CN115865606A - A distributed network construction method under zero trust - Google Patents

Abstract

The invention relates to a method for constructing a distributed network under a zero-trust framework, comprising the following steps: step 1, establishing a connection with an agent center when a new client accesses; step 2, the client initiates a subscription message to the agent for topic subscription; step 3, the client Publish messages according to the topics subscribed in step 2. The invention can greatly improve the security of the distributed system.

Description

A distributed network construction method under zero trust

technical field

The invention belongs to the technical field of information communication, and relates to a distributed network construction method, in particular to a distributed network construction method under zero trust.

Background technique

Nowadays, information technology is changing with each passing day, and open sharing has become the mainstream of the times. The emergence of open computing environments such as cloud computing and distributed computing marks the gradual development of information systems from single-domain and closed to cross-domain and collaborative. The complexity of network information resources in the big data environment makes the protection of information resources and private data more difficult. The traditional access control model has been unable to realize the protection of private information and the secure interaction of confidential data in a complex network environment. There is an urgent need for fine-grained, A flexible access control model, so the attribute-based access control model (ABAC) came into being. The attribute-based access control model can adapt to complex network environments in a fine-grained manner, and at the same time use attributes to describe users and resources, so that it has sufficient advantages in flexibility and scalability, and can guarantee anonymity in large-scale distributed environments Security of Access.

In view of the fact that the traditional network security model cannot meet the security needs of the intranet, a network security model based on zero trust came into being. For any subject that accesses the network, including the person who initiates the access, the device that initiates the access, and the application that is accessed, it is in an untrusted state by default every time it visits, and it is necessary to build a dynamic access system through continuous identity verification and access authorization. trust. This is the core idea of the zero-trust network security model, and its essence is to control access based on the identity of the access subject.

The combination of zero-trust network and dynamic access control technology is the current research hotspot of IoT security, and it is also a new development direction. The existing distributed network security protection technology has problems such as insufficient security authentication of "terminal (equipment)-application (behavior)-user (role)", insufficient security monitoring of terminal network access behavior, insufficient fineness and dynamic adaptability of terminal access control, etc. , facing security risks such as illegal terminal access, legitimate terminal attacks, and unauthorized malicious terminal access.

After searching, no published patent documents identical or similar to the present invention have been found.

Contents of the invention

The purpose of the present invention is to overcome the deficiencies of the prior art, and propose a method for building a distributed network under zero trust with reasonable design, high flexibility, safety and reliability, which can greatly improve the security of the distributed system.

The present invention solves its practical problems and is realized by taking the following technical solutions:

A method for constructing a distributed network under a zero-trust framework, comprising the following steps:

Step 1. Establish a connection with the agency center when a new customer accesses;

Step 2. The client initiates a subscription message to the agent for topic subscription;

Step 3. The client publishes the message according to the topic subscribed in step 2.

And, the concrete steps of described step 1 include:

(1) The new customer applies for certification to the certification center of the trust evaluation module, and the certification center queries whether the new customer exists in the existing black and white list: ① If it exists in the black list, refuse to return the certificate ② If it exists in the white list, return A certificate with a subject attribute has an initial trust value ③ If it does not exist on the whitelist, a certificate with a subject attribute will also be returned without an initial trust value;

(2) A new customer initiates a connection request to the agency center with a certificate attached, and the request is intercepted by the policy enforcement point PEP. The PEP first transfers the customer information to the trust evaluation center of the trust evaluation module, and the trust evaluation center calculates the current trust value of the customer;

(3) After obtaining the trust value of the client, PEP judges whether to allow the connection request according to the trust threshold; if the trust value is satisfied, it forwards the connection request to the agent and updates the list to the authentication center at the same time;

(4) After the agency center successfully establishes a connection with the customer, it will feed back the connection confirmation message, which is also intercepted by the PEP, and the trust evaluation will be performed again.

And, the concrete steps of described step 2 include:

(1) The customer initiates a subscription message to the agent, which is intercepted by the PEP, and first transferred to the trust assessment center to conduct a trust assessment for the current customer. If the trust level is lower than the trust threshold required for the topic subscription, the application will be directly rejected and the blacklist will be updated;

(2) PEP provides the customer's current trust value to the policy decision point PDP in the access control module, and the trust degree will participate in the authorization process as an important subject attribute. Find the satisfied access control policy at the location, if the request is rejected, a rejection message will be returned to the client, and if the request is allowed, the subscription message will be forwarded to the agent;

(3) The agent accepts the subscription request and forwards the subscription success/failure message to the customer, which is also intercepted by the PEP and forwarded to the trust evaluation center, which conducts trust evaluation on the agent center and the customer and updates the trust list.

And, the specific steps of described step 3 include:

(1) The customer releases a message to the agency center according to the topic, which is intercepted by PEP and first transferred to the trust evaluation center to conduct a trust evaluation for the current customer. If the trust value is too low, the release will be directly rejected and the blacklist will be updated;

(2) PEP provides the current trust value of the customer to the PDP, and the PDP searches for the satisfied access control policy at the PAP according to various attribute information and the customer trust value. If it refuses to publish, it returns a rejection message to the customer, and if it is allowed, it forwards it to the agency center make an announcement;

(3) The agency center receives the information released by the customer, queries the latest trust list from the trust evaluation center, and forwards the topic message to the subscribing customers who meet the trust level of the topic according to the trust value. If the customer trust value does not reach the trust threshold required for accepting the message, then Send a message refusal notification to the customer, informing the customer that there is an unreceived message on this topic and specifying the reason;

(4) The agency center feedbacks the release success/failure information to the issuing customer, which is also intercepted by the PEP and forwarded to the trust evaluation center to conduct trust evaluation on the agent and customer and update the trust list.

Advantages and beneficial effects of the present invention:

1. The present invention proposes a distributed network construction method under a zero-trust framework, including: a client, an agent center, an access control module, and a trust evaluation module; the client and the agent center are basic components in the subscription/publishing mode, and the client is both a message The publisher of the message is also the subscriber of the message, and the broker is responsible for accepting client requests and managing the subscription and publishing of messages. The present invention adds an access control module and a trust evaluation module under the framework of the traditional subscription/publishing mode, utilizes the fine-grained and high-flexibility advantages of the ABAC model, and combines dynamic and continuous trust evaluation to greatly improve the security of the distributed system .

2. The present invention combines the ABAC access control model with continuous trust assessment, and proposes a distributed network construction method based on a subscription/publishing model under a zero-trust framework. It is feasible to make use of the fine-grained and high-flexibility features of the ABAC model to meet the security requirements of dynamic access in distributed networks and to make up for the security gaps in the existing distributed Internet of Things.

Description of drawings

Fig. 1 is the block diagram of the processing flow that connects with agent center when the new client of step 1 of the present invention connects;

Fig. 2 is the block diagram of the processing flow of the client initiating a subscription message to the agent in step 2 of the present invention to subscribe to a topic;

Fig. 3 is a block diagram of the processing flow of message release by the client of the present invention;

Fig. 4 is a block diagram of the authorization process of user behavior by the ABAC model;

Fig. 5 is a block diagram of a trust evaluation performed by a trust evaluation center (PEC) on a user in the trust evaluation module.

Detailed ways

Embodiments of the present invention are described in further detail below in conjunction with the accompanying drawings:

A method for building a distributed network under a zero-trust framework, as shown in Figures 1 to 3, comprising the following steps:

Step 1. Establish a connection with the agency center when a new customer accesses;

The concrete steps of described step 1 include:

(1) The new customer applies for certification to the certification center of the trust evaluation module, and the certification center queries whether the new customer exists in the existing black and white list: ① If it exists in the black list, refuse to return the certificate ② If it exists in the white list, return A certificate with a subject attribute has an initial trust value ③ If it does not exist on the whitelist, a certificate with a subject attribute will also be returned without an initial trust value;

(2) A new customer initiates a connection request to the agency center with a certificate attached, and the request is intercepted by the Policy Enforcement Point (PEP). The PEP first transfers the customer information to the trust assessment center of the trust assessment module, and the trust assessment center calculates the current trust value;

The trust evaluation center can be linked with the policy decision point PDP and policy information point PIP in the access control module to collect user interaction records and quantify them into comprehensive trust values;

(3) After obtaining the client's trust value, PEP judges whether to allow the connection request according to the trust threshold; if the trust value is satisfied, it forwards the connection request to the agent and updates the list to the authentication center.

(4) After the agency center successfully establishes a connection with the customer, it will feed back the connection confirmation message, which is also intercepted by the PEP, and the trust evaluation will be performed again. Then forward the connection confirmation information.

Taking the agent as one of the objects of trust evaluation can effectively avoid the security risks brought by untrusted agents, and greatly improve the security of the distributed system.

In this embodiment, when a new client accesses, a connection needs to be established with the agency center. Before the connection is established, an application for authentication to the authentication center is required, and a connection application can only be made after obtaining the certificate. At this time, the application is intercepted by the PEP and forwarded to the trust evaluation center. The client does the trust evaluation, and the forward proxy does the connection establishment. The agent feedbacks the establishment success/failure information, which is forwarded by the PEP and conducts trust evaluation on the agent and the client again.

Step 2. The client initiates a subscription message to the agent for topic subscription;

The client needs to subscribe to the topic before receiving the message, and the subscription message is initiated by the client to the agent;

The concrete steps of described step 2 include:

(1) The customer initiates a subscription message to the agent, which is intercepted by the PEP, and first transferred to the trust assessment center to conduct a trust assessment for the current customer. If the trust level is lower than the trust threshold required for the topic subscription, the application will be directly rejected and the blacklist will be updated; No subsequent authorization process is required, reducing the overhead caused by access control;

(2) PEP provides the current trust value of the customer to the policy decision point (PolicyDecisionPoint, PDP) in the access control module, and the trust degree will participate in the authorization process as an important subject attribute. The policy administration point (PolicyAdministrationPoint _, PAP) looks for the satisfied access control policy, if the request is rejected, it will return a rejection message to the client, and if it is allowed, it will forward the subscription message to the agent.

Since there is no process in which the client subject directly applies for access to resource objects in the present invention, the present invention makes some changes to the access control process, and its access control policy formulation and implementation will be based on themes. Topics exist in a tree form, and access control policies are created based on the topic tree. Administrators can assign matching access rights to each topic, and the authorization process is based on the permissions, constraints, and policies under the topic;

(3) The agent accepts the subscription request and forwards the subscription success/failure message to the customer, which is also intercepted by the PEP and forwarded to the trust evaluation center, which conducts trust evaluation on the agent center and the customer and updates the trust list.

In this embodiment, the process of unsubscribing is similar to the process of applying for subscription, so details are not repeated here.

In this embodiment, the client needs to subscribe to the topic before receiving the message. The subscription message is initiated by the client to the agent and intercepted by the PEP. Find the satisfied access control policy at the policy management point based on various attribute information and customer trust values; the proxy accepts the subscription request and forwards the subscription success/failure message to the customer, which is also intercepted by PEP and forwarded to the trust evaluation center for the proxy and customer. Trust evaluation and update trust list.

Step 3. The client publishes the message according to the topic subscribed in step 2

The concrete steps of described step 3 include:

(1) The customer releases a message to the agency center according to the topic, which is intercepted by PEP and first transferred to the trust evaluation center to conduct a trust evaluation for the current customer. If the trust value is too low, the release will be directly rejected and the blacklist will be updated;

(2) PEP provides the current trust value of the customer to the PDP, and the PDP searches for the satisfied access control policy at the PAP according to various attribute information and the customer trust value. If it refuses to publish, it returns a rejection message to the customer, and if it is allowed, it forwards it to the agency center make an announcement.

Due to the dynamic nature of the distributed system, each message subscription/publishing needs to be authorized. After the end of a behavior, the user's current permissions will be invalidated, and the next time the same behavior (such as publishing the same topic information again) needs to be done. reauthorization;

(3) The agency center receives the information released by the customer, queries the latest trust list from the trust evaluation center, and forwards the topic message to the subscribing customers who meet the trust level of the topic according to the trust value. If the customer trust value does not reach the trust threshold required for accepting the message, then Send a message refusal notification to the customer, informing the customer that there is an unreceived message on this topic and specifying the reason;

(4) The agency center feedbacks the release success/failure information to the issuing customer, which is also intercepted by the PEP and forwarded to the trust evaluation center to conduct trust evaluation on the agent and customer and update the trust list.

In this embodiment, customers can publish messages based on topics. In the traditional subscription publishing mode, after receiving the messages published by customers, the agent directly sends the customers who have subscribed to the topic according to the subscription list. This approach does not conform to the principle of zero trust. Thought. In this model, restrictions will be added to the release of messages. Not only do customers need to conduct trust evaluation and access control decisions when publishing messages, but agents also need to obtain customer trust values when forwarding messages, and forward corresponding messages to customers that meet the trust requirements. .

In this embodiment, an access control module is also included to dynamically authorize user behavior;

The functions and effects of the access control module are as follows:

In the access control part of the present invention, an attribute-based access control model (AttributeBasedAccessControl, ABAC) is adopted and improved. ABAC is an access control method that matches the access control rights to protected resources according to the specified attributes of subjects and objects, environmental conditions, and a set of policies specified according to these attributes and conditions. Since there is no process in which the client subject directly applies for accessing resource objects in the present invention, the present invention makes certain changes to the ABAC model, and its access control policy formulation and implementation will be based on topics. Topics exist in a tree form, and access control policies are created based on the topic tree. Administrators can assign matching access rights to each topic, and the authorization process is based on the permissions, constraints, and policies under the topic.

Extensible Access Control Markup Language (XACML) is an OASIS specification that uses XML language to express access control policies for information access. It can support complex and fine-grained access control policy languages, and can be used to implement the ABAC authorization model. The model includes 5 main parts: a) Policy Enforcement Point (PEP): a system entity that enforces access control by issuing decision requests and enforcing authorization decisions; b) Policy Decision Point (PDP): based on access control policies and other attribute information The entity that makes access control decisions; c) Policy Administration Point (PAP): the entity that generates and maintains security policies in the system; d) Policy Information Point (PIP): the entity that obtains the attribute information of subjects, environments and resources, if PEP initiates Some attributes are missing in the request, which will be found by PIP and fed back to PDP for decision-making; e) Context Processor (Context Processor): convert external requests into XACML requests, and convert XACML responses into external responses, and serve according to attributes Digitizes XACML requests (responses).

The block diagram of the access control model is shown in Figure 4, which is not the research content of the present invention, so it will not be described in detail.

In this embodiment, a trust assessment module is also included to perform continuous trust assessment on user behavior.

The description of the trust evaluation module is as follows:

The trust evaluation module is divided into two parts: the certification authorization center (CAC) and the trust evaluation center (PEC), which are responsible for managing the trust system in the network. The basic framework of the TEC is shown in Figure 5. CAC stores black and white lists of customers and is responsible for issuing certificates. TEC is responsible for evaluating the trust degree between any peer entities in the network system. TEC is linked with modules such as the authentication authorization center CAC and policy decision point PDP in the model to collect access between entities. Interaction historical records, quantified as trust comprehensive ability, using peer entity similarity, penalty mechanism, trust decay, etc. to calculate direct trust, indirect trust and recommended trust, and feedback the results to the policy decision point in the access control module In the next step of the PDP operation, the trust degree will participate in the authorization process as an important subject attribute.

Usually, the access control policy does not change frequently, but the trust degree of the subject changes dynamically. Multiple abnormal behaviors will cause the trust degree of the subject to drop sharply or even enter the blacklist, which reduces the overhead brought by access control to a certain extent, because Some behaviors of users with unqualified trust will be directly rejected without subsequent authorization process. In addition, the topic tree has a hierarchical division, and the trust hierarchy is applicable to this model. Subscription, publication, and reception under different topics correspond to different trust thresholds, which is easy to implement.

In addition, the agent (Broker) is also one of the trust evaluation objects, which can effectively avoid the security risks brought by untrusted agents and greatly improve the security of the distributed system.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowcharts and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

Claims (4)

1. A distributed network construction method under a zero-trust framework, characterized in that: comprising the following steps: Step 1. Establish a connection with the agency center when a new customer accesses; Step 2. The client initiates a subscription message to the agent for topic subscription; Step 3. The client publishes the message according to the topic subscribed in step 2. 2. The distributed network construction method under a zero-trust framework according to claim 1, characterized in that: the specific steps of the step 1 include: (1) The new customer applies for certification to the certification center of the trust evaluation module, and the certification center queries whether the new customer exists in the existing black and white list: ① If it exists in the black list, refuse to return the certificate ② If it exists in the white list, return A certificate with a subject attribute has an initial trust value ③ If it does not exist on the whitelist, a certificate with a subject attribute will also be returned without an initial trust value; (2) A new customer initiates a connection request to the agency center with a certificate attached, and the request is intercepted by the policy enforcement point PEP. The PEP first transfers the customer information to the trust evaluation center of the trust evaluation module, and the trust evaluation center calculates the current trust value of the customer; (3) After obtaining the trust value of the client, PEP judges whether to allow the connection request according to the trust threshold; if the trust value is satisfied, it forwards the connection request to the agent and updates the list to the authentication center at the same time; (4) After the agency center successfully establishes a connection with the customer, it will feed back the connection confirmation message, which is also intercepted by the PEP, and the trust evaluation will be performed again. 3. The distributed network construction method under a zero-trust framework according to claim 1, characterized in that: the specific steps of the step 2 include: (1) The customer initiates a subscription message to the agent, which is intercepted by the PEP, and first transferred to the trust assessment center to conduct a trust assessment for the current customer. If the trust level is lower than the trust threshold required for the topic subscription, the application will be directly rejected and the blacklist will be updated; (2) PEP provides the customer's current trust value to the policy decision point PDP in the access control module, and the trust degree will participate in the authorization process as an important subject attribute. Find the satisfied access control policy at the location, if the request is rejected, a rejection message will be returned to the client, and if the request is allowed, the subscription message will be forwarded to the proxy; (3) The agent accepts the subscription request and forwards the subscription success/failure message to the customer, which is also intercepted by the PEP and forwarded to the trust evaluation center, which conducts trust evaluation on the agent center and the customer and updates the trust list. 4. The method for constructing a distributed network under a zero-trust framework according to claim 1, wherein the specific steps of step 3 include: (1) The customer releases a message to the agency center according to the topic, which is intercepted by PEP and first transferred to the trust evaluation center to conduct a trust evaluation for the current customer. If the trust value is too low, the release will be directly rejected and the blacklist will be updated; (2) PEP provides the current trust value of the customer to the PDP, and the PDP searches for the satisfied access control policy at the PAP according to various attribute information and the customer trust value. If it refuses to publish, it returns a rejection message to the customer, and if it is allowed, it forwards it to the agency center make an announcement; (3) The agency center receives the information released by the customer, queries the latest trust list from the trust evaluation center, and forwards the topic message to the subscribing customers who meet the trust level of the topic according to the trust value. If the customer trust value does not reach the trust threshold required for accepting the message, then Send a message refusal notification to the customer, informing the customer that there is an unreceived message on this topic and specifying the reason; (4) The agency center feedbacks the release success/failure information to the issuing customer, which is also intercepted by the PEP and forwarded to the trust evaluation center to conduct trust evaluation on the agent and customer and update the trust list.

Images