A message transmission method and device

Abstract

The application relates to the technical field of network security, in particular to a message transmission method and device. The method comprises the following steps: receiving an authentication message sent by a target user terminal, wherein the authentication message comprises a network card address of the target user terminal and a user token; judging whether a table item corresponding to the user token exists in a mapping list of network card addresses and user tokens of each user terminal maintained locally; if the table item exists, when a service message with a source IP being the network card address of the target user terminal is received, performing authentication based on permission information of the target user terminal.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a message transmission method and apparatus. Background Technology

[0002] With the rise of internet technologies such as cloud computing, the Internet of Things, and mobile office, enterprise resources are no longer confined to the internal network. The need for employees to access the enterprise intranet anytime, anywhere is becoming increasingly common, blurring the traditional network protection boundaries and rendering traditional security measures based on network boundaries increasingly inadequate. To address these issues, SDP (Software Defined Perimeter) zero-trust technology has emerged. The core idea of ​​SDP zero-trust is to distrust no person, device, or system, and to continuously and dynamically authenticate and grant least privileges to all users accessing restricted resources.

[0003] SDP zero-trust functionality refers to a device acting as an SDP gateway, working in conjunction with an SDP controller to authenticate and authorize users accessing specified applications or APIs. This centralized control over user identity and access permissions prevents unauthorized access. Within the SDP framework, for security reasons, the data channel between the SDP connection initiating host and the SDP connection receiving host must be encrypted.

[0004] After successful authentication by the controller, the controller will return the IP addresses of all gateways to which the user terminal is bound to the application. The user terminal will then establish an SSL VPN tunnel with all the returned gateways and will have the right to access the authorized application resources under the corresponding gateway.

[0005] In current zero-trust solutions, the data channel between the terminal and the zero-trust gateway is encrypted. This encrypted channel consumes resources for both the terminal and the zero-trust gateway, and it is impossible to audit the encrypted traffic. Summary of the Invention

[0006] This application provides a message transmission method and apparatus.

[0007] In a first aspect, this application provides a message transmission method applied to a zero-trust gateway, wherein when a controller determines that a user terminal has passed authentication and is a trusted terminal, it sends a first message carrying a transmission mode and parameters corresponding to the transmission mode to the user terminal, and sends a second message carrying the transmission mode, parameters corresponding to the transmission mode, and permission information of the user terminal to the zero-trust gateway corresponding to the user terminal; the method includes: Receive an authentication message sent by a target user terminal, wherein the authentication message includes the network card address and user token of the target user terminal; Determine whether the mapping list of network card addresses and user tokens of each user terminal maintained locally exists as an entry corresponding to the user token; If present, when a service packet with the source IP address of the target user terminal's network card is received, authentication is performed based on the target user terminal's permission information.

[0008] Optionally, the transmission mode is an unencrypted transmission mode, and the parameters corresponding to the transmission mode include the port number, aging time parameter, and dynamic key of the unencrypted transmission mode. If a message sent by a target user terminal is received, and the destination port number of the message is determined to be the port number of the unencrypted transmission mode, then it is determined that an authentication message sent by the target user terminal has been received. The authentication message includes the network card address and user token of the target user terminal encrypted based on the dynamic key. The authentication message is parsed, and the encrypted network card address and user token of the target user terminal are decrypted based on the dynamic key. If it is determined that there is no entry corresponding to the user token in the mapping list of network card address and user token of each user terminal maintained locally, then the entry of network card address and user token of the target user terminal is added to the mapping list, and the aging time of the entry is set based on the aging time parameter.

[0009] Optionally, if it is determined that there is an entry corresponding to the user token in the mapping list of network card addresses and user tokens of each user terminal maintained locally, the aging time of the entry is refreshed based on the aging time parameter.

[0010] Optionally, if it is determined that there is an entry corresponding to the user token in the mapping list of network card addresses and user tokens of each user terminal maintained locally, and the network card address of the entry does not match the network card address of the target user terminal, then the network card address of the entry is updated to the network card address of the target user terminal.

[0011] Optionally, the target user terminal periodically sends authentication messages; the method further includes: If no authentication message is received from the target user terminal within a preset time period, the entry corresponding to the user token in the mapping list is deleted, and the preset time period is longer than the aging time parameter.

[0012] Secondly, this application provides a message transmission method applied to a controller, the method comprising: Receive authentication messages sent by user terminals; Based on the network card address of the user terminal, determine whether the user terminal is a trusted terminal; If the determination is yes, a first message carrying an unencrypted transmission mode and the parameters corresponding to the transmission mode is sent to the user terminal, and a second message carrying an unencrypted transmission mode, the parameters corresponding to the transmission mode, and the user terminal's permission information is sent to the zero-trust gateway corresponding to the user terminal.

[0013] Thirdly, this application provides a message transmission apparatus applied to a zero-trust gateway, wherein when the controller determines that a user terminal has passed authentication and that the user terminal is a trusted terminal, it sends a first message carrying a transmission mode and parameters corresponding to the transmission mode to the user terminal, and sends a second message carrying the transmission mode, parameters corresponding to the transmission mode, and the user terminal's permission information to the zero-trust gateway corresponding to the user terminal; the apparatus includes: The receiving unit is configured to receive an authentication message sent by a target user terminal, wherein the authentication message includes the network card address and user token of the target user terminal; The judgment unit is used to determine whether there is an entry corresponding to the user token in the mapping list of network card addresses and user tokens of each user terminal maintained locally; If the determination unit determines that an authentication unit exists, then when the receiving unit receives a service packet whose source IP is the network card address of the target user terminal, the authentication unit performs authentication based on the permission information of the target user terminal.

[0014] Optionally, the transmission mode is an unencrypted transmission mode, and the parameters corresponding to the transmission mode include the port number of the unencrypted transmission mode, the aging time parameter, and the dynamic key; the device further includes a parsing unit and an adding unit. The receiving unit is used to receive a message sent by the target user terminal. If the judging unit determines that the destination port number of the message is the port number of the unencrypted transmission mode, then it is determined that an authentication message sent by the target user terminal has been received. The authentication message includes the network card address and user token of the target user terminal encrypted based on the dynamic key. The parsing unit is used to parse the authentication message and decrypt the encrypted network card address and user token of the target user terminal based on the dynamic key. If the judgment unit determines that there is no entry corresponding to the user token in the mapping list of network card address and user token of each user terminal maintained locally, the adding unit is used to add the entry of network card address and user token of the target user terminal to the mapping list, and set the aging time of the entry based on the aging time parameter.

[0015] Optionally, the device further includes a refresh unit; If the determination unit determines that there is an entry corresponding to the user token in the mapping list of network card addresses and user tokens of each user terminal maintained locally, the refresh unit is used to refresh the aging time of the entry based on the aging time parameter.

[0016] Optionally, if the determination unit determines that there is an entry corresponding to the user token in the mapping list of network card addresses and user tokens of each user terminal maintained locally, and the network card address of the entry does not match the network card address of the target user terminal, then the refresh unit is used to update the network card address of the entry to the network card address of the target user terminal.

[0017] Optionally, the target user terminal periodically sends authentication messages; the device further includes a deletion unit: If no authentication message is received from the target user terminal within a preset time period, the deletion unit is used to delete the entry corresponding to the user token in the mapping list, wherein the preset time period is longer than the aging time parameter.

[0018] Fourthly, this application provides a message transmission device applied to a controller, the device comprising: The receiving unit is used to receive authentication messages sent by user terminals; The judgment unit is used to determine whether the user terminal is a trusted terminal based on the network card address of the user terminal; If the determination unit determines that the message is true, the message sending unit is used to send a first message carrying an unencrypted transmission mode and parameters corresponding to the transmission mode to the user terminal, and to send a second message carrying an unencrypted transmission mode, parameters corresponding to the transmission mode, and permission information of the user terminal to the zero-trust gateway corresponding to the user terminal.

[0019] Fifthly, embodiments of this application provide a message transmission apparatus, which includes: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of the first or second aspects above, according to the obtained program instructions.

[0020] In a sixth aspect, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for causing the computer to perform the steps of the method as described in any one of the first or second aspects above.

[0021] In summary, the message transmission method provided in this application embodiment is applied to a zero-trust gateway. When the controller determines that a user terminal has passed authentication and is a trusted terminal, it sends a first message carrying a transmission mode and parameters corresponding to that transmission mode to the user terminal, and a second message carrying the transmission mode, parameters corresponding to that transmission mode, and the user terminal's permission information to the zero-trust gateway corresponding to the user terminal. The method includes: receiving an authentication message sent by a target user terminal, wherein the authentication message includes the target user terminal's network interface card (NIC) address and user token; determining whether a table entry corresponding to the user token exists in a locally maintained mapping list of NIC addresses and user tokens for each user terminal; if so, performing authentication based on the target user terminal's permission information when receiving a service message with a source IP address equal to the target user terminal's NIC address.

[0022] The message transmission method provided in this application adds an unencrypted transmission mode, enabling data channels to bypass tunnel encryption in zero-trust scenarios, saving resources for terminals and gateways. Avoiding tunnel transmission increases traffic throughput. Unencrypted data packets facilitate better third-party traffic auditing. Furthermore, it adds a process where the terminal sends an authentication message to the zero-trust gateway. If the user terminal fails zero-trust authentication and the zero-trust gateway does not receive the authentication packet, the user terminal's access request to business resources will be discarded by the zero-trust gateway. This prevents unauthenticated user terminals from accessing resources protected by the zero-trust gateway. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments of this application or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings of the embodiments of this application.

[0024] Figure 1 This is a schematic diagram of a zero-trust architecture network. Figure 2 A detailed flowchart of a message transmission method provided for an embodiment of this application; Figure 3 A detailed flowchart of another message transmission method provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of a message transmission device provided in an embodiment of this application; Figure 5 This is a schematic diagram of another message transmission device provided in an embodiment of this application; Figure 6A schematic diagram of the hardware architecture of a message transmission device provided in this application embodiment; Figure 7 This is a schematic diagram of the hardware architecture of another message transmission device provided in an embodiment of this application. Detailed Implementation

[0025] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms “a,” “the,” and “the” as used in this application and claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to any and all possible combinations comprising one or more of the associated listed items.

[0026] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of this application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" may also be interpreted as "when," "when," or "in response to a determination."

[0027] For example, see Figure 1 The diagram illustrates a zero-trust architecture network. In current zero-trust network architectures, one implementation involves the following steps on the control channel side: Users authenticate themselves by accessing the controller's authentication center via their terminals. After successful authentication, the controller sends the client a list of all accessible gateway addresses and the applications protected by each gateway. The controller also sends and dynamically updates the resources and permissions accessible to the user to the gateways.

[0028] On the data channel side: end users establish SSL VPN tunnels with all gateways based on the returned list of gateways for the resources they are given, and then access the business resources behind the gateways.

[0029] Currently, in some application scenarios, the zero-trust solution is deployed on a local area network. Users only use the zero-trust solution to control user permissions and audit user access, so encryption of traffic between the terminal and the zero-trust gateway is not required.

[0030] In current zero-trust solutions, the data channel between the terminal and the zero-trust gateway is encrypted. Whether through SSL VPN, Tunnel, or IPsec, the traffic is encrypted. Using an encrypted channel between the terminal and the zero-trust gateway consumes resources for both the terminal and the gateway, and makes it difficult for third parties to audit user traffic.

[0031] This application proposes a scheme that improves the zero-trust controller, zero-trust terminal, and zero-trust gateway to achieve unencrypted data channels between the terminal and the zero-trust gateway, and allows the zero-trust gateway to manage data according to user permissions.

[0032] For example, see Figure 2 The diagram shown is a detailed flowchart of a message transmission method provided in an embodiment of this application. This method is applied to a zero-trust gateway and includes the following steps: Step 200: Receive the authentication message sent by the target user terminal.

[0033] The authentication message includes the network card address and user token of the target user terminal.

[0034] In this embodiment of the application, when the controller determines that a user terminal has passed authentication and that the user terminal is a trusted terminal, it sends a first message to the user terminal carrying the transmission mode and the parameters corresponding to the transmission mode, and sends a second message to the zero-trust gateway corresponding to the user terminal carrying the transmission mode, the parameters corresponding to the transmission mode, and the user terminal's permission information.

[0035] Specifically, the user terminal (client) authenticates with the controller; the controller authenticates the user's identity based on the account / password and other information entered by the user, and after confirming that the user terminal has passed the authentication, it issues a user token to the user terminal.

[0036] Furthermore, the controller determines whether the user terminal is a trusted terminal (e.g., an intranet terminal). If so, it determines that the message transmission mode between the user terminal and the zero-trust gateway is unencrypted mode (transparent mode); otherwise, it determines that the message transmission mode between the user terminal and the zero-trust gateway is encrypted mode.

[0037] After determining that the user terminal is a trusted terminal, the controller sends a message (first message) to the user terminal carrying transmission mode information and the parameter information corresponding to the transmission mode, so as to inform the user terminal to transmit messages with the zero-trust gateway based on the transmission mode (unencrypted transmission) and the parameters corresponding to the transmission mode.

[0038] In practical applications, the controller will also determine the service resources that the user terminal can access, as well as the zero-trust gateways corresponding to each service resource, and send the list of accessible zero-trust gateways (gateway IP addresses) and service resources to the user terminal.

[0039] At the same time, the controller will also send a second message to the zero-trust gateway corresponding to the user terminal, carrying the transmission mode, the parameters corresponding to the transmission mode, and the user terminal's permission information.

[0040] In this embodiment of the application, the transmission mode is an unencrypted transmission mode, and the parameters corresponding to the transmission mode include the port number, aging time parameter, and dynamic key of the unencrypted transmission mode.

[0041] When receiving an authentication message sent by a target user terminal, a preferred implementation is as follows: upon receiving a message sent by the target user terminal, if it is determined that the destination port number of the message is the port number of the unencrypted transmission mode, then it is determined that an authentication message sent by the target user terminal has been received. The authentication message includes the network card address and user token of the target user terminal encrypted based on the dynamic key.

[0042] In other words, the target user terminal sends an authentication message to the zero-trust gateway. The destination IP address of the message is the zero-trust gateway address, the destination port is the port in unencrypted transmission mode, and the message payload carries the terminal network card IP address, terminal information (AID, association identifier), and user token information. Among them, the user token information and the terminal network card IP address are encrypted using a dynamic key.

[0043] Step 110: Determine whether the table entry corresponding to the user token exists in the mapping list of network card addresses and user tokens of each user terminal maintained locally.

[0044] Specifically, the authentication message is parsed, and the encrypted network card address and user token of the target user terminal are decrypted based on the dynamic key to obtain the decrypted network card address and user token of the target user terminal.

[0045] Then, based on the user token, it is determined whether there is an entry in the mapping list of network card addresses and user tokens of each user terminal maintained locally that matches the user token.

[0046] If it is determined that there is no entry corresponding to the user token in the mapping list of network card address and user token of each user terminal maintained locally, then the entry of network card address and user token of the target user terminal is added to the mapping list, and the aging time of the entry is set based on the aging time parameter.

[0047] In practical applications, we can determine whether a user terminal is online by checking whether the mapping list maintains the network card address and user token of that user terminal. If it is online, it can be understood that the mapping list will maintain the mapping relationship between the network card address and user token of that user terminal. If it is not online, it can be understood that the mapping list will not maintain the mapping relationship between the network card address and user token of that user terminal.

[0048] Step 120: If it exists, when a service packet with the source IP address of the target user terminal's network card address is received, authentication is performed based on the target user terminal's permission information.

[0049] In this embodiment of the application, the authentication operation between the user terminal and the zero-trust gateway aims to maintain a mapping list of network card addresses and user tokens of each authenticated and legitimate terminal on the zero-trust gateway, so that in subsequent service message processing, the user terminal to which each service message belongs can be identified as a legitimate terminal based on the mapping list.

[0050] Specifically, if the zero-trust gateway determines that the destination port of the received packet is not a port in unencrypted transmission mode (the zero-trust gateway can identify whether a packet is an authentication packet or a service packet by the destination port number in the packet's five-tuple), and the source IP address of the packet matches the terminal network interface card address list (mapping list), then it determines that the packet belongs to the service packet (service traffic) of the user terminal corresponding to the matched terminal network interface card address, and then performs authentication based on the user terminal's permission information. If the gateway receives a service packet whose source IP address does not match the terminal network interface card address list, then it discards the packet.

[0051] In this embodiment of the application, if a corresponding aging time is set for each entry in the mapping list, then if it is determined that there is an entry corresponding to the user token in the mapping list of network card addresses and user tokens of each user terminal maintained locally, the aging time of the entry can be refreshed based on the aging time parameter.

[0052] In other words, online users will periodically send authentication messages to the zero-trust gateway, so that the zero-trust gateway will refresh the entries corresponding to each user terminal in the mapping list according to a preset period.

[0053] If it is determined that there is an entry corresponding to the user token in the mapping list of network card addresses and user tokens of each user terminal maintained locally, and the network card address of the entry does not match the network card address of the target user terminal, then the network card address of the entry is updated to the network card address of the target user terminal.

[0054] In other words, if a user terminal's IP address changes, causing the network card address carried in the authentication message to be inconsistent with the network card address maintained in the mapping list, the network card address in that entry can be updated to the network card address (IP address) of the user terminal carried in the authentication message.

[0055] Furthermore, if no authentication message is received from the target user terminal within a preset time period, the entry corresponding to the user token in the mapping list is deleted, where the preset time period is longer than the aging time parameter.

[0056] For example, if no authentication message is received from the target user terminal for N consecutive cycles, the entry corresponding to the target user terminal in the mapping list (the mapping relationship between the target user terminal's network card address and the user token) will be deleted (e.g., N≥2).

[0057] For example, see Figure 3 The diagram shown is a detailed flowchart of a message transmission method provided in an embodiment of this application. This method is applied to a controller and includes the following steps: Step 300: Receive the authentication message sent by the user terminal.

[0058] Specifically, it receives authentication messages sent by user terminals and authenticates the identity of user terminals based on these authentication messages.

[0059] Step 310: Based on the network card address of the user terminal, determine whether the user terminal is a trusted terminal.

[0060] In this embodiment of the application, the controller needs to determine whether the user terminal is a trusted terminal. For example, an intranet terminal can be defined as a trusted terminal, and an extranet terminal can be defined as an untrusted terminal.

[0061] Step 320: If the determination is yes, then send a first message carrying an unencrypted transmission mode and the parameters corresponding to the transmission mode to the user terminal, and send a second message carrying an unencrypted transmission mode, the parameters corresponding to the transmission mode, and the user terminal's permission information to the zero-trust gateway corresponding to the user terminal.

[0062] In this embodiment of the application, if a user terminal is a trusted terminal, the message transmission mode between the user terminal and the zero-trust gateway can be specified as an unencrypted transmission mode; if a user terminal is an untrusted terminal, the message transmission mode between the user terminal and the zero-trust gateway can be specified as an encrypted transmission mode (existing implementation).

[0063] If the controller determines that the target user terminal is a trusted terminal, it determines the target user terminal's access permissions (accessible business resources), the target gateway corresponding to the accessible business resources, the target user terminal's token, the message transmission mode between the target user terminal and the target gateway (unencrypted mode), and the message transmission parameters (such as the port number, aging time parameter, and dynamic key corresponding to the unencrypted mode), and sends the relevant information to the target user terminal and the target gateway.

[0064] For example, information such as the user token, message transmission mode, message transmission parameters, and the address of the target gateway are sent to the target user terminal; information such as the user token, message transmission mode, message transmission parameters, and the permissions of the target user terminal are sent to the target gateway. The message transmission process between the target user terminal and the target gateway is described above and will not be repeated here.

[0065] For example, see Figure 4 The diagram shows a schematic of a message transmission device provided in an embodiment of this application. This device is applied to a zero-trust gateway. When the controller determines that a user terminal has passed authentication and is a trusted terminal, it sends a first message carrying a transmission mode and parameters corresponding to that transmission mode to the user terminal, and sends a second message carrying the transmission mode, parameters corresponding to that transmission mode, and the user terminal's permission information to the zero-trust gateway corresponding to the user terminal. The device includes: The receiving unit 40 is used to receive an authentication message sent by the target user terminal, wherein the authentication message includes the network card address and user token of the target user terminal; The judgment unit 41 is used to determine whether there is an entry corresponding to the user token in the mapping list of network card addresses and user tokens of each user terminal maintained locally; If the judgment unit 41 determines that an authentication unit exists, then when the receiving unit 40 receives a service packet whose source IP is the network card address of the target user terminal, the authentication unit 42 performs authentication based on the permission information of the target user terminal.

[0066] Optionally, the transmission mode is an unencrypted transmission mode, and the parameters corresponding to the transmission mode include the port number of the unencrypted transmission mode, the aging time parameter, and the dynamic key; the device further includes a parsing unit and an adding unit. The receiving unit 40 is used to receive a message sent by the target user terminal. If the judging unit 41 determines that the destination port number of the message is the port number of the unencrypted transmission mode, then it is determined that an authentication message sent by the target user terminal has been received. The authentication message includes the network card address and user token of the target user terminal encrypted based on the dynamic key. The parsing unit is used to parse the authentication message and decrypt the encrypted network card address and user token of the target user terminal based on the dynamic key. If the judgment unit 41 determines that there is no entry corresponding to the user token in the mapping list of network card address and user token of each user terminal maintained locally, the adding unit is used to add the entry of network card address and user token of the target user terminal to the mapping list, and set the aging time of the entry based on the aging time parameter.

[0067] Optionally, the device further includes a refresh unit; If the judgment unit 41 determines that there is an entry corresponding to the user token in the mapping list of network card addresses and user tokens of each user terminal maintained locally, the refresh unit is used to refresh the aging time of the entry based on the aging time parameter.

[0068] Optionally, if the determination unit 41 determines that there is an entry corresponding to the user token in the mapping list of network card addresses and user tokens of each user terminal maintained locally, and the network card address of the entry does not match the network card address of the target user terminal, then the refresh unit is used to update the network card address of the entry to the network card address of the target user terminal.

[0069] Optionally, the target user terminal periodically sends authentication messages; the device further includes a deletion unit: If no authentication message is received from the target user terminal within a preset time period, the deletion unit is used to delete the entry corresponding to the user token in the mapping list, wherein the preset time period is longer than the aging time parameter.

[0070] For example, see Figure 5 The diagram shown is a structural schematic of a message transmission device provided in an embodiment of this application. This device is applied to a controller and includes: The receiving unit 50 is used to receive authentication messages sent by the user terminal; The judgment unit 51 is used to determine whether the user terminal is a trusted terminal based on the network card address of the user terminal. If the judgment unit 51 determines that it is yes, the sending unit 52 is used to send a first message carrying an unencrypted transmission mode and parameters corresponding to the transmission mode to the user terminal, and to send a second message carrying an unencrypted transmission mode, parameters corresponding to the transmission mode, and permission information of the user terminal to the zero-trust gateway corresponding to the user terminal.

[0071] These units can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more digital signal processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when one of these units is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these units can be integrated together to form a system-on-a-chip (SOC).

[0072] Furthermore, regarding the message transmission device provided in this application embodiment, from a hardware perspective, the hardware architecture diagram of the message transmission device can be found in [reference needed]. Figure 6 As shown, the message transmission device may include: a memory 60 and a processor 61. The memory 60 is used to store program instructions; the processor 61 calls the program instructions stored in the memory 60 and executes the method embodiment applied to the zero-trust gateway according to the obtained program instructions. The specific implementation and technical effects are similar, and will not be described in detail here.

[0073] Optionally, this application also provides a zero-trust gateway device, including at least one processing element (or chip) for performing the above-described method embodiments applied to a zero-trust gateway.

[0074] Optionally, this application also provides a program product, such as a computer-readable storage medium storing computer-executable instructions for causing the computer to execute the above-described method embodiment applied to a zero-trust gateway.

[0075] Furthermore, regarding the message transmission device provided in this application embodiment, from a hardware perspective, the hardware architecture diagram of the message transmission device can be found in [reference needed]. Figure 7 As shown, the message transmission device may include: a memory 70 and a processor 71. The memory 70 is used to store program instructions; the processor 71 calls the program instructions stored in the memory 70 and executes the method embodiment applied to the controller according to the obtained program instructions. The specific implementation and technical effects are similar, and will not be described again here.

[0076] Optionally, this application also provides a controller, including at least one processing element (or chip) for performing the above-described method embodiments applied to the controller.

[0077] Optionally, this application also provides a program product, such as a computer-readable storage medium storing computer-executable instructions for causing the computer to perform the above-described method embodiments applied to the controller.

[0078] Here, a machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, a machine-readable storage medium can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0079] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0080] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0081] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0082] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0083] Furthermore, these computer program instructions can also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0084] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0085] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A message transmission method, characterized in that, Applied to a zero-trust gateway, the controller, upon determining that a user terminal has passed authentication and is a trusted terminal, sends a first message to the user terminal carrying a transmission mode and parameters corresponding to that transmission mode, and sends a second message to the zero-trust gateway corresponding to the user terminal carrying the transmission mode, parameters corresponding to that transmission mode, and the user terminal's permission information, wherein the transmission mode is an unencrypted transmission mode; the method includes: Receive an authentication message sent by a target user terminal, wherein the authentication message includes the network card address and user token of the target user terminal; Determine whether the mapping list of network card addresses and user tokens of each user terminal maintained locally exists as an entry corresponding to the user token; If present, when a service packet with the source IP address of the target user terminal's network card is received, authentication is performed based on the target user terminal's permission information.

2. The method as described in claim 1, characterized in that, The parameters corresponding to the transmission mode include the port number, aging time parameter, and dynamic key for the unencrypted transmission mode. If a message sent by a target user terminal is received, and the destination port number of the message is determined to be the port number of the unencrypted transmission mode, then it is determined that an authentication message sent by the target user terminal has been received. The authentication message includes the network card address and user token of the target user terminal encrypted based on the dynamic key. The authentication message is parsed, and the encrypted network card address and user token of the target user terminal are decrypted based on the dynamic key. If it is determined that there is no entry corresponding to the user token in the mapping list of network card address and user token of each user terminal maintained locally, then the entry of network card address and user token of the target user terminal is added to the mapping list, and the aging time of the entry is set based on the aging time parameter.

3. The method as described in claim 2, characterized in that, If it is determined that there is an entry corresponding to the user token in the mapping list of network card addresses and user tokens of each user terminal maintained locally, then the aging time of the entry is refreshed based on the aging time parameter.

4. The method according to any one of claims 1-3, characterized in that, If it is determined that there is an entry corresponding to the user token in the mapping list of network card addresses and user tokens of each user terminal maintained locally, and the network card address of the entry does not match the network card address of the target user terminal, then the network card address of the entry is updated to the network card address of the target user terminal.

5. The method as described in claim 4, characterized in that, The target user terminal periodically sends authentication messages; the method further includes: If no authentication message is received from the target user terminal within a preset time period, the entry corresponding to the user token in the mapping list is deleted, and the preset time period is longer than the aging time parameter.

6. A message transmission method, characterized in that, Applied to a controller, the method includes: Receive authentication messages sent by user terminals, authenticate the identity of user terminals based on the authentication messages, and issue user tokens to user terminals after determining that the user terminals have passed the identity authentication. Based on the network card address of the user terminal, determine whether the user terminal is a trusted terminal; If the determination is yes, a first message carrying an unencrypted transmission mode and the parameters corresponding to the transmission mode is sent to the user terminal, and a second message carrying an unencrypted transmission mode, the parameters corresponding to the transmission mode, and the user terminal's permission information is sent to the zero-trust gateway corresponding to the user terminal.

7. A message transmission device, characterized in that, Applied to a zero-trust gateway, the controller, upon determining that a user terminal has passed authentication and is a trusted terminal, sends a first message to the user terminal carrying a transmission mode and parameters corresponding to that transmission mode, and sends a second message to the zero-trust gateway corresponding to the user terminal carrying the transmission mode, parameters corresponding to that transmission mode, and the user terminal's permission information. The transmission mode is an unencrypted transmission mode. The device includes: The receiving unit is configured to receive an authentication message sent by a target user terminal, wherein the authentication message includes the network card address and user token of the target user terminal; The judgment unit is used to determine whether there is an entry corresponding to the user token in the mapping list of network card addresses and user tokens of each user terminal maintained locally; If the determination unit determines that an authentication unit exists, then when the receiving unit receives a service packet whose source IP is the network card address of the target user terminal, the authentication unit performs authentication based on the permission information of the target user terminal.

8. A message transmission device, characterized in that, Applied to a controller, the device includes: The receiving unit is configured to receive authentication messages sent by the user terminal, authenticate the identity of the user terminal based on the authentication messages, and issue a user token to the user terminal after determining that the user terminal has passed the identity authentication. The judgment unit is used to determine whether the user terminal is a trusted terminal based on the network card address of the user terminal; If the determination unit determines that the message is true, the message sending unit is used to send a first message carrying an unencrypted transmission mode and parameters corresponding to the transmission mode to the user terminal, and to send a second message carrying an unencrypted transmission mode, parameters corresponding to the transmission mode, and permission information of the user terminal to the zero-trust gateway corresponding to the user terminal.

9. A message transmission device, characterized in that, The message transmission device includes: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of claims 1-5 or 6 according to the obtained program instructions.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions for causing the computer to perform the steps of the method as described in any one of claims 1-5 or 6.

Images