Access control method based on zero-trust security, device, and storage medium

An access control method of a certificate authority server, comprising:

• receiving, from a user management server, a challenge request corresponding to validated identity information of a user, the identity information being provided to the user management server in a service access request from a user device;
• sending challenge information to a key storage component of the user device, the key storage component being configured to generate a public key and a private key, wherein the challenge information is based on a random value and associated with the identity information of the user;
• receiving, from the key storage component of the user device, signature information of the challenge information, the signature information of the challenge information being generated with the private key;
• sending a user information query request to the user management server;
• receiving a public key certificate associated with the identity information of the user from the user management server based on the user information query request;
• determining, by processing circuitry, whether the signature information is verified based on the public key that is indicated by the public key certificate;
• and
• sending a signature valid message to the user device based on the signature information being verified, the signature valid message indicating that the service access request is to be transmitted to the user management server.

An access control apparatus, comprising:

• processing circuitry configured to:
• receive a service access request of a service application, the service access request including identity information of a user;
• send an identity validation request to a user management server based on the service access request, the identity validation request including the identity information of the user;
• receive challenge information from a certificate authority server based on the identity information of the user in the identity validation request being determined to be valid by the user management server, wherein the challenge information is based on a random value and associated with the identity information of the user;
• forward the challenge information to a key storage component of the access control apparatus, the key storage component being configured to generate a public key and a private key;
• receive signature information of the challenge information from the key storage component, the signature information of the challenge information being generated with the private key;
• send the signature information to the certificate authority server;
• receive a signature valid message from the certificate authority server when the challenge information is verified by the certificate authority server based on the public key that is indicated by a public key certificate from the user management server and associated with the identity information of the user;
• and
• send, based on the signature valid message, the service access request to the user management server.