Zero-trust service access method and device, equipment and storage medium

Abstract

The invention discloses a zero-trust service access method and device, equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: collecting user authentication information through employing a target webview assembly, and transmitting the user authentication information to a zero-trust authentication platform, thereby carrying out the identity authentication of an SDP client, and generating dynamic authorization information; receiving the dynamic authorization information, and sending an SPA request to the zero-trust authentication platform by using the target webview component so as to open a target firewall port; and establishing an encryption tunnel between the local and the target server based on the target webview component, and performing service access on the target server based on the encryption tunnel and the dynamic authorization information. An encryption tunnel with the target server is established through the webview component, service access is carried out, the range of zero-trust network control is limited in the application of the integrated component, and the problem that the influence range of a zero-trust mechanism is too large is avoided.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a zero-trust service access method, apparatus, device, and storage medium. Background Technology

[0002] Zero Trust, in essence, addresses the trust crisis in the borderless era through a dynamic closed loop of "never trusting + continuous verification," thus becoming the security cornerstone of digital infrastructure.

[0003] Existing SDP (Software Defined Perimeter) solutions require users to install independent clients (such as desktop apps or mobile applications). This approach requires hooking the entire terminal's network services, and only one or two applications on the entire terminal may need to adopt the zero-trust mechanism, resulting in an excessively large impact. Therefore, how to reduce the impact of the zero-trust mechanism has become a technical problem that needs to be solved. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a zero-trust service access method, apparatus, device, and storage medium, which enables a webview component to establish an encrypted tunnel with a target server and perform service access, limiting the scope of zero-trust network control to the application of the integrated component, thus avoiding the problem of the zero-trust mechanism having an excessively wide impact. The specific solution is as follows:

[0005] Firstly, this application provides a zero-trust service access method, applied to an SDP client, including:

[0006] The target webview component is used to collect local user authentication information and send the user authentication information to the zero trust authentication platform. The zero trust authentication platform then performs identity authentication on the SDP client based on the user authentication information, generates dynamic authorization information based on the corresponding authentication result, and sends the dynamic authorization information to the SDP client.

[0007] The target webview component is used to receive the dynamic authorization information, and the target webview component is used to send an SPA request to the zero-trust authentication platform, so that the zero-trust authentication platform can open the target firewall port according to the SPA request;

[0008] After the target firewall port is opened, an encrypted tunnel is established between the local machine and the target server based on the target webview component, and business access is performed on the target server based on the encrypted tunnel and the dynamic authorization information; wherein, the target webview component is located in the local target application.

[0009] Optionally, the zero-trust service access method further includes:

[0010] The target webview component is used to collect local device information, and the device information is sent to the zero-trust authentication platform so that the zero-trust authentication platform can perform device security authentication on the SDP client based on the device information.

[0011] Optionally, the device information includes the hardware information, system information, and network information of the SDP client. The hardware information includes the CPU model, memory capacity, and hard disk serial number. The system information includes the operating system version, patch installation status, and system process list.

[0012] Optionally, the zero-trust service access method further includes:

[0013] The target webview component and the communication connection between the local machine and the zero-trust authentication platform are used to listen for policy update instructions issued by the zero-trust authentication platform in real time, and the local access permissions are updated based on the policy update instructions.

[0014] Optionally, after sending the user authentication information to the zero-trust authentication platform, the method further includes:

[0015] If the user authentication information passes the authentication, the target webview component is used to obtain the digital authentication certificate issued by the zero-trust authentication platform.

[0016] Accordingly, establishing an encrypted tunnel between the local machine and the target server based on the target webview component includes:

[0017] The encrypted tunnel is established by performing two-way authentication with the target server based on the national cryptographic SSL protocol, the digital certificate, and the webview component.

[0018] Optionally, the step of accessing the target server based on the encrypted tunnel and the dynamic authorization information includes:

[0019] The data access token is obtained from the dynamic authorization information, and a business access request including the data access token is sent to the target server through the encrypted tunnel, so that the server receives the business access request and authenticates the data access token.

[0020] If the data access token is authenticated, the encrypted tunnel is used to access the target server for business purposes.

[0021] Secondly, this application provides a zero-trust service access device applied to an SDP client, comprising:

[0022] The authentication information sending module is used to collect local user authentication information using the target webview component and send the user authentication information to the zero trust authentication platform, so that the zero trust authentication platform can authenticate the SDP client based on the user authentication information, generate dynamic authorization information based on the corresponding authentication result, and send the dynamic authorization information to the SDP client.

[0023] The request sending module is used to receive the dynamic authorization information using the target webview component, and to send an SPA request to the zero-trust authentication platform using the target webview component, so that the zero-trust authentication platform can open the target firewall port according to the SPA request;

[0024] The business access module is used to establish an encrypted tunnel between the local machine and the target server based on the target webview component after the target firewall port is opened, and to perform business access to the target server based on the encrypted tunnel and the dynamic authorization information; wherein, the target webview component is located in the local target application.

[0025] Optionally, the zero-trust service access device further includes:

[0026] The device information sending module is used to collect local device information using the target webview component and send the device information to the zero-trust authentication platform so that the zero-trust authentication platform can perform device security authentication on the SDP client based on the device information.

[0027] Thirdly, this application provides an electronic device, comprising:

[0028] Memory, used to store computer programs;

[0029] A processor for executing the computer program to implement the aforementioned zero-trust service access method.

[0030] Fourthly, this application provides a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the aforementioned zero-trust service access method.

[0031] This application first uses a target webview component to collect local user authentication information and sends the user authentication information to a zero-trust authentication platform. The zero-trust authentication platform then authenticates the SDP client based on the user authentication information, generates dynamic authorization information based on the authentication result, and sends the dynamic authorization information to the SDP client. Next, the target webview component receives the dynamic authorization information and sends an SPA request to the zero-trust authentication platform, so that the zero-trust authentication platform opens the target firewall port based on the SPA request. Finally, after the target firewall port is opened, an encrypted tunnel is established between the local machine and the target server based on the target webview component, and business access is performed on the target server based on the encrypted tunnel and the dynamic authorization information. The target webview component resides in the local target application. Therefore, this application achieves user authentication without the need to install a separate client by utilizing the target WebView component located in the target application to collect and report user authentication information, thus solving the problems of complex deployment and poor compatibility. By sending SPA requests to the platform through the same component, the firewall port is opened, thereby achieving service port hiding and single-packet knock-on authentication. After the port is opened, an encrypted tunnel is established with the target server based on the component to access services, strictly limiting the scope of zero-trust network control to the application integrating the component, avoiding the shortcomings of traditional solutions that require hooking the entire terminal network service, resulting in large system overhead and excessively wide impact. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0033] Figure 1 This application discloses a flowchart of a zero-trust service access method.

[0034] Figure 2 This is a schematic diagram of the structure of a zero-trust service access device disclosed in this application;

[0035] Figure 3 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0036] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] Current SDP solutions require hooking the entire terminal network service, resulting in an excessively wide impact. To address this, this application provides a zero-trust service access method that establishes an encrypted tunnel with the target server through a webview component and performs service access. This limits the scope of zero-trust network control to the application of the integrated component, avoiding the problem of an excessively wide impact from the zero-trust mechanism.

[0038] See Figure 1 As shown, this embodiment of the invention discloses a zero-trust service access method applied to an SDP client, including:

[0039] Step S11: Collect local user authentication information using the target webview component and send the user authentication information to the zero-trust authentication platform so that the zero-trust authentication platform can authenticate the SDP client based on the user authentication information, generate dynamic authorization information based on the corresponding authentication result, and send the dynamic authorization information to the SDP client.

[0040] The target webview component in this embodiment is a self-developed webview component. This component is built on top of the standard WebView kernel (such as Chromium or WebKit) and encapsulates a "zero-trust adaptation layer". This layer includes a dynamic verification module, an authentication interface module, and a permission proxy module.

[0041] This embodiment first collects local user authentication information and sends it to the zero-trust authentication platform, so that the zero-trust authentication platform can authenticate the client based on the received user authentication information.

[0042] In addition, the zero-trust service access method in this embodiment also includes: using the target webview component to collect local device information and sending the device information to the zero-trust authentication platform, so that the zero-trust authentication platform can perform device security authentication on the SDP client based on the device information.

[0043] It should be noted that the above device information includes the hardware information, system information, and network information of the SDP client. The hardware information includes the CPU model, memory capacity, and hard drive serial number, while the system information includes the operating system version, patch installation status, and system process list.

[0044] Specifically, the dynamic verification module and authentication interface module in the zero-trust adaptation layer of the self-developed WebView component (i.e., the target WebView component) will work together to complete the device information reporting and identity authentication.

[0045] The dynamic verification module actively collects device hardware information (such as CPU model, memory capacity, and hard drive serial number), system information (such as operating system version, patch installation status, and system process list), and network information (such as IP address, MAC address, and network access type). This information is automatically and in real time reported to the Zero Trust platform (i.e., the Zero Trust authentication platform), providing comprehensive data support for the platform to assess device security and trustworthiness.

[0046] The authentication interface module provides a standardized authentication interface that supports multiple authentication methods. When a user authenticates their identity, this module receives the authentication information input by the user (i.e., user authentication information), such as SMS verification codes, biometric features (fingerprints, faces, etc.). This authentication information is then sent to the Zero Trust platform. After verifying the authentication information, the Zero Trust platform returns the verification result to the authentication interface module. The module completes the identity authentication process based on the result. If authentication is successful, a corresponding identity certificate (i.e., a digital authentication certificate) is generated for the user. In other words, if the user's authentication information is successfully authenticated, the target webview component is used to obtain the digital authentication certificate issued by the Zero Trust authentication platform.

[0047] Step S12: Receive the dynamic authorization information using the target webview component, and send an SPA request to the zero-trust authentication platform using the target webview component, so that the zero-trust authentication platform can open the target firewall port according to the SPA request.

[0048] Before establishing a socket connection, the self-developed WebView component initiates a Single Packet Authorization (SPA) request. Once the request is approved, the zero-trust platform opens the firewall port, allowing subsequent network connections.

[0049] The permission proxy module in the Zero Trust adaptation layer is the core of handling dynamic authorization reception and execution. The permission proxy module in the self-developed WebView establishes a real-time communication connection with the permission center of the Zero Trust platform, enabling it to promptly receive dynamic authorization information issued by the Zero Trust platform. This information includes the resources that the user can access, operation permissions, and the validity period of the permissions.

[0050] It should be noted that this embodiment can utilize the target webview component and the communication connection between the local machine and the zero-trust authentication platform to listen for policy update instructions issued by the zero-trust authentication platform in real time, and update the local access permissions based on the policy update instructions.

[0051] Step S13: After the target firewall port is opened, an encrypted tunnel is established between the local machine and the target server based on the target webview component, and business access is performed on the target server based on the encrypted tunnel and the dynamic authorization information; wherein, the target webview component is located in the local target application.

[0052] After the target firewall port is opened, this embodiment uses the national cryptographic SSL (Secure Sockets Layer) protocol, digital certificate, and webview component to perform two-way authentication with the target server to establish an encrypted tunnel.

[0053] In this embodiment, accessing the target server based on an encrypted tunnel and dynamic authorization information includes: obtaining a data access token from the dynamic authorization information and sending a business access request including the data access token to the target server using the encrypted tunnel, so that the server can receive the business access request and authenticate the data access token; if the data access token is authenticated, then accessing the target server using the encrypted tunnel.

[0054] Specifically, the self-developed WebView is responsible for establishing the encrypted tunnel for the Chinese national cryptographic SSL two-way authentication. The Chinese national cryptographic SSL two-way authentication uses the client certificate (i.e., digital certificate) issued by the zero-trust platform mentioned in the previous steps. Based on this, the Chinese national cryptographic SSL protocol is customized so that a token (i.e., data access token) can be sent to the business server in each SSL request. After the server successfully authenticates the token, normal business access can be enabled.

[0055] It should be noted that the self-developed WebView component will determine the authorization information when initiating a network connection. Only URLs (Uniform Resource Locators) within the authorized scope are allowed to access.

[0056] In addition, this embodiment uses a self-developed WebView component to ensure zero-trust protection for H5 (HyperText Markup Language 5) applications on mobile devices.

[0057] Therefore, this application achieves user authentication without the need to install a separate client by utilizing the target WebView component located in the target application to collect and report user authentication information, thus solving the problems of complex deployment and poor compatibility. By sending SPA requests to the platform through the same component, the firewall port is opened, thereby achieving service port hiding and single-packet knock-on authentication. After the port is opened, an encrypted tunnel is established with the target server based on the component to access services, strictly limiting the scope of zero-trust network control to the application integrating the component, avoiding the shortcomings of traditional solutions that require hooking the entire terminal network service, resulting in large system overhead and excessively wide impact.

[0058] See Figure 2 As shown, this embodiment of the invention discloses a zero-trust service access device applied to an SDP client, comprising:

[0059] The authentication information sending module 11 is used to collect local user authentication information using the target webview component and send the user authentication information to the zero trust authentication platform, so that the zero trust authentication platform can perform identity authentication on the SDP client based on the user authentication information, generate dynamic authorization information based on the corresponding authentication result, and send the dynamic authorization information to the SDP client.

[0060] The request sending module 12 is used to receive the dynamic authorization information using the target webview component, and to send an SPA request to the zero-trust authentication platform using the target webview component, so that the zero-trust authentication platform can open the target firewall port according to the SPA request.

[0061] The business access module 13 is used to establish an encrypted tunnel between the local machine and the target server based on the target webview component after the target firewall port is opened, and to perform business access to the target server based on the encrypted tunnel and the dynamic authorization information; wherein, the target webview component is located in the local target application.

[0062] In some specific embodiments, the zero-trust service access device further includes:

[0063] The device information sending module is used to collect local device information using the target webview component and send the device information to the zero-trust authentication platform so that the zero-trust authentication platform can perform device security authentication on the SDP client based on the device information.

[0064] In some specific embodiments, the zero-trust service access device further includes:

[0065] The permission update module is used to listen in real time for policy update instructions issued by the zero-trust authentication platform using the target webview component and the communication connection between the local machine and the zero-trust authentication platform, and update the local access permissions based on the policy update instructions.

[0066] In some specific embodiments, the authentication information sending module 11 further includes:

[0067] The certificate acquisition unit is used to obtain the digital certificate issued by the zero-trust authentication platform using the target webview component if the user authentication information passes the authentication.

[0068] Accordingly, the service access module 13 may specifically include:

[0069] The tunnel establishment unit is used to perform two-way authentication with the target server based on the national cryptographic SSL protocol, the digital certificate, and the webview component to establish the encrypted tunnel.

[0070] In some specific embodiments, the service access module 13 may specifically include:

[0071] The request sending unit is used to obtain a data access token from the dynamic authorization information and send a business access request including the data access token to the target server through the encrypted tunnel, so that the server can receive the business access request and authenticate the data access token.

[0072] The business access unit is used to access the target server via the encrypted tunnel if the data access token is authenticated.

[0073] Furthermore, embodiments of this application also disclose an electronic device, Figure 3 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0074] Figure 3 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the zero-trust service access method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0075] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0076] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0077] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the zero-trust service access method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0078] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned zero-trust service access method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0079] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0080] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0081] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0082] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0083] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A zero-trust service access method, characterized in that, Applied to SDP clients, including: The target webview component is used to collect local user authentication information and send the user authentication information to the zero trust authentication platform. The zero trust authentication platform then performs identity authentication on the SDP client based on the user authentication information, generates dynamic authorization information based on the corresponding authentication result, and sends the dynamic authorization information to the SDP client. The target webview component is used to receive the dynamic authorization information, and the target webview component is used to send an SPA request to the zero-trust authentication platform, so that the zero-trust authentication platform can open the target firewall port according to the SPA request; After the target firewall port is opened, an encrypted tunnel is established between the local machine and the target server based on the target webview component, and business access is performed on the target server based on the encrypted tunnel and the dynamic authorization information; wherein, the target webview component is located in the local target application.

2. The zero-trust service access method according to claim 1, characterized in that, Also includes: The target webview component is used to collect local device information, and the device information is sent to the zero-trust authentication platform so that the zero-trust authentication platform can perform device security authentication on the SDP client based on the device information.

3. The zero-trust service access method according to claim 2, characterized in that, The device information includes the hardware information, system information, and network information of the SDP client. The hardware information includes the CPU model, memory capacity, and hard disk serial number. The system information includes the operating system version, patch installation status, and system process list.

4. The zero-trust service access method according to claim 1, characterized in that, Also includes: The target webview component and the communication connection between the local machine and the zero-trust authentication platform are used to listen for policy update instructions issued by the zero-trust authentication platform in real time, and the local access permissions are updated based on the policy update instructions.

5. The zero-trust service access method according to claim 1, characterized in that, After sending the user authentication information to the zero-trust authentication platform, the process further includes: If the user authentication information passes the authentication, the target webview component is used to obtain the digital authentication certificate issued by the zero-trust authentication platform. Accordingly, establishing an encrypted tunnel between the local machine and the target server based on the target webview component includes: The encrypted tunnel is established by performing two-way authentication with the target server based on the national cryptographic SSL protocol, the digital certificate, and the webview component.

6. The zero-trust service access method according to any one of claims 1 to 5, characterized in that, The process of accessing the target server based on the encrypted tunnel and the dynamic authorization information includes: The data access token is obtained from the dynamic authorization information, and a business access request including the data access token is sent to the target server through the encrypted tunnel, so that the server receives the business access request and authenticates the data access token. If the data access token is authenticated, the encrypted tunnel is used to access the target server for business purposes.

7. A zero-trust service access device, characterized in that, Applied to SDP clients, including: The authentication information sending module is used to collect local user authentication information using the target webview component and send the user authentication information to the zero trust authentication platform, so that the zero trust authentication platform can authenticate the SDP client based on the user authentication information, generate dynamic authorization information based on the corresponding authentication result, and send the dynamic authorization information to the SDP client. The request sending module is used to receive the dynamic authorization information using the target webview component, and to send an SPA request to the zero-trust authentication platform using the target webview component, so that the zero-trust authentication platform can open the target firewall port according to the SPA request; The business access module is used to establish an encrypted tunnel between the local machine and the target server based on the target webview component after the target firewall port is opened, and to perform business access to the target server based on the encrypted tunnel and the dynamic authorization information; wherein, the target webview component is located in the local target application.

8. The zero-trust service access device according to claim 7, characterized in that, Also includes: The device information sending module is used to collect local device information using the target webview component and send the device information to the zero-trust authentication platform so that the zero-trust authentication platform can perform device security authentication on the SDP client based on the device information.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the zero-trust service access method as described in any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that, Used to store a computer program, which, when executed by a processor, implements the zero-trust service access method as described in any one of claims 1 to 6.

Images