Resource access control method and device

Abstract

The present application relates to the field of network communication technology, and in particular to a resource access control method and device. Based on preset rules, the managed network is divided into several network areas, and a corresponding proxy gateway port set is allocated for each network area; the association relationship between each proxy gateway and the network area is configured, and a binding relationship between each proxy gateway and the proxy gateway port set allocated to the network area associated with it is established; the proxy gateway of each TCP type resource is configured, and an association relationship between each TCP resource and the proxy gateway port set bound to its corresponding proxy gateway is established; after determining that the user authentication is successful, the target TCP type resource accessible to the user is determined, and a target proxy gateway port is allocated to each target TCP type resource from the target proxy gateway port set associated with the target TCP type resource, and the table entry including the target TCP type resource and its corresponding target proxy gateway port is sent to the target proxy gateway.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a resource access control method and device. Background Art

[0002] Zero Trust (ZT) is a security concept, and Zero Trust Architecture (ZTA) is a plan for enterprise network security. It is based on the Zero Trust concept and is built around its component relationships, workflow planning, and access policies.

[0003] SDP (Software Definition Perimeter) is a new generation of network security model based on the concept of zero trust. SDP enables application owners to deploy security boundaries when needed to isolate services from insecure networks. SDP replaces physical devices with logical components that run under the control of the application. SDP allows access to the internal infrastructure (various applications and services) of the enterprise only after device verification and identity authentication.

[0004] Zero-trust SDP gateway proxy accesses cloud desktops. The process is that after the inode client and the controller log in and authenticate, the authorized cloud desktop resources (C / S) are sent to the gateway. After the inode pulls up the workspace client, the cloud desktop is opened through the SDP gateway. However, the current C / S business can only go through the SSL tunnel. Since the tunnel encapsulation generates double layers of TCP and SSL, it has a great impact on performance and stability. Therefore, in order to solve this problem, when the cloud desktop client accesses the cloud desktop side gateway, it no longer goes through the tunnel access business process when passing through the SDP gateway proxy, but goes through the TCP four-layer proxy.

[0005] However, each resource accessed through TCP mode needs to be configured with a proxy gateway port to determine that this application is a TCP type resource. When accessing such resources through the gateway, no tunneling or encryption is performed, but TCP proxy forwarding is performed directly. Then, the corresponding gateway side must also configure an sslvpn gateway with the same port and must be referenced in the instance. This implementation method is relatively simple and easy to understand in terms of implementation logic, but in scenarios with a large number of TCP mode resources, especially when the number of referenced gateways in the sslvpn instance is limited, this implementation method has disadvantages, limiting the number of TCP type resources that a gateway proxy can proxy. Summary of the invention

[0006] The present application provides a resource access control method and device.

[0007] In a first aspect, the present application provides a resource access control method, which is applied to a software-defined boundary (SDP) controller. The method includes:

[0008] Divide the managed network into several network areas based on preset rules, and assign a corresponding proxy gateway port set to each network area;

[0009] Configure the association between each proxy gateway and the network area, and establish a binding relationship between each proxy gateway and the proxy gateway port set allocated by the network area associated with it, wherein one proxy gateway belongs to one network area;

[0010] Configure the proxy gateway of each TCP type resource, and establish an association relationship between each TCP resource and the proxy gateway port set bound to its corresponding proxy gateway;

[0011] A user authentication request is received from a client, and after determining that the user authentication is successful, a target TCP type resource that can be accessed by the user is determined, and a target proxy gateway port is allocated to each target TCP type resource from a set of target proxy gateway ports associated with the target TCP type resource, and a table entry including the target TCP type resource and its corresponding target proxy gateway port is sent to the target proxy gateway, so that after the target proxy gateway receives an access message sent by the client for accessing the target TCP type resource, the access message is forwarded based on the target proxy gateway port corresponding to the target TCP type resource in the table entry.

[0012] Optionally, the method further comprises:

[0013] The target proxy gateway port in the target proxy gateway port set allocated to the target TCP type resource is marked as used.

[0014] Optionally, after receiving a user authentication request sent by the client and determining that the user authentication is successful, the method further includes:

[0015] Generate a user token and send the user token to the target proxy gateway, and send the table entry including the target TCP type resource and its corresponding target proxy gateway port and the user token to the client, so that when the target proxy gateway receives an access message sent by the client for accessing the target TCP type resource, it authenticates the user based on the user token, and after determining that the authentication is successful, forwards the access message based on the target proxy gateway port corresponding to the target TCP type resource in the table entry.

[0016] In a second aspect, the present application provides a resource access control method, which is applied to a proxy gateway, and the method includes:

[0017] Receive a table entry including a target TCP type resource and its corresponding target proxy gateway port sent by the SDP controller, wherein the target TCP type resource is a TCP type resource accessible to the user determined by the SDP controller after determining that the user authentication is passed, and the target proxy gateway port is a proxy gateway port allocated to the target TCP type resource by the SDP controller from a proxy gateway port set corresponding to the proxy gateway;

[0018] Receiving an access message sent by a client for accessing a target TCP type resource, wherein the SDP controller sends a table entry including the target TCP type resource and its corresponding target proxy gateway port to the client after determining that the user authentication is passed;

[0019] The access message is forwarded based on the target proxy gateway port corresponding to the target TCP type resource in the table entry.

[0020] Optionally, the method further comprises:

[0021] Receive a user token sent by the SDP controller, a mapping relationship between a target proxy gateway port corresponding to a target TCP resource and an IP address and port of the target TCP resource, wherein the user token is generated by the SDP controller after determining that user authentication is successful based on a user authentication request sent by the client, and the SDP controller sends a table entry including the target TCP type resource and its corresponding target proxy gateway port and the user token to the client, so that an access message sent by the client carries the user token;

[0022] The user is authenticated based on the user token, and after it is determined that the authentication is passed, the access message is forwarded based on the mapping relationship between the target proxy gateway port corresponding to the target TCP type resource in the table entry and the IP address and port of the target TCP resource.

[0023] In a third aspect, the present application provides a resource access control device, which is applied to a software-defined boundary SDP controller, and the device includes:

[0024] A division unit, used to divide the managed network into several network areas based on preset rules, and allocate a corresponding proxy gateway port set to each network area;

[0025] A configuration unit, used to configure the association between each proxy gateway and the network area, and establish a binding relationship between each proxy gateway and the proxy gateway port set allocated by the network area associated with it, wherein one proxy gateway belongs to one network area;

[0026] The configuration unit is also used to configure the proxy gateway of each TCP type resource and establish an association relationship between each TCP resource and the proxy gateway port set bound to its corresponding proxy gateway;

[0027] The sending unit is used to receive a user authentication request sent by a client, determine a target TCP type resource accessible to the user after determining that the user authentication is successful, and allocate a target proxy gateway port to each target TCP type resource from a target proxy gateway port set associated with the target TCP type resource, and send a table entry including the target TCP type resource and its corresponding target proxy gateway port to a target proxy gateway, so that after the target proxy gateway receives an access message sent by the client for accessing the target TCP type resource, the access message is forwarded based on the target proxy gateway port corresponding to the target TCP type resource in the table entry.

[0028] Optionally, the device further comprises:

[0029] The marking unit is used to mark the target proxy gateway port in the target proxy gateway port set allocated to the target TCP type resource as used.

[0030] Optionally, the device further comprises:

[0031] A generating unit, used for generating a user token;

[0032] The sending unit is also used to send the user token to the target proxy gateway, and to send the table entry including the target TCP type resource and its corresponding target proxy gateway port and the user token to the client, so that when the target proxy gateway receives the access message sent by the client for accessing the target TCP type resource, it authenticates the user based on the user token, and after determining that the authentication is passed, forwards the access message based on the target proxy gateway port corresponding to the target TCP type resource in the table entry.

[0033] In a fourth aspect, the present application provides a resource access control device, which is applied to a proxy gateway, and the device includes:

[0034] A first receiving unit is used to receive a table entry including a target TCP type resource and a target proxy gateway port corresponding thereto, sent by an SDP controller, wherein the target TCP type resource is a TCP type resource accessible to a user determined by the SDP controller after determining that the user authentication is passed, and the target proxy gateway port is a proxy gateway port allocated by the SDP controller to the target TCP type resource from a proxy gateway port set corresponding to the proxy gateway;

[0035] A second receiving unit is used to receive an access message sent by a client for accessing a target TCP type resource, wherein the SDP controller sends a table entry including the target TCP type resource and its corresponding target proxy gateway port to the client after determining that the user authentication is passed;

[0036] The forwarding unit is used to forward the access message based on the target proxy gateway port corresponding to the target TCP type resource in the table entry.

[0037] Optionally, the first receiving unit is further used to receive a user token sent by the SDP controller, a mapping relationship between a target proxy gateway port corresponding to a target TCP resource and an IP address and port of the target TCP resource, wherein the user token is generated by the SDP controller after determining that user authentication is successful based on a user authentication request sent by the client, and the SDP controller sends a table entry including the target TCP type resource and its corresponding target proxy gateway port and the user token to the client, so that an access message sent by the client carries the user token;

[0038] The forwarding unit is also used to authenticate the user based on the user token, and after determining that the authentication is successful, forward the access message based on the mapping relationship between the target proxy gateway port corresponding to the target TCP type resource in the table entry and the IP address and port of the target TCP resource.

[0039] In a fifth aspect, an embodiment of the present application provides a resource access control device, the resource access control device comprising:

[0040] A memory for storing program instructions;

[0041] The processor is used to call the program instructions stored in the memory, and execute the steps of the method as described in any one of the first aspects above according to the obtained program instructions.

[0042] In a sixth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the steps of the method described in any one of the above-mentioned first aspects.

[0043] In a seventh aspect, an embodiment of the present application provides a resource access control device, the resource access control device comprising:

[0044] A memory for storing program instructions;

[0045] The processor is used to call the program instructions stored in the memory and execute the steps of the method as described in any one of the second aspects according to the obtained program instructions.

[0046] In an eighth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the steps of the method described in any one of the second aspects above.

[0047] In summary, the resource access control method provided in the embodiment of the present application divides the managed network into several network areas based on preset rules, and allocates a corresponding proxy gateway port set for each network area; configures the association relationship between each proxy gateway and the network area, and establishes a binding relationship between each proxy gateway and the proxy gateway port set allocated to the network area associated with it, wherein one proxy gateway belongs to one network area; configures the proxy gateway of each TCP type resource, and establishes an association relationship between each TCP resource and the proxy gateway port set bound to its corresponding proxy gateway; receives a user authentication request sent by a client, determines that the user authentication is successful, determines the target TCP type resource accessible to the user, and allocates a target proxy gateway port to each target TCP type resource from the target proxy gateway port set associated with the target TCP type resource, and sends the table entry including the target TCP type resource and its corresponding target proxy gateway port to the target proxy gateway, so that after the target proxy gateway receives the access message sent by the client for accessing the target TCP type resource, it forwards the access message based on the target proxy gateway port corresponding to the target TCP type resource in the table entry.

[0048] By adopting the resource access control method provided in the embodiment of the present application, when accessing multiple TCP type resources, it is no longer necessary to configure multiple proxy gateways in the gateway instance, and it is no longer restricted by the configuration specifications. It is only necessary to maintain the association table according to the correspondence between the resources and the proxy ports issued by the controller, and the configuration and maintenance are simple. The SDP controller dynamically allocates the proxy port, improves the utilization rate of the port, reduces the configuration complexity on the gateway side, and facilitates the maintenance of the gateway. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments of the present application or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings of the embodiments of the present application.

[0050] Figure 1 A detailed flow chart of a resource access control method provided in an embodiment of the present application;

[0051] Figure 2 A schematic diagram of a basic SDP network provided in an embodiment of the present application;

[0052] Figure 3 A detailed flow chart of another resource access control method provided in an embodiment of the present application;

[0053] Figure 4 A schematic diagram of the structure of a resource access control device provided in an embodiment of the present application;

[0054] Figure 5 A schematic diagram of the structure of another resource access control device provided in an embodiment of the present application;

[0055] Figure 6 A schematic diagram of the hardware architecture of a resource access control device provided in an embodiment of the present application;

[0056] Figure 7 A schematic diagram of the hardware architecture of another resource access control device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, rather than limiting the present application. The singular forms of "a", "said" and "the" used in the present application and claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to any or all possible combinations of one or more associated listed items.

[0058] It should be understood that, although the terms first, second, third, etc. may be used to describe various information in the embodiments of the present application, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, in addition, the word "if" used may be interpreted as "at..." or "when..." or "in response to determination".

[0059] For example, see Figure 1 As shown, it is a detailed flow chart of a resource access control method provided in an embodiment of the present application. The method is applied to a software defined boundary SDP controller. The method includes the following steps:

[0060] Step 100: Divide the managed network into several network areas based on preset rules, and allocate a corresponding proxy gateway port set to each network area.

[0061] This application is based on the zero-trust security network architecture, and SDP is used as an example for illustration. Figure 2As shown. It includes clients (iNode (referring to index node) / browser), zero-trust gateways (such as proxy gateways), controllers (such as SDP controllers) and business resources (such as TCP type resources). Among them, the dotted line represents the control channel and the solid line represents the data channel. Specifically, the control channel includes: the user uses the iNode / browser to access the controller for user authentication; after the authentication is passed, the controller sends the customer all accessible gateway addresses and applications protected by each gateway; the controller sends and dynamically updates the user's access rights to applications and APIs to the gateway. The data channel includes users accessing business resources behind the gateway through a WEB proxy or SSLVPN tunnel.

[0062] In the embodiment of the present application, the administrator can log in to the SDP controller and create a network area on the SDP controller. The network area is a logical area, that is, create several (one or more) network areas, and then create a port level (agent gateway port set) for each network area. That is, a corresponding agent gateway port set is allocated for each network area.

[0063] For example, it is assumed that the created network areas include network area 1 and network area 2, the proxy port set allocated to network area 1 is set 1, and the proxy port set allocated to network area 2 is set 2.

[0064] Step 110: configuring the association between each proxy gateway and the network area, and establishing a binding relationship between each proxy gateway and the proxy gateway port set allocated by the network area associated with it.

[0065] Specifically, in an embodiment of the present application, the administrator can divide the proxy gateways included in the networking into corresponding network areas. For example, assuming that the created network areas include network area 1 and network area 2, and the proxy gateways of the networking include proxy gateway 1, proxy gateway 2,..., proxy gateway 8, then proxy gateways 1-4 can be divided into network area 1, and proxy gateways 5-8 can be divided into network area 2.

[0066] It should be noted that a proxy gateway belongs to only one network area, that is, a proxy gateway belongs to only one network area, and a network area may include multiple proxy gateways.

[0067] Furthermore, the proxy gateway belonging to a network area is bound to the proxy port set allocated by the network area.

[0068] For example, proxy gateways 1-4 belong to network area 1, and the proxy port set allocated to network area 1 is set 1, so a binding relationship between proxy gateways 1-4 and set 1 can be established; proxy gateways 5-8 belong to network area 2, and the proxy port set allocated to network area 2 is set 2, so a binding relationship between proxy gateways 5-8 and set 2 can be established.

[0069] Step 120: configure the proxy gateway of each TCP type resource, and establish an association relationship between each TCP resource and the proxy gateway port set bound to its corresponding proxy gateway.

[0070] In an embodiment of the present application, various TCP type resources (such as cloud desktops) can also be configured on the SDP controller. Specifically, the access mode of the cloud desktop (Workspace) is configured to be TCP mode, the access protocol is TCP, the application type is Workspace, the application address is IP1, the application port is 443, the gateway (SDP gateway, proxy gateway, belonging to network area 1) proxy port is set 1, and the user token position is 2000, wherein the "application address" and "application port" are the real address and port of the cloud desktop gateway, and the "gateway proxy port" is consistent with the gateway proxy port range configured on the SDP gateway (that is, when the gateway proxy port corresponding to the cloud desktop is referenced on the proxy gateway, it is no longer bound to a fixed proxy gateway port, but is bound to the corresponding port set). The user token position is the position where the user token information is inserted in the client hello message, which is generally fixed.

[0071] In this way, the SDP controller sends each target TCP type resource accessible to the user and its corresponding proxy gateway port to each proxy gateway in the network area, and also sends each proxy gateway a mapping relationship between each target TCP type resource and its corresponding real IP address and port.

[0072] Step 130: Receive a user authentication request sent by the client, and after determining that the user authentication is successful, determine the target TCP type resources that the user can access, and allocate a target proxy gateway port to each of the target TCP type resources from the target proxy gateway port set associated with the target TCP type resources, and send the table entry including the target TCP type resources and their corresponding target proxy gateway ports to the target proxy gateway.

[0073] After receiving the access message sent by the client for accessing the target TCP type resource, the target proxy gateway forwards the access message based on the target proxy gateway port corresponding to the target TCP type resource in the table entry.

[0074] In the embodiment of the present application, after allocating a target proxy gateway port to a target TCP type resource, the SDP controller may mark the target proxy gateway port in the target proxy gateway port set allocated to the target TCP type resource as used.

[0075] In this way, the SDP controller can know the status of each port in the proxy gateway port set, and know which ports are allocated and which ports are not allocated.

[0076] In the embodiment of the present application, the resource access control method may further include the following steps:

[0077] Generate a user token (e.g., token), send the user token to the target proxy gateway, and send the table entry including the target TCP type resource and its corresponding target proxy gateway port and the user token to the client, so that when the target proxy gateway receives an access message sent by the client for accessing the target TCP type resource, it authenticates the user based on the user token, and after determining that the authentication is successful, forwards the access message based on the target proxy gateway port corresponding to the target TCP type resource in the table entry.

[0078] Specifically, a user authentication client (such as iNode / browser) is installed on the client (such as PC). The user accesses the SDP controller authentication center through the iNode or browser to perform user authentication. After the SDP controller determines that the user has passed the authentication, it generates a user token, determines the target TCP type resources that the user can access, and allocates an unused target proxy gateway port to each target TCP type resource from the proxy gateway port set associated with the target TCP type resource. Then, the table including the target TCP type resource and its corresponding target proxy gateway port and the user token are sent to the client and the target proxy gateway.

[0079] Then, when the client needs to access a target TCP type resource (such as a cloud desktop), the iNode pulls up the cloud desktop client, and the cloud desktop client sends an access request to the target proxy gateway. The access request carries the user token and the proxy gateway port information assigned by the cloud desktop. After the target proxy gateway receives the access request, it authenticates the user based on the user token. After the authentication is passed, based on the proxy gateway port information carried in the access request and the table including the target TCP type resource and its corresponding target proxy gateway port, it determines the service that the client wants to access (target TCP type resource, cloud desktop), establishes TCP proxy forwarding on the target proxy gateway, and forwards the access request to the service gateway to achieve service access.

[0080] Specifically, when configuring TCP type resources, the real IP address and port information of each TCP type resource are also configured. Then, when the SDP controller sends the table entries of the target TCP type resources accessible to users and their corresponding proxy gateway ports to the target proxy gateway in a certain network area, the real IP address and port information of each target TCP type resource will also be sent to the target proxy gateway. Then, when the target proxy gateway receives an access message for a target TCP type resource, it can forward the access message according to the real IP address and port of the TCP type resource.

[0081] For example, see Figure 3 As shown, it is a detailed flow chart of a resource access control method provided by an embodiment of the present application. The method is applied to a proxy gateway, and the method includes the following steps:

[0082] Step 300: Receive a table entry including a target TCP type resource and its corresponding target proxy gateway port sent by an SDP controller.

[0083] Among them, the target TCP type resource is the TCP type resource accessible to the user determined by the SDP controller after determining that the user authentication is passed, and the target proxy gateway port is the proxy gateway port allocated by the SDP controller to the target TCP type resource from the proxy gateway port set corresponding to the proxy gateway.

[0084] Step 310: Receive an access message sent by a client for accessing a target TCP type resource.

[0085] After determining that the user authentication is passed, the SDP controller sends the table entry including the target TCP type resource and its corresponding target proxy gateway port to the client.

[0086] In this way, the access message sent by the client to the target proxy gateway for accessing the target TCP type resource can include the target proxy gateway port information corresponding to the target TCP type resource.

[0087] Step 320: Forward the access message based on the target proxy gateway port corresponding to the target TCP type resource in the table entry.

[0088] Furthermore, the resource access control method applied to the proxy gateway may also include the following steps:

[0089] Receive a user token sent by the SDP controller, a mapping relationship between a target proxy gateway port corresponding to a target TCP resource and an IP address and port of the target TCP resource, wherein the user token is generated by the SDP controller after determining that user authentication is successful based on a user authentication request sent by the client, and the SDP controller sends a table entry including the target TCP type resource and its corresponding target proxy gateway port and the user token to the client, so that an access message sent by the client carries the user token;

[0090] The user is authenticated based on the user token, and after it is determined that the authentication is passed, the access message is forwarded based on the mapping relationship between the target proxy gateway port corresponding to the target TCP type resource in the table entry and the IP address and port of the target TCP resource.

[0091] For example, see Figure 4 FIG. 1 is a schematic diagram of a structure of a resource access control device provided in an embodiment of the present application. The device is applied to a software-defined boundary SDP controller. The device includes:

[0092] The division unit 40 is used to divide the managed network into a plurality of network areas based on a preset rule, and allocate a corresponding proxy gateway port set to each network area;

[0093] A configuration unit 41 is used to configure the association between each proxy gateway and the network area, and to establish a binding relationship between each proxy gateway and a proxy gateway port set allocated by the network area associated with the proxy gateway, wherein one proxy gateway belongs to one network area;

[0094] The configuration unit 41 is also used to configure the proxy gateway of each TCP type resource, and establish an association relationship between each TCP resource and the proxy gateway port set bound to its corresponding proxy gateway;

[0095] The sending unit 42 is used to receive a user authentication request sent by the client, determine the target TCP type resource that the user can access after determining that the user authentication is successful, and allocate a target proxy gateway port to each target TCP type resource from a set of target proxy gateway ports associated with the target TCP type resource, and send a table entry including the target TCP type resource and its corresponding target proxy gateway port to the target proxy gateway, so that after the target proxy gateway receives an access message sent by the client for accessing the target TCP type resource, the access message is forwarded based on the target proxy gateway port corresponding to the target TCP type resource in the table entry.

[0096] Optionally, the device further comprises:

[0097] The marking unit is used to mark the target proxy gateway port in the target proxy gateway port set allocated to the target TCP type resource as used.

[0098] Optionally, the device further comprises:

[0099] A generating unit, used for generating a user token;

[0100] The sending unit 42 is also used to send the user token to the target proxy gateway, and to send the table entry including the target TCP type resource and its corresponding target proxy gateway port and the user token to the client, so that when the target proxy gateway receives the access message sent by the client for accessing the target TCP type resource, it authenticates the user based on the user token, and after determining that the authentication is passed, forwards the access message based on the target proxy gateway port corresponding to the target TCP type resource in the table entry.

[0101] For example, see Figure 5 FIG. 1 is a schematic diagram of a resource access control device provided in an embodiment of the present application. The device is applied to a proxy gateway, and the device includes:

[0102] The first receiving unit 50 is used to receive a table entry including a target TCP type resource and a target proxy gateway port corresponding thereto, sent by the SDP controller, wherein the target TCP type resource is a TCP type resource accessible to a user determined by the SDP controller after determining that the user authentication is passed, and the target proxy gateway port is a proxy gateway port allocated by the SDP controller to the target TCP type resource from a proxy gateway port set corresponding to the proxy gateway;

[0103] The second receiving unit 51 is used to receive an access message sent by a client for accessing a target TCP type resource, wherein the SDP controller sends a table including the target TCP type resource and its corresponding target proxy gateway port to the client after determining that the user authentication is passed;

[0104] The forwarding unit 52 is used to forward the access message based on the target proxy gateway port corresponding to the target TCP type resource in the table entry.

[0105] Optionally, the first receiving unit 50 is further used to receive a user token sent by the SDP controller, a mapping relationship between a target proxy gateway port corresponding to a target TCP resource and an IP address and port of the target TCP resource, wherein the user token is generated by the SDP controller after determining that the user authentication is successful based on a user authentication request sent by the client, and the SDP controller sends a table entry including the target TCP type resource and its corresponding target proxy gateway port and the user token to the client, so that the access message sent by the client carries the user token;

[0106] The forwarding unit 52 is also used to authenticate the user based on the user token, and after determining that the authentication is successful, forward the access message based on the mapping relationship between the target proxy gateway port corresponding to the target TCP type resource in the table entry and the IP address and port of the target TCP resource.

[0107] The above units may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASIC), or one or more digital singnal processors (DSP), or one or more field programmable gate arrays (FPGA). For another example, when a certain unit above is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processors that can call program codes. For another example, these units may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0108] Furthermore, the resource access control device provided in the embodiment of the present application, from the hardware level, the hardware architecture diagram of the resource access control device can be seen in Figure 6 As shown, the resource access control device may include: a memory 60 and a processor 61,

[0109] The memory 60 is used to store program instructions; the processor 61 calls the program instructions stored in the memory 60 and executes the above method embodiment according to the obtained program instructions. The specific implementation method and technical effect are similar and will not be repeated here.

[0110] Optionally, the present application also provides an SDP controller, comprising at least one processing element (or chip) for executing the above method embodiment applied to the SDP controller.

[0111] Optionally, the present application also provides a program product, such as a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the above-mentioned method embodiment applied to the SDP controller.

[0112] Furthermore, the resource access control device provided in the embodiment of the present application, from the hardware level, the hardware architecture diagram of the resource access control device can be seen in Figure 7 As shown, the resource access control device may include: a memory 70 and a processor 71,

[0113] The memory 70 is used to store program instructions; the processor 71 calls the program instructions stored in the memory 70 and executes the above method embodiment according to the obtained program instructions. The specific implementation method and technical effect are similar and will not be repeated here.

[0114] Optionally, the present application also provides a proxy gateway, comprising at least one processing element (or chip) for executing the above method embodiment applied to the proxy gateway.

[0115] Optionally, the present application also provides a program product, such as a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the above-mentioned method embodiment applied to the proxy gateway.

[0116] Here, the machine-readable storage medium may be any electronic, magnetic, optical or other physical storage device that may contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium may be: RAM (RadomAccess Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as CD, DVD, etc.), or similar storage medium, or a combination thereof.

[0117] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.

[0118] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0119] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0120] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0121] Moreover, these computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0122] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0123] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A resource access control method, characterized in that: Applied to a software-defined border (SDP) controller, the method comprises: Divide the managed network into several network areas based on preset rules, and assign a corresponding proxy gateway port set to each network area; Configure the association between each proxy gateway and the network area, and establish a binding relationship between each proxy gateway and the proxy gateway port set allocated by the network area associated with it, wherein one proxy gateway belongs to one network area; Configure the proxy gateway of each TCP type resource, and establish an association relationship between each TCP resource and the proxy gateway port set bound to its corresponding proxy gateway, and establish a mapping relationship between each TCP type resource and its corresponding real IP address and port; A user authentication request is received from a client, and after determining that the user authentication is successful, a target TCP type resource accessible to the user is determined, and a target proxy gateway port is allocated to each target TCP type resource from a target proxy gateway port set associated with the target TCP type resource, and a table entry including the target TCP type resource and its corresponding target proxy gateway port and a mapping relationship between the target TCP type resource and its corresponding real IP address and port is sent to the target proxy gateway, so that after the target proxy gateway receives an access message sent by the client for accessing the target TCP type resource, the access message is forwarded based on the mapping relationship between the target proxy gateway port corresponding to the target TCP type resource in the table entry and the IP address and port of the target TCP resource.

2. The method according to claim 1, characterized in that The method further comprises: The target proxy gateway port in the target proxy gateway port set allocated to the target TCP type resource is marked as used.

3. The method according to claim 1 or 2, characterized in that After receiving the user authentication request sent by the client and determining that the user authentication is successful, the method further includes: Generate a user token and send the user token to the target proxy gateway, and send the table entry including the target TCP type resource and its corresponding target proxy gateway port and the user token to the client, so that when the target proxy gateway receives an access message sent by the client for accessing the target TCP type resource, it authenticates the user based on the user token, and after determining that the authentication is successful, forwards the access message based on the mapping relationship between the target proxy gateway port corresponding to the target TCP type resource in the table entry and the IP address and port of the target TCP resource.

4. A resource access control method, characterized in that: Applied to a proxy gateway, the method comprises: Receive a table entry including a target TCP type resource and its corresponding target proxy gateway port sent by the SDP controller, and receive a mapping relationship between the IP address and the port of the target TCP resource, wherein the target TCP type resource is a TCP type resource accessible to the user determined by the SDP controller after determining that the user authentication is passed, and the target proxy gateway port is a proxy gateway port allocated to the target TCP type resource by the SDP controller from a proxy gateway port set corresponding to the proxy gateway; Receiving an access message sent by a client for accessing a target TCP type resource, wherein the SDP controller, after determining that the user authentication is passed, sends a table entry including the target TCP type resource and its corresponding target proxy gateway port and a mapping relationship between the IP address and the port of the target TCP resource to the client; The access message is forwarded based on the mapping relationship between the target proxy gateway port corresponding to the target TCP type resource in the table entry and the IP address and port of the target TCP resource.

5. The method according to claim 4, characterized in that The method further comprises: Receive a user token sent by the SDP controller, a mapping relationship between a target proxy gateway port corresponding to a target TCP resource and an IP address and port of the target TCP resource, wherein the user token is generated by the SDP controller after determining that user authentication is successful based on a user authentication request sent by the client, and the SDP controller sends a table entry including the target TCP type resource and its corresponding target proxy gateway port and the user token to the client, so that an access message sent by the client carries the user token; The user is authenticated based on the user token, and after it is determined that the authentication is passed, the access message is forwarded based on the mapping relationship between the target proxy gateway port corresponding to the target TCP type resource in the table entry and the IP address and port of the target TCP resource.

6. A resource access control device, characterized in that: Applied to a software defined border SDP controller, the device comprises: A division unit, used to divide the managed network into several network areas based on preset rules, and allocate a corresponding proxy gateway port set to each network area; A configuration unit, used to configure the association between each proxy gateway and the network area, and establish a binding relationship between each proxy gateway and the proxy gateway port set allocated by the network area associated with it, wherein one proxy gateway belongs to one network area; The configuration unit is also used to configure the proxy gateway of each TCP type resource, and establish an association relationship between each TCP resource and the proxy gateway port set bound to its corresponding proxy gateway, and establish a mapping relationship between each TCP type resource and its corresponding real IP address and port; The sending unit is used to receive a user authentication request sent by a client, determine a target TCP type resource accessible to the user after determining that the user authentication is successful, and allocate a target proxy gateway port to each target TCP type resource from a target proxy gateway port set associated with the target TCP type resource, and send a table entry including the target TCP type resource and its corresponding target proxy gateway port and a mapping relationship between the target TCP type resource and its corresponding real IP address and port to a target proxy gateway, so that after receiving an access message sent by the client for accessing the target TCP type resource, the target proxy gateway forwards the access message based on the mapping relationship between the target proxy gateway port corresponding to the target TCP type resource in the table entry and the IP address and port of the target TCP resource.

7. The device according to claim 6, characterized in that The device also includes: The marking unit is used to mark the target proxy gateway port in the target proxy gateway port set allocated to the target TCP type resource as used.

8. The device according to claim 6 or 7, characterized in that The device also includes: A generating unit, used for generating a user token; The sending unit is also used to send the user token to the target proxy gateway, and to send the table entry including the target TCP type resource and its corresponding target proxy gateway port and the user token to the client, so that when the target proxy gateway receives the access message sent by the client for accessing the target TCP type resource, it authenticates the user based on the user token, and after determining that the authentication is passed, forwards the access message based on the mapping relationship between the target proxy gateway port corresponding to the target TCP type resource in the table entry and the IP address and port of the target TCP resource.

9. A resource access control device, characterized in that: Applied to a proxy gateway, the device comprises: A first receiving unit is used to receive a table entry including a target TCP type resource and a target proxy gateway port corresponding thereto sent by an SDP controller, and receive a mapping relationship between an IP address and a port of the target TCP resource, wherein the target TCP type resource is a TCP type resource accessible to a user determined by the SDP controller after determining that the user authentication is passed, and the target proxy gateway port is a proxy gateway port allocated by the SDP controller to the target TCP type resource from a proxy gateway port set corresponding to the proxy gateway; A second receiving unit is used to receive an access message sent by a client for accessing a target TCP type resource, wherein the SDP controller sends a table including the target TCP type resource and its corresponding target proxy gateway port and a mapping relationship between the IP address and the port of the target TCP resource to the client after determining that the user authentication is passed; The forwarding unit is used to forward the access message based on the mapping relationship between the target proxy gateway port corresponding to the target TCP type resource in the table entry and the IP address and port of the target TCP resource.

10. The device according to claim 9, characterized in that The first receiving unit is further used to receive a user token sent by the SDP controller, a mapping relationship between a target proxy gateway port corresponding to a target TCP resource and an IP address and port of the target TCP resource, wherein the user token is generated by the SDP controller after determining that the user authentication is successful based on a user authentication request sent by the client, and the SDP controller sends a table entry including the target TCP type resource and its corresponding target proxy gateway port and the user token to the client, so that an access message sent by the client carries the user token; The forwarding unit is also used to authenticate the user based on the user token, and after determining that the authentication is successful, forward the access message based on the mapping relationship between the target proxy gateway port corresponding to the target TCP type resource in the table entry and the IP address and port of the target TCP resource.

Images