A zero-trust-based spa data transmission method and system

Abstract

The application discloses a zero-trust-based SPA data transmission method and system. First, according to the obtained single package authorization request, the SPA data package is sent to a random one of the multiple proxy servers corresponding to the single package authorization request; the proxy server judges the legality after obtaining the SPA data package, and when the legality is passed, the SPA data package is parsed and the SPA server identifier in the SPA data package is obtained; finally, the proxy server determines the SPA server address according to the parsed SPA server identifier, and transmits the SPA data package according to the SPA server address. The method not only protects the resources behind the SPA server, but also protects the SPA server itself, and improves the security of data transmission.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication technology, in particular to a zero-trust-based SPA data transmission method and system. BACKGROUND

[0002] Single Packet Authorization (SPA) is committed to alleviating the problems caused by application vulnerabilities, and its idea is to hide enterprise resources. For the data packet sent by the client, the corresponding port will be opened only when the authentication is passed.

[0003] Currently, the implementation of the zero-trust SPA scheme is that the client directly sends the SPA data packet to the SPA-Server, the SPA-Server unpacks the data, calls the rear authentication and authorization mechanism for judgment, and completes a data packet business cycle.

[0004] Although the prior art can hide the resources behind the SPA-Server, the SPA-Server itself is exposed to the outside world. When the data is transmitted to the SPA-Server, if the source IP and target IP in the UDP (or TCP) data packet are in plaintext, the SPA server information is leaked, which is an easy-to-exploit vulnerability for potential attackers. If the attacker intercepts the client data packet, the SPA IP address can be extracted through the protocol in the four-layer data packet in the OSI seven-layer model, so as to perform a DDOS attack on the SPA-Server. SUMMARY

[0005] Therefore, the embodiments of the present application provide a zero-trust-based SPA data transmission method and system, which can not only protect the resources behind the SPA-Server, but also protect the SPA-Server itself, so that the DDOS attacker cannot see the SPA-Server and cannot form an attack on the SPA-Server.

[0006] In a first aspect, a zero-trust-based SPA data transmission method is provided, which comprises:

[0007] The client sends an SPA data packet to a random one of the multiple proxy servers corresponding to the client according to the obtained single packet authorization request, wherein the SPA data packet at least includes an SPA server identifier;

[0008] The proxy server performs a legality judgment after obtaining the SPA data packet, and when the legality judgment is passed, parses the SPA data packet and obtains the SPA server identifier therein;

[0009] The proxy server determines the SPA server address according to the parsed SPA server identifier, and performs SPA data packet transmission according to the SPA server address.

[0010] Optionally, after the proxy server obtains the SPA data packet, the method comprises:

[0011] discarding the SPA data packet and aborting the current SPA data transmission process.

[0012] Optionally, the proxy server determines the SPA server address according to the parsed SPA server identifier, and comprises:

[0013] determining the SPA server address according to a pre-established identifier address configuration table, wherein the identifier address configuration table comprises a mapping relationship between SPA server identifiers and SPA server addresses.

[0014] Optionally, before the proxy server performs the legality judgment after obtaining the SPA data packet, the method further comprises:

[0015] judging whether the client has the right to access the proxy server according to the data packet;

[0016] If yes, the SPA data packet sent by the client is received.

[0017] Optionally, judging whether the client has the right to access the proxy server according to the data packet, the method further comprises:

[0018] If no, the SPA data packet sent by the client is rejected.

[0019] In a second aspect, a zero-trust-based SPA data transmission system is provided, which comprises:

[0020] a client, which sends an SPA data packet to a random one of a plurality of proxy servers corresponding to the client according to a single packet authorization request obtained by the client, wherein the SPA data packet at least comprises an SPA server identifier;

[0021] a proxy server, which performs a legality judgment after obtaining the SPA data packet, and when the legality judgment is passed, parses the SPA data packet and obtains the SPA server identifier in the SPA data packet, and determines the SPA server address according to the parsed SPA server identifier, and performs SPA data packet transmission according to the SPA server address.

[0022] Optionally, after the proxy server obtains the SPA data packet, the system comprises:

[0023] discard the SPA data packet and abort the current SPA data transmission process.

[0024] Optionally, the proxy server determines the SPA server address according to the parsed SPA server identifier, comprising:

[0025] determining the SPA server address according to a pre-established identifier address configuration table, wherein the identifier address configuration table comprises a mapping relationship between SPA server identifiers and SPA server addresses.

[0026] Optionally, before the proxy server performs the legality judgment after obtaining the SPA data packet, the system further comprises:

[0027] judging whether the client has the right to access the proxy server according to the data packet;

[0028] if yes, receiving the SPA data packet sent by the client.

[0029] Optionally, judging whether the client has the right to access the proxy server according to the data packet, the system further comprises:

[0030] if no, rejecting the SPA data packet sent by the client.

[0031] In the technical scheme provided by the embodiment of the application, the client sends the SPA data packet to a random one of the multiple proxy servers corresponding to the client according to the obtained single-packet authorization request; the proxy server performs the legality judgment after obtaining the SPA data packet, and when the legality judgment passes, parses the SPA data packet and obtains the SPA server identifier therein; the proxy server determines the SPA server address according to the parsed SPA server identifier, and performs the SPA data packet transmission according to the SPA server address.

[0032] It can be seen that the technical scheme provided by the embodiment of the application has at least the following beneficial effects: the SPA super-stealth technology is adopted, which not only protects the resources behind the SPA-Server, but also protects the SPA-Server itself, and the DDOS attacker cannot see the SPA-Server, so as to form an attack on the SPA-Server. BRIEF DESCRIPTION OF DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the application or the technical schemes in the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only exemplary, and for those skilled in the art, other drawings can be derived from the provided drawings without creative labor.

[0034] Figure 1 A zero-trust-based SPA data transmission flowchart provided for an embodiment of the present application;

[0035] Figure 2 A zero-trust-based SPA data transmission architecture diagram provided for an embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0037] In the description of the present application, the terms "comprising", "having" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to only those steps or units explicitly listed, but can also include other steps or units inherent to these processes, methods, products or devices, or steps or units added based on further optimization of the concept of the present application.

[0038] In the present application, the terms appearing first are described:

[0039] Zero trust: Zero trust represents a new generation of network security protection concept. Its key is to break the default "trust", and in a popular way, it is summarized as "continuous verification, never trust". By default, no one, device and system inside and outside the enterprise network is trusted, and the trust basis of access control is reconstructed based on identity authentication and authorization, so as to ensure that the identity is trusted, the device is trusted, the application is trusted and the link is trusted. Based on the principle of zero trust, the three "safety" of office system can be guaranteed: terminal safety, link safety and access control safety.

[0040] SPA: Single Packet Authorization, single packet authorization, which mainly reflects authorization (Authorization) from the name, but in fact, authentication (Authentication) is the core, and SPA can also be called Single Packet Authentication, single packet authentication.

[0041] Proxy: refers to proxy software or proxy server, which can also be regarded as a network access method. Proxy is used to perform other operations that things do not want or cannot perform. In this paper, the proxy (Proxy) provides the same interface (properties and methods) as the remote object (SPAServer)

[0042] SPA is committed to alleviate the problems caused by application vulnerabilities, and its idea is to hide enterprise resources. For the data packet sent by the client, the corresponding port will be opened (according to the policy management system setting) only when the authentication is passed.

[0043] When the data is transmitted to the SPA-Server, if the source IP and the target IP in the UDP (TCP and UDP have different ideas to realize, and this embodiment only takes UDP as an example) data packet are in plaintext, the information of the SPA server is leaked, which is an easy-to-use vulnerability for potential attackers. For example, the SPA server is attacked by DDOS.

[0044] The present application is to completely solve the stealth problem in the zero trust scheme, and the protected resources are hidden through SPA. Furthermore, the present application also solves the stealth problem of SPA itself - super stealth.

[0045] Specifically, refer to Figure 1 which shows a flowchart of a SPA data transmission method based on zero trust provided by the embodiment of the present application. The method can include the following steps:

[0046] Step 101, the client sends a SPA data packet to a random one of the multiple proxy servers corresponding to it according to the obtained single packet authorization request.

[0047] Among them, the SPA data packet at least includes SPA server identification (SPA-Server-ID).

[0048] Step 102, the proxy server judges the legality after obtaining the SPA data packet, and when the legality judgment is passed, the SPA data packet is parsed and the SPA server identification therein is obtained.

[0049] In the optional embodiment of the present application, when the proxy server (SPA-Proxy) judges the legality after obtaining the SPA data packet, if the legality judgment is not passed, the SPA data packet is discarded, and the current SPA data transmission process is terminated.

[0050] Before this step, the proxy server judges the legality before obtaining the SPA data packet, which further includes: judging whether the client has the right to access the proxy server according to the data packet; if yes, receiving the SPA data packet sent by the client; if no, refusing to receive the SPA data packet sent by the client.

[0051] Step 103, the proxy server determines the SPA server address according to the SPA server identification obtained by parsing, and transmits the SPA data packet according to the SPA server address.

[0052] In the embodiment, the SPA server address (SPA-Server-IP) is determined according to a pre-established identification address configuration table; wherein the identification address configuration table includes a mapping relationship between SPA server identification and SPA server address.

[0053] In the existing implementation of the current zero-trust SPA scheme, the client directly sends a SPA data packet to the SPA-Server, the SPA-Server unpacks the data, calls a rear authentication and authorization mechanism for judgment, and completes a data packet service cycle. Although the existing technology can hide the resources behind the SPA-Server, the SP2-Server itself is exposed to the outside world.

[0054] In the present application, as Figure 2 , a plurality of SPA-Proxy are set up between the client and the SPA-Server; the client is built-in with a SPA-Proxy list; the SPA-Proxy is built-in with a SPA-Server list.

[0055] Further, the data flow is realized as follows:

[0056] 1. The client has a SPA-Proxy list, and randomly selects a SPA-Proxy to send a SPA data packet (containing a SPA-Server mixed SPA-Server-ID)

[0057] 2. After the SAP-Proxy receives the data packet, it determines the legality, and if it is illegal, it is directly discarded. It plays a role in protecting the SPA-Server. If it is legal data, the SPA-Server-ID in the SPA data packet is taken out.

[0058] 3. Query the built-in SPA-Server-ID configuration table to transfer the legal data packet to the SPA-Server.

[0059] As can be seen from the above, the SPA-Proxy protects the SPA-Server in the present application. (The front SPA-Proxy completely hides the SPA-Server, and is invisible to the attacker)

[0060] And the SPA-Proxy is built-in with a SPA-Server-ID and SPA-Server IP mapping relationship. (The attacker can intercept the data packet, but does not know the mapping relationship between the SPA-Server-ID and the SPA-Server, so it cannot directly attack the SPA-Proxy)

[0061] The present application also provides a zero-trust based SPA data transmission system. The system comprises:

[0062] The client sends an SPA data packet to a random one of the multiple proxy servers corresponding to the single package authorization request; wherein the SPA data packet at least includes an SPA server identifier;

[0063] The proxy server performs legality judgment after obtaining the SPA data packet, parses the SPA data packet and obtains the SPA server identifier when the legality judgment passes, determines the SPA server address according to the parsed SPA server identifier, and performs SPA data packet transmission according to the SPA server address.

[0064] In an optional embodiment of the present application, when the legality judgment does not pass, the system includes: discarding the SPA data packet and aborting the current SPA data transmission process.

[0065] In an optional embodiment of the present application, the proxy server determines the SPA server address according to the parsed SPA server identifier, including: determining the SPA server address according to a pre-established identifier address configuration table; wherein the identifier address configuration table includes a mapping relationship between the SPA server identifier and the SPA server address.

[0066] In an optional embodiment of the present application, before the proxy server performs legality judgment after obtaining the SPA data packet, the system further includes: judging whether the client has the right to access the proxy server according to the data packet; if yes, receiving the SPA data packet sent by the client.

[0067] In an optional embodiment of the present application, if no, the system further includes: rejecting the SPA data packet sent by the client.

[0068] The zero-trust-based SPA data transmission system provided by the embodiments of the present application is used to implement the zero-trust-based SPA data transmission method described above. The specific limitations of the zero-trust-based SPA data transmission system can be referred to the limitations of the zero-trust-based SPA data transmission method described above, and will not be repeated here. Each part of the zero-trust-based SPA data transmission system described above can be realized by software, hardware and their combinations. The above modules can be embedded in or independent of the processor in the device in hardware form, or can be stored in the memory in the device in software form, so as to be called and executed by the processor to perform the operations corresponding to each module.

[0069] Any combination of the technical features in the above-described embodiments can be made, and for the sake of brevity, not all possible combinations are described, however, it is to be understood that the application embraces all such possible combinations.

[0070] The above-described embodiments only express several implementation manners of the present application, and the description is relatively specific and detailed, but it should not be understood as a limitation on the patent scope of the application. It should be pointed out that for ordinary skilled persons in the art, some modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the patent protection scope of the present application should be subject to the appended claims.

Claims

1. A zero-trust based SPA data transmission method, characterized in that, The method comprises: The client sends an SPA data packet to a random one of the multiple proxy servers corresponding to the client according to the obtained single packet authorization request; wherein the SPA data packet at least comprises an SPA server identifier; The proxy server performs legality judgment after obtaining the SPA data packet, and when the legality judgment passes, parses the SPA data packet and obtains the SPA server identifier therein; The proxy server determines an SPA server address according to the parsed SPA server identifier, and performs SPA data packet transmission according to the SPA server address.

2. The SPA data transmission method of claim 1, wherein, When the legality judgment does not pass, the method comprises: Discarding the SPA data packet and aborting the current SPA data transmission process.

3. The SPA data transmission method of claim 1, wherein, The proxy server determines the SPA server address according to the parsed SPA server identifier, comprising: Determining the SPA server address according to a pre-established identifier address configuration table; wherein the identifier address configuration table comprises a mapping relationship between the SPA server identifier and the SPA server address.

4. The SPA data transmission method of claim 1, wherein, Before the proxy server performs legality judgment after obtaining the SPA data packet, the method further comprises: Determining whether the client has access to the proxy server according to the data packet; If yes, receiving the SPA data packet sent by the client.

5. The SPA data transmission method of claim 4, wherein, Determining whether the client has access to the proxy server according to the data packet, the method further comprises: If no, rejecting to receive the SPA data packet sent by the client.

6. A zero trust based SPA data transfer system characterized in that, The system comprises: The client sends an SPA data packet to a random one of the multiple proxy servers corresponding to the client according to the obtained single packet authorization request; wherein the SPA data packet at least comprises an SPA server identifier; The proxy server performs legality judgment after obtaining the SPA data packet, and when the legality judgment passes, parses the SPA data packet and obtains the SPA server identifier therein; and determines an SPA server address according to the parsed SPA server identifier, and performs SPA data packet transmission according to the SPA server address.

7. The SPA data transmission system of claim 6, wherein, When the legality judgment does not pass, the system comprises: Discarding the SPA data packet and aborting the current SPA data transmission process.

8. The SPA data transmission system of claim 6, wherein, The proxy server determines the SPA server address according to the parsed SPA server identifier, comprising: Determining the SPA server address according to a pre-established identifier address configuration table; wherein the identifier address configuration table comprises a mapping relationship between the SPA server identifier and the SPA server address.

9. The SPA data transmission system of claim 6, wherein, Before the proxy server performs legality judgment after obtaining the SPA data packet, the system further comprises: Determining whether the client has access to the proxy server according to the data packet; If yes, receiving the SPA data packet sent by the client.

10. The SPA data transmission system of claim 9, wherein, Determining whether the client has access to the proxy server according to the data packet, the system further comprises: If no, the SPA data packet sent by the client is rejected.

Images