Session processing method and device based on zero trust mechanism, equipment and medium

Abstract

The present disclosure provides a session processing method and device based on a zero trust mechanism, equipment and medium, relating to the technical field of network and security. The method comprises: receiving a session request forwarded by a broadband access gateway device, the session request being a session request initiated by a client to a target application server through the broadband access gateway device, the session request containing a domain name and / or a network address of the target application server; verifying whether the target application server belongs to a preset white list according to the domain name and / or the network address; in the case that the target application server belongs to the preset white list, judging whether the number of current session requests accessed by the target application server exceeds a preset threshold; if the number of current session requests accessed by the target application server does not exceed the preset threshold, forwarding the session request to the target application server. The present disclosure can ensure that the application system maintains maximum load processing of session access requests based on the zero trust mechanism, and improves the session processing efficiency.

Description

Technical Field

[0001] This disclosure relates to the field of network and security technology, and in particular to a session processing method, apparatus, device and medium based on a zero-trust mechanism. Background Technology

[0002] A Broadband Access Gateway (BRAS) is an access server for a broadband fixed IP network. A Point-to-Point Protocol (PPP) is typically used between the user and the BRAS to authenticate the user and handle access time-based billing. A BRAS generally covers a Layer 2 Ethernet access area, and any IP address on the BRAS can access the network via PPPoE.

[0003] However, with the development of the Internet, most people can obtain information in real time through the network. Therefore, when a hot event occurs, the lack of reasonable execution strategies and the inability to control the number of sessions in a timely manner in the relevant technologies can lead to a sudden influx of sessions into the application server, causing the application server to operate under overload, which often results in congestion of the relevant website or even network paralysis. Similar situations also occur in some large enterprise private networks at certain times. In schools, similar incidents also occur frequently during the course registration period each semester.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] This disclosure provides a session processing method, apparatus, device, and medium based on a zero-trust mechanism, which at least to some extent overcomes the problems of network congestion or even paralysis under sudden high load conditions in related technologies.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0007] According to one aspect of this disclosure, a session processing method based on a zero-trust mechanism is provided, comprising: receiving a session request forwarded by a broadband access gateway device, wherein the session request is a session request initiated by a client through the broadband access gateway device to a target application server, and the session request includes the domain name and / or network address of the target application server; verifying whether the target application server belongs to a preset whitelist based on the domain name and / or network address included in the session request; if the target application server belongs to the preset whitelist, determining whether the number of session requests currently connected to the target application server exceeds a preset threshold; if the number of session requests currently connected to the target application server does not exceed the preset threshold, forwarding the session request to the target application server.

[0008] In some embodiments, after verifying whether the target application server belongs to a preset whitelist based on the domain name and / or network address included in the session request, the method further includes: if the target application server does not belong to the preset whitelist, sending a notification message to the broadband access gateway device, wherein the notification message is used to notify the broadband access gateway device to discard the session request.

[0009] In some embodiments, after determining whether the number of session requests currently connected to the target application server exceeds a preset threshold, the method further includes: if the number of session requests currently connected to the target application server exceeds the preset threshold, adding the session requests forwarded by the broadband access gateway device to the waiting session queue.

[0010] In some embodiments, after forwarding the session request to the target application server if the number of session requests currently connected to the target application server does not exceed a preset threshold, the method further includes: counting the number of session requests connected to the target application server; determining whether the number of session requests connected to the target application server exceeds a preset threshold; and if the number of session requests connected to the target application server exceeds the preset threshold, prohibiting the forwarding of the session request to the target application server.

[0011] In some embodiments, after forwarding the session request to the target application server if the number of session requests currently connected to the target application server does not exceed a preset threshold, the method further includes: monitoring the client's session state, wherein the session state includes at least one of the following: access state, network state, and traffic state; when any one or more of the client's access state, network state, and traffic state meet a preset termination condition, determining whether there is a pending session request in the pending session queue; if there is a pending session request in the pending session queue, forwarding the pending session request to the target application server.

[0012] In some embodiments, the access state includes a connected state and a disconnected state, the network state includes online and offline, and the preset termination condition includes the client's access state being disconnected, or no traffic being generated between the client and the target application server within a preset time period, or the client's network state being offline.

[0013] In some embodiments, before determining whether there are pending session requests in the pending session queue, the method further includes: if the client's network status is offline, sending a session end notification message to one or more application servers that have a session with the client.

[0014] According to another aspect of this disclosure, a session processing apparatus based on a zero-trust mechanism is also provided, comprising: a session request receiving module, configured to receive a session request forwarded by a broadband access gateway device, wherein the session request is a session request initiated by a client to a target application server through the broadband access gateway device, and the session request includes the domain name and / or network address of the target application server; an application server verification module, configured to verify whether the target application server belongs to a preset whitelist based on the domain name and / or network address included in the session request; a session request quantity judgment module, configured to determine whether the number of session requests currently connected to the target application server exceeds a preset threshold if the target application server is on the preset whitelist; and a session request forwarding module, configured to forward the session request to the target application server if the number of session requests currently connected to the target application server does not exceed the preset threshold.

[0015] According to another aspect of this disclosure, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the zero-trust-based session processing method described above by executing the executable instructions.

[0016] According to another aspect of this disclosure, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the session processing method based on the zero-trust mechanism described in any one of the preceding claims.

[0017] According to another aspect of this disclosure, a computer program product is also provided, including a computer program that, when executed by a processor, implements the zero-trust mechanism-based session processing method of any of the above.

[0018] This disclosure provides a session processing method based on a zero-trust mechanism. Based on the domain name and / or network address contained in the session request forwarded by the broadband access gateway device, it verifies whether the target application server belongs to a preset whitelist. If it belongs to the preset whitelist, it determines whether the number of currently accessing sessions exceeds a preset threshold. If not, it forwards the session request to the target application server. This disclosure embodiment can ensure that the application system maintains maximum load processing capacity for session access requests based on a zero-trust mechanism, thereby improving session processing efficiency.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0021] Figure 1 A schematic diagram of a session processing system architecture based on a zero-trust mechanism that can be applied to embodiments of this disclosure is shown.

[0022] Figure 2 A flowchart of a session processing method based on a zero-trust mechanism is shown in an embodiment of this disclosure;

[0023] Figure 3 A flowchart of another session processing method based on a zero-trust mechanism is shown in an embodiment of this disclosure;

[0024] Figure 4 A flowchart of another session processing method based on a zero-trust mechanism is shown in an embodiment of this disclosure;

[0025] Figure 5 A flowchart of another session processing method based on a zero-trust mechanism is shown in an embodiment of this disclosure;

[0026] Figure 6 A schematic diagram of a session processing device based on a zero-trust mechanism is shown in an embodiment of this disclosure;

[0027] Figure 7 A block diagram of an electronic device according to an embodiment of the present disclosure is shown;

[0028] Figure 8 A schematic diagram of a computer-readable storage medium according to an embodiment of the present disclosure is shown. Detailed Implementation

[0029] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0030] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0031] To facilitate understanding, before introducing the embodiments of this disclosure, the following explanations are provided for several terms involved in the embodiments of this disclosure:

[0032] BRAS: Broadband Remote Access Server (i.e., broadband access gateway device);

[0033] ID: Identity Document, identification number.

[0034] The specific implementation methods of the embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0035] Figure 1 A schematic diagram illustrates a session processing system architecture based on a zero-trust mechanism that can be applied to embodiments of this disclosure. For example... Figure 1 As shown, the system architecture may include a security client (i.e., a client with zero-trust security software installed) 101, a security gateway device (i.e., a broadband access gateway device based on the zero-trust mechanism) 102, a policy controller (i.e., a policy control server based on the zero-trust mechanism) 103, and an application (i.e., a network-side target application policy control server) 104.

[0036] The security client 101 can be various electronic devices, including but not limited to smartphones, tablets, laptops, desktop computers, wearable devices, augmented reality devices, virtual reality devices, etc.

[0037] Optionally, the clients of the applications installed in different security clients 101 may be the same, or clients of the same type of application based on different operating systems. Depending on the terminal platform, the specific form of the application client may also differ; for example, the application client may be a mobile client, a PC client, etc.

[0038] In one embodiment of this disclosure, the policy control server may include a policy control management module 1031 and a session and queuing management module 1032.

[0039] In one embodiment of this disclosure, the session and queuing management module 1032 can be used to record whether each user is attached to the network (i.e., the network status is online), the access status of each user with access rights in each application, and to count the current number of session connections for each application.

[0040] The user's network status can be seen in Table 1:

[0041] Table 1

[0042] User ID Network status IDxx01 Online status IDxx02 Offline status

[0043] The user's access permissions and access status to the application are shown in Table 2:

[0044] Table 2

[0045] User ID Access permissions Access Status IDxx01 have Connection status IDxx02 have Disconnected

[0046] In one embodiment of this disclosure, the session and queuing management module 1032 can also be used to record the pre-set maximum number of session connections for each application, and when the current number of session connections for an application reaches the pre-set maximum number of session connections, to place subsequent access requests into the waiting session queue. It should be noted that the pre-set maximum number of session connections is set by the operator according to the actual situation, and this disclosure does not specifically limit the value of the maximum number of session connections.

[0047] In one embodiment of this disclosure, the session and queuing management module 1032 can also be used to disconnect the corresponding session and notify users in the waiting session queue to initiate access when a user's access ends or the user's network goes offline. The end of a user's access can include the user actively ending the access or the broadband access gateway device detecting that no traffic has been generated for a preset duration.

[0048] In one embodiment of this disclosure, it can be implemented in a large-scale, secure, centralized business processing scenario, such as the internal private network of a large factory. Due to the large number of employees in the factory, the application server will be overloaded when many employees need to log in at the same time. Or, when students in a certain major at a university select elective courses, multiple people will log in at the same time. It can also be implemented in a scenario of sudden concentrated business access on a large application platform. For example, when a social hot news suddenly appears, a large number of users log in to the application, causing the application server to be overloaded or overloaded.

[0049] Those skilled in the art will know that Figure 1 The number of security clients, security gateways, policy control servers, and applications shown is merely illustrative; any number of security clients, security gateways, policy control servers, and applications can be used as needed. This disclosure does not limit this.

[0050] Under the above system architecture, this disclosure provides a session processing method based on a zero-trust mechanism, which can be executed by any electronic device with computing power.

[0051] In some embodiments, the zero-trust-based session processing method provided in this disclosure can be executed by a security client of the above-described system architecture; in other embodiments, the zero-trust-based session processing method provided in this disclosure can be executed by a policy control server in the above-described system architecture; in still other embodiments, the zero-trust-based session processing method provided in this disclosure can be implemented by the security client and the policy control server in the above-described system architecture through interaction.

[0052] Figure 2 This illustration shows a flowchart of a session processing method based on a zero-trust mechanism in an embodiment of this disclosure, as follows: Figure 2 As shown, the method includes the following steps:

[0053] S202, Receive a session request forwarded by the broadband access gateway device, wherein the session request is a session request initiated by the client to the target application server through the broadband access gateway device, and the session request contains the domain name and / or network address of the target application server.

[0054] In one embodiment of this disclosure, the broadband access gateway device can be used to forward requests or notifications received from a client or a target application server to enable interaction between the client and the target application server; a session request can refer to a session request initiated by the client that contains the domain name and / or network address of the target application server.

[0055] S204, based on the domain name and / or network address contained in the session request, verify whether the target application server belongs to the preset whitelist.

[0056] It should be noted that the preset whitelist may refer to the whitelist set in advance by the operator or user. The contents of the whitelist can be set according to the actual situation. This embodiment of the disclosure does not specifically limit the contents of the whitelist.

[0057] S206, if the target application server is on a preset whitelist, determine whether the number of session requests currently connected to the target application server exceeds a preset threshold.

[0058] It should be noted that the preset threshold can refer to the maximum number of access session requests that the target application server can connect to, which is usually set in the thousands by the operator or user. For example, the maximum number of access sessions can usually be set to 5,000. It should be noted that the embodiments of this disclosure do not specifically limit the value of the preset threshold.

[0059] S208. If the number of session requests currently connected to the target application server does not exceed the preset threshold, the session requests will be forwarded to the target application server.

[0060] As described above, this embodiment of the present disclosure verifies whether the target application server belongs to a preset whitelist based on the domain name and / or network address contained in the session request forwarded by the broadband access gateway device. If it belongs to the preset whitelist, it determines whether the number of currently accessing sessions exceeds a preset threshold. If it does not exceed the threshold, the session request is forwarded to the target application server. This embodiment of the present disclosure can ensure that the application system maintains maximum load processing of session access requests based on a zero-trust mechanism, thereby improving session processing efficiency.

[0061] In one embodiment of this disclosure, after determining that the target application server belongs to the application server in the preset whitelist, it can also be determined whether the user has permission to access the target application server. It should be noted that the user's access permissions are preset by the operator or the user, and this embodiment of the disclosure does not specifically limit the user's access permissions.

[0062] In one embodiment of this disclosure, after S204 above, the method further includes: sending a notification message to a broadband access gateway device when the target application server is not in a preset whitelist, wherein the notification message is used to notify the broadband access gateway device to discard the session request.

[0063] In one embodiment of this disclosure, after S206 above, the method further includes: if the number of session requests currently accessed by the target application server exceeds a preset threshold, then adding the session requests forwarded by the broadband access gateway device to the waiting session queue.

[0064] In one embodiment of this disclosure, after S208 above, the method further includes: counting the number of session requests accessed by the target application server; determining whether the number of session requests accessed by the target application server exceeds a preset threshold; if the number of session requests accessed by the target application server exceeds the preset threshold, then prohibiting the forwarding of session requests to the target application server.

[0065] In one embodiment of this disclosure, if the number of session connections of the target application server has reached its corresponding maximum number of session connections, the client initiating a new session will receive a waiting notification sent by the target application server forwarded by the broadband access gateway device, enter the waiting session queue, and become a queued state.

[0066] In one embodiment of this disclosure, after S208 above, the method further includes: monitoring the session state of the client, wherein the session state includes at least one of the following: access state, network state, and traffic state; when any one or more of the client's access state, network state, and traffic state meet a preset termination condition, determining whether there is a pending session request in the pending session queue; if there is a pending session request in the pending session queue, forwarding the pending session request to the target application server.

[0067] In one embodiment of this disclosure, the access state includes a connected state and a disconnected state, the network state includes online and offline, and the preset termination condition includes the client's access state being disconnected, or no traffic being generated between the client and the target application server within a preset time period, or the client's network state being offline.

[0068] In one embodiment of this disclosure, the broadband access gateway device periodically monitors session traffic generated during session connections. If no traffic is generated during a session after a preset time, the session will be forcibly disconnected, and a report will be submitted to the zero-trust policy control server. The preset time is a pre-set duration, typically in minutes. For example, the preset time can usually be set to five minutes. It should be noted that the preset time can be set based on experience or the data transmission and reception characteristics of each application. This embodiment of the disclosure does not specifically limit the value of the preset time, provided that it does not affect the normal use of the application.

[0069] In one embodiment of this disclosure, before determining whether there is a pending session request in the pending session queue, the method further includes: if the client's network status is offline, sending a session end notification message to one or more application servers that are having a session with the client.

[0070] In one embodiment of this disclosure, if a session is detected to have ended, it is determined whether there is a user's session request in the waiting queue. If there is, the session request with the longest waiting time is forwarded to the target application server through the broadband access gateway device. If there is no session request, the number of session connections of the target application server counted by the zero trust policy control server is updated.

[0071] In one embodiment of this disclosure, the zero-trust policy control server can be used to record the state of session connections established for sessions of different application servers, and can also be used to set the maximum number of session connections and queuing mechanisms.

[0072] In one embodiment of this disclosure, there is no need to expand the application system to meet sudden business processing. Only a session and queuing control management module needs to be added to the existing broadband access gateway device to manage and control the total number of access connection sessions for each application system, as well as the addition and termination of such sessions. When the maximum number of session connections is reached, subsequent newly initiated sessions are added to the waiting session queue. This allows the system to continuously maintain a normal state and process ongoing session access at maximum processing capacity at all times. At the same time, if there is a large amount of access at the same time, exceeding the maximum number of session connections that the server can handle, it can also ensure that the system continues to provide services at maximum processing capacity, achieving peak shaving and valley filling effects, and improving the efficiency and stability of session processing.

[0073] Figure 3 This illustration shows a flowchart of another session processing method based on a zero-trust mechanism in an embodiment of this disclosure, such as... Figure 3 As shown, the method includes the following steps:

[0074] S301 receives domain name requests from the client's Domain Name System or broadband access gateway devices.

[0075] S302, determine whether the target application server is an application server in the client's preset whitelist. If the target application server is an application server in the client's preset whitelist, proceed to S303; if the target application server is not an application server in the client's preset whitelist, proceed to S305.

[0076] S303, determine whether the client user has permission to access the target application server. If the client user has permission to access the target application server, proceed to S304; if the client user does not have permission to access the target application server, proceed to S305.

[0077] S304, determine whether the current number of session connections on the target application server has reached a preset threshold (i.e., the preset maximum number of session connections). If the current number of session connections on the target application server has reached the preset threshold, then execute S306; if the current number of session connections on the target application server has not reached the preset threshold, then execute S307.

[0078] S305, notifying the broadband access gateway device to refuse client access.

[0079] S306, notifies the client to enter the waiting session queue.

[0080] S307 notifies the client to allow it to access the target application server.

[0081] In one embodiment of this disclosure, when a client successfully attaches to a zero-trust secure network (i.e., the user's network status is online), whenever the client initiates an access request to the corresponding application server and confirms a successful connection through the broadband access gateway device, the zero-trust policy control server increments the current application server's session connection count by 1; whenever the application access ends or the client is no longer attached (i.e., the client's network status is offline), the zero-trust policy control server decrements the current application server's session connection count by 1.

[0082] When the number of session connections of the application server reaches the set maximum number of session connections (i.e., the preset threshold), a waiting notification is sent to the client that initiated the latest session, and the session request initiated by it is added to the waiting session queue.

[0083] For example, if the maximum number of session connections preset by the current application server is 5000, and if 4999 sessions are already connected on the application server, the zero-trust policy control server will allow the broadband access gateway device to forward another session request from the client to the application server; if 5000 sessions are already in progress on the application server, the zero-trust policy control server will add the session request forwarded by the broadband access gateway device to the waiting session queue.

[0084] Figure 4 This illustration shows a flowchart of another session processing method based on a zero-trust mechanism in an embodiment of this disclosure, such as... Figure 4 As shown, the method includes the following steps:

[0085] S401, Received a message indicating that a session has ended on the broadband access gateway device / client / zero trust policy control server.

[0086] S402, instruct the broadband access gateway device to clear the forwarding entries for the corresponding session.

[0087] In one embodiment of this disclosure, the forwarding item of a session is the IP 5-tuple information of an application and the corresponding action. The IP 5-tuple includes data such as destination IP address, source IP address, destination port, source port and packet protocol type, for example, destination IP address 200.10.16.8, source IP address 230.100.100.100, destination port (0080), source port (136780), etc.; the corresponding action can be forwarding, blocking and dropping, etc.

[0088] S403, Determine if the waiting session queue is empty. If the waiting session queue is empty, execute S405; if the waiting session queue is not empty, execute S404.

[0089] S404 Notifies the client user at the head of the waiting session queue that they can initiate access.

[0090] S405, the number of session connections for the corresponding application server is reduced by 1.

[0091] In one embodiment of this disclosure, the methods for ending a session may include the following three: ① The client user actively ends the session (i.e., the client's access status is disconnected); ② The broadband access gateway device monitors that no traffic is generated in a session within a certain duration (i.e., a preset threshold); ③ The client user goes offline (i.e., the client's network status is offline).

[0092] In one embodiment of this disclosure, a preset duration for no traffic generation in a session can be set based on experience or the data transmission and reception characteristics of each application to ensure that normal application use is not affected. Within the preset duration, if the client network is accidentally disconnected, causing the network status to become offline, a retransmission can re-establish the session connection, and the session will still be considered connected.

[0093] For example, if a preset threshold for the duration of no traffic is set to five minutes, and the client reattaches to the network within five minutes, the session connection can be re-established, and the broadband access gateway device can re-monitor the traffic generated by the session; if the broadband access gateway device still cannot monitor the traffic generated by the session after five minutes, the session is forcibly terminated.

[0094] In one embodiment of this disclosure, the order in the waiting session queue is sorted according to the waiting time after the client user joins the waiting session queue. The longer the user waits, the closer the user is to the front of the queue; the shorter the user waits, the closer the user is to the back of the queue.

[0095] Figure 5 This illustration shows a flowchart of another session processing method based on a zero-trust mechanism in an embodiment of this disclosure, such as... Figure 5 As shown, the method includes the following steps:

[0096] S501, received a message from the broadband access gateway device indicating that the client user's network status is offline.

[0097] S502, check all application servers corresponding to the user's accesses, and send session termination notifications one by one.

[0098] In one embodiment of this disclosure, a client user can correspond to one or more sessions. However, when the client's network status becomes offline, all sessions corresponding to that client will end by default. At this time, the application servers corresponding to all sessions of that user will be checked, and a session termination notification will be sent to each application server.

[0099] Based on the same inventive concept, this disclosure also provides a session processing device based on a zero-trust mechanism, as described in the following embodiments. Since the principle by which this device embodiment solves the problem is similar to that of the above-described method embodiments, the implementation of this device embodiment can refer to the implementation of the above-described method embodiments, and repeated details will not be elaborated further.

[0100] Figure 6 This illustration shows a schematic diagram of a session processing apparatus based on a zero-trust mechanism according to an embodiment of the present disclosure, such as... Figure 6 As shown, the device 60 includes: a session request receiving module 601, an application server verification module 602, a session request quantity judgment module 603, and a session request forwarding module 604.

[0101] The system includes a session request receiving module 601, which receives session requests forwarded by a broadband access gateway device. Each session request is initiated by a client through the broadband access gateway device to a target application server, and includes the domain name and / or network address of the target application server. An application server verification module 602 verifies whether the target application server belongs to a preset whitelist based on the domain name and / or network address included in the session request. A session request quantity judgment module 603 determines whether the number of session requests currently connected to the target application server exceeds a preset threshold if the target application server is on the preset whitelist. A session request forwarding module 604 forwards the session requests to the target application server if the number of session requests currently connected to the target application server does not exceed the preset threshold.

[0102] As described above, this embodiment of the present disclosure verifies whether the target application server belongs to a preset whitelist based on the domain name and / or network address contained in the session request forwarded by the broadband access gateway device. If it belongs to the preset whitelist, it determines whether the number of currently accessing sessions exceeds a preset threshold. If it does not exceed the threshold, the session request is forwarded to the target application server. This embodiment of the present disclosure can ensure that the application system maintains maximum load processing of session access requests based on a zero-trust mechanism, thereby improving session processing efficiency.

[0103] In one embodiment of this disclosure, the session request quantity determination module 603 is further configured to determine whether the user has permission to access the target application server after determining that the target application server belongs to the application server in the preset whitelist. It should be noted that the user's access permissions are preset by the operator or the user, and this embodiment of the disclosure does not specifically limit the user's access permissions.

[0104] In one embodiment of this disclosure, the session request quantity determination module 603 is further configured to send a notification message to the broadband access gateway device when the target application server is not in the preset whitelist, wherein the notification message is used to notify the broadband access gateway device to discard the session request.

[0105] In one embodiment of this disclosure, the session request forwarding module 604 is further configured to add the session requests forwarded by the broadband access gateway device to the waiting session queue if the number of session requests currently accessed by the target application server exceeds a preset threshold.

[0106] In one embodiment of this disclosure, the session request forwarding module 604 is further configured to count the number of session requests accessed by the target application server; determine whether the number of session requests accessed by the target application server exceeds a preset threshold; and if the number of session requests accessed by the target application server exceeds the preset threshold, prohibit the forwarding of session requests to the target application server.

[0107] In one embodiment of this disclosure, the session request forwarding module 604 is further configured to monitor the session status of the client, wherein the session status includes at least one of the following: access status, network status, and traffic status; when any one or more of the client's access status, network status, and traffic status meet a preset termination condition, it is determined whether there is a pending session request in the pending session queue; if there is a pending session request in the pending session queue, the pending session request is forwarded to the target application server.

[0108] In one embodiment of this disclosure, the access state includes a connected state and a disconnected state, the network state includes online and offline, and the preset termination condition includes the client's access state being disconnected, or no traffic being generated between the client and the target application server within a preset time period, or the client's network state being offline.

[0109] In one embodiment of this disclosure, the session request forwarding module 604 is further configured to send a session end notification message to one or more application servers that are having a session with the client if the client's network status is offline.

[0110] In one embodiment of this disclosure, if a session is detected to have ended, it is determined whether there is a user's session request in the waiting queue. If there is, the session request with the longest waiting time is forwarded to the target application server through the broadband access gateway device. If there is no session request, the number of session connections of the target application server counted by the zero trust policy control server is updated.

[0111] In one embodiment of this disclosure, there is no need to expand the application system to meet sudden business processing. Only a session and queuing control management module needs to be added to the existing broadband access gateway device to manage and control the total number of access connection sessions for each application system, as well as the addition and termination of such sessions. When the maximum number of session connections is reached, subsequent newly initiated sessions are added to the waiting session queue. This allows the system to continuously maintain a normal state and process ongoing session access at its maximum processing capacity at all times. At the same time, if there is a large amount of access at the same time, exceeding the server's capacity, the system can continue to provide services at its maximum processing capacity, achieving peak shaving and valley filling effects, and improving the efficiency and stability of session processing.

[0112] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0113] The following reference Figure 7 To describe an electronic device 700 according to such an embodiment of the present disclosure. Figure 7 The electronic device 700 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0114] Figure 7 A block diagram of an electronic device according to an embodiment of the present disclosure is shown. Referring below... Figure 7 To describe an electronic device 700 according to such an embodiment of the present disclosure. Figure 7The electronic device 700 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0115] like Figure 7 As shown, the electronic device 700 is manifested in the form of a general-purpose computing device. The components of the electronic device 700 may include, but are not limited to: at least one processing unit 710, at least one storage unit 720, and a bus 730 connecting different system components (including storage unit 720 and processing unit 710).

[0116] The storage unit stores program code that can be executed by the processing unit 710, causing the processing unit 710 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processing unit 710 can perform the following steps of the above method embodiment: receiving a session request forwarded by a broadband access gateway device, wherein the session request is a session request initiated by a client through the broadband access gateway device to a target application server, and the session request contains the domain name and / or network address of the target application server; verifying whether the target application server belongs to a preset whitelist based on the domain name and / or network address contained in the session request; if the target application server belongs to the preset whitelist, determining whether the number of session requests currently connected to the target application server exceeds a preset threshold; if the number of session requests currently connected to the target application server does not exceed the preset threshold, then forwarding the session request to the target application server.

[0117] Storage unit 720 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 7201 and / or cache memory 7202, and may further include a read-only memory (ROM) 7203.

[0118] The storage unit 720 may also include a program / utility 7204 having a set (at least one) program module 7205, such program module 7205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0119] Bus 730 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0120] Electronic device 700 can also communicate with one or more external devices 740 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 700, and / or with any device that enables electronic device 700 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 750. Furthermore, electronic device 700 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 760. As shown, network adapter 760 communicates with other modules of electronic device 700 via bus 730. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0121] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0122] In particular, according to embodiments of this disclosure, the process described above with reference to the flowchart can be implemented as a computer program product, which includes a computer program that, when executed by a processor, implements the above-described session processing method based on a zero-trust mechanism.

[0123] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. Figure 8 This illustration shows a schematic diagram of a computer-readable storage medium according to an embodiment of the present disclosure, such as... Figure 8 As shown, the computer-readable storage medium stores a program product 800 capable of implementing the methods described above. In some possible embodiments, various aspects of this disclosure may also be implemented as a program product comprising program code that, when run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0124] More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0125] In this disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device.

[0126] Optionally, the program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0127] In practical implementation, program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0128] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0129] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0130] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0131] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A session processing method based on a zero-trust mechanism, characterized in that, include: Receive a session request forwarded by a broadband access gateway device, wherein the session request is a session request initiated by the client to the target application server through the broadband access gateway device, and the session request contains the domain name and / or network address of the target application server; Based on the domain name and / or network address contained in the session request, verify whether the target application server belongs to the preset whitelist; If the target application server is in a preset whitelist, determine whether the number of session requests currently connected to the target application server exceeds a preset threshold. If the number of session requests currently connected to the target application server does not exceed a preset threshold, the session request will be forwarded to the target application server. After determining whether the number of session requests currently connected to the target application server exceeds a preset threshold, the method further includes: If the number of session requests currently connected to the target application server exceeds a preset threshold, the session requests forwarded by the broadband access gateway device will be added to the waiting session queue.

2. The session processing method based on a zero-trust mechanism according to claim 1, characterized in that, After verifying whether the target application server belongs to a preset whitelist based on the domain name and / or network address contained in the session request, the method further includes: If the target application server is not in the preset whitelist, a notification message is sent to the broadband access gateway device, wherein the notification message is used to notify the broadband access gateway device to discard the session request.

3. The session processing method based on a zero-trust mechanism according to claim 1, characterized in that, If the number of session requests currently connected to the target application server does not exceed a preset threshold, and the session requests are forwarded to the target application server, the method further includes: Count the number of session requests received by the target application server; Determine whether the number of session requests connected to the target application server exceeds a preset threshold; If the number of session requests connected to the target application server exceeds a preset threshold, then forwarding the session requests to the target application server is prohibited.

4. The session processing method based on a zero-trust mechanism according to claim 1, characterized in that, If the number of session requests currently connected to the target application server does not exceed a preset threshold, and the session requests are forwarded to the target application server, the method further includes: Monitor the client's session state, wherein the session state includes at least one of the following: access state, network state, and traffic state; When any one or more of the client's access status, network status, and traffic status meet the preset termination condition, it is determined whether there are any pending session requests in the pending session queue. If there are pending session requests in the pending session queue, the pending session requests are forwarded to the target application server.

5. The session processing method based on a zero-trust mechanism according to claim 4, characterized in that, The access status includes a connected status and a disconnected status, the network status includes online and offline, and the preset termination condition includes the client's access status being disconnected, or the client and the target application server not generating traffic within a preset time period, or the client's network status being offline.

6. The session processing method based on a zero-trust mechanism according to claim 5, characterized in that, Before determining whether there are pending session requests in the pending session queue, the method further includes: If the client's network status is offline, a session end notification message is sent to one or more application servers that are having a session with the client.

7. A session processing device based on a zero-trust mechanism, characterized in that, include: A session request receiving module is used to receive session requests forwarded by a broadband access gateway device, wherein the session request is a session request initiated by a client to a target application server through the broadband access gateway device, and the session request contains the domain name and / or network address of the target application server. The application server verification module is used to verify whether the target application server belongs to a preset whitelist based on the domain name and / or network address contained in the session request. The session request count determination module is used to determine whether the number of session requests currently connected to the target application server exceeds a preset threshold, provided that the target application server is on a preset whitelist. The session request forwarding module is used to forward the session request to the target application server if the number of session requests currently connected to the target application server does not exceed a preset threshold. The session request forwarding module is also used to add the session requests forwarded by the broadband access gateway device to the waiting session queue if the number of session requests currently connected to the target application server exceeds a preset threshold.

8. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the session processing method based on a zero-trust mechanism as described in any one of claims 1 to 6 by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the session processing method based on the zero-trust mechanism as described in any one of claims 1 to 6.

Images