A method and system for implementing software-defined boundaries

Abstract

The present invention discloses a method and system for implementing software-defined boundaries. The method comprises the following steps: registering the pre-generated network information of a protected service to an SDP system, generating SPA service authentication information; the SDP client obtains the SPA service authentication information, generates an access message, and sends the access message to the protected service through a switch; the SDP system obtains the mirror data of the switch traffic, the mirror data includes the access message; the SDP system matches the access message according to the SPA service authentication information, authorizes the SDP client and releases the access message when the match is successful. The present invention adopts a bypass deployment of the SDP system to mirror the access switch traffic, monitors and blocks the mirror data of the switch traffic, realizes the SDP function when internal users access internal services, and effectively resists internal attacks.

Description

Technical Field

[0001] The present invention relates to a method for realizing a software-defined boundary, and also relates to an access control system adopting the method, belonging to the technical field of network security. Background Art

[0002] Software Defined Perimeter (SDP) is an innovative network security solution proposed by the Cloud Security Alliance (CSA). It controls user access to resources based on user identity and replaces security protection with security stealth. Its core technical idea is to hide core network assets and facilities through the SDP architecture so that they are not directly exposed to the Internet, thus protecting network assets and facilities from external security threats.

[0003] In the traditional SDP architecture, due to the large scope of protected services (or applications), the gateway mode is generally adopted to create a logical access boundary based on identity and context around a certain service or a group of services. Before accessing, each client must pass the Single Packet Authorization (SPA) before being allowed to access the service (or application) protected by SDP.

[0004] However, the traditional SDP architecture still has the following disadvantages:

[0005] (1) The SDP gateway is connected in series in the network and deployed at a single point. As the unified traffic entrance for protected services, the SDP gateway forwards all network traffic, which puts a lot of pressure on network performance. Once it goes down, the services it protects will be inaccessible.

[0006] (2) The SDP controller is the SPA control center. Both the client and the protected service need to connect to the SDP controller through the network. Therefore, the SDP controller needs to be connected to the network, that is, it is exposed to the Internet and is vulnerable to hacker attacks. Once the SDP controller is attacked, the network will be paralyzed; if the SDP controller is hijacked, the SDP controller can authorize any user, threatening the security of the services that the SDP needs to protect; if the SDP controller is maliciously shut down, the protected services will be unable to be accessed normally.

[0007] (3) The SDP gateway can defend against external network attacks, but cannot effectively defend against illegal access or attacks from the intranet.

[0008] Therefore, a technical solution is needed that can hide the services that need to be protected so that attackers cannot see the targets in cyberspace and cannot attack them. The solution also uses agents or devices to verify the identity, context, and policy compliance of designated visitors to protect service resources and significantly reduce the attack surface. Summary of the invention

[0009] The primary technical problem to be solved by the present invention is to provide a method for implementing software-defined boundaries, by which the authorized user can access the predetermined service incognito.

[0010] Another technical problem to be solved by the present invention is to provide an access control system using the method.

[0011] In order to achieve the above object, the present invention adopts the following technical solutions:

[0012] According to a first aspect of an embodiment of the present invention, a method for implementing a software-defined boundary is provided, comprising the following steps:

[0013] Register the pre-generated network information of the protected service to the SDP system to generate SPA service authentication information;

[0014] The SDP client obtains SPA service authentication information, generates an access message, and sends the access message to the protected service through the switch;

[0015] The SDP system obtains mirror data of the switch traffic, wherein the mirror data includes the access message;

[0016] The SDP system matches the access message according to the SPA service authentication information, and when the match succeeds, authorizes the SDP client and releases the access message.

[0017] Preferably, the pre-generated network information of the protected service includes: the IP address of the protected service, the service port, the SPA authentication port, the verification code, the validity period of a single authentication, and the public-private key pair.

[0018] Preferably, the SDP client obtains the SPA service authentication information and generates an access message, further comprising the following sub-steps:

[0019] The SDP client obtains the SPA authentication port, the verification code, and the public key file offline, constructs an authentication token based on the public key file and the verification code, and generates a single-package authentication message including the authentication token.

[0020] Preferably, authorizing the SDP client includes the following sub-steps:

[0021] Bind the IP address of the SDP client to the IP address of the protected service and the service port.

[0022] Preferably, the encrypted content of the authentication token includes: a timestamp and a verification code of the access message initiated by the client.

[0023] Preferably, before the step of matching the access message according to the SPA service authentication information, the SDP system further includes the following sub-steps:

[0024] The SDP system uses a private key to decrypt the authentication token and verify the verification code. When the authentication token is legal, the SDP system generates a white list according to the information of the SDP client and the information of the protected service.

[0025] Preferably, when the access duration of the SDP client exceeds the valid duration of the single authentication, the whitelist becomes invalid, and the SDP system blocks the IP address access of the SDP client.

[0026] Preferably, the SDP system matches the access message according to the SPA service authentication information, and blocks the IP address access of the SDP client when the match is unsuccessful, and discards the access message.

[0027] Preferably, the SDP system obtains the mirror data of the switch traffic in a bypass deployment manner, and only monitors and blocks the mirror data without forwarding the data.

[0028] According to a second aspect of an embodiment of the present invention, an access control system is provided, comprising an SDP system, an SDP client, and a switch; wherein the SDP system and the SDP client are respectively connected to the switch, and through the switch, the pre-generated protected services are accessed using the above-mentioned software-defined boundary implementation method.

[0029] Compared with the prior art, the present invention adopts the method of deploying the SDP system in a bypass manner to mirror the access switch traffic, and only monitors and blocks the mirrored data without forwarding the data, so as to avoid the problem that once the SDP system fails, the services protected by the SDP system are inaccessible. In addition, the SDP system in the present invention does not need to be exposed to the Internet, so as to avoid the risk of authorizing any user to access the intranet data after the SDP system is controlled by an attack. On the other hand, the present invention can also realize the SDP function when internal users access internal services by mirroring the intranet traffic, so as to effectively resist internal attacks. By using the present invention, there is no need to change the user's network structure, nor to transform the software architecture of the protected service, so as to achieve transparent deployment. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 The overall flow chart of the method for implementing software-defined boundaries provided by the present invention;

[0031] Figure 2 A schematic diagram of the architecture of the access control system provided by the present invention;

[0032] Figure 3 This is a flowchart of a method for implementing software-defined boundaries in Embodiment 1 of the present invention;

[0033] Figure 4 This is a flowchart of a method for implementing a software-defined boundary in Embodiment 2 of the present invention;

[0034] Figure 5 This is a flowchart of a method for implementing software-defined boundaries in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0035] The technical content of the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0036] like Figure 1 As shown, the method for implementing software-defined boundaries provided by the present invention at least includes the following steps:

[0037] Register the pre-generated network information of the protected service to the SDP system to generate SPA service authentication information;

[0038] The SDP client obtains SPA service authentication information, generates an access message, and sends the access message to the protected service through the switch;

[0039] The SDP system obtains mirror data of the switch traffic, wherein the mirror data includes the access message;

[0040] The SDP system matches the access message according to the SPA service authentication information, and when the match succeeds, authorizes the SDP client and releases the access message.

[0041] At the same time, the present invention also provides an access control system for implementing the above method. Figure 2 As shown, the access control system includes an SDP system, an SDP client, and a switch; wherein the SDP system and the SDP client are respectively connected to the switch, and through the switch, the pre-generated protected service is accessed using the above-mentioned software-defined boundary implementation method.

[0042] In one embodiment of the present invention, the SDP system is an integrated hardware (which can be implemented based on an existing SDP authentication server), and can be connected to the network in parallel in a bypass deployment mode, mirroring the access switch traffic. The SDP client is implemented in software and can run on the user's computer, mobile phone, Pad and other terminal devices. The user can obtain information such as the service IP address, service port, public key, service binding verification code, SPA authentication port, etc. from the SDP system in an offline manner (such as USB flash drive copy) or an online manner (such as email, social software, network disk, etc.). The SDP client can be used only after obtaining the above information. The SDP client needs to be obfuscated by source code, encapsulated, etc., in order to effectively resist reverse analysis, avoid source code leakage, and protect the security of the client authentication process. In the SDP client, a token algorithm (specifically described in the first embodiment) can be built in. After calculating and generating the authentication token, the authentication token is assembled into a single-packet authentication message (using the UDP message format), and a UDP message is sent to the service IP address and SPA authentication port of the protected service.

[0043] The following is a detailed and specific description of the implementation method and system of the software-defined boundary through different embodiments.

[0044] <First Embodiment>

[0045] like Figure 3 As shown, the first embodiment of the present invention discloses a method for implementing a software-defined boundary, which at least includes the following steps:

[0046] S11, registering the pre-generated network information of the protected service into the SDP system, and generating SPA service authentication information.

[0047] Among them, the network information of the protected service may include the IP address of the protected service, service port, SPA authentication port, verification code, single authentication validity period, public and private key pairs, and this information is used for single-package authentication.

[0048] The process of generating registration information of protected services in the SDP system is as follows:

[0049] (1) Create a new protected service in the SDP system. The SDP system generates registration information for each protected service, which may include but is not limited to: service name, service IP address, service port, SPA authentication port, service binding verification code, single authentication validity period, public and private key pairs, and other information.

[0050] (2) Generate a pair of dedicated public and private key pairs for the protected service: the public key is stored by the SDP client and used to generate authentication tokens; the private key is stored by the SDP system and used to decrypt the authentication token received from the client to obtain plaintext authentication information.

[0051] After the protected service information is registered with the SDP system, the SDP system begins to monitor all UDP packets on the network that are sent to the IP address and SPA authentication port of the protected service.

[0052] S12, the SDP system generates a default blacklist for the protected services, prohibiting all unauthorized access.

[0053] S13, the SDP client obtains the SPA service authentication information and generates an access message. The SDP client sends the access message to the protected service through the switch.

[0054] In the embodiment of the present invention, the SDP client initiates the single-packet authentication, obtains the public key file, the SPA authentication port, and the verification code offline, generates an authentication token, encrypts the authentication token using the public key file, and sends a single-packet authentication message.

[0055] The encrypted content of the authentication token includes: timestamp (local system timestamp when the SDP client initiates a single packet authentication request) and verification code. The authentication token encryption algorithm uses RSA or SM2 algorithm for asymmetric encryption, and the token calculation formula is Token = PublicKeyEncrypt (timestamp - verification code).

[0056] For SDP client access traffic that has not passed single-packet authentication, when the SDP system detects that the SDP client is trying to establish a connection with the protected service for a TCP three-way handshake, it will send reset packets to the SDP client and the protected service respectively, blocking the network connection, thereby preventing the SDP client from accessing the protected service.

[0057] S14, the SDP system collects a single-packet authentication message from the SDP client according to the SPA authorization authentication information.

[0058] In an embodiment of the present invention, the SDP system obtains the mirror data of the switch traffic, and the mirror data includes the access message, which is used for the SDP system to perform parsing and authentication. The SDP system adopts a bypass deployment method to obtain the mirror data of the switch traffic, and only monitors and blocks the mirror data without forwarding data. Therefore, the invisible monitoring of the SDP system is realized. When the SDP system fails, it will not affect the data interaction on the network.

[0059] The technical solution of the above embodiment can, on the one hand, prevent the SDP system from failing and affecting the authorized SDP client's access to protected services. On the other hand, since the SDP system is deployed in a bypass manner and mirrors the access switch traffic, it is invisible on the network, which can prevent the SDP system from being attacked or hijacked.

[0060] Next, the SDP system collects access messages from the client from the mirror data and performs parsing and authentication.

[0061] S15, the SDP system analyzes and determines the legitimacy of the authentication token. When the authentication token is determined to be legitimate, the SDP system generates a whitelist based on the client information and the target service information.

[0062] S16, the SDP system matches the access message according to the SPA service authentication information, authorizes the SDP client when the match is successful, and forwards the access message to the target service specified by the target service information.

[0063] Through the above steps, after confirming the legal identity of the requester, the SDP system authorizes the legal SDP client to access the services protected by the SDP system. During the subsequent monitoring of the mirrored data, if the SDP system finds that the authorized legal client accesses the protected service, it will directly release it.

[0064] In an embodiment of the present invention, authorizing the SDP client includes: binding the IP address of the SDP client with the IP address of the protected service and the service port. Specifically, it includes the following sub-steps:

[0065] (1) The SDP client constructs and sends a UDP message to the IP address and port of the protected service.

[0066] (2) The SDP system monitors UDP packets in the network traffic, filters the UDP packets matched according to the service IP address and the corresponding SPA authentication port in the configuration list, obtains the authentication token in the UDP packet, and confirms the public and private key pair used.

[0067] (3) The SDP system uses the private key to decrypt the authentication token and obtains the plaintext data after successful decryption.

[0068] (4) The SDP system takes out the timestamp in the authentication token and calculates the difference with the current timestamp of the system. If it is less than a predetermined time (e.g., 10 minutes), the authentication token is considered valid, and the verification code is further verified.

[0069] (5) The SDP system compares the locally stored verification code of the protected service with the verification code in the client's authentication token. If they are the same, the verification is considered successful, and the service IP address and port that match the verification code are searched and bound to the source IP address and added to the whitelist.

[0070] In an embodiment of the present invention, the SDP client sends a UDP message carrying a token to the server IP and the SPA authentication port. After the SDP system passes the single-packet authentication, it generates a whitelist for the client IP, server IP, and service port, and performs pair-wise whitelisting. After successful authentication, the SDP client can access the protected service normally. The SDP system continuously monitors traffic, and during the monitoring process, it will pass the SDP client's request to the protected server, so that data can interact normally. After the access time expires, the pair-wise whitelist of the SDP client and the protected server becomes invalid, and the SDP system will block the SDP client's access, and the SDP client needs to re-perform single-packet authentication.

[0071] Before the above step S16, that is, before the step in which the SDP system matches the access message according to the SPA service authentication information, the following steps may also be included:

[0072] The SDP system uses a private key to decrypt the authentication token and verify the verification code. When the authentication token is legal, the SDP system generates a whitelist according to the information of the SDP client and the information of the protected service;

[0073] The SDP system matches the received access message according to the source IP address, destination IP address and destination port. If the match is successful in the whitelist, the access message is forwarded to the target service specified by the target service information.

[0074] <Second Embodiment>

[0075] like Figure 4 As shown, the second embodiment of the present invention discloses a method for implementing a software-defined boundary, which at least includes the following steps:

[0076] S21, registering the pre-generated network information of the protected service into the SDP system, and generating SPA service authentication information.

[0077] In the embodiment of the present invention, the network information of the protected service includes: service IP address, service port, SPA authentication port. Correspondingly, the SPA service authentication information includes: public-private key pair, verification code and other information used for single packet authentication.

[0078] S22, the SDP client obtains the SPA service authentication information and generates an access message; the SDP client sends the access message to the protected service through the switch. The SDP client obtains the public key file, SPA authentication port, and verification code offline, generates an authentication token, encrypts the authentication token with the public key, and sends a single-packet authentication message (using UDP message format). The encrypted content of the authentication token includes: the timestamp and verification code of the SDP client initiating the access message.

[0079] S23, SDP collects the single-packet authentication message from the SDP client, parses and determines the legitimacy of the authentication token.

[0080] In an embodiment of the present invention, the SDP system obtains mirror data of switch traffic, wherein the mirror data includes access messages. The SDP system collects access messages from the SDP client from the mirror data according to SPA authorization authentication information, and performs parsing authentication.

[0081] S24, when the authentication token is determined to be legitimate, the SDP system generates a whitelist based on the information of the SDP client and the information of the protected service. The whitelist includes: client IP, server IP, and server port.

[0082] S25, the SDP system continuously monitors network traffic, passes traffic that meets the whitelist, and blocks network traffic that does not match the whitelist.

[0083] In an embodiment of the present invention, the SDP system matches the single-packet authentication message according to the SPA service authentication information, authorizes the SDP client when the match is successful, and releases the access message; when the match is unsuccessful, the IP address access of the SDP client is blocked and the single-packet authentication message is discarded.

[0084] Specifically, the SDP system determines whether to allow access messages by monitoring whether the access messages in the network traffic match the whitelist. When the access time of the SDP client exceeds the valid time of a single authentication, the whitelist becomes invalid and is deleted, and the SDP system blocks the IP address access of the SDP client. After that, the SDP client needs to regenerate the access message and re-perform single packet authentication before it can continue to access the protected service.

[0085] In an embodiment of the present invention, authorizing the SDP client includes: binding the IP address of the SDP client with the IP address of the protected service and the service port.

[0086] It should be noted that, before the step of the SDP system matching the access message according to the SPA service authentication information, the following steps may also be included:

[0087] The SDP system uses the private key to decrypt the authentication token and verify the verification code. When the authentication token is legal, the SDP system generates a whitelist based on the information of the SDP client and the information of the protected service.

[0088] <Third Embodiment>

[0089] like Figure 5As shown, the third embodiment of the present invention discloses a method for implementing a software-defined boundary. In this embodiment, the SDP system performs single-packet authentication and access control. The implementation method includes at least the following steps:

[0090] S31, registering the pre-generated network information of the protected service to the SDP system to generate SPA service authentication information;

[0091] In the embodiment of the present invention, the network information of the protected service includes: service IP address, service port, SPA authentication port. Correspondingly, the SPA service authentication information includes: public-private key pair, verification code and other information used for single packet authentication.

[0092] S32, the SDP system continuously monitors network traffic and determines access rights based on the access control list: if the network traffic matches the access permission rule, the SDP system will allow access; if the network traffic matches the access prohibition rule, the SDP system directly blocks access; if it does not match the access control list, the subsequent steps are executed: when the SDP system detects a UDP message, it detects whether the destination port of the UDP message matches the SPA authentication port: if it matches, execute S33;

[0093] S33, the SDP system obtains the mirror data of the switch traffic, wherein the mirror data includes the access message. The SDP system collects the access message from the SDP client according to the SPA authorization authentication information.

[0094] The SDP system matches the corresponding private key according to the destination address and authentication port in the UDP message, and uses the private key to decrypt the data part in the UDP message: If the decryption is successful, the plaintext authentication token is obtained and S34 is continued.

[0095] S34, the SDP system obtains the timestamp and verification code of the SDP client from the plain text authentication token: the SDP system verifies the verification code, and if the verification passes, executes S35.

[0096] S35, the SDP system matches the access message according to the SPA service authentication information, and when the match succeeds, authorizes the SDP client and releases the access message.

[0097] The SDP system verifies whether the UDP message is within the valid authentication time. If the UDP message is valid, single-packet authentication is completed, and an access control rule is added to the source IP address, destination IP address, and destination port of the UDP message to implement the pairing of the SDP client and the protected service into the whitelist.

[0098] It should be noted that the various embodiments or variations in the present invention are described in a related manner, and the same or similar parts between the various embodiments or variations can be referenced to each other. Each embodiment or variation focuses on the differences from other embodiments, but they are all implemented based on the working principle of software-defined boundaries, which will not be described one by one here.

[0099] Compared with the prior art, the present invention adopts the method of deploying the SDP system in a bypass manner to mirror the access switch traffic, and only monitors and blocks the mirrored data, so as not to forward data, thereby avoiding the problem that once the SDP system fails, the services protected by the SDP system are inaccessible. In addition, the SDP system in the present invention does not need to be exposed to the Internet, avoiding the risk of authorizing any user to access intranet data after the SDP system is controlled by an attack. On the other hand, the present invention can also realize the SDP function when internal users access internal services by mirroring the intranet traffic, effectively resisting internal attacks. By using the present invention, there is no need to change the user's network structure, nor to transform the software architecture of the protected service, thereby achieving transparent deployment.

[0100] The above is a detailed description of the implementation method and system of the software-defined boundary provided by the present invention. For those skilled in the art, any obvious changes made to it without departing from the essence of the present invention will constitute an infringement of the patent right of the present invention and will bear corresponding legal responsibilities.

Claims

1. A method for implementing software-defined boundaries, characterized in that The steps include: Register the pre-generated network information of the protected service to the SDP system to generate SPA service authentication information; The SDP client obtains SPA service authentication information, generates an access message, and sends the access message to the protected service through the switch; The SDP system adopts a bypass deployment mode to obtain the mirror data of the switch traffic, wherein the mirror data includes the access message; wherein the SDP system only monitors and blocks the mirror data and does not forward the data; The SDP system matches the access message according to the SPA service authentication information, and when the match succeeds, authorizes the SDP client and releases the access message.

2. The method for implementing software-defined boundaries according to claim 1, wherein: The pre-generated network information of the protected service includes: the IP address of the protected service, the service port, the SPA authentication port, the verification code, the valid time of a single authentication, and the public-private key pair.

3. The method for implementing software-defined boundaries as claimed in claim 2, characterized in that Authorizing the SDP client includes the following sub-steps: Bind the IP address of the SDP client to the IP address of the protected service and the service port.

4. The method for implementing a software-defined boundary as claimed in claim 1, characterized in that The SDP client obtains SPA service authentication information and generates an access message, which also includes the following sub-steps: The SDP client obtains the SPA authentication port, the verification code, and the public key file offline, constructs an authentication token based on the public key file and the verification code, and generates a single-package authentication message including the authentication token.

5. The method for implementing software-defined boundaries according to claim 4, characterized in that: The encrypted content of the authentication token includes the local system timestamp and verification code when the SDP client initiates the single-packet authentication request.

6. The method for implementing software-defined boundaries according to claim 1, wherein: The SDP system matches the access message according to the SPA service authentication information, and blocks the IP address access of the SDP client when the match fails, and discards the access message.

7. The method for implementing software-defined boundaries as claimed in claim 1, characterized in that Before the step of matching the access message according to the SPA service authentication information, the following sub-steps are also included: The SDP system uses a private key to decrypt the authentication token and verify the verification code. When the authentication token is legal, the SDP system generates a white list according to the information of the SDP client and the information of the protected service.

8. The method for implementing software-defined boundaries according to claim 7, characterized in that: When the access duration of the SDP client exceeds the single authentication validity duration, the whitelist becomes invalid, and the SDP system blocks the IP address access of the SDP client.

9. An access control system, comprising an SDP system, an SDP client and a switch; characterized in that: The SDP system and the SDP client are respectively connected to the switch, and access the pre-generated protected service through the switch using the method described in any one of claims 1 to 8.

Images