A fast network access method and device based on a zero-trust architecture

Abstract

The application discloses a kind of based on the quick network access method and device of zero trust architecture, belong to network security technical field.The method includes: to the non-zero trust port of access side switching device is completely blocked, open zero trust port, to take over the identity authentication of all ports in the switching device;When receiving the identity information of target access device forwarded by switching device, the single packet authentication of the target access device is carried out using zero trust identity authentication system;The authentication information is forwarded by the switching device when receiving the network request initiated by target access device based on the opened zero trust port;When determining that single packet authentication result is passed, the target non-zero trust port in the switching device is opened to the target access device, and network access is completed without Radius secondary authentication.The application can avoid complex 802.1x-based 3A authentication server Radius, so that the authentication process is simpler.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a rapid network access method and apparatus based on a zero-trust architecture. Background Technology

[0002] Currently, zero-trust architectures based on SDP (Software Defined Perimeter) provide security control over device access to central services, making them suitable for remote mobile office scenarios. However, network access control on the access side has shortcomings. For example, in enterprise intranets, there is a need for zero-trust access to some services, but on the other hand, there is a desire for internal staff to access some unrestricted networks, while strong control over network access for non-internal staff (i.e., no network access permissions for non-internal personnel). Therefore, how to achieve network access control for access-side devices based on zero-trust networks is a technical problem that urgently needs to be solved. Summary of the Invention

[0003] This invention provides a fast network access method and apparatus based on a zero-trust architecture. The technical solution is as follows: On the one hand, a fast network admission method based on a zero-trust architecture is provided, applied to a zero-trust server, the method comprising: Completely block the non-zero trust ports of the access-side switching device and open the zero trust ports to take over the identity authentication of all ports in the switching device; Upon receiving the identity information of the target access device forwarded by the switching device, the zero-trust identity authentication system is used to perform single-packet authentication on the target access device; the authentication information is forwarded by the switching device when it receives a network request initiated by the target access device based on the opened zero-trust port. When the single packet authentication result is confirmed to be successful, the target non-zero trust port in the switching device is opened to the target access device, and network access is completed without performing Radius secondary authentication.

[0004] On the other hand, a fast network access control device based on a zero-trust architecture is provided, applied to a zero-trust server, the device comprising: The takeover unit is used to completely block the non-zero trust ports of the access-side switching device and open the zero trust ports to take over the identity authentication of all ports in the switching device. The authentication unit is used to perform single-packet authentication on the target access device using a zero-trust identity authentication system when it receives the identity information of the target access device forwarded by the switching device; the authentication information is forwarded by the switching device when it receives a network request initiated by the target access device based on the opened zero-trust port. The admission unit is used to open the target non-zero trust port in the switching device to the target access device when the single packet authentication result is determined to be successful, and to complete network admission without performing Radius secondary authentication.

[0005] On the other hand, a computer device is provided, the computer device including a memory and a processor, the memory for storing a computer program, and the processor for executing the computer program stored in the memory to implement the steps of the fast network access method based on zero trust architecture described above.

[0006] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when executed by a processor, the computer program implements the steps of the fast network access method based on zero-trust architecture described above.

[0007] On the other hand, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the fast network access method based on a zero-trust architecture described above.

[0008] The technical solution provided by this invention can bring at least the following beneficial effects: Network access control on the access side based on the zero-trust network architecture completely blocks the non-zero-trust ports of the access-side switching equipment, and only opens the zero-trust ports. When an access device makes a network request, it initiates identity authentication using the open zero-trust port. After the zero-trust identity authentication system performs identity authentication on the access device once, if the identity authentication is confirmed to be successful, the corresponding port is opened for the access device to complete the network access of the access device. There is no need to perform RADIUS secondary authentication, avoiding the complex RADIUS 3A authentication server based on 802.1x, making the authentication process simpler. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 This is a flowchart of a fast network admission method based on a zero-trust architecture provided by an embodiment of the present invention; Figure 2 This is a structural diagram of a fast network admission device based on a zero-trust architecture provided in an embodiment of the present invention; Figure 3This is a hardware architecture diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0011] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0012] Since zero-trust networks have their own identity information and authentication system, introducing a traditional 802.1x-based 3A authentication service system would be cumbersome. Therefore, the purpose of this invention is to explore how to implement simple network access control based on the zero-trust network's own authentication module.

[0013] The inventive concept of this invention lies in a zero-trust architecture-based identity authentication system. First, a full-blocking policy is implemented on the access-side switches and routers. After zero-trust authentication is completed, the ports on the access-side switches are opened, allowing traffic forwarding on those ports and achieving network access control. This solution is faster than traditional 802.1x-based access, eliminates the need for complex authentication via a 3A authentication server, and still meets the requirements of a zero-trust architecture.

[0014] The following describes the specific implementation of the above concept.

[0015] Please refer to Figure 1 This invention provides a fast network admission method based on a zero-trust architecture, the method comprising: Step 100: Completely block the non-zero trust ports of the access-side switching device and open the zero trust ports to take over the identity authentication of all ports in the switching device; Step 102: Upon receiving the identity information of the target access device forwarded by the switching device, the zero-trust identity authentication system is used to perform single-packet authentication on the target access device; the authentication information is forwarded by the switching device when it receives a network request initiated by the target access device based on the opened zero-trust port. Step 104: When the single packet authentication result is confirmed to be successful, the target non-zero trust port in the switching device is opened to the target access device, and network access is completed without performing Radius secondary authentication.

[0016] In this embodiment of the invention, based on the network access control of the access side under the zero-trust network architecture, all non-zero-trust ports of the access-side switching device are completely blocked, and only the zero-trust ports are opened. When the access device makes a network request, it initiates identity authentication using the open zero-trust port. After the zero-trust identity authentication system performs identity authentication on the access device once, if the identity authentication is confirmed to be successful, the corresponding port is opened for the access device to complete the network access of the access device. There is no need to perform RADIUS secondary authentication, avoiding the complex RADIUS 3A authentication server based on 802.1x, making the authentication process simpler.

[0017] The following description Figure 1 The execution method of each step is shown.

[0018] First, we will explain step 100, "to completely block the non-zero trust ports of the access-side switching device and open the zero trust ports to take over the identity authentication of all ports in the switching device," and step 102, "when receiving the identity information of the target access device forwarded by the switching device, to perform single-packet authentication of the target access device using the zero trust identity authentication system; the authentication information is forwarded by the switching device when it receives a network request initiated by the target access device based on the opened zero trust ports."

[0019] For traditional 802.1x-based 3A authentication server Radius, even with zero-trust authentication, Radius secondary authentication is still required. Furthermore, for non-zero-trust ports, Radius authentication is also required. As a result, the system needs to deploy two authentication systems, use two sets of authentication information, and synchronize data between the two authentication information sources. This approach is not only complex but also has a cumbersome authentication process.

[0020] In this embodiment of the invention, after deploying the zero-trust identity authentication system, non-zero-trust ports are also authenticated through the zero-trust identity authentication system, thereby avoiding the introduction of the complex traditional 802.1x-based 3A authentication server Radius.

[0021] After deploying a zero-trust identity authentication system, in order to perform zero-trust identity authentication on non-zero-trust ports, it is necessary to first completely block the non-zero-trust ports of the access device. Only after the zero-trust identity authentication is successful can the corresponding non-zero-trust ports be opened.

[0022] In one embodiment of the present invention, non-zero trust ports of the access-side switching device can be completely blocked in the following way: an ACL command is sent to the switching device based on the SNMP protocol to instruct the switching device to block all ports except the specified UDP port.

[0023] In this embodiment, the zero-trust port is a designated UDP port. In one implementation, this designated UDP port is UDP port 60172. Since UDP ports are connectionless, they are suitable for sending single data transmissions, which aligns with the single-packet concept of SPAs. Furthermore, the UDP protocol is relatively simple, without complex connection establishment and maintenance processes, which helps reduce the complexity of SPA implementation. Moreover, due to the low overhead of UDP, its transmission efficiency in the network is high. Therefore, in this embodiment of the invention, the designated UDP port is opened as a zero-trust port to complete authentication using this designated UDP port.

[0024] In this embodiment of the invention, the complete blocking of non-zero-trust ports of the switching device is achieved by sending ACL commands to the switching device via the SNMP protocol, which is simple and easy to use. Furthermore, based on a zero-trust architecture, a designated UDP port is opened for single-packet authentication before network access to the device, ensuring both security and concealment.

[0025] In this embodiment of the invention, although the access device uses a non-zero-trust port to access network resources, identity authentication is performed based on a zero-trust port. Therefore, when authenticating the access device, the dynamic logic of zero trust is still used to implement zero-trust authentication. Thus, in this embodiment, when performing single packet authentication (SPA) on the target access device, it can support multi-factor authentication and access device health verification at the authentication level. Multi-factor authentication includes, for example, password + SMS / face / face / hardware key, and access device health verification includes, for example, system patches, antivirus status, etc. At the authorization level, identity authentication can be based on dynamic policies, such as real-time verification of identity, access device status, and access location, dynamic issuance of VLAN / ACL permissions, and immediate revocation of permissions in case of anomalies. At the policy management level, a unified policy platform can be established to link with business systems and dynamically adjust access permissions according to the minimum permissions.

[0026] Then, regarding step 104, when it is determined that the single packet authentication result is successful, the target non-zero trust port in the switching device is opened to the target access device, and network access is completed without performing Radius secondary authentication.

[0027] In this embodiment of the invention, the target access device can be a wired access device or a wireless access device. Regardless of whether it is a wired or wireless access device, it needs to access network resources through the port of the switching device. Therefore, when the target access device initiates a network request, although it performs authentication through a specified UDP port, after successful authentication, it needs to use the corresponding port of the switching device to access network resources. This corresponding port can be a zero-trust port or a non-zero-trust port.

[0028] After the single packet authentication result is passed, the zero-trust identity authentication system can directly authorize and allow the target access device to perform network access without performing Radius secondary authentication.

[0029] Furthermore, after network access is granted, it may also include: If the target access device is a wired access device, then network control of the target access device is performed using the target non-zero trust port; If the target access device is a wireless access device, then network control of the target access device is performed using the IP address and MAC address of the target access device.

[0030] Wired access devices are connected directly to the port of the switching equipment via cables. Therefore, after enabling the target non-zero trusted port, network control of the target access device can be performed directly using the target non-zero trusted port. For wireless access devices, since their target non-zero trusted port may not be fixed, while their IP address and MAC address are fixed, network control of the target access device is performed using its IP address and MAC address. Thus, using different network control methods to control different access devices separately ensures effective management and control of the access devices.

[0031] Furthermore, it may also include: when it is determined that the target access device has logged out, a blocking command is sent to the access device, causing the switching device to re-enable the blocking of the target non-zero trust port against the target access device. Once an access device that has passed zero trust authentication logs out, the blocking is re-enabled to ensure network security.

[0032] Please refer to Figure 2 This invention provides a fast network admission device based on a zero-trust architecture, the device comprising: The takeover unit 200 is used to completely block the non-zero trust ports of the access-side switching device and open the zero trust ports to take over the identity authentication of all ports in the switching device. The authentication unit 202 is used to perform single-packet authentication on the target access device using a zero-trust identity authentication system when it receives the identity information of the target access device forwarded by the switching device; the authentication information is forwarded by the switching device when it receives a network request initiated by the target access device based on the opened zero-trust port. The admission unit 204 is used to open the target non-zero trust port in the switching device to the target access device when the single packet authentication result is determined to be successful, and to complete network admission without performing Radius secondary authentication.

[0033] In one embodiment of the present invention, the zero-trust port is a designated UDP port.

[0034] In one embodiment of the present invention, when the takeover unit performs a full block on the non-zero trust ports of the access-side switching device, it specifically includes: sending an ACL instruction to the switching device based on the SNMP protocol to instruct the switching device to block all ports except the specified UDP port.

[0035] In one embodiment of the present invention, it further includes: a network control unit, configured to, after the network access is granted, if the target access device is a wired access device, perform network control on the target access device using the target non-zero trust port; and if the target access device is a wireless access device, perform network control on the target access device using the IP address and MAC address of the target access device.

[0036] In one embodiment of the present invention, the takeover unit is further configured to, when it is determined that the target access device has logged out, issue a blocking command to the access device so that the switching device can re-enable the blocking of the target non-zero trust port on the target access device.

[0037] It should be noted that the fast network access device based on zero-trust architecture provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the fast network access device based on zero-trust architecture provided in the above embodiments and the fast network access method embodiments based on zero-trust architecture belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0038] Embodiments of this application also provide a computer device, please refer to... Figure 3 The computer device includes a processor and a memory, the memory storing at least one instruction, at least one program, code set, or instruction set, the at least one instruction, at least one program, code set, or instruction set being loaded and executed by the processor to implement the fast network access method based on zero-trust architecture provided in the above-described method embodiments.

[0039] Embodiments of this application also provide a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the fast network access method based on zero-trust architecture provided in the above-described method embodiments.

[0040] Embodiments of this application also provide a computer program product comprising a computer program, wherein a processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, causing the computer device to perform any of the fast network access methods based on zero-trust architecture described in the above embodiments.

[0041] For ease of description, the above systems or devices are described separately as various modules or units based on their functions. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware components.

[0042] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0043] Finally, it should be noted that in this document, relational terms such as first, second, third, and fourth are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0044] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A fast network admission method based on a zero-trust architecture, characterized in that, Applied to zero-trust servers, the method includes: The non-zero-trust ports of the access-side switching device are completely blocked, and the zero-trust ports are opened to take over the identity authentication of all ports in the switching device; the zero-trust ports are UDP ports. Upon receiving the identity information of the target access device forwarded by the switching device, the zero-trust identity authentication system is used to perform single-packet authentication on the target access device; the identity information is forwarded by the switching device when it receives a network request initiated by the target access device based on the opened zero-trust port. When the single packet authentication result is confirmed to be successful, the target non-zero trust port in the switching device is opened to the target access device, and network access is completed without performing Radius secondary authentication. The method of completely blocking the non-zero trust ports of the access-side switching device includes: sending an ACL command to the switching device based on the SNMP protocol to instruct the switching device to block all ports except the specified UDP port.

2. The method according to claim 1, characterized in that, After completing network access, the following is also included: If the target access device is a wired access device, then network control of the target access device is performed using the target non-zero trust port; If the target access device is a wireless access device, then network control of the target access device is performed using the IP address and MAC address of the target access device.

3. The method according to any one of claims 1-2, characterized in that, Also includes: When it is determined that the target access device has logged out, a blocking command is sent to the target access device so that the switching device can re-enable the blocking of the target non-zero trust port on the target access device.

4. A fast network admission device based on a zero-trust architecture, characterized in that, The apparatus, used in zero-trust servers, includes: The takeover unit is used to completely block the non-zero-trust ports of the access-side switching device and open the zero-trust ports to take over the identity authentication of all ports in the switching device; the zero-trust ports are UDP ports. The authentication unit is used to perform single-packet authentication on the target access device using a zero-trust identity authentication system when it receives the identity information of the target access device forwarded by the switching device; the identity information is forwarded by the switching device when it receives a network request initiated by the target access device based on an open zero-trust port. The admission unit is used to open the target non-zero trust port in the switching device to the target access device when the single packet authentication result is determined to be successful, and to complete network admission without performing Radius secondary authentication. The method of completely blocking the non-zero trust ports of the access-side switching device includes: sending an ACL command to the switching device based on the SNMP protocol to instruct the switching device to block all ports except the specified UDP port.

5. The apparatus according to claim 4, characterized in that, The device further includes: The network control unit is configured to, after network access is granted, control the target access device using the target non-zero trust port if the target access device is a wired access device, and control the target access device using the IP address and MAC address of the target access device if the target access device is a wireless access device.

6. A computer device, characterized in that, The computer device includes a memory and a processor. The memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the steps of the method according to any one of claims 1-3.

7. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the steps of the method described in any one of claims 1-3.

8. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1-3.

Images