Authentication methods, devices, and network equipment based on zero-trust network security architecture

Abstract

This application provides an authentication method, apparatus, and network device based on a zero-trust network security architecture. The authentication method based on the zero-trust network security architecture includes: Step S1: After the client is authenticated by the control terminal, the gateway receives an SPA message sent by the client and parses it to obtain authentication information; the authentication information includes the client's first IP address and a first user identity identifier; Step S2: If it is determined that the first IP address is not recorded, based on the first user identity identifier and a recorded user information set, it is confirmed whether the user has passed authentication; wherein, the user information set represents several user information that has passed authentication by the control terminal, and the user information includes a second user identity identifier that has passed authentication by the control terminal. The above method confirms whether a user has passed authentication through the user identity identifier, thereby enabling the same user to log in to the client normally even when the IP address changes.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an authentication method and apparatus, and network device based on a zero-trust network security architecture. Background Technology

[0002] Zero Trust is a network security concept whose core principle is to distrust any user or device, whether inside or outside the network. Users or devices must be authenticated and authorized before accessing network resources to ensure network security and reliability. In a zero-trust network architecture, when a user logs into the system through a client, they need to send an SPA (Single Packet Authorization) message to the control terminal and, after successful authentication, send an SPA message back to the gateway from the control terminal for login authentication.

[0003] In related technologies, the IP address in the SPA message sent by the client to the control terminal and the gateway must match for the user to log in successfully. If the user's IP address changes during the login process, the technology will prevent the user from passing authentication, affecting the user experience. Summary of the Invention

[0004] In view of this, this application provides an authentication method, apparatus, and network device based on a zero-trust network security architecture to address the shortcomings of related technologies.

[0005] To achieve the above objectives, this application provides the following technical solution:

[0006] According to a first aspect of the present invention, an authentication method based on a zero-trust network security architecture is provided. The zero-trust network security architecture includes a client, a control terminal, and a gateway. The client communicates with the gateway through the control terminal. The method is used by the gateway to authenticate the logged-in user of the client, including:

[0007] Step S1: After the client is successfully authenticated by the control terminal, the gateway receives the SPA message sent by the client and parses it to obtain authentication information; the authentication information includes the client's first IP address and first user identity identifier;

[0008] Step S2: If it is determined that the first IP address has not been recorded, based on the first user identity identifier and the recorded user information set, confirm whether the user has passed authentication; wherein, the user information set represents several user information that has passed the authentication of the control terminal, and the user information includes a second user identity identifier that has passed the authentication of the control terminal.

[0009] According to a second aspect of the present invention, an authentication device based on a zero-trust network security architecture is provided. The zero-trust network security architecture includes a client, a control terminal, and a gateway. The client communicates with the gateway through the control terminal. The device is used for the gateway to authenticate the logged-in user of the client, including:

[0010] The parsing unit is used to, after the client is authenticated by the control terminal, receive the SPA message sent by the client from the gateway and parse it to obtain authentication information; the authentication information includes the client's first IP address and first user identity identifier;

[0011] An authentication unit is configured to, in the event that the first IP address is not recorded, confirm whether the user has passed authentication based on the first user identity identifier and the recorded user information set; wherein, the user information set represents a plurality of user information that has passed the authentication of the control terminal, and the user information includes a second user identity identifier that has passed the authentication of the control terminal.

[0012] According to a third aspect of the present invention, a zero-trust network security architecture is provided, including a client, a control terminal, and a gateway, wherein the gateway is used to perform the method described in the first aspect above to authenticate the logged-in user of the client.

[0013] According to a fourth aspect of the present invention, a network device is provided, the network device including a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor, the processor being prompted by the machine-executable instructions to perform the authentication method based on the zero-trust network security architecture described in the first aspect above.

[0014] As can be seen from the above technical solutions, the inventors discovered through research that there is a field representing the user's identity in the SPA message sent from the same user. This field remains unchanged regardless of how the IP address changes. Therefore, the gateway can confirm whether the user has been authenticated through the user identity identifier, so that the same user can log in to the client normally even when the IP changes.

[0015] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this application, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] Figure 1 This is a flowchart illustrating an authentication method based on a zero-trust network security architecture according to an embodiment of this application;

[0018] Figure 2 This is a block diagram illustrating an authentication device based on a zero-trust network security architecture according to an embodiment of this application;

[0019] Figure 3 This is a schematic diagram illustrating a zero-trust network security architecture according to an embodiment of this application;

[0020] Figure 4 This is a schematic diagram of the hardware structure of a network device according to an embodiment of this application. Detailed Implementation

[0021] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0022] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0023] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0024] Zero Trust is a network security concept whose core idea is to distrust any user or device, whether inside or outside the network. Users or devices must be authenticated and authorized to access resources within the network. The network also controls and monitors user and device access behavior in real time, and restricts and controls application access to ensure network security and reliability.

[0025] SPA (Single Packet Authorization) is a lightweight security protocol and an important technology for realizing the zero-trust concept. The SPA protocol requests network access by integrating all necessary information into a single data packet. It verifies the user or device's identity before granting network access; only after successful verification does it return information to the user or device; otherwise, it does not respond. This achieves a "network stealth" effect, making it impossible for attackers to find the service address and port.

[0026] Zero-trust network security architecture includes a client, a control terminal, and a gateway. When a user logs into the system through a client, the client first sends authentication information to the control terminal based on the SPA protocol. The control terminal parses this authentication information to determine if the client can be authenticated. After the client is authenticated by the control terminal, the control terminal returns accessible gateway information to the client and sends the authenticated client information to that gateway. Then, the client sends authentication information to the gateway based on the SPA protocol. The gateway compares this authentication information with the client information sent by the control terminal. If the information matches, the client is authenticated and a TLS bidirectional connection is established with the gateway, allowing the user to access system resources through the client.

[0027] In related technologies, the authentication information sent by the client to the control terminal and the gateway based on the SPA protocol includes the client's IP address. The gateway stores the IP address of the verified client sent by the control terminal in a user table. When the gateway authenticates the client, it matches the received client IP address with the IP address stored in the user table. If the match is successful, the client is authenticated.

[0028] However, during the user login process, the client's IP address may change. For example, when the client is installed on a mobile phone, switching between 4G and 5G networks, switching between mobile data and Wi-Fi, or the phone automatically switching to the SIM card with better signal in dual-SIM mode will all cause the client's IP address to change. In this case, the IP address sent by the client to the control terminal and the IP address sent to the gateway will be inconsistent. As a result, when the client requests authentication from the gateway, the gateway's user table cannot match the client's current IP address, leading to authentication failure and preventing the user from logging in normally, thus impacting the user experience.

[0029] The inventors discovered through research that there is a field in the SPA message sent from the same user that represents the user's identity. This field remains unchanged no matter how the IP address changes. Therefore, the gateway can confirm whether the user has been authenticated through the user identity identifier, so that the same user can log in to the client normally even when the IP changes.

[0030] Figure 1This is a flowchart illustrating an authentication method based on a zero-trust network security architecture according to an embodiment of this application. The zero-trust network security architecture includes a client, a control terminal, and a gateway. The client communicates with the gateway through the control terminal. The method is used by the gateway to authenticate the logged-in user of the client, including:

[0031] Step S1: After the control terminal authenticates the client, the gateway receives the SPA message sent by the client and parses it to obtain the authentication information.

[0032] The authentication information includes the client's first IP address and first user identity identifier.

[0033] Step S2: If it is determined that the first IP address has not been recorded, based on the first user identity and the recorded user information set, confirm whether the user has passed authentication.

[0034] The user information set represents several user information that has been authenticated by the control terminal, and the user information includes a second user identity identifier that has been authenticated by the control terminal.

[0035] In one embodiment, user information may include one or more of the following: client IP address, user account, session identifier, credit rating, and authentication policy information.

[0036] In one embodiment, the user identity identifier can be a session identifier, which can be a 32-bit UUID (Universally Unique Identifier).

[0037] In one embodiment, the process of the control terminal authenticating the logged-in user of the client can be as follows: The control terminal receives and parses the SPA message sent by the client to obtain authentication information such as the client's IP address and user identity identifier, and uses this authentication information to determine whether the user can pass authentication. For example, the SPA message sent by the client contains an SPA key calculated using a shared key and a random number based on the HOTP (HMAC-based One-Time Password) algorithm, as well as authentication information such as terminal identifier, random number, timestamp, client IP, and port. The control terminal calculates the SPA key based on the timestamp, client IP, and service password stored internally in the received authentication information, compares it with the received SPA key, and if they match, the user passes the authentication of the control terminal. The control terminal then returns accessible gateway information to the client and sends the information of the authenticated user to that gateway.

[0038] In one embodiment, the user information may further include a second IP address that has been authenticated by the control terminal, and the second IP address is bound and stored with a second user identity identifier.

[0039] In this embodiment, if it is determined that the first IP address has not been recorded, and a second user identity that is the same as the first user identity exists in the set of recorded user information, the user can be confirmed to have passed authentication.

[0040] In one embodiment, the authentication method based on a zero-trust network security architecture further includes:

[0041] Step S3: Replace the second IP address in the user information set with the first IP address.

[0042] In order to facilitate the gateway to find the corresponding user information when the client uses the second IP address to communicate with the gateway in the future, in this embodiment, step S3 can also be to delete the second IP address and its corresponding user information from the user information set and add the first IP address and its corresponding user information. This application does not limit this.

[0043] Therefore, during the user login process, when the client's IP address changes and the user information set does not store the IP address of the current client that sent the SPA message to the gateway (i.e., the first IP address), the user's unchanging user identity can be used to determine whether the user has been authenticated by the control terminal and whether they can communicate with the gateway. This allows the same user to log in to the client normally even when their IP address changes after successful authentication by the control terminal.

[0044] When a user successfully logs into the client and communicates with the gateway, the gateway can receive the heartbeat packets forwarded by the control terminal to determine whether the user is online and whether the connection needs to be maintained. This avoids frequent connection and disconnection operations, reduces resource consumption, and improves communication efficiency.

[0045] The inventors discovered that if a user's IP address changes after successfully logging into the client, the gateway will be unable to match the user information corresponding to that IP address in the user information set, thus failing to update the online status of the currently logged-in user. Furthermore, in the application scenario of this application, the change in the client's IP address typically involves a shift between the first IP address used for communication with the control terminal and the second IP address used for communication with the gateway.

[0046] Therefore, the inventors thought that if the first IP address is not recorded, and the recorded user information contains a second user identity that is the same as the first user identifier, the binding information of the first IP address and the second IP address can be recorded, so that when the gateway receives a heartbeat packet containing the first IP address, it can also update the user's online status.

[0047] In one embodiment, the authentication method based on a zero-trust network security architecture further includes:

[0048] Step S4: Add the binding information of the first IP address and the second IP address to the IP information set.

[0049] In this embodiment, when user authentication is successful, the gateway can add the binding information of the first IP address and the second IP address to the IP information set, so that when the gateway receives a heartbeat packet containing the first IP address, it can update the user's online status normally.

[0050] In one embodiment, the user information also includes heartbeat time; in another embodiment, the authentication method based on a zero-trust network security architecture further includes:

[0051] Step S5: After the gateway authenticates the user, it receives the heartbeat packet from the client forwarded by the control terminal. The heartbeat packet carries the third IP address of the client.

[0052] Step S6: When the third IP address is the same as the second IP address, update the user's heartbeat time in the user information set based on the first IP address bound to the second IP address in the IP information set;

[0053] In one embodiment, the heartbeat time can represent a user's online status. When the heartbeat time exceeds a first preset threshold, the gateway can disconnect the user. The first preset threshold can be set as needed, such as 3 minutes, 5 minutes, or 10 minutes, and this application does not impose any restrictions on it.

[0054] In one embodiment, the heartbeat packet may also carry a timestamp to prevent replay attacks on the controller.

[0055] In this embodiment, the gateway may have an aging timer to check the user information set at preset time intervals. Each time it checks, the heartbeat time of each user information is incremented by 1. When the heartbeat time exceeds a first preset threshold, the gateway may disconnect the corresponding user and release network resources. The preset time interval can be set as needed, such as every 30 seconds, 1 minute, or 2 minutes, and this application does not impose any restrictions on it.

[0056] In one embodiment, updating the heartbeat time of a user in the user information set can be done by resetting the heartbeat time to a certain value, such as 0, 1, or 2. This application does not impose any restrictions on this.

[0057] It should be noted that in a zero-trust network security architecture, the control terminal configures resource access policies and distributes them to the gateway. The gateway executes these policies, thus restricting communication between the gateway and the client. The client can only access authorized resources through the gateway, thereby improving network security. Typically, when the client communicates with the gateway, the heartbeat packet is not sent directly from the client to the gateway; instead, the client sends the heartbeat packet to the control terminal, which then forwards it to the client. However, this application does not exclude the possibility of the client directly sending the heartbeat packet to the gateway.

[0058] The inventors discovered that, in the application scenario of this application, the IP address of the changed client may also be different from the first IP address or the second IP address, in which case the client can automatically reconnect.

[0059] In one embodiment, the authentication method based on a zero-trust network security architecture further includes:

[0060] Step S7: If the third IP address is different from the second IP address, repeat steps S1 to S2.

[0061] In this embodiment, when the client automatically reconnects, the control terminal and the gateway will re-authenticate the client's logged-in user. This process is usually quite fast and can be done without the user noticing, thus improving the user experience.

[0062] The inventors also considered that when the IP information set stores too much information, it will consume a lot of resources and reduce the performance of the gateway, so it is necessary to clear the useless information.

[0063] In one embodiment, the IP information set further includes an aging time, and the authentication method based on a zero-trust network security architecture further includes:

[0064] Step S8: When the aging time exceeds the second preset threshold, delete the IP address corresponding to the aging time. The second preset threshold can be set as needed, such as 3 minutes, 5 minutes, or 10 minutes, or it can be the same as the first preset threshold in the above embodiments; this application does not impose any restrictions on this.

[0065] In this embodiment, the gateway can have an aging timer to check the IP information set at preset time intervals. Each time it checks, the aging time of each IP information is incremented by 1. When the heartbeat time exceeds a second preset threshold, the gateway can delete the IP information, including the IP address, corresponding to the aging time, thereby reducing resource waste. The preset time interval can be set as needed, such as every 30 seconds, 1 minute, or 2 minutes; this application does not impose any restrictions on this.

[0066] In one embodiment, the user information set and IP information set can be stored in memory to improve reading efficiency, or they can be stored in a database; this application does not limit this.

[0067] In this application, the user information set and IP information set can be linked list arrays. Each element of the array is a linked list, the head of each linked list can be the hash value of an IP address, and each node of the linked list can be user information or IP information, enabling fast lookup of user information or IP information. The following example illustrates the authentication method based on the zero-trust network security architecture of this application:

[0068] When the control terminal authenticates the SPA message sent by the client, the authentication information in the SPA message includes the second IP address A, and the session identifier, i.e., the second identity identifier, is X. After successful authentication, the control terminal returns accessible gateway information to the client and sends the information of the authenticated user to that gateway. The gateway stores the information of the authenticated user, including the hash value of the second IP address A and the session identifier, in the user information table, and the correspondence is shown in Table 1.

[0069] Table 1

[0070] IP-Hash SessionID 0 X 1 Y 2 Z

[0071] Table 1 represents three linked lists in the user information linked list array, which store three user information entries respectively. The session IDs in the user information entries are X, Y, and Z, and the head lists of the corresponding IP address hash values ​​in the user information entries are 0, 1, and 2, respectively.

[0072] After the client is successfully authenticated at the control end, the gateway receives the SPA message sent by the client, parses it to obtain the authentication information; the authentication information includes the client's first IP address B and first user identity X.

[0073] In the user information table shown in Table 1, there is no hash value 4 for the first IP address B, but there is a second identity identifier that is the same as the first user identity identifier X. Therefore, it can be confirmed that the user has passed authentication, and the binding information of the first IP address B and the second IP address A is added to the IP information table. The correspondence is shown in Table 2.

[0074] Table 2

[0075] Old-IP-Hash New-IP 0 B 1 C 2 D

[0076] Table 2 represents three linked lists in the IP information linked list array, which store three IP information. The corresponding changed IP addresses (i.e., the first IP addresses) in the IP information are B, C, and D, respectively. The head of the linked list corresponding to the hash values ​​of the IP addresses before the change (i.e., the second IP addresses) in the IP information are 0, 1, and 2, respectively.

[0077] Replace the hash value 0 of the second IP address A in user information table 1 with the hash value 4 of the first IP address B to obtain the user information table shown in Table 3:

[0078] Table 3

[0079] IP-Hash SessionID 4 X 1 Y 2 Z

[0080] After the gateway authenticates the user, it receives the heartbeat packet forwarded by the control terminal from the client. The heartbeat packet carries the hash value 0 of the client's third IP address A. In the IP information table, the hash value 0 of the second IP address A bound to the first IP address B is the same. The gateway then resets the heartbeat time of the user corresponding to the hash value 4 of the first IP address B in the user information set to 0, thus maintaining the user's online status.

[0081] Figure 2 This is a block diagram illustrating an authentication device based on a zero-trust network security architecture according to an embodiment of this application. The zero-trust network security architecture includes a client, a control terminal, and a gateway. The client communicates with the gateway through the control terminal. The device is used by the gateway to authenticate the client's logged-in user, including:

[0082] After the client is authenticated by the control terminal, the gateway receives the SPA message sent by the client and parses it to obtain the authentication information.

[0083] The authentication information includes the client's first IP address and first user identity identifier.

[0084] The authentication unit 22 is used to confirm whether the user has passed authentication based on the first user identity identifier and the recorded user information set if it is determined that the first IP address has not been recorded.

[0085] The user information set represents several user information that has been authenticated by the control terminal, and the user information includes a second user identity identifier that has been authenticated by the control terminal.

[0086] In one embodiment, the user information may further include a second IP address that has been authenticated by the control terminal, and the second IP address is bound and stored with a second user identity identifier.

[0087] In this embodiment, if it is determined that the first IP address has not been recorded, and a second user identity that is the same as the first user identity exists in the set of recorded user information, the user can be confirmed to have passed authentication.

[0088] In one embodiment, the authentication device based on a zero-trust network security architecture further includes:

[0089] IP binding unit 23 is used to add the binding information of the first IP address and the second IP address to the IP information set;

[0090] IP update unit 24 is used to replace the second IP address in the user information set with the first IP address.

[0091] When a user successfully logs into the client and communicates with the gateway, the gateway can receive the client's heartbeat packets forwarded by the control terminal to determine whether the user is online and whether the connection needs to be maintained. This avoids frequent connection and disconnection operations, reduces resource consumption, and improves communication efficiency.

[0092] In one embodiment, the authentication device based on a zero-trust network security architecture further includes:

[0093] The heartbeat receiving unit 25 is used to receive the heartbeat packet of the client forwarded by the control terminal after the gateway has authenticated the user. The heartbeat packet carries the third IP address of the client.

[0094] Heartbeat update unit 26 is used to update the heartbeat time of the user in the user information set based on the first IP address bound to the second IP address in the IP information set when the third IP address is the same as the second IP address.

[0095] The heartbeat time represents the user's online status. When the heartbeat time exceeds a first preset threshold, the gateway takes the user offline.

[0096] Figure 3 This is a schematic diagram of a zero-trust network security architecture according to an embodiment of this application, including a client 31, a control terminal 32 and a gateway 33, which can execute the authentication method based on the zero-trust network security architecture described above.

[0097] In this embodiment, the client 31 can be a program installed on the user's device to provide services to the user. The client 31 includes, but is not limited to, applications (APPs), web pages, mini-programs, plugins, or components. The user device includes, but is not limited to, smartphones, personal digital assistants, tablets, personal computers, laptops, wearable devices, virtual reality terminal devices, or augmented reality terminal devices.

[0098] Figure 4This is a schematic diagram of the hardware structure of a network device according to an embodiment of this application. The network device may include a processor 401 and a machine-readable storage medium 402 storing machine-executable instructions. The processor 401 and the machine-readable storage medium 402 can communicate via a system bus 403. Furthermore, by reading and executing the machine-executable instructions corresponding to load-sharing logic in the machine-readable storage medium 402, the processor 401 can execute the load-sharing method described above.

[0099] The machine-readable storage medium 402 mentioned herein can be any electronic, magnetic, optical, or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium 402 can include at least one of the following storage media: volatile memory, non-volatile memory, or other types of storage media. The volatile memory can be RAM (Random Access Memory), and the non-volatile memory can be flash memory, a storage drive (such as a hard disk drive), a solid-state drive, or a storage disk (such as an optical disc, DVD, etc.).

[0100] The foregoing has described specific embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0101] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention filed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not claimed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the claims.

[0102] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims. The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An authentication method based on a zero-trust network security architecture, wherein the zero-trust network security architecture includes a client, a control terminal, and a gateway, the client communicates with the gateway through the control terminal, and the method is used for the gateway to authenticate the logged-in user of the client, characterized in that, include: Step S1: After the client is successfully authenticated by the control terminal, the gateway receives the SPA message sent by the client and parses it to obtain the authentication information; The authentication information includes the client's first IP address and first user identity identifier; Step S2: If it is determined that the first IP address has not been recorded, when there is a second user identity identifier in the recorded user information set that is the same as the first user identifier, confirm whether the user has passed authentication; wherein, the user information set represents several user information that has passed the authentication of the control terminal, and the user information includes the second user identity identifier and the second IP address that have passed the authentication of the control terminal, and the second IP address is bound and stored with the second user identity identifier; Add the binding information of the first IP address and the second IP address to the IP information set; Replace the second IP address in the user information set with the first IP address.

2. The method according to claim 1, characterized in that, The user information also includes heart rate time, and the method further includes: After the gateway authenticates the user, it receives the heartbeat packet from the client forwarded by the control terminal. The heartbeat packet carries the client's third IP address. When the third IP address is the same as the second IP address, the heartbeat time of the user in the user information set is updated based on the first IP address bound to the second IP address in the IP information set; wherein, the heartbeat time represents the online status of the user, and when the heartbeat time exceeds a first preset threshold, the gateway takes the user offline.

3. The method according to claim 2, characterized in that, Also includes: If the third IP address is different from the second IP address, repeat steps S1 to S2.

4. The method according to claim 1, characterized in that, Also includes: The IP information set also includes an aging time. When the aging time exceeds a second preset threshold, the IP address corresponding to the aging time is deleted.

5. An authentication device based on a zero-trust network security architecture, the zero-trust network security architecture including a client, a control terminal, and a gateway, wherein the client communicates with the gateway through the control terminal, and the device is used for the gateway to authenticate the logged-in user of the client, characterized in that, include: The parsing unit is used to, after the client is authenticated by the control terminal, receive the SPA message sent by the client and parse it to obtain the authentication information; The authentication information includes the client's first IP address and first user identity identifier; An authentication unit is configured to, when it is determined that the first IP address has not been recorded, confirm whether the user has passed authentication when a second user identity identifier identical to the first user identifier exists in the set of recorded user information; wherein, the user information set represents a plurality of user information that has passed the authentication of the control terminal, and the user information includes a second user identity identifier and a second IP address that have passed the authentication of the control terminal, wherein the second IP address is bound and stored with the second user identity identifier; The IP binding unit is used to add the binding information of the first IP address and the second IP address to the IP information set; The IP update unit is used to replace the second IP address in the user information set with the first IP address.

6. The apparatus according to claim 5, characterized in that, The user information also includes heart rate time, and the device further includes: A heartbeat receiving unit is used to receive a heartbeat packet from the client forwarded by the control terminal after the gateway has authenticated the user. The heartbeat packet carries the third IP address of the client. The heartbeat update unit is used to update the heartbeat time of the user in the user information set based on the first IP address bound to the second IP address in the IP information set when the third IP address is the same as the second IP address; wherein the heartbeat time represents the online status of the user, and when the heartbeat time exceeds a first preset threshold, the gateway takes the user offline.

7. A zero-trust network security architecture, characterized in that, It includes a client, a control terminal, and a gateway, wherein the gateway is used to perform the method as described in any one of claims 1 to 4 to authenticate the logged-in user of the client.

8. A network device, characterized in that, The network device includes a processor and a machine-readable storage medium storing machine-executable instructions that can be executed by the processor, which in turn causes the processor to perform the authentication method based on a zero-trust network security architecture as described in any one of claims 1-4.

Images