CN116318971A - A zero-trust IM terminal configuration method based on identity authentication - Google Patents

Abstract

The invention aims to provide a zero trust I M terminal configuration method based on identity authentication, which fully utilizes the self equipment characteristics of I M terminals and safely and quickly connects the I M terminals into a zero trust network. Therefore, the invention acquires the existing service type and the corresponding configuration information in the main equipment after the main equipment is detected by the zero trust terminal, the identity authentication policy server in the zero trust terminal records the identity of the main equipment and adds a security identifier to the main equipment, a I M user provides a corresponding permission opening request to a permission control center according to the provided permission application function, and the permission opening request is completely sent by the main equipment provided with the I M terminal, and the permission opening relates to other equipment connected to the main equipment. Therefore, the self performance of the I M terminal can be fully utilized, the safety configuration of the I M terminal can be rapidly set in the existing zero trust network, and the deployment speed and success rate are improved on the premise of ensuring the reliability of the zero trust system.

Description

A zero-trust IM terminal configuration method based on identity authentication

technical field

The invention relates to the technical field of computer networks, in particular to a zero-trust IM terminal configuration method based on identity authentication.

Background technique

Zero trust solves the security problems based on excessive trust, especially the problem of excessive trust in the trust zone. This is especially important for units with high security protection requirements. However, since an IM terminal (InstantMessaging instant messaging terminal) has its own communication function, when accessing a zero-trust network, the configuration is relatively complicated. For example, the patent application number in the prior art is: CN202011536114.X's invention patent "communication method, target system and network system under the zero trust architecture system" discloses the communication method, the target system and the network system under the zero trust architecture system , where the target system includes: a server used to provide application services in the intranet system, and a connector connected to the server; the connector is also connected to the zero trust cloud gateway deployed in the external network; the connector actively connects to the zero trust cloud gateway ; After the connector actively connects to the zero-trust cloud gateway, the preset encryption and decryption algorithm is used to carry out encrypted communication with the zero-trust cloud gateway. On the one hand, the connector actively connects to the zero-trust cloud gateway, that is, the connector does not need to provide external ports. By actively connecting to the zero-trust cloud gateway, a tunnel is established with the zero-trust cloud gateway, thereby preventing the internal network from being breached. Thereby improving the security of the intranet. On the other hand, after the connector actively connects to the zero trust cloud gateway, the preset encryption and decryption algorithm is used to carry out encrypted communication with the zero trust cloud gateway, thereby further improving the security of the intranet.

In this application, after the connector actively connects to the zero-trust cloud gateway, the preset encryption and decryption algorithm is used to carry out encrypted communication with the zero-trust cloud gateway, thereby further improving the security of the intranet. However, since the security of the connector itself has not been covered, once the connector is invaded or controlled by criminals, it can use the connector to continuously send requests for permission. Even if it cannot enter the zero trust system, it will still take up a lot of system resources, and even cause the entire system to crash. At the same time, such a configuration method does not make full use of the advantages of the IM terminal itself, resulting in redundant construction.

Contents of the invention

Aiming at the shortcomings of the prior art, the purpose of the present invention is to provide a zero-trust IM terminal configuration method based on identity authentication, which makes full use of the device characteristics of the IM terminal itself, and securely and quickly connects it to a zero-trust network. At the same time, the zero-trust system after the IM terminal is connected is simplified as much as possible to ensure the overall security.

In order to achieve the above object, the present invention is based on a zero-trust IM terminal configuration method based on identity authentication, which is used to add IM terminal equipment in the configured zero-trust system. For other devices on the main device, the main device with the IM terminal installed accesses the network with the zero-trust terminal, and the zero-trust terminal detects the main device and obtains the existing service types and corresponding configuration information in the main device, The identity authentication policy server in the zero-trust terminal records the identity of the main device, adds a security identifier to the main device, issues basic access permissions to the main device, and writes the permissions to the writable switch. IM users pass OA The process applies for opening other permissions, and the application is approved by the process control center. After the approval, the configuration information of the main device is added to the access control list, and based on this open permission application, the IM user submits the permission application function to the permission control center Propose a corresponding permission opening request, the permission opening request is completely issued by the main device installed with the IM terminal, the permission opening involves other devices connected to the main device, after the request is approved, the corresponding device has a built-in identity authentication policy server The authority policy issued by the authority control center controls the active zero-trust security identification, and the security identification is uniformly sent to the main device, and distributed by the main device to other devices according to the authority request.

Preferably, the security identifier is used to represent a person, service or IoT device, and they define a zero-trust control plane. When a certain security identifier tries to access resources, it is necessary to use strong authentication to verify the security identifier and ensure that the access conforms to It is required and is a typical behavior of this security identity, and access follows the principle of least access privilege. Integrate the basic functions of the zero-trust terminal on the main device with IM terminal, and then integrate the function of the zero-trust gateway through the gateway connected to the main device to realize the zero-trust gateway. At this time, the main device with the IM terminal can completely act as an independent zero-trust system server after being authorized.

Preferably, a second multi-factor verification request is required when suspicious access is found during verification of the security identifier. The suspicious access includes sniffing a situation of logging in with an unconventional IP address, a situation of logging in at an irregular time, and a situation where other login behaviors conflict with the operator's itinerary.

Preferably, the second multi-factor verification request specifically includes performing a verification code operation on the IM terminal through a text message or an email address. Trust roles assist in validating trusted access for users. This can prevent illegal users from accessing the zero trust system through normal means.

Preferably, the gateway connected to the master device installed with the IM terminal is controlled by a configurable switch to realize a zero-trust gateway, and the gateway verifies whether the user's request packet is legal, and decides whether to develop a TCP port for application access. This gives administrative control from what is sent.

Preferably, the ACL policy of the switch is dynamically issued, as a zero-trust terminal strategy, to complete the first authentication in the switch, and at the same time rely on the user data, environment, IP, GPS and other basic environments obtained by the gateway connected to the main device installed with the IM terminal Data verification user's access security.

Preferably, the zero-trust terminal generates a configuration information list after obtaining the configuration information of the master device with the IM terminal installed, performs initialization processing according to the configuration information list, and closes high-risk ports and idle ports in turn according to the configuration information list, and the IM terminal will be installed. The configuration of the main device is modified to the minimum configuration that meets the basic functions. Part of the functions on the main device and some functions of other devices connected to the main device can be temporarily opened according to the request of the IM user.

Preferably, the basic rights activated by the IM terminal after being recorded by the identity authentication policy server include login OA rights, WIFI authentication access rights and basic access function rights.

Preferably, it also includes writing back configuration, uploading the configuration information of the IM terminal before the initialization process and after the configuration is completed to the zero-trust terminal as a configuration template, once there is a problem with the operation of the IM terminal after the initialization process, then roll back to the previous Configure information, delete the corresponding configuration template in the zero trust terminal, and exclude this IM terminal from the zero trust system. IM users need to deal with the problem before trying to reconfigure.

Preferably, after the zero-trust terminal detects the service type of the new IM terminal and the corresponding configuration information, it first compares it with the configuration information of the already configured IM terminal that has been saved, and selects whether to directly adopt the existing IM terminal according to the comparison result. configuration template.

A zero-trust IM terminal configuration method based on identity authentication in the technical solution of the present invention can make full use of the performance of the IM terminal itself, and quickly configure it safely into the existing zero-trust network, on the premise of ensuring the reliability of the zero-trust system Next, the speed and success rate of deployment are improved.

Compared with the prior art, adopting the technical scheme of the present invention has the following significant beneficial effects:

1. Using the functions of the IM terminal itself, for some non-confidential data interactions, such as downloading data when configuring the zero-trust network client, there is no need to perform pre-operations, and the IM terminal is directly used to realize data transmission.

2. When an abnormality occurs, the IM terminal can be used to achieve the minimum degree of interaction. Temporarily separate the IM terminal from the zero-trust network, and re-verify to establish trust. If it is found that the abnormality cannot be eliminated during the process of re-establishing trust, the zero-trust system will be completely shut down, and the IM terminal and related equipment will be shielded. After sufficient testing to ensure that abnormalities are eliminated, IM terminals can be used to quickly rebuild a zero-trust network.

3. Once the IM terminal is blocked from the zero trust system, the IM terminal will transmit the process data to the identity authentication policy server, which is convenient for relevant technical personnel to analyze, so as to continuously improve the zero trust system.

4. When the IM terminal is connected to the zero-trust system, other devices connected to the main device that are not connected to the zero-trust system can work independently according to their own functions. It's just that these devices are data-isolated relative to devices connected to the zero-trust system, except in the process of actively applying for permission and waiting for a reply.

Description of drawings

The accompanying drawings illustrate exemplary embodiments of the present disclosure and, together with the description, serve to explain the principles of the disclosure, are included to provide a further understanding of the disclosure, and are incorporated in and constitute this specification. part of the manual.

FIG. 1 is an overall schematic diagram of a zero-trust IM terminal configuration method based on identity authentication in the present invention.

FIG. 2 is a schematic diagram of a working flow of a zero-trust IM terminal configuration method based on identity authentication in the present invention.

FIG. 3 is a schematic diagram of a write-back process architecture of a zero-trust IM terminal configuration method based on identity authentication in the present invention.

Detailed ways

The present disclosure will be further described in detail below with reference to the drawings and embodiments. It can be understood that the specific implementation manners described here are only used to explain relevant content, rather than to limit the present disclosure. It should also be noted that, for ease of description, only parts related to the present disclosure are shown in the drawings.

It should be noted that, in the case of no conflict, the implementation modes and the features in the implementation modes in the present disclosure can be combined with each other. The present disclosure will be described in detail below with reference to the drawings and embodiments. In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

Some terms are explained here:

IM (Instant Messaging) instant messaging. Most of the existing zero-trust systems have their own communication modules, but there are few communication modules compatible with instant messaging.

OA: (OfficeAutomation) office automation. It adopts Internet/Intranet technology, based on the concept of workflow, so that the internal personnel of the enterprise can share information conveniently and quickly, and work together efficiently; change the complicated and inefficient manual office method in the past, realize rapid and comprehensive information collection and processing, and serve the enterprise Provide scientific basis for management and decision-making.

IoT devices: (Internet of things) Internet of things devices are network devices that link physical devices, vehicles, buildings, and some other embedded electronic devices, software, sensors, and other things with the network, enabling these objects to move and exchange data.

IP: (InternetProtocol) The Internet protocol assigned to users to access the Internet.

GPS: (TheGlobalPositioningSystem) Global Positioning System, a satellite navigation system.

A zero-trust network requires dynamic and continuous monitoring and adjustment of permissions based on the security status of objects. At the same time, traditional enterprise IM usually purchases third-party communication software for communication, which is not well integrated with the zero trust system. Leakage still exists in the IM terminal, and multiple accounts often use the account, which can easily lead to account theft. Or leakage, affecting enterprise system security.

As shown in Figure 1, it is a zero-trust IM terminal configuration method based on identity authentication in the present invention, which is used to add an IM terminal device in the configured zero-trust system, including the main device installed with the IM terminal and the main device connected to the main device other devices on the The main device installed with the IM terminal is connected to the network with the zero-trust terminal. After the zero-trust terminal detects the IM terminal, it obtains the existing service types and corresponding configuration information in the main device installed with the IM terminal. The zero-trust terminal The identity authentication policy server records the identity of the main device installed with the IM terminal, adds a security identifier to the main device, issues basic access rights to the IM terminal, and writes the rights into the writable switch. The IM user passes the OA The process applies for opening other permissions, and the application is approved by the process control center. After the approval, the configuration information of the IM terminal is added to the access control list, and the permission application is opened based on this.

The access control list, that is, ACL, (AccessControlList) is composed of a series of conditional rules (that is, judgment statements describing the matching conditions of the message), including the source address, destination address, port number, etc. of the message, and is an application in A list of commands on various hardware and software interfaces of network devices. Filter incoming and outgoing packets according to the matching conditions in the ACL. Traffic is identified according to the conditions in the ACL for further special processing by the device. In this embodiment, after the configuration information of the IM terminal is added to the access control list, the transmission of the message whose source address comes from the IM terminal or whose destination address is the IM terminal is opened.

According to the permission application function provided, the IM user submits a corresponding permission opening request to the permission control center. The permission opening request is completely sent by the IM terminal, and has more permission policies issued by the permission control center to control active zero-trust security signs. . The security identity is used to represent a person, service or IoT device, and they define a zero-trust control plane. When a certain security identity tries to access a resource, it needs to use strong authentication to verify the security identity and ensure that the access meets the requirements and is The typical behavior of this security ID follows the principle of least access privilege. The basic functions of the zero trust terminal are integrated in the IM terminal, and the function of the zero trust gateway is realized by integrating the function of the zero trust gateway through the gateway connected to the main device installed with the IM terminal. A second multi-factor verification request is required when suspicious access is found during verification of the security identity. The second multi-factor verification request specifically includes the verification code operation through SMS and email on the IM terminal. After the verification code is verified, the face-swiping operation is performed to realize the second authentication user operation. At the same time, through the friend group that comes with the IM terminal, find a trusted role to assist Confirm trusted access for users. This can prevent illegal users from accessing the zero trust system through normal means.

Embodiment 1: When the identity authentication policy server detects that an IM terminal is accessing with an overseas IP. At the same time, according to the schedule of the IM user, it was found that there was no departure from the country. At this time, the information pop-up window function of the IM terminal requires the client to confirm the access, and at the same time requires the user to verify the mobile phone SMS login account twice, otherwise the user's access request will be terminated. If there is no response to the information pop-up window within 1 minute, the user's client login will be disconnected directly. And before the user authenticates the mobile phone SMS login account for the second time, all login attempts of the IM terminal are rejected.

After the user has successfully logged in to the account through the mobile phone text message for the second time, a description of the exception will be sent to the mobile phone, and the user will explain in detail the situation when the exception occurs. The IM terminal will transmit the process data to the identity authentication policy server, which is convenient for relevant technical personnel to analyze and mutually verify with the user's situation description. In this embodiment, the user illegally opens the VPN software, which causes the IP address to change. This behavior is not allowed. Therefore, after recording the situation, the connection authority of the IM terminal corresponding to the master device is closed.

As shown in Figure 2, the gateway connected to the main device installed with the IM terminal verifies whether the user's request packet is legal, and decides whether to develop a TCP port for application access. This gives administrative control from what is sent. Dynamically issue the ACL policy of the switch, as a zero-trust terminal strategy, complete the first authentication in the switch, and rely on the user data, environment, IP, GPS and other basic environmental data obtained by the IM terminal's own gateway to verify the user's access security sex. After obtaining the configuration information of the IM terminal, the zero-trust terminal generates a configuration information list, performs initialization processing according to the configuration information list, closes high-risk ports and idle ports in turn according to the configuration information list, and modifies the configuration of the IM terminal to the minimum configuration that meets the basic functions . Some functions can be temporarily opened according to the request of IM users. The basic permissions activated by the IM terminal after being recorded on the identity authentication policy server include login OA permissions, WIFI authentication access permissions, and basic access function permissions.

Embodiment 2: When the gateway connected to the main device installed with the IM terminal verifies the user's client IMEI information, and finds that the user configuration file in the main device has been modified, a pop-up window can ask the user to re-enter the password, or use a SMS verification code Log in. At the same time, the corresponding IM friends of the user are required to assist in sending the corresponding confirmation code to the user's account to confirm the login security.

As shown in Figure 3, the present invention also includes write-back configuration. The configuration information of the IM terminal before initialization and after configuration is uploaded to the zero-trust terminal as a configuration template. Roll over the previous configuration information, delete the corresponding configuration template in the zero trust terminal, and exclude this IM terminal from the zero trust system. IM users need to deal with the problem before trying to reconfigure. After the zero-trust terminal detects the service type of the new IM terminal and the corresponding configuration information, it first compares it with the saved configuration information of the configured IM terminal, and chooses whether to directly adopt the existing configuration template according to the comparison result .

Although the present invention is disclosed above with preferred embodiments, it is not intended to limit the scope of the present invention. Any person skilled in the art may make some improvements without departing from the scope of the present invention, that is, all equivalent improvements made according to the present invention shall be covered by the scope of the present invention. In the description of this specification, descriptions referring to the terms "one embodiment/mode", "some embodiments/modes", "examples", "specific examples", or "some examples" mean that the embodiments/modes are combined The specific features, structures, materials or characteristics described in or examples are included in at least one embodiment/mode or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment/mode or example. Moreover, the described specific features, structures, materials or characteristics may be combined in any one or more embodiments/modes or examples in an appropriate manner. In addition, those skilled in the art may combine and combine different embodiments/modes or examples and features of different embodiments/modes or examples described in this specification without conflicting with each other.

In addition, the terms "first" and "second" are used for descriptive purposes only, and cannot be interpreted as indicating or implying relative importance or implicitly specifying the quantity of indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include at least one of these features. In the description of the present application, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined.

It should be understood by those skilled in the art that the above-mentioned embodiments are only for clearly illustrating the present disclosure, rather than limiting the scope of the present disclosure. For those skilled in the art, other changes or modifications can be made on the basis of the above disclosure, and these changes or modifications are still within the scope of the present disclosure.

Claims (10)

1. A zero-trust IM terminal configuration method based on identity authentication, which is used to add an IM terminal device in a configured zero-trust system, wherein the IM terminal device includes a master device equipped with an IM terminal and a master device connected to the IM terminal. For other devices on the main device, the main device with the IM terminal installed accesses the network with the zero-trust terminal. After the zero-trust terminal detects the main device, it obtains the existing service types and corresponding configuration information in the main device. The identity authentication policy server in the trust terminal records the identity of the main device, adds a security identifier to the main device, issues basic access rights to the main device, writes the rights into the writable switch, and the IM user passes the OA process Apply for opening other permissions. The application is approved by the process control center. After the approval, the configuration information of the main device is added to the access control list, and based on this open permission application, the IM user submits to the permission control center according to the provided permission application function. Corresponding permission opening request, the permission opening request is completely issued by the main device installed with the IM terminal, the permission opening involves other devices connected to the main device, after the request is approved, the corresponding device has the built-in authority of the identity authentication policy server The authority policy issued by the control center controls the active zero-trust security identification, and the security identification is uniformly sent to the main device, and distributed by the main device to other devices according to the authority request. 2. A zero-trust IM terminal configuration method based on identity authentication according to claim 1, wherein the security identifier is used to represent personnel, services or IoT devices, and they define a zero-trust control plane, when a certain When a security ID tries to access a resource, it needs to use strong authentication to verify the security ID, and ensure that the access meets the requirements and is a typical behavior of the security ID, and the access follows the principle of least access privilege. 3. A zero-trust IM terminal configuration method based on identity authentication according to claim 2, characterized in that a second multi-factor verification request is required when suspicious access is found in the verification of the security identification. 4. A zero-trust IM terminal configuration method based on identity authentication according to claim 3, wherein the second multi-factor verification request specifically includes performing a verification code operation on the IM terminal through a text message and a mailbox, and the verification code verification is completed Then scan the face to realize the operation of the second authentication user, and at the same time, through the friend group that comes with the IM terminal, find a trusted role to help confirm the user's trusted access. 5. A kind of zero-trust IM terminal configuration method based on identity authentication according to claim 1, is characterized in that, realizes zero-trust gateway through the gateway that the master device that IM terminal is connected is controlled by configurable switchboard, in this gateway Verify whether the user's request packet is legal, and decide whether to develop a TCP port for application access. 6. A zero-trust IM terminal configuration method based on identity authentication according to claim 5, characterized in that the switch ACL policy is dynamically issued as a zero-trust terminal policy, and the first authentication is completed in the switch, while relying on The user data, environment, IP, GPS and other basic environmental data obtained by the gateway connected to the main device installed with the IM terminal verify the user's access security. 7. A kind of zero-trust IM terminal configuration method based on identity authentication according to claim 1, it is characterized in that, zero-trust terminal obtains the configuration information of the main device that IM terminal is installed after generating configuration information list, according to configuration information list Carry out initialization processing, close high-risk ports and idle ports in turn according to the configuration information list, and modify the configuration of the main device installed with the IM terminal to the minimum configuration that meets the basic functions. 8. A kind of zero-trust IM terminal configuration method based on identity authentication according to claim 1 or 7, characterized in that, the basic authority of the IM terminal opened after the identity authentication policy server records has login OA authority, WIFI authentication access Permissions and basic access function permissions. 9. A kind of zero-trust IM terminal configuration method based on identity authentication according to claim 7, is characterized in that, also comprises write-back configuration, the configuration information of the IM terminal before initialization processing and after configuration is uploaded as configuration template For zero-trust terminals, once there is a problem with the operation of the IM terminal after the initialization process, the previous configuration information will be rolled back, and the corresponding configuration template will be deleted in the zero-trust terminal, and the IM terminal will be excluded from the zero-trust system. Users need to deal with the problem before attempting to reconfigure. 10. A zero-trust IM terminal configuration method based on identity authentication according to claim 9, characterized in that, after the zero-trust terminal detects the service type of the new IM terminal and the corresponding configuration information, it first compares it with the existing IM terminal Compare the saved configuration information of the configured IM terminal, and choose whether to directly adopt the existing configuration template according to the comparison result.

Images