Terminal security access control method and device, computer device and storage medium

Abstract

The application belongs to the technical field of network security, and relates to a terminal security access control method and device, computer equipment and a storage medium, the method comprising: deploying terminal security access infrastructure, the infrastructure comprising a client, a security system and a server component; performing initial registration of a terminal device, realizing unique binding of terminal identity and loading of basic security policy by collecting device fingerprints, issuing certificates and configuring policies; verifying user identity and device credibility in real time through a multi-factor dynamic authentication mechanism; performing application and network communication authentication through signature verification and encrypted transmission, ensuring application legality, communication channel security and operation environment credibility; establishing a trusted connection after authentication and implementing fine-grained authorization, realizing business layer security isolation through dynamic token and API control. The application effectively solves the problems of single authentication dimension, coarse-grained authorization and lack of dynamic control in existing terminal access control.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a terminal security access control method and device, a computer device and a storage medium. BACKGROUND

[0002] In the process of terminal access to a network, how to ensure the authenticity of user identity and the trustworthiness of terminal platform becomes a key link to guarantee network security.

[0003] Traditional terminal access authentication methods have many security risks, for example, user credentials are easy to be stolen, and platform configurations are easy to be tampered with, so that illegal users can easily access the network and obtain sensitive information, causing huge losses to enterprises and individuals.

[0004] In the prior art, user authentication methods are relatively single and mostly rely on the combination of usernames and passwords. Such methods cannot effectively resist increasingly complex network attack methods. At the same time, there is a lack of effective mechanism for terminal platform authentication, making it difficult to ensure the integrity and security of the platform. For example, some malicious software may tamper with the system configuration of the terminal, allowing it to access the network without being detected, thereby posing a serious threat to network security. SUMMARY

[0005] To solve the above technical problems, the present application provides a terminal security access control method, which adopts the technical solution as follows, comprising:

[0006] Deploying an infrastructure for terminal security access, the infrastructure comprising a client, a security system and a server component;

[0007] Performing initial registration of terminal devices, realizing unique binding of terminal identity and loading of basic security policies by collecting device fingerprints, issuing certificates and configuring policies;

[0008] Real-time verification of user identity and device trustworthiness through a multi-factor dynamic authentication mechanism;

[0009] Carrying out application and network communication authentication through signature verification and encrypted transmission to ensure application legitimacy, communication channel security and running environment trustworthiness;

[0010] Establishing a trusted connection after authentication and implementing fine-grained authorization to guarantee the principle of minimum authority for business access, realizing business layer security isolation through dynamic token and API control;

[0011] Realizing an adaptive security closed loop through real-time behavior monitoring, risk analysis and policy adjustment.

[0012] Preferably, the step of deploying the infrastructure for secure terminal access, wherein the infrastructure includes client, security system, and server components, specifically includes:

[0013] Deploy a five-tuple authentication system component, wherein the five-tuple includes user, device, application, network, and environment parameters;

[0014] Install and configure the client-side security agent;

[0015] Prepare server-side resources and pre-configure strategies.

[0016] Preferably, the steps of initial registration of the terminal device, which involves collecting device fingerprints, issuing certificates, and configuring policies to achieve unique binding of the terminal identity and loading of basic security policies, specifically include:

[0017] Perform fingerprint collection and registration for client devices;

[0018] Users are assigned dual SIM cards and dual certificates to achieve a strong binding between their identity and the device. The dual SIM cards and dual certificates include a user certificate and a device certificate.

[0019] Set an initial access control policy to ensure that terminal access follows the principle of least privilege.

[0020] Preferably, the step of verifying user identity and device trustworthiness in real time through a multi-factor dynamic authentication mechanism specifically includes:

[0021] Dynamically authenticate user identities;

[0022] Perform dynamic certification and verification on the equipment;

[0023] Dynamically adjust user permission scope based on user role, device type, and access context.

[0024] Preferably, the steps of performing application and network communication authentication through signature verification and encrypted transmission to ensure application legitimacy, communication channel security, and a trustworthy operating environment specifically include:

[0025] Perform dynamic authentication and verification for applications;

[0026] Dynamic authentication of network communication channels;

[0027] Perform trustworthiness authentication on the operating environment of the device terminal.

[0028] Preferably, the steps of establishing a trusted connection after successful authentication and implementing fine-grained authorization to ensure the principle of least privilege for business access, and achieving secure isolation of the business layer through dynamic tokens and API control, specifically include:

[0029] Create secure communication channels to provide confidentiality and integrity protection for business data;

[0030] Dynamic authorization of business resource access rights based on user, device, application and context attributes, enabling four-level control of devices, users, applications and APIs;

[0031] Security control of business application interfaces.

[0032] Preferably, the step of achieving an adaptive security loop through real-time behavior monitoring, risk analysis and policy adjustment specifically includes:

[0033] Monitoring user operations, device states and application activities to collect behavior data for risk analysis;

[0034] Adjusting access rights in real time according to risk scores;

[0035] Security event response and audit.

[0036] To solve the above technical problems, the application further provides a terminal security access control device, which adopts the technical scheme as follows, comprising:

[0037] A deployment module for deploying infrastructure for terminal security access, the infrastructure including a client, a security system and a server component;

[0038] A registration module for initial registration of terminal devices, achieving unique binding of terminal identity and loading of basic security policies through collection of device fingerprints, issuance of certificates and configuration of policies;

[0039] A verification module for real-time verification of user identity and device trustworthiness through a multi-factor dynamic authentication mechanism;

[0040] An authentication module for authentication of application and network communication through signature verification and encrypted transmission, ensuring application legitimacy, communication channel security and operating environment trustworthiness;

[0041] An establishment module for establishing a trusted connection after authentication and implementing fine-grained authorization to guarantee the principle of least privilege for business access, and achieving business layer security isolation through dynamic token and API control;

[0042] A monitoring module for achieving an adaptive security loop through real-time behavior monitoring, risk analysis and policy adjustment.

[0043] To solve the above technical problems, the application further provides a computer device, which adopts the technical scheme as follows, comprising a memory and a processor, the memory storing computer readable instructions, and the processor executing the computer readable instructions to realize the steps of the terminal security access control method described above.

[0044] To solve the above technical problems, the application further provides a computer readable storage medium, which adopts the technical scheme as follows, the computer readable storage medium stores computer readable instructions, and the computer readable instructions are executed by a processor to realize the steps of the terminal security access control method.

[0045] Compared with the prior art, the application has the following beneficial effects:

[0046] First, the credibility is improved through double authentication: the user identity authentication of the controlled end Ukey smart card is combined with the central platform authentication and verification of the trusted management component (TPM), the single authentication defects of only authenticating the device and not the person, and only authenticating the person and not the device are solved, and it is ensured that the person, the device, the application, and the network communication are trusted;

[0047] Second, fine-grained authorization covers all dimensions: four-level permission management and control of devices, users, applications, and APIs are realized, over-allocated permissions are avoided, and the principle of least privilege is met;

[0048] Third, dynamic management conforms to the concept of zero trust: based on entity behavior, access permissions are adjusted in real time, the traditional static mode of one-time authentication for lifelong trust is broken, and continuous verification, dynamic authorization, and rapid response are realized;

[0049] Fourth, full-link security protection can be provided: user identity information, platform proof data, and behavior monitoring data are encrypted for transmission and storage by using a national secret algorithm, and the permission token is internally provided with an effective period and a forgery prevention check to prevent data leakage and token forgery. BRIEF DESCRIPTION OF DRAWINGS

[0050] In order to more clearly illustrate the schemes in the application, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the application. Obviously, the drawings described below are some embodiments of the application, and other drawings can also be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0051] Figure 1 is a flowchart of an embodiment of the terminal security access control method of the application;

[0052] Figure 2 is an exemplary system architecture diagram to which the application can be applied;

[0053] Figure 3 is a communication link establishment principle diagram used in the terminal security access control method of the application;

[0054] Figure 4 is a schematic diagram of a railway ticket business trusted access application scenario applying the terminal security access control method of the application;

[0055] Figure 5 is a schematic diagram of a ticket service end implementing a trusted computing environment by applying the terminal secure access control method of the present application;

[0056] Figure 6 is a client and platform challenge-response authentication flowchart of the terminal secure access control method of the present application;

[0057] Figure 7 is a structural schematic diagram of an embodiment of the terminal secure access control device of the present application;

[0058] Figure 8 is a structural schematic diagram of an embodiment of the computer device of the present application. DETAILED DESCRIPTION

[0059] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used in the description herein is for describing particular embodiments only and is not intended to be limiting of the application; the description herein and the claims of the application and the above description of the drawings herein, the terms "comprising", "comprises" and "including" are to be construed as not limited; the description herein and the claims of the application and the above description of the drawings herein, the terms "first", "second" and the like are used to distinguish different objects, not to describe a particular sequential order.

[0060] Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in an embodiment" in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another. It is expressly understood that any of the embodiments described herein can be combined with any of the other embodiments.

[0061] In order to make the technical personnel in the art better understand the present application scheme, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings.

[0062] It should be noted that the terminal secure access control method provided by the embodiments of the present application is generally executed by a server / terminal device, and accordingly, the terminal secure access control device is generally arranged in the server / terminal device.

[0063] It should be understood that the number of terminal devices, networks and servers is only illustrative. According to the implementation needs, there can be any number of terminal devices, networks and servers.

[0064] Embodiment one

[0065] Please refer to Figure 1 , a flow chart of one embodiment of the terminal security access control method of the present application is shown. The terminal security access control method comprises the following steps:

[0066] Step S1, deploying the infrastructure of terminal security access, which comprises client, security system and server component.

[0067] In this embodiment, the electronic device (such as server / terminal device) on which the terminal security access control method runs can receive the terminal security access control request through wired connection or wireless connection. It should be noted that the above-mentioned wireless connection can include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAXX connection, Zigbee connection, UWB (ultra wideband) connection, and other now known or future developed wireless connection.

[0068] Figure 2 is an exemplary system architecture diagram to which the present application can be applied. As shown in Figure 2 , the architecture involves client, trusted authentication platform, network access gateway, secure communication platform, trusted management platform (TPM) and server. The client involves business terminal (such as ticketing terminal), security agent (S-Agent), trusted management firmware (TPM) and smart card (double card double certificate) and the like. The client is authenticated in the trusted authentication platform, and the authentication content includes five-tuple authentication: user dynamic authentication, device dynamic authentication, application dynamic authentication, network channel dynamic authentication and running environment trustworthiness authentication.

[0069] In this embodiment, step S1, deploying the infrastructure of terminal security access, which comprises client, security system and server component specifically can include the following steps:

[0070] S11, deploying five-tuple authentication system components, which includes user, device, application, network and environment parameters.

[0071] Deploying trusted identity authentication platform, using public key infrastructure (PKI) based certificate management system, issuing digital certificate for user and device.

[0072] Configuring network access gateway, integrating software defined border (SDP) technology, realizing micro-isolation and dynamic authorization of network layer.

[0073] Building a secure communication platform, supporting encryption transmission protocol of national cryptographic algorithm (such as SM2, SM4), ensuring data confidentiality.

[0074] Initialize the trusted platform management (TPM), store the root key by the hardware security module (HSM), and provide the platform integrity verification function.

[0075] The step S11 is to establish the dual-system core platform for authentication and verification, realize the identity management, network access control, secure communication, and trusted management, and realize the collaborative work. The component is the command center of dynamic authentication, and ensures the real-time and consistency of the data interaction of the elements.

[0076] S12, install and configure the client security agent.

[0077] Install the security agent software (S-Agent), support Windows / Linux system, and interact with the smart card reader and TPM chip through the API interface.

[0078] Configure the dual-card dual-certificate UKey smart card, store the user certificate and device certificate in different partitions respectively, and prevent the certificate from being confused and misused.

[0079] Integrate the trusted management firmware (TPM), protect the key and critical parameters by using the secure storage function, and ensure that the sensitive data cannot be tampered.

[0080] The step S12 is to implant the security software on the terminal device, realize the integrated management of the smart card and TPM, and provide the execution carrier for the subsequent dynamic authentication. The security agent is responsible for collecting the device fingerprint, managing the certificate, and executing the strategy, and forms the supervision system on the terminal side.

[0081] S13, prepare the server resources and preset the strategy.

[0082] Deploy the directory service (such as LDAP) or identity management system, store the user role, device attribute, and application permission information.

[0083] Configure the business application server (such as OA, ticketing system) and data storage area, and implement the data classification marking (such as sensitive, public).

[0084] Preset the default access strategy in the trusted management platform, define the user-device-application association rules based on the attribute-based access control (ABAC) model.

[0085] The step S13 is to ensure that the intranet server (such as directory service, business application) is ready, and preset the minimum permission access strategy, and provide data support for fine-grained authorization. The server as the resource subject needs to be linked with the security system to realize the dynamic strategy distribution.

[0086] By the integration of the hardware-level security module and the software agent, the step S1 constructs the trusted computing environment, and lays the foundation for the five-tuple (user, device, application, network, and environment parameter) dynamic authentication system.

[0087] Step S2, initial registration of the terminal device, through the collection of device fingerprints, the issuance of certificates and the configuration of policies, to realize the unique binding of terminal identity and the loading of basic security policy.

[0088] In the embodiment, step S2, initial registration of the terminal device, through the collection of device fingerprints, the issuance of certificates and the configuration of policies, to realize the unique binding of terminal identity and the loading of basic security policy can specifically include steps of:

[0089] S21, client device fingerprint collection and registration.

[0090] The TPM chip measures the device hardware information (such as CPU serial number, motherboard hash value), and uses the SHA-256 algorithm to generate a unique fingerprint.

[0091] The security agent uploads the encrypted fingerprint to the trusted identity authentication platform, and the platform records the fingerprint and device association information.

[0092] The digital signature technology is adopted to ensure the integrity of the fingerprint transmission and prevent tampering by intermediaries.

[0093] The purpose of step S21 is to generate a unique device identifier (fingerprint) for device identity verification in subsequent dynamic authentication. The device fingerprint is based on hardware features to prevent device forgery or reuse.

[0094] S22, allocate dual-card dual-certificate to the user to realize strong binding of identity and device, the dual-card dual-certificate including user certificate and device certificate.

[0095] The CA agency issues X.509 format digital certificate, the user certificate is used for identity authentication, and the device certificate is used for terminal legitimacy proof.

[0096] The certificate is stored in the UKey smart card, and the private key access is protected by PIN code, which meets the national standard GM / T 0016.

[0097] The trusted identity authentication platform binds the certificate with the device fingerprint to form a "user-device" mapping database.

[0098] The purpose of step S22 is to allocate dual-card dual-certificate (user certificate and device certificate) to the user to realize strong binding of identity and device. The dual-certificate mechanism separates user authentication and device authentication, and improves the anti-spoofing capability.

[0099] S23, set initial access control policy to ensure that the terminal access complies with the principle of least privilege.

[0100] The trusted management platform is based on the role-based access control (RBAC) model, and the user default permissions (such as access to specific applications only) are preset.

[0101] The security agent downloads the policy file from the platform, stores it locally encrypted, and verifies the integrity of the policy through the TPM.

[0102] Implement policy version management, support remote update, ensure that the policy is synchronized with the risk posture.

[0103] The role of step S23 is to set the initial access control policy, such as applying the white list and network permission range, to ensure that the terminal access complies with the principle of least privilege.

[0104] Step S2 is used to focus on the initial registration process of the terminal device, and by collecting device fingerprints, issuing certificates and configuring policies, the unique binding of terminal identity and the loading of basic security policies are realized. The registration stage emphasizes the rigor of the first verification, laying the foundation for continuous authentication.

[0105] Step S3, through the multi-factor dynamic authentication mechanism, verifies the user identity and device credibility in real time.

[0106] In this embodiment, step S3, through the multi-factor dynamic authentication mechanism, verifies the user identity and device credibility in real time, which can include the following steps:

[0107] S31, dynamically authenticate the user identity.

[0108] The user inserts the UKey smart card and inputs the PIN code to unlock the private key, generating a PKI-based signature challenge response.

[0109] The trusted identity authentication platform verifies the certificate chain and signature, and queries the TPM platform configuration register (PCR) value to verify the integrity of the terminal environment.

[0110] Introduce timestamp and random number to prevent replay attacks, and synchronize the authentication result to the trusted management platform in real time.

[0111] The identity authentication between the client and the trusted authentication platform is through the interactive process of submitting trusted credentials, verifying the validity of the credentials, and granting access rights, including identity uniqueness confirmation, secure transmission of credentials, and prevention of credential theft or tampering, and fine-grained control of permissions.

[0112] In specific implementation, step S31, dynamically authenticating the user identity, can further include the following steps:

[0113] S311, UKey card issuance and digital certificate issuance and initialization (preparation), ensure that the client has a legal "identity certificate", ticket SQY20 codon system, has a user digital certificate for user unique identification, UKey securely stores the private key to prevent private key leakage.

[0114] S312: Client initiates active authentication request, and the security management agent generates an authentication request packet: 1. Collects basic information such as "current timestamp, random number A (to prevent replay attacks), target platform address, user account", signs the information using the user private key (generates "client signature value"), packs "user digital certificate (containing public key), signed authentication request information, random number A", and transmits it to the trusted authentication platform through the YD-SOMN security protocol for encrypted transmission.

[0115] S313: The trusted management platform (TPM) verifies the identity and verifies the legality of the client:

[0116] After the trusted authentication platform receives the request, it notifies the trusted management platform (TPM) to verify the identity of the client first to avoid illegal user access:

[0117] Certificate validity check: Extract the digital certificate sent by the client, and verify the certificate signature through the public key — if the signature verification is passed, it proves that the certificate is signed by the trusted CA and has not been tampered with;

[0118] Further check the certificate status: query the CRL (Certificate Revocation List) of the CA or through the OCSP (Online Certificate Status Protocol) interface to confirm that the certificate has not expired and has not been revoked (such as the user private key is leaked and actively revoked); check the identity information bound by the certificate: compare the "user account" in the certificate with the account in the platform user database to ensure that the certificate corresponds to the user identity uniquely.

[0119] Request signature verification: use the user public key in the certificate to decrypt the "client signature value" to restore the original information such as "timestamp, random number A";

[0120] Check the validity of the timestamp (such as the difference with the current platform time is not more than 2 minutes) to prevent attackers from replaying old requests; check the uniqueness of the random number A (such as it has not appeared repeatedly within 20 minutes) to avoid repeated authentication attacks.

[0121] S314: Client identity verification platform legality: To prevent "phishing platform" from stealing user information, the client needs to verify the platform identity in reverse to achieve two-way authentication.

[0122] Platform certificate and signature verification: The trusted authentication platform sends "platform digital certificate (containing platform public key), random number B, and confirmation information signed by platform private key (containing random number A, random number B)" to the client through the YD_SOMN security protocol;

[0123] The client extracts the platform certificate and queries the "root certificate library" through the security management agent to verify the legality of the platform certificate.

[0124] The client uses the platform's public key to decrypt the "platform signature information" and restores the random number A. If the random number A is the same as the random number A sent by the client, it proves that the platform is a legitimate target platform and not a phishing site.

[0125] S315, session key negotiation, and ensuring the security of subsequent communications.

[0126] After successful two-way identity verification, both parties negotiate a temporary session key to replace inefficient asymmetric encryption for subsequent data transmission.

[0127] Key generation and encrypted transmission: The client combines "random number A, random number B, and its own private key" to generate a symmetric session key (such as an AES-256 key), and encrypts the session key using the platform's public key;

[0128] Send the encrypted session key to the platform, and the platform will decrypt it using its own private key to obtain the same session key;

[0129] Both parties agreed that all subsequent communications would use the session key for symmetric encryption, balancing security and transmission efficiency.

[0130] S316, Authentication Result Feedback and Session Establishment: The platform provides feedback on the authentication result.

[0131] The trusted authentication platform generates an "authentication passed / failed" result, which is then encrypted using the session key and sent to the client. If the authentication is successful, the platform also issues a "session ID" (used to identify this authentication session, which is usually valid for 1 hour). Subsequent accesses by the client can be quickly verified using the session ID, without having to repeat the entire authentication process.

[0132] Client confirmation and session initiation: The client decrypts the authentication result. If it is "passed", the client stores the session ID and establishes a secure communication session with the platform.

[0133] When the client sends business requests (such as querying data or submitting forms) in the future, it only needs to carry the "session ID" and encrypt the data using the session key. The platform will then associate the user's identity with the session ID to complete the permission verification.

[0134] S317 provides secure two-party authentication assurance, based on a combination of asymmetric and symmetric encryption. Asymmetric encryption (SM2, RSA) is used for identity signing and key negotiation, solving the "key distribution" problem; symmetric encryption (SM4 / AES) is used for subsequent data transmission, improving efficiency.

[0135] Two-way authentication: Simultaneously verify the identity of the client and the platform to eliminate the risk of "one-sided forgery" (such as phishing platforms deceiving users or illegal clients attacking the platform).

[0136] Anti-replay and anti-tamper: ensure the uniqueness of the request through timestamp and random number (A / B), and ensure the data has not been tampered with through digital signature.

[0137] Private key secure storage: the client private key is stored in a hardware encryption module (UKey smart card) to avoid private key theft by malicious software.

[0138] In the implementation, if an abnormal situation occurs in the authentication process, the abnormal situation needs to be handled:

[0139] Invalid certificate (expired / invalidation): the platform returns an invalid certificate result, and the client prompts the user to reapply for a certificate from the CA;

[0140] Signature verification failure: the platform returns an identity verification failure, and the client checks whether the private key is normal (such as whether the UKey is inserted) or reinitiates authentication;

[0141] Platform certificate verification failure: the client pops up a platform untrusted warning, terminates the authentication process, and prevents the user from accessing a phishing site;

[0142] Session timeout: after the session ID expires, the platform requires the client to perform the complete authentication process again to ensure communication security.

[0143] The role of step S31 is to verify the authenticity of the user's identity to prevent credential theft or impersonation. The authentication process integrates smart card PKI authentication and TPM verification to ensure user trust.

[0144] S32, dynamic authentication and verification of the device.

[0145] The security agent generates a one-time password using HOTP (HMAC-based one-time password algorithm) based on the device fingerprint and the random number issued by the server.

[0146] The network access gateway verifies the validity of the password and compares it with the device fingerprint database. If it fails, it blocks the connection.

[0147] TPM provides hardware-level support to ensure that the fingerprint generation process is tamper-proof and complies with the Trusted Computing Group (TCG) standard.

[0148] The role of step S32 is to confirm the legality of the access device to prevent unauthorized devices from accessing the network. Device authentication is based on fingerprints and dynamic passwords to ensure device trust.

[0149] S33, dynamically adjust the user's permission range according to the user's role, device type, and access context.

[0150] The trusted management platform queries the directory service to obtain user attributes (such as department and position), and calculates the permissions based on the device risk score (such as virus scan results).

[0151] The dynamic policy engine is implemented to generate access tokens in real time based on JSON format policy rules.

[0152] The token has a built-in validity period (e.g., 5 minutes) and an anti-counterfeit check code, and the national cryptographic SM3 hash algorithm is used to ensure token integrity.

[0153] The purpose of step S33 is to dynamically adjust the scope of authority based on user roles, device types, and access context, to avoid excessive allocation of authority.

[0154] Step S3 is the core of the five-tuple authentication, which verifies the user identity and device credibility in real time through a multi-factor dynamic authentication mechanism. Combined with one-time password and context analysis, it realizes the zero-trust requirement of always verification.

[0155] In step S4, the application and network communication authentication are performed through signature verification and encrypted transmission to ensure the legality of the application, the security of the communication channel, and the trustworthiness of the running environment.

[0156] In this embodiment, step S4, the application and network communication authentication are performed through signature verification and encrypted transmission to ensure the legality of the application, the security of the communication channel, and the trustworthiness of the running environment. Specifically, it can include the following steps:

[0157] S41, dynamic authentication and verification of the application.

[0158] The security agent collects application features (such as hash value, digital signature) and compares them with the whitelist database through the trusted management platform.

[0159] Based on the TPM-based static trusted root (SRTM), the application loading process is measured, and if there is an exception, the execution is blocked.

[0160] When accessing the API, the dynamic token needs to be carried, and the API gateway verifies the token authority range.

[0161] The purpose of step S41 is to verify the legality of the application binary file or script to prevent malicious software execution. Application authentication covers the installation, startup, and running stages.

[0162] S42, dynamic authentication of the network communication channel.

[0163] The TLS 1.3 protocol is used to negotiate session keys, and the national cryptographic SM2 / SM4 algorithm suite is supported to realize end-to-end encryption.

[0164] The network access gateway implements two-way authentication, and the client needs to present the device certificate, and the server verifies the validity of the certificate.

[0165] Real-time monitoring of link quality, such as delay or packet loss rate exceptions, automatically triggers re-authentication.

[0166] The step S42 is to establish an encrypted communication link to prevent data eavesdropping or tampering. Channel authentication ensures transport layer security to meet sensitive business needs.

[0167] Figure 3 The figure is the principle of communication link establishment used in the terminal security access control method of the application. As shown in Figure 3 the illegal user cannot scan the TCP port and the UDP port, and the legal user establishes a communication tunnel between the TCP port set on the application gateway in the security zone.

[0168] S43, the credibility of the device terminal running environment is authenticated.

[0169] TPM periodically measures the start component (such as BIOS, boot loader), generates an integrity report uploaded to the trusted management platform.

[0170] The platform compares the reference value, and if the deviation exceeds the threshold, the device is marked as "risk" and its access rights are limited.

[0171] Integrate the terminal detection and response (EDR) tool to monitor process behavior and detect vulnerability exploitation attempts.

[0172] The function of step S43 is to verify the integrity of the operating system, driver and firmware, and to ensure that the terminal is in a safe state. Environment authentication is the key basis for dynamic authorization.

[0173] Step S4 is used to expand the authentication dimension to the application layer and the network layer to ensure application legality, communication channel security and running environment credibility. Through signature verification and encrypted transmission, a full-link security defense line is built.

[0174] Step S5, after authentication, establish a trusted connection and implement fine-grained authorization to guarantee the principle of minimum privilege of business access, and through dynamic token and API control, realize business layer security isolation.

[0175] In this embodiment, step S5, after authentication, establish a trusted connection and implement fine-grained authorization to guarantee the principle of minimum privilege of business access, and through dynamic token and API control, realize business layer security isolation, which can specifically include the following steps:

[0176] S51, create a secure communication channel to provide confidentiality and integrity protection for business data.

[0177] The client establishes an IPSec VPN tunnel with the secure communication platform, and uses the SM4 algorithm to encrypt the data packet.

[0178] Integrity protection is applied to prevent data tampering by generating a message authentication code (MAC) through the SM3 hash algorithm.

[0179] The link alive detection mechanism periodically refreshes the session key to avoid risks caused by long-term connections.

[0180] Step S51 creates a secure communication channel to provide confidentiality and integrity protection for business data. The connection service ensures reliable transmission.

[0181] S52, based on user, device, application and context attributes, dynamically authorizes business resource access permissions, and realizes four-level management and control of devices, users, applications and APIs.

[0182] The trusted management and control platform implements the ABAC model to analyze policy rules (such as "only allow finance department users to access the OA system from trusted devices").

[0183] Generate a short-term access token (JWT format) containing permission scope and timestamp, verified by API gateway.

[0184] Support real-time revocation of permissions, such as detecting abnormal behavior and invalidating related tokens immediately.

[0185] S53, business application interface security management and control.

[0186] API gateway verifies the signature and permissions of the request token, and uses the OAuth 2.0 protocol to manage the authorization process.

[0187] Implement rate limiting and anomaly detection, such as frequent access triggering secondary authentication.

[0188] Key API calls require attestation evidence generated by TPM to prove that the terminal environment is trusted.

[0189] The role of step S53 is to protect business application interfaces (APIs) from unauthorized access and ensure the security of business interactions. Interface management and control is the last line of defense for application layer security.

[0190] Step S6, through real-time behavior monitoring, risk analysis and policy adjustment, realizes adaptive security loop.

[0191] In this embodiment, step S6, through real-time behavior monitoring, risk analysis and policy adjustment, realizes adaptive security loop can specifically include the following steps:

[0192] S61, monitor user operations, device status and application activities, collect behavior data for risk analysis.

[0193] The security agent collects behavior logs (such as login time, file access records), and transmits them to the security information and event management (SIEM) system in encrypted form.

[0194] Anomaly patterns such as irregular time access or bulk data download are detected using machine learning algorithms (such as Isolation Forest).

[0195] The TPM provides a hardware-level audit log, ensuring that the log is tamper-proof.

[0196] Step S61 monitors user operations, device status and application activities, and collects behavior data for risk analysis. Monitoring is the basis for dynamic policies.

[0197] S62, according to the risk score, real-time adjustment of access rights.

[0198] The trusted management platform integrates a risk engine to calculate entity risk values (such as the number of device vulnerabilities and user behavior deviations) and outputs policy change instructions.

[0199] Automatic policy updates are issued to network access gateways and API gateways, such as downgrading permissions or forcing logout.

[0200] Manual intervention is supported, and administrators can adjust policies based on alerts.

[0201] Step S62 adjusts access rights in real time according to the risk score, enabling continuous verification and dynamic authorization. Policy adjustment ensures timely security response.

[0202] S63, security event response and audit.

[0203] An incident response process is established to automatically trigger actions (such as isolating devices) and notify administrators.

[0204] Audit logs are signed and stored using national encryption algorithms to ensure non-repudiation and comply with the level of protection standard.

[0205] Regular security reports are generated to analyze threat trends and optimize policy rules.

[0206] Step S63 is to quickly respond to security events (such as intrusion attempts) and record full-process audit logs to meet compliance requirements. Response and audit form a security closed loop.

[0207] Step S6 is adopted to break the static mode of one-time authentication and lifelong trust through dynamic control.

[0208] Figure 4 is a schematic diagram of a railway ticket business trusted access application scenario using the terminal security access control method of the present application. Figure 4As shown, the business terminal trusted access universality security problem, trusted access controller assumes the function of network access gateway, ensure that no trust end entity and the network internal security of the most fundamental and most important defense.

[0209] In the railway ticket system, there are gate machines, automatic ticket machines and other passenger self-service terminals, which are also the entry point of network attack. It is difficult to implement security protection measures on the terminal. Window ticket sales is also a Windows operating system, and it is also difficult to implement high-level security protection.

[0210] The network controller is used for security access authentication and security detection of business terminals, self-service terminals, Internet of Things terminals and the like, to ensure safe access and trusted access to the network of end entities and prevent illegal terminal access.

[0211] The business terminal and the network controller information fingerprint perform joint door knocking authentication. After authentication, the business terminal can access the network in a trusted manner, and a secure channel is established through the trusted controller, so that a secure communication channel for data transmission is established between the controlled end entity and the service network.

[0212] First, the end entity of the configurable trusted security management and control agent performs joint access authentication with the trusted access controller. If the authentication is successful, the business channel of the controlled terminal is opened, otherwise it is not opened, and all business packets are discarded.

[0213] Second, the application program of the controlled end entity calls the security signature interface to sign the business data, encapsulates the protocol, and then sends it to the controller. The controller parses the received data, discards the data that does not comply with the protocol, and verifies the legal data.

[0214] Third, the trusted access controller forwards the business data to the security channel after successful verification, and sends it to the security management and control platform / proximity controller for verification and decryption, and finally forwards it to the core network front-end server.

[0215] Fourth, the trusted access controller is responsible for auditing business data and reporting user operation records to the log audit server. The log audit server provides a user interface audit query function.

[0216] Fifth, the trusted access controller is deployed at the business terminal access network and is used for trusted access of business terminals or self-service terminals such as IP broadcast, boot terminal, and supports device authentication, data signing and verification, dynamic access control and trusted intelligent connection.

[0217] Sixth, it supports anomaly detection and prevention, has efficient detection of zombie worms, anomaly traffic detection and early warning, and includes detection and early warning of threat behaviors such as malicious attacks, illegal external connection, abnormal protocols, DDoS behaviors, weak password scanning and brute force cracking.

[0218] At the same time, support threshold and baseline-based traffic alarm strategy, provide sensitive domain name, combined feature value and alarm mode.

[0219] Seventh, support YD-SOMN security management protocol, including management protocol cluster, control protocol cluster, configuration protocol cluster, event and early warning protocol cluster, security device management protocol cluster and third party system security interconnection protocol cluster.

[0220] Seventh, security guarantee and trusted verification, including identity authentication, access control, security audit, trusted path, software fault tolerance, intrusion detection and data security.

[0221] Figure 5 It is a schematic diagram of a ticket business terminal implementing a trusted computing environment by applying the terminal security access control method. Figure 5 As shown, the ticket business terminal is installed with a trusted management and control agent, configured with a double card and double digital certificate smart card, and implements a trusted computing environment of the controlled terminal.

[0222] The controlled business terminal, such as a station window terminal of a station ticket system and a dedicated line sales point terminal, implements a trusted management and control agent (with a smart card) + a trusted access management and control device, and the controlled terminal implements a trusted computing environment.

[0223] Dual Ukey (node card / user card), used for user authorization on the device, supports dual certificates, including signature certificates and encryption certificates; supports dual keys (without card) signature keys and encryption keys, which can meet different requirements of the commercial secret for the life cycle and backup of the encryption / decryption (SM1 / SM4 / SM7) and signature / verification (SM2 / SM3) keys.

[0224] The trusted management and control agent APP of the controlled terminal is used for security prevention and control of the controlled terminal, implements an IP security access whitelist mechanism, and through a zero-trust five-tuple strong authentication mode, including user authentication, device authentication, operating system authentication, service authentication and communication channel authentication, after authentication, network connection and business passage permission are enabled.

[0225] The trusted access controller is used for a dynamic authentication mode of "authentication first and network connection later", including the joint information fingerprint of the trusted management and control agent APP + (small box): "IP+MAC+time+location" knock authentication, and after the network (TCP) connection is opened.

[0226] End entity five tuple strong authentication, including end entity information fingerprint: computer name, computer hardware feature code, computer domain, operating system, operating system version, running process, business application (application service process, port), network (IP, MAC, DNS resolution), user (user ID + account + validity period), generate DNA algorithm, that is, Hash (information digest) algorithm or MD5 algorithm, after authentication, issue a pass permit.

[0227] Figure 6 is a client and platform challenge-response authentication flowchart of the terminal security access control method of the application. As shown in Figure 6 , the device makes an authentication request to the trusted authentication platform, the trusted authentication platform queries whether the device node information exists, if the device basic information exists, the request device is trusted.

[0228] The trusted authentication platform configures a confidential machine to randomly generate 64 bytes of data or other lengths, and sends a challenge request to the device.

[0229] The device side combines the device node ID and the random number, and uses the agreed hash algorithm (SM3) to generate a string as a response.

[0230] The trusted authentication platform compares the response string with the result calculated by itself, if they are the same, the authentication is passed, otherwise the authentication is failed.

[0231] First step, the device requests authentication.

[0232] The device sends the challenge request (message) to the trusted authentication platform (uplink).

[0233] Second step, the trusted authentication platform initiates the challenge question.

[0234] The trusted authentication platform checks the request parameters (mainly the device basic information). The trusted authentication platform sends a 64-bit random string to the device (downlink).

[0235] Third step, the device responds.

[0236] The device calculates MD5 on the downlink question of the trusted authentication platform, adds the node ID and device attribute field, and sends the random number to the trusted authentication platform.

[0237] Fourth step, the trusted authentication platform confirms the response result.

[0238] The trusted authentication platform compares the response string with the result calculated by itself, if they are the same, the authentication is passed; otherwise the authentication is failed.

[0239] By the five-tuple dynamic authentication of user identity, terminal device, application, network communication channel, terminal device running environment, and real-time detection and verification combination, and supporting device-user-application-API fine-grained authorization, dynamic control based on behavior, effectively solve the single authentication dimension, coarse-grained authorization, and dynamic control missing problems in the existing terminal access control, the beneficial effects are as follows:

[0240] First, the reliability is improved through double authentication: the user identity authentication of the controlled end Ukey smart card is combined with the central platform authentication and verification of the trusted control component (TPM), the single authentication defect that only recognizes the device and not the person, only recognizes the person and not the device is solved, and it is ensured that the access terminal is trusted, the device is trusted, the application is trusted, and the network communication is trusted;

[0241] Second, fine-grained authorization covers all dimensions: four-level permission control of device, user, application and API is realized, permission over-allocation is avoided, and the principle of least privilege is met;

[0242] Third, dynamic control conforms to the zero trust concept: based on entity behavior, real-time adjustment of access permission is realized, the traditional static mode of one-time authentication lifelong trust is broken, and continuous verification, dynamic authorization and rapid response are realized;

[0243] Fourth, full-link security can be provided: user identity information, platform proof data and behavior monitoring data are encrypted and transmitted and stored by using national secret algorithm, and the permission token is built-in with an effective period and anti-fake verification, to prevent data leakage and token forgery.

[0244] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in a distributed computing environment, in which tasks are performed by remote processing devices connected by a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0245] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by computer readable instructions instructing related hardware, and the computer readable instructions can be stored in a computer readable storage medium. When the program is executed, the processes of the above-mentioned embodiments of each method can be included. The storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0246] It should be understood that, although each step in the flowchart of the accompanying drawings is shown in sequence according to the direction of the arrow, these steps are not necessarily executed in sequence according to the direction of the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and they can be executed in other sequences. Moreover, at least part of the steps in the flowchart of the accompanying drawings can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence is not necessarily sequential, but can be alternately executed with at least part of other steps or sub-steps or stages of other steps.

[0247] Embodiment two

[0248] Further reference Figure 7 , as an implementation of the above-mentioned Figure 1 method, the present application provides an embodiment of a terminal security access control device, which corresponds to the method embodiment shown in Figure 1 , and the device can be applied to various electronic devices.

[0249] As shown in Figure 7 , the terminal security access control device 70 of the present embodiment includes a deployment module 71, a registration module 72, a verification module 73, an authentication module 74, an establishment module 75, and a monitoring module 76. Among them:

[0250] The deployment module 71 is configured to deploy the infrastructure of terminal security access, and the infrastructure includes a client, a security system, and a server component;

[0251] The registration module 72 is configured to perform initial registration of the terminal device, and to realize unique binding of the terminal identity and loading of the basic security policy by collecting device fingerprints, issuing certificates, and configuring policies;

[0252] The verification module 73 is configured to verify the user identity and the device credibility in real time through a multi-factor dynamic authentication mechanism;

[0253] The authentication module 74 is used to authenticate applications and network communications through signature verification and encrypted transmission, ensuring the legitimacy of applications, the security of communication channels, and the trustworthiness of the operating environment;

[0254] Module 75 is established to establish a trusted connection after successful authentication and implement fine-grained authorization to ensure the principle of least privilege for business access. Through dynamic tokens and API control, it achieves secure isolation of the business layer.

[0255] The monitoring module 76 is used to achieve an adaptive security closed loop through real-time behavior monitoring, risk analysis, and strategy adjustment.

[0256] The beneficial effects of implementing this embodiment are:

[0257] Firstly, credibility is enhanced through dual authentication: the user identity authentication of the controlled terminal Ukey smart card is combined with the central platform authentication and verification of the Trusted Management and Control Component (TPM) to solve the single authentication defects of recognizing only the device and not the person or only the person and not the device, and to ensure that the access terminal is trustworthy in terms of the person, the device, the application, and the network communication.

[0258] Secondly, fine-grained authorization covers all dimensions: it realizes four-level permission control of device, user, application and API, avoids excessive allocation of permissions and meets the principle of least privilege;

[0259] Third, dynamic management aligns with the zero-trust principle: it adjusts access permissions in real time based on entity behavior, breaking the traditional static model of one-time authentication and lifelong trust, and achieving continuous verification, dynamic authorization, and rapid response;

[0260] Fourth, it can provide full-chain security protection: user identity information, platform certification data, and behavior monitoring data are all encrypted and transmitted and stored using national cryptographic algorithms. At the same time, the permission token has a built-in validity period and anti-counterfeiting verification to prevent data leakage and token forgery.

[0261] Example 3

[0262] To address the aforementioned technical problems, embodiments of the present invention also provide a computer device. Please refer to [link / reference needed]. Figure 8 , Figure 8 This is a basic structural block diagram of the computer device in this embodiment.

[0263] The computer device 8 includes a memory 81, a processor 82, and a network interface 83, which are communicatively connected via a system bus. It should be noted that the computer device 8 is shown with the components memory 81, processor 82, and network interface 83, but it should be understood that not all of the illustrated components need be implemented, and that more or fewer components can alternatively be implemented. As will be understood by one skilled in the art, the computer device is a device that can automatically process data and / or information according to pre-set or stored instructions, and its hardware includes, but is not limited to, a microprocessor, an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), an embedded device, etc.

[0264] The computer device can be a desktop computer, a notebook computer, a palm computer, a cloud server, or the like. The computer device can interact with a user through a keyboard, a mouse, a remote controller, a touchpad, a voice control device, or the like.

[0265] The memory 81 includes at least one type of readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, or the like. In some embodiments, the memory 81 can be an internal storage unit of the computer device 8, such as a hard disk or a memory of the computer device 8. In other embodiments, the memory 81 can also be an external storage device of the computer device 8, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, or the like. Of course, the memory 81 can include both an internal storage unit and an external storage device of the computer device 8. In this embodiment, the memory 81 is generally used to store an operating system and various application software installed in the computer device 8, such as computer readable instructions of the terminal security access control method, etc. In addition, the memory 81 can also be used to temporarily store various data that has been output or will be output.

[0266] The processor 82 in some embodiments can be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 82 is generally used to control the overall operation of the computer device 8. In the present embodiment, the processor 82 is used to run computer readable instructions or process data stored in the memory 81, for example, computer readable instructions of the terminal security access control method.

[0267] The network interface 83 can include a wireless network interface or a wired network interface, and the network interface 83 is generally used to establish a communication connection between the computer device 8 and other electronic devices.

[0268] The present embodiment is implemented, and the beneficial effects are:

[0269] First, the credibility is improved through double authentication: the user identity authentication of the controlled end Ukey smart card is combined with the center platform authentication and verification of the trusted management component (TPM), solving the single authentication defects of only recognizing the device and not recognizing the person, only recognizing the person and not recognizing the device, and ensuring that the access terminal is trusted, the device is trusted, the application is trusted, and the network communication is trusted.

[0270] Second, fine-grained authorization covers all dimensions: four-level permission management and control of devices, users, applications, and APIs are achieved, avoiding excessive allocation of permissions and meeting the principle of least privilege.

[0271] Third, dynamic management conforms to the zero trust concept: based on entity behavior, real-time adjustment of access permissions is realized, breaking the traditional static mode of one-time authentication and lifelong trust, and realizing continuous verification, dynamic authorization, and rapid response.

[0272] Fourth, it can provide full-link security protection: user identity information, platform proof data, and behavior monitoring data are encrypted for transmission and storage using national encryption algorithms, and the permission token has a built-in validity period and anti-fake verification to prevent data leakage and token forgery.

[0273] Embodiment Four

[0274] The present application also provides another implementation, that is, a computer readable storage medium storing computer readable instructions, which can be executed by at least one processor to make the at least one processor execute the steps of the terminal security access control method as described above.

[0275] The present embodiment is implemented, and the beneficial effects are:

[0276] First, improve credibility through dual authentication: combine the user identity authentication of the controlled end Ukey smart card with the central platform authentication and verification of the trusted management component (TPM), solve the single authentication defects of only recognizing devices and not people, only recognizing people and not devices, and ensure that the access terminal is people, devices, applications, and network communication are trusted;

[0277] Second, fine-grained authorization covers all dimensions: implement device, user, application, and API four-level permission management, avoid excessive allocation of permissions, and meet the principle of least privilege;

[0278] Third, dynamic management conforms to the concept of zero trust: based on entity behavior, real-time adjustment of access permissions, breaking the traditional static mode of one-time authentication and lifelong trust, realizing continuous verification, dynamic authorization, and rapid response;

[0279] Fourth, it can provide full-link security protection: user identity information, platform proof data, and behavior monitoring data are encrypted for transmission and storage using national encryption algorithms, and the permission token has a built-in validity period and anti-fake verification to prevent data leakage and token forgery.

[0280] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by means of software and the necessary general hardware platform, of course, they can also be realized by hardware, but in many cases the former is a better implementation. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a plurality of instructions for making a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) execute the various embodiment methods of the present application.

[0281] Obviously, the above-described embodiments are only some of the embodiments of the present application, not all the embodiments, and the preferred embodiments of the present application are given in the drawings, but do not limit the patent scope of the present application. The present application can be realized in many different forms, and on the contrary, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent replacements to some technical features. Any equivalent structure made by using the contents of the present application specification and drawings, directly or indirectly applied to other related technical fields, is also within the patent protection scope of the present application.

Claims

1. A terminal security access control method, characterized in that, Includes the following steps: Deploy infrastructure for secure terminal access, the infrastructure including client, security system and server components; The client and the server component collaborate to perform initial registration of the terminal device. The client collects the device fingerprint, and the server component issues certificates and configuration policies to achieve unique binding of the terminal identity and loading of basic security policies. The client, the security system, and the server components interact through a multi-factor dynamic authentication mechanism to verify user identity and device trustworthiness in real time. The client, the security system, and the server components interact through signature verification and encrypted transmission to authenticate applications and network communications, ensuring application legitimacy, communication channel security, and a trustworthy operating environment. After authentication by the security system, the client establishes a trusted connection with the server component, and the security system implements fine-grained authorization to ensure the principle of least privilege for business access. Through dynamic tokens and API control between the security system and the server component, business layer security isolation is achieved. The client, the security system, and the server components work together to achieve an adaptive security closed loop through real-time behavior monitoring, risk analysis, and policy adjustment.

2. The terminal security access control method according to claim 1, characterized in that, The steps for deploying the infrastructure for secure terminal access, wherein the infrastructure includes client, security system, and server components, specifically include: The security system deploys a five-tuple authentication system component, wherein the five-tuple includes user, device, application, network, and environmental parameters; The client performs the installation and configuration of the client security agent; The server-side components perform server-side resource preparation and strategy pre-configuration.

3. The terminal security access control method according to claim 1, characterized in that, The client and the server component collaborate to perform initial registration of the terminal device. The steps involved, including the client collecting the device fingerprint, the server component issuing certificates and configuring policies, to achieve unique binding of the terminal identity and loading of basic security policies, specifically include: The client device fingerprint is collected and registered by the client. The server-side component assigns dual SIM cards and dual certificates to the user to achieve a strong binding between the identity and the device. The dual SIM cards and dual certificates include a user certificate and a device certificate. The security system sets the initial access control policy to ensure that terminal access follows the principle of least privilege.

4. The terminal security access control method according to claim 1, characterized in that, The interaction between the client, the security system, and the server components, through a multi-factor dynamic authentication mechanism, specifically includes the following steps for real-time verification of user identity and device trustworthiness: The user's identity is dynamically authenticated through interaction between the client, the security system, and the server components. Perform dynamic certification and verification on the equipment; Dynamically adjust user permission scope based on user role, device type, and access context.

5. The terminal security access control method according to claim 1, characterized in that, The interaction between the client, the security system, and the server components involves signature verification and encrypted transmission to authenticate application and network communication, ensuring application legitimacy, communication channel security, and a trustworthy operating environment. The specific steps include: The application dynamic authentication and verification are performed through the interaction of the client, the security system, and the server components. Dynamic authentication of network communication channels; Perform trustworthiness authentication on the operating environment of the device terminal.

6. The terminal security access control method according to claim 1, characterized in that, After authentication by the security system, the client establishes a trusted connection with the server component, and the security system implements fine-grained authorization to ensure the principle of least privilege for business access. The steps to achieve secure isolation of the business layer through dynamic tokens and API control by the security system and the server component specifically include: The server-side component creates a secure communication channel to provide confidentiality and integrity protection for business data; The security system dynamically authorizes access permissions for business resources based on user, device, application, and context attributes, achieving four-level control over devices, users, applications, and APIs. The server-side component performs security management of business application interfaces.

7. The terminal security access control method according to any one of claims 1 to 6, characterized in that, The steps for achieving an adaptive security closed loop through real-time behavior monitoring, risk analysis, and policy adjustment, in collaboration between the client, the security system, and the server components, specifically include: The client, the security system, and the server components work together to monitor user operations, device status, and application activities, and collect behavioral data for risk analysis. Access permissions are adjusted in real time based on risk scores; Conduct security incident response and auditing.

8. A terminal security access control device, characterized in that, include: The deployment module is used to deploy the infrastructure for secure terminal access, which includes client, security system and server components; The registration module is used for the client and the server component to cooperate in the initial registration of the terminal device. The client collects the device fingerprint, and the server component issues certificates and configuration policies to achieve unique binding of the terminal identity and loading of basic security policies. The verification module is used to verify the user's identity and device trustworthiness in real time through a multi-factor dynamic authentication mechanism in the interaction between the client, the security system, and the server components. The authentication module is used for the interaction between the client, the security system, and the server components to perform application and network communication authentication through signature verification and encrypted transmission, ensuring the legitimacy of the application, the security of the communication channel, and the trustworthiness of the operating environment; The module establishes a trusted connection between the client and the server component after the security system authenticates the client. The security system then implements fine-grained authorization to ensure the principle of least privilege for business access. Through dynamic tokens and API control between the security system and the server component, business layer security isolation is achieved. The monitoring module is used by the client, the security system and the server components to achieve an adaptive security closed loop through real-time behavior monitoring, risk analysis and policy adjustment.

9. A computer device, characterized in that, The device includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of the terminal secure access control method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the terminal security access control method as described in any one of claims 1 to 7.

Images