interface-level access token to access the selected resource Rdata. The URO matrix shows that Engineer1 can view and write to the resource Rdata. The authentication system monitors the access process, restricting Engineer1's operations to view and write and limiting it to accessing only the resource Rdata.

[0078] In the sixth step, the trusted authentication system continuously and dynamically verifies the trusted status of the node connection by continuously obtaining new node status information nodeStatus' and executing the inspection process in the third step in parallel (if the node status is found to be abnormal, such as the emergence of a new dangerous process, a suspicious open port, a location change, etc., the resource platform saves the current execution status, and then the trusted authentication system interrupts the node connection). If no abnormality is found, the current access connection will continue to execute until the end.

[0079] In the seventh step, the trusted authentication system records the entire process of user Engineerl using the node to access the resource Rdata, starting from the initiation of the connection request to the end of the access. All event logs are used as a reference for future connection authentication of the node.

Claims

1. A node trusted connection authentication method based on zero-trust network access, characterized in that: The steps include: (1) Node initiates connection request: The node accessing the grid system resources starts a dedicated client and initiates a connection request to the resource platform; (2) User identity authentication: The trusted authentication system receives the connection request from the client, checks whether the user is initiating the connection, whether the username and password are correct, and obtains the user's role and accessible resource information; (3) Node status authentication: The trusted authentication system checks the node status information nodeStatus in the connection request to determine the current security status of the node to determine whether to allow access to the resource platform. If the node status is safe and trustworthy, it will enter the resource platform; (4) Selecting the resource to be accessed: Based on the role of user U and the accessible resource information obtained in step (2), a resource platform interface containing the accessible resources is displayed on the node's dedicated client, and the user selects the specific resource to be accessed in the interface; (5) Connection access control: Only allow the node to access the resources it needs and limit its access scope; at the same time, continuously and dynamically verify the connection trust status and take corresponding measures if an abnormality is found; (6) Record the access log of the node connection: The trusted authentication system records all event logs of the entire process of the node connecting to access the specific resource, and saves them as reference data for future connection authentication.

2. The node trusted connection authentication method based on zero-trust network access according to claim 1, characterized in that: The step (1) comprises: (1.1) The node starts the pre-installed dedicated proxy client. The ZTNA-based trusted authentication system generates a verification code and sends it to the client. The user fills in the user information and then sends a connection request to the resource platform using a pre-defined encryption method. (1.2) After the dedicated proxy client is started, it collects node status information nodeStatus, including the node's operating system, running processes, network environment, geographical location, and access frequency, and sends it together with the user information.

3. The node trusted connection authentication method based on zero-trust network access according to claim 1, characterized in that: The step (2) comprises: (2.1) The ZTNA-based trusted authentication system accepts the account information that attempts to establish a connection with the resource platform, and first checks the verification code V. If V is inconsistent with the verification code generated in advance by the trusted authentication system, the access is denied and a new verification code is generated and sent to the client, and then returns to step (1); (2.2) The trusted authentication system checks whether the username U and password P are correct. If the username U or password P is incorrect, access is denied. Otherwise, the next step is executed. (2.3) Determine whether user U currently has permission to access the resource platform. If not, deny access. Otherwise, obtain user U's role and accessible resource information.

4. The node trusted connection authentication method based on zero-trust network access according to claim 1, characterized in that: The step (3) comprises: (3.1) Check the process information in nodeStatus to determine whether the node has any dangerous processes running, such as viruses, backdoors, etc. If so, deny access, otherwise proceed to the next step; (3.2) Check the network environment and geographic location in nodeStatus, check the network port information of the connected node, and determine whether the node has an unsafe network configuration, such as no antivirus software installed. If so, deny access. Otherwise, determine the node's geographic location through the IP address or nodeStatus location information and proceed to the next step of the inspection; (3.3) Check the network access frequency information in nodeStatus. If it is found that the frequency of a node sending a large number of connection requests or data to other nodes exceeds the threshold set by the trusted authentication system, access is denied.

5. The node trusted connection authentication method based on zero-trust network access according to claim 1, characterized in that: The step (4) comprises: (4.1) The resource platform displays a list of resources that user U can access in his current state. These resources are a subset of all resources on the resource platform. (4.2) User U selects a specific resource from the resource list and initiates an access request. The resource platform grants the user an interface-level access token for the selected resource, i.e., authorization is performed based on the principle of least privilege.

6. The node trusted connection authentication method based on zero-trust network access according to claim 1, characterized in that: The step (5) comprises: (5.1) Node connections access selected resources through interface-level access tokens. The authentication system monitors the access process and limits access operations to the current resource scope. (5.2) Continuously and dynamically verify the trusted status of the connection. The dedicated client continuously sends the status information of the current node to the authentication system. Step 3 is executed in parallel. If the node status is abnormal, the access policy is dynamically adjusted or the connection access is interrupted.

7. The node trusted connection authentication method based on zero-trust network access according to claim 1, characterized in that: Said step (6) comprises: the trusted authentication system records all event logs of the entire process of the node connecting to access the specific resource, and saves them as reference data for future connection authentication.

8. A node trusted connection authentication system based on zero-trust network access, characterized in that: Includes trusted authentication system, resource platform and dedicated proxy client; The trusted authentication system checks the node status information nodeStatus in the connection request to determine the current security status of the node to determine whether access to the resource platform is allowed. If the node status is safe and trusted, it will enter the resource platform.

9. The node trusted connection authentication system based on zero-trust network access according to claim 8, characterized in that: The trusted authentication system checks the node status information nodeStatus in the connection request to determine the current security status of the node to determine whether to allow access to the resource platform. If the node status is safe and reliable, it will enter the resource platform; The trusted authentication system records all event logs of the entire process of the node connecting to access the specific resource, and saves them as reference data for future connection authentication.

10. The node trusted connection authentication system based on zero-trust network access according to claim 8, characterized in that: After the dedicated proxy client is started, it collects node status information nodeStatus, including the node's operating system, running process, network environment, geographical location, and access frequency, and sends it together with user information.

Images