CN115696329B - Zero trust authentication method and device, zero trust client device and storage medium - Google Patents

Abstract

The application provides a zero-trust authentication method and device, zero-trust client equipment and a storage medium. The method is applied to the zero-trust client and comprises the following steps: sending a first login request to the zero trust server, and enabling the zero trust server to verify login information in the first login request to generate a first authentication result; receiving a first authentication result; when the first authentication result indicates that authentication is successful and login is not performed for the first time, an identification code request is sent to the national cipher SIM card; receiving an integrated circuit card identification code ICCID, and acquiring an international mobile equipment identification code IMEI and a random number; signing the ICCID, the IMEI and the random number by using the digital certificate to generate a national secret SIM card fingerprint; the second authentication result is sent to the zero trust server to enable the zero trust server to authenticate the fingerprint of the national secret SIM card to generate a second authentication result; and when the second authentication result indicates that authentication is successful, receiving a login response sent by the zero trust server. The method reduces the security risk of the zero-trust client.

Description

Zero trust authentication method and device, zero trust client device and storage medium

Technical Field

The present application relates to the field of computer technology, and in particular to a zero-trust authentication method and apparatus, a zero-trust client device, and a storage medium.

Background technique

Zero trust is a network security protection concept. In the zero trust mode, any person, device, and system inside or outside the user network needs to be "continuously verified and never trusted". Based on the zero trust principle, user terminal security, link security, and access control security can be guaranteed.

At present, in the zero-trust authentication process of the user terminal device login operation, the user name and password are usually used for authentication, and then the device fingerprint generated by hardware information such as the device serial number and network card media access control (MAC) address is used for authentication. Login is allowed after both authentications are passed.

However, when using the above-mentioned zero-trust authentication method, there are still security risks such as malicious tampering or forgery of device fingerprints.

Summary of the invention

The present application provides a zero-trust authentication method and apparatus, a zero-trust client device and a storage medium to solve the problem of device fingerprints being maliciously tampered with or forged.

In a first aspect, the present application provides a zero-trust authentication method, which is applied to a zero-trust client, and the method includes:

Sending a first login request to the zero trust server, so that the zero trust server verifies the login information in the first login request and generates a first authentication result;

Receive the first authentication result sent by the zero trust server;

After the first authentication result indicates that the authentication is successful and it is not the first login, sending an identification code request to the Subscriber Identity Module (SIM) card;

Receive the integrated circuit card identity (ICCID) sent by the national encryption SIM card;

Obtain the International Mobile Equipment Identity (IMEI) and random number of the zero-trust client;

Use the pre-stored digital certificate to sign the ICCID, IMEI and random number to generate the national secret SIM card fingerprint;

Send the national secret SIM card fingerprint to the zero trust server, so that the zero trust server authenticates the national secret SIM card fingerprint and generates a second authentication result;

When the second authentication result indicates that the authentication is successful, receive a login response sent by the zero trust server.

Optionally, after receiving the first authentication result sent by the zero-trust server, the method further includes:

After the first authentication result indicates that the authentication is successful and it is not the first login, obtain the personal identification number (PIN) of the national secret SIM card, generate a signature request according to the PIN of the national secret SIM card, and send the signature request to the national secret SIM card;

Receive the signature sent by the national encryption SIM card;

Generate a signature authentication request based on the signature and user information, send the signature authentication request to the zero trust server, and enable the zero trust server to authenticate the signature and user information in the signature authentication request to generate a third authentication result;

Accordingly, when the second authentication result indicates that the authentication is successful, a login response sent by the zero-trust server is received, specifically including:

When the second authentication result and the third authentication result both indicate successful authentication, a login response sent by the zero-trust server is received.

Optionally, before sending the first login request to the zero trust server, the method further includes:

Sending a second login request to the zero trust server, so that the zero trust server verifies the login information in the second login request and generates a fourth authentication result;

Receive the fourth authentication result sent by the zero trust server;

After the fourth authentication result indicates that the authentication is successful and at the first login, a digital certificate request is sent to the zero trust server;

Receive the digital certificate sent by the zero-trust server;

Forward the digital certificate to the national encryption SIM card so that the national encryption SIM card can store the digital certificate.

Optionally, before sending a digital certificate request to the zero trust server, the following steps are also included:

Send a national encryption SIM card application request to the management server;

Receive the national encryption SIM card application sent by the management server;

Sending a real-name authentication request to the zero-trust server, so that the zero-trust server authenticates the real-name authentication information in the real-name authentication request to generate a fifth authentication result;

Accordingly, after the fourth authentication result indicates that the authentication is successful and at the first login, a digital certificate request is sent to the zero trust server, specifically including:

After the fourth authentication result and the fifth authentication result both indicate successful authentication and at the first login, a digital certificate request is sent to the zero trust server;

Accordingly, the digital certificate is forwarded to the national secret SIM card so that the national secret SIM card stores the digital certificate, specifically including:

By running the national encryption SIM card application, the digital certificate is forwarded to the national encryption SIM card, so that the national encryption SIM card stores the digital certificate.

Optionally, send a digital certificate request to the zero trust server, including:

Send a certificate signing request to the national encryption SIM card to enable the national encryption SIM card to generate an asymmetric key;

Receive the asymmetric key sent by the national encryption SIM card, and generate a digital certificate request based on the asymmetric key;

Send a digital certificate request to the zero trust server.

Optionally, after receiving the login response sent by the zero trust server, the following is further included:

Receive risk warning information sent by the national secret SIM card, where the risk warning information is generated after the national secret SIM card receives the pop-up authentication command sent by the management server; the pop-up authentication command is generated by the management server after receiving the secondary authentication command sent by the zero trust server, and the zero trust server generates the secondary authentication command after detecting a risk event;

Generate a confirmation response based on the risk warning information, and send the confirmation response to the national encryption SIM card, so that the national encryption SIM card forwards the confirmation response to the zero trust server through the management server.

In a second aspect, the present application provides a zero-trust authentication device, which is applied to a zero-trust client, and the device includes:

A sending module, used to send a first login request to a zero-trust server, so that the zero-trust server verifies the login information in the first login request and generates a first authentication result;

A receiving module, used to receive a first authentication result sent by a zero-trust server;

The sending module is further used to send an identification code request to the national encryption SIM card after the first authentication result indicates that the authentication is successful and it is not the first login;

The receiving module is also used to receive the integrated circuit card identification code sent by the national encryption SIM card, and obtain the international mobile equipment identification code and random number of the zero-trust client;

The signature module is used to sign the integrated circuit card identification code, the international mobile equipment identification code and the random number using the pre-stored digital certificate to generate the national secret SIM card fingerprint;

The sending module is also used to send the national secret SIM card fingerprint to the zero trust server, so that the zero trust server authenticates the national secret SIM card fingerprint and generates a second authentication result;

The receiving module is also used to receive a login response sent by the zero-trust server when the second authentication result indicates that the authentication is successful.

In a third aspect, the present application provides a zero-trust client device, including: a memory and a processor;

The memory is used to store computer programs; the processor is used to execute the zero-trust authentication method in the first aspect and any possible design of the first aspect according to the computer program stored in the memory.

In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it is used to implement the zero-trust authentication method in the first aspect and any possible design of the first aspect.

In a fifth aspect, the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the zero-trust authentication method in the first aspect and any possible design of the first aspect.

The zero-trust authentication method and apparatus, zero-trust client device and storage medium provided in this application, after the zero-trust server successfully authenticates the first login request, uses a digital certificate to sign the ICCID, IMEI and random number to generate a national secret SIM card fingerprint for fingerprint authentication, thereby solving the problem of the device fingerprint used in fingerprint authentication being maliciously tampered with or forged, and achieving the effect of reducing security risks.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

FIG1 is a schematic diagram of a zero-trust authentication scenario provided by an embodiment of the present application;

FIG2 is a signaling interaction diagram of a zero-trust authentication method provided in an embodiment of the present application;

FIG3 is a signaling interaction diagram of a digital certificate signature provided in an embodiment of the present application;

FIG4 is a signaling interaction diagram of a zero-trust client logging in for the first time provided by an embodiment of the present application;

FIG5 is a signaling interaction diagram of zero-trust client secondary authentication provided by an embodiment of the present application;

FIG6 is a schematic diagram of the structure of a zero-trust authentication device provided in an embodiment of the present application;

FIG. 7 is a schematic diagram of the hardware structure of a zero-trust client device provided in an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

The terms "first", "second", "third", "fourth", etc. in the specification and claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances. For example, first information can also be referred to as second information without departing from the scope of this document, and similarly, second information can also be referred to as first information.

To ensure the security of the client, users are generally required to perform authentication when logging in to the client. In the prior art, a user name and password authentication is usually performed when the client logs in. After the authentication is passed, the client generates a device fingerprint based on hardware information such as the device serial number and the network card MAC address, and sends it to the server, which verifies it. After the verification is passed, the client is allowed to log in.

However, in the prior art, the device fingerprint used for authentication still has security risks such as being maliciously tampered with or forged, and the authentication result cannot ensure the security of the client.

In response to the above problems, the present application proposes a zero-trust authentication method and apparatus, a zero-trust client device and a storage medium. The zero-trust authentication method of the present application is to send a first login request to the zero-trust server when the client is not logging in for the first time. After the zero-trust server authenticates the login information of the first login request, the zero-trust client uses a digital certificate to sign the ICCID, IMEI and random number to generate a national secret SIM card fingerprint, which is sent to the zero-trust server for fingerprint authentication. After the authentication is passed, the zero-trust client is allowed to log in. Compared with the prior art, in the method of the present application, the fingerprint used for fingerprint authentication is generated by signing the ICCID, IMEI and random number with a digital certificate. Due to the use of ICCID and IMEI, the uniqueness of the zero-trust client is guaranteed, and the random number ensures that the fingerprint is different each time the authentication is performed, reducing the security risks of fingerprints being maliciously tampered with or forged.

The technical solution of the present application is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

FIG1 shows a schematic diagram of a zero-trust authentication scenario provided by an embodiment of the present application. When a zero-trust client logs in, it is usually necessary to authenticate through a zero-trust server. The authentication method can be username and password authentication, fingerprint authentication or other authentication methods, or a combination of multiple authentication methods. The zero-trust client can successfully log in only after at least two authentications are passed.

In this application, the zero-trust client is used as the execution subject to execute the zero-trust authentication method of the following embodiment. Specifically, the execution subject can be a hardware device of the zero-trust client, or a software application that implements the following embodiment in the zero-trust client, or a computer-readable storage medium installed with the software application that implements the following embodiment, or a code of the software application that implements the following embodiment.

FIG2 shows an interactive signaling diagram of a zero-trust authentication method provided by an embodiment of the present application, which is applied to a zero-trust client. As shown in FIG2 , the method of this embodiment may include the following steps:

S201. Send a first login request to the zero trust server, so that the zero trust server verifies the login information in the first login request and generates a first authentication result.

Among them, the login information of the first login request can be a user name and password. The zero trust server verifies the login information according to the pre-stored user name and password to generate a first authentication result.

S202. Receive a first authentication result sent by the zero-trust server.

S203: After the first authentication result indicates that the authentication is successful and it is not the first login, send an identification code request to the national encryption SIM card.

In this embodiment, when the first authentication result indicates that the authentication is successful and it is not the first login, the ICCID of the national secret SIM card is applied to the national secret SIM card, and the ICCID can be used to query the user information of the national secret SIM card. The first login situation will be described in detail in the subsequent embodiments of this application.

S204, receiving the ICCID sent by the national encryption SIM card.

S205. Obtain the IMEI and random number of the zero-trust client.

Among them, IMEI is the international mobile equipment identity code of the zero-trust client. Each zero-trust client has a unique IMEI, which can be used to identify the authenticity of the zero-trust client.

S206. Use the pre-stored digital certificate to sign the ICCID, IMEI and random number to generate a national secret SIM card fingerprint.

In this embodiment, ICCID, IMEI and random number form a string. For example, ICCID is AAA, IMEI is BBB, random number is CCC, and the corresponding string is AAABBBCCC. The string is signed by a digital certificate, and the signature value is the national secret SIM card fingerprint. The random number can ensure that the national secret SIM card fingerprint is different each time the authentication is performed, that is, the national secret SIM card fingerprint is a dynamic fingerprint.

S207. Send the national secret SIM card fingerprint to the zero-trust server, so that the zero-trust server authenticates the national secret SIM card fingerprint and generates a second authentication result.

In this embodiment, after receiving the national secret SIM card fingerprint, the zero-trust server uses the digital certificate to decrypt the national secret SIM card fingerprint to obtain a string consisting of ICCID, IMEI and random numbers, and then intercepts the string corresponding to ICCID and IMEI, for example, AAABBBCCC is intercepted to AAABBB, and compares it with the pre-stored initial fingerprint. If they are consistent, the authentication is passed. The initial fingerprint is a string consisting of ICCID and IMEI. For example, if ICCID is AAA and IMEI is BBB, the corresponding initial fingerprint is AAABBB.

S208. When the second authentication result indicates that the authentication is successful, receive a login response sent by the zero-trust server.

In this embodiment, the authentication is successful, that is, the first authentication result and the second authentication result both indicate that the authentication is successful, and a login response sent by the zero-trust server is received, and the zero-trust client logs in successfully.

The zero-trust authentication method of this embodiment, when it is not the first login, after authenticating the first login request, uses a digital certificate to sign a string consisting of ICCID, IMEI and random numbers to obtain the national secret SIM card fingerprint, and the zero-trust server verifies the national secret SIM card fingerprint, reducing the risk of fingerprint tampering or forgery, thereby reducing the security risk of the zero-trust client.

FIG3 is a signaling interaction diagram of a digital certificate signature provided by an embodiment of the present application, which is applied to a zero-trust client. As shown in FIG3, in some embodiments, after step 202, the following steps are also included:

S301. After the first authentication result indicates that the authentication is successful and it is not the first login, the zero-trust client obtains the PIN of the national secret SIM card, generates a signature request according to the PIN of the national secret SIM card, and sends the signature request to the national secret SIM card.

In this embodiment, the PIN is used to verify the identity of the zero-trust client user. In addition, the signature request may also include a zero-trust client custom message, such as a message that identifies the user's identity information.

S302. The zero-trust client receives the signature sent by the national encryption SIM card.

In this embodiment, the signature sent by the national cryptographic SIM card refers to the national cryptographic SIM card using a digital certificate to sign the signature request containing the custom message.

S303. The zero-trust client generates a signature authentication request based on the signature and user information, and sends the signature authentication request to the zero-trust server, so that the zero-trust server authenticates the signature and user information in the signature authentication request to generate a third authentication result.

The user information may be a user name and a password, or may be only a user name. The signature and user information are verified to verify the information of the user of the zero-trust client, or other possible custom information is also verified.

In this embodiment, step S208 specifically includes: when the second authentication result and the third authentication result both indicate successful authentication, receiving a login response sent by the zero trust server.

The zero-trust authentication method of this embodiment is based on the embodiment shown in Figure 2. After authenticating the first login request, a digital certificate is used to sign the signature request generated according to the PIN of the national secret SIM card. The zero-trust server verifies the signature and user information, thereby reducing the risk of mismatch between the current user of the zero-trust client and the registrant, and further reducing the security risk of the zero-trust client.

FIG4 is a signaling interaction diagram of a zero-trust client's first login provided by an embodiment of the present application, which is applied to a zero-trust client. As shown in FIG4, in some embodiments, before step S201, the following steps are also included:

S401. The zero-trust client sends a second login request to the zero-trust server, so that the zero-trust server verifies the login information in the second login request and generates a fourth authentication result.

In this embodiment, the login information in the second login request may be a user name and password. The zero-trust server verifies the login information based on the pre-stored user name and password to generate a fourth authentication result.

S402. The zero trust client receives the fourth authentication result sent by the zero trust server.

S403. After the fourth authentication result indicates that the authentication is successful and when logging in for the first time, the zero-trust client sends a national encryption SIM card application request to the management server.

In this embodiment, when logging in for the first time, the zero-trust client needs to complete the activation of the national secret SIM card authentication policy, that is, apply for the national secret SIM card application from the management server, complete the real-name authentication through the zero-trust server, and apply for a digital certificate from the zero-trust server. The management server can be at least one business server.

S404. The zero-trust client receives the national encryption SIM card application sent by the management server.

S405. The zero-trust client sends a real-name authentication request to the zero-trust server, so that the zero-trust server authenticates the real-name authentication information in the real-name authentication request and generates a fifth authentication result.

Among them, real-name authentication can only be performed after applying for the national secret SIM card application. The zero-trust client interacts with the national secret SIM card through the national secret SIM card application.

S406. After the fifth authentication result indicates that the authentication is successful, the zero-trust client sends a certificate signing request to the national encryption SIM card, so that the national encryption SIM card generates an asymmetric key.

In this embodiment, the signature request may be a certificate signing request file (CSR), which may be generated by the zero-trust client calling the national cryptographic SIM card application interface. The national cryptographic SIM card generates an asymmetric key according to the CSR.

S407. The zero-trust client receives the asymmetric key sent by the national encryption SIM card and generates a digital certificate request based on the asymmetric key.

In this embodiment, the zero-trust client generates a digital certificate request based on an asymmetric key, and the digital certificate is used to identify the user.

S408. The zero trust client sends a digital certificate request to the zero trust server.

S409. The zero trust client receives the digital certificate sent by the zero trust server.

S410. The zero-trust client forwards the digital certificate to the national encryption SIM card, so that the national encryption SIM card stores the digital certificate.

In this embodiment, the zero-trust client can forward the digital certificate to the national encryption SIM card by running the national encryption SIM card application, so that the national encryption SIM card stores the digital certificate.

The zero-trust authentication method of this embodiment, when logging in for the first time, after successfully authenticating the login information of the second login request, applies to the management server for a national secret SIM card application, requests real-name authentication from the zero-trust server, and then applies to the zero-trust server for a digital certificate after the authentication is successful, thereby completing the authentication policy activation process of the national secret SIM card when the zero-trust client logs in for the first time, so that when the zero-trust client is not logging in for the first time, it can directly use the digital certificate stored in the national secret SIM card to sign the string composed of ICCID, IMEI and random numbers to generate a national secret SIM card fingerprint, and use the digital certificate to sign the signature request generated according to the national secret SIM card PIN, making the zero-trust authentication process simpler and the security of the zero-trust client more secure.

FIG5 is a signaling interaction diagram of a zero-trust client secondary authentication provided by an embodiment of the present application, which is applied to a zero-trust client. As shown in FIG5, in some embodiments, after step S208, it also includes:

S501. The zero-trust client receives risk warning information sent by the national secret SIM card, wherein the risk warning information is generated after the national secret SIM card receives the pop-up authentication command sent by the management server; the pop-up authentication command is generated by the management server after receiving the secondary authentication command sent by the zero-trust server, and the zero-trust server generates the secondary authentication command after detecting a risk event.

In this embodiment, after the zero-trust client receives the login response sent by the zero-trust server, the login is successful. During the use of the zero-trust client, if the zero-trust server perceives that there is a risk in the zero-trust client access, it will generate a secondary authentication command and send it to the management server. The management server generates a pop-up authentication command based on the secondary authentication command and sends it to the national secret SIM card. The national secret SIM card generates risk warning information and sends it to the zero-trust client. Among them, the zero-trust server can perceive the risk of zero-trust client access through channels such as threat intelligence and zero-trust client environment perception.

The zero-trust client can include multiple applications, and all of them communicate with the management server and the zero-trust server through the national encryption SIM card, without having to communicate directly with the management server and the zero-trust server.

S502. The zero-trust client generates a confirmation response based on the risk warning information, and sends the confirmation response to the national encryption SIM card, so that the national encryption SIM card forwards the confirmation response to the zero-trust server through the management server.

In this embodiment, the confirmation response can be that the zero-trust client confirms that the current user is the first-time login user. The zero-trust client communicates with the management server and the zero-trust server through the national secret SIM card. After the national secret SIM card receives the confirmation response, it forwards the confirmation response to the zero-trust server through the management server. After the zero-trust server receives the confirmation response, the zero-trust client passes the secondary authentication.

The zero-trust authentication method of this embodiment initiates secondary authentication when the zero-trust server perceives that there is a risk in the access of the zero-trust client, so that the zero-trust client confirms that the current user is a first-time login user, thereby reducing the security risk of the zero-trust client during use.

FIG6 is a schematic diagram of the structure of a zero-trust authentication device provided by an embodiment of the present application. As shown in FIG6, the present application also provides a zero-trust authentication device 60, which is applied to a zero-trust client, and the device 60 includes:

A sending module 601 is used to send a first login request to a zero-trust server, so that the zero-trust server verifies the login information in the first login request and generates a first authentication result;

A receiving module 602 is used to receive a first authentication result sent by a zero-trust server;

The sending module 601 is further used to send an identification code request to the national encryption SIM card after the first authentication result indicates that the authentication is successful and it is not the first login;

The receiving module 602 is also used to receive the integrated circuit card identification code sent by the national encryption SIM card, and obtain the international mobile equipment identification code and random number of the zero-trust client;

The signature module 603 is used to sign the integrated circuit card identification code, the international mobile equipment identification code and the random number using the pre-stored digital certificate to generate a national secret SIM card fingerprint;

The sending module 601 is also used to send the national secret SIM card fingerprint to the zero trust server, so that the zero trust server authenticates the national secret SIM card fingerprint to generate a second authentication result;

The receiving module 602 is also used to receive a login response sent by the zero-trust server when the second authentication result indicates that the authentication is successful.

The zero-trust authentication device 60 provided in this embodiment can execute the above method embodiment. Its specific implementation principles and technical effects can be found in the above method embodiment, and this embodiment will not be repeated here.

Fig. 7 is a schematic diagram of the hardware structure of a zero-trust client device 70 provided in an embodiment of the present application. As shown in Fig. 7, the zero-trust client device 70 may include: a memory 701, a processor 702 and a communication interface 704.

The memory 701 is used to store computer programs. The memory 701 may include a high-speed random access memory (RAM), and may also include a non-volatile memory (NVM), such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a disk or an optical disk.

Processor 702 is used to execute the computer program stored in the memory to implement the zero-trust authentication method in the above embodiment. For details, please refer to the relevant description in the above method embodiment. The processor 702 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can be any conventional processor, etc. The steps of the method disclosed in the invention can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

Optionally, the memory 701 may be independent or integrated with the processor 702 .

When the memory 701 is a device independent of the processor 702, the zero-trust client device 70 may further include a bus 703. The bus 703 is used to connect the memory 701 and the processor 702. The bus 703 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

The communication interface 704 may be connected to the processor 702 via the bus 703. The processor 702 may control the communication interface 704 to implement the function of zero-trust authentication.

The zero-trust client device 70 provided in this embodiment can be used to execute the above-mentioned zero-trust authentication method. Its implementation method and technical effects are similar, and this embodiment will not be repeated here.

The present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, it is used to implement the methods provided in the various embodiments described above.

Among them, the computer-readable storage medium can be a computer storage medium or a communication medium. The communication medium includes any medium that facilitates the transmission of a computer program from one place to another. The computer storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer. For example, a computer-readable storage medium is coupled to a processor so that the processor can read information from the computer-readable storage medium and write information to the computer-readable storage medium. Of course, the computer-readable storage medium can also be a component of the processor. The processor and the computer-readable storage medium can be located in an application-specific integrated circuit (ASIC). In addition, the ASIC can be located in a user device. Of course, the processor and the computer-readable storage medium can also exist in a communication device as discrete components.

Specifically, the computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special-purpose computer.

The present application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor of a device can read the computer program from the computer-readable storage medium, and at least one processor executes the computer program so that the device implements the methods provided in the various embodiments described above.

In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed.

Among them, each module can be physically separated, for example, installed in different locations of a device, or installed on different devices, or distributed on multiple network units, or distributed on multiple processors. Each module can also be integrated together, for example, installed in the same device, or integrated in a set of codes. Each module can exist in the form of hardware, or can also exist in the form of software, or can also be implemented in the form of software plus hardware. The present application can select some or all of the modules according to actual needs to achieve the purpose of the present embodiment.

When each module is implemented as an integrated module in the form of a software function module, it can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of each embodiment of the present application.

It should be understood that, although the various steps in the flowchart in the above-described embodiment are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and they can be executed in other orders. Moreover, at least a portion of the steps in the figure may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the above embodiments can still be modified, or some or all of the technical features can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims (9)

1. A zero-trust authentication method, applied to a zero-trust client, the method comprising:

Sending a first login request to a zero trust server, and enabling the zero trust server to verify login information in the first login request to generate a first authentication result;

Receiving the first authentication result sent by the zero trust server;

After the first authentication result indicates that authentication is successful and when login is not performed for the first time, an identification code request is sent to a national password user identity identification SIM card;

receiving an integrated circuit card identification code ICCID sent by the national cipher SIM card;

Acquiring an international mobile equipment identification code (IMEI) and a random number of the zero trust client;

Signing the ICCID, the IMEI and the random number by using a pre-stored digital certificate to generate a national password SIM card fingerprint;

The national secret SIM card fingerprint is sent to the zero trust server, so that the zero trust server authenticates the national secret SIM card fingerprint to generate a second authentication result;

Receiving a login response sent by the zero trust server when the second authentication result indicates that authentication is successful;

After receiving the first authentication result sent by the zero trust server, the method further includes:

After the first authentication result indicates that authentication is successful and the user logs in for the first time, acquiring a personal identification Password (PIN) of a national-security SIM card, generating a signature request according to the PIN of the national-security SIM card, and sending the signature request to the national-security SIM card;

receiving a signature sent by the national cipher SIM card;

Generating a signature authentication request according to the signature and the user information, and sending the signature authentication request to the zero trust server to enable the zero trust server to authenticate the signature and the user information in the signature authentication request, so as to generate a third authentication result;

Correspondingly, when the second authentication result indicates that authentication is successful, receiving a login response sent by the zero trust server, which specifically includes:

And when the second authentication result and the third authentication result indicate that authentication is successful, receiving a login response sent by the zero trust server.

2. The method of claim 1, wherein before sending the first login request to the zero trust server, further comprising:

sending a second login request to the zero trust server, and enabling the zero trust server to verify login information in the second login request to generate a fourth authentication result;

receiving the fourth authentication result sent by the zero trust server;

after the fourth authentication result indicates that authentication is successful and when logging in for the first time, a digital certificate request is sent to the zero trust server;

receiving the digital certificate sent by the zero trust server;

And forwarding the digital certificate to the national cipher SIM card, so that the national cipher SIM card stores the digital certificate.

3. The method of claim 2, wherein before sending the digital certificate request to the zero trust server, further comprising:

Sending a national cipher SIM card application request to a management server;

receiving a national cipher SIM card application program sent by the management server;

A real-name authentication request is sent to the zero-trust server, so that the zero-trust server authenticates real-name authentication information in the real-name authentication request to generate a fifth authentication result;

correspondingly, when the fourth authentication result indicates that authentication is successful and logging in for the first time, a digital certificate request is sent to the zero trust server, which specifically comprises:

after the fourth authentication result and the fifth authentication result indicate authentication success and when logging in for the first time, sending a digital certificate request to the zero trust server;

Correspondingly, forwarding the digital certificate to the national cipher SIM card to enable the national cipher SIM card to store the digital certificate, and specifically comprises the following steps:

And forwarding the digital certificate to the national cipher SIM card by running the national cipher SIM card application program, so that the national cipher SIM card stores the digital certificate.

4. The method of claim 3, wherein the sending the digital certificate request to the zero trust server specifically comprises:

sending a certificate signing request to the national secret SIM card so that the national secret SIM card generates an asymmetric key;

Receiving the asymmetric key sent by the national cipher SIM card, and generating a digital certificate request according to the asymmetric key;

And sending the digital certificate request to the zero trust server.

5. The method according to any one of claims 1-4, further comprising, after receiving the login response sent by the zero trust server:

Receiving risk prompt information sent by the national security SIM card, wherein the risk prompt information is generated after the national security SIM card receives a popup authentication command sent by a management server; the popup authentication command is generated after the management server receives a secondary authentication command sent by the zero-trust server, and the zero-trust server generates the secondary authentication command after detecting a risk event;

Generating a confirmation response according to the risk prompt information, and sending the confirmation response to the national cipher SIM card, so that the national cipher SIM card forwards the confirmation response to the zero trust server through the management server.

6. A zero-trust authentication apparatus for use with a zero-trust client, the apparatus comprising:

The sending module is used for sending a first login request to the zero trust server side, so that the zero trust server side verifies login information in the first login request to generate a first authentication result;

the receiving module is used for receiving the first authentication result sent by the zero trust server;

The sending module is further used for sending an identification code request to the national cipher SIM card when the first authentication result indicates that authentication is successful and the authentication is not performed for the first time;

the receiving module is further configured to receive an ICCID sent by the national security SIM card, and obtain an IMEI and a random number of the zero trust client;

the signature module is used for signing the ICCID, the IMEI and the random number by using a pre-stored digital certificate to generate a national secret SIM card fingerprint;

The sending module is further configured to send the national secret SIM card fingerprint to the zero trust server, so that the zero trust server authenticates the national secret SIM card fingerprint to generate a second authentication result;

the receiving module is further configured to receive a login response sent by the zero trust server when the second authentication result indicates that authentication is successful;

The sending module is further configured to obtain a personal identification password PIN of the national security SIM card after the receiving the first authentication result sent by the zero trust server, and after the first authentication result indicates that authentication is successful and when the authentication is not performed for the first time, generate a signature request according to the PIN of the national security SIM card, and send the signature request to the national security SIM card; receiving a signature sent by the national cipher SIM card; generating a signature authentication request according to the signature and the user information, and sending the signature authentication request to the zero trust server to enable the zero trust server to authenticate the signature and the user information in the signature authentication request, so as to generate a third authentication result;

Correspondingly, the receiving module is further configured to receive a login response sent by the zero-trust server when the second authentication result and the third authentication result both indicate that authentication is successful.

7. A zero trust client device, the device comprising: a memory and a processor;

the memory is used for storing a computer program;

The processor is configured to implement the zero trust authentication method according to any one of claims 1-5 according to a computer program stored in the memory.

8. A computer readable storage medium, characterized in that the computer readable storage medium has stored therein a computer program which, when executed by a processor, is adapted to implement the zero trust authentication method according to any one of claims 1-5.

9. A computer program product, characterized in that the computer program product comprises a computer program which, when executed by a processor, implements the zero trust authentication method of any one of claims 1-5.