An automated VPN authentication method and system integrating OAuth and zero-trust architecture

Abstract

This application discloses an automated VPN authentication method and system integrating OAuth and zero-trust architecture, relating to the field of authentication technology. The automated VPN authentication method integrating OAuth and zero-trust architecture includes the following steps: S1: User authentication and authorization code transfer are performed based on OAuth 2.0 and OIDC protocols to obtain user identity information and a temporary access token; S2: Multidimensional data is acquired and analyzed in real time to obtain a trust score; S3: The trust score is analyzed to generate a trust assessment result, and an access policy is generated based on the trust assessment result; S4: A VPN connection is created according to the access policy, and the session state is monitored in real time. The VPN connection is terminated or rebuilt based on the monitored session state. This application improves the security, flexibility, and efficiency of network access.

Description

Technical Field

[0001] This application relates to the field of authentication technology, and in particular to an automated VPN authentication method and system that integrates OAuth and zero-trust architecture. Background Technology

[0002] In fields such as water environment management, the demand for network security and efficient data access is becoming increasingly prominent. Among these, VPN (Virtual Private Network) authentication is a key element in ensuring network access security.

[0003] However, current technical solutions in the field of water environment management rely on traditional knowledge base systems (i.e., question-and-answer systems based on keyword matching, such as environmental policy document retrieval tools), static data analysis tools (i.e., analysis tools that require manual operation and rely on expert experience to interpret data), general large model question-and-answer (i.e., directly calling existing models such as ChatGPT (chat generation pre-trained converter) to obtain answers, which lacks domain knowledge constraints and is prone to producing erroneous or irrelevant answers), and fixed rule engines (i.e., predefined "IF-THEN" rules to handle simple query tasks, which are difficult to deal with complex environmental problems such as multi-source pollution tracing).

[0004] Regarding VPN authentication mechanisms, traditional VPN authentication mechanisms have the following problems:

[0005] (1) Static passwords are easy to leak and pose security risks, and cannot meet the high requirements for data access security in scenarios such as water environment management.

[0006] (2) The network location-based trust model is difficult to meet the needs of mobile office and limits the flexible access of staff to water environment management data in different environments.

[0007] (3) The multi-factor authentication process is cumbersome, which affects user experience and reduces work efficiency.

[0008] (4) Unable to assess access risks in real time, lacking dynamic decision-making ability, and unable to respond in a timely manner to ensure security in the face of complex and ever-changing network environment and water environment management business needs.

[0009] Furthermore, while the OAuth 2.0 protocol is widely used in the authorization field, it has shortcomings in session management and device trust assessment in VPN authentication scenarios. Although the zero-trust architecture proposes the principle of "default distrust, always verify," existing implementations lack efficient automation mechanisms. Summary of the Invention

[0010] The purpose of this application is to provide an automated VPN authentication method and system that integrates OAuth and zero-trust architecture, thereby improving the security, flexibility and efficiency of network access.

[0011] To achieve the above objectives, this application provides an automated VPN authentication method integrating OAuth and a zero-trust architecture, comprising the following steps: S1: User authentication and authorization code transfer are performed based on OAuth 2.0 and OIDC protocols to obtain user identity information and a temporary access token; S2: Multidimensional data is acquired and analyzed in real time to obtain a trust score; wherein, the multidimensional data includes at least: user behavior data obtained based on user identity information, real-time collected device data, and environmental data; S3: The trust score is analyzed to generate a trust assessment result, and an access policy is generated based on the trust assessment result, wherein the trust assessment result is high trust, medium trust, or low trust; the access policy includes at least: permission level and session duration; S4: A VPN connection is created according to the access policy, and the session status is monitored in real time, and the VPN connection is terminated or rebuilt based on the real-time monitored session status.

[0012] As described above, the sub-steps for user authentication and authorization code transfer based on OAuth 2.0 and OIDC protocols to obtain user identity information and temporary access tokens are as follows: S11: Receive an authentication request sent by the client's third-party identity provider, wherein the authentication request includes at least: client ID, authorization scope, and callback address; S12: Combine the authentication request and pre-configured key information of the third-party identity provider, and construct a redirect URL according to the format required by the third-party identity provider; wherein the pre-configured key information of the third-party identity provider includes at least: authorization endpoint URL and pre-configured callback address; S13: Redirect to the login page of the third-party identity provider through the redirect URL, and after the third-party identity provider authenticates and generates an authorization code, receive the authorization code carried by the callback address in the authentication request; S14: Send a token exchange request to the third-party identity provider, and receive the access token and identity token, wherein the token exchange request carries the client ID, key, and authorization code;

[0013] S15: Verify the access token, and use the valid access token as a temporary access token; parse the identity token to obtain the user's identity information.

[0014] As described above, the sub-steps for acquiring multidimensional data and performing real-time analysis to obtain a trust score are as follows: S21: Obtain relevant user behavior data from the log system based on user identity information, collect device data in real-time from the terminal management tool, and obtain environmental data in real-time from the network layer, and use user behavior data, device data, and environmental data as multidimensional data; S22: Quantify the multidimensional data to obtain user behavior score, device status score, and environmental factor score; S23: Calculate the user behavior score, device status score, and environmental factor score using a multidimensional trust assessment model to obtain a trust score.

[0015] As mentioned above, the device status indicators in the device data include at least the following types: system security indicators, device health indicators, and network configuration indicators.

[0016] As mentioned above, the environmental indicators in the environmental data should include at least the following types: network environment type, IP region matching degree, time and location correlation, and login terminal compliance.

[0017] As shown above, the expression for the trust score is: Txrdf = μ U ×U+μ D ×D+μ E ×E; where Txrdf is the trust score; μ U μ D μ E μ is the weighting coefficient. U +μ D +μ E =1; U is the user behavior score; D is the device status score; E is the environmental factor score.

[0018] As described above, the steps for analyzing trust scores and generating trust assessment results are as follows: The trust score is judged using a preset first trust threshold and a second trust threshold, and a trust assessment result is generated. If the trust score is greater than or equal to the first trust threshold, the generated trust assessment result is high trust. If the trust score is less than the first trust threshold but greater than or equal to the second trust threshold, the generated trust assessment result is medium trust. If the trust score is less than the second trust threshold, the generated trust assessment result is low trust. The first trust threshold is greater than the second trust threshold.

[0019] As described above, the sub-steps for creating a VPN connection according to the access policy, monitoring the session status in real time, and terminating or rebuilding the VPN connection based on the real-time monitored session status are as follows: S41: Assign an encrypted tunnel to the client according to the access policy, bind the permission scope according to the access policy, and record the session ID; S42: Monitor the session status in real time, continuously synchronize the trust score and the status of the temporary access token. If the trust score decreases and / or the temporary access token expires or is revoked, trigger the session termination process, automatically disconnect the VPN connection, release resources, and execute S43; S43: Send a VPN rebuild command and re-execute steps S1-S3.

[0020] This application also provides an automated VPN authentication system integrating OAuth and zero-trust architecture, comprising: a client and an authentication center; wherein, the client is configured with a third-party identity provider; and the authentication center is used to perform the aforementioned automated VPN authentication method integrating OAuth and zero-trust architecture.

[0021] As described above, the authentication center includes at least the following modules: an OAuth authentication module, a zero-trust assessment engine, an automated decision-making module, and a VPN session management module. The OAuth authentication module performs user authentication and authorization code transfer based on OAuth 2.0 and the OIDC protocol to obtain user identity information and temporary access tokens. The zero-trust assessment engine acquires multi-dimensional data and performs real-time analysis to obtain a trust score. The automated decision-making module analyzes the trust score, generates a trust assessment result, and generates an access policy based on the trust assessment result. The VPN session management module creates VPN connections according to the access policy, monitors the session status in real-time, and terminates or re-establishes the VPN connection based on the monitored session status.

[0022] The beneficial effects achieved by this application are as follows:

[0023] (1) The automated VPN authentication method and system integrating OAuth and zero trust architecture of this application can effectively solve the problems of low security, low adaptability, poor user experience and lack of dynamic decision-making of traditional VPN authentication, and improve the security, flexibility and efficiency of network access.

[0024] (2) The automated VPN authentication method and system integrating OAuth and zero trust architecture of this application, with the help of automation mechanism and multi-dimensional evaluation, makes VPN authentication more adaptable to complex business needs, ensures the security and convenience of data access, and helps to carry out management work (e.g., water environment management work) efficiently. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0026] Figure 1 A schematic diagram of the structure of an embodiment of an automated VPN authentication system integrating OAuth and zero-trust architecture;

[0027] Figure 2 A flowchart of one embodiment of an automated VPN authentication method integrating OAuth and a zero-trust architecture. Detailed Implementation

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] like Figure 1 As shown, this application provides an automated VPN authentication system integrating OAuth and zero-trust architecture, including: client 1 and authentication center 2.

[0030] Client 1: has a third-party identity provider configured.

[0031] Authentication Center 2: Used to perform the automated VPN authentication method described below, which integrates OAuth and zero-trust architecture.

[0032] Specifically, third-party identity providers are platforms that offer identity authentication services in compliance with the OAuth 2.0 standard. Third-party identity providers include at least general-purpose platforms and enterprise-level platforms.

[0033] Among them, the general-purpose platform supports both personal and enterprise-level identity authentication, and includes at least: Google, Apple ID, Microsoft Azure AD, and Facebook Meta.

[0034] Enterprise-level platforms provide identity management services for enterprises, support integration with enterprise intranet systems, and are suitable for enterprise user scenarios. Enterprise-level platforms include at least: Okta, Ping Identity, Auth0, WeChat Open Platform, Alipay Open Platform, and Baidu Account System.

[0035] Furthermore, client 1 can be a personal computer (e.g., desktop computer and laptop computer), mobile device (e.g., mobile phone and tablet) and other network-accessible terminals (e.g., dedicated office equipment).

[0036] Furthermore, Authentication Center 2 includes at least: an OAuth authentication module, a zero-trust assessment engine, an automated decision-making module, and a VPN session management module.

[0037] The OAuth authentication module uses OAuth 2.0 and the OIDC protocol (Open ID Connection Protocol) to authenticate users and transfer authorization codes, thereby obtaining user identity information and temporary access tokens.

[0038] Zero Trust Assessment Engine: Acquires multidimensional data and performs real-time analysis on the multidimensional data to obtain a trust score; the multidimensional data includes at least: user behavior data obtained based on user identity information, real-time collected device data, and environmental data.

[0039] Automated decision-making module: Analyzes trust scores, generates trust assessment results, and generates access policies based on the trust assessment results. The access policies include at least: permission level and session duration.

[0040] VPN Session Management Module: Creates VPN connections based on access policies, monitors session status in real time, and terminates or rebuilds VPN connections based on the monitored session status.

[0041] like Figure 2 As shown, this application provides an automated VPN authentication method integrating OAuth and zero-trust architecture, including the following steps:

[0042] S1: Based on OAuth 2.0 and OIDC protocols, user authentication and authorization code transfer are performed to obtain user identity information and temporary access tokens.

[0043] Specifically, the OAuth authentication module uses the OAuth 2.0 and OIDC protocols to perform user authentication and authorization code transfer, which solves the problems of easy leakage of static passwords and cumbersome multi-factor authentication processes in traditional VPN authentication, thereby improving authentication security and simplifying the authentication process.

[0044] Furthermore, as an example, the sub-steps for obtaining user identity information and temporary access tokens based on OAuth 2.0 and OIDC protocols for user authentication and authorization code transfer are as follows:

[0045] S11: Receive an authentication request sent by the client's third-party identity provider, wherein the authentication request includes at least: client ID, authorization scope, and callback address.

[0046] Specifically, users send authentication requests to the OAuth authentication module by clicking on a third-party identity provider (such as WeChat) through the client.

[0047] The client ID is a unique identifier registered by the user with a third-party identity provider, used to identify the source of the request.

[0048] The scope of authorization is a parameter in the OAuth 2.0 protocol used to limit the permissions a client can obtain user resources. It defines the scope of permissions a client can request to access user information or functions from a third-party identity provider.

[0049] The callback address is pre-configured on the client side.

[0050] S12: Combine the authentication request and the pre-configured key information of the third-party identity provider, and construct the redirect URL in the format required by the third-party identity provider; wherein the pre-configured key information of the third-party identity provider includes at least: the authorization endpoint URL and the pre-configured callback address.

[0051] Specifically, the OAuth authentication module constructs a redirect URL based on the authentication request and pre-configured key information of the third-party identity provider, which is used to redirect the user to the third-party identity provider's login page.

[0052] The authorization endpoint URL is the login page address provided by the third-party identity provider.

[0053] The pre-configured callback address is: the callback URL registered by the user with the third-party identity provider, which is used by the third-party identity provider to verify the legitimacy of the redirection.

[0054] S13: Redirect to the login page of the third-party identity provider via the redirect URL. After the third-party identity provider authenticates the user and generates an authorization code, receive the authorization code carried in the callback address in the authentication request.

[0055] Specifically, the user enters credentials (such as password or biometrics) on the third-party identity provider's page. After the third-party identity provider verifies the credentials, it generates an authorization code and redirects the user to the callback address in the authentication request, along with the authorization code. The OAuth authentication module receives the authorization code through the callback address in the authentication request.

[0056] S14: Send a token exchange request to a third-party identity provider and receive an access token and an identity token. The token exchange request carries the client ID, key, and authorization code.

[0057] Specifically, after receiving the token exchange request, the third-party identity provider verifies the client ID, key, and authorization code. If the client ID matches the unique identifier registered with the third-party identity provider, the key matches, and the authorization code is valid (i.e., the authorization code has not been used or expired), then an access token and an identity token are generated and sent to the OAuth authentication module.

[0058] The access token must include at least the following: authorization scope information.

[0059] An identity token is generated based on the OIDC protocol, and the identity token contains the user's identity information.

[0060] S15: Verify the access token, and use the valid access token as a temporary access token; parse the identity token to obtain the user's identity information.

[0061] Specifically, the validity of the access token is verified through the OAuth authentication module. If the signature verification of the access token passes, it has not expired, and the issuer matches the audience, then the access token is deemed valid.

[0062] The identity token is a JWT format token defined by the OIDC protocol, which can be parsed to directly obtain the user's identity information.

[0063] User identity information is used to bind users or internal user systems within an enterprise (e.g., mapped to employee ID numbers).

[0064] Furthermore, as another embodiment, the multi-factor authentication process for user authentication and authorization code transfer based on OAuth 2.0 and the OIDC protocol is as follows:

[0065] Python

[0066] run

[0067] defmulti_factor_authentication(user_id,credentials,device_info):

[0068] #Step 1: Verify the master certificate

[0069] ifnot verify_primary_credentials(user_id,credentials):

[0070] return False, "Authentication failed"

[0071] #Step 2: Device Trust Assessment

[0072] device_risk=evaluate_device_trust(device_info)

[0073] #Step 3: Risk-based multi-factor decision making

[0074] if device_risk>HIGH_RISK_THRESHOLD:

[0075] return send_mfa_challenge(user_id,SMS_OTP)

[0076] #Step 4: Environmental Risk Assessment

[0077] if evaluate_environment_risk()>MEDIUM_RISK_THRESHOLD:

[0078] return send_mfa_challenge(user_id,BIOMETRIC)

[0079] return True, "Authentication successful"

[0080] Specifically, the multi-factor authentication process addresses the security shortcomings of traditional single-factor authentication through master credentials, dynamic risk assessment, and layered verification, thereby improving the security of identity authentication, balancing security and user experience, and providing a foundation for dynamic authorization.

[0081] S2: Acquire multidimensional data and perform real-time analysis on the multidimensional data to obtain a trust score; wherein, the multidimensional data includes at least: user behavior data obtained based on user identity information, real-time collected device data, and environmental data.

[0082] Specifically, the zero-trust assessment engine analyzes multi-dimensional data, including user behavior data, device data, and environmental data, in real time to obtain a trust score, thus making up for the shortcomings of traditional trust models.

[0083] Furthermore, the sub-steps for acquiring multidimensional data and performing real-time analysis to obtain a trust score are as follows:

[0084] S21: Obtain relevant user behavior data from the log system based on user identity information, collect device data in real time from the terminal management tool, obtain environmental data in real time from the network layer, and use user behavior data, device data, and environmental data as multi-dimensional data.

[0085] Specifically, user behavior data consists of user behavior metrics collected through a log system. These metrics include at least: historical login time, accessed resource type, and operation frequency (e.g., whether sensitive resources are accessed frequently outside of working hours). User identity information is associated with the user behavior data. The log system is deployed on the client side.

[0086] Device data refers to device status indicators obtained through endpoint management tools (such as MDM systems). These indicators must include at least the following types: device compliance information (e.g., whether antivirus software is installed, whether the device is rooted / jailbroken, and system patch versions). The endpoint management tool is deployed on or communicates with the client to obtain device data.

[0087] Environmental data refers to environmental indicators obtained through the network layer. The types of environmental indicators include at least: login IP address (corresponding geographical location), network environment type (e.g., public network / internal network), and access time.

[0088] S22: Quantify multidimensional data to obtain user behavior scores, device status scores, and environmental factor scores.

[0089] Furthermore, as an example, the expression for user behavior score is:

[0090]

[0091] Where U represents the user behavior score; a i ω represents the score of the i-th user behavior metric in the user behavior data. i a is the base weight for the i-th user behavior metric; j Let r be the score of the j-th user behavior metric in the user behavior data; ij Let be the risk correlation coefficient between the i-th user behavior indicator and the j-th user behavior indicator; i∈[1,I], where I is the total number of user behavior indicators in the user behavior data.

[0092] Specifically, the content of user behavior metrics is set according to the actual situation, and the specific score of user behavior metrics is set according to the degree of deviation from the historical baseline, the baseline of job authority, and the degree of risk. The greater the deviation, the lower the score.

[0093] For example: When the user behavior metric type is login behavior, if the specific content of the user behavior metric is logging in during working hours, and the specific content of the user behavior metric fully conforms to the historical baseline (e.g., logging in between 9:00 and 18:00), then the user behavior metric score is 1; if the specific content of the user behavior metric is logging in outside working hours (e.g., at 2:00 AM), and the specific content of the user behavior metric is a slight deviation from the historical baseline with low risk, then the user behavior metric score is 0.8; if the specific content of the user behavior metric is logging in more than twice the historical average number of times in a single day, and the specific content of the user behavior metric is a moderate deviation from the historical baseline with possible abnormal operations, then the user behavior metric score is 0.6; if the specific content of the user behavior metric is multiple logins from a different IP address in a short period of time (e.g., 3 logins within one hour), and the specific content of the user behavior metric is a serious deviation from the historical baseline with a risk of account theft, then the user behavior metric score is 0.3.

[0094] When the user behavior metric type is resource access (access to resource type), if the specific content of the user behavior metric is access to daily work resources and the specific content of the user behavior metric fully conforms to the job permission baseline, then the user behavior metric score is 1; if the specific content of the user behavior metric is first-time access to low-sensitivity resources (e.g., public document library) and the specific content of the user behavior metric is slightly deviating from the job permission baseline, then the user behavior metric score is 0.7; if the specific content of the user behavior metric is access to non-sensitive cross-departmental resources (e.g., announcements from other departments) and the specific content of the user behavior metric is moderately deviating from the job permission baseline, then the user behavior metric score is 0.5; if the specific content of the user behavior metric is first-time access to high-sensitivity resources (e.g., core code repository) and the specific content of the user behavior metric is seriously deviating from the job permission baseline, then the user behavior metric score is 0.2.

[0095] When the user behavior metric type is operational risk (operation frequency), if the specific content of the user behavior metric is a routine operation (e.g., viewing or editing personal data) and the specific content of the user behavior metric is a risk-free operation, then the score of the user behavior metric is 1; if the specific content of the user behavior metric is downloading a small amount of data in batches (e.g., less than or equal to 100 records), the specific content of the user behavior metric is a low-risk operation that meets daily needs, then the score of the user behavior metric is 0.8; if the specific content of the user behavior metric is downloading a large amount of data in batches (e.g., more than 500 records), the specific content of the user behavior metric is a medium-risk operation that may involve data leakage, then the score of the user behavior metric is 0.4; if the specific content of the user behavior metric is performing a high-risk operation (e.g., deleting shared data or modifying permissions), the specific content of the user behavior metric is a serious risk that requires real-time alerts, then the score of the user behavior metric is 0.1.

[0096] The basic weights of user behavior metrics include at least: login behavior weight, resource access weight, and operational risk weight. The specific values ​​of these basic weights are set according to actual circumstances; in this application, the preferred value is: login behavior weight + resource access weight + operational risk weight = 1. The login behavior weight is 0.3, the resource access weight is 0.4, and the operational risk weight is 0.3.

[0097] The risk correlation coefficient r between the i-th user behavior indicator and the j-th user behavior indicator ij The risk correlation coefficient r is set based on the actual risk superposition effect of the indicator combination. The closer the correlation (i.e., the higher the risk when they occur simultaneously), the higher the risk correlation coefficient r. ij The larger the value, the higher the risk of data leakage. For example, if logins and bulk downloads of large amounts of data occur simultaneously during off-peak hours, the risk of data leakage increases significantly, indicating a high correlation with a risk correlation coefficient r. ij =0.2; The simultaneous occurrence of login from a different IP address and first-time access to highly sensitive resources increases the risk of account theft, indicating a high correlation, with a risk correlation coefficient r. ij =0.18; The simultaneous occurrence of abnormal daily login frequency and execution of high-risk operations may indicate malicious attempts to gain access, with a medium correlation and a risk correlation coefficient r. ij =0.15; The simultaneous occurrence of logins outside of working hours and access to daily resources indicates a low risk and a low correlation, with a risk correlation coefficient r. ij =0.05; Login and access to regular resources during work hours fully comply with the baseline, with no additional risks, the correlation is 0, and the risk correlation coefficient r ij =0.

[0098] Furthermore, if high-risk indicators exist, such as rooting / jailbreaking, then the device status score D = 0; if no high-risk indicators exist, then the expression for the device status score D is:

[0099]

[0100] Among them, b n This is the score of the nth device status indicator in the device data; Xxs is the geometric mean of all equipment status indicators; n∈[1,N], where N is the total number of equipment status indicators in the equipment data.

[0101] Specifically, the value of Xxs is set according to the actual situation. In this application, it is preferred that if there are more than three b... n If <0.5, then Xxs = 0.8; if there exist three b less than or equal to b... n If <0.5, then Xxs = 1.

[0102] The specific content and values ​​of device status indicators are designed based on device security, stability, and compliance. Among these, the types of device status indicators in the device data should at least include: system security indicators, device health indicators, and network configuration indicators.

[0103] For example: When the device status indicator is classified as a system security indicator, the following specific content indicates a high-risk status: Root / jailbroken state exists, resulting in D=0; No root / jailbroken state exists, resulting in a score of 1; Virus database expired for 1 day, resulting in a score of 0.7; Virus database expired for 3 days, resulting in a score of 0.5; Virus database expired for more than 7 days, resulting in a score of 0.3; Virus database updated normally, resulting in a score of 1; Missing critical patches, resulting in a score of 0.4; Missing non-critical patches, resulting in a score of 0.8; All patches are present, resulting in a score of 1.

[0104] When the device status indicator is classified as a device health indicator, the specific content of the device status indicator is as follows: if the remaining storage space is <10%, the device status indicator score is 0.6; if the remaining storage space is 10%-30%, the device status indicator score is 0.8; if the remaining storage space is >30%, the device status indicator score is 1; if the device mobile device battery health is <80%, the device status indicator score is 0.8; if the device mobile device battery health is ≥80%, the device status indicator score is 1.

[0105] When the device status indicator is classified as a network configuration indicator, the specific content of the device status indicator is as follows: firewall status is off, and the device status indicator score is 0.3; firewall status is on but rules are lenient, and the device status indicator score is 0.7; firewall status is on and rules are strict, and the device status indicator score is 1; unauthorized remote connection exists, and the device status indicator score is 0.2; no unauthorized remote connection exists, i.e., no anomaly, and the device status indicator score is 1.

[0106] The specific scenarios and values ​​of the multiple medium-risk correction coefficients are set based on experience with multiple medium-risk hazards overlapping and approaching high-risk levels, and can be adjusted according to the risk preferences of users or enterprises.

[0107] Furthermore, the expression for the environmental factor score is:

[0108]

[0109] Where E represents the environmental factor score; c m η represents the score of the m-th environmental indicator in the environmental data. m s represents the basic weight of the m-th environmental indicator; m Let m be the scenario coefficient of the m-th environmental indicator; m∈[1,M], where M is the total number of environmental indicators in the environmental data.

[0110] Specifically, the environmental metrics are designed around the security and compliance of the login scenario. Among them, the types of environmental metrics in the environmental data include at least: network environment type, IP region matching degree, time and location correlation, and login terminal compliance.

[0111] For example: when the environmental indicator type is network environment type, the specific content of the environmental indicator is enterprise intranet login, which belongs to the highest security level, and the environmental indicator score is 1; the specific content of the environmental indicator is enterprise VPN login, which belongs to high security, and the environmental indicator score is 0.9; the specific content of the environmental indicator is public network (such as: coffee shop WiFi) login, which belongs to medium risk, and the environmental indicator score is 0.6; the specific content of the environmental indicator is unknown network (no security verification) login, which belongs to high risk, and the environmental indicator score is 0.3.

[0112] When the environmental indicator type is IP region matching, the specific content of the environmental indicator is: if the IP address is consistent with the commonly used office area, the environmental indicator score is 1; if the specific content of the environmental indicator is that the IP address is in a different location, but in the branch office area of ​​the enterprise, the environmental indicator score is 0.8; if the specific content of the environmental indicator is that the IP address is in an unfamiliar region and is not a branch office, the environmental indicator score is 0.4; if the specific content of the environmental indicator is that the IP address is in a high-risk region (such as: sensitive overseas regions), the environmental indicator score is 0.1.

[0113] When the environmental indicator type is time and location correlation, the specific content of the environmental indicator is that the login time matches the IP's regional time zone (e.g., logging in with Beijing time from a domestic IP), and the environmental indicator score is 1; the specific content of the environmental indicator is that the time zone does not match, but there is a reasonable reason (e.g., having a business trip record across time zones), and the environmental indicator score is 0.7; the specific content of the environmental indicator is that the time zone does not match at all, and there is no record (e.g., logging in with domestic time from an overseas IP), and the environmental indicator score is 0.3.

[0114] When the environmental indicator type is login terminal compliance, the specific content of the environmental indicator is enterprise-certified device login, and the score of the environmental indicator is 1; the specific content of the environmental indicator is personal device but with security software installed, and the score of the environmental indicator is 0.8; the specific content of the environmental indicator is personal device and no security software installed, and the score of the environmental indicator is 0.5; the specific content of the environmental indicator is unauthorized device (such as: unregistered unfamiliar terminal), and the score of the environmental indicator is 0.2.

[0115] The basic weights of environmental indicators reflect their impact on overall environmental security. The specific values ​​of these basic weights are set according to actual circumstances. For example: the network is a fundamental security carrier and has a high weight; the basic weight for the environmental indicator corresponding to network environment type is 0.3. Regional anomalies are common risk signals; the basic weight for the environmental indicator corresponding to IP region matching degree is 0.3. Time-location correlation helps verify the rationality of regional risks; the basic weight for the environmental indicator corresponding to time-location correlation is 0.2. The terminal (client) is the direct carrier of data interaction; the basic weight for the environmental indicator corresponding to login terminal compliance is 0.2.

[0116] The scenario coefficient for environmental indicators is used to correct the weight of indicators in special scenarios and to offset misjudgments of normal and abnormal conditions. The specific value of the scenario coefficient for environmental indicators is set according to the actual situation.

[0117] For example: When the scenario is a business trip, the IP region matching accuracy is adjusted, and s is set. m =0.3 to reduce the weight of regional anomalies and avoid misjudging legitimate business trips; adjust the correlation between time and location, and set s m =0.5, to partially offset the risk score for time zone mismatch.

[0118] When the scenario is a remote work scenario, the network environment type is modified, and s is set. m =0.8. Since remote work may use non-enterprise networks, the weight of network type needs to be appropriately reduced.

[0119] When the scenario is an emergency business scenario, the compliance settings for the login terminal should be corrected. m=0.7, allowing uncertified devices to temporarily log in in emergency situations, thus reducing the stringency of compliance.

[0120] When the scenario is no special scenario (default), the s of all metrics m =1, no correction needed, calculated based on the basic weight.

[0121] S23: A multi-dimensional trust assessment model is used to calculate the trust score by analyzing user behavior scores, device status scores, and environmental factor scores.

[0122] Furthermore, the expression for the trust score is:

[0123] Txrdf=μ U ×U+μ D ×D+μ E ×E;

[0124] Where Txrdf is the trust score; μ U μ D μ E μ is the weighting coefficient. U +μ D +μ E =1; U is the user behavior score; D is the device status score; E is the environmental factor score.

[0125] Specifically, the higher the Txrdf value, the higher the trust level. μ U μ D μ E The specific value is set according to the actual situation. For example, in scenarios with high security requirements, μ U =0.5, μ D =0.3; μ E =0.3.

[0126] S3: Analyze the trust score, generate a trust assessment result, and generate an access policy based on the trust assessment result. The trust assessment result is classified as high trust, medium trust, or low trust. The access policy includes at least the permission level and session duration.

[0127] Specifically, the automated decision-making module dynamically generates access policies based on trust assessment results, including permission levels and session durations. This solves the problem of static trust boundaries in traditional VPNs, realizes dynamic access control in a zero-trust architecture, and ensures the security and flexibility of network access.

[0128] Furthermore, the steps for analyzing the trust score and generating a trust assessment result are as follows: the trust score is judged using a preset first trust threshold and a second trust threshold, and a trust assessment result is generated; if the trust score is greater than or equal to the first trust threshold, the generated trust assessment result is high trust; if the trust score is less than the first trust threshold but greater than or equal to the second trust threshold, the generated trust assessment result is medium trust; if the trust score is less than the second trust threshold, the generated trust assessment result is low trust; the first trust threshold is greater than the second trust threshold.

[0129] Specifically, the values ​​of the first trust threshold and the second trust threshold are set according to the actual situation.

[0130] Permission levels and session durations should be set according to the actual situation. For example, high trust corresponds to full permissions (e.g., access to all intranet resources), medium trust corresponds to limited permissions (e.g., access only to specified systems), and low trust requires triggering secondary verification (e.g., SMS verification code) before granting the corresponding permissions.

[0131] The session duration corresponding to high trust is greater than that corresponding to medium trust, which in turn is greater than that corresponding to low trust, thus reducing the risk exposure time.

[0132] Furthermore, the access policy also includes dynamically adjusting rules. If the trust score subsequently decreases (e.g., Txrdf drops from 0.9 to 0.4), the permission level will be automatically reduced and / or the session duration will be shortened.

[0133] Furthermore, as another embodiment, the dynamic access control mechanism in steps S2-S3 is as follows:

[0134]

[0135]

[0136] Specifically, dynamic access control mechanisms can solve problems such as static and one-size-fits-all approaches in traditional access control, improve security, and support the implementation of zero-trust architecture.

[0137] S4: Create a VPN connection based on the access policy and monitor the session status in real time. Terminate or rebuild the VPN connection based on the real-time monitored session status.

[0138] Specifically, the VPN session management module automates the creation of VPN connections, monitors session status, and terminates VPN connections, ensuring synchronization with the authentication status. This addresses the shortcomings of the OAuth 2.0 protocol in session management within VPN authentication scenarios, guaranteeing the security and stability of VPN connections.

[0139] Furthermore, as an example, the sub-steps of creating a VPN connection according to the access policy, monitoring the session status in real time, and terminating or re-establishing the VPN connection based on the real-time monitored session status are as follows:

[0140] S41: Assign an encrypted tunnel to the client according to the access policy, bind the permission scope according to the access policy, and record the session ID.

[0141] Specifically, encrypted tunnels are implemented based on SSL VPN or IPsec protocols, but are not limited to SSL VPN or IPsec protocols.

[0142] The Session ID is a temporary, unique identifier generated by the VPN Session Management module when a VPN connection is created. It is used to identify the encrypted tunnel connection between the current client and the gateway. The Session ID is bound to a single session and becomes invalid when the session ends (e.g., the client actively disconnects the VPN connection or the VPN connection times out).

[0143] S42: Monitor the session status in real time, continuously synchronize the trust score and the status of the temporary access token. If the trust score decreases and / or the temporary access token expires or is revoked, trigger the session termination process, automatically disconnect the VPN connection, release resources, and execute S43.

[0144] S43: Send VPN reconstruction command and re-execute steps S1-S3.

[0145] Specifically, the VPN session management module sends a VPN reconstruction command, prompting the client to re-execute steps S1-S3, and the VPN connection is rebuilt after the re-execution is successful.

[0146] Furthermore, as another embodiment, an automated session synchronization mechanism is implemented to monitor the session state in real time and terminate or rebuild the VPN connection based on the monitored session state:

[0147]

[0148]

[0149] Specifically, the automated risk response mechanism can automatically adjust VPN session permissions based on real-time risk assessment without manual intervention.

[0150] This application enhances security while reducing unnecessary multi-factor authentication steps through intelligent risk assessment.

[0151] The beneficial effects achieved by this application are as follows:

[0152] (1) The automated VPN authentication method and system integrating OAuth and zero trust architecture of this application can effectively solve the problems of low security, low adaptability, poor user experience and lack of dynamic decision-making of traditional VPN authentication, and improve the security, flexibility and efficiency of network access.

[0153] (2) The automated VPN authentication method and system integrating OAuth and zero trust architecture of this application, with the help of automation mechanism and multi-dimensional evaluation, makes VPN authentication more adaptable to complex business needs, ensures the security and convenience of data access, and helps to carry out management work (e.g., water environment management work) efficiently.

[0154] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the scope of protection of this application is intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application. Obviously, those skilled in the art can make various alterations and variations to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of protection of this application and its equivalents, this application also intends to include these modifications and variations.

Claims

1. An automated VPN authentication method integrating OAuth and zero-trust architecture, characterized in that, Includes the following steps: S1: Based on OAuth 2.0 and OIDC protocols, user authentication and authorization code transfer are performed to obtain user identity information and temporary access tokens; S2: Acquire multidimensional data and perform real-time analysis on the multidimensional data to obtain a trust score; the multidimensional data includes: user behavior data obtained based on user identity information, real-time collected device data, and environmental data; S3: Analyze the trust score, generate a trust assessment result, and generate an access policy based on the trust assessment result. The trust assessment result is classified as high trust, medium trust, or low trust. The access policy includes: permission level and session duration. S4: Create a VPN connection according to the access policy and monitor the session status in real time. Terminate or rebuild the VPN connection based on the real-time monitored session status. The sub-steps for acquiring multidimensional data and performing real-time analysis to obtain a trust score are as follows: S21: Obtain relevant user behavior data from the log system based on user identity information, collect device data in real time from the terminal management tool, obtain environmental data in real time from the network layer, and use user behavior data, device data, and environmental data as multi-dimensional data; S22: Quantify multidimensional data to obtain user behavior scores, device status scores, and environmental factor scores; S23: A multi-dimensional trust assessment model is used to calculate the trust score based on user behavior score, device status score, and environmental factor score. Among them, trust score The expression is: ； in, , , These are the weighting coefficients. ; Among them, user behavior score The expression is: ； in, The first in user behavior data Scores for individual user behavior metrics; For the first The basic weights of each user behavior metric; The first in user behavior data Scores for individual user behavior metrics; For the first The user behavior metrics and the first Risk correlation coefficient between individual user behavior metrics; , This represents the total number of user behavior metrics in the user behavior data. If high-risk indicators are present, the equipment status score will be adjusted. If no high-risk indicators are found, the equipment status score will be... The expression is: ； in, For the first in the device data The score of each device status indicator; This is the geometric mean of all equipment status indicators; For multiple medium-risk correction factors; , This represents the total number of equipment status indicators in the equipment data. Environmental Factor Score The expression is: ； in, For the first in environmental data Scores for each environmental indicator; For the first The basic weights of each environmental indicator; For the first Scenario coefficients for each environmental indicator; , This represents the total number of environmental indicators in the environmental data.

2. The automated VPN authentication method integrating OAuth and zero-trust architecture according to claim 1, characterized in that, The sub-steps for user authentication and authorization code transfer based on OAuth 2.0 and OIDC protocols to obtain user identity information and temporary access tokens are as follows: S11: Receive an authentication request sent by the client's third-party identity provider, wherein the authentication request includes: client ID, authorization scope, and callback address; S12: Combine the authentication request with the pre-configured key information of the third-party identity provider, and construct the redirect URL according to the format required by the third-party identity provider; wherein, the pre-configured key information of the third-party identity provider includes: the authorization endpoint URL and the pre-configured callback address; S13: Redirect to the login page of the third-party identity provider via the redirect URL. After the third-party identity provider authenticates the user and generates an authorization code, receive the authorization code carried in the callback address in the authentication request. S14: Send a token exchange request to a third-party identity provider and receive an access token and an identity token. The token exchange request carries the client ID, key, and authorization code. S15: Verify the access token, and use the valid access token as a temporary access token; parse the identity token to obtain the user's identity information.

3. The automated VPN authentication method integrating OAuth and zero-trust architecture according to claim 1, characterized in that, The types of device status indicators in device data include: system security indicators, device health indicators, and network configuration indicators.

4. The automated VPN authentication method integrating OAuth and zero-trust architecture according to claim 1, characterized in that, The types of environmental indicators in environmental data include: network environment type, IP region matching degree, time and location correlation, and login terminal compliance.

5. The automated VPN authentication method integrating OAuth and zero-trust architecture according to claim 1, characterized in that, The steps for analyzing trust scores and generating trust assessment results are as follows: the trust scores are judged using a preset first trust threshold and a second trust threshold, and a trust assessment result is generated. If the trust score is greater than or equal to the first trust threshold, the generated trust assessment result is high trust. If the trust score is less than the first trust threshold and greater than or equal to the second trust threshold, the generated trust assessment result is medium trust. If the trust score is less than the second trust threshold, the generated trust assessment result is low trust. The first trust threshold is greater than the second trust threshold.

6. The automated VPN authentication method integrating OAuth and zero-trust architecture according to claim 1, characterized in that, The steps for creating a VPN connection based on the access policy and monitoring the session status in real time, and then terminating or rebuilding the VPN connection based on the monitored session status, are as follows: S41: Assign an encrypted tunnel to the client according to the access policy, bind the permission scope according to the access policy, and record the session ID; S42: Monitor the session status in real time, continuously synchronize the trust score and temporary access token status. If the trust score decreases and / or the temporary access token expires or is revoked, trigger the session termination process, automatically disconnect the VPN connection, release resources, and execute S43. S43: Send VPN reconstruction command and re-execute steps S1-S3.

7. An automated VPN authentication system integrating OAuth and zero-trust architecture, characterized in that, include: Clients and authentication centers; The client-side application is configured with a third-party identity provider. Authentication Center: Used to implement the automated VPN authentication method integrating OAuth and zero-trust architecture as described in any one of claims 1-6.

8. The automated VPN authentication system integrating OAuth and zero-trust architecture according to claim 7, characterized in that, The authentication center includes: an OAuth authentication module, a zero-trust assessment engine, an automated decision-making module, and a VPN session management module; The OAuth authentication module is based on OAuth 2.0 and OIDC protocols to perform user authentication and authorization code transfer, and obtain user identity information and temporary access tokens. Zero Trust Assessment Engine: Acquires multi-dimensional data and performs real-time analysis to obtain a trust score; Automated decision-making module: Analyzes trust scores, generates trust assessment results, and generates access policies based on the trust assessment results; VPN Session Management Module: Creates VPN connections based on access policies, monitors session status in real time, and terminates or rebuilds VPN connections based on the monitored session status.

Images