A service processing method and related device based on software-defined perimeter (SDP)

Abstract

The application discloses a service processing method based on a software-defined perimeter (SDP) and a related device. In the method, after a user equipment is authenticated by SPA and identity authentication on an SDP control system in a certain area, the SDP control system in the area sends a user token corresponding to the user equipment to an SDP control system in another area. The SDP control system in the other area obtains a device identifier of the user equipment and a user group to which the user equipment belongs by analyzing the user token, determines a service access right of the user equipment based on the user group, and issues a corresponding service access list to an SDP gateway in the other area, so that the user equipment can access service resources through the SDP gateway in different areas. According to the method, the user equipment does not need to perform SPA authentication multiple times when accessing service resources across areas, the process of the user equipment accessing service resources is simplified, and the efficiency of the user equipment accessing service resources is improved.

Description

Technical Field

[0001] This application relates to the field of network technology, and in particular to a service processing method and related apparatus based on SDP. Background Technology

[0002] Software Defined Perimeter (SDP) is a security framework developed by the Cloud Security Alliance that controls access to resources based on the identity of the endpoint. Under the SDP architecture, each endpoint device must undergo Single Packet Authorization (SPA) authentication before connecting to the server, ensuring that each endpoint device is allowed to access. The core idea of ​​SDP is to hide core network assets and infrastructure through the SDP architecture, preventing these assets and infrastructure from being directly exposed to the Internet and thus protecting them from external security threats.

[0003] Typically, an SDP system includes an SDP controller and an SDP gateway. The SDP controller only notifies the SDP gateway to open the specified service access port for the terminal device after receiving the SPA data packet sent by the SDP client deployed on the terminal device and verifying the validity of the SPA data packet.

[0004] Currently, SDP systems are geographically deployed, with different SDP systems typically deployed in different regions. When a terminal device is authenticated as an SPA in one SDP system, if it needs to access service resources protected by another SDP system, it often needs to re-authenticate as an SPA in that different SDP system. This makes the process of accessing service resources cumbersome and inefficient. Summary of the Invention

[0005] This application provides a service processing method based on SDP, which enables user equipment to access service resources across regions without performing multiple SPA authentications, thus simplifying the process of user equipment accessing service resources and improving the efficiency of user equipment accessing service resources.

[0006] This application provides a service processing method based on SDP (Software as a Provider Interface). The method is applied to a network system including a first SDP system and a second SDP system. The first SDP system includes a first control system and a first SDP gateway, and the second SDP system includes a second control system and a second SDP gateway. The first and second SDP systems are deployed in different areas. The method includes: the second control system receiving a user token sent by the first control system, wherein the user token is sent by the first control system after the user equipment has passed SPA (Service Provider Interface) authentication and identity authentication on the first control system, and the user token is generated by the first control system based on the device identifier of the user equipment and the user group to which the user equipment belongs.

[0007] Then, the second control system parses the user token to obtain the device identifier and user group.

[0008] The second control system provides a service access list to the second SDP gateway according to the service access permissions corresponding to the user group, so that the second SDP gateway can process service access requests from user equipment according to the service access list, wherein the service access list is used to indicate the services that user equipment can access.

[0009] In this solution, after a user device (UGC) successfully completes SPA authentication and identity verification on an SDP control system in a specific region, the SDP control system in that region sends the user token corresponding to the UAC to SDP control systems in other regions. The SDP control systems in other regions then parse the user token to obtain the UAC's device identifier and its associated user group. Based on the user group, they determine the UAC's service access permissions and issue the corresponding service access list to the SDP gateways in other regions, thus ensuring that the UAC can access service resources through SDP gateways in different regions. Based on this solution, UACs do not need to perform multiple SPA authentications when accessing service resources across regions, simplifying the process and improving the efficiency of UAC access to service resources.

[0010] Optionally, the method further includes: the second control system receiving an updated security score sent by the first control system, wherein the updated security score is sent by the first control system after detecting an update to the security score related to the user equipment. The updated security score indicates the current security status of the user equipment. A higher updated security score indicates a more secure user equipment; a lower updated security score indicates a less secure user equipment.

[0011] The second control system determines the new service access permissions corresponding to the user equipment based on the updated security score, and sends a permission change message to the second SDP gateway. The permission change message is used to instruct the second SDP gateway to change the service access list.

[0012] In this scheme, the updated security score is used to indicate the current security status of the user equipment, so that the second control system can adjust the current business access permissions of the user equipment according to the current security status of the user equipment, thereby ensuring that user equipment with lower security cannot access some highly private businesses.

[0013] Optionally, the updated security score is determined based on the user device's security information and / or the traffic sent by the user device.

[0014] Optionally, the service access request sent by the user equipment includes the device identifier, the user token, and the target service that the user equipment requests to access.

[0015] The second control system receives an authentication request from the second SDP gateway. This authentication request is sent by the second SDP gateway after it has verified the user equipment's service access request against the service access list. The authentication request includes the user token and the target service. Then, the second control system returns the authentication result corresponding to the authentication request to the second SDP gateway, enabling the second SDP gateway to accept or reject the service access request based on the authentication result.

[0016] In this solution, the dual authentication based on the second SDP gateway and the second control system can effectively ensure that user equipment can legally access target services and improve the security of service access.

[0017] Optionally, the first control system includes a first SDP controller and a first authentication system, and the second control system includes a second SDP controller and a second authentication system. The second control system receives user tokens sent by the first control system, specifically including: the second authentication system receiving user tokens sent by the first authentication system.

[0018] The second control system provides a service access list to the second SDP gateway based on the service access permissions corresponding to the user group. Specifically, this includes: the second SDP controller receiving a device identifier sent by the first SDP controller; the second SDP controller sending a first message to the second authentication system, the first message including the device identifier, the first message being used to request service access permissions for the user device; the second authentication system sending a service access list to the second SDP controller based on the first message and the service access permissions corresponding to the user group; and the second SDP controller sending the service access list to the second SDP gateway.

[0019] Optionally, the first control system includes a first SDP controller and a first authentication system, and the second control system includes a second SDP controller and a second authentication system. The user token is generated based on the device identifier of the user equipment, the user group to which the user equipment belongs, and the user identifier corresponding to the user equipment. The second control system receives the user token sent by the first control system, specifically including: the second authentication system receiving the user token sent by the first authentication system.

[0020] The second control system provides a service access list to the second SDP gateway based on the service access permissions corresponding to the user group. Specifically, this includes: the second SDP controller receiving a device identifier and a user identifier sent by the first SDP controller; the second SDP controller sending a first message to the second authentication system, the first message including the device identifier and the user identifier, the first message being used to request service access permissions for the user device; the second authentication system sending the service access list to the second SDP controller based on the first message and the service access permissions corresponding to the user group; and the second SDP controller sending the service access list to the second SDP gateway.

[0021] Optionally, the first control system includes a first SDP controller, a first authentication system, and a first environmental perception system, and the second control system includes a second SDP controller, a second authentication system, and a second environmental perception system.

[0022] The second control system receives the updated security score sent by the first control system. Specifically, this includes: the second environmental perception system receiving the updated security score sent by the first environmental perception system, the updated security score being sent after the first environmental perception system detects an update in the security score related to the user equipment; the second control system determining the new service access permissions corresponding to the user equipment based on the updated security score and sending an access permission change message to the second SDP gateway, including: the second environmental perception system sending the updated security score to the second authentication system; the second authentication system determining the new service access permissions corresponding to the user equipment based on the updated security score and sending an access permission change message to the second SDP controller; and the second SDP controller sending an access permission change message to the second SDP gateway, the access permission change message being used to instruct the second SDP gateway to change the service access list.

[0023] Optionally, the updated security score is determined by the first environmental perception system based on the device score sent by the first SDP controller and / or the traffic sent by the user equipment. The device score is determined by the first SDP controller based on the security information of the user equipment.

[0024] Optionally, the first SDP gateway and the second SDP gateway are responsible for accessing different business services.

[0025] A second aspect of this application provides a service processing method based on SDP (Software as a Provider Interface). This method is applied to an SDP system, which includes a control system, a first SDP gateway, and a second SDP gateway deployed in different areas. The method includes: after a user device completes SPA authentication and identity authentication on the control system, the control system determines the user device's service access permissions; the control system generates a first service access list based on the service access permissions.

[0026] The first service access list is used to indicate the services that the user equipment can access through the first SDP gateway, and the second service access list is used to indicate the services that the user equipment can access through the first SDP gateway.

[0027] Services, the second service access list is used to indicate the services that user equipment can access through the second SDP gateway; control system

[0028] Send the first service access list to the first SDP gateway and the second service access list to the second SDP gateway.

[0029] Optionally, the SDP-based service processing method further includes: controlling the system to obtain security information sent by the user equipment; controlling the system to determine the security score of the user equipment based on the security information and / or the traffic sent by the user equipment; controlling the system to determine the new service access permissions corresponding to the user equipment based on the security score, and sending a first permission change message to the first SDP gateway and a second permission change message to the second SDP gateway, wherein the first permission change message is used to instruct the first SDP gateway to change the first service access list, and the second permission change message is used to instruct the second SDP gateway to change the second service access list.

[0030] Optionally, the control system includes an SDP controller and an authentication system. The control system determines the service access permissions of user equipment, specifically including: the authentication system determining the service access permissions of user equipment based on the user group to which the user equipment belongs.

[0031] The control system generates a first service access list and a second service access list based on service access permissions. Specifically, this includes the authentication system generating the first service access list and the second service access list based on service access permissions.

[0032] The control system sends a first service access list to the first SDP gateway and a second service access list to the second SDP gateway. Specifically, this includes: the authentication system sending the first service access list and the second service access list to the SDP controller; and the SDP controller sending the first service access list to the first SDP gateway and the second service access list to the second SDP gateway.

[0033] Optionally, the control system also includes an environmental sensing system. The SDP-based service processing method further includes: the environmental sensing system receiving a device score sent by the SDP controller, the device score being determined by the SDP controller based on the user equipment's security information; the environmental sensing system determining a security score based on the device score and / or the traffic sent by the user equipment; the environmental sensing system sending the security score to the authentication system; the authentication system determining new service access permissions corresponding to the user equipment based on the security score and sending a permission change message to the SDP controller; and the SDP controller sending a permission change message to the SDP gateway, the permission change message instructing the SDP gateway to modify the service access list.

[0034] Optionally, the first SDP gateway and the second SDP gateway are responsible for accessing different business services.

[0035] A third aspect of this application provides an SDP-based service processing system. The service processing system is applied to a network system including a first SDP system and a second SDP system. The first SDP system includes a first control system and a first SDP gateway, and the second SDP system includes a service processing system and a second SDP gateway. The first and second SDP systems are deployed in different areas. The service processing system receives a user token sent by the first control system. The user token is sent by the first control system after the user equipment passes SPA authentication and identity authentication on the first control system. The user token is generated based on the device identifier of the user equipment and the user group to which the user equipment belongs. The service processing system also parses the user token to obtain the device identifier and the user group. Furthermore, the service processing system provides a service access list to the second SDP gateway according to the service access permissions corresponding to the user group, so that the second SDP gateway processes service access requests from the user equipment according to the service access list. The service access list indicates the services that the user equipment can access.

[0036] Optionally, the service processing system is also used to receive the updated security score sent by the first control system. The updated security score is sent by the first control system after detecting an update in the security score related to the user equipment. The service processing system determines the new service access permissions corresponding to the user equipment based on the updated security score and sends a permission change message to the second SDP gateway. The permission change message is used to instruct the second SDP gateway to change the service access list.

[0037] Optionally, the updated security score is determined based on the user device's security information and / or the traffic sent by the user device.

[0038] Optionally, the service access request includes a device identifier, a user token, and the target service requested by the user device. The service processing system is also used to receive an authentication request sent by the second SDP gateway. The authentication request is sent after the second SDP gateway verifies the user device's service access request according to the service access list. The authentication request includes the user token and the target service. The service processing system is also used to return the authentication result of the authentication request to the second SDP gateway, so that the second SDP gateway can accept or reject the service access request based on the authentication result.

[0039] Optionally, the first control system includes a first SDP controller and a first authentication system, and the service processing system includes a second SDP controller and a second authentication system; the second authentication system is used to receive a user token sent by the first authentication system; the second SDP controller is used to receive a device identifier sent by the first SDP controller; the second SDP controller is used to send a first message to the second authentication system, the first message including the device identifier, the first message being used to request service access permissions for the user device; the second authentication system is used to send a service access list to the second SDP controller according to the first message and the service access permissions corresponding to the user group; the second SDP controller is used to send the service access list to the second SDP gateway.

[0040] Optionally, the first control system includes a first SDP controller and a first authentication system, and the service processing system includes a second SDP controller and a second authentication system. The user token is generated based on the user equipment's device identifier, the user group to which the user equipment belongs, and the user identifier corresponding to the user equipment. The second authentication system receives the user token sent by the first authentication system. The second SDP controller receives the device identifier and user identifier sent by the first SDP controller. The second SDP controller sends a first message to the second authentication system, the first message including the device identifier and user identifier, and the first message requests service access permissions for the user equipment. The second authentication system sends a service access list to the second SDP controller based on the first message and the service access permissions corresponding to the user group. The second SDP controller sends the service access list to the second SDP gateway.

[0041] Optionally, the first control system includes a first SDP controller, a first authentication system, and a first environmental awareness system, and the service processing system includes a second SDP controller, a second authentication system, and a second environmental awareness system. The second environmental awareness system is used to receive an updated security score sent by the first environmental awareness system, which is sent after the first environmental awareness system detects an update in the security score related to the user equipment. The second environmental awareness system is used to send the updated security score to the second authentication system. The second authentication system is used to determine the new service access permissions corresponding to the user equipment based on the updated security score and send a permission change message to the second SDP controller. The second SDP controller is used to send a permission change message to the second SDP gateway, which instructs the second SDP gateway to change the service access list.

[0042] Optionally, the updated security score is determined by the first environmental perception system based on the device score sent by the first SDP controller and / or the traffic sent by the user equipment. The device score is determined by the first SDP controller based on the security information of the user equipment.

[0043] Optionally, the first SDP gateway and the second SDP gateway are responsible for accessing different business services.

[0044] A fourth aspect of this application provides an SDP-based service processing system, characterized in that the service processing system is applied to an SDP system, the SDP system including the service processing system, a first SDP gateway, and a second SDP gateway, the first SDP gateway and the second SDP gateway being deployed in different areas; after a user equipment passes SPA authentication and identity authentication on the service processing system, the service processing system is used to determine the user equipment's service access permissions; the service processing system is used to generate a first service access list and a second service access list based on the service access permissions, the first service access list indicating the services that the user equipment can access through the first SDP gateway, and the second service access list indicating the services that the user equipment can access through the second SDP gateway; the service processing system is used to send the first service access list to the first SDP gateway and the second service access list to the second SDP gateway.

[0045] Optionally, the service processing system is used to obtain security information sent by the user equipment; the service processing system is used to determine the security score of the user equipment based on the security information and / or the traffic sent by the user equipment; the service processing system is used to determine the new service access permissions corresponding to the user equipment based on the security score, and send a first permission change message to the first SDP gateway and a second permission change message to the second SDP gateway, wherein the first permission change message is used to instruct the first SDP gateway to change the first service access list, and the second permission change message is used to instruct the second SDP gateway to change the second service access list.

[0046] Optionally, the service processing system includes an SDP controller and an authentication system; the authentication system is used to determine the service access permissions of the user equipment according to the user group to which the user equipment belongs; the authentication system is used to generate a first service access list and a second service access list according to the service access permissions; the authentication system is used to send the first service access list and the second service access list to the SDP controller; the SDP controller is used to send the first service access list to the first SDP gateway and the second service access list to the second SDP gateway.

[0047] Optionally, the service processing system also includes an environment awareness system; the environment awareness system receives device scores sent by the SDP controller, which are determined by the SDP controller based on the security information of the user equipment; the environment awareness system determines a security score based on the device scores and / or the traffic sent by the user equipment; the environment awareness system sends the security score to the authentication system; the authentication system determines the new service access permissions corresponding to the user equipment based on the security score and sends a permission change message to the SDP controller; the SDP controller sends the permission change message to the SDP gateway, which instructs the SDP gateway to change the service access list.

[0048] Optionally, the first SDP gateway and the second SDP gateway are responsible for accessing different business services.

[0049] A fifth aspect of this application provides a network device including a processor and a memory; wherein the memory is used to store program code, and the processor is used to call the program code in the memory to cause the network device to perform a method as described in any of the embodiments of the first or second aspect.

[0050] The sixth aspect of this application provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform a method as described in any of the embodiments of the first or second aspect.

[0051] The seventh aspect of this application provides a computer program product that, when run on a computer, causes the computer to perform a method as described in any of the embodiments of the first or second aspect.

[0052] This application provides a chip, including one or more processors. Part or all of the processors are used to read and execute computer instructions stored in a memory to perform the methods in any possible implementation of any of the above aspects. Optionally, the chip also includes a memory. Optionally, the chip also includes a communication interface, with the processor connected to the communication interface. The communication interface is used to receive data and / or information to be processed, the processor obtains the data and / or information from the communication interface, processes the data and / or information, and outputs the processing results through the communication interface. Optionally, the communication interface is an input / output interface or a bus interface. The methods provided in this application are implemented by one chip or by multiple chips working together.

[0053] The solutions provided in the third to eighth aspects above are used to implement or cooperate with the methods provided in the first or second aspects above, and therefore can achieve the same or corresponding beneficial effects as the first or second aspects, which will not be elaborated here. Attached Figure Description

[0054] Figure 1 A schematic diagram illustrating a network deployment scenario provided in an embodiment of this application;

[0055] Figure 2 A flowchart illustrating a service processing method based on SDP provided in an embodiment of this application;

[0056] Figure 3 A flowchart illustrating a second control system for sending permission change messages based on security scoring, provided as an embodiment of this application;

[0057] Figure 4 A schematic diagram illustrating the process of a first control system for detecting whether the security score of a user equipment has been updated, as provided in an embodiment of this application.

[0058] Figure 5 A schematic diagram illustrating another network deployment scenario provided in this application embodiment;

[0059] Figure 6 A flowchart illustrating another SDP-based service processing method provided in this application embodiment;

[0060] Figure 7 A schematic diagram illustrating another network deployment scenario provided in this application embodiment;

[0061] Figure 8 A flowchart illustrating another SDP-based service processing method provided in this application embodiment;

[0062] Figure 9 This is a schematic diagram of the structure of a network device 900 provided in an embodiment of this application. Detailed Implementation

[0063] The embodiments of this application are described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. As those skilled in the art will understand, with the development of technology and the emergence of new scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0064] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0065] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0066] The following is an explanation of some terms and concepts involved in the embodiments of this application.

[0067] (1) SPA Certification

[0068] SPA authentication is an authentication technology used in SDP systems. During SPA authentication, the client combines the timestamp of the packet, the client's Internet Protocol (IP) address, and the service password to generate a hash value. The client then packages this hash value into a User Datagram Protocol (UDP) packet and sends it to the server to specify the access port. The server then generates a hash value based on the timestamp in the received UDP packet, the client's IP address, and the service password stored on the server, and compares it with the hash value in the received UDP packet. If the hash value generated by the server matches the received hash value, the server opens the requested service port for the client. Furthermore, the server records the last validly authorized packet received to prevent attackers from sending old packets for replay attacks.

[0069] (2) Syslog

[0070] Syslog, often referred to as system log or system record, is a standard used to transmit system log messages or system record messages over the Internet. A Syslog message is a type of message used to transmit system logs or system records.

[0071] The above describes the terminology and concepts involved in the embodiments of this application. The following will describe the application scenarios of the SDP-based service processing method provided in the embodiments of this application.

[0072] Please see Figure 1, Figure 1 This is a schematic diagram of a network deployment scenario provided in an embodiment of this application.

[0073] like Figure 1 As shown, a first SDP system is deployed in Area 1. The first SDP system includes a first SDP gateway and a first control system. The first SDP gateway is connected to the service server in Area 1 and can control user equipment access to the service server in Area 1.

[0074] A second SDP system is deployed in Region 2, which includes a second SDP gateway and a second control system. The second SDP gateway is connected to the service servers in Region 2 and can control user equipment access to the service servers in Region 2. The service servers in Region 1 and Region 2 are used to provide one or more service offerings.

[0075] After the user equipment in Region 1 passes the SPA authentication and identity authentication on the first control system, the first control system provides the first SDP gateway with the service access list of the user equipment in Region 1, so that the user equipment in Region 1 can access the service server in Region 1 through the first SDP gateway.

[0076] Furthermore, after the user equipment in Region 1 passes the SPA authentication and identity authentication on the first control system, the second control system executes the business processing method provided in the embodiments of this application, thereby enabling the user equipment in Region 1 to access the business server in Region 2 across domains through the second SDP gateway without performing SPA authentication.

[0077] The above describes the application scenarios of the SDP-based service processing method provided in the embodiments of this application. The following will describe in detail the specific implementation process of the SDP-based service processing method provided in the embodiments of this application.

[0078] Please see Figure 2 , Figure 2 This is a flowchart illustrating a service processing method based on SDP, provided as an embodiment of this application. Figure 2 As shown, the SDP-based service processing method includes the following steps 201-203. Among them, Figure 2 The SDP-based service processing method shown is applied to Figure 1 The network system shown includes a first SDP system and a second SDP system.

[0079] Step 201: The second control system receives a user token sent by the first control system. The user token is sent by the first control system after the user equipment passes SPA authentication and identity authentication on the first control system. The user token is generated based on the device identifier of the user equipment and the user group to which the user equipment belongs.

[0080] In this embodiment, SPA authentication by the user equipment on the first control system means that the SPA message sent by the user equipment to the first control system has been successfully authenticated. Identity authentication by the user equipment on the first control system means that the first control system confirms that the identity of the user logged into the user equipment has been authenticated.

[0081] After the user equipment passes SPA authentication and identity verification on the first control system, the first control system generates a user token based on the user equipment's device identifier and the user group to which the user equipment belongs, and sends the user token to the second control system. The device identifier is a unique identifier generated by the first control system based on the user equipment's information. The user group to which the user equipment belongs is determined by the first control system based on the identity of the user logged into the user equipment. Furthermore, since the user equipment and the first control system are located in the same area, the user equipment passes SPA authentication and identity verification on the first control system.

[0082] For example, the user token is obtained by the first control system encrypting the device identifier of the user equipment and the user group to which the user equipment belongs using symmetric or asymmetric encryption. For instance, assuming the device identifier of the user equipment is 2bc17646142b404b9895 and the user group of the user equipment is a0000000035246, the user token obtained by encrypting the device identifier of the user equipment and the user group to which the user equipment belongs would be f35989e8fea1.

[0083] Step 202: The second control system parses the user token to obtain the device identifier and user group.

[0084] In this embodiment, the second control system has a pre-set key for parsing user tokens. Thus, after receiving a user token from the first control system, the second control system parses the token using the pre-set key to obtain the user device's identifier and the user group to which the user device belongs.

[0085] For example, when the first control system obtains the user token through symmetric encryption, the key used to decrypt the user token in the second control system is the same as the key used to encrypt the user token in the first control system. When the first control system obtains the user token through asymmetric encryption, the first control system encrypts the user token using a public key, while the second control system decrypts the user token using a private key.

[0086] Step 203: The second control system provides a service access list to the second SDP gateway according to the service access permissions corresponding to the user group, so that the second SDP gateway can process service access requests from user equipment according to the service access list. The service access list is used to indicate the services that user equipment can access.

[0087] Optionally, the second control system has a pre-set service permission mapping table, which records the service access permissions corresponding to each user group. For example, the pre-set service permission mapping table in the second control system is shown in Table 1.

[0088] Table 1

[0089] User Group Business access permissions R&D team Business 1, Business 2, Business 3 Procurement Group Business 4 Human Resources Group Business 5 Legal Team Business 6 … …

[0090] After the second control system parses the user token to obtain the user group to which the user device belongs, it can determine the business access permissions corresponding to the user group to which the user device belongs by querying a preset business permission mapping table. Since there is a correspondence between user devices and their respective user groups, and each user group has corresponding business access permissions, the second control system can generate a business access list based on the business access permissions of the user group to which the user device belongs. This business access list indicates the business access permissions corresponding to the user device, i.e., the services that the user device can access. For example, as shown in Table 1, assuming the user group to which the user device belongs is the R&D group, the business access list indicates that the user device can access services 1, 2, and 3.

[0091] After the second control system provides the service access list to the second SDP gateway, when a user equipment sends a service access request to the second SDP gateway across regions, the second SDP gateway can process the service access request sent by the user equipment according to the service access list provided by the second control system.

[0092] It should be noted that the above describes how, after a user device (PDP) passes SPA authentication and identity authentication in the first control system, the first control system sends a user token to the second control system, enabling the PDP to access services across domains through the second SDP gateway without performing SPA authentication. In practical applications, when other PDPs pass SPA authentication and identity authentication in the second control system, the second control system can also send a user token to the first control system, enabling other PDPs to access services across domains through the first SDP gateway without performing SPA authentication. This embodiment will not elaborate on this further.

[0093] In this solution, after a user device (UGC) successfully completes SPA authentication and identity verification on an SDP control system in a specific region, the SDP control system in that region sends the user token corresponding to the UAC to SDP control systems in other regions. The SDP control systems in other regions then parse the user token to obtain the UAC's device identifier and its associated user group. Based on the user group, they determine the UAC's service access permissions and issue the corresponding service access list to the SDP gateway, thus ensuring that the UAC can access service resources through SDP gateways in different regions. Based on this solution, UACs do not need to perform multiple SPA authentications when accessing service resources across regions, simplifying the process and improving the efficiency of UAC access to service resources.

[0094] Optionally, the service access request sent by the user equipment to the second SDP gateway includes the user equipment's device identifier, user token, and the target service requested by the user equipment. The second SDP gateway queries the service access list to determine whether the user equipment has permission to access the target service.

[0095] If the second SDP gateway determines that the user equipment has permission to access the target service based on the service access list, the service access request on behalf of the user equipment passes the verification of the service access list on the second SDP gateway. Therefore, the second SDP gateway sends an authentication request to the second control system. The authentication request sent by the second SDP gateway to the second control system includes the user token and the target service; this authentication request is used to verify whether the user equipment has permission to access the target service.

[0096] Upon receiving an authentication request, the second control system determines whether the user corresponding to the user token has permission to access the target service based on the user token and the target service in the authentication request. It then returns the authentication result to the second SDP gateway, enabling the second SDP gateway to accept or reject the service access request based on the authentication result. For example, the second control system parses the user token to obtain the user device's device identifier and user group, and determines whether the user corresponding to the user token has permission to access the target service by querying the access permissions corresponding to the user group.

[0097] Furthermore, if the second SDP gateway determines, based on the service access list, that the user equipment does not have permission to access the target service, the second SDP will discard the service access request sent by the user equipment, thereby denying the user equipment access to the target service.

[0098] In simple terms, the second SDP gateway's verification of service access requests based on the service access list is essentially a legitimacy check on the user device, verifying whether the user device has the necessary permissions to access the target service. After confirming that the user device has the required permissions, the second SDP gateway sends an authentication request, including the user token, to the second control system. This allows the second control system to further verify whether the user logged in on the user device has the necessary permissions. This dual verification by the second SDP gateway and the second control system effectively ensures legitimate access to the target service by the user device, improving service access security.

[0099] For example, suppose user A has permission to access the target service, while user B does not. After user A logs in on the user device and passes SPA authentication and identity authentication on the first control system, the second control system executes steps 201-203 above, creating a service access list on the second SDP gateway associated with the user device's device identifier. If user B logs in on the same user device and sends a service access request to the second SDP gateway to access the target service, then, if the service access list on the second SDP gateway is not updated in time, user B's service access request sent through the user device will pass the second SDP gateway's verification. In this case, the second control system receives the authentication request sent by the second SDP gateway, confirms that user B does not actually have permission to access the target service, and then returns an authentication result to the second SDP gateway, instructing the second SDP gateway to reject user B's service access request sent through the user device.

[0100] The above describes the process by which the second control system provides a service access list to the second SDP gateway after the user equipment passes SPA authentication and identity authentication. For ease of understanding, the following will detail the process by which the user equipment passes SPA authentication and identity authentication on the first control system.

[0101] First, the user downloads the SDP client by accessing the SDP client download page on their device. This SDP client enables communication between the user device and the SDP system. After the SDP client is installed on the user device, the user completes the user registration process on the SDP client. During registration, the user enters their personal information, which the SDP client then relays to the first control system. For example, the user enters their username and job title within the company. Additionally, the SDP client uploads user device information to the first control system, such as memory, hard drive, and processor information. The first control system generates a unique device identifier for the user device based on the user device information relayed by the SDP client and establishes a mapping between the user's personal information and the device identifier.

[0102] Furthermore, the first control system can also determine the user group to which the user belongs based on the user's identity information, whereby the user group has corresponding business access permissions. For example, the first control system determines that the user belongs to the R&D group based on the user's username and job position within the company, thereby determining the user's corresponding business access permissions as Business 1, Business 2, and Business 3.

[0103] In simple terms, after a user completes registration, the first control system obtains the user's identity information, the information of the user device the user's device is logged into, the user group the user belongs to, and the user's corresponding business access permissions, and establishes a correspondence between these various pieces of information. For example, the correspondence established by the first control system is specifically: Username—Device Identifier—User Group—Business Access Permission. In this way, the first control system can determine the corresponding user group and business access permissions based on the username or device identifier.

[0104] After user registration, the user enters their username and password on the SDP client on their device to initiate SPA authentication. The username and password entered by the user can be issued by the enterprise administrator to uniquely identify the user. Specifically, the SDP client generates an SPA message based on the user's entered username and password and sends the SPA message to the first control system.

[0105] Upon receiving the SPA message, the first control system verifies it. If the SPA message passes verification, the first control system determines that the user equipment has passed SPA authentication. Therefore, the first control system performs user identity authentication on the account and password carried in the SPA message. If the account and password in the SPA message pass user identity authentication, the first control system generates a user token based on the device identifier of the user equipment that sent the SPA message and the user group to which the user equipment belongs.

[0106] After the user equipment passes SPA authentication and identity authentication, the first control system generates a service access list based on the user group to which the user equipment belongs and provides the service access list to the first SDP gateway, enabling the first SDP gateway to process the user equipment's service access requests based on the service access list. Furthermore, the first control system returns a user token to the SDP client on the user equipment to notify the SDP client that it has passed SPA authentication and identity authentication and to enable the SDP client to access the corresponding services based on the user token.

[0107] Optionally, the first SDP gateway and the second SDP gateway are responsible for accessing different service providers. In this case, the service access list issued by the first control system to the first SDP gateway is different from the service access list issued by the second control system to the second SDP gateway. Specifically, the service access list issued by the first control system to the first SDP gateway indicates the service providers that the user equipment can access among the service providers accessed by the first SDP gateway, while the service access list issued by the second control system to the second SDP gateway indicates the service providers that the user equipment can access among the service providers accessed by the second SDP gateway.

[0108] For example, suppose that the services that a user equipment has access to across the entire network system include service 1, service 2, and service 3. The first SDP gateway is responsible for accessing service 1 and service 2, and the second SDP gateway is responsible for accessing service 3. Then, the service access list issued by the first control system to the first SDP gateway indicates that the user equipment can access services 1 and 2; the service access list issued by the second control system to the second SDP gateway indicates that the user equipment can access service 3.

[0109] The above describes the process by which the first and second control systems provide service access lists to their respective SDP gateways. The following will describe the process by which the first and second control systems instruct their respective SDP gateways to update the service access lists.

[0110] Optionally, after the second control system sends the service access list to the second SDP gateway, the second control system receives the updated security score sent by the first control system. The updated security score is sent by the first control system after detecting an update to the security score related to the user equipment. The updated security score indicates the current security status of the user equipment. A higher updated security score indicates a more secure user equipment; a lower updated security score indicates a less secure user equipment.

[0111] Then, the second control system determines the new service access permissions corresponding to the user equipment based on the updated security score and sends a permission change message to the second SDP gateway. This permission change message instructs the second SDP gateway to modify the service access list. Since the updated security score indicates the current security status of the user equipment, the second control system can adjust the current service access permissions of the user equipment according to its current security status, thereby ensuring that user equipment with lower security cannot access certain highly private services.

[0112] For example, the second control system has pre-defined access conditions for various services. For instance, the access conditions for services 1 and 2 are a security score of 80 or higher for the user equipment, and the access condition for service 3 is a security score of 90 or higher for the user equipment. Before the second control system receives the updated security score, the service access list provided to the second SDP gateway indicates that the user equipment can access services 1, 2, and 3. After the second control system receives the updated security score, based on the updated security score of 85, the second control system determines that the user equipment's service access permissions are services 1 and 2. Therefore, the second control system sends a permission transformation message to the second SDP gateway, instructing the second SDP gateway to change the services accessible to the user equipment in the service access list to services 1 and 2.

[0113] Similarly, after the first control system detects an update to the security score associated with the user equipment, it also determines the new service access permissions corresponding to the user equipment based on the updated security score and sends a permission change message to the first SDP gateway to instruct the first SDP gateway to change the service access list.

[0114] Optionally, the updated security score is determined based on the user equipment's security information and / or the traffic sent by the user equipment. The user equipment's security information indicates the security status of the user equipment itself. For example, this includes whether the user equipment has high-risk ports and whether the system running on the user equipment has high-risk vulnerabilities. The traffic sent by the user equipment indicates its behavior on the network. By analyzing the traffic sent by the user equipment, the security status of the user equipment in the network environment can be determined; for example, whether the user equipment is currently being hijacked by an attacker and continuously sending attack packets.

[0115] In this embodiment, after the user equipment passes SPA authentication and identity authentication, the first control system generates an initial security score for the user equipment, which is, for example, 100 points. Then, the first control system continuously monitors whether the user equipment's security score has been updated, and when the user equipment's security score has been updated, it sends the updated security score to the second control system.

[0116] Furthermore, after a user equipment's security score has been updated, the first control system retains the updated security score and continues to monitor whether the user equipment's security score has been updated again, so as to notify the second control system when the user equipment's security score is updated again. In other words, every time the user equipment's security score is updated, the first control system sends the updated security score to the second control system so that the second control system can determine the user equipment's latest service access permissions.

[0117] Similarly, after receiving the security score sent by the first control system, the second control system saves the received security score locally and determines whether to update the user equipment's service access permissions by comparing it with the previously saved security score locally.

[0118] For example, please refer to Figure 3 , Figure 3 This is a flowchart illustrating a second control system that sends permission change messages based on security scoring, as provided in an embodiment of this application. Figure 3 As shown, the process of the second control system sending permission change messages based on security scores includes the following steps 301-306.

[0119] Step 301: The second control system receives the safety score sent by the first control system.

[0120] Step 302: The second control system checks whether a security score is stored locally.

[0121] Step 303: If the second control system does not have a safety score stored locally, the second control system adds a safety score locally.

[0122] Step 304: If the second control system has a security score stored locally, the second control system determines whether the local security score is the same as the received security score.

[0123] Step 305: If no security score is stored locally, or if the local security score is different from the received security score, the second control system sends an access control message to the second SDP gateway based on the received security score.

[0124] Specifically, the second control system determines the new service access permissions corresponding to the user equipment based on the received security score, and sends a permission change message to the second SDP gateway to instruct the second SDP gateway to change the service access permissions corresponding to the user equipment in the service access list to the new service access permissions.

[0125] Furthermore, if the local security score differs from the received security score, the second control system updates the local security score based on the received security score, so that the second control system can store the latest security score locally.

[0126] Step 306: If the local security score is the same as the received security score, the second control system will not take any action, that is, the second control system will not send a permission change message to the second SDP gateway.

[0127] For ease of understanding, the following will detail the process by which the first control system detects whether the safety score of the user equipment has been updated.

[0128] Please see Figure 4 , Figure 4 This is a schematic diagram illustrating the process by which the first control system, provided in an embodiment of this application, detects whether the security score of a user equipment has been updated. Figure 4 As shown, the process by which the first control system detects whether the security score of the user equipment has been updated includes the following steps 401-404.

[0129] Step 401: The first control system sends a security policy to the SDP client on the user equipment.

[0130] After the user equipment passes SPA authentication and identity authentication, the first control system sends a security policy to the SDP client on the user equipment. This security policy is used to instruct the SDP client to collect security information of the user equipment.

[0131] Step 402: The first control system receives the security information of the user equipment sent by the SDP client.

[0132] After the SDP client collects the security information of the user equipment by executing the security policy issued by the first control system, the SDP client sends the collected security information of the user equipment to the first control system.

[0133] For example, if the security policy sent by the primary control system to the SDP client is a high-risk port policy, the SDP client executes the high-risk port policy, thereby sending high-risk port logs to the primary control system when the user equipment opens a high-risk port. The SDK client, for example, sends the high-risk port logs to the primary control system via syslog messages in the User Datagram Protocol (UDP). The high-risk port logs include the user equipment's device identifier, the threat type of the threat event on the user equipment (i.e., the high-risk port), and the threat level of the threat event.

[0134] Step 403: The first control system determines a security score based on the security information of the user equipment and / or the traffic sent by the user equipment.

[0135] In one possible example, after receiving security information about the user equipment from the SDP client, the first control system calculates the user equipment's current security score based on a predefined scoring algorithm. For instance, assuming the user equipment's default security score is 100 points, if the user equipment has a high-risk port, then the user equipment's security score needs to be deducted by 2 points, meaning the user equipment's current security score is 98 points.

[0136] In another possible example, the first control system monitors the traffic sent by the user equipment over a period of time and determines the user equipment's security score by analyzing the traffic. For example, if the traffic sent by the user equipment matches the characteristics of a certain attack behavior, the first control system determines the user equipment's security score as the security score corresponding to that attack behavior.

[0137] In another possible example, the first control system determines a device score for the user equipment based on its security information and a network environment score based on the traffic it sends. Finally, the first control system combines the device score and the network environment score to determine the user equipment's security score.

[0138] Step 404: The first control system compares the newly determined security score with the locally stored security score to detect whether the security score has been updated.

[0139] After the first control system determines the security score of the user equipment, it compares the newly determined security score with the locally stored security score to detect whether the security score has been updated. If the security score has been updated, the first control system updates the locally stored security score and sends the updated security score to the second control system. Furthermore, the first control system determines the new service access permissions corresponding to the user equipment based on the updated security score, and then sends a permission change message to the first SDP gateway.

[0140] Please see Figure 5 , Figure 5 This is a schematic diagram illustrating another network deployment scenario provided by an embodiment of this application. For example... Figure 5 As shown, Figure 5 The network system shown is Figure 1 The differences between the network systems shown are: Figure 5 The first control system includes a first SDP controller and a first authentication system, and the second control system includes a second SDP controller and a second authentication system.

[0141] The following will combine Figure 5 This document details the process by which the second SDP controller and the second authentication system in the second control system execute the SDP-based business processing method provided in the embodiments of this application.

[0142] Please see Figure 6 , Figure 6 This is a flowchart illustrating another SDP-based service processing method provided in an embodiment of this application. Figure 6 As shown, the SDP-based service processing method is applied to Figure 5 The network deployment scenario shown includes the following steps 601-604.

[0143] Step 601: The second authentication system receives the user token sent by the first authentication system.

[0144] In this embodiment, after the user equipment passes the SPA authentication on the first SDP controller and the identity authentication on the first authentication system, the second authentication system receives the user token sent by the first authentication system.

[0145] Step 602: The second authentication system parses the user token to obtain the device identifier of the user device and the user group to which the user device belongs.

[0146] In one possible example, the user token is generated based on the user device's device identifier and the user group to which the user device belongs. Therefore, the second authentication system parses the user token to obtain the user device's device identifier and the user group to which the user device belongs.

[0147] Optionally, the user token is generated based on the user device's device identifier, the user group to which the user device belongs, and the user identifier corresponding to the user device. Therefore, the second authentication system parses the user token to obtain the user device's device identifier, the user group to which the user device belongs, and the user identifier corresponding to the user device.

[0148] Step 603: The second SDP controller receives the device identifier sent by the first SDP controller.

[0149] After the user equipment passes SPA authentication on the first SDP controller and identity authentication on the first authentication system, the first authentication system sends the user equipment's service access list in Area 1 to the first SDP controller. After obtaining the service access list, the first SDP controller sends the user equipment's device identifier to the second SDP controller.

[0150] Optionally, while sending the device identifier of the user equipment to the second SDP controller, the first SDP controller also sends the user identifier corresponding to the user equipment to the second SDP controller, wherein the user identifier is used to indicate the identity of the user who logged into the user equipment.

[0151] Step 604: The second SDP controller sends a first message to the second authentication system. The first message includes the device identifier of the user equipment and is used to request the user equipment's service access permissions.

[0152] Optionally, when the second SDP controller receives the device identifier and user identifier of the user equipment sent by the first SDP controller, the first message sent by the second SDP controller to the second authentication system includes the device identifier and user identifier of the user equipment.

[0153] Understandably, when multiple users log in simultaneously on a user device, the device identifier of the user device corresponds to multiple user identifiers, and also to multiple user groups. Therefore, the second authentication method, based on the device identifier of the user device, cannot uniquely determine the user group to which the user device belongs, and thus cannot determine the user device's service access permissions. In this case, the second SDP controller sends both the device identifier and the user identifier of the user device to the second authentication system simultaneously, enabling the second authentication system to determine the service access permissions corresponding to the user device.

[0154] Step 605: The second authentication system sends a service access list to the second SDP controller based on the first message and the service access permissions corresponding to the user group.

[0155] After the second authentication system parses the user token to obtain the user device's device identifier and the user group to which the user device belongs, the second authentication system determines the user group corresponding to the user device based on the device identifier in the first message, and then determines the corresponding service access permissions for the user device. In this way, the second authentication system then sends a service access list to the second SDP controller based on the service access permissions corresponding to the user device.

[0156] Optionally, if the second authentication system parses the user token to obtain the user device's device identifier, the user group to which the user device belongs, and the user identifier corresponding to the user device, the second authentication system determines the user group corresponding to the user device based on the device identifier and user identifier in the first message, and then determines the service access permissions corresponding to the user device. In this way, the second authentication system then sends a service access list to the second SDP controller based on the service access permissions corresponding to the user device.

[0157] Step 606: The second SDP controller sends the service access list to the second SDP gateway.

[0158] After obtaining the service access list sent by the second authentication system, the second SDP controller sends the service access list to the second SDP gateway.

[0159] Optionally, in addition to the first SDP controller and the first authentication system, the first control system also includes a first environmental perception system. In addition to the second SDP controller and the second authentication system, the second control system also includes a second environmental perception system.

[0160] After the second control system provides the service access list to the second SDP gateway, the second environmental perception system receives an updated security score from the first environmental perception system. This updated security score is sent by the first environmental perception system after detecting an update in the security score related to the user equipment. Specifically, the updated security score is determined by the first environmental perception system based on the device score sent by the first SDP controller and / or the traffic sent by the user equipment. The device score is determined by the first SDP controller based on the security information of the user equipment. For details on how the updated security score is determined, please refer to the above description; it will not be repeated here.

[0161] Then, the second environmental perception system sends the updated security score to the second authentication system.

[0162] Secondly, after receiving the updated security score, the second authentication system determines the new service access permissions corresponding to the user equipment based on the updated security score and sends a permission change message to the second SDP controller.

[0163] Finally, the second SDP controller sends a permission change message to the second SDP gateway, which instructs the second SDP gateway to change the service access list.

[0164] Please see Figure 7 , Figure 7 This is a schematic diagram illustrating another network deployment scenario provided by an embodiment of this application. For example... Figure 7 As shown, Figure 7 The SDP system includes a control system, a first SDP gateway, and a second SDP gateway. The first SDP gateway is deployed in Area 1, and the second SDP gateway is deployed in Area 2, meaning they are deployed in different areas. Furthermore, both the first and second SDP gateways are connected to the control system.

[0165] Please see Figure 8 , Figure 8 This is a flowchart illustrating another SDP-based service processing method provided in an embodiment of this application. Figure 8 As shown, the SDP-based service processing method is applied to Figure 7 The network deployment scenario shown includes the following steps 801-803.

[0166] Step 801: After the user equipment passes the SPA authentication and identity authentication on the control system, the control system determines the user equipment's business access permissions.

[0167] In step 801, the control system determines the user equipment's service access permissions in the same way as described above. Figure 2 In the embodiments described above, the first control system determines the service access permissions of the user equipment in a similar manner. Please refer to the above description for details, which will not be repeated here.

[0168] Step 802: The control system generates a first service access list and a second service access list based on service access permissions. The first service access list indicates the services that the user equipment can access through the first SDP gateway, and the second service access list indicates the services that the user equipment can access through the second SDP gateway.

[0169] Optionally, when the first SDP gateway and the second SDP gateway are responsible for accessing the same service, the service access list and the second service access list generated by the control system are the same. For example, if the control system confirms that the user equipment has access to services including service 1, service 2, and service 3, and both the first SDP gateway and the second SDP gateway are responsible for accessing services 1, service 2, and service 3, the first service access list and the second service access list generated by the control system are both used to indicate that the user equipment can access services 1, service 2, and service 3.

[0170] Optionally, when the first SDP gateway and the second SDP gateway are responsible for accessing different service providers, the service access list and the service access list generated by the control system will be different. For example, if the control system confirms that the user equipment has access to services 1, 2, and 3, and assumes that the first SDP gateway is responsible for accessing services 1 and 2, and the second SDP gateway is responsible for accessing service 3, then the first service access list generated by the control system indicates that the user equipment can access services 1 and 2; the second service access list generated by the control system indicates that the user equipment can access service 3.

[0171] Step 803: The control system sends a first service access list to the first SDP gateway and a second service access list to the second SDP gateway.

[0172] In this way, the first SDP gateway can process service access requests from user equipment according to the first service access list. The second SDP gateway can also process service access requests from user equipment according to the first service access list. After the user equipment completes SPA authentication and identity authentication on the control system, it can access SDP gateways in different areas, thereby enabling service access through the SDP gateways.

[0173] Optionally, after the control system sends the first service access list to the first SDP gateway and the second service access list to the second SDP gateway, the control system obtains the security information sent by the user equipment.

[0174] The control system then determines a security score for the user equipment (UE) based on security information and / or the traffic transmitted by the UE. The security score indicates the current security status of the UE. A higher security score indicates a more secure UE, while a lower security score indicates a less secure UE.

[0175] Finally, the control system determines the new service access permissions corresponding to the user equipment based on the security score, and sends a first permission change message to the first SDP gateway and a second permission change message to the second SDP gateway. The first permission change message is used to instruct the first SDP gateway to change the first service access list, and the second permission change message is used to instruct the second SDP gateway to change the second service access list.

[0176] In this embodiment, the control system determines the security score and, based on the security score, determines the new service access permissions corresponding to the user equipment, as described above. Figure 2In the embodiment shown, the first control system determines the security score and the new service access permissions corresponding to the user equipment in a similar way. Please refer to the description above for details, which will not be repeated here.

[0177] Optional, Figure 7 The control system shown specifically includes an SDP controller and an authentication system.

[0178] In step 801 above, the authentication system in the control system determines the service access permissions of the user equipment based on the user group to which the user equipment belongs.

[0179] In step 802 above, the authentication system in the control system generates a first business access list and a second business access list based on business access permissions.

[0180] In step 803 above, the authentication system in the control system sends a first service access list and a second service access list to the SDP controller. Then, the SDP controller in the control system sends the first service access list to the first SDP gateway and the second service access list to the second SDP gateway.

[0181] Optional, Figure 7 The control system shown also includes an environmental sensing system.

[0182] After the SDP controller sends the corresponding service access lists to the first and second SDP gateways, the environment awareness system receives a device score from the SDP controller. This device score is determined by the SDP controller based on the security information of the user equipment. The security information of the user equipment is collected by the SDP client on the user equipment and sent to the SDP controller.

[0183] Then, the environmental perception system determines a security score based on the device score and / or the traffic sent by the user device, and sends the security score to the authentication system. The method by which the environmental perception system determines the security score is described in the section on the first control system's security score determination above, and will not be repeated here.

[0184] Secondly, the authentication system determines the new service access permissions corresponding to the user equipment based on the security score and sends the permission change message to the SDP controller.

[0185] Finally, the SDP controller sends a permission change message to the SDP gateway, which instructs the SDP gateway to modify the service access list.

[0186] The above describes the SDP-based service processing provided by the embodiments of this application. The following will describe the execution subject used to perform the above SDP-based service processing method.

[0187] This application provides an SDP-based service processing system applied to a network system including a first SDP system and a second SDP system. The first SDP system includes a first control system and a first SDP gateway, and the second SDP system includes a service processing system and a second SDP gateway. The first and second SDP systems are deployed in different areas. For example, the service processing system provided in this embodiment is... Figure 1 or Figure 5 The second control system shown.

[0188] The business processing system provided in this embodiment is Figure 1 In the case of the second control system shown, the business processing method executed by the business processing system is as follows: Figures 2-4 The corresponding embodiments are described above; please refer to the specific examples above. Figures 2-4 The corresponding implementation examples will not be described in detail here.

[0189] The business processing system provided in this embodiment is Figure 5 In the case of the second control system shown, the business processing method executed by the business processing system is as follows: Figure 6 The corresponding embodiments are described above; please refer to the specific examples above. Figure 6 The corresponding implementation examples will not be described in detail here.

[0190] In another possible embodiment, this application also provides an SDP-based service processing system. This service processing system is applied to an SDP system, which includes a service processing system, a first SDP gateway, and a second SDP gateway. The first and second SDP gateways are deployed in different regions. For example, the service processing system provided in this embodiment is... Figure 7 The control system shown.

[0191] The business processing system provided in this embodiment is Figure 7 In the case of the control system shown, the business processing method executed by the business processing system is as follows: Figure 8 The corresponding embodiments are described above; please refer to the specific examples above. Figure 8 The corresponding implementation examples will not be described in detail here.

[0192] Please see Figure 9 , Figure 9 This is a schematic diagram of the structure of a network device 900 provided in an embodiment of this application. Wherein, the above... Figure 1 The second control system in the illustrated embodiment, Figure 5 The second SDP controller and the second authentication system shown are as follows Figure 7 The control system shown can, for example, be deployed in Figure 9The network device 900 shown is implemented using a general bus architecture.

[0193] The network device 900 includes at least one processor 901, a communication bus 902, a memory 903, and at least one communication interface 904.

[0194] Optionally, the processor 901 is a general-purpose CPU, NP, microprocessor, or one or more integrated circuits for implementing the solutions of this application, such as application-specific integrated circuits (ASICs), programmable logic devices (PLDs), or combinations thereof. The aforementioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0195] The communication bus 902 is used to transmit information between the aforementioned components. The communication bus 902 is divided into an address bus, a data bus, and a control bus. For ease of representation, it is shown in the figure with only one thick line, but this does not indicate that there is only one bus or one type of bus.

[0196] Optionally, memory 903 is read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions. Alternatively, memory 903 is random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions. Alternatively, memory 903 is electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but not limited to these. Optionally, memory 903 exists independently and is connected to processor 901 via communication bus 902. Optionally, memory 903 and processor 901 are integrated together.

[0197] Communication interface 904 uses any transceiver-like device for communicating with other devices or communication networks. Communication interface 904 includes a wired communication interface. Optionally, communication interface 904 also includes a wireless communication interface. The wired communication interface is, for example, an Ethernet interface. The Ethernet interface is an optical interface, an electrical interface, or a combination thereof. The wireless communication interface is a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof, etc.

[0198] In a specific implementation, as one example, the processor 901 includes one or more CPUs, such as... Figure 9 CPU0 and CPU1 are shown in the diagram.

[0199] In a specific implementation, as one example, network device 900 includes multiple processors, such as... Figure 9 The processors 901 and 905 shown are illustrated. Each of these processors is either a single-core processor (CPU) or a multi-core processor (CPU). Here, a processor refers to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0200] In some embodiments, memory 903 is used to store program code 99 for executing the scheme of this application, and processor 901 executes the program code 99 stored in memory 903. That is, network device 900 implements the above-described method embodiment through processor 901 and program code 99 in memory 903.

[0201] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0202] A references B, which means that A is the same as B or A is a simple variation of B.

[0203] The terms "first" and "second," etc., used in the specification and claims of this application are used to distinguish different objects, not to describe a specific order of objects, and should not be construed as indicating or implying relative importance. For example, "first speed limit lane" and "second speed limit lane" are used to distinguish different speed limit lanes, not to describe a specific order of speed limit lanes, and should not be construed as the first speed limit lane being more important than the second speed limit lane.

[0204] In the embodiments of this application, unless otherwise stated, "at least one" means one or more, and "multiple" means two or more.

[0205] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any combination thereof. When implemented in software, they can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0206] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A service processing method based on Software Defined Perimeter (SDP), characterized in that, The method is applied to a network system including a first SDP system and a second SDP system. The first SDP system includes a first control system and a first SDP gateway, and the second SDP system includes a second control system and a second SDP gateway. The first SDP system and the second SDP system are deployed in different areas. The method includes: The second control system receives a user token sent by the first control system. The user token is sent by the first control system after the user equipment passes the Single Packet Authorization (SPA) authentication and identity authentication on the first control system. The user token is generated based on the device identifier of the user equipment and the user group to which the user equipment belongs. The second control system parses the user token to obtain the device identifier and the user group; The second control system provides a service access list to the second SDP gateway according to the service access permissions corresponding to the user group, so that the second SDP gateway can process service access requests from the user equipment according to the service access list, wherein the service access list is used to indicate the services that the user equipment can access.

2. The method according to claim 1, characterized in that, The method further includes: The second control system receives an updated security score from the first control system, the updated security score being sent by the first control system after detecting an update in the security score related to the user equipment; The second control system determines the new service access permissions corresponding to the user equipment based on the updated security score, and sends a permission change message to the second SDP gateway. The permission change message is used to instruct the second SDP gateway to change the service access list.

3. The method according to claim 2, characterized in that, The updated security score is determined based on the security information of the user equipment and / or the traffic sent by the user equipment.

4. The method according to any one of claims 1-3, characterized in that, The service access request includes the device identifier, the user token, and the target service requested by the user device. The method further includes: The second control system receives an authentication request sent by the second SDP gateway. The authentication request is sent by the second SDP gateway after it has verified the user equipment's service access request according to the service access list. The authentication request includes the user token and the target service. The second control system returns the authentication result corresponding to the authentication request to the second SDP gateway, so that the second SDP gateway can accept or reject the service access request based on the authentication result.

5. The method according to any one of claims 1-3, characterized in that, The first control system includes a first SDP controller and a first authentication system, and the second control system includes a second SDP controller and a second authentication system; The second control system receives the user token sent by the first control system, including: The second authentication system receives the user token sent by the first authentication system; The second control system provides a service access list to the second SDP gateway based on the service access permissions corresponding to the user group, including: The second SDP controller receives the device identifier sent by the first SDP controller; The second SDP controller sends a first message to the second authentication system. The first message includes the device identifier and is used to request the user equipment's service access permissions. The second authentication system sends the service access list to the second SDP controller based on the first message and the service access permissions corresponding to the user group; The second SDP controller sends the service access list to the second SDP gateway.

6. The method according to any one of claims 1-3, characterized in that, The first control system includes a first SDP controller and a first authentication system, and the second control system includes a second SDP controller and a second authentication system. The user token is generated based on the device identifier of the user equipment, the user group to which the user equipment belongs, and the user identifier corresponding to the user equipment. The second control system receives the user token sent by the first control system, including: The second authentication system receives the user token sent by the first authentication system; The second control system provides a service access list to the second SDP gateway based on the service access permissions corresponding to the user group, including: The second SDP controller receives the device identifier and user identifier sent by the first SDP controller; The second SDP controller sends a first message to the second authentication system. The first message includes the device identifier and the user identifier. The first message is used to request the user device's service access permissions. The second authentication system sends the service access list to the second SDP controller based on the first message and the service access permissions corresponding to the user group; The second SDP controller sends the service access list to the second SDP gateway.

7. The method according to claim 2, characterized in that, The first control system includes a first SDP controller, a first authentication system, and a first environmental perception system; the second control system includes a second SDP controller, a second authentication system, and a second environmental perception system. The second control system receives an updated safety score from the first control system, including: The second environmental perception system receives the updated security score sent by the first environmental perception system. The updated security score is sent by the first environmental perception system after it detects an update in the security score related to the user equipment. The second control system determines the new service access permissions corresponding to the user equipment based on the updated security score, and sends a permission change message to the second SDP gateway, including: The second environmental perception system sends the updated security score to the second authentication system; The second authentication system determines the new service access permissions corresponding to the user equipment based on the updated security score, and sends a permission change message to the second SDP controller; The second SDP controller sends the permission change message to the second SDP gateway, the permission change message being used to instruct the second SDP gateway to change the service access list.

8. The method according to claim 7, characterized in that, The updated security score is determined by the first environmental perception system based on the device score sent by the first SDP controller and / or the traffic sent by the user equipment. The device score is determined by the first SDP controller based on the security information of the user equipment.

9. The method according to any one of claims 1-3, characterized in that, The first SDP gateway and the second SDP gateway are respectively responsible for accessing different business services.

10. A service processing method based on SDP, characterized in that, The method is applied to an SDP system, which includes a control system, a first SDP gateway, and a second SDP gateway, wherein the first SDP gateway and the second SDP gateway are deployed in different areas. The method includes: After the user equipment passes the SPA authentication and identity authentication on the control system, the control system determines the user equipment's service access permissions, wherein the user equipment and the first SDP gateway are deployed in the same area; The control system generates a first service access list and a second service access list based on the service access permissions. The first service access list indicates the services that the user equipment can access through the first SDP gateway, and the second service access list indicates the services that the user equipment can access through the second SDP gateway. The control system sends the first service access list to the first SDP gateway and the second service access list to the second SDP gateway.

11. The method according to claim 10, characterized in that, The method further includes: The control system acquires the security information sent by the user equipment; The control system determines the security score of the user equipment based on the security information and / or the traffic sent by the user equipment; The control system determines the new service access permissions corresponding to the user equipment based on the security score, and sends a first permission change message to the first SDP gateway and a second permission change message to the second SDP gateway. The first permission change message is used to instruct the first SDP gateway to change the first service access list, and the second permission change message is used to instruct the second SDP gateway to change the second service access list.

12. The method according to claim 10 or 11, characterized in that, The control system includes an SDP controller and an authentication system; The control system determines the service access permissions of the user equipment, including: The authentication system determines the service access permissions of the user equipment based on the user group to which the user equipment belongs; The control system generates a first service access list and a second service access list based on the service access permissions, including: The authentication system generates a first business access list and a second business access list based on the business access permissions. The control system sends the first service access list to the first SDP gateway and the second service access list to the second SDP gateway, including: The authentication system sends the first service access list and the second service access list to the SDP controller. The SDP controller sends the first service access list to the first SDP gateway and the second service access list to the second SDP gateway.

13. The method according to claim 12, characterized in that, The control system also includes an environmental sensing system; The method further includes: The environmental perception system receives a device score sent by the SDP controller, which is determined by the SDP controller based on the security information of the user equipment. The environmental perception system determines a security score based on the device score and / or the traffic sent by the user device. The environmental perception system sends the security score to the authentication system; The authentication system determines the new service access permissions corresponding to the user equipment based on the security score, and sends a first permission change message and a second permission change message to the SDP controller. The SDP controller sends the first permission change message to the first SDP gateway and the second permission change message to the second SDP gateway. The first permission change message is used to instruct the first SDP gateway to change the first service access list, and the second permission change message is used to instruct the second SDP gateway to change the second service access list.

14. The method according to any one of claims 10-11, characterized in that, The first SDP gateway and the second SDP gateway are respectively responsible for accessing different business services.

15. A service processing system based on SDP, characterized in that, The service processing system is applied to a network system including a first SDP system and a second SDP system. The first SDP system includes a first control system and a first SDP gateway. The second SDP system includes the service processing system and a second SDP gateway. The first SDP system and the second SDP system are deployed in different areas. The business processing system is used to receive a user token sent by the first control system. The user token is sent by the first control system after the user equipment passes the Single Packet Authorization (SPA) authentication and identity authentication on the first control system. The user token is generated based on the device identifier of the user equipment and the user group to which the user equipment belongs. The business processing system is also used to parse the user token to obtain the device identifier and the user group; The service processing system is further configured to provide a service access list to the second SDP gateway according to the service access permissions corresponding to the user group, so that the second SDP gateway can process service access requests from the user equipment according to the service access list, wherein the service access list is used to indicate the services that the user equipment can access.

16. The business processing system according to claim 15, characterized in that, The service processing system is also used to receive an updated security score sent by the first control system, wherein the updated security score is sent by the first control system after detecting an update in the security score related to the user equipment; The service processing system determines the new service access permissions corresponding to the user equipment based on the updated security score, and sends a permission change message to the second SDP gateway. The permission change message is used to instruct the second SDP gateway to change the service access list.

17. The business processing system according to claim 16, characterized in that, The updated security score is determined based on the security information of the user equipment and / or the traffic sent by the user equipment.

18. The business processing system according to any one of claims 15-17, characterized in that, The service access request includes the device identifier, the user token, and the target service that the user device requests to access. The service processing system is also used to receive an authentication request sent by the second SDP gateway. The authentication request is sent after the second SDP gateway verifies the service access request of the user equipment according to the service access list. The authentication request includes the user token and the target service. The service processing system is also used to return the authentication result corresponding to the authentication request to the second SDP gateway, so that the second SDP gateway can accept or reject the service access request based on the authentication result.

19. The business processing system according to any one of claims 15-17, characterized in that, The first control system includes a first SDP controller and a first authentication system, and the business processing system includes a second SDP controller and a second authentication system; The second authentication system is used to receive the user token sent by the first authentication system; The second SDP controller is used to receive the device identifier sent by the first SDP controller; The second SDP controller is used to send a first message to the second authentication system, the first message including the device identifier, and the first message is used to request the user equipment's service access permissions; The second authentication system is used to send the service access list to the second SDP controller based on the first message and the service access permissions corresponding to the user group; The second SDP controller is used to send the service access list to the second SDP gateway.

20. The business processing system according to any one of claims 15-17, characterized in that, The first control system includes a first SDP controller and a first authentication system, and the service processing system includes a second SDP controller and a second authentication system. The user token is generated based on the device identifier of the user equipment, the user group to which the user equipment belongs, and the user identifier corresponding to the user equipment. The second authentication system is used to receive the user token sent by the first authentication system; The second SDP controller is used to receive the device identifier and user identifier sent by the first SDP controller; The second SDP controller is used to send a first message to the second authentication system. The first message includes the device identifier and the user identifier. The first message is used to request the user device's service access permissions. The second authentication system is used to send the service access list to the second SDP controller based on the first message and the service access permissions corresponding to the user group; The second SDP controller is used to send the service access list to the second SDP gateway.

21. The business processing system according to claim 16, characterized in that, The first control system includes a first SDP controller, a first authentication system, and a first environmental perception system; the service processing system includes a second SDP controller, a second authentication system, and a second environmental perception system. The second environmental perception system is used to receive the updated security score sent by the first environmental perception system. The updated security score is sent by the first environmental perception system after it detects that the security score related to the user equipment has been updated. The second environmental perception system is used to send the updated security score to the second authentication system; The second authentication system is used to determine the new service access permissions corresponding to the user equipment based on the updated security score, and send the permission change message to the second SDP controller; The second SDP controller is used to send the permission change message to the second SDP gateway, and the permission change message is used to instruct the second SDP gateway to change the service access list.

22. The business processing system according to claim 21, characterized in that, The updated security score is determined by the first environmental perception system based on the device score sent by the first SDP controller and / or the traffic sent by the user equipment. The device score is determined by the first SDP controller based on the security information of the user equipment.

23. The business processing system according to any one of claims 15-17, characterized in that, The first SDP gateway and the second SDP gateway are respectively responsible for accessing different business services.

24. A service processing system based on SDP, characterized in that, The service processing system is applied to the SDP system, which includes the service processing system, a first SDP gateway, and a second SDP gateway. The first SDP gateway and the second SDP gateway are deployed in different regions. After the user equipment passes the SPA authentication and identity authentication on the service processing system, the service processing system is used to determine the service access permissions of the user equipment, wherein the user equipment and the first SDP gateway are deployed in the same area; The service processing system is used to generate a first service access list and a second service access list according to the service access permissions. The first service access list is used to indicate the services that the user equipment can access through the first SDP gateway, and the second service access list is used to indicate the services that the user equipment can access through the second SDP gateway. The service processing system is used to send the first service access list to the first SDP gateway and the second service access list to the second SDP gateway.

25. The business processing system according to claim 24, characterized in that, The service processing system is used to obtain security information sent by the user equipment; The service processing system is used to determine the security score of the user equipment based on the security information and / or the traffic sent by the user equipment. The service processing system is used to determine the new service access permissions corresponding to the user equipment based on the security score, and send a first permission change message to the first SDP gateway and a second permission change message to the second SDP gateway. The first permission change message is used to instruct the first SDP gateway to change the first service access list, and the second permission change message is used to instruct the second SDP gateway to change the second service access list.

26. The business processing system according to claim 24 or 25, characterized in that, The business processing system includes an SDP controller and an authentication system; The authentication system is used to determine the service access permissions of the user equipment based on the user group to which the user equipment belongs; The authentication system is used to generate a first business access list and a second business access list based on the business access permissions. The authentication system is used to send the first service access list and the second service access list to the SDP controller; The SDP controller is used to send the first service access list to the first SDP gateway and the second service access list to the second SDP gateway.

27. The business processing system according to claim 26, characterized in that, The business processing system also includes an environmental perception system; The environmental perception system is used to receive device scores sent by the SDP controller, which are determined by the SDP controller based on the security information of the user equipment. The environmental perception system is used to determine a security score based on the device score and / or the traffic sent by the user device; The environmental perception system is used to send the security score to the authentication system; The authentication system is used to determine the new service access permissions corresponding to the user equipment based on the security score, and to send a first permission change message and a second permission change message to the SDP controller. The SDP controller is used to send the first permission change message to the first SDP gateway and the second permission change message to the second SDP gateway. The first permission change message is used to instruct the first SDP gateway to change the first service access list, and the second permission change message is used to instruct the second SDP gateway to change the second service access list.

28. The business processing system according to any one of claims 24-25, characterized in that, The first SDP gateway and the second SDP gateway are respectively responsible for accessing different business services.

29. A network device comprising a processor and a memory, the memory for storing program code, the processor for calling the program code in the memory to cause the network device to perform the method as claimed in any one of claims 1-14.

30. A computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1-14.

Images