Zero-trust knock message transmission method and system based on quic protocol

Abstract

The application provides a zero-trust knocking message transmission method and system based on a QUIC protocol, and the method comprises the following steps: an SPA client generates an SPA knocking message and sends the SPA knocking message to a QUIC client; the QUIC client sends the SPA knocking message to a corresponding QUIC server through the QUIC protocol; and the QUIC server forwards the SPA knocking message to an SDP zero-trust gateway. The SPA knocking message is carried by the QUIC protocol in the application, so that the SPA knocking message can reliably and effectively reach the SDP zero-trust gateway. The QUIC protocol can effectively ensure the security of the zero-trust SDP scheme UDP connectionless based on UDP, and the QUIC protocol can guarantee the reliability of the message at the application layer, for example, if the SPA knocking message is discarded by the network layer, the QUIC client will automatically retransmit, so as to ensure that the SPA knocking message is reachable, guarantee normal access of user services, and improve user experience.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a zero-trust door-knocking message transmission method and system based on the QUIC protocol. Background Technology

[0002] Zero Trust originated from the de-bordered security concept proposed at the Jericho Forum in 2004, and Forrester formally introduced the term "Zero Trust" (ZT) in 2010. The core idea of ​​Zero Trust security is that "no one / device / system inside or outside the network should be trusted by default, and the trust foundation of access control needs to be reconstructed based on authentication and authorization."

[0003] The core technical components of the zero-trust network security architecture include the Single Packet Authorization (SPA) module, which is used for zero-trust gateway access to user requests. SPAs generally choose to use the User Datagram Protocol (UDP) for communication because UDP transmission is connectionless and does not require a response by default. This has a great advantage, as it can hide itself by discarding data packets that fail to be authorized.

[0004] In existing technologies, because the zero-trust architecture requires the use of the UDP connectionless protocol to knock on the gateway, in an Internet environment, the knock messages sent by users to access the zero-trust gateway may be lost due to network jitter and congestion, thus making it impossible for users to access their services and degrading the user experience.

[0005] The information disclosed in the background section is only intended to enhance the understanding of the background of this application, and therefore may contain information that is not part of the prior art known to those skilled in the art. Summary of the Invention

[0006] This application provides a zero-trust door-knocking message transmission method and system based on the QUIC protocol to solve the problems existing in the prior art.

[0007] Firstly, this application provides a zero-trust door-knocking message transmission method based on the QUIC protocol, including:

[0008] S1. The single-packet authorized SPA client generates an SPA knock message and sends it to the QUIC client;

[0009] S2. The QUIC client sends the SPA knock message to the corresponding QUIC server via the QUIC protocol;

[0010] S3, the QUIC server forwards the SPA knock message to the SDP zero-trust gateway.

[0011] In some embodiments, S2 includes:

[0012] S21. The QUIC client encapsulates the SPA knock message to obtain an encapsulated message;

[0013] S22. The QUIC client transmits the encapsulated message to the QUIC server through an encrypted transmission tunnel of the QUIC protocol.

[0014] In some embodiments, S21 includes:

[0015] S211. The QUIC client generates a target connection corresponding to the SPA knock message, and the target connection is identified by a connection ID;

[0016] S212. The QUIC client loads the SPA knock message into the target connection to obtain the encapsulated message.

[0017] In some embodiments, S3 includes:

[0018] S31. After receiving the encapsulated message, the QUIC server decapsulates the encapsulated message to obtain the SPA knock message;

[0019] S32. The QUIC server forwards the SPA knock message to the SDP zero-trust gateway.

[0020] In some embodiments, S22 includes:

[0021] The QUIC client uses 0-RTT to transmit the encapsulated message to the QUIC server through an encrypted transmission tunnel of the QUIC protocol.

[0022] Secondly, this application provides a zero-trust door-knocking message transmission system based on the QUIC protocol, including: an SPA client, a QUIC client, a QUIC server, and an SDP zero-trust gateway;

[0023] The SPA client is used to generate an SPA knock message and send it to the QUIC client.

[0024] The QUIC client is used to send the SPA knock message to the corresponding QUIC server via the QUIC protocol;

[0025] The QUIC server is used to forward the SPA knock message to the SDP zero-trust gateway.

[0026] In some embodiments, the QUIC client is specifically used to encapsulate the SPA knock message to obtain an encapsulated message; and transmit the encapsulated message to the QUIC server through an encrypted transmission tunnel of the QUIC protocol.

[0027] In some embodiments, the QUIC client is specifically used to generate a target connection corresponding to the SPA knock message, the target connection being identified by a connection ID; and to encapsulate the SPA knock message into the target connection to obtain the encapsulated message.

[0028] In some embodiments, the QUIC server is specifically used to decapsulate the encapsulated message after receiving it to obtain the SPA knock message; and forward the SPA knock message to the SDP zero-trust gateway.

[0029] In some embodiments, the QUIC client is specifically used to transmit the encapsulated message to the QUIC server via an encrypted transmission tunnel of the QUIC protocol using a 0-RTT method.

[0030] This application provides a zero-trust knock message transmission method and system based on the QUIC protocol. The method includes: S1, an SPA client generates an SPA knock message and sends it to a QUIC client; S2, the QUIC client sends the SPA knock message to the corresponding QUIC server via the QUIC protocol; S3, the QUIC server forwards the SPA knock message to the SDP zero-trust gateway. This application uses the QUIC protocol to carry the SPA knock message, ensuring that the SPA knock message can reliably and effectively reach the SDP zero-trust gateway. The QUIC protocol, based on UDP, can effectively ensure the security of the UDP connectionless connection of the zero-trust SDP scheme. At the same time, QUIC provides message reliability guarantees at the application layer. If the SPA knock message is discarded by the network layer, the QUIC client will automatically retransmit it, thereby ensuring the reachability of the SPA knock message, guaranteeing normal access to user services, and improving user experience. Attached Figure Description

[0031] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0032] Figure 1 A schematic diagram of a zero-trust door-knocking message transmission method based on the QUIC protocol provided in an embodiment of this application;

[0033] Figure 2 This is a schematic diagram of a QUIC client encapsulating a SPA knock message in an embodiment of this application;

[0034] Figure 3 A schematic diagram of a zero-trust door-knocking message transmission system based on the QUIC protocol provided in an embodiment of this application.

[0035] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms "a" and "the" as used in the embodiments of this application are also intended to include the plural forms unless the context clearly indicates otherwise.

[0038] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" or "several" means two or more, unless otherwise explicitly specified.

[0039] It should be understood that the term "and / or" used in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Furthermore, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0040] Depending on the context, the words “if” or “suppose” as used here can be interpreted as “when” or “in response to determination” or “in response to detection.” Similarly, depending on the context, the phrases “if determination” or “if detection (of the stated condition or event)” can be interpreted as “when determination” or “in response to determination” or “when detection (of the stated condition or event)” or “in response to detection (of the stated condition or event).”

[0041] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a product or system comprising a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a product or system. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the product or system that includes said element.

[0042] SPAs typically use UDP for communication. However, the UDP protocol cannot guarantee reliability. If transmitted over the Internet, network quality issues can easily lead to the loss of knock messages, causing service connectivity failures, making it impossible for users to access services, and degrading the user experience.

[0043] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0044] Figure 1 A schematic diagram of a zero-trust door-knock message transmission method based on the QUIC protocol provided in this application embodiment is shown below. Figure 1 As shown, this application provides a zero-trust door-knock message transmission method based on the QUIC protocol, including:

[0045] S1. The SPA client generates an SPA knock message and sends it to the QUIC (Quick UDP Internet Connection) client.

[0046] S2. The QUIC client sends the SPA knock message to the corresponding QUIC server via the QUIC protocol;

[0047] QUIC is a low-latency Internet transport layer protocol based on UDP, developed by Google.

[0048] S3, the QUIC server forwards the SPA knock message to the SDP zero-trust gateway.

[0049] In the technical solution of this application, after generating the SPA knock message, the SPA client does not directly send the SPA knock message to the SDP zero-trust gateway. Instead, it first sends the SPA knock message to the QUIC client, which then sends the SPA knock message to the corresponding QUIC server through the QUIC protocol. Finally, the QUIC server forwards the SPA knock message to the SDP zero-trust gateway.

[0050] The above-mentioned technical solution of this application uses the QUIC protocol to carry SPA knock messages, ensuring that SPA knock messages can reliably and effectively reach the SDP zero-trust gateway. The QUIC protocol, based on UDP, can effectively ensure the security tradition of UDP connectionless connection in the zero-trust SDP scheme. At the same time, QUIC will perform message reliability guarantee at the application layer. If the SPA knock message is dropped by the network layer, the QUIC client will automatically retransmit it, thereby ensuring that the SPA knock message can be reached, guaranteeing the normal access of user services, and improving user experience.

[0051] In addition, QUIC can perform Transport Layer Security (TLS) 1.3 encryption by default to ensure that the transmitted SPA knock messages are not intercepted and replayed. Since the TLS 1.3 encryption is used to encrypt the QUIC tunnel, the entire tunnel is protected by the TLS 1.3 protocol. The SPA knock messages are transmitted in the tunnel. If someone wants to intercept it in the middle, they must first crack the TLS 1.3 encryption protocol, thus ensuring the security of the SPA knock messages.

[0052] In some embodiments, S2 includes: S21, the QUIC client encapsulates the SPA knock message to obtain an encapsulated message; S22, the QUIC client transmits the encapsulated message to the QUIC server through an encrypted transmission tunnel of the QUIC protocol.

[0053] In some embodiments, S21 includes: S211, the QUIC client generates a target connection corresponding to the SPA knock message, the target connection being identified by a connection ID; S212, the QUIC client loads the SPA knock message into the target connection to obtain the encapsulated message.

[0054] Specifically, after the SPA client generates an SPA knock message, QUIC establishes a target connection. This target connection is identified by a Connection ID (the source and target connection IDs in the message). The QUIC protocol has a stream mode that forms an independent stream, making QUIC itself a large encrypted transmission tunnel. Then, the SPA encapsulates the SPA knock message into this QUIC connection, including the QUIC header. The SPA's payload (the payload field) retains the original header. When the QUIC server receives and decapsulates the message from the QUIC client, it can read the content of the SPA knock message and perform the knocking. The advantage of this is that SPA knock messages in a UDP environment, encapsulated by the QUIC connection, traverse the complex internet environment and are not randomly dropped or lost due to congestion, preventing the SPA from failing to knock.

[0055] For example, Figure 2 This is a schematic diagram illustrating the encapsulation of a SPA knock message by a QUIC client in an embodiment of this application, as shown below. Figure 2 As shown, this application packages both the SPA and the client's business connections within the application layer of the QUIC protocol, that is... Figure 2 Because it is located in the HTTP / 3 domain, it can use QUIC for communication, thus overcoming the shortcomings of the SDP zero-trust architecture, which is based entirely on the UDP protocol.

[0056] In some embodiments, S3 includes: S31, after receiving the encapsulated message, the QUIC server decapsulates the encapsulated message to obtain the SPA knock message; S32, the QUIC server forwards the SPA knock message to the SDP zero-trust gateway.

[0057] After receiving the encapsulated message from the QUIC client, the QUIC server first decapsulates it to obtain the SPA knock message, and then forwards the SPA knock message to the SDP zero-trust gateway, thereby realizing the SPA client's knocking action.

[0058] Specifically, when the QUIC server receives a QUIC stream tunnel from a QUIC client, it first decrypts it, then decapsulates it, extracts the PAYLOAD (SPA) knock message, and sends this SPA knock message to the SDP zero-trust gateway for processing. Furthermore, even if the SDP zero-trust gateway and the QUIC server are not integrated on the same server, the QUIC server can still route the SPA knock message to the SDP zero-trust gateway for knocking.

[0059] In some embodiments, S22 includes: the QUIC client transmitting the encapsulated message to the QUIC server via an encrypted transmission tunnel of the QUIC protocol using a 0-RTT method.

[0060] Specifically, the QUIC protocol can effectively enhance the sending efficiency of SPA knock messages. Using QUIC's 0-RTT transmission mode can improve the SPA's speed and ensure the transmission efficiency of subsequent client access to the service server. The 0-RTT mode refers to the ability of a client that has previously connected to a server to cache certain parameters from that connection and subsequently establish a 0-RTT connection with that server that can immediately transmit information without waiting for a handshake to complete, thereby reducing the time required to establish a new connection.

[0061] Secondly, this application provides a zero-trust door-knocking message transmission system based on the QUIC protocol. Figure 3 A schematic diagram of a zero-trust door-knock message transmission system based on the QUIC protocol provided in this application embodiment is shown below. Figure 3 As shown, the zero-trust knock message transmission system based on the QUIC protocol includes: SPA client 10, QUIC client 20, QUIC server 30 and SDP zero-trust gateway 40;

[0062] The SPA client is used to generate an SPA knock message and send it to the QUIC client.

[0063] The QUIC client is used to send the SPA knock message to the corresponding QUIC server via the QUIC protocol;

[0064] The QUIC server is used to forward the SPA knock message to the SDP zero-trust gateway.

[0065] Optionally, the SPA client and the QUIC client can have a one-to-one correspondence, meaning that each SPA client and QUIC client can be integrated together.

[0066] Optionally, QUIC servers can be integrated into the SDP zero-trust gateway in a one-to-one correspondence.

[0067] Optionally, multiple QUIC clients can be associated with one QUIC server, allowing multiple QUIC clients to correspond to one QUIC server, and multiple QUIC clients to knock on the SDP zero-trust gateway through one QUIC server.

[0068] In some embodiments, the QUIC client is specifically used to encapsulate the SPA knock message to obtain an encapsulated message; and transmit the encapsulated message to the QUIC server through an encrypted transmission tunnel of the QUIC protocol.

[0069] In some embodiments, the QUIC client is specifically used to generate a target connection corresponding to the SPA knock message, the target connection being identified by a connection ID; and to encapsulate the SPA knock message into the target connection to obtain the encapsulated message.

[0070] In some embodiments, the QUIC server is specifically used to decapsulate the encapsulated message after receiving it to obtain the SPA knock message; and forward the SPA knock message to the SDP zero-trust gateway.

[0071] In some embodiments, the QUIC client is specifically used to transmit the encapsulated message to the QUIC server via an encrypted transmission tunnel of the QUIC protocol using a 0-RTT method.

[0072] The zero-trust knock message transmission system based on the QUIC protocol provided in this application improves the SPA knock message knocking method by using the reliable UDP protocol QUIC (http / 3). It first establishes a reliable connection between the QUIC client and the server, and then carries the SPA knock message on the reliable connection to knock on the gateway. By modifying the original access structure of the zero-trust SPA knock message, this application can effectively enhance the reliability, security and efficiency of the SPA knock message.

[0073] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0074] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0075] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the application disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0076] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A zero-trust door-knock message transmission method based on the QUIC protocol, characterized in that, include: S1. The single-packet authorized SPA client generates an SPA knock message and sends it to the QUIC client; S2. The QUIC client sends the SPA knock message to the corresponding QUIC server via the QUIC protocol; S3, the QUIC server forwards the SPA knock message to the SDP zero-trust gateway; S2 includes: S21. The QUIC client encapsulates the SPA knock message to obtain an encapsulated message; S22. The QUIC client transmits the encapsulated message to the QUIC server through an encrypted transmission tunnel of the QUIC protocol; S21 includes: S211. The QUIC client generates a target connection corresponding to the SPA knock message, and the target connection is identified by a connection ID; S212. The QUIC client loads the SPA knock message into the target connection to obtain the encapsulated message; S3 includes: S31. After receiving the encapsulated message, the QUIC server decapsulates the encapsulated message to obtain the SPA knock message; S32. The QUIC server forwards the SPA knock message to the SDP zero-trust gateway.

2. The zero-trust door-knocking message transmission method based on the QUIC protocol according to claim 1, characterized in that, S22, including: The QUIC client uses 0-RTT to transmit the encapsulated message to the QUIC server through an encrypted transmission tunnel of the QUIC protocol.

3. A zero-trust knock message transmission system based on the QUIC protocol, used to execute the method as described in claim 1 or 2, characterized in that, include: SPA client, QUIC client, QUIC server, and SDP zero-trust gateway; The SPA client is used to generate an SPA knock message and send it to the QUIC client. The QUIC client is used to send the SPA knock message to the corresponding QUIC server via the QUIC protocol; The QUIC server is used to forward the SPA knock message to the SDP zero-trust gateway.

4. The zero-trust door-knocking message transmission system based on the QUIC protocol according to claim 3, characterized in that, The QUIC client is specifically used to encapsulate the SPA knock message to obtain an encapsulated message; and transmit the encapsulated message to the QUIC server through an encrypted transmission tunnel of the QUIC protocol.

5. The zero-trust door-knocking message transmission system based on the QUIC protocol according to claim 4, characterized in that, The QUIC client is specifically used to generate a target connection corresponding to the SPA knock message, and the target connection is identified by a connection ID; the SPA knock message is loaded into the target connection to obtain the encapsulated message.

6. The zero-trust door-knocking message transmission system based on the QUIC protocol according to claim 5, characterized in that, The QUIC server is specifically used to decapsulate the encapsulated message after receiving it to obtain the SPA knock message; and to forward the SPA knock message to the SDP zero-trust gateway.

7. The zero-trust door-knocking message transmission system based on the QUIC protocol according to claim 6, characterized in that, The QUIC client is specifically used to transmit the encapsulated message to the QUIC server via an encrypted transmission tunnel of the QUIC protocol using a 0-RTT method.

Images