WO2022262078A1 - 基于零信任安全的访问控制方法、设备及存储介质 - Google Patents

基于零信任安全的访问控制方法、设备及存储介质 Download PDF

Info

Publication number
WO2022262078A1
WO2022262078A1 PCT/CN2021/108408 CN2021108408W WO2022262078A1 WO 2022262078 A1 WO2022262078 A1 WO 2022262078A1 CN 2021108408 W CN2021108408 W CN 2021108408W WO 2022262078 A1 WO2022262078 A1 WO 2022262078A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
information
verified
identity
public
Prior art date
Application number
PCT/CN2021/108408
Other languages
English (en)
French (fr)
Inventor
王连赢
丁川达
于旸
Original Assignee
腾讯云计算（北京）有限责任公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯云计算（北京）有限责任公司 filed Critical 腾讯云计算（北京）有限责任公司
Publication of WO2022262078A1 publication Critical patent/WO2022262078A1/zh
Priority to US18/123,690 priority Critical patent/US20230224167A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response

Definitions

  • the present application relates to the field of cloud technology, and in particular to an access control method, device and storage medium based on zero-trust security.
  • the core concept of zero-trust security is "Never Trust, Always Verify" (Never Trust, Always Verify), which establishes a chain of trust through the following aspects: user trustworthiness, device trustworthiness, network link trustworthiness, and resource authority trustworthiness. , and conduct continuous and dynamic inspections to ensure the safety and credibility of the trust chain.
  • Embodiments of the present application provide an access control method, device, and storage medium based on zero-trust security, which can improve the security of zero-trust systems in terms of identity information.
  • an embodiment of the present application provides an access control method based on zero-trust security.
  • the method is executed by a terminal device, and a security authentication component and a business application run on the terminal device.
  • the method includes:
  • the service access request includes the identity information of the target user to be verified
  • the signature information to be verified is obtained by signing random challenge information with a private key; the private key cannot be read;
  • the security authentication component receives the signature verification pass message issued by the authentication server, and sends the service access request to the authentication server based on the signature verification pass message, so that the authentication server will pass the service access request forwarded to the service server accessed by the service application.
  • An embodiment of the present application provides an access control method based on zero trust security, the method is executed by an authentication server, and the method includes:
  • signature verification result is a signature verification pass result
  • a signature verification pass message is sent to the security authentication component, so that the security authentication component sends a service access request to the authentication server based on the signature verification pass message;
  • the security authentication component and the service application run in the terminal device.
  • An embodiment of the present application provides an access control device based on zero trust security, including:
  • An intercept authentication module configured to intercept a service access request initiated by a service application, the service access request including the target user's identity information to be verified;
  • the interception authentication module is used to obtain the identity information to be verified in the service access request
  • a forwarding module configured to initiate an identity authentication request carrying the identity information to be verified to an authentication server, so that the authentication server sends random challenge information to the security authentication component when determining that the identity information to be verified is legitimate information ;
  • a signature module configured to obtain signature information to be verified obtained by signing the random challenge information with a private key; the private key cannot be read;
  • the forwarding module is configured to send the signature information to be verified to the authentication server, so that the authentication server can verify the signature information based on the random challenge information and the public key certificate bound to the identity information to be verified.
  • the signature information to be verified is verified, and the result of the verification is obtained;
  • a receiving module configured to receive a signature verification pass message issued by the authentication server if the signature verification result is a signature verification pass result
  • the forwarding module is configured to send the service access request to the authentication server based on the signature verification message, so that the authentication server forwards the service access request to the service server accessed by the service application .
  • An embodiment of the present application provides an access control device based on zero trust security, including:
  • the identity verification module is used to respond to the identity authentication request carrying the identity information to be verified of the target user initiated by the security authentication component, and to verify the legality of the identity information to be verified;
  • a challenge sending module configured to send random challenge information to the security authentication component when it is determined that the identity information to be verified is legitimate information, so that the security authentication component obtains the random challenge information obtained by signing the random challenge information with a private key. signature information to be verified; the private key cannot be read;
  • a signature verification module configured to receive the signature information to be verified sent by the security authentication component, and verify the signature information to be verified based on the random challenge information and the public key certificate bound to the identity information to be verified, Get the verification result;
  • a business processing module configured to send a signature verification pass message to the security authentication component if the signature verification result is a signature verification pass result, so that the security authentication component sends a service access request based on the signature verification pass message to the authentication server; and forward the service access request to the service server accessed by the service application.
  • An embodiment of the present application provides a computer device, including: a processor, a memory, and a network interface;
  • the above-mentioned processor is connected to the above-mentioned memory and the above-mentioned network interface, wherein the above-mentioned network interface is used to provide a data communication function, the above-mentioned memory is used to store a computer program, and the above-mentioned processor is used to call the above-mentioned computer program to execute the method in the embodiment of the present application .
  • Embodiments of the present application provide a computer-readable storage medium on the one hand.
  • the computer-readable storage medium stores a computer program.
  • the computer program is loaded and executed by a processor, the method in the embodiment of the present application is executed.
  • Embodiments of the present application provide a computer program product or computer program on the one hand, the computer program product or computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium, and the processor of the computer device reads from the computer-readable storage The medium reads the computer instruction, and the processor executes the computer instruction, so that the computer device executes the method in the embodiment of the present application.
  • the security authentication component on the terminal device intercepts the service access request initiated by the service application, obtains the identity information to be verified in the service access request, and initiates an identity verification process carrying the identity information to be verified to the authentication server.
  • Authentication request so that when the authentication server determines that the identity information to be verified is legal, it sends random challenge information to the security authentication component, and then signs the random challenge information with the private key to obtain the signature information to be verified; and then sends the signature information to be verified Send it to the authentication server, so that the authentication server can verify the signature information based on the random challenge information and the public key.
  • the signature verification If the signature verification is passed, it will receive the signature verification message issued by the authentication server, and based on the signature verification message, the business access The request is sent to the authentication server, so that the authentication server forwards the service access request to the service server accessed by the service application.
  • the private key cannot be read.
  • the private key that cannot be read can be used to prevent the root of trust of the user's identity certificate from being leaked.
  • the random challenge information generated by the authentication server and the private key during each identity authentication can be used to obtain a new Therefore, the signature information to be verified is different for each identity authentication, so that attackers cannot steal user identities and improve the security of zero trust systems in terms of identity information.
  • FIG. 1 is a network architecture diagram provided by an embodiment of the present application
  • FIG. 2 is a schematic diagram of an access control scenario provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of an access control scenario provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of an access control scenario provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of an access control method provided in an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of another access control method provided by the embodiment of the present application.
  • FIG. 7 is a schematic flow diagram of a user registration method provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of a sequence of a user registration process provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of a sequence of a user authentication process provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of an access control device provided by an embodiment of the present application.
  • Fig. 11 is a schematic structural diagram of a computer device provided by an embodiment of the present application.
  • Fig. 12 is a schematic structural diagram of another access control device provided by an embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of another computer device provided by an embodiment of the present application.
  • the access control method of the present application is introduced below, and the description provides method operation steps such as embodiments or flow charts, but more or less operation steps may be included based on routine or non-creative work.
  • the sequence of steps enumerated in the embodiments is only one of the execution sequences of many steps, and does not represent the only execution sequence.
  • the methods shown in the embodiments or drawings may be executed sequentially or in parallel (for example, in a parallel processor or multi-thread processing environment).
  • Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on cloud computing business model applications. It can form a resource pool and be used on demand, which is flexible and convenient. Cloud computing technology will become an important support.
  • the background services of technical network systems require a lot of computing and storage resources, such as video websites, picture websites and more portal websites. With the rapid development and application of the Internet industry, each item may have its own identification mark in the future, which needs to be transmitted to the background system for logical processing. Data of different levels will be processed separately, and all kinds of industry data need to be powerful.
  • the system backing support can only be realized through cloud computing.
  • Cloud computing refers to the delivery and use mode of IT (Information Technology, information technology) infrastructure. It refers to obtaining the required services through the network in an on-demand and easy-to-expand manner. Such services can be IT and software, Internet related, or other services.
  • Cloud computing is grid computing (Grid Computing), distributed computing (Distributed Computing), parallel computing (Parallel Computing), utility computing (Utility Computing), network storage (Network Storage Technologies), virtualization (Virtualization), load balancing (Load Balance) and other traditional computer and network technology development fusion product.
  • cloud computing With the development of the Internet, real-time data streams, diversification of connected devices, and demand for search services, social networks, mobile commerce, and open collaboration, cloud computing has developed rapidly. Different from the parallel distributed computing in the past, the emergence of cloud computing will promote the revolutionary change of the entire Internet model and enterprise management model from the concept.
  • the solution provided by the embodiment of this application belongs to Cloud Security (Cloud Security) under the field of cloud technology.
  • Cloud security refers to the general term for secure software, hardware, users, institutions, and secure cloud platforms based on cloud computing business model applications. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and judgment of unknown virus behavior. Through the abnormal monitoring of software behavior in the network through a large number of mesh clients, it obtains the latest information on Trojan horses and malicious programs in the Internet, and sends Go to the server for automatic analysis and processing, and then distribute the virus and Trojan solution to each client.
  • the main research directions of cloud security include: 1. Cloud computing security, mainly researching how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, safe storage and isolation of user data, user access authentication, and information transmission security , network attack protection, compliance audit, etc.; 2. Cloudification of security infrastructure, mainly researching how to use cloud computing to build and integrate security infrastructure resources, optimize security protection mechanisms, including building ultra-large-scale security events and information through cloud computing technology The collection and processing platform realizes the collection and correlation analysis of massive information, and improves the ability to control security incidents and risk control of the entire network; 3. Cloud security services, mainly researching various security services based on cloud computing platforms for users, such as Antivirus services, etc.
  • the solution provided by the embodiment of the present application involves the security authentication of the identity information of the zero trust system.
  • Zero trust is a security concept, which is not in the same dimension as traditional security products/devices in essence. However, when the zero trust architecture is implemented, it will cooperate with traditional security products/devices, and may even replace some The case of traditional security products/appliances.
  • Zero trust can be understood literally, that is, it is not trustworthy for any object. Specifically, in the access control system, it is assumed that people (users), terminals, resources, etc. are all untrustworthy. By establishing a trust chain from people to terminals to resources, And dynamically verify the chain of trust in real time to realize secure and trusted requests for resources, block network attacks, and improve network security.
  • Zero trust can be applied to a variety of application scenarios, such as remote office, cloud computing platform, big data center, Internet of Things, 5G applications, etc.
  • FIG. 1 is a network architecture diagram provided by an embodiment of the present application.
  • the network architecture may include an authentication server 100, a service server 200, and a terminal device cluster, wherein the above-mentioned terminal device cluster may include a plurality of terminal devices, as shown in Figure 1, specifically may include a terminal device 10a, a terminal Device 10b, terminal device 10c, ..., terminal device 10n.
  • terminal equipment 10a, terminal equipment 10b, terminal equipment 10c, ..., terminal equipment 10n can carry out network connection with above-mentioned authentication server 100 respectively, so that each terminal equipment can carry out data exchange with authentication server 100 through network connection. interaction, so that each terminal device can receive the authentication data from the above-mentioned authentication server 100.
  • a network connection can be made between the business authentication server 100 and the business server 200.
  • the authentication server 100 determines that the terminal device has completed the authentication, it can forward the service request for a certain application initiated by the terminal device to the business server 200. .
  • each terminal device can be integrated with a target application and a business application.
  • the target application includes a security authentication component.
  • the terminal device can intercept the The service access request, and then obtain relevant authentication data, and perform data interaction with the authentication server 100 shown in FIG. Then forward it to the service server 200, and then the terminal device can access the protected resource corresponding to the service access request.
  • the service access request refers to a request to access protected resources.
  • the protected resources refer to resources that can only be accessed by specific users. For example, internal resources of the enterprise, non-enterprise employees cannot access the internal resources of the enterprise.
  • the terminal device when the terminal device initiates an access request for the internal resources of the enterprise through the business application, the terminal The device will first complete the identity authentication of the target user who initiates the service access request through the target application and the authentication server 100 .
  • the target application may be an application having data information functions such as account management, data collection and authentication, request interception and forwarding, such as a zero-trust client.
  • the protected applications can be game applications, video editing applications, social networking applications, instant messaging applications, live broadcast applications, short video applications, video applications, music applications, shopping applications, novel applications, payment applications, browsers, etc.
  • Application of data information functions such as image, audio and video.
  • Each terminal device can perform data interaction with the authentication server 100 to complete identity authentication.
  • the process can be as follows: after each terminal device intercepts the service access request for the protected application through the target application, it will obtain the service access request from the service access request. The identity information to be verified of the target user, and then each terminal device can obtain the identity information to be verified in the service access request, and then initiate an identity authentication request carrying the identity information to be verified to the authentication server 100, and then the authentication server 100 will The identity information to be verified is verified, and after it is determined that the identity information to be verified is legitimate information, random challenge information is sent to the corresponding terminal device.
  • the terminal device After receiving the random challenge information, the terminal device can use the private key corresponding to the target user in the public-private key storage component to sign the random challenge information in the public-private key storage component, obtain the signature information to be verified, and then send the signature information to be verified Send it to the authentication server 100, and the authentication server 100 checks the signature information to be verified through the public key certificate corresponding to the target user. If the authentication server 100 determines that the signature verification is passed, the authentication server 100 determines that the terminal device has completed the authentication, and issues The message of passing the signature verification is sent to the terminal device. The terminal device can then send the service access request to the authentication server 100 , and then the authentication server 100 will forward the service access request to the service server 200 .
  • the process of determining that the identity information to be verified is legal information may be to search the user information management database for the same legal information as the identity information to be verified, that is, to determine whether the target user is in the list of users allowed to access.
  • the public-private key storage component is a component with storage function, calculation function and data unreadable function.
  • the private key in the public-private key storage component can only be used in the public-private key storage component, and cannot be exported to the public-private key storage component , which can ensure that the private key is not leaked.
  • the public-private key storage component may be a hardware device independent of the terminal device, for example, a USB Key, and the public-private key storage component is connected to the terminal device for use.
  • the public-private key storage component may also be a hardware device embedded in the terminal device, for example, a TPM (Trusted Platform Module, trusted platform module) security chip.
  • the public-private key storage component may also be a software system running on the terminal device, for example, a virtualization-based isolation technology, a trusted execution environment, and the like.
  • one user account corresponds to one public and private key storage component.
  • the method provided in the embodiment of the present application can be executed by a computer device, and the computer device includes but is not limited to a terminal device, an authentication server or a service server.
  • both the authentication server and the business server can be independent physical servers, or server clusters or distributed systems composed of multiple physical servers, or provide cloud databases, cloud services, cloud computing, cloud functions, cloud storage, Cloud servers for basic cloud computing services such as network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network, content distribution network), and big data and artificial intelligence platforms.
  • Terminal devices can be smartphones, tablet computers, laptops, desktop computers, handheld computers, mobile Internet devices (Mobile Internet Device, MID), wearable devices (such as smart watches, smart bracelets, etc.), smart computers, etc. can run the above The smart terminal of the application client.
  • the terminal device, the authentication server, and the service server may be connected directly or indirectly through wired or wireless means, which is not limited in this embodiment of the present application.
  • the above-mentioned computer equipment may be a node in a distributed system, wherein the The distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting multiple nodes through network communication.
  • the peer-to-peer (P2P, Peer To Peer) network that can be formed between nodes
  • the P2P protocol is an application layer protocol that runs on the Transmission Control Protocol (TCP, Transmission Control Protocol) protocol.
  • TCP Transmission Control Protocol
  • any form of computer equipment such as servers, terminal equipment and other electronic equipment, can become a node in the blockchain system by joining the peer-to-peer network.
  • the terminal device 10a intercepts the service access request for the protected application, performs data interaction with the authentication server 100 to complete the authentication, and then forwards the service access request to the corresponding service server 100 through the authentication server 100 as an example for illustration. .
  • FIG. 2-FIG. 4 are schematic diagrams of an access control scenario provided by an embodiment of the present application.
  • Fig. 2 it is user A who has a binding relationship with terminal device 10a, and service application 11 and target application 12 are installed on terminal device 10a, wherein, service application 11 may be a browser, and target application 12 may be a user A A zero-trust client bound to internal resources of the company where A works.
  • the target application 12 can perform zero-trust authentication on the business application 11.
  • user A can complete the access to the internal resources of the enterprise through the business application 11 and use.
  • zero-trust authentication is performed on the business application 11, that is, the identity of user A is authenticated to determine whether user A has the right to access internal resources of the enterprise, so as to ensure that illegal personnel cannot access internal resources of the enterprise.
  • FIG 2 assume that user A has completed the user registration process of the target application 12. At this time, user A wants to log in to the company's webpage system to submit a flow chart. User A can enter the URL of the company's webpage system in the business application 11, and then initiate A business access request to the company's webpage system, wherein the business access request includes user A's identity information to be verified. Since the identity of user A is unknown at this time, if the service access request is directly forwarded to the service server 200, the service server 200 will reject the service access request.
  • the target application 12 will perform data interaction with the authentication server 100 to authenticate the user.
  • A's identity authentication when it is determined that user A's identity authentication is passed, the target application 12 will forward the service access request to the authentication server 100, and the authentication server 100 will forward the service access request to the service server 200, and the service server 200 is user A
  • the terminal device 10a includes a security authentication component 121 corresponding to the target application 12, and a public-private key storage component 122 connected to the terminal device 10a, or a public-private key storage component 122 running in the terminal device 10a.
  • the security authentication component 121 can intercept and forward the request.
  • the forwarding request includes request forwarding of an unauthenticated service access request and forwarding of an authenticated service access request
  • the interception request refers to intercepting and blocking an unauthenticated service access request.
  • the public-private key storage component 122 has attributes of unreadable stored data and operation attributes, and may be a built-in component of the terminal device 10a, or may be an external component connected to the terminal device 10a.
  • the unreadable property of stored data means that the data stored in the public-private key storage component 122 cannot be read by the outside, and can only be used in the public-private key storage component 122
  • the operation property means that the public-private key storage component 122 can The data is calculated and processed.
  • the service application 11 generates a service access request in response to user A's operation, and the terminal device 10a intercepts the service access request through the security authentication component 121, and then obtains user A's identity information to be verified from the service access request , where the identity information to be verified can be user name, account number, bound mobile phone number and other information. Then, the terminal device 10a will initiate an identity authentication request carrying the identity information to be verified to the authentication server 100 through the security authentication component 121 . After receiving the identity authentication request, the authentication server 100 will determine whether the identity information to be verified is legitimate information.
  • the process of determining whether the verification identity information is legal information may be: searching whether there is the same identity information as the verification identity information in the user information management database, and if found, it indicates that the identity information to be verified is legal information. If it is determined that the identity information to be verified is legitimate information, the authentication server will generate a random challenge information, and then send the random challenge information to the security authentication component 121 . The security authentication component 121 will send the random challenge information to the public-private key storage component 122, and the terminal device 10a will use the private key in the public-private key storage component 122 to sign the random challenge information to obtain signature information to be verified.
  • the terminal device 10a will forward the signature information to be verified to the authentication server 100 through the security authentication component 121, and the authentication server 100 will obtain the public key certificate bound to the identity information to be verified in the user information management library, and then sign the verification signature
  • the information is processed for signature verification, and the signature verification result is obtained.
  • the private key signature is to encrypt the random challenge information
  • the public key decryption is to decrypt the encrypted signature information to be verified. If the decrypted information is the same as the random challenge information sent by the authentication server 100, it means that the public and private keys are paired.
  • the signature verification is passed, and the user's identity authentication is passed.
  • user A target user
  • the target application 12 there is no identity information and public key certificate related to user A in the user information management library in the authentication server 100, the above-mentioned identity
  • the authentication process cannot be completed, and user A cannot access internal resources of the enterprise. Therefore, when user A uses the target application 12 for the first time, user registration needs to be performed first, and the specific implementation process can be referred to FIG. 4 .
  • the terminal device 10a can generate a public-private key pair of user A in the public-private key storage component 122, wherein the public-private key pair includes a private key and a public key, the private key and the public key are a pair of keys, and the private key It is owned by oneself, that is, no one else except user A knows the private key, and the public key is public.
  • the terminal device 10a may send a user registration request for user A to the authentication server 100, and the user registration request includes the public key and the user identity information of user A.
  • the authentication server 100 After the authentication server 100 receives the user registration request, it will perform the initial identity authentication of user A according to the user registration request, that is, send the initial identity authentication request to the terminal device 10a, then receive the identity authentication reply returned by the terminal device 10a, and then based on this Authentication Reply for authentication. As shown in FIG. 4 , the authentication server 100 will search user A's user identity information in the user information management database, then obtain the bound contact account, and send a random dynamic code to the contact account. At the same time, the authentication server 100 will send an initial identity authentication request to the terminal device 10a, and the terminal device 10a can display the dynamic code authentication interface 13 according to the initial identity authentication request.
  • the terminal device 10a After user A obtains the dynamic code through the contact account reserved in advance, that is, It can be input in the dynamic code authentication interface 10a, and then click the confirm button, and then the terminal device 10a will return the dynamic code input by user A to the authentication server 100, and the authentication server 100 will determine the returned dynamic code and the random dynamic code sent at the beginning If they are the same, it is determined that user A’s identity authentication has passed, and then a public key certificate is generated according to user A’s public key, and then user A’s user identity information and public key certificate are bound, and then stored together in the user information management database. At the same time, The authentication server 100 will also return the public key certificate to the terminal device 10a.
  • FIG. 5 is a schematic flowchart of an access control method provided by an embodiment of the present application.
  • the method is executed by the terminal device described in FIG. 1 , that is, any terminal device in the terminal device cluster in FIG. 1 (including terminal device 10a, terminal device 10b, terminal device 10c, and terminal device 10n).
  • the access control process includes the following steps:
  • Step S101 the security authentication component intercepts the service access request initiated by the service application, and the service access request includes the target user's identity information to be verified.
  • the business application refers to the application software used by the target user that requires zero-trust authentication, and the target user can access protected internal resources through these application software.
  • internal resources usually refer to operating resources that are controlled by the enterprise and have ownership and use rights, and are usually only allowed to be accessed by internal personnel of the enterprise, such as internal resources of a school, which are only allowed to be used by teachers and students of the school.
  • internal resources that must be accessed on the corporate intranet can now be accessed by internal personnel from any location. Therefore, terminal devices no longer run in a relatively safe intranet environment, but may run in any environment, such as homes, cafes, hotels, and so on.
  • the terminal device needs to perform zero-trust authentication for the service access request, that is, Authentication.
  • business applications may include B/S (Browser/Server, browser/server mode) architecture application software and C/S (Client/Server, client/server mode) architecture application software, for the application of B/S architecture
  • B/S Bitser/Server, browser/server mode
  • C/S Client/Server, client/server mode
  • Protected internal resources generally refer to application servers. These services are generally placed on the enterprise intranet or cloud, and access requests need to be authenticated, so that the resources behind the protected services can only be accessed by legitimate users. Therefore, the security authentication component will intercept the service access request initiated by the service application.
  • the security authentication component may only need to intercept the service access request initiated by the application for accessing and using internal resources, but the security authentication component does not need to intercept the service access request for other resources initiated by the service application.
  • the security authentication component will initially identify the service access request initiated by the application, such as analyzing the address information in the service access request, whether it is in the address list to be verified, etc., to determine whether the service access request is an access Internal resources, if accessing internal resources, the security authentication component will intercept the business access request.
  • a security authentication component and a public-private key storage component run on the terminal device; or, a security certification component runs on the terminal device and is connected to a public-private key storage component.
  • the security authentication component may be a built-in functional component in the zero-trust client (ie, the target application 12 shown in FIG. 2 ), and the security authentication component may implement request interception and forwarding.
  • the service access request includes the target user's identity information to be verified, such as account information, user name information and other information for uniquely identifying the target user.
  • Step S102 the security authentication component obtains the identity information to be verified in the service access request, and initiates an identity authentication request carrying the identity information to be verified to the authentication server, so that the authentication server determines that the identity information to be verified is legitimate information , send random challenge information to the security authentication component.
  • the security authentication component intercepts the service access request, it will extract the target user's identity information to be verified, and then generate an identity authentication request carrying the identity information to be verified, and the security authentication component will send the identity authentication request to the authentication server, Then wait for the processing of the authentication server.
  • the authentication server determines that the identity information to be verified is legitimate information, and sends random challenge information to the security authentication component.
  • the authentication server can provide corresponding user information management services, authentication services, access gateway and other functional services for the identity authentication process in the zero trust system.
  • the authentication server can be one server or a server cluster, and the above-mentioned functional services can be deployed on different servers. Here, only the functional services are deployed on the same server for illustration.
  • the random challenge information is information randomly generated by the authentication server based on this identity authentication request, which can be random numbers, random strings, etc., and the generated random challenge information can be different for each identity authentication request initiated by the same target user. .
  • the identity information to be verified of the target user belonging to legal information exists in the user information management database in the authentication server, and the identity information to be verified of the target user belonging to illegal information does not exist in the user information management database in the authentication server.
  • the authentication failure prompt information sent by the authentication server is obtained.
  • Step S103 the security authentication component obtains signature information to be verified, which is obtained by signing the random challenge information with a private key; the private key cannot be read.
  • the process for the security authentication component to obtain the signature information to be verified obtained by signing the random challenge information with the private key may be: the security authentication component transmits the obtained random challenge information to the public-private key storage component; the public-private key storage The component signs the random challenge information with the private key in the public-private key storage component to obtain the signature information to be verified; the public-private key storage component transmits the signature information to be verified to the security authentication component; the security authentication component obtains the signature to be verified transmitted by the public-private key storage component Information; public and private key storage components have data unreadable properties.
  • the public-private key storage component can also be called an identity storage device, which is used to store the trust root of the target user's user identity certificate, such as a private key.
  • the key attribute of the public-private key storage component is that the data is unreadable, that is, the secret information stored in it cannot be exported and copied. As long as this key attribute is met, both hardware devices and software systems can be used as the public-private key storage component of this application .
  • the external hardware device may also be called the public-private key storage component of the terminal device.
  • hardware devices such as USB key (a hardware device with a built-in single-chip microcomputer or smart card chip), TPM (Trusted Platform Module, trusted platform module) security chip, etc.
  • software systems such as isolated computing based on virtualization, trusted execution environment etc.
  • a public key public key
  • a private key private key
  • Party A You can use your own private key to sign the confidential information and then send it to Party B.
  • Party B can use Party A's public key to verify the signed confidential information received, so as to confirm that the confidential information comes from Party A.
  • the public-private key storage component stores the public key and private key of the target user.
  • the public key can be stored in the readable area of the public-private key storage component, but the private key can only be stored in the unreadable area of the public-private key storage component, that is, The target user's private key can only be used in the public-private key storage component, and other components and devices cannot read the target user's private key.
  • the security authentication component obtains the signature information to be verified by signing the random challenge information with the private key in the public-private key storage component.
  • the process can be as follows: the public-private key storage component hashes the random challenge information to obtain the random challenge information
  • the digital digest of the public-private key storage component asymmetrically encrypts the digital digest through the private key in the public-private key storage component to obtain signature information to be verified for the random challenge information.
  • hash operation also known as hash operation, is to transform an input of any length into a fixed-length output through a hash algorithm. This output value is a digital summary.
  • the hash operation may include a division hash method, a multiplication hash method, a Fibonacci hash method, and the like. It is understandable that if the random challenge information is small, such as a random number, the random number can be asymmetrically encrypted using the target user's private key directly through the public-private key storage component, without hashing it to obtain the number Summary.
  • Step S104 the security authentication component sends the signature information to be verified to the authentication server, so that the authentication server performs signature verification processing on the signature information to be verified based on the random challenge information and the public key certificate bound to the identity information to be verified, and obtains a signature verification result.
  • the security authentication component sends the signature information to be verified to the authentication server, and then waits for the authentication server to verify based on the random challenge information and the public key certificate bound to the identity information to be verified.
  • the signature information is processed for signature verification, and the signature verification result is obtained.
  • the public key certificate is a digital certificate generated by the authentication server according to the public key of the target user when the target user completes user registration.
  • Digital certificates are also called "digital ID cards" and "network ID cards”.
  • the digital signature of the certificate certification authority is an electronic file containing the owner of the public key and related information of the public key, which can be used to prove the true identity of the digital certificate holder.
  • Step S105 if the signature verification result is a signature verification pass result, the security authentication component receives the signature verification pass message issued by the authentication server, and sends the service access request to the authentication server based on the signature verification pass message, so that the authentication server will pass the service
  • the access request is forwarded to the service server accessed by the service application.
  • the authentication server determines that the signature verification result is the result of the signature verification pass, it will issue a signature verification pass message.
  • the security authentication component receives the signature verification pass message, it will forward the service access request to the authentication server, and then the authentication server will The business access request is forwarded to the business server accessed by the business application, that is, the server where the server corresponding to the internal resource is located.
  • the security authentication component can add access status for the target user.
  • the security authentication component intercepts the business access request, it will query the access status of the target user. If the access status is allowed, the service access request will be sent to the authentication server, so that the authentication server forwards the service access request to the service server accessed by the application; if the access state is an unknown access state, an identity authentication request carrying the identity information to be verified is initiated to the authentication server.
  • the above process can be realized through the security authentication component, that is, the terminal device can add the access status for the target user in the security authentication component.
  • the security authentication component queries the access status of the target user. In this way, when the target user initiates multiple service access requests for internal resources in a short period of time, the security authentication component only needs to authenticate the target user when the target user initiates the service access request for the first time.
  • the authentication server When the identity authentication of the target user is passed, and the authentication server sends the above-mentioned signature verification pass message, it can also issue a state adjustment instruction, and the security authentication component adjusts the access state of the target user to the access state according to the state adjustment instruction; at the same time, the security The authentication component can set the access validity period for the target user's access status; when the target user's access status is the current accumulative time of the allowed access status exceeds the allowed access validity period, adjust the target user's access status to an unknown access status. Assuming that the allowed access is valid for one hour, within one hour after the target user passes the identity authentication of the authentication server, the service access request initiated by the target user again can be directly forwarded to the service server without further identity authentication.
  • the public-private key storage component will first generate the public-private key pair of the target user, wherein the public-private key pair includes the private key and the public key; the public-private key storage component transmits the public key to the security authentication component; the security authentication component receives the public key transmitted by the public-private key storage component.
  • the security authentication component receives the initial identity authentication request initiated by the authentication server based on the user registration request, and according to the initial The identity authentication request sends an identity authentication reply to the authentication server, so that the authentication server performs identity authentication according to the identity authentication reply, and obtains the identity authentication result; if the identity authentication result is a successful identity authentication result, it receives the public key of the target user issued by the authentication server Certificate; the security authentication component transmits the public key certificate to the public and private key storage component, so that the public and private key storage component stores the public key certificate.
  • the process of sending an identity authentication reply to the authentication server according to the initial identity authentication request may be: displaying the dynamic code authentication interface according to the initial identity authentication request; in response to receiving an input determination operation on the dynamic code authentication interface, Obtain the dynamic code to be verified, and use the dynamic code to be verified as the identity authentication reply; send the identity authentication reply to the authentication server, so that the authentication server will compare the dynamic code to be verified with the random dynamic code, and determine the initial identity authentication according to the comparison result result.
  • the dynamic code authentication interface is used to input the dynamic code to be verified, the user can input the dynamic code to be verified in the dynamic code authentication interface according to the random dynamic code sent by the authentication server to the contact account, and the contact account is stored in the user information management library of the authentication server It has a binding relationship with user identity information. If the comparison result shows that the dynamic code to be verified is the same as the random dynamic code, the initial identity authentication result is the initial identity authentication success result; if the comparison result is that the dynamic code to be verified is not the same as the random dynamic code, the initial identity authentication result is the initial Result of authentication failure.
  • the token storage component runs on the terminal device, and the process of sending an identity authentication reply to the authentication server according to the initial identity authentication request may be: according to the initial identity authentication request, call the token storage component according to the token password key to generate a dynamic password to be verified, and use the dynamic password to be verified as an identity authentication reply; send the dynamic password to be verified to the authentication server, so that the authentication server will compare the dynamic password to be verified with the target dynamic password, and according to the comparison result Determine the initial authentication result.
  • the target dynamic password is generated by the authentication server according to the target token key associated with the user identity information in the user management information base.
  • the initial identity authentication result is the successful result of initial identity authentication; if the comparison result is that the dynamic password to be verified is not the same as the target dynamic password, the initial identity authentication result is initial Result of authentication failure.
  • the method provided by the embodiment of this application can prevent the target user's identity credential root from being leaked by using an unreadable private key, and the subsequent security authentication component intercepts the service access request initiated by the service application and obtains the service access request Initiate an identity authentication request carrying the identity information to be verified to the authentication server, and then receive the random challenge information sent by the authentication server when the authentication server determines that the identity information to be verified is legal; call the public-private key storage component Sign the random challenge information with the private key to obtain the signature information to be verified, and wait for the authentication server to verify the signature based on the random challenge information and the public key of the target user.
  • Using the method provided by the embodiment of this application can ensure that the signature information to be verified is different each time, and the private key that generates the signature information to be verified will not be leaked, so that the attacker cannot steal the user's identity and improve the security of the zero trust system in terms of identity information. safety.
  • FIG. 6 is a schematic flowchart of another access control method provided by the embodiment of the present application, which is executed by the authentication server 100 described in FIG. 1 .
  • the access control process includes the following steps:
  • step S201 the authentication server responds to the identity authentication request carrying the identity information to be verified of the target user initiated by the terminal device, and performs legality verification on the identity information to be verified.
  • the authentication server After receiving the identity authentication request carrying the identity information to be verified of the target user, the authentication server will first determine whether the identity information to be verified is legal, that is, whether the target user has completed user registration.
  • the authentication server stores the user information management library. After the user completes the above user registration, the authentication server will bind the user's user identity information and public key certificate and store it in the user information management library. Therefore, the authentication server responds to the identity authentication request carrying the target user's identity information to be verified initiated by the security authentication component, and the process of performing legality verification on the identity information to be verified can be: the authentication server responds to the target user's pending identity information initiated by the security authentication component.
  • the target user’ To verify the identity information of the identity authentication request, search the target user’s identity information to be verified in the user information management database; if the user identity information that is the same as the target user’s identity information to be verified is found in the user information management database, determine the target user The identity information to be verified of the target user is legal information; if the same user identity information as the target user’s identity information to be verified is not found in the user information management database, it is determined that the target user’s identity information to be verified is illegal information, and the terminal device downloads Send an authentication failure prompt message.
  • the authentication failure prompt information may be prompt information such as "the user has not registered yet".
  • Step S202 when it is determined that the identity information to be verified is legitimate information, the authentication server sends random challenge information to the security authentication component, so that the security authentication component obtains the signature information to be verified obtained by signing the random challenge information with a private key; The key could not be read.
  • the random challenge information is randomly generated by the authentication server according to related functions or methods.
  • the random challenge information is different in each identity authentication process.
  • the random challenge information may include random numbers, random character strings, random text, and the like.
  • the specific process for the security authentication component to obtain the signature information to be verified after receiving the random challenge information may refer to the above step S103.
  • Step S203 the authentication server receives the signature information to be verified sent by the security authentication component, and performs signature verification on the signature information to be verified based on the random challenge information and the public key certificate bound to the identity information to be verified, and obtains a signature verification result.
  • the process of receiving the signature information to be verified sent by the security authentication component, performing signature verification on the signature information to be verified based on the random challenge information and the public key certificate bound to the identity information to be verified, and obtaining the signature verification result can be as follows: receiving The signature information to be verified sent by the security authentication component; then obtain the public key certificate bound to the identity information of the target user to be verified in the user information management library, and determine the public key of the target user according to the public key certificate, for example, the user information management library
  • the user identity information and public key certificate of the user are stored in the user information management database.
  • the authentication server determines the user identity information that matches the identity information to be verified in the user information management database, and the public key certificate corresponding to the user identity information is the identity to be verified.
  • the public key certificate bound to the information; the signature information to be verified is verified based on the public key of the target user and the random challenge information, and the signature verification result is obtained.
  • the public key certificate is an electronic file containing the owner of the public key and related information of the public key mentioned above, which can be used to prove the true identity of the digital certificate holder.
  • the authentication server obtains the public key certificate bound to the identity information to be verified, it can determine that the public key in the public key certificate belongs to the target user according to the relevant information on the public key certificate, and directly obtain the public key of the target user from the public key certificate. key.
  • the process of verifying the signature information to be verified and obtaining the result of the verification can be as follows: decrypt the signature information to be verified based on the public key of the target user to obtain a digital digest; The hash operation is performed on the challenge information to obtain the real digital summary of the random challenge information; if the digital summary is the same as the real digital summary, the signature verification result is determined to be the signature verification result; if the digital summary is not the same as the real digital summary, the signature verification is determined The result is the signature verification failure result, and the identity verification failure prompt message is sent to the security authentication component.
  • the hash algorithm used by the authentication server for the random challenge information and the hash algorithm used by the public-private key storage component for the random challenge information should be the same algorithm.
  • Step S204 if the signature verification result is a signature verification pass result, the authentication server sends a signature verification pass message to the security authentication component, so that the security authentication component sends a service access request to the authentication server based on the signature verification pass message.
  • the signature verification indicates that the public key obtained by the authentication server matches the private key of the target user, and the service access request of the target user is legal. Message instructions for internal resources, after the security authentication component receives the signature verification message, it will forward the service access request to the authentication server.
  • Step S205 the authentication server forwards the service access request to the service server accessed by the service application.
  • the authentication server forwards the service access request to the service server accessed by the service application, so that the target user can normally access internal resources.
  • the authentication server After the authentication server determines that the identity information to be verified of the target user is legal, it will generate random challenge information and send it to the security authentication component, and then wait for the security authentication component to sign the random challenge information with a private key to obtain The signature information to be verified, and then the authentication server will obtain the public key certificate of the target user, so as to obtain the public key of the target user to verify the signature information to complete the identity authentication of the target user. Due to the uncertainty of the random challenge information, the signature information to be verified sent by the security authentication component is also uncertain. Even if the signature information to be verified is leaked for a certain time, it will not be available next time, which can prevent identity cloning attacks.
  • FIG. 7 is a schematic flowchart of a user registration method provided by an embodiment of the present application. This method can be executed by the authentication server 100 described in FIG. 1 . As shown in Figure 7, the access control process includes the following steps:
  • Step S301 the authentication server receives the user registration request for the target user sent by the security authentication component; the user registration request includes the target user's public key and the target user's user identity information.
  • a zero-trust client (including security authentication components) can be integrated and installed in the terminal device. After the data interaction between the corresponding security authentication component, public-private key storage component, and authentication server completes the identity authentication of the target user, it can be forwarded to the business server through the authentication server.
  • the public key certificate and user identity information of the target user are required, but when the target user uses to access internal resources for the first time, there is no relevant user identity information and public key certificate in the authentication server. Therefore, it is necessary to First, send a user registration request to the authentication server through the zero-trust client, and complete the registration and storage of user identity information and public key certificates in the user information management database.
  • Step S302 sending an initial identity authentication request based on the user registration request to the security authentication component, receiving an identity authentication reply sent by the security authentication component according to the initial identity authentication request, performing identity authentication according to the identity authentication reply, and obtaining an identity authentication result.
  • the user information management library may include an internal user list, that is, a list of users allowed to access internal resources. It is understandable that internal resources are non-public access resources, and only specific groups of people can access internal resources, such as company internal resources, only company employees and company-related customers are allowed to access. Usually, resource managers will update the internal user list in the user information management database according to personnel changes and business dealings. It should be noted that the users in the internal user list include registered users and unregistered users. If users on the internal user list have not completed user registration, they cannot complete identity authentication to access internal resources.
  • the internal user list includes the user's initial identity information and registration information, where the registration information can be contact account number, contact phone number, contact email address, token key, etc., which are used to help users complete user registration.
  • the authentication server when the registration information is a contact account number, after receiving the initial identity authentication request, the authentication server will query the contact account number bound to the user's initial identity information corresponding to the user identity information in the user information management database, and then send the Contact the account to send a random dynamic code, then send the initial identity authentication request based on the user registration request to the security authentication component, receive the identity authentication reply sent by the security authentication component according to the initial identity authentication request, perform initial identity authentication according to the identity authentication reply, and get the initial
  • the process of the identity authentication result may be: sending an initial identity authentication request initiated based on a user registration request to the security authentication component, so that the security authentication component displays a dynamic code authentication interface according to the initial identity authentication request (such as in the above-mentioned embodiment corresponding to Figure 4
  • the dynamic code authentication interface 13 in response to receiving the input determination operation on the dynamic code authentication interface, the security authentication component obtains the dynamic code to be verified, and uses the dynamic code to be verified as an identity authentication reply; the authentication server receives the pending code sent by
  • the dynamic code to be verified To verify the dynamic code, compare the dynamic code to be verified with the random dynamic code; if the dynamic code to be verified is the same as the random dynamic code, determine that the initial identity authentication result is the successful result of the initial identity authentication; if the dynamic code to be verified and the random dynamic code If the codes are not the same, it is determined that the initial identity authentication result is the initial identity authentication failure result. It is understandable that if the target user is a legitimate user, the random dynamic code issued by the authentication server can be obtained by contacting the account, and the received random dynamic code can be input through the dynamic code authentication interface, and the pending code obtained by the security authentication component The verification dynamic code must be the same as the random dynamic code.
  • the authentication server when the registration information is a token key, sends an initial identity authentication request based on the user registration request to the security authentication component, and receives the identity authentication reply sent by the security authentication component according to the initial identity authentication request, according to
  • the process of performing initial identity authentication and obtaining the initial identity authentication result can be as follows: the authentication server sends an initial identity authentication request based on the user registration request to the security authentication component, so that the security authentication component
  • the card storage component generates a dynamic password to be verified according to the token key; receives the dynamic password to be verified sent by the security authentication component; obtains the target token key associated with the user identity information in the user management information base, and according to the target token key key to generate the target dynamic password; if the dynamic password to be verified is the same as the target dynamic password, then determine that the initial identity authentication result is the successful result of initial identity authentication; if the dynamic password to be verified is not the same as the target dynamic password, then determine that the initial identity authentication result is Initial authentication failure result.
  • Step S303 if the identity authentication result is determined to be a successful identity authentication result, the authentication server generates a public key certificate according to the public key and the basic information of the certificate.
  • the target user's public key certificate records personal information such as the target user's name, organization, email address, and the public key belonging to the target user, and needs to be digitally signed by a certification authority (Certifying Authority, CA).
  • CA Certification Authority
  • the authentication server obtains the public key certificate of the target user, it can be determined that the public key therein belongs to the target user, and the public key certificate can be referred to as a certificate for short.
  • the certification authority can be understood as a trusted third party.
  • Both the certification server and the terminal device recognize the public key certificate generated by the certification authority, which can be used to determine that "the public key really belongs to the target user" and verify it with its own private key. to sign.
  • the function of the certification authority can be realized through the certificate issuing component.
  • the certificate issuing component can be built in the authentication server or externally placed in a special CA server.
  • the authentication server can communicate with the CA server to indirectly call the certificate issuing component. Generate the target user's public key certificate.
  • Step S304 the authentication server binds the public key certificate and user identity information, stores the bound public key certificate and user identity information in the user information management database; sends the public key certificate to the security authentication component, so that The terminal device stores the public key certificate.
  • the authentication server will bind the public key certificate and user identity information, and then store the bound public key certificate and user identity information in the user information management database, which is convenient management and inquiries.
  • the authentication server will also send the public key certificate to the security authentication component, and the security authentication component writes the public key certificate into the public and private key storage component, so that the public and private key storage component stores the public key certificate, which is convenient for terminal equipment to query and manage.
  • FIG. 8 is a schematic sequence diagram of a user registration process provided by an embodiment of the present application.
  • the user registration process refers to the registration process when the user uses the zero trust system for the first time.
  • the user registration process involves four main objects: certificate storage device, zero trust client, user management server, and CA server.
  • the certificate storage device is the above-mentioned public and private key storage component
  • the zero-trust client is the above-mentioned target application including the security authentication component (that is, the target application 12 shown in Figure 2 above).
  • Key certificate generation assuming that the above-mentioned certificate issuing components correspond to the CA server alone, and the functions of the other authentication servers are realized through the user management server.
  • the CA server and the user management server can be independent servers or integrated into one server, that is, The above authentication server.
  • the specific process of user registration is described as follows:
  • the certificate storage device (public-private key storage component) generates a public-private key key pair, and sends the public key to the zero-trust client (security authentication component).
  • the certificate storage device generates a public-private key pair within itself, and sends the public key to the zero-trust client installed on the terminal device.
  • the private key never leaves the certificate storage device, and as mentioned above, the certificate storage device is unreadable, so the private key cannot be exported.
  • the generation of public-private key pairs can be based on asymmetric cryptography methods, such as RSA (an asymmetric key encryption technology), DSA (Digital Signature Algorithm, digital signature algorithm), ECDSA (Elliptic Curve Digital Signature Algorithm, elliptic curve signature algorithm) or other zero-knowledge proof algorithms.
  • S42 The zero-trust client initiates a user registration request carrying the public key and user identity information.
  • the zero-trust client sends a user registration request to the user management server, and the data of the request mainly includes the public key and necessary user identity information.
  • S43 The user management server initiates a multi-factor authentication request (that is, the above-mentioned initial identity authentication request).
  • the user management server After receiving the user registration request sent by the zero-trust client, the user management server will actively initiate a multi-factor authentication request to the user.
  • multi-factor authentication methods include: SMS dynamic authentication code, mobile application QR code Scan code authentication, dynamic token, etc.
  • the user management server actively initiates multi-factor authentication to the user is an abstract and omitted term to unify the expressions in different implementation modes, mainly emphasizing that the multi-factor authentication action is controlled and initiated by the user management server.
  • the user server When the next user request arrives, the user server will first check the multi-factor authentication status. If it has not yet been authenticated, it will send multi-factor authentication information (SMS, QR code, dynamic token, etc.) and wait for a reply.
  • SMS SMS
  • QR code QR code
  • dynamic token dynamic token
  • S44 The zero-trust client generates a multi-factor authentication reply according to the multi-factor authentication request.
  • the user After the user receives the multi-factor authentication information issued by the user management server, according to the specific multi-factor authentication method, the user replies with the corresponding multi-factor authentication reply (such as SMS verification code, QR code scanning result) through the zero trust client. , dynamic token information, etc.) to the user management server.
  • the corresponding multi-factor authentication reply such as SMS verification code, QR code scanning result
  • S45 The user management server performs multi-factor authentication according to the multi-factor authentication reply.
  • the user management server After receiving the multi-factor authentication reply message from the zero-trust client, the user management server will determine the result of the multi-factor authentication according to different multi-factor authentication methods. For specific implementation, reference may be made to the relevant description of step S302 in the embodiment corresponding to FIG. 7 above, and details are not repeated here.
  • the user management server determines that the multi-factor authentication fails, it will directly return an authentication failure prompt message, informing the user that the registration has failed.
  • the user management server determines that the multi-factor authentication is successful, the user management server will send a certificate signing request (Certificate Signing Request, CSR) to the CA server, and the CSR includes the public key and other basic information required by the certificate.
  • CSR Certificate Signing Request
  • the certificate authority server generates a public key certificate and sends it to the user management server.
  • the certificate authority server will obtain the public key and other basic information required by the certificate from the CSR request, then generate the initial certificate, and then use the stored certificate private key to sign the initial certificate to obtain the public key certificate, and then issue it to the user Management server.
  • the user management server binds the user identity information and the public key certificate, and then stores them in the user information management database.
  • the user management server binds the user identity information with the public key certificate, generally using the user ID (Identity Document, identification number) and the fingerprint of the certificate for binding, and stores it in the user information management database.
  • the fingerprint of the certificate means that the certificate has a unique identification code.
  • S410 The user management server issues the public key certificate to the zero-trust client, and the zero-trust client installs the certificate, and at the same time transmits it to the certificate storage device for storage.
  • FIG. 9 is a schematic sequence diagram of a user authentication process provided by an embodiment of the present application.
  • the user can use the zero-trust client to cooperate with the certificate storage device to perform zero-trust authentication, which is convenient.
  • Access protected intranet resources Compared with the above user registration process, the user authentication process has two more main objects: user software and protected resources.
  • User software refers to software used by users that requires zero-trust authentication. Users need to use these software to access internal protected resources.
  • B/S architecture software user software generally refers to a browser; for C/S architecture software, user software generally refers to specific client software.
  • Protected resources generally refer to software servers. These services are generally placed on the enterprise intranet or cloud, and access requests need to be authenticated, so that the resources behind the protected services can only be accessed by legitimate users.
  • the specific process of user authentication is described as follows:
  • S501 The service access request initiated by normal user software is intercepted by the zero-trust client.
  • the service access request will be intercepted by the zero-trust client.
  • the zero-trust client can intercept business access requests by using the virtual network card full-flow proxy method. Simply put, all requests from terminal devices will pass through the zero-trust client, and the zero-trust client can identify the request and intercept the access.
  • a business access request for a protected resource is a business access request for a protected resource.
  • the zero-trust client initiates an identity authentication request carrying target user identity information to be verified.
  • the zero-trust client intercepts the service access request, it will initiate a user authentication process and send an identity authentication request carrying identity information to be verified to the user management server.
  • S503 The user management server verifies the validity of the identity information to be verified, and sends a prompt message of identity verification failure if it determines that the identity information to be verified is illegal information.
  • the user management server searches the user information management database for the same user information as the identity information to be verified, and checks the user information; if the user information check fails, that is, the same user information is not found in the user information management database, then If it is determined that the identity information to be verified is illegal, the user authentication failure message may be directly returned to the zero-trust client.
  • the certificate issuing component is placed on the certificate authority server, the above-mentioned processes of generating random challenge information and performing signature verification processing on the signature information to be verified can also be implemented by the certificate authority server.
  • the user management server will first initiate a challenge request to the CA server.
  • S505 The certificate authority server generates challenge information (random number).
  • the CA server after receiving the challenge request, the CA server will send challenge information (that is, the above random challenge information) to the zero-trust client, and the actual information of the challenge message may be a random number.
  • challenge information that is, the above random challenge information
  • S506 The zero-trust client forwards the challenge information (random number) to the certificate storage device.
  • the zero-trust client will forward the challenge information to the certificate storage device, initiate a challenge response process, and then perform a digital certificate signature operation inside the certificate storage device.
  • S507 The certificate storage device signs the challenge information by using the private key.
  • the certificate storage device itself has computing power. After receiving a random challenge, digitally sign the challenge message inside the device. The essence is to use the private key stored in the device to encrypt the random number of the challenge message.
  • the certificate storage device sends the digital signature to the zero-trust client.
  • the certificate storage device sends the calculated digital signature of the random challenge (that is, the signature information to be verified) to the zero-trust client.
  • S509 The zero-trust client sends the digital signature to the certificate authority server.
  • the certificate authority server sends a user information query request.
  • the user information query request includes the user information of the user.
  • S511 The user management server returns the public key certificate.
  • the user management server will search the user information management database for the public key certificate bound to the user information, and then return it to the CA server.
  • S512 The certificate authority server verifies the digital signature according to the user information.
  • the CA server performs a digital signature verification process.
  • the specific operation is to use the certificate public key to decrypt the digital signature, and then compare the decrypted message with the challenge information sent in step S505. If they are consistent, the verification is successful, if not, the verification fails.
  • the CA server will return a digital signature verification failure message to the zero-trust client.
  • the verification fails and the business access request of the normal user software is terminated;
  • the client returns a digital signature verification success message, indicating that the user's authentication is successful.
  • S514 the verification is successful, the zero-trust client forwards the service access request to the user management server, and the user management server forwards the service access request to the protected resource.
  • S515 A protected resource response.
  • the user accesses the protected resources through the normal user software, he needs to go through the challenge authentication of the CA server first, and after the challenge authentication is passed, the service access request is forwarded to the user management server, and then forwarded by the user management server to protected resources. Since the private key of the terminal device is non-exportable, an attacker cannot steal the private key to generate the digital signature required for challenging authentication, so the user's identity cannot be stolen, thereby avoiding identity cloning attacks.
  • FIG. 10 is a schematic structural diagram of an access control device based on zero trust security provided by an embodiment of the present application.
  • the above-mentioned access control device may be a computer program (including program code) running on a computer device, for example, the access control device is an application software; the device may be used to execute the corresponding steps in the method provided by the embodiment of the present application.
  • the access control device 1 may include: an interception authentication module 211 , a signature module 212 and a forwarding module 213 .
  • An intercept authentication module 211 configured to intercept a service access request initiated by a service application, where the service access request includes the target user's identity information to be verified;
  • the intercept authentication module 211 is also used to obtain the identity information to be verified in the service access request;
  • the forwarding module 213 is configured to initiate an identity authentication request carrying identity information to be verified to the authentication server, so that the authentication server sends random challenge information to the security authentication component when determining that the identity information to be verified is legitimate information;
  • the signature module 212 is used to obtain the signature information to be verified obtained by signing the random challenge information through the private key; the private key cannot be read;
  • the forwarding module 213 is configured to send the signature information to be verified to the authentication server, so that the authentication server performs signature verification on the signature information to be verified based on the random challenge information and the public key certificate bound to the identity information to be verified, and obtains a signature verification result;
  • a receiving module configured to receive a signature verification pass message issued by the authentication server if the signature verification result is a signature verification pass result
  • the forwarding module 213 is further configured to send the service access request to the authentication server based on the signature verification message, so that the authentication server forwards the service access request to the service server accessed by the service application.
  • the specific implementation manners of the intercepting authentication module 211, the signature module 212 and the forwarding module 213 can refer to the description of steps S101-S105 in the above embodiment corresponding to FIG. 5, which will not be repeated here.
  • the signature module 212 may include: a component signature unit 221 .
  • the component signature unit 221 is configured to transmit the random challenge information to the public-private key storage component, and the public-private key storage component is used to sign the random challenge information with the private key in the public-private key storage component to obtain the pending Verify the signature information; the public and private key storage components have data unreadable properties;
  • the component signature unit 221 is configured to obtain the signature information to be verified transmitted by the public and private key storage component.
  • the public-private key storage component is configured to perform a hash operation on the random challenge information to obtain a digital digest of the random challenge information; perform asymmetric encryption processing on the digital digest through the private key to obtain the digital digest for the random challenge information.
  • the signature information of the random challenge information to be verified.
  • the public-private key storage component is a hardware device used to connect with the terminal device, or, the public-private key storage component is a hardware device in the terminal device, or, the public-private key storage component is run on the The software system on the terminal device.
  • step S103 for the specific implementation manner of the component signature unit 221, reference may be made to the description of step S103 in the above embodiment corresponding to FIG. 5 , which will not be repeated here.
  • the identity information to be verified of the target user belonging to legal information exists in the user information management database in the authentication server, and the identity information to be verified of the target user belonging to illegal information does not exist in the user information management database in the authentication server;
  • the access control device 1 may also include:
  • the authentication illegal module 14 is configured to receive the identity verification failure prompt information sent by the authentication server when the authentication server determines that the identity information to be verified is illegal information.
  • the specific implementation manner of the authenticating illegal module 14 can refer to the description of step S103 in the above embodiment corresponding to FIG. 5 , which will not be repeated here.
  • the access control device 1 may further include: a transmission module 15 , a registration request module 16 , a reply authentication module 17 and a certificate storage module 18 .
  • the public-private key storage component is used to generate a target user's public-private key pair;
  • the public-private key pair includes a private key and a public key;
  • a transmission module 15, configured to receive the public key transmitted by the public-private key storage component
  • the registration request module 16 is used to send the user registration request for the target user to the authentication server; the user registration request includes the public key of the target user and the user identity information of the target user;
  • the registration request module 16 is also used to receive the initial identity authentication request initiated by the authentication server based on the user registration request;
  • the reply authentication module 17 is used to send an identity authentication reply to the authentication server according to the initial identity authentication request, so that the authentication server performs initial identity authentication according to the identity authentication reply, and obtains an initial identity authentication result;
  • the certificate storage module 18 is also used to receive the public key certificate issued by the authentication server if the initial identity authentication result is a successful initial identity authentication result;
  • the transmission module 15 is configured to transmit the public key certificate to the public and private key storage component, and the public and private key storage component is used to store the public key certificate.
  • step S105 for the specific implementation of the generating module 15, the registration request module 16, the reply authentication module 17 and the certificate storage module 18, please refer to the optional description of step S105 in the embodiment corresponding to FIG. 5 above, which will not be repeated here.
  • the identity authentication reply includes a dynamic code to be verified
  • the reply authentication module 17 may include: an interface display unit 171 , a first response unit 172 and a first result determination unit 173 .
  • the interface display unit 171 is used to display the dynamic code authentication interface according to the initial identity authentication request; the dynamic code authentication interface is used to input the dynamic code to be verified;
  • the first response unit 172 is used to respond to receiving the input determination operation on the dynamic code authentication interface to obtain the dynamic code to be verified;
  • the first result determining unit 173 is used to send the dynamic code to be verified to the authentication server, so that the authentication server will compare the dynamic code to be verified with the random dynamic code, and determine the initial identity authentication result according to the comparison result; the random dynamic The code is sent by the authentication server to the contact account, and the contact account has a binding relationship with the target user in the user information management database of the authentication server;
  • the initial identity authentication result is the successful result of the initial identity authentication; if the comparison result is that the dynamic code to be verified is not the same as the random dynamic code, the initial identity authentication result is Result for initial authentication failure.
  • the interface display unit 171 the first response unit 172 and the first result determination unit 173 , refer to the optional description of step S105 in the above embodiment corresponding to FIG. 5 , which will not be repeated here.
  • the identity authentication reply includes a dynamic password to be verified
  • the reply authentication module 17 may include: a second response unit 174 and a second result determination unit 175 .
  • the second response unit 174 is used to call the token storage component to generate a dynamic password to be verified according to the token key according to the initial identity authentication request;
  • the second result determining unit 175 is used to send the dynamic password to be verified to the authentication server, so that the authentication server will compare the dynamic password to be verified with the target dynamic password, and determine the initial identity authentication result according to the comparison result;
  • the target dynamic password is The authentication server generates it according to the target token key associated with the user identity information in the user management information base; if the comparison result shows that the dynamic password to be verified is the same as the target dynamic password, the initial identity authentication result is the initial identity authentication success result; if If the comparison result shows that the dynamic password to be verified is not the same as the target dynamic password, the initial identity authentication result is a result of initial identity authentication failure.
  • step S105 For the specific implementation manners of the second response unit 174 and the second result determination unit 175, refer to the optional description of step S105 in the embodiment corresponding to FIG. 5 above, and details will not be repeated here.
  • the access control device 1 may further include: an access control module 19 .
  • the access control module 19 is used to inquire about the access status of the target user
  • the access control module 19 is also used to send the service access request to the authentication server through the security authentication component if the access state is the access state, so that the authentication server forwards the service access request to the service server accessed by the service application;
  • the access control module 19 is also used to execute the steps of obtaining the identity information to be verified in the service access request through the security authentication component and initiating an identity authentication request carrying the identity information to be verified to the authentication server if the access state is an unknown access state.
  • step S105 for the specific implementation manner of the access control module 19, refer to the optional description of step S105 in the above embodiment corresponding to FIG. 5 , which will not be repeated here.
  • the access control device 1 may further include: an access adjustment module 110 .
  • the access adjustment module 110 is configured to receive a state adjustment instruction sent by the authentication server when receiving the signature verification pass message issued by the authentication server, and adjust the access state of the target user to an access-allowed state according to the state adjustment instruction;
  • the access adjustment module 110 is also used to set the access validity period for the target user's access state
  • the access adjustment module 110 is further configured to adjust the target user's access status to an unknown access status when the current accumulative duration of the target user's access status being the allowed access status exceeds the validity period of the allowed access.
  • step S105 for the specific implementation manner of the access control module 110, reference may be made to the optional description of step S105 in the embodiment corresponding to FIG. 5 above, which will not be repeated here.
  • FIG. 11 is a schematic structural diagram of a computer device provided by an embodiment of the present application.
  • the access control device 1 in the embodiment corresponding to the above-mentioned FIG. 10 can be applied to the above-mentioned computer equipment 1000, and the above-mentioned computer equipment 1000 can include: a processor 1001, a network interface 1004 and a memory 1005.
  • the above-mentioned computer equipment 1000 also includes: a user interface 1003 , and at least one communication bus 1002 . Wherein, the communication bus 1002 is used to realize connection and communication between these components.
  • the user interface 1003 may include a display screen (Display) and a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface.
  • the network interface 1004 may include a standard wired interface and a wireless interface (such as a WI-FI interface).
  • the memory 1005 can be a high-speed RAM memory, or a non-volatile memory, such as at least one disk memory.
  • the memory 1005 may also be at least one storage device located away from the aforementioned processor 1001 .
  • the memory 1005 as a computer-readable storage medium may include an operating system, a network communication module, a user interface module, and a device control application program.
  • the network interface 1004 can provide a network communication function;
  • the user interface 1003 is mainly used to provide an input interface for the user; and
  • the processor 1001 can be used to call the device control application stored in the memory 1005 program to achieve:
  • the signature verification result is the result of the signature verification pass
  • receive the signature verification pass message issued by the authentication server and send the service access request to the authentication server based on the signature verification pass message, so that the authentication server forwards the service access request to the service application. business server.
  • the computer device 1000 described in the embodiment of the present application can execute the description of the access control method in the previous embodiments, and can also execute the description of the access control device 1 in the embodiment corresponding to FIG. 10 above. This will not be repeated here. In addition, the description of the beneficial effect of adopting the same method will not be repeated here.
  • the embodiment of the present application also provides a computer-readable storage medium, and the above-mentioned computer-readable storage medium stores the computer program executed by the aforementioned access control device 1, when the above-mentioned processing
  • the computer loads and executes the above-mentioned computer program
  • it can execute the description of the above-mentioned access control method in any of the above-mentioned embodiments, so details will not be repeated here.
  • the description of the beneficial effect of adopting the same method will not be repeated here.
  • FIG. 12 is a schematic structural diagram of another access control device based on zero trust security provided by an embodiment of the present application.
  • the above-mentioned data processing device may be a computer program (including program code) running on a computer device, for example, the access control device is an application software; the device may be used to execute the corresponding steps in the method provided by the embodiment of the present application.
  • the access control device 2 may include: an identity verification module 21 , a challenge sending module 22 , a signature verification module 23 and a business processing module 24 .
  • the identity verification module 21 is used to respond to the identity authentication request carrying the identity information to be verified of the target user initiated by the security authentication component, and to verify the legitimacy of the identity information to be verified;
  • the challenge sending module 22 is used to send random challenge information to the security authentication component when it is determined that the identity information to be verified is legal information, so that the security authentication component obtains the signature information to be verified by signing the random challenge information with the private key; the key cannot be read;
  • the signature verification module 23 is configured to receive the signature information to be verified sent by the security authentication component, perform signature verification on the signature information to be verified based on the random challenge information and the public key certificate bound to the identity information to be verified, and obtain a signature verification result;
  • Business processing module 24 is used for if the signature verification result is a signature verification passing result, then sends a verification signature passing message to the security authentication component, so that the security authentication component sends a service access request to the authentication server based on the signature verification passing message; The request is forwarded to the business server accessed by the business application.
  • the specific implementation of the identity verification module 21, the challenge sending module 22, the signature verification module 23 and the service processing module 24 can refer to the description of steps S201-S205 in the embodiment corresponding to FIG. 6 above, and will not be repeated here.
  • the signature verification module 23 may include: a receiving unit 231 , a public key acquisition unit 232 and a signature verification unit 233 .
  • the public key obtaining unit 232 is used to obtain the public key certificate bound to the identity information to be verified of the target user in the user information management library, and determine the public key of the target user according to the public key certificate;
  • the signature verification unit 233 is configured to perform signature verification on the signature information to be verified based on the target user's public key and random challenge information, and obtain a signature verification result.
  • the public key obtaining unit 232 and the signature verification unit 233 refer to the description of step S203 in the above embodiment corresponding to FIG. 6 , which will not be repeated here.
  • the signature verification unit 233 may include: a digest obtaining subunit 2331 and a signature verification processing subunit 2332 .
  • the digest acquisition subunit 2331 is used to decrypt the signature information to be verified based on the public key of the target user to obtain a digital digest
  • the abstract acquisition subunit 2331 is also used to perform hash operation on the random challenge information to obtain the real digital abstract of the random challenge information;
  • the signature verification processing subunit 2332 is configured to determine that the signature verification result is a signature verification result if the digital abstract is the same as the real digital abstract;
  • the signature verification processing subunit 2332 is also used to determine that the signature verification result is a signature verification failure result if the digital digest is different from the real digital digest, and send an identity verification failure prompt message to the security authentication component.
  • the signature information to be verified is obtained by the security authentication component calling the public-private key storage component to sign the random challenge information through the private key in the public-private key storage component; the public-private key storage component has a data-unreadable attribute .
  • the public-private key storage component is a hardware device used to connect with the terminal device, or, the public-private key storage component is a hardware device in the terminal device, or, the public-private key storage component is run on the The software system on the terminal device.
  • step S203 for the specific implementation manners of the abstract obtaining subunit 2331 and the signature verification processing subunit 2332, please refer to the description of step S203 in the above embodiment corresponding to FIG. 6 , which will not be repeated here.
  • the access control device 2 may further include: a registration module 25 , an authentication module 26 and a certificate management module 27 .
  • the registration module 25 is used to receive the user registration request for the target user sent by the security authentication component; the user registration request includes a public key and user identity information;
  • An authentication module 26 configured to send an initial identity authentication request initiated based on a user registration request to the terminal device;
  • the authentication module 26 is also used to receive the identity authentication reply sent by the security authentication component according to the initial identity authentication request, perform initial identity authentication according to the identity authentication reply, and obtain the initial identity authentication result;
  • the certificate management module 27 is used to generate a public key certificate according to the public key and certificate basic information if the initial identity authentication result is determined to be a successful initial identity authentication result;
  • the certificate management module 27 is also used to bind the public key certificate and user identity information, and store the bound public key certificate and user identity information in the user information management library;
  • the certificate management module 27 is also configured to deliver the public key certificate to the security authentication component, so that the terminal device stores the public key certificate in the public and private key storage component.
  • the specific implementation manners of the registration module 25, the authentication module 26 and the certificate management module 27 can refer to the description of steps S301-S304 in the above embodiment corresponding to FIG. 7, which will not be repeated here.
  • FIG. 13 is a schematic structural diagram of another computer device provided by an embodiment of the present application.
  • the access control device 2 in the embodiment corresponding to the above-mentioned FIG. 12 can be applied to the above-mentioned computer equipment 2000, and the above-mentioned computer equipment 2000 can include: a processor 2001, a network interface 2004 and a memory 2005.
  • the above-mentioned computer equipment 2000 also includes: a user interface 2003 , and at least one communication bus 2002 . Wherein, the communication bus 2002 is used to realize connection and communication between these components.
  • the user interface 2003 may include a display screen (Display) and a keyboard (Keyboard), and the optional user interface 2003 may also include a standard wired interface and a wireless interface.
  • the network interface 2004 may include a standard wired interface and a wireless interface (such as a WI-FI interface).
  • the memory 2005 can be a high-speed RAM memory, or a non-volatile memory, such as at least one disk memory.
  • the memory 2005 may also be at least one storage device located away from the aforementioned processor 2001 .
  • the memory 2005 as a computer-readable storage medium may include an operating system, a network communication module, a user interface module, and a device control application program.
  • the network interface 2004 can provide a network communication function;
  • the user interface 2003 is mainly used to provide an input interface for the user;
  • the processor 2001 can be used to call the device control application stored in the memory 2005 program to achieve:
  • the authentication server responds to the identity authentication request carrying the identity information to be verified of the target user initiated by the security authentication component, and performs legality verification on the identity information to be verified;
  • signature verification result is a signature verification pass result
  • a signature verification pass message is sent to the security authentication component, so that the security authentication component sends a service access request to the authentication server based on the signature verification pass message;
  • the service access request is forwarded to the service server accessed by the service application.
  • the computer device 2000 described in the embodiment of the present application can execute the description of the access control method in the previous embodiments, and can also execute the description of the access control device 2 in the embodiment corresponding to FIG. 12 above. This will not be repeated here. In addition, the description of the beneficial effect of adopting the same method will not be repeated here.
  • the embodiment of the present application also provides a computer-readable storage medium, and the above-mentioned computer-readable storage medium stores the computer program executed by the aforementioned access control device 2, when the above-mentioned processing
  • the computer loads and executes the above-mentioned computer program
  • it can execute the description of the above-mentioned access control method in any of the above-mentioned embodiments, so details will not be repeated here.
  • the description of the beneficial effect of adopting the same method will not be repeated here.
  • the above-mentioned computer-readable storage medium may be the access control device provided in any of the foregoing embodiments or an internal storage unit of the above-mentioned computer equipment, such as a hard disk or a memory of the computer equipment.
  • the computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk equipped on the computer device, a smart memory card (smart media card, SMC), a secure digital (secure digital, SD) card, Flash card (flash card), etc.
  • the computer-readable storage medium may also include both an internal storage unit of the computer device and an external storage device.
  • the computer-readable storage medium is used to store the computer program and other programs and data required by the computer device.
  • the computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Telephonic Communication Services (AREA)
  • Storage Device Security (AREA)

Abstract

一种基于零信任安全的访问控制方法、设备及存储介质，所述方法由终端设备执行，终端设备运行有安全认证组件和业务应用，该方法包括：通过安全认证组件拦截业务访问请求，获取业务访问请求中的待验证身份信息，向认证服务器发起身份认证请求，接收认证服务器在确定待验证身份信息为合法信息时发送的随机挑战信息；获取待验证签名信息；将待验证签名信息发送给认证服务器，以使认证服务器对待验证签名信息进行验签处理，得到验签结果；若验签结果为验签通过结果，则将业务访问请求发送至认证服务器，以使认证服务器将业务访问请求转发至业务服务器。采用该方法，可以提高零信任***在身份信息方面的安全性。

Description

基于零信任安全的访问控制方法、设备及存储介质
本申请要求于2021年06月15日提交的申请号为202110660863.1、发明名称为“基于零信任安全的访问控制方法、设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及云技术领域，尤其涉及一种基于零信任安全的访问控制方法、设备及存储介质。
背景技术
近年来，随着云原生、物联网等技术的普及，企业内部的网络环境越来越复杂、网络边界越来越模糊，传统的安全产品遇到一些挑战，零信任这一概念逐渐火热起来。零信任安全的核心理念是“从不信任，持续校验”(Never Trust,Always Verify)，通过用户可信、设备可信、网络链路可信、资源权限可信这几个方面建立信任链条，并进行持续、动态的检验，以确保信任链的安全可信。
现有的零信任解决方案，通常是通过初始的身份认证(用户名密码、动态口令，多因子认证等)，换取用户身份标识符(通常表述为身份标识号、令牌、票据等名称)，并存储在终端设备中。当再次访问目标服务时，客户端在发送的访问请求中附带前面获得的用户身份标识符，服务端通过校验身份标识符来验证用户身份。但是，由于零信任在网络拓扑上消除了网络边界，原本需要在企业内网(物理网络边界)访问的资源，现在从任意位置都可以发起访问，在给合法用户提供便利的同时，也给攻击者提供了便利。一旦终端设备被攻破，用户身份标识符被泄露，攻击者就可以通过合法用户的用户身份标识符访问受零信任***保护的资源，因此，零信任***在身份信息方面的安全性仍需提高。
发明内容
本申请实施例提供一种基于零信任安全的访问控制方法、设备及存储介质，可以提高零信任***在身份信息方面的安全性。
本申请实施例一方面提供了一种基于零信任安全的访问控制方法，所述方法由终端设备执行，所述终端设备上运行有安全认证组件和业务应用，所述方法包括：
通过所述安全认证组件拦截由所述业务应用所发起的业务访问请求，业务访问请求包含目标用户的待验证身份信息；
通过所述安全认证组件获取业务访问请求中的待验证身份信息，向认证服务器发起携带待验证身份信息的身份认证请求，以使认证服务器在确定待验证身份信息为合法信息时，向安全认证组件发送随机挑战信息；
通过所述安全认证组件获取待验证签名信息，所述待验证签名信息是通过私钥对随机挑战信息进行签名得到的；私钥无法被读取；
通过所述安全认证组件将待验证签名信息发送给认证服务器，以使认证服务器基于随机挑战信息和与待验证身份信息绑定的公钥证书对待验证签名信息进行验签，得到验签结果；
若验签结果为验签通过结果，则通过所述安全认证组件接收认证服务器下发的验签通过消息，基于验签通过消息将业务访问请求发送至认证服务器，以使认证服务器将业务访问请求转发至所述业务应用所访问的业务服务器。
本申请实施例一方面提供了一种基于零信任安全的访问控制方法，所述方法由认证服务器执行，所述方法包括：
响应安全认证组件发起的携带目标用户的待验证身份信息的身份认证请求，对待验证身份信息进行合法性验证；
当确定待验证身份信息为合法信息时，向安全认证组件发送随机挑战信息，以使安全认证组件获取通过私钥对随机挑战信息进行签名得到的待验证签名信息；私钥无法被去读；
接收安全认证组件发送的待验证签名信息，基于随机挑战信息和与待验证身份信息绑定的公钥证书对待验证签名信息进行验签，得到验签结果；
若验签结果为验签通过结果，则向安全认证组件下发验签通过消息，以使安全认证组件基于验签通过消息发送业务访问请求至认证服务器；
将业务访问请求转发至业务应用所访问的业务服务器；
其中，所述安全认证组件和所述业务应用运行在终端设备中。
本申请实施例一方面提供了一种基于零信任安全的访问控制装置，包括：
拦截认证模块，用于拦截由业务应用所发起的业务访问请求，所述业务访问请求包含目标用户的待验证身份信息；
所述拦截认证模块，用于获取所述业务访问请求中的待验证身份信息；
转发模块，用于向认证服务器发起携带所述待验证身份信息的身份认证请求，以使所述认证服务器在确定所述待验证身份信息为合法信息时，向所述安全认证组件发送随机挑战信息；
签名模块，用于获取通过私钥对所述随机挑战信息进行签名得到的待验证签名信息；所述私钥无法被读取；
所述转发模块，用于将所述待验证签名信息发送给所述认证服务器，以使所述认证服务器基于所述随机挑战信息和与所述待验证身份信息绑定的公钥证书对所述待验证签名信息进行验签，得到验签结果；
接收模块，用于若所述验签结果为验签通过结果，则接收所述认证服务器下发的验签通过消息；
所述转发模块，用于基于所述验签通过消息将所述业务访问请求发送至所述认证服务器，以使所述认证服务器将所述业务访问请求转发至所述业务应用所访问的业务服务器。
本申请实施例一方面提供了一种基于零信任安全的访问控制装置，包括：
身份验证模块，用于响应安全认证组件发起的携带目标用户的待验证身份信息的身份认证请求，对所述待验证身份信息进行合法性验证；
挑战发送模块，用于当确定所述待验证身份信息为合法信息时，向所述安全认证组件发送随机挑战信息，以使所述安全认证组件获取通过私钥对所述随机挑战信息进行签名得到的待验证签名信息；所述私钥无法被读取；
验签模块，用于接收所述安全认证组件发送的待验证签名信息，基于所述随机挑战信息和与所述待验证身份信息绑定的公钥证书对所述待验证签名信息进行验签，得到验签结果；
业务处理模块，用于若所述验签结果为验签通过结果，则向所述安全认证组件下发验签通过消息，以使所述安全认证组件基于所述验签通过消息发送业务访问请求至所述认证服务器；将所述业务访问请求转发至业务应用所访问的业务服务器。
本申请实施例一方面提供了一种计算机设备，包括：处理器、存储器、网络接口；
上述处理器与上述存储器、上述网络接口相连，其中，上述网络接口用于提供数据通信功能，上述存储器用于存储计算机程序，上述处理器用于调用上述计算机程序，以执行本申请实施例中的方法。
本申请实施例一方面提供了一种计算机可读存储介质，上述计算机可读存储介质存储有计算机程序，上述计算机程序被处理器加载并执行时，以执行本申请实施例中的方法。
本申请实施例一方面提供了一种计算机程序产品或计算机程序，该计算机程序产品或计 算机程序包括计算机指令，该计算机指令存储在计算机可读存储介质中，计算机设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该计算机设备执行本申请实施例中的方法。
在本申请实施例中，终端设备上的安全认证组件拦截由业务应用所发起的业务访问请求，并获取该业务访问请求中的待验证身份信息，向认证服务器发起携带该待验证身份信息的身份认证请求，以使认证服务器在确定该待验证身份信息合法时，向安全认证组件发送随机挑战信息，然后通过私钥对随机挑战信息进行签名，得到待验证签名信息；然后再将待验证签名信息发给认证服务器，以使认证服务器基于随机挑战信息和公钥对待验证签名信息进行验签处理，如果验签通过，则接收认证服务器下发的验签通过消息，基于验签通过消息将业务访问请求发送至认证服务器，以使认证服务器将业务访问请求转发至业务应用所访问的业务服务器。其中，私钥无法被读取。通过本申请实施例提出的方案，采用无法被读取的私钥，可以杜绝用户身份凭证的信任根被泄露，然后，通过每次身份认证时认证服务器产生的随机挑战信息和该私钥得到新的待验证签名信息，因此每次身份认证时需要的待验证签名信息均不同，使得攻击者无法盗用用户身份，提高零信任***在身份信息方面的安全性。
附图说明
图1是本申请实施例提供的一种网络架构图；
图2是本申请实施例提供的一种访问控制的场景示意图；
图3是本申请实施例提供的一种访问控制的场景示意图；
图4是本申请实施例提供的一种访问控制的场景示意图；
图5是本申请实施例提供的一种访问控制方法的流程示意图；
图6是本申请实施例提供的另一种访问控制方法的流程示意图；
图7是本申请实施例提供的一种用户注册方法的流程示意图；
图8是本申请实施例提供的一种用户注册流程的时序示意图；
图9是本申请实施例提供的一种用户认证流程的时序示意图；
图10是本申请实施例提供的一种访问控制装置的结构示意图；
图11是本申请实施例提供的一种计算机设备的结构示意图；
图12是本申请实施例提供的另一种访问控制装置的结构示意图；
图13是本申请实施例提供另一种计算机设备的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
需要说明的是，本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、***、产品或服务器不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。以下介绍本申请的访问控制方法，本说明书提供了如实施例或流程图的方法操作步骤，但基于常规或者无创造性的劳动可以包括更多或者更少的操作步骤。实施例中列举的步骤顺序仅仅为众多步骤执行顺序中的一种方式，不代表唯一的执行顺序。在实际中的***或服务器产品执行时，可以按照实施例或者附图所示的方法顺序执行或者并行执行(例如并行处理器或者多线程处理的环境)。
云技术(Cloud technology)是基于云计算商业模式应用的网络技术、信息技术、整合技术、管理平台技术、应用技术等的总称，可以组成资源池，按需所用，灵活便利。云计算技术将变成重要支撑。技术网络***的后台服务需要大量的计算、存储资源，如视频网站、图片类网站和更多的门户网站。伴随着互联网行业的高度发展和应用，将来每个物品都有可能存在自己的识别标志，都需要传输到后台***进行逻辑处理，不同程度级别的数据将会分开处理，各类行业数据皆需要强大的***后盾支撑，只能通过云计算来实现。
云计算(cloud computing)指IT(Information Technology，信息技术)基础设施的交付和使用模式，指通过网络以按需、易扩展的方式获得所需资源；广义云计算指服务的交付和使用模式，指通过网络以按需、易扩展的方式获得所需服务。这种服务可以是IT和软件、互联网相关，也可是其他服务。云计算是网格计算(Grid Computing)、分布式计算(DistributedComputing)、并行计算(Parallel Computing)、效用计算(Utility Computing)、网络存储(Network Storage Technologies)、虚拟化(Virtualization)、负载均衡(Load Balance)等传统计算机和网络技术发展融合的产物。
随着互联网、实时数据流、连接设备多样化的发展，以及搜索服务、社会网络、移动商务和开放协作等需求的推动，云计算迅速发展起来。不同于以往的并行分布式计算，云计算的产生从理念上将推动整个互联网模式、企业管理模式发生革命性的变革。
本申请实施例提供的方案属于云技术领域下属的云安全(Cloud Security)。
云安全是指基于云计算商业模式应用的安全软件、硬件、用户、机构、安全云平台的总称。云安全融合了并行处理、网格计算、未知病毒行为判断等新兴技术和概念，通过网状的大量客户端对网络中软件行为的异常监测，获取互联网中木马、恶意程序的最新信息，并发送到服务端进行自动分析和处理，再把病毒和木马的解决方案分发到每一个客户端。
云安全主要研究方向包括：1.云计算安全，主要研究如何保障云自身及云上各种应用的安全，包括云计算机***安全、用户数据的安全存储与隔离、用户接入认证、信息传输安全、网络攻击防护、合规审计等；2.安全基础设施的云化，主要研究如何采用云计算新建与整合安全基础设施资源，优化安全防护机制，包括通过云计算技术构建超大规模安全事件、信息采集与处理平台，实现对海量信息的采集与关联分析，提升全网安全事件把控能力及风险控制能力；3.云安全服务，主要研究各种基于云计算平台为用户提供的安全服务，如防病毒服务等。
本申请实施例提供的方案涉及到零信任***的身份信息方面的安全认证。
零信任，是一种安全理念，本质上和传统安全产品/设备并不是同一个维度的概念，但是由于零信任架构落地的时候，会和传统安全产品/设备产生协作，甚至可能存在替代某些传统安全产品/设备的情况。
零信任，可以按照字面理解，即对任何对象都不可信，具体到访问控制***中，假定人(用户)、终端、资源等都是不可信的，通过建立人到终端到资源的信任链，并动态实时校验信任链，来实现对资源安全可信请求，阻断网络攻击，提高网络安全。
零信任可以应用于多种应用场景，例如，远程办公、云计算平台、大数据中心、物联网、5G应用等。
图1是本申请实施例提供的一种网络架构图。如图1所示，该网络架构可以包括认证服务器100、业务服务器200以及终端设备集群，其中，上述终端设备集群可以包括多个终端设备，如图1所示，具体可以包括终端设备10a、终端设备10b、终端设备10c、…、终端设备10n。如图1所示，终端设备10a、终端设备10b、终端设备10c、…、终端设备10n可以分别与上述认证服务器100进行网络连接，以便于每个终端设备可以通过网络连接与认证服务器100进行数据交互，以便于每个终端设备可以接收到来自于上述认证服务器100的认证数据。如图1所示，业认证服务器100和业务服务器200之间可以进行网络连接，当认证服务器100确定终端设备完成认证后，可以将终端设备发起的针对某个应用的业务请求转发至 业务服务器200。
如图1所示，每个终端设备均可以集成安装有目标应用和业务应用，目标应用包括安全认证组件，当该目标应用运行于各终端设备时，终端设备可以通过该目标应用拦截针对业务应用的业务访问请求，然后获取相关的认证数据，与上述图1所示的认证服务器100之间进行数据交互，当认证服务器100确定终端设备完成身份认证后，会接收目标应用拦截的业务访问请求，然后转发给业务服务器200，然后，终端设备可以访问到该业务访问请求所对应的受保护资源。其中，业务访问请求是指访问受保护资源的请求。其中，受保护资源是指只能被特定的用户访问的资源，比如，企业内部资源，非企业员工不能访问企业内部，因此，当终端设备通过业务应用发起针对企业内部资源的访问请求时，终端设备会先通过目标应用和认证服务器100共同完成对发起该业务访问请求的目标用户的身份认证。其中，该目标应用可以为具有账号管理、数据采集和认证、请求拦截和转发等数据信息功能的应用，比如零信任客户端。其中，受保护应用可以为游戏应用、视频编辑应用、社交应用、即时通信应用、直播应用、短视频应用、视频应用、音乐应用、购物应用、小说应用、支付应用、浏览器等具有显示文字、图像、音频以及视频等数据信息功能的应用。
每个终端设备均可以和认证服务器100进行数据交互，完成身份认证，过程可以为：每个终端设备通过目标应用拦截到针对受保护应用的业务访问请求后，会从该业务访问请求中获取到目标用户的待验证身份信息，然后每个终端设备均可以获取到业务访问请求中的待验证身份信息，然后向认证服务器100发起携带待验证身份信息的身份认证请求，然后，认证服务器100会对该待验证身份信息进行验证，当确定该待验证身份信息为合法信息后，向对应的终端设备发送随机挑战信息。终端设备在接收到随机挑战信息后，可以通过公私钥存储组件中目标用户对应的私钥，在公私钥存储组件中对该随机挑战信息进行签名，得到待验证签名信息，然后将待验证签名信息发送给认证服务器100，认证服务器100再通过目标用户对应的公钥证书对该待验证签名信息进行验签，如果认证服务器100确定验签通过，则认证服务器100确定终端设备完成认证，并下发验签通过的消息到终端设备。终端设备就可以将业务访问请求发送至认证服务器100，然后认证服务器100会将该业务访问请求转发至业务服务器200。其中，确定待验证身份信息为合法信息的过程，可以为，在用户信息管理库中查找与该待验证身份信息相同的合法信息，即确定目标用户是否在允许访问的用户名单中。
其中，公私钥存储组件是具有存储功能、计算功能和数据不可读功能的组件，换言之，公私钥存储组件中的私钥仅能在该公私钥存储组件中使用，不能被导出该公私钥存储组件，可以保证私钥不被泄露。示例性的，公私钥存储组件可以是独立在终端设备之外的硬件设备，例如，USB Key，公私钥存储组件与终端设备连接使用。公私钥存储组件也可以是嵌入在终端设备内的硬件设备，例如，TPM(Trusted Platform Module，可信赖平台模块)安全芯片。示例性的，公私钥存储组件还可以是运行在终端设备上的软件***，例如，基于虚拟化的隔离技术、可信执行环境等。示例性的，一个用户账号对应一个公私钥存储组件。
由于攻击者无法获取到公私钥存储组件中的私钥，就无法确定每次认证时的待验证签名信息，就无法完成认证，自然就无法访问受保护应用，采用本申请的方法，可以防止身份克隆攻击。
可以理解的是，本申请实施例提供的方法可以由计算机设备执行，计算机设备包括但不限于终端设备、认证服务器或业务服务器。其中，认证服务器和业务服务器均可以是独立的物理服务器，也可以是多个物理服务器构成的服务器集群或者分布式***，还可以是提供云数据库、云服务、云计算、云函数、云存储、网络服务、云通信、中间件服务、域名服务、安全服务、CDN(Content Delivery Network，内容分发网络)、以及大数据和人工智能平台等基础云计算服务的云服务器。终端设备可以是智能手机、平板电脑、笔记本电脑、台式计算机、掌上电脑、移动互联网设备(Mobile Internet Device,MID)、可穿戴设备(例如智能手表、智能手环等)、智能电脑等可以运行上述应用客户端的智能终端。其中，终端设备、认证服务 器和业务服务器之间，可以通过有线或无线方式进行直接或间接地连接，本申请实施例在此不做限制。
可以理解的是，上述计算机设备(如上述认证服务器100、业务服务器200、终端设备10a、终端设备10b、终端设备10c…、终端设备10n)可以是一个分布式***中的一个节点，其中，该分布式***可以为区块链***，该区块链***可以是由该多个节点通过网络通信的形式连接形成的分布式***。其中，节点之间可以组成的点对点(P2P，Peer To Peer)网络，P2P协议是一个运行在传输控制协议(TCP，Transmission Control Protocol)协议之上的应用层协议。在分布式***中，任意形式的计算机设备，比如服务器、终端设备等电子设备都可以通过加入该点对点网络而成为该区块链***中的一个节点。
下述以终端设备10a拦截到针对受保护应用的业务访问请求后，和认证服务器100进行数据交互完成认证以后，再通过认证服务器100将该业务访问请求转发至对应的业务服务器100为例进行说明。
为便于理解，请参见图2-图4，是本申请实施例提供的一种访问控制的场景示意图。如图2所示，与终端设备10a具有绑定关系的是用户A，终端设备10a上安装有业务应用11和目标应用12，其中，业务应用11可以是浏览器，目标应用12可以是与用户A所在公司的企业内部资源绑定的零信任客户端。用户A在通过终端设备10a完成对目标应用12的用户注册流程以后，目标应用12可以对业务应用11进行零信任认证，认证完成以后，用户A就可以通过业务应用11完成对企业内部资源的访问和使用。其中，对业务应用11进行零信任认证，即对用户A的身份进行认证，确定用户A是否有权利访问企业内部资源，确保非法人员无法访问企业内部资源。如图2所示，假设用户A已经完成目标应用12的用户注册流程，此时用户A想要登录公司网页***提交流程表，用户A可以在业务应用11中输入公司网页***的网址，然后发起对公司网页***的业务访问请求，其中，业务访问请求包含用户A的待验证身份信息。由于此时用户A的身份未知，该业务访问请求如果直接转发至业务服务器200，业务服务器200会拒绝该业务访问请求，因此，目标应用12会和认证服务器100之间进行数据交互，进行对用户A的身份认证，当确定用户A的身份认证通过以后，目标应用12会将业务访问请求转发至认证服务器100，认证服务器100会将该业务访问请求转发至业务服务器200，业务服务器200即用户A公司的公司网页***对应的服务器。业务服务器200响应用户A的业务访问请求后，用户A就可以进入公司网页***了。需要说明的是，在一种可选地实现方式中，当目标应用12和认证服务器100共同完成了用户A的身份认证后，一段时间周期内，用户A针对企业内部资源的后续业务访问请求，将不再需要进行身份认证，用户A可以直接对企业内部资源进行访问和使用，也就是说，用户A登录仅公司网页***后，就可以直接提交流程表了。在另一种可选地实现方式中，每次用户A针对企业内部起源的业务访问请求，都需要进行身份认证。
进一步地，终端设备10a和认证服务器100之间进行数据交互，进行对用户A的身份认证的具体实现场景，可以参见图3。如图3所示，终端设备10a包含有与目标应用12对应的安全认证组件121，以及与终端设备10a相连的公私钥存储组件122，或，运行在终端设备10a中的公私钥存储组件122。其中，安全认证组件121可以拦截和转发请求。其中，转发请求包括对未经认证的业务访问请求进行身份认证的请求转发和转发认证通过后的业务访问请求，拦截请求是指对未经认证的业务访问请求进行拦截阻断。其中，公私钥存储组件122具有存储数据不可读属性和运算属性，可以是终端设备10a的内置组件，可以是与终端设备10a相连的外部组件。其中，存储数据不可读属性是指存储在公私钥存储组件122中的数据不可以被外部所读取，仅能在公私钥存储组件122中被使用，运算属性是指公私钥存储组件122可以对数据进行计算处理。如图3所示，业务应用11响应用户A的操作，生成业务访问请求，终端设备10a会通过安全认证组件121拦截该业务访问请求，然后从该业务访问请求中获取用户A的待验证身份信息，其中，待验证身份信息可以为用户名、账号、绑定手机号等 信息。然后，终端设备10a会通过安全认证组件121向认证服务器100发起携带待验证身份信息的身份认证请求。认证服务器100接收到身份认证请求后，会确定该待验证身份信息是否为合法信息。其中，确定该验证身份信息是否为合法信息的过程，可以为：在用户信息管理库中查找是否有与该验证身份信息相同的身份信息，如果找到，说明该待验证身份信息为合法信息。如果确定该待验证身份信息为合法信息，则认证服务器会生成一个随机挑战信息，然后将该随机挑战信息发送给安全认证组件121。安全认证组件121会将该随机挑战信息发送至公私钥存储组件122中，终端设备10a会通过公私钥存储组件122中的私钥对随机挑战信息进行签名，得到待验证签名信息。然后终端设备10a会通过安全认证组件121将待验证签名信息转发至认证服务器100，认证服务器100会在用户信息管理库中获取与该待验证身份信息绑定的公钥证书，然后对该验证签名信息进行验签处理，得到验签结果。其中，私钥签名即对随机挑战信息进行加密，公钥解密即对加密后的待验证签名信息进行解密，解密后得到的信息如果和认证服务器100发送的随机挑战信息相同，说明公私钥配对，验签通过，用户的身份认证通过。
进一步地，如果用户A(目标用户)是公司新员工，并没有通过目标应用12完成用户注册，则认证服务器100中的用户信息管理库中没有用户A相关的身份信息和公钥证书，上述身份认证过程无法完成，用户A也无法访问到企业内部资源。因此，当用户A初次使用目标应用12时，需要先进行用户注册，具体实现过程可以参见图4。如图4所示，终端设备10a可以在公私钥存储组件122中生成用户A的公私钥对，其中，公私钥对包括私钥和公钥，私钥和公钥是一对密钥，私钥是自己所有，即除了用户A别的人都不知道私钥，公钥是公开的，所有人都可以获取到用户A的公钥，私钥签名的数据可以通过公钥解密。终端设备10a可以向认证服务器100发送针对用户A的用户注册请求，该用户注册请求就包括公钥和用户A的用户身份信息。认证服务器100接收到该用户注册请求后，会根据该用户注册请求进行用户A的初始身份认证，即向终端设备10a发送初始身份认证请求，然后接收终端设备10a返回的身份认证回复，再基于该身份认证回复进行身份认证。如图4所示，认证服务器100会在用户信息管理库中查找用户A的用户身份信息，然后获取绑定的联系账号，向该联系账号发送随机动态码。同时，认证服务器100会向终端设备10a下发初始身份认证请求，终端设备10a根据该初始身份认证请求可以显示动态码认证界面13，用户A通过事先预留的联系账号获取到动态码后，即可以在动态码认证界面10a中输入，随后点击确认按钮，然后终端设备10a会将该用户A输入的动态码返回给认证服务器100，认证服务器100确定返回的动态码和最开始发送的随机动态码相同，则确定用户A的身份认证通过，随后根据用户A的公钥生成公钥证书，再将用户A的用户身份信息和公钥证书进行绑定，然后一起存储用户信息管理库中，同时，认证服务器100还会将公钥证书返回给终端设备10a。通过上述过程，用户A的用户注册完成，后续用户A通过上述业务应用11访问企业内部资源时，就可以进行上述图3所示的身份认证了。
进一步地，请参见图5，图5是本申请实施例提供的一种访问控制方法的流程示意图。该方法由图1中所述的终端设备执行，即可以为图1中的终端设备集群中的任一终端设备(也包括终端设备10a、终端设备10b、终端设备10c以及终端设备10n)。如图5所示，该访问控制过程包括如下步骤：
步骤S101，安全认证组件拦截由业务应用所发起的业务访问请求，业务访问请求包含目标用户的待验证身份信息。
具体的，业务应用是指目标用户使用的需要进行零信任认证的应用软件，目标用户可以通过这些应用软件来访问受保护的内部资源。其中，内部资源通常指指企业控制并拥有所有权和使用权的经营资源，通常仅允许企业内部人员访问，比如学校内部资源，只允许该学校的老师和学生使用。随着零信任安全的概念提出，原本必须在企业内网(物理网络边界)访问的内部资源，现在可以允许企业内部人员从任意位置发起访问。因此，终端设备不再是运 行在相对安全的企业内网环境，而是有可能运行在任意的环境中，比如居家、咖啡馆、酒店等等。在这些环境中，目标用户潜在遭受的钓鱼攻击、水坑攻击等安全威胁极大增加，因此，目标用户在通过应用发起业务访问请求时，终端设备需要对该业务访问请求进行零信任认证，即身份认证。
具体的，业务应用可以包括B/S(Browser/Server，浏览器/服务器模式)架构应用软件和C/S(Client/Server，客户端/服务器模式)架构应用软件，对于B/S架构的应用软件来说，应用一般是指浏览器；对于C/S架构的应用软件来说，应用一般是指特定的客户端软件。受保护的内部资源一般是指应用的服务端，这些服务一般放在企业内网或云端，需要对访问请求进行身份认证，从而保护服务背后的资源只能被合法的用户访问。因此，安全认证组件会拦截由业务应用所发起的业务访问请求。可选的，安全认证组件可以仅需拦截应用发起的针对内部资源进行访问和使用的业务访问请求，而对于业务应用发起的针对其他资源的业务访问请求，安全认证组件无需拦截。一种可行的实施例中，安全认证组件会对应用发起的业务访问请求做初步识别，比如分析业务访问请求中的地址信息，是否在待验证地址名单中等等，确定该业务访问请求是否是访问内部资源，如果是访问内部资源，安全认证组件将拦截该业务访问请求。
具体的，终端设备上运行有安全认证组件和公私钥存储组件；或，终端设备上运行有安全认证组件，且连接有公私钥存储组件。其中，安全认证组件可以为零信任客户端(即上述图2所示的目标应用12)中的一个内置功能组件，安全认证组件可以实现请求的拦截和转发。其中，业务访问请求包含目标用户的待验证身份信息，比如账号信息、用户名信息等用于唯一标识该目标用户的信息。
步骤S102，安全认证组件获取所述业务访问请求中的待验证身份信息，向认证服务器发起携带所述待验证身份信息的身份认证请求，以使所述认证服务器在确定待验证身份信息为合法信息时，向安全认证组件发送随机挑战信息。
具体的，安全认证组件拦截到业务访问请求后，会从中提取目标用户的待验证身份信息，然后生成携带该待验证身份信息的身份认证请求，安全认证组件会向认证服务器发送该身份认证请求，然后等待认证服务器的处理。认证服务器接收到身份认证请求后，确定待验证身份信息为合法信息，会向安全认证组件发送随机挑战信息。其中，认证服务器可以为零信任***中的身份认证过程提供相应的用户信息管理服务、认证服务、接入网关等功能服务。需要说明的是，认证服务器可以为一个服务器，也可以为一个服务器集群，上述各个功能服务可以部署在不同的服务器上，这里仅以各个功能服务部署在同一服务器上进行说明。其中，随机挑战信息是认证服务器基于本次身份认证请求随机生成的信息，可以为随机数、随机字符串等等，每次针对同一目标用户发起的身份认证请求，生成的随机挑战信息均可以不同。其中，属于合法信息的目标用户的待验证身份信息存在于认证服务器中的用户信息管理库中，属于非法信息的目标用户的待验证身份信息不存在于认证服务器中的用户信息管理库中。可选的，若认证服务器在确定待验证身份信息为非法信息时，获取认证服务器所发送的身份验证失败提示信息。
步骤S103，安全认证组件获取待验证签名信息，待验证签名信息是通过私钥对所述随机挑战信息进行签名得到的；所述私钥无法被读取。
具体的，安全认证组件获取通过私钥对所述随机挑战信息进行签名得到的待验证签名信息的过程，可以为：安全认证组件将获取到的随机挑战信息传输至公私钥存储组件；公私钥存储组件通过公私钥存储组件中的私钥对随机挑战信息进行签名，得到待验证签名信息；公私钥存储组件向安全认证组件传输待验证签名信息；安全认证组件获取公私钥存储组件传输的待验证签名信息；公私钥存储组件具有数据不可读属性。其中，公私钥存储组件又可以称之为身份存储设备，用于存储目标用户的用户身份凭证的信任根，比如私钥。公私钥存储组件的关键属性为数据不可读，即存储在其中的秘密信息无法被导出复制，只要满足这一关键 属性，不论是硬件设备还是软件***都可以用来作为本申请的公私钥存储组件。另外，外部的硬件设备与终端设备连接后，该外部的硬件设备也可以称之为终端设备的公私钥存储组件。其中，硬件设备，比如USB key(一种内置单片机或者智能卡芯片的硬件设备)、TPM(Trusted Platform Module，可信赖平台模块)安全芯片等，软件***，比如基于虚拟化的隔离计算、可信执行环境等。
具体的，在非对称加密算法中，需要两个密钥，一个公开密钥(publickey，简称公钥)和私有密钥(privatekey，简称私钥)，公钥和私钥是一对，甲方可以用自己的私钥对机密信息签名后再发送给乙方，乙方可以通过甲方的公钥对接收的签名后的机密信息进行验签，从而确定该机密信息来源于甲方。公私钥存储组件中存储有目标用户的公钥和私钥，公钥可以存储在公私钥存储组件中的可读区域，但是私钥只能存储在公私钥存储组件中的不可读区域，也就是仅能在公私钥存储组件中使用目标用户的私钥，其余组件、设备都不能读取到目标用户的私钥。
具体的，安全认证组件获取通过公私钥存储组件中的私钥对随机挑战信息进行签名得到的待验证签名信息，过程可以为：公私钥存储组件对随机挑战信息进行哈希运算，得到随机挑战信息的数字摘要；公私钥存储组件通过公私钥存储组件中的私钥对数字摘要进行非对称加密处理，得到针对随机挑战信息的待验证签名信息。其中，哈希运算又称散列运算，就是把任意长度的输入，通过散列算法，变换成固定长度的输出，这个输出值，就是数字摘要。其中，哈希运算可以包括除法哈希法、乘法哈希法、斐波那契哈希法等等。可以理解的是，如果随机挑战信息较小，比如为随机数时，可以直接通过公私钥存储组件使用目标用户的私钥对该随机数进行非对称加密处理，无需对其进行哈希运算得到数字摘要。
步骤S104，安全认证组件将待验证签名信息发送给认证服务器，以使认证服务器基于随机挑战信息和与待验证身份信息绑定的公钥证书对待验证签名信息进行验签处理，得到验签结果。
具体的，通过公私钥存储组件得到待验证签名信息后，安全认证组件将待验证签名信息发送给认证服务器，然后等待认证服务器基于随机挑战信息和与待验证身份信息绑定的公钥证书对待验证签名信息进行验签处理，得到验签结果。其中，公钥证书是目标用户完成用户注册时，认证服务器根据目标用户的公钥生成的数字证书，数字证书又叫“数字身份证”、“网络身份证”，是由证书认证中心发放并经过证书认证中心数字签名，包含公开密钥的拥有者以及公开密钥相关信息的一种电子文件，可以用来证明数字证书持有者的真实身份。
步骤S105，若所述验签结果为验签通过结果，则安全认证组件接收认证服务器下发的验签通过消息，基于验签通过消息将业务访问请求发送至认证服务器，以使认证服务器将业务访问请求转发至业务应用所访问的业务服务器。
具体的，当认证服务器确定验签结果为验签通过结果时，会下发验签通过消息，安全认证组件接收到该验签通过消息时，将业务访问请求转发至认证服务器，然后认证服务器会将业务访问请求转发至业务应用所访问的业务服务器，即内部资源对应的服务端所在的服务器。
可选的，安全认证组件可以为目标用户添加访问状态，当安全认证组件拦截到业务访问请求后，会查询目标用户的访问状态，若访问状态为允许访问状态，则将业务访问请求发送至认证服务器，以使认证服务器将业务访问请求转发至应用所访问的业务服务器；若访问状态为未知访问状态，则向认证服务器发起携带所述待验证身份信息的身份认证请求。上述过程均可以通过安全认证组件实现，即终端设备可以在安全认证组件中为目标用户添加访问状态，当安全认证组件拦截到业务访问请求后，安全认证组件查询目标用户的访问状态。如此，当目标用户在短时间内多次发起针对内部资源的业务访问请求时，安全认证组件仅需要在目标用户初次发起业务访问请求时，对目标用户进行身份认证。
当目标用户的身份认证通过，认证服务器下发上述验签通过消息时，还可以一并下发状态调整指令，安全认证组件根据状态调整指令将目标用户的访问状态调整为允许访问状态； 同时安全认证组件可以为目标用户的访问状态设置允许访问有效期；当目标用户的访问状态为允许访问状态的当前累计时长超出允许访问有效期时，将目标用户的访问状态调整为未知访问状态。假设允许访问有效期为一小时，则当目标用户通过认证服务器的身份认证的一小时内，目标用户再次发起的业务访问请求无需再进行身份认证，可以直接转发至业务服务器。
可选的，目标用户初次访问内部资源之前，需要先完成用户注册，才能进行上述的身份认证过程。公私钥存储组件会先生成目标用户的公私钥对，其中，公私钥对包括私钥和公钥；公私钥存储组件将公钥传输给安全认证组件；安全认证组件接收公私钥存储组件传输的公钥，向认证服务器发送针目标用户的用户注册请求；用户注册请求包括目标用户的公钥和目标用户的用户身份信息；安全认证组件接收认证服务器基于用户注册请求发起的初始身份认证请求，根据初始身份认证请求向认证服务器发送身份认证回复，以使认证服务器根据身份认证回复进行身份认证，得到身份认证结果；若身份认证结果为身份认证成功结果，则接收认证服务器下发的目标用户的公钥证书；安全认证组件向公私钥存储组件传输公钥证书，以使公私钥存储组件存储该公钥证书。
一个可行的实施例中，根据初始身份认证请求向认证服务器发送身份认证回复的过程，可以为：根据初始身份认证请求显示动态码认证界面；响应接收到在动态码认证界面上的输入确定操作，获取待验证动态码，将待验证动态码作为身份认证回复；向认证服务器发送身份认证回复，以使认证服务器将待验证动态码和随机动态码进行比对处理，根据比对结果确定初始身份认证结果。其中，动态码认证界面用于输入待验证动态码，用户可以依据认证服务器发送至联系账号的随机动态码在动态码认证界面中输入待验证动态码，联系账号在认证服务器的用户信息管理库中与用户身份信息具有绑定关系。若比对结果为待验证动态码和随机动态码相同，则初始身份认证结果为初始身份认证成功结果；若比对结果为待验证动态码和随机动态码不相同，则初始身份认证结果为初始身份认证失败结果。
一个可行的实施例中，终端设备上运行有令牌存储组件，根据初始身份认证请求向认证服务器发送身份认证回复的过程，可以为：根据初始身份认证请求，调用令牌存储组件根据令牌密钥生成待验证动态口令，将待验证动态口令作为身份认证回复；向认证服务器发送所述待验证动态口令，以使认证服务器将待验证动态口令和目标动态口令进行比对处理，根据比对结果确定初始身份认证结果。其中，目标动态口令是认证服务器根据用户管理信息库中与所述用户身份信息关联的目标令牌密钥生成的。若比对结果为待验证动态口令和目标动态口令相同，则初始身份认证结果为初始身份认证成功结果；若比对结果为待验证动态口令和目标动态口令不相同，则初始身份认证结果为初始身份认证失败结果。
本申请实施例提供的方法，通过使用无法读取的私钥，可以防止目标用户的身份凭证信用根被泄露，后续安全认证组件拦截由业务应用所发起的业务访问请求，并获取该业务访问请求中的待验证身份信息，向认证服务器发起携带该待验证身份信息的身份认证请求，然后在认证服务器在确定该待验证身份信息合法时，接收认证服务器发送的随机挑战信息；调用公私钥存储组件通过私钥对随机挑战信息进行签名，得到待验证签名信息，等待认证服务器基于随机挑战信息和目标用户的公钥进行验签。采用本申请实施例提供的方法，可以保证每次待验证签名信息不同，且产生待验证签名信息的私钥不被泄露，从而使得攻击者无法盗用用户身份，提高零信任***在身份信息方面的安全性。
进一步地，请参见图6，图6是本申请实施例提供的另一种访问控制方法的流程示意图，该方法由图1中所述的认证服务器100执行。如图6所示，该访问控制过程包括如下步骤：
步骤S201，认证服务器响应终端设备发起的携带目标用户的待验证身份信息的身份认证请求，对所述待验证身份信息进行合法性验证。
具体的，认证服务器接收到携带目标用户的待验证身份信息的身份认证请求后，会先确定该待验证身份信息是否合法，即目标用户是否完成用户注册。认证服务器中存储有用户信息管理库，当用户完成了上述用户注册以后，认证服务器会将用户的用户身份信息和公钥证 书绑定后存进用户信息管理库中。因此，认证服务器响应安全认证组件发起的携带目标用户的待验证身份信息的身份认证请求，对待验证身份信息进行合法性验证的过程，可以为：认证服务器响应安全认证组件发起的携带目标用户的待验证身份信息的身份认证请求，在用户信息管理库中查找目标用户的待验证身份信息；若在用户信息管理库中查找到与目标用户的待验证身份信息相同的用户身份信息，则确定目标用户的待验证身份信息为合法信息；若在用户信息管理库中未查找到与目标用户的待验证身份信息相同的用户身份信息，则确定目标用户的待验证身份信息为非法信息，向终端设备下发身份验证失败提示信息。其中，身份验证失败提示信息可以是“用户尚未注册”等提示信息。
步骤S202，当确定所述待验证身份信息为合法信息时，认证服务器向安全认证组件发送随机挑战信息，以使安全认证组件获取通过私钥对随机挑战信息进行签名得到的待验证签名信息；私钥无法被读取。
具体的，随机挑战信息是认证服务器根据相关函数或者方法随机生成的，换言之，每次身份认证过程中，随机挑战信息不同。其中，随机挑战信息可以包括随机数、随机字符串、随机文本等等。
具体的，安全认证组件接收随机挑战信息后获取待验证签名信息的具体过程，可以参见上述步骤S103。
步骤S203，认证服务器接收安全认证组件发送的待验证签名信息，基于随机挑战信息和与待验证身份信息绑定的公钥证书对待验证签名信息进行验签，得到验签结果。
具体的，接收安全认证组件发送的待验证签名信息，基于随机挑战信息和与待验证身份信息绑定的公钥证书对待验证签名信息进行验签处理，得到验签结果的过程，可以为：接收安全认证组件发送的待验证签名信息；然后在用户信息管理库中获取与目标用户的待验证身份信息绑定的公钥证书，根据公钥证书确定目标用户的公钥，例如，用户信息管理库中存储了用户的用户身份信息以及公钥证书，认证服务器在用户信息管理库中确定与待验证身份信息相匹配的用户身份信息，则该用户身份信息对应的公钥证书即为该待验证身份信息所绑定的公钥证书；基于目标用户的公钥和随机挑战信息对待验证签名信息进行验签，得到验签结果。其中，公钥证书为上述所说的包含公钥的拥有者以及公钥相关信息的一种电子文件，可以用来证明数字证书持有者的真实身份。认证服务器获取到与待验证身份信息绑定的公钥证书后，可以根据公钥证书上的相关信息确定该公钥证书中的公钥属于目标用户，直接从公钥证书中获取目标用户的公钥即可。
具体的，基于目标用户的公钥和随机挑战信息对待验证签名信息进行验签，得到验签结果的过程，可以为：基于目标用户的公钥对待验证签名信息进行解密，得到数字摘要；对随机挑战信息进行哈希运算，得到随机挑战信息的真实数字摘要；若数字摘要和真实数字摘要相同，则确定验签结果为验签通过结果；若数字摘要和真实数字摘要不相同，则确定验签结果为验签失败结果，向安全认证组件下发身份验证失败提示信息。需要说明的是，认证服务器对随机挑战信息使用的哈希算法，与公私钥存储组件对随机挑战信息使用的哈希算法，应该为同一种算法。
步骤S204，若所述验签结果为验签通过结果，则认证服务器向安全认证组件下发验签通过消息，以使安全认证组件基于验签通过消息发送业务访问请求至认证服务器。
具体的，验签通过说明认证服务器获取到的公钥和目标用户的私钥相匹配，目标用户的业务访问请求是合法的，认证服务器会下发验签通过消息，即下发允许目标用户访问内部资源的消息指令，安全认证组件接收到验签通过消息后，就会将业务访问请求转发到认证服务器。
步骤S205，认证服务器将所述业务访问请求转发至业务应用所访问的业务服务器。
具体的，认证服务器会将业务访问请求转发至业务应用所访问的业务服务器，以使目标用户可以正常访问内部资源。
本申请实施例提供的方法，认证服务器在确定目标用户的待验证身份信息合法后，会生成随机挑战信息下发给安全认证组件，随后等待安全认证组件对该随机挑战信息进行私钥签名，得到待验证签名信息，然后认证服务器会获取目标用户的公钥证书，从而得到目标用户的公钥对待验证签名信息进行验签，从而完成对目标用户的身份认证。由于随机挑战信息的不确定性，因此安全认证组件每次发送的待验证签名信息也不确定，即使某次待验证签名信息被泄露，下一次也不可用，可以防止身份克隆攻击。
进一步地，上述提到用户需要先完成用户注册，使得认证服务器中的用户信息管理库中有用户的用户身份信息和公钥证书，才能正常执行上述访问控制方法，为便于理解，请参见图7，图7是本申请实施例提供的一种用户注册方法的流程示意图。该方法可以由图1中所述的认证服务器100执行。如图7所示，该访问控制过程包括如下步骤：
步骤S301，认证服务器接收安全认证组件发送的针对目标用户的用户注册请求；用户注册请求包括目标用户的公钥和目标用户的用户身份信息。
具体的，目标用户想要在任意位置均可访问内部资源，可以在终端设备中集成安装有零信任客户端(包括安全认证组件)，之后目标用户针对内部资源的业务访问请求，在零信任客户端对应的安全认证组件、公私钥存储组件以及认证服务器之间的数据交互完成对目标用户的身份认证后，可以通过认证服务器转发至业务服务器。上述目标用户的身份认证过程中，需要目标用户的公钥证书以及用户身份信息，而目标用户初次使用访问内部资源时，认证服务器中是没有相关的用户身份信息和公钥证书的，因此，需要先通过零信任客户端向认证服务器发送用户注册请求，完成用户信息管理库中用户身份信息和公钥证书的登记入库。
步骤S302，向安全认证组件发送基于用户注册请求发起的初始身份认证请求，接收安全认证组件根据初始身份认证请求发送的身份认证回复，根据身份认证回复进行身份认证，得到身份认证结果。
具体的，用户信息管理库中可以包含内部用户名单，即允许访问内部资源的用户名单。可以理解的是，内部资源非公开访问资源，仅有特定的人群才能访问内部资源，比如公司内部资源，只有公司员工和公司相关的客户才被允许访问。通常，资源管理人员会根据***、业务来往来更新用户信息管理库中的内部用户名单。需要说明的是，内部用户名单中的用户包括已注册用户和未注册用户，在内部用户名单上的用户如果没有完成用户注册，也无法完成身份认证访问内部资源。内部用户名单中包含用户初始身份信息和注册信息，其中，注册信息可以是联系账号、联系电话、联系邮箱、令牌密钥等等用于帮助用户完成用户注册的信息。
一个可行的实施例中，注册信息为联系账号时，认证服务器接收到初始身份认证请求后，会在用户信息管理库中查询与用户身份信息对应的用户初始身份信息绑定的联系账号，然后向联系账号发送随机动态码，则向安全认证组件发送基于用户注册请求发起的初始身份认证请求，接收安全认证组件根据初始身份认证请求发送的身份认证回复，根据身份认证回复进行初始身份认证，得到初始身份认证结果的过程，可以为：向安全认证组件发送基于用户注册请求发起的初始身份认证请求，以使安全认证组件根据初始身份认证请求显示动态码认证界面(比如上述图4所对应实施例中的动态码认证界面13)，响应接收到在动态码认证界面上的输入确定操作，安全认证组件获取待验证动态码，将待验证动态码作为身份认证回复；认证服务器接收安全认证组件发送的待验证动态码，将待验证动态码和随机动态码进行比对处理；若待验证动态码和随机动态码相同，则确定初始身份认证结果为初始身份认证成功结果；若待验证动态码和随机动态码不相同，则确定初始身份认证结果为初始身份认证失败结果。可以理解的是，如果目标用户是合法用户，则能通过联系账号获取到认证服务器下发的随机动态码，就可以通过动态码认证界面输入接收到的随机动态码，安全认证组件获取到的待验证动态码必然和随机动态码相同。
一个可行的实施例中，注册信息为令牌密钥时，认证服务器向安全认证组件发送基于用 户注册请求发起的初始身份认证请求，接收安全认证组件根据初始身份认证请求发送的身份认证回复，根据身份认证回复进行初始身份认证，得到初始身份认证结果的过程，可以为：认证服务器向安全认证组件发送基于用户注册请求发起的初始身份认证请求，以使安全认证组件根据初始身份认证请求，在令牌存储组件中根据令牌密钥生成待验证动态口令；接收安全认证组件发送的待验证动态口令；在用户管理信息库中获取与用户身份信息关联的目标令牌密钥，根据目标令牌密钥，生成目标动态口令；若待验证动态口令和目标动态口令相同，则确定初始身份认证结果为初始身份认证成功结果；若待验证动态口令和目标动态口令不相同，则确定初始身份认证结果为初始身份认证失败结果。
步骤S303，若身份认证结果确定为身份认证成功结果，则认证服务器根据公钥和证书基本信息生成公钥证书。
具体的，目标用户的公钥证书记录有目标用户的姓名、组织、邮箱地址等个人信息，以及属于目标用户的公钥，并且需要由认证机构(Certification Authority、Certifying Authority,CA)施加数字签名。当认证服务器获取到目标用户的公钥证书，就可以认定其中的公钥属于目标用户，公钥证书可以简称为证书(certificate)。其中，认证机构可以理解为可信的第三方，认证服务器和终端设备都认可认证机构生成的公钥证书，可以用于确定“公钥确实属于目标用于"，并通过自己的私钥对其进行签名。认证机构功能可以通过证书颁发组件来实现，该证书颁发组件可以内置于认证服务器中，也可以外置于专门的CA服务器中，认证服务器可以和CA服务器进行通信，来间接调用该证书颁发组件，生成目标用户的公钥证书。
步骤S304，认证服务器将公钥证书和用户身份信息进行绑定，将已绑定的公钥证书和用户身份信息存储至用户信息管理库中；将公钥证书下发到安全认证组件，以使终端设备存储公钥证书。
具体的，通过证书颁发组件得到公钥证书后，认证服务器会将公钥证书和用户身份信息进行绑定，然后将已绑定的公钥证书和用户身份信息存储至用户信息管理库中，方便管理和查询。认证服务器还会将公钥证书下发至安全认证组件，安全认证组件将公钥证书写入公私钥存储组件，以使公私钥存储组件存储公钥证书，方便终端设备进行查询和管理。
通过本申请实施例提供的方法，仅有内部用户名单上的用户才可以完成用户注册，后续才能进行上述访问内部资源的身份认证过程。
进一步地，为便于理解，请参见图8，图8是本申请实施例提供的一种用户注册流程的时序示意图。用户注册流程指用户初次使用零信任***时的注册过程，用户注册流程涉及四个主体对象：证书存储设备、零信任客户端、用户管理服务器、CA服务器。其中，证书存储设备即上述所述的公私钥存储组件，零信任客户端即上述所说的包含安全认证组件的目标应用(即上述图2所示的目标应用12)，为了更好的说明公钥证书的生成，假设上述证书颁发组件单独对应有CA服务器，其余认证服务器实现的功能通过用户管理服务器实现，换言之，CA服务器和用户管理服务器可以为独立的服务器，也可以集成为一个服务器，即上述认证服务器。用户注册具体流程描述如下：
S41：证书存储设备(公私钥存储组件)生成公私钥密钥对，将公钥发送给零信任客户端(安全认证组件)。
具体的，证书存储设备在其自身内部生成公私密钥对，并将公钥发送给安装在终端设备上的零信任客户端。私钥始终不离开证书存储设备，且由前文所述，证书存储设备具有不可读特性，所以无法导出该私钥。其中，公私密钥对的生成可以基于非对称密码学方法，比如RSA(一种非对称秘钥加密技术)、DSA(Digital Signature Algorithm，数字签名算法)、ECDSA(Elliptic Curve Digital Signature Algorithm，椭圆曲线签名算法)或者其他零知识证明算法。
S42：零信任客户端发起携带公钥和用户身份信息的用户注册请求。
具体的，零信任客户端发送用户注册请求给用户管理服务器，该请求的数据中主要包含公钥和必要的用户身份信息。
S43：用户管理服务器发起多因子认证请求(即上述初始身份认证请求)。
具体的，用户管理服务器在收到零信任客户端发来的用户注册请求后，会主动向用户发起多因子认证请求，常见的多因子认证方式包括：手机短信动态认证码、手机应用二维码扫码认证、动态令牌等。需要说明的是，用户管理服务器主动向用户发起多因子认证是一个抽象省略的说法，是为了统一不同实现方式下的表述形式，主要是强调多因子认证动作是由用户管理服务器控制和发起。用户服务器器在下一个用户请求到达时会先检查多因子认证状态，如果尚未认证，则下发多因子认证信息(短信、二维码、动态令牌等)，等待回复。
S44：零信任客户端根据多因子认证请求生成多因子认证回复。
具体的，用户在收到用户管理服务器下发的多因子认证信息后，根据具体的多因子认证方式，通过零信任客户端回复相应的多因子认证回复(比如短信验证码、二维码扫描结果、动态令牌信息等)给用户管理服务器。
S45：用户管理服务器根据多因子认证回复进行多因子认证。
具体的，用户管理服务器在收到零信任客户端发来的多因子认证回复信息后，会根据不同的多因子认证方式来进行多因子认证结果判定。具体实现可以参见上述图7所对应实施例中步骤S302的相关描述，这里不再进行赘述。
S46：多因子认证失败，向零信任客户端下发认证失败提示信息。
具体的，如果用户管理服务器确定多因子认证失败，会直接返回认证失败提示信息，告知用户注册失败。
S47：多因子认证成功，向证书机构服务器发起证书签发请求。
具体的，如果用户管理服务器确定多因子认证成功，则用户管理服务器会向CA服务器发送证书签发请求(Certificate Signing Request，CSR)，CSR中包含公钥和其它证书所需要的基本信息。
S48：证书机构服务器生成公钥证书后下发给用户管理服务器。
具体的，证书机构服务器会从CSR请求中获取公钥和其它证书所需要的基本信息，然后生成初始证书，随后使用存储的证书私钥对初始证书签名，得到公钥证书，随后下发给用户管理服务器。
S49：用户管理服务器将用户身份信息和公钥证书进行绑定，然后存储进用户信息管理库中。
具体的，用户管理服务器将用户身份信息和公钥证书进行绑定，一般使用用户ID(Identity Document，标识号)和证书的指纹进行绑定，存储在用户信息管理库中。其中，证书的指纹是指证书拥有独一无二的识别代码。
S410：用户管理服务器下发公钥证书到零信任客户端，零信任客户端安装证书，同时传给证书存储设备进行存储。
采用本申请实施例提供的方法，可以方便内部用户快速完成用户注册，同时，确保非内部用户无法完成用户注册。
进一步地，为便于理解，请参见图9，图9是本申请实施例提供的一种用户认证流程的时序示意图。用户在成功完成了上述图8所示的初次使用零信任***时的用户注册流程之后，在后续的使用过程中，即可使用零信任客户端配合证书存储设备来进行零信任认证，从而方便的访问受保护的内网资源。用户认证流程比上述用户注册流程多了两个主体对象：用户软件和受保护的资源。用户软件是指用户使用的需要进行零信任认证的软件，用户需要通过这些软件来访问内部受保护的资源。对于B/S架构的软件来说，用户软件一般是指浏览器；对于C/S架构的软件来说，用户软件一般是指特定的客户端软件。受保护的资源一般是指软件的服务端，这些服务一般放在企业内网或云端，需要对访问请求进行人身认证，从而保护服务背后的资源只能被合法的用户访问。用户认证具体流程描述如下：
S501：正常用户软件发起的业务访问请求，被零信任客户端所拦截。
具体的，用户(即上述目标用户)正常使用软件(即上述业务应用)访问受保护的资源(即上述内部资源)，业务访问请求会被零信任客户端拦截。零信任客户端拦截业务访问请求可以采用虚拟网卡全流量代理的方式，简单来说，就是终端设备的所有请求，都会经过零信任客户端，而零信任客户端可以对请求进行识别，拦截住访问受保护资源的业务访问请求。
S502：零信任客户端发起携带目标用户的待验证身份信息的身份认证请求。
具体的，零信任客户端拦截到业务访问请求后，会发起用户认证流程，向用户管理服务器发送携带待验证身份信息的身份认证请求。
S503：用户管理服务器对待验证身份信息进行合法性验证，如果确定待验证身份信息为非法信息，下发身份验证失败提示信息。
具体的，用户管理服务器在用户信息管理库中查找与待验证身份信息相同的用户信息，进行用户信息检查；如果用户信息检查失败，即没有在用户信息管理库中查找到相同的用户信息，则确定待验证身份信息为非法信息，则可以直接向零信任客户端返回用户认证失败消息。
S504：如果用户管理服务器确定待验证身份信息为合法信息，发起挑战请求。
具体的，由于将证书颁发组件放置在证书机构服务器，则上述生成随机挑战信息和对待验证签名信息进行验签处理等过程也可以由证书机构服务器实现。此时，用户管理服务器会向CA服务器先发起挑战请求。
S505：证书机构服务器生成挑战信息(随机数)。
具体的，CA服务器接收到挑战请求后，会向零信任客户端发送挑战信息(即上述随机挑战信息)，挑战消息的实际信息可以是一个随机数。
S506：零信任客户端转发挑战信息(随机数)到证书存储设备。
具体的，零信任客户端会将挑战信息转发给证书存储设备，发起挑战应答流程，随后在证书存储设备内部进行数字证书签名操作。
S507：证书存储设备通过私钥对挑战信息进行签名。
具体的，证书存储设备本身具有运算能力，在收到随机挑战之后，在设备内部对挑战消息进行数字签名操作，其实质是使用存储在设备内部的私钥对挑战信息的随机数进行加密操作。
S508：证书存储设备将数字签名发送至零信任客户端。
具体的，证书存储设备将计算好的随机挑战的数字签名(即上述待验证签名信息)发送给零信任客户端。
S509：零信任客户端将数字签名发送给证书机构服务器。
S510：证书机构服务器发送用户信息查询请求。
具体的，用户信息查询请求中包含用户的用户信息。
S511：用户管理服务器返回公钥证书。
具体的，用户管理服务器会在用户信息管理库中查找与用户信息绑定的公钥证书，然后返回给CA服务器。
S512：证书机构服务器根据用户信息对数字签名进行校验。
具体的，CA服务器进行数字签名校验流程。具体操作是使用证书公钥对数字签名进行解密，然后将解密出的消息和步骤S505发送出去的挑战信息进行比对。如果一致，则校验成功，如果不一致，则校验失败。
S513：校验失败，下发身份校验失败提示信息；校验成功，下发验签通过消息。
具体的，如果校验失败，CA服务器会向零信任客户端返回数字签名校验失败消息，此时认证失败，正常用户软件的业务访问请求被终止；如果校验成功，CA服务器会向零信任客户端返回数字签名校验成功消息，此时用户的认证成功。
S514：校验成功，零信任客户端转发业务访问请求到用户管理服务器，用户管理服务器 再将业务访问请求转发至受保护的资源。
S515：受保护的资源响应。
通过本申请实施例提供的方法，用户通过正常用户软件访问受保护的资源时，需要先经过CA服务器的挑战认证，挑战认证通过后将业务访问请求转发至用户管理服务器，再由用户管理服务器转发至受保护的资源。由于终端设备的私钥具有不可导出性，攻击者无法通过盗取私钥生成挑战认证需要的数字签名，因此无法盗取用户的身份，从而避免了身份克隆攻击。
进一步地，请参见图10，图10是本申请实施例提供的一种基于零信任安全的访问控制装置的结构示意图。上述访问控制装置可以是运行于计算机设备中的一个计算机程序(包括程序代码)，例如该访问控制装置为一个应用软件；该装置可以用于执行本申请实施例提供的方法中的相应步骤。如图10所示，该访问控制装置1可以包括：拦截认证模块211、签名模块212以及转发模块213。
拦截认证模块211，用于拦截由业务应用所发起的业务访问请求，业务访问请求包含目标用户的待验证身份信息；
拦截认证模块211，还用于获取业务访问请求中的待验证身份信息；
转发模块213，用于向认证服务器发起携带待验证身份信息的身份认证请求，以使认证服务器在确定待验证身份信息为合法信息时，向安全认证组件发送随机挑战信息；
签名模块212，用于获取通过私钥对随机挑战信息进行签名得到的待验证签名信息；私钥无法被读取；
转发模块213，用于将待验证签名信息发送给认证服务器，以使认证服务器基于随机挑战信息和与待验证身份信息绑定的公钥证书对待验证签名信息进行验签，得到验签结果；
接收模块，用于若验签结果为验签通过结果，则接收认证服务器下发的验签通过消息；
转发模块213，还用于基于验签通过消息将业务访问请求发送至认证服务器，以使认证服务器将业务访问请求转发至业务应用所访问的业务服务器。
其中，拦截认证模块211、签名模块212以及转发模块213的具体实现方式，可以参见上述图5所对应实施例中步骤S101-S105的描述，这里将不再进行赘述。
请参见图10，签名模块212可以包括：组件签名单元221。
组件签名单元221，用于向公私钥存储组件传输所述随机挑战信息，所述公私钥存储组件用于通过所述公私钥存储组件中的私钥对所述随机挑战信息进行签名得到所述待验证签名信息；所述公私钥存储组件具有数据不可读属性；
组件签名单元221，用于获取所述公私钥存储组件传输的所述待验证签名信息。
所述公私钥存储组件，用于对所述随机挑战信息进行哈希运算，得到所述随机挑战信息的数字摘要；通过所述私钥对所述数字摘要进行非对称加密处理，得到针对所述随机挑战信息的待验证签名信息。
所述公私钥存储组件为用于与所述终端设备连接的硬件设备，或，所述公私钥存储组件为所述终端设备内的硬件设备，或，所述公私钥存储组件为运行在所述终端设备上的软件***。
其中，组件签名单元221的具体实现方式，可以参见上述图5所对应实施例中步骤S103的描述，这里将不再进行赘述。
其中，属于合法信息的目标用户的待验证身份信息存在于认证服务器中的用户信息管理库中，属于非法信息的目标用户的待验证身份信息不存在于认证服务器中的用户信息管理库中；
请参见图10，访问控制装置1还可以包括：
认证非法模块14，用于若认证服务器在确定待验证身份信息为非法信息时，接收认证服务器所发送的身份验证失败提示信息。
其中，认证非法模块14的具体实现方式，可以参见上述图5所对应实施例中步骤S103的描述，这里将不再进行赘述。
请参见图10，访问控制装置1还可以包括：传输模块15、注册请求模块16、回复认证模块17以及证书存储模块18。
所述公私钥存储组件，用于生成目标用户的公私钥对；公私钥对包括私钥和公钥；
传输模块15，用于接收所述公私钥存储组件传输的所述公钥；
注册请求模块16，用于向认证服务器发送针对目标用户的用户注册请求；用户注册请求包括目标用户的公钥和目标用户的用户身份信息；
注册请求模块16，还用于接收认证服务器基于用户注册请求发起的初始身份认证请求；
回复认证模块17，用于根据初始身份认证请求向认证服务器发送身份认证回复，以使认证服务器根据身份认证回复进行初始身份认证，得到初始身份认证结果；
证书存储模块18，还用于若初始身份认证结果为初始身份认证成功结果，则接收认证服务器下发的公钥证书；
所述传输模块15，用于向所述公私钥存储组件传输所述公钥证书，所述公私钥存储组件用于存储所述公钥证书。
其中，生成模块15、注册请求模块16、回复认证模块17以及证书存储模块18的具体实现方式，可以参见上述图5所对应实施例中步骤S105的可选描述，这里将不再进行赘述。
在一个可选的实施例中，身份认证回复包括待验证动态码；
请参见图10，回复认证模块17可以包括：界面显示单元171、第一响应单元172以及第一结果确定单元173。
界面显示单元171，用于根据初始身份认证请求显示动态码认证界面；动态码认证界面用于输入待验证动态码；
第一响应单元172，用于响应接收到在动态码认证界面上的输入确定操作，获取待验证动态码；
第一结果确定单元173，用于向认证服务器发送待验证动态码，以使认证服务器将待验证动态码和随机动态码进行比对处理，根据比对结果确定初始身份认证结果；所述随机动态码为所述认证服务器向联系账号发送的，所述联系账号在所述认证服务器的用户信息管理库中与所述目标用户具有绑定关系；
其中，若比对结果为待验证动态码和随机动态码相同，则初始身份认证结果为初始身份认证成功结果；若比对结果为待验证动态码和随机动态码不相同，则初始身份认证结果为初始身份认证失败结果。
其中，界面显示单元171、第一响应单元172以及第一结果确定单元173的具体实现方式，可以参见上述图5所对应实施例中步骤S105的可选描述，这里将不再进行赘述。
在一个可选的实施例中，身份认证回复包括待验证动态口令；
请参见图10，回复认证模块17可以包括：第二响应单元174以及第二结果确定单元175。
第二响应单元174，用于根据初始身份认证请求，调用令牌存储组件根据令牌密钥生成待验证动态口令；
第二结果确定单元175，用于向认证服务器发送待验证动态口令，以使认证服务器将待验证动态口令和目标动态口令进行比对处理，根据比对结果确定初始身份认证结果；目标动态口令是认证服务器根据用户管理信息库中与用户身份信息关联的目标令牌密钥生成的；若比对结果为待验证动态口令和目标动态口令相同，则初始身份认证结果为初始身份认证成功结果；若比对结果为待验证动态口令和目标动态口令不相同，则初始身份认证结果为初始身份认证失败结果。
其中，第二响应单元174以及第二结果确定单元175的具体实现方式，可以参见上述图5所对应实施例中步骤S105的可选描述，这里将不再进行赘述。
请参见图10，访问控制装置1还可以包括：访问控制模块19。
访问控制模块19，用于查询目标用户的访问状态；
访问控制模块19，还用于若访问状态为允许访问状态，则通过安全认证组件将业务访问请求发送至认证服务器，以使认证服务器将业务访问请求转发至业务应用所访问的业务服务器；
访问控制模块19，还用于若访问状态为未知访问状态，则执行通过安全认证组件获取业务访问请求中的待验证身份信息，向认证服务器发起携带待验证身份信息的身份认证请求的步骤。
其中，访问控制模块19的具体实现方式，可以参见上述图5所对应实施例中步骤S105的可选描述，这里将不再进行赘述。
请参见图10，访问控制装置1还可以包括：访问调整模块110。
访问调整模块110，用于当接收到认证服务器下发的验签通过消息时，接收认证服务器发送的状态调整指令，根据状态调整指令将目标用户的访问状态调整为允许访问状态；
访问调整模块110，还用于为目标用户的访问状态设置允许访问有效期；
访问调整模块110，还用于当目标用户的访问状态为允许访问状态的当前累计时长超出允许访问有效期时，将目标用户的访问状态调整为未知访问状态。
其中，访问控制模块110的具体实现方式，可以参见上述图5所对应实施例中步骤S105的可选描述，这里将不再进行赘述。
进一步地，请参见图11，图11是本申请实施例提供的一种计算机设备的结构示意图。如图11所示，上述图10所对应实施例中的访问控制装置1可以应用于上述计算机设备1000，上述计算机设备1000可以包括：处理器1001，网络接口1004和存储器1005，此外，上述计算机设备1000还包括：用户接口1003，和至少一个通信总线1002。其中，通信总线1002用于实现这些组件之间的连接通信。其中，用户接口1003可以包括显示屏(Display)、键盘(Keyboard)，可选用户接口1003还可以包括标准的有线接口、无线接口。网络接口1004可选的可以包括标准的有线接口、无线接口(如WI-FI接口)。存储器1005可以是高速RAM存储器，也可以是非不稳定的存储器(non-volatile memory)，例如至少一个磁盘存储器。存储器1005可选的还可以是至少一个位于远离前述处理器1001的存储装置。如图11所示，作为一种计算机可读存储介质的存储器1005中可以包括操作***、网络通信模块、用户接口模块以及设备控制应用程序。
在图11所示的计算机设备1000中，网络接口1004可提供网络通讯功能；而用户接口1003主要用于为用户提供输入的接口；而处理器1001可以用于调用存储器1005中存储的设备控制应用程序，以实现：
拦截由业务应用所发起的业务访问请求，业务访问请求包含目标用户的待验证身份信息；
获取业务访问请求中的待验证身份信息，向认证服务器发起携带待验证身份信息的身份认证请求，以使认证服务器在确定待验证身份信息为合法信息时，向安全认证组件发送随机挑战信息；
获取通过私钥对随机挑战信息进行签名得到的待验证签名信息；私钥无法被读取；
将待验证签名信息发送给认证服务器，以使认证服务器基于随机挑战信息和与待验证身份信息绑定的公钥证书对待验证签名信息进行验签，得到验签结果；
若验签结果为验签通过结果，则接收认证服务器下发的验签通过消息，基于验签通过消息将业务访问请求发送至认证服务器，以使认证服务器将业务访问请求转发至业务应用所访问的业务服务器。
应当理解，本申请实施例中所描述的计算机设备1000可执行前文各个实施例中对该访问控制方法的描述，也可执行前文图10所对应实施例中对该访问控制装置1的描述，在此不再赘述。另外，对采用相同方法的有益效果描述，也不再进行赘述。
此外，这里需要指出的是：本申请实施例还提供了一种计算机可读存储介质，且上述计算机可读存储介质中存储有前文提及的访问控制装置1所执行的计算机程序，当上述处理器加载并执行上述计算机程序时，能够执行前文任一实施例对上述访问控制方法的描述，因此，这里将不再进行赘述。另外，对采用相同方法的有益效果描述，也不再进行赘述。对于本申请所涉及的计算机可读存储介质实施例中未披露的技术细节，请参照本申请方法实施例的描述。
进一步的，请参见图12，图12是本申请实施例提供的另一种基于零信任安全的访问控制装置的结构示意图。上述数据处理装置可以是运行于计算机设备中的一个计算机程序(包括程序代码)，例如该访问控制装置为一个应用软件；该装置可以用于执行本申请实施例提供的方法中的相应步骤。如图12所示，该访问控制装置2可以包括：身份验证模块21、挑战发送模块22、验签模块23以及业务处理模块24。
身份验证模块21，用于响应安全认证组件发起的携带目标用户的待验证身份信息的身份认证请求，对待验证身份信息进行合法性验证；
挑战发送模块22，用于当确定待验证身份信息为合法信息时，向安全认证组件发送随机挑战信息，以使安全认证组件获取通过私钥对随机挑战信息进行签名得到的待验证签名信息；私钥无法被读取；
验签模块23，用于接收安全认证组件发送的待验证签名信息，基于随机挑战信息和与待验证身份信息绑定的公钥证书对待验证签名信息进行验签，得到验签结果；
业务处理模块24，用于若验签结果为验签通过结果，则向安全认证组件下发验签通过消息，以使安全认证组件基于验签通过消息发送业务访问请求至认证服务器；将业务访问请求转发至业务应用所访问的业务服务器。
其中，身份验证模块21、挑战发送模块22、验签模块23以及业务处理模块24的具体实现方式，可以参见上述图6所对应实施例中步骤S201-S205的描述，这里将不再进行赘述。
请参见图12，验签模块23可以包括：接收单元231、公钥获取单元232以及验签单元233。
接收单元231，用于接收安全认证组件发送的待验证签名信息；
公钥获取单元232，用于在用户信息管理库中获取与目标用户的待验证身份信息绑定的公钥证书，根据公钥证书确定目标用户的公钥；
验签单元233，用于基于目标用户的公钥和随机挑战信息对待验证签名信息进行验签，得到验签结果。
其中，接收单元231、公钥获取单元232以及验签单元233的具体实现方式，可以参见上述图6所对应实施例中步骤S203的描述，这里将不再进行赘述。
请参见图12，验签单元233可以包括：摘要获取子单元2331以及验签处理子单元2332。
摘要获取子单元2331，用于基于目标用户的公钥对待验证签名信息进行解密，得到数字摘要；
摘要获取子单元2331，还用于对随机挑战信息进行哈希运算，得到随机挑战信息的真实数字摘要；
验签处理子单元2332，用于若数字摘要和真实数字摘要相同，则确定验签结果为验签通过结果；
验签处理子单元2332，还用于若数字摘要和真实数字摘要不相同，则确定验签结果为验签失败结果，向安全认证组件下发身份验证失败提示信息。
所述待验证签名信息是所述安全认证组件调用公私钥存储组件通过所述公私钥存储组件中的私钥对所述随机挑战信息进行签名得到的；所述公私钥存储组件具有数据不可读属性。
所述公私钥存储组件为用于与所述终端设备连接的硬件设备，或，所述公私钥存储组件为所述终端设备内的硬件设备，或，所述公私钥存储组件为运行在所述终端设备上的软件系 统。
其中，摘要获取子单元2331以及验签处理子单元2332的具体实现方式，可以参见上述图6所对应实施例中步骤S203的描述，这里将不再进行赘述。
请参见图12，访问控制装置2还可以包括：注册模块25、认证模块26以及证书管理模块27。
注册模块25，用于接收安全认证组件发送的针对目标用户的用户注册请求；用户注册请求包括公钥和用户身份信息；
认证模块26，用于向终端设备发送基于用户注册请求发起的初始身份认证请求；
认证模块26，还用于接收安全认证组件根据初始身份认证请求发送的身份认证回复，根据身份认证回复进行初始身份认证，得到初始身份认证结果；
证书管理模块27，用于若初始身份认证结果确定为初始身份认证成功结果，则根据公钥和证书基本信息生成公钥证书；
证书管理模块27，还用于将公钥证书和用户身份信息进行绑定，将已绑定的公钥证书和用户身份信息存储至用户信息管理库中；
证书管理模块27，还用于将公钥证书下发到安全认证组件，以使终端设备将公钥证书存储至公私钥存储组件。
其中，注册模块25、认证模块26以及证书管理模块27的具体实现方式，可以参见上述图7所对应实施例中步骤S301-S304的描述，这里将不再进行赘述。
进一步地，请参见图13，图13是本申请实施例提供的另一种计算机设备的结构示意图。如图13所示，上述图12所对应实施例中的访问控制装置2可以应用于上述计算机设备2000，上述计算机设备2000可以包括：处理器2001，网络接口2004和存储器2005，此外，上述计算机设备2000还包括：用户接口2003，和至少一个通信总线2002。其中，通信总线2002用于实现这些组件之间的连接通信。其中，用户接口2003可以包括显示屏(Display)、键盘(Keyboard)，可选用户接口2003还可以包括标准的有线接口、无线接口。网络接口2004可选的可以包括标准的有线接口、无线接口(如WI-FI接口)。存储器2005可以是高速RAM存储器，也可以是非不稳定的存储器(non-volatile memory)，例如至少一个磁盘存储器。存储器2005可选的还可以是至少一个位于远离前述处理器2001的存储装置。如图13所示，作为一种计算机可读存储介质的存储器2005中可以包括操作***、网络通信模块、用户接口模块以及设备控制应用程序。
在图13所示的计算机设备2000中，网络接口2004可提供网络通讯功能；而用户接口2003主要用于为用户提供输入的接口；而处理器2001可以用于调用存储器2005中存储的设备控制应用程序，以实现：
认证服务器响应安全认证组件发起的携带目标用户的待验证身份信息的身份认证请求，对待验证身份信息进行合法性验证；
当确定待验证身份信息为合法信息时，向安全认证组件发送随机挑战信息，以使安全认证组件获取通过私钥对随机挑战信息进行签名得到的待验证签名信息；私钥无法被读取；
接收安全认证组件发送的待验证签名信息，基于随机挑战信息和与待验证身份信息绑定的公钥证书对待验证签名信息进行验签，得到验签结果；
若验签结果为验签通过结果，则向安全认证组件下发验签通过消息，以使安全认证组件基于验签通过消息发送业务访问请求至认证服务器；
将业务访问请求转发至业务应用所访问的业务服务器。
应当理解，本申请实施例中所描述的计算机设备2000可执行前文各个实施例中对该访问控制方法的描述，也可执行前文图12所对应实施例中对该访问控制装置2的描述，在此不再赘述。另外，对采用相同方法的有益效果描述，也不再进行赘述。
此外，这里需要指出的是：本申请实施例还提供了一种计算机可读存储介质，且上述计 算机可读存储介质中存储有前文提及的访问控制装置2所执行的计算机程序，当上述处理器加载并执行上述计算机程序时，能够执行前文任一实施例对上述访问控制方法的描述，因此，这里将不再进行赘述。另外，对采用相同方法的有益效果描述，也不再进行赘述。对于本申请所涉及的计算机可读存储介质实施例中未披露的技术细节，请参照本申请方法实施例的描述。
上述计算机可读存储介质可以是前述任一实施例提供的访问控制装置或者上述计算机设备的内部存储单元，例如计算机设备的硬盘或内存。该计算机可读存储介质也可以是该计算机设备的外部存储设备，例如该计算机设备上配备的插接式硬盘，智能存储卡(smart media card，SMC)，安全数字(secure digital，SD)卡，闪存卡(flash card)等。进一步地，该计算机可读存储介质还可以既包括该计算机设备的内部存储单元也包括外部存储设备。该计算机可读存储介质用于存储该计算机程序以及该计算机设备所需的其他程序和数据。该计算机可读存储介质还可以用于暂时地存储已经输出或者将要输出的数据。
以上所揭露的仅为本申请可选实施例而已，当然不能以此来限定本申请之权利范围，因此依本申请权利要求所作的等同变化，仍属本申请所涵盖的范围。

Claims (34)

  1. 一种基于零信任安全的访问控制方法，其特征在于，所述方法由终端设备执行，所述终端设备运行有安全认证组件和业务应用，所述方法包括：
    通过所述安全认证组件拦截由所述业务应用所发起的业务访问请求，所述业务访问请求包含目标用户的待验证身份信息；
    通过所述安全认证组件获取所述业务访问请求中的待验证身份信息，向认证服务器发起携带所述待验证身份信息的身份认证请求，以使所述认证服务器在确定所述待验证身份信息为合法信息时，向所述安全认证组件发送随机挑战信息；
    通过所述安全认证组件获取待验证签名信息，所述待验证签名信息是通过私钥对所述随机挑战信息进行签名得到的；所述私钥无法被读取；
    通过所述安全认证组件将所述待验证签名信息发送给所述认证服务器，以使所述认证服务器基于所述随机挑战信息和与所述待验证身份信息绑定的公钥证书对所述待验证签名信息进行验签，得到验签结果；
    若所述验签结果为验签通过结果，则通过所述安全认证组件接收所述认证服务器下发的验签通过消息，基于所述验签通过消息将所述业务访问请求发送至所述认证服务器，以使所述认证服务器将所述业务访问请求转发至所述业务应用所访问的业务服务器。
  2. 根据权利要求1所述的方法，其特征在于，所述通过所述安全认证组件获取待验证签名信息，包括：
    通过所述安全认证组件向公私钥存储组件传输所述随机挑战信息，所述公私钥存储组件用于通过所述公私钥存储组件中的私钥对所述随机挑战信息进行签名得到所述待验证签名信息；所述公私钥存储组件具有数据不可读属性；
    通过所述安全认证组件获取所述公私钥存储组件传输的所述待验证签名信息。
  3. 根据权利要求2所述的方法，其特征在于，所述公私钥存储组件，用于对所述随机挑战信息进行哈希运算，得到所述随机挑战信息的数字摘要；通过所述私钥对所述数字摘要进行非对称加密处理，得到针对所述随机挑战信息的待验证签名信息。
  4. 根据权利要求2或3所述的方法，其特征在于，所述公私钥存储组件为用于与所述终端设备连接的硬件设备，或，所述公私钥存储组件为所述终端设备内的硬件设备，或，所述公私钥存储组件为运行在所述终端设备上的软件***。
  5. 根据权利要求1至3任一所述的方法，其特征在于，属于合法信息的所述目标用户的待验证身份信息存在于所述认证服务器中的用户信息管理库中，属于非法信息的所述目标用户的待验证身份信息不存在于所述认证服务器中的用户信息管理库中；
    所述方法还包括：
    若所述认证服务器在确定所述待验证身份信息为非法信息时，通过所述安全认证组件接收所述认证服务器所发送的身份验证失败提示信息。
  6. 根据权利要求2或3所述的方法，其特征在于，所述公私钥存储组件，用于生成公私钥对；所述公私钥对包括所述私钥和所述公钥；
    所述方法还包括：
    通过所述安全认证组件接收所述公私钥存储组件传输的所述公钥；
    通过所述安全认证组件向认证服务器发送针对所述目标用户的用户注册请求；所述用户注册请求包括所述公钥和用户身份信息；
    通过所述安全认证组件接收所述认证服务器基于所述用户注册请求发起的初始身份认证请求，根据所述初始身份认证请求向所述认证服务器发送身份认证回复，以使所述认证服务器根据所述身份认证回复进行初始身份认证，得到初始身份认证结果；
    若所述初始身份认证结果为初始身份认证成功结果，则通过所述安全认证组件接收所述 认证服务器下发的所述目标用户的所述公钥证书；
    通过所述安全认证组件向所述公私钥存储组件传输所述公钥证书，所述公私钥存储组件用于存储所述公钥证书。
  7. 根据权利要求6所述的方法，其特征在于，所述身份认证回复包括待验证动态码；
    所述根据所述初始身份认证请求向所述认证服务器发送身份认证回复，包括：
    通过所述安全认证组件根据所述初始身份认证请求显示动态码认证界面；所述动态码认证界面用于输入待验证动态码；
    响应接收到在所述动态码认证界面上的输入确定操作，通过所述安全认证组件获取所述待验证动态码；
    通过所述安全认证组件向所述认证服务器发送所述待验证动态码，以使所述认证服务器将所述待验证动态码和随机动态码进行比对处理，根据比对结果确定初始身份认证结果；所述随机动态码为所述认证服务器向联系账号发送的，所述联系账号在所述认证服务器的用户信息管理库中与所述目标用户具有绑定关系；
    其中，若所述比对结果为所述待验证动态码和所述随机动态码相同，则所述初始身份认证结果为初始身份认证成功结果；若所述比对结果为所述待验证动态码和所述随机动态码不相同，则所述初始身份认证结果为初始身份认证失败结果。
  8. 根据权利要求6所述的方法，其特征在于，所述身份认证回复包括待验证动态口令；所述终端设备上运行有令牌存储组件；
    所述根据所述初始身份认证请求向所述认证服务器发送身份认证回复，包括：
    根据所述初始身份认证请求，通过所述安全认证组件调用令牌存储组件根据令牌密钥生成所述待验证动态口令；
    通过所述安全认证组件向所述认证服务器发送所述待验证动态口令，以使所述认证服务器将所述待验证动态口令和目标动态口令进行比对处理，根据比对结果确定初始身份认证结果；所述目标动态口令是所述认证服务器根据用户管理信息库中与所述用户身份信息关联的目标令牌密钥生成的；若所述比对结果为所述待验证动态口令和所述目标动态口令相同，则所述初始身份认证结果为初始身份认证成功结果；若所述比对结果为所述待验证动态口令和所述目标动态口令不相同，则所述初始身份认证结果为初始身份认证失败结果。
  9. 根据权利要求1至3任一所述的方法，其特征在于，所述方法还包括：
    通过所述安全认证组件查询所述目标用户的访问状态；
    若所述访问状态为允许访问状态，则通过所述安全认证组件将所述业务访问请求发送至所述认证服务器，以使所述认证服务器将所述业务访问请求转发至所述业务应用所访问的业务服务器；
    若所述访问状态为未知访问状态，则通过所述安全认证组件执行获取所述业务访问请求中的待验证身份信息，向认证服务器发起携带所述待验证身份信息的身份认证请求的步骤。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    当接收到所述认证服务器下发的验签通过消息时，通过所述安全认证组件接收所述认证服务器发送的状态调整指令，根据所述状态调整指令将所述目标用户的所述访问状态调整为所述允许访问状态；
    通过所述安全认证组件为所述目标用户的所述访问状态设置允许访问有效期；
    当所述目标用户的所述访问状态为所述允许访问状态的当前累计时长超出所述允许访问有效期时，通过所述安全认证组件将所述目标用户的所述访问状态调整为所述未知访问状态。
  11. 一种基于零信任安全的访问控制方法，其特征在于，所述方法由认证服务器执行，所述方法包括：
    响应安全认证组件发起的携带目标用户的待验证身份信息的身份认证请求，对所述待验证身份信息进行合法性验证；
    当确定所述待验证身份信息为合法信息时，向所述安全认证组件发送随机挑战信息，以使所述安全认证组件获取通过私钥对所述随机挑战信息进行签名得到的待验证签名信息；所述私钥无法被读取；
    接收所述安全认证组件发送的待验证签名信息，基于所述随机挑战信息和与所述待验证身份信息绑定的公钥证书对所述待验证签名信息进行验签，得到验签结果；
    若所述验签结果为验签通过结果，则向所述安全认证组件下发验签通过消息，以使所述安全认证组件基于所述验签通过消息发送业务访问请求至所述认证服务器；
    将所述业务访问请求转发至业务应用所访问的业务服务器；
    其中，所述业务应用和所述安全认证组件运行在终端设备中。
  12. 根据权利要求11所述的方法，其特征在于，所述接收所述安全认证组件发送的待验证签名信息，基于所述随机挑战信息和与所述待验证身份信息绑定的公钥证书对所述待验证签名信息进行验签，得到验签结果，包括：
    接收所述安全认证组件发送的待验证签名信息；
    在用户信息管理库中获取与所述目标用户的待验证身份信息绑定的公钥证书，根据所述公钥证书确定所述目标用户的公钥；
    基于所述目标用户的公钥和所述随机挑战信息对所述待验证签名信息进行验签，得到所述验签结果。
  13. 根据权利要求12所述的方法，其特征在于，所述基于所述目标用户的公钥和所述随机挑战信息对所述待验证签名信息进行验签，得到验签结果，包括：
    基于所述目标用户的公钥对所述待验证签名信息进行解密，得到数字摘要；
    对所述随机挑战信息进行哈希运算，得到所述随机挑战信息的真实数字摘要；
    若所述数字摘要和所述真实数字摘要相同，则确定所述验签结果为验签通过结果；
    若所述数字摘要和所述真实数字摘要不相同，则确定所述验签结果为验签失败结果，向所述安全认证组件下发身份验证失败提示信息。
  14. 根据权利要求11至13任一所述的方法，其特征在于，所述待验证签名信息是所述安全认证组件调用公私钥存储组件通过所述公私钥存储组件中的私钥对所述随机挑战信息进行签名得到的；所述公私钥存储组件具有数据不可读属性。
  15. 根据权利要求14所述的方法，其特征在于，所述公私钥存储组件为用于与所述终端设备连接的硬件设备，或，所述公私钥存储组件为所述终端设备内的硬件设备，或，所述公私钥存储组件为运行在所述终端设备上的软件***。
  16. 根据权利要求11至13任一所述的方法，其特征在于，所述方法还包括：
    接收安全认证组件发送的针对目标用户的用户注册请求；所述用户注册请求包括公钥和用户身份信息；
    向所述安全认证组件发送基于所述用户注册请求发起的初始身份认证请求；
    接收所述安全认证组件根据所述初始身份认证请求发送的身份认证回复，根据所述身份认证回复进行初始身份认证，得到初始身份认证结果；
    若所述初始身份认证结果确定为初始身份认证成功结果，则根据所述公钥和证书基本信息生成公钥证书；
    将所述公钥证书和所述用户身份信息进行绑定，将已绑定的所述公钥证书和所述用户身份信息存储至用户信息管理库中；
    将所述公钥证书下发到所述安全认证组件，以使所述安全认证组件将所述公钥证书存储至公私钥存储组件。
  17. 一种基于零信任安全的访问控制装置，其特征在于，所述装置包括：
    拦截认证模块，用于拦截由业务应用所发起的业务访问请求，所述业务访问请求包含目标用户的待验证身份信息；
    所述拦截认证模块，用于获取所述业务访问请求中的待验证身份信息；
    转发模块，用于向认证服务器发起携带所述待验证身份信息的身份认证请求，以使所述认证服务器在确定所述待验证身份信息为合法信息时，向所述安全认证组件发送随机挑战信息；
    签名模块，用于获取通过私钥对所述随机挑战信息进行签名得到的待验证签名信息；所述私钥无法被读取；
    所述转发模块，用于将所述待验证签名信息发送给所述认证服务器，以使所述认证服务器基于所述随机挑战信息和与所述待验证身份信息绑定的公钥证书对所述待验证签名信息进行验签，得到验签结果；
    接收模块，用于若所述验签结果为验签通过结果，则接收所述认证服务器下发的验签通过消息；
    所述转发模块，用于基于所述验签通过消息将所述业务访问请求发送至所述认证服务器，以使所述认证服务器将所述业务访问请求转发至所述业务应用所访问的业务服务器。
  18. 根据权利要求17所述的装置，其特征在于，所述签名模块包括：组件签名单元；
    所述组件签名单元，用于向公私钥存储组件传输所述随机挑战信息，所述公私钥存储组件用于通过所述公私钥存储组件中的私钥对所述随机挑战信息进行签名得到所述待验证签名信息；所述公私钥存储组件具有数据不可读属性；
    所述组件签名单元，用于获取所述公私钥存储组件传输的所述待验证签名信息。
  19. 根据权利要求18所述的装置，其特征在于，所述公私钥存储组件，用于对所述随机挑战信息进行哈希运算，得到所述随机挑战信息的数字摘要；通过所述私钥对所述数字摘要进行非对称加密处理，得到针对所述随机挑战信息的待验证签名信息。
  20. 根据权利要求18或19所述的装置，其特征在于，所述公私钥存储组件为用于与所述终端设备连接的硬件设备，或，所述公私钥存储组件为所述终端设备内的硬件设备，或，所述公私钥存储组件为运行在所述终端设备上的软件***。
  21. 根据权利要求17至19任一所述的装置，其特征在于，属于合法信息的所述目标用户的待验证身份信息存在于所述认证服务器中的用户信息管理库中，属于非法信息的所述目标用户的待验证身份信息不存在于所述认证服务器中的用户信息管理库中；
    所述装置还包括：
    认证非法模块，用于若所述认证服务器在确定所述待验证身份信息为非法信息时，接收所述认证服务器所发送的身份验证失败提示信息。
  22. 根据权利要求18或19所述的装置，其特征在于，所述公私钥存储组件，用于生成公私钥对；所述公私钥对包括所述私钥和所述公钥；
    所述装置还包括：
    传输模块，用于接收所述公私钥存储组件传输的所述公钥；
    注册请求模块，用于向认证服务器发送针对所述目标用户的用户注册请求；所述用户注册请求包括所述公钥和用户身份信息；
    所述注册请求模块，用于接收所述认证服务器基于所述用户注册请求发起的初始身份认证请求；
    回复认证模块，用于根据所述初始身份认证请求向所述认证服务器发送身份认证回复，以使所述认证服务器根据所述身份认证回复进行初始身份认证，得到初始身份认证结果；
    证书存储模块，用于若所述初始身份认证结果为初始身份认证成功结果，则接收所述认证服务器下发的所述目标用户的所述公钥证书；
    所述传输模块，用于向所述公私钥存储组件传输所述公钥证书，所述公私钥存储组件用于存储所述公钥证书。
  23. 根据权利要求22所述的装置，其特征在于，所述身份认证回复包括待验证动态码； 所述回复认证模块包括：界面显示单元、第一响应单元以及第一结果确定单元；
    所述界面显示单元，用于根据所述初始身份认证请求显示动态码认证界面；所述动态码认证界面用于输入待验证动态码；
    所述第一响应单元，用于响应接收到在所述动态码认证界面上的输入确定操作，获取所述待验证动态码；
    所述第一结果确定单元，用于向所述认证服务器发送所述待验证动态码，以使所述认证服务器将所述待验证动态码和随机动态码进行比对处理，根据比对结果确定初始身份认证结果；所述随机动态码为所述认证服务器向联系账号发送的，所述联系账号在所述认证服务器的用户信息管理库中与所述目标用户具有绑定关系；
    其中，若所述比对结果为所述待验证动态码和所述随机动态码相同，则所述初始身份认证结果为初始身份认证成功结果；若所述比对结果为所述待验证动态码和所述随机动态码不相同，则所述初始身份认证结果为初始身份认证失败结果。
  24. 根据权利要求22所述的装置，其特征在于，所述身份认证回复包括待验证动态口令；所述终端上运行有令牌存储组件；所述回复认证模块包括：第二响应单元以及第二结果确定单元；
    所述第二响应单元，用于根据所述初始身份认证请求，调用令牌存储组件根据令牌密钥生成所述待验证动态口令；
    所述第二结果确定单元，用于向所述认证服务器发送所述待验证动态口令，以使所述认证服务器将所述待验证动态口令和目标动态口令进行比对处理，根据比对结果确定初始身份认证结果；所述目标动态口令是所述认证服务器根据用户管理信息库中与所述用户身份信息关联的目标令牌密钥生成的；若所述比对结果为所述待验证动态口令和所述目标动态口令相同，则所述初始身份认证结果为初始身份认证成功结果；若所述比对结果为所述待验证动态口令和所述目标动态口令不相同，则所述初始身份认证结果为初始身份认证失败结果。
  25. 根据权利要求17至19任一所述的装置，其特征在于，所述装置还包括：
    访问控制模块，用于查询所述目标用户的访问状态；
    所述访问控制模块，用于若所述访问状态为允许访问状态，则将所述业务访问请求发送至所述认证服务器，以使所述认证服务器将所述业务访问请求转发至所述业务应用所访问的业务服务器；
    所述访问控制模块，用于若所述访问状态为未知访问状态，则执行获取所述业务访问请求中的待验证身份信息，向认证服务器发起携带所述待验证身份信息的身份认证请求的步骤。
  26. 根据权利要求25所述的装置，其特征在于，所述装置还包括：
    访问调整模块，用于当接收到所述认证服务器下发的验签通过消息时，接收所述认证服务器发送的状态调整指令，根据所述状态调整指令将所述目标用户的所述访问状态调整为所述允许访问状态；
    所述访问调整模块，用于为所述目标用户的所述访问状态设置允许访问有效期；
    所述访问调整模块，用于当所述目标用户的所述访问状态为所述允许访问状态的当前累计时长超出所述允许访问有效期时，将所述目标用户的所述访问状态调整为所述未知访问状态。
  27. 一种基于零信任安全的访问控制装置，其特征在于，所述装置包括：
    身份验证模块，用于响应安全认证组件发起的携带目标用户的待验证身份信息的身份认证请求，对所述待验证身份信息进行合法性验证；
    挑战发送模块，用于当确定所述待验证身份信息为合法信息时，向所述安全认证组件发送随机挑战信息，以使所述安全认证组件获取通过私钥对所述随机挑战信息进行签名得到的待验证签名信息；所述私钥无法被读取；
    验签模块，用于接收所述安全认证组件发送的待验证签名信息，基于所述随机挑战信息 和与所述待验证身份信息绑定的公钥证书对所述待验证签名信息进行验签，得到验签结果；
    业务处理模块，用于若所述验签结果为验签通过结果，则向所述安全认证组件下发验签通过消息，以使所述安全认证组件基于所述验签通过消息发送业务访问请求至所述认证服务器；将所述业务访问请求转发至业务应用所访问的业务服务器。
  28. 根据权利要求27所述的装置，其特征在于，所述验签模块包括：接收单元、公钥获取单元以及验签单元；
    所述接收单元，用于接收所述安全认证组件发送的待验证签名信息；
    所述公钥获取单元，用于在用户信息管理库中获取与所述目标用户的待验证身份信息绑定的公钥证书，根据所述公钥证书确定所述目标用户的公钥；
    所述验签单元，用于基于所述目标用户的公钥和所述随机挑战信息对所述待验证签名信息进行验签，得到所述验签结果。
  29. 根据权利要求28所述的装置，其特征在于，所述验签单元包括：摘要获取子单元以及验签处理子单元；
    所述摘要获取子单元，用于基于所述目标用户的公钥对所述待验证签名信息进行解密，得到数字摘要；
    所述摘要获取子单元，还用于对所述随机挑战信息进行哈希运算，得到所述随机挑战信息的真实数字摘要；
    所述验签处理子单元，用于若所述数字摘要和所述真实数字摘要相同，则确定所述验签结果为验签通过结果；
    所述验签处理子单元，还用于若所述数字摘要和所述真实数字摘要不相同，则确定所述验签结果为验签失败结果，向所述安全认证组件下发身份验证失败提示信息。
  30. 根据权利要求27至29任一所述的装置，其特征在于，所述待验证签名信息是所述安全认证组件调用公私钥存储组件通过所述公私钥存储组件中的私钥对所述随机挑战信息进行签名得到的；所述公私钥存储组件具有数据不可读属性。
  31. 根据权利要求30所述的装置，其特征在于，所述公私钥存储组件为用于与所述终端设备连接的硬件设备，或，所述公私钥存储组件为所述终端设备内的硬件设备，或，所述公私钥存储组件为运行在所述终端设备上的软件***。
  32. 根据权利要求27至29任一所述的装置，其特征在于，所述装置还包括：
    注册模块，用于接收安全认证组件发送的针对目标用户的用户注册请求；所述用户注册请求包括公钥和用户身份信息；认证模块，用于向所述安全认证组件发送基于所述用户注册请求发起的初始身份认证请求；所述认证模块，还用于接收所述安全认证组件根据所述初始身份认证请求发送的身份认证回复，根据所述身份认证回复进行初始身份认证，得到初始身份认证结果；证书管理模块，用于若所述初始身份认证结果确定为初始身份认证成功结果，则根据所述公钥和证书基本信息生成公钥证书；所述证书管理模块，还用于将所述公钥证书和所述用户身份信息进行绑定，将已绑定的所述公钥证书和所述用户身份信息存储至用户信息管理库中；所述证书管理模块，还用于将所述公钥证书下发到所述安全认证组件，以使所述安全认证组件将所述公钥证书存储至公私钥存储组件。
  33. 一种计算机设备，其特征在于，包括：处理器、存储器以及网络接口；所述处理器与所述存储器、所述网络接口相连，其中，所述网络接口用于提供网络通信功能，所述存储器用于存储程序代码，所述处理器用于调用所述程序代码，以执行权利要求1-16任一项所述的方法。
  34. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机程序，该计算机程序适于由处理器加载并执行权利要求1-16任一项所述的方法。
PCT/CN2021/108408 2021-06-15 2021-07-26 基于零信任安全的访问控制方法、设备及存储介质 WO2022262078A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/123,690 US20230224167A1 (en) 2021-06-15 2023-03-20 Access control method based on zero-trust security, device, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110660863.1A CN114679293A (zh) 2021-06-15 2021-06-15 基于零信任安全的访问控制方法、设备及存储介质
CN202110660863.1 2021-06-15

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/123,690 Continuation US20230224167A1 (en) 2021-06-15 2023-03-20 Access control method based on zero-trust security, device, and storage medium

Publications (1)

Publication Number Publication Date
WO2022262078A1 true WO2022262078A1 (zh) 2022-12-22

Family

ID=82071062

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/108408 WO2022262078A1 (zh) 2021-06-15 2021-07-26 基于零信任安全的访问控制方法、设备及存储介质

Country Status (3)

Country Link
US (1) US20230224167A1 (zh)
CN (1) CN114679293A (zh)
WO (1) WO2022262078A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116094852A (zh) * 2023-04-13 2023-05-09 深圳开鸿数字产业发展有限公司 设备的管理方法、管理装置、计算机设备及存储介质
CN116156495A (zh) * 2023-04-11 2023-05-23 支付宝(杭州)信息技术有限公司 一种基于无线信号的安全环境核身方法及***
CN116346505A (zh) * 2023-05-30 2023-06-27 浙江鹏信信息科技股份有限公司 物联网数据安全通信方法、***及计算机可读存储介质
CN116405929A (zh) * 2023-06-09 2023-07-07 贵州联广科技股份有限公司 适用于集群通讯的安全访问处理方法及***
CN116471128A (zh) * 2023-06-20 2023-07-21 合肥工业大学 一种用于车辆和外界设备的安全音频通信方法和***

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115134157A (zh) * 2022-06-29 2022-09-30 上海众人智能科技有限公司 一种基于数据安全访问的动态确权认证方法
CN115134155A (zh) * 2022-06-29 2022-09-30 北京天融信网络安全技术有限公司 一种鉴权方法及装置、计算机程序产品、电子设备
CN115174106A (zh) * 2022-06-30 2022-10-11 中国联合网络通信集团有限公司 云服务认证方法、装置、设备及存储介质
CN115333779A (zh) * 2022-07-15 2022-11-11 天翼云科技有限公司 一种验证数据的方法、装置及电子设备
CN115189967A (zh) * 2022-09-07 2022-10-14 杭州海康威视数字技术股份有限公司 访问控制方法、装置、电子设备及机器可读存储介质
CN115696329B (zh) * 2022-10-27 2024-06-25 中国联合网络通信集团有限公司 零信任认证方法及装置、零信任客户端设备和存储介质
CN116015961B (zh) * 2023-01-05 2024-05-28 中国联合网络通信集团有限公司 下挂终端设备的控制处理方法、安全cpe、***及介质
CN115834245A (zh) * 2023-01-05 2023-03-21 卓望数码技术（深圳）有限公司 一种安全认证方法、***、设备及存储介质
CN115801450B (zh) * 2023-01-12 2023-05-12 华腾数云(北京)科技有限公司 时间、终端多维联合认证方法及***
CN116170238B (zh) * 2023-04-26 2023-07-07 北京中宏立达科技发展有限公司 一种基于服务身份标识密钥的认证方法
CN116611098B (zh) * 2023-07-19 2023-10-27 北京电科智芯科技有限公司 文件加密移动存储方法、***及存储介质、电子设备
CN116866093B (zh) * 2023-09-05 2024-01-05 鼎铉商用密码测评技术(深圳)有限公司 身份认证方法、身份认证设备以及可读存储介质
CN117014226B (zh) * 2023-09-22 2024-01-12 云粒智慧科技有限公司 服务请求鉴权方法、装置、设备、***和存储介质
CN117614752B (zh) * 2024-01-24 2024-03-22 明阳点时科技(沈阳)有限公司 一种双层零信任企业生产网安全自组网方法及***

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8941469B1 (en) * 2010-06-14 2015-01-27 Impinj, Inc. RFID tag authentication with public-key cryptography
CN104468532A (zh) * 2014-11-19 2015-03-25 成都卫士通信息安全技术有限公司 一种跨多级网络边界的网络资源访问接入控制方法
CN104641375A (zh) * 2012-07-09 2015-05-20 生物技术公司 在医疗装置及其远程装置之间安全的通信
CN105101194A (zh) * 2014-04-28 2015-11-25 华为技术有限公司 终端安全认证方法、装置及***
CN107959573A (zh) * 2017-12-12 2018-04-24 华东交通大学 一种基于数字签名的网络摄像头的保护方法
WO2021004055A1 (zh) * 2019-07-05 2021-01-14 创新先进技术有限公司 人脸数据采集、验证的方法、设备及***

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1274105C (zh) * 2003-06-12 2006-09-06 上海格尔软件股份有限公司 基于数字证书实现的动态口令认证方法
CN103020825B (zh) * 2012-12-05 2016-05-11 福建派活园科技信息股份公司 一种基于软体客户端的安全支付认证方法
CN106487511B (zh) * 2015-08-27 2020-02-04 阿里巴巴集团控股有限公司 身份认证方法及装置
CN106612178A (zh) * 2015-10-22 2017-05-03 哈尔滨安天科技股份有限公司 保护Android adb数据传输安全的方法及装置
CN105847247B (zh) * 2016-03-21 2020-04-10 飞天诚信科技股份有限公司 一种认证***及其工作方法
CN107872438B (zh) * 2016-09-28 2021-02-05 腾讯科技（深圳）有限公司 一种验证方法、装置及终端
CN106789924B (zh) * 2016-11-25 2020-08-21 北京天威诚信电子商务服务有限公司 一种使用移动终端的数字证书保护web站点登录的方法及***
CN108881310B (zh) * 2018-08-15 2020-05-19 飞天诚信科技股份有限公司 一种注册***及其工作方法
CN110535856B (zh) * 2019-08-28 2022-04-26 视联动力信息技术股份有限公司 一种用户的认证方法、装置和存储介质
CN110557400B (zh) * 2019-09-16 2022-11-15 平安科技（深圳）有限公司 登录控制的方法及装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8941469B1 (en) * 2010-06-14 2015-01-27 Impinj, Inc. RFID tag authentication with public-key cryptography
CN104641375A (zh) * 2012-07-09 2015-05-20 生物技术公司 在医疗装置及其远程装置之间安全的通信
CN105101194A (zh) * 2014-04-28 2015-11-25 华为技术有限公司 终端安全认证方法、装置及***
CN104468532A (zh) * 2014-11-19 2015-03-25 成都卫士通信息安全技术有限公司 一种跨多级网络边界的网络资源访问接入控制方法
CN107959573A (zh) * 2017-12-12 2018-04-24 华东交通大学 一种基于数字签名的网络摄像头的保护方法
WO2021004055A1 (zh) * 2019-07-05 2021-01-14 创新先进技术有限公司 人脸数据采集、验证的方法、设备及***

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116156495A (zh) * 2023-04-11 2023-05-23 支付宝(杭州)信息技术有限公司 一种基于无线信号的安全环境核身方法及***
CN116094852A (zh) * 2023-04-13 2023-05-09 深圳开鸿数字产业发展有限公司 设备的管理方法、管理装置、计算机设备及存储介质
CN116094852B (zh) * 2023-04-13 2023-08-01 深圳开鸿数字产业发展有限公司 设备的管理方法、管理装置、计算机设备及存储介质
CN116346505A (zh) * 2023-05-30 2023-06-27 浙江鹏信信息科技股份有限公司 物联网数据安全通信方法、***及计算机可读存储介质
CN116346505B (zh) * 2023-05-30 2023-07-21 浙江鹏信信息科技股份有限公司 物联网数据安全通信方法、***及计算机可读存储介质
CN116405929A (zh) * 2023-06-09 2023-07-07 贵州联广科技股份有限公司 适用于集群通讯的安全访问处理方法及***
CN116405929B (zh) * 2023-06-09 2023-08-15 贵州联广科技股份有限公司 适用于集群通讯的安全访问处理方法及***
CN116471128A (zh) * 2023-06-20 2023-07-21 合肥工业大学 一种用于车辆和外界设备的安全音频通信方法和***
CN116471128B (zh) * 2023-06-20 2023-08-29 合肥工业大学 一种用于车辆和外界设备的安全音频通信方法和***

Also Published As

Publication number Publication date
US20230224167A1 (en) 2023-07-13
CN114679293A (zh) 2022-06-28

Similar Documents

Publication Publication Date Title
WO2022262078A1 (zh) 基于零信任安全的访问控制方法、设备及存储介质
CN110537346B (zh) 安全去中心化域名***
US9871791B2 (en) Multi factor user authentication on multiple devices
US9537861B2 (en) Method of mutual verification between a client and a server
US20220394026A1 (en) Network identity protection method and device, and electronic equipment and storage medium
US8196186B2 (en) Security architecture for peer-to-peer storage system
EP2491672B1 (en) Low-latency peer session establishment
KR20110057128A (ko) 휴대용 장치 연결
CA2719034A1 (en) System and method for storing client-side certificate credentials
EP2798772A1 (en) Web authentication using client platform root of trust
US20220070172A1 (en) Methods and systems for enabling identity-based services using a random identifier
Huang et al. A token-based user authentication mechanism for data exchange in RESTful API
JP2022534677A (ja) ブロックチェーンを使用するオンラインアプリケーションおよびウェブページの保護
KR20200125279A (ko) 블록 체인기반의 사용자 인증 방법, 시스템
KR102118556B1 (ko) 프라이빗 블록체인 기반 개인정보 관리 서비스 제공 방법
US11611541B2 (en) Secure method to replicate on-premise secrets in a cloud environment
Binu et al. A mobile based remote user authentication scheme without verifier table for cloud based services
Haqani et al. A decentralised blockchain-based secure authentication scheme for IoT devices
Cheng et al. IoT security access authentication method based on blockchain
KR20210129981A (ko) 가로채기 해킹 공격 방지를 위한 블록체인 기반 인증 시스템 및 방법
Ozha Kerberos: An Authentication Protocol
Chang et al. A dependable storage service system in cloud environment
Asha et al. One time password-based two channel authentication mechanism using blockchain
Kapudasu et al. Network Device Identity Management Using Cryptography
Moldamurat et al. Enhancing cryptographic protection, authentication, and authorization in cellular networks: a comprehensive research study.

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21945660

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE