Method and apparatus for establishing a secure connection

Abstract

The present disclosure provides a method and device for establishing a secure connection, which can be applied to a first component in a zero trust system. The method comprises: calculating a first password according to a locally stored system identifier and first MAC information; sending a first connection request to a second component in the zero trust system, wherein the first connection request comprises the first password and the first MAC information; receiving a first response corresponding to the first connection request sent by the second component, wherein the first response comprises a second password and second MAC information; calculating a first reference password according to the second MAC information and the locally stored system identifier; and establishing a secure connection with the second component if the first reference password is consistent with the second password.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to a method and apparatus for establishing a secure connection. Background Technology

[0002] Zero Trust Architecture is a cybersecurity concept and architectural model designed to improve the security of data and systems. Traditional security models typically place trust within the enterprise's internal network, while Zero Trust Architecture believes that no user, device, or network should be trusted; instead, identity and permissions should be verified on every access request.

[0003] The core principle of zero-trust architecture is to treat every resource and user within the network as a potential security risk and require them to be authenticated and authorized. Unlike traditional perimeter defense, zero-trust architecture protects the network and data through multi-layered authentication, access control, isolation, and monitoring.

[0004] SDP (Software Definition Perimeter) is a network security architecture designed to ensure secure access to network resources and applications in a dynamic and programmable manner. Traditional network perimeter security relies on fixed firewalls and VPNs, while SDP provides more flexible and secure protection for enterprise networks by creating a software-defined, transparent access control boundary.

[0005] In existing zero-trust architectures, controllers and gateways do not trust user clients, but they are trusted by default for gateways, controllers, and other non-user components. When these non-user components are attacked or impersonated, the authentication and authorization process for user clients becomes meaningless. Therefore, the security of existing zero-trust architectures is relatively low. Summary of the Invention

[0006] In view of this, the present disclosure provides a method and apparatus for establishing a secure connection to improve system security.

[0007] In a first aspect, this disclosure provides a method for establishing a secure connection, applied to a first component in a zero-trust system. The method includes: calculating a first password based on a locally stored system identifier and first MAC information; sending a first connection request to a second component in the zero-trust system, the first connection request including the first password and the first MAC information; receiving a first response from the second component corresponding to the first connection request, the first response including a second password and second MAC information; calculating a first reference password based on the second MAC information and the locally stored system identifier; and establishing a secure connection with the second component if the first reference password and the second password are consistent.

[0008] Secondly, this disclosure provides an apparatus for establishing a secure connection, applied to a first component in a zero-trust system. The apparatus includes: a first calculation module for calculating a first password based on a locally stored system identifier and first MAC information; a first sending module for sending a first connection request to a second component in the zero-trust system, the first connection request including the first password and the first MAC information; a first receiving module for receiving a first response sent by the second component corresponding to the first connection request, the first response including a second password and second MAC information; a second calculation module for calculating a first reference password based on the second MAC information and a locally stored system identifier; and a connection module for establishing a secure connection with the second component if the first reference password and the second password are consistent.

[0009] Thirdly, this disclosure provides a network device including a processor and a machine-readable storage medium storing machine-executable instructions that can be executed by the processor, the processor being prompted by the machine-executable instructions to perform the method provided in the first aspect of this disclosure.

[0010] Therefore, by applying the method and apparatus for establishing a secure connection provided in this disclosure, and by carrying a password in the connection request and response between components, two-way authentication between components can be achieved, thereby enhancing the security of the system. Attached Figure Description

[0011] Figure 1 This is a schematic diagram of a system architecture illustrated in this specification according to an exemplary embodiment;

[0012] Figure 2 A flowchart illustrating a method for establishing a secure connection, as provided in this embodiment of the disclosure;

[0013] Figure 3 A flowchart illustrating another method for establishing a secure connection provided in this disclosure embodiment;

[0014] Figure 4A schematic diagram illustrating the establishment of a secure connection provided in an embodiment of this disclosure;

[0015] Figure 5 An apparatus for establishing a secure connection is provided in an embodiment of this disclosure;

[0016] Figure 6 The network device hardware structure provided in the embodiments of this disclosure. Detailed Implementation

[0017] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0018] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The singular forms “a,” “the,” and “the” as used in this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the corresponding listed items.

[0019] It should be understood that although the terms first, second, third, etc., may be used in this disclosure to describe various information, such information should not be limited to these terms. These terms are used only to distinguish information of the same type from one another. For example, without departing from the scope of this disclosure, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0020] The following combination Figure 1 The system architecture of the methods and apparatus for establishing secure connections that can be applied to the embodiments of this specification will be described. It should be noted that... Figure 1 The examples shown are merely examples of system architectures that can be applied to the embodiments of this disclosure, in order to help those skilled in the art understand the technical content of this disclosure, but do not mean that the embodiments of this disclosure cannot be used in other devices, systems, environments or scenarios.

[0021] Figure 1 This is a schematic diagram of a system architecture illustrated in this specification according to an exemplary embodiment.

[0022] like Figure 1As shown, the system can be a zero-trust system, and its architecture may include, for example, a controller, terminal devices, a gateway, and a server.

[0023] According to embodiments of this disclosure, a gateway may be a device responsible for providing resource access services to authorized users. The gateway may provide resource access services to users authorized by the controller.

[0024] According to embodiments of this disclosure, the controller can be a device responsible for authenticating user identity and verifying user access permissions. The controller may have its own identity and access control system, where administrators can configure user identity information and access permissions to resources.

[0025] According to embodiments of this disclosure, the server can be, for example, an application server or an API (Application Programming Interface) server. An application server can be used to deploy, manage, and execute the runtime environment of applications. It provides a series of services and middleware to enable applications to run and handle requests from clients. An API server can be used to provide a programming interface for applications. It provides a unified channel for accessing data and operations. Applications can communicate with the API server via HTTP (Hypertext Transfer Protocol) or other protocols to obtain the required data or perform the required operations.

[0026] According to embodiments of this disclosure, the terminal device can be various electronic devices with a display screen and supporting web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers. Various applications, such as iNode clients and browsers, can be installed on the terminal device.

[0027] According to embodiments of this disclosure, users can use an iNode client or browser on a terminal device to access the controller's authentication center for user authentication.

[0028] Once authentication is successful, the controller can send all accessible gateway addresses and the applications and APIs protected by each gateway to the terminal device.

[0029] The controller issues and dynamically updates user access permissions for applications and APIs to the gateway.

[0030] Users can access the resource server behind the gateway through a web proxy or SSL (Secure Socket Layer) VPN (Virtual Private Network).

[0031] The method for establishing a secure connection provided by the embodiments of this disclosure will now be described in detail. See also: Figure 2 , Figure 2 This is a flowchart illustrating a method for establishing a secure connection according to an embodiment of this disclosure. The method is applied to a first component, which can be any component in a zero-trust system. Exemplarily, the component may include, for example, a terminal device, a gateway, a controller, etc. The method for establishing a secure connection provided in this disclosure may include the following steps.

[0032] Step 210: Calculate the first password based on the locally stored system identifier and the first MAC information.

[0033] According to embodiments of this disclosure, the system identifier may include, for example, an Identity Document (ID). The first MAC information is the MAC information of the first component. The MAC information may include, for example, a MAC address or information generated from a MAC address.

[0034] According to embodiments of this disclosure, a system identifier can be generated based on the system identifier parameter of each component in the zero-trust system, serving as a unique identifier for the entire zero-trust environment. This identifier is then distributed to each component and stored locally within the component.

[0035] According to embodiments of this disclosure, a first password can be obtained by calculating the locally stored system identifier and first MAC information based on a predetermined algorithm. The predetermined algorithm may, for example, include a hash algorithm. The predetermined algorithm can be pre-distributed to each component and stored locally on the component.

[0036] Step 220: Send a first connection request to the second component in the zero-trust system. The first connection request includes a first password and first MAC information.

[0037] According to embodiments of this disclosure, the first connection request may be a connection request sent by a first component. The connection request may, for example, be used to request the establishment of a secure connection. The secure connection may, for example, include an SSL connection. The first MAC information may, for example, include the MAC information of the first component.

[0038] Step 230: Receive the first response sent by the second component corresponding to the first connection request. The first response includes the second password and the second MAC information.

[0039] According to embodiments of this disclosure, after receiving a first connection request, the second component can verify the first password and first MAC information in the first connection request. If the verification passes, it can reply with a first response to the first component.

[0040] According to embodiments of this disclosure, the second password may be calculated by the second component based on a locally stored system identifier and second MAC information.

[0041] Step 240: Calculate the first reference password based on the second MAC information and the system identifier stored locally.

[0042] According to embodiments of this disclosure, for example, a first reference password can be obtained by calculating the second MAC information and the locally stored system identifier using the same algorithm as that used to calculate the first password.

[0043] Step 250: Determine whether the first reference password and the second password are consistent.

[0044] If the first reference password and the second password match, proceed to step 260; if the first reference password and the second password do not match, proceed to step 270.

[0045] Step 260: Establish a secure encrypted connection with the second component.

[0046] According to embodiments of this disclosure, if the first reference password and the second password are the same, it indicates that the second component is trustworthy and can be connected.

[0047] Step 270: Refuse to connect to the second component.

[0048] According to embodiments of this disclosure, if the first reference password and the second password do not match, it indicates that the second component is untrusted, and connection to the second component can be refused. If a connection has already been established with the second component, the connection can be disconnected.

[0049] According to embodiments of this disclosure, two-way authentication between components can be achieved by carrying a password in the connection request and response between components. Compared to one-way authentication, the method of two-way authentication between components enhances the security of a zero-trust system.

[0050] The more components a zero-trust system has, the more important secure connections between them become. According to embodiments of this disclosure, generating a password through a unique identifier for the entire zero-trust system and carrying the password in connection requests and responses between components can reduce the risk of system attacks and improve security.

[0051] Optionally, the connection request may include extensions. Based on this, the first connection request may include a first extension field. A first password and first MAC information can be added to the first extension field. Correspondingly, the second component can obtain the first password and first MAC information by recognizing the first extension field in the first connection request.

[0052] Optionally, for example, the component identifier of each component in the zero-trust system can be obtained. Then, a system identifier is generated based on the component identifier of each component. For example, in this embodiment, the system identifier can be obtained by performing a hash operation on the component identifier of each component in the zero-trust system.

[0053] See Figure 3 , Figure 3 A flowchart illustrating another method for establishing a secure connection provided in this disclosure embodiment. The method is applied to a first component, which can be any component in a zero-trust system. The method for establishing a secure connection provided in this disclosure embodiment may further include the following steps.

[0054] Step 310: Receive a second connection request sent by the third component. The second connection request includes a third password and third MAC information.

[0055] According to embodiments of this disclosure, the second connection request may be a connection request sent by a third component. The third MAC information may, for example, include the MAC address of the third component. The third password may be calculated by the third component using a preset algorithm based on the third component's MAC information and the system identifier.

[0056] Step 320: Calculate the second reference password based on the locally stored system identifier and the third MAC information.

[0057] According to embodiments of this disclosure, for example, a second reference password can be obtained by calculating the locally stored system identifier and third MAC information based on a preset algorithm.

[0058] Step 330: Determine whether the second reference local password and the third password are the same. If the second reference local password and the third password are the same, proceed to steps 340-350; otherwise, proceed to step 360.

[0059] Step 340: Generate the fourth password based on the locally stored system identifier and the local first MAC information.

[0060] Step 350: Send a second response to the third component. The second response includes a local fourth password and the first local MAC information.

[0061] According to embodiments of this disclosure, if the second reference local password is consistent with the third password, it indicates that the third component is trustworthy and can respond to the third component with the corresponding response.

[0062] Step 360: Refuse to connect to third-party components.

[0063] If the second reference local password does not match the third password, it indicates that the third component is untrusted, and the connection to the third component can be refused. If a connection has already been established with the second component, the connection can be closed.

[0064] Optionally, the second response may include a second extended field. Based on this, a fourth password and first MAC information can be added to the second extended field. Correspondingly, the third component can obtain the fourth password and first MAC information by recognizing the second extended field in the second response.

[0065] The method for establishing a secure connection provided by the embodiments of this disclosure will now be described in detail. See also: Figure 4 , Figure 4 This is a schematic diagram illustrating the establishment of a secure connection as provided in an embodiment of this disclosure. Figure 4 middle,

[0066] In a zero-trust solution, each component acts as a client and server to the other, and they do not trust each other. A secure connection is established only after mutual authentication, as follows:

[0067] When deploying a zero-trust system, after installing all components and enabling interoperability between them, a system ID is generated based on the component identifier of each component in the system, serving as the unique identifier for the entire zero-trust system.

[0068] The systemID can then be distributed to every component in the zero-trust system and stored locally on each component. If the zero-trust system is updated or a new component is added, the systemID will be regenerated and updated to all components.

[0069] When establishing an SSL connection between any two components, each acts as both client and server. The client initiates a connection request (client hello) to the server. The client appends two extension fields to the end of the extensions field in the connection request: one identifies its own MAC address, and the other identifies a password calculated from its own MAC address and the systemID. The calculation method can be pre-set and is known throughout the system.

[0070] After receiving the client hello, the server obtains the information from the extension fields, calculates a reference password using its local systemID and the MAC message sent by the client, and compares it with the password sent by the client. If they do not match, the connection is closed directly; if they match, the server responds with a server hello, and appends two extension fields to the end of the extensions field in the response: one is identified by its own MAC information, and the other is identified by the password calculated from its own MAC information and systemID.

[0071] After receiving the server hello message, the client obtains the information from the extended fields, calculates a reference password using its local systemID and the MAC address sent by the server, and compares this reference password with the password sent by the server. If they match, the negotiation is complete and an SSL connection is established; otherwise, the connection is closed.

[0072] Based on the same inventive concept, embodiments of this disclosure also provide an apparatus for establishing a secure connection, corresponding to the method for establishing a secure connection. See also Figure 5 , Figure 5 An apparatus for establishing a secure connection is provided in an embodiment of this disclosure. This apparatus is applied to a first component in a zero-trust system, and the first component can be any component within the zero-trust system. The apparatus may include:

[0073] The first calculation module 510 is used to calculate the first password based on the locally stored system identifier and the first MAC information;

[0074] The first sending module 520 is used to send a first connection request to a second component in the zero-trust system. The first connection request includes a first password and first MAC information.

[0075] The first receiving module 530 is used to receive a first response sent by the second component corresponding to the first connection request. The first response includes a second password and second MAC information.

[0076] The second calculation module 540 is used to calculate the first reference password based on the second MAC information and the system identifier stored locally;

[0077] Connection module 550 is used to establish a secure connection with the second component if the first reference password and the second password are the same.

[0078] Optionally, the device for establishing a secure connection may also include:

[0079] The second receiving module is used to receive a second connection request sent by the third component. The second connection request includes a third password and third MAC information.

[0080] The third calculation module is used to calculate the second reference password based on the locally stored system identifier and the third MAC information;

[0081] The fourth calculation module is used to calculate the fourth password based on the locally stored system identifier and the first MAC information if the second reference password matches the third password.

[0082] The second sending module is used to send a second response to the third component. The second response includes a fourth password and first MAC information.

[0083] Optionally, the first connection request may include a first extended field, and the means for establishing a secure connection may further include:

[0084] The second module is used to add the first password and the first MAC information to the first extended field.

[0085] Optionally, the second response includes a second extended field, and the means for establishing a secure connection may further include:

[0086] The second add module is used to add a fourth password and the first MAC information to the second extended field.

[0087] Optionally, the device for establishing a secure connection may also include:

[0088] The acquisition module is used to acquire the component identifier of each component in the zero-trust system;

[0089] A generation module is used to generate a system identifier based on the component identifier of each component. According to embodiments of this disclosure, two-way authentication between components can be achieved by carrying passwords in connection requests and responses between components. Compared to one-way authentication, the method of two-way authentication between components enhances the security of a zero-trust system.

[0090] The more components a zero-trust system has, the more important secure connections between them become. According to embodiments of this disclosure, generating a password through a unique identifier for the entire zero-trust system and carrying the password in connection requests and responses between components can reduce the risk of system attacks and improve security.

[0091] Based on the same inventive concept, this disclosure also provides a network device, such as... Figure 6 As shown, the system includes a processor 610, a transceiver 620, and a machine-readable storage medium 630. The machine-readable storage medium 630 stores machine-executable instructions that can be executed by the processor 610. The processor 610 is prompted by the machine-executable instructions to execute the method for establishing a secure connection provided in the embodiments of this disclosure. (The foregoing...) Figure 5 The device for establishing a secure connection shown can be used as follows: Figure 6 The hardware structure of the network device shown is implemented.

[0092] The aforementioned computer-readable storage medium 630 may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the computer-readable storage medium 630 may also be at least one storage device located remotely from the aforementioned processor 610.

[0093] The processor 610 mentioned above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0094] In this embodiment of the disclosure, the processor 610 reads machine-executable instructions stored in the machine-readable storage medium 630, and is prompted by the machine-executable instructions to enable the processor 610 itself and the transceiver 620 to execute the method for establishing a secure connection described in the foregoing embodiments of the disclosure.

[0095] In addition, this disclosure provides a machine-readable storage medium 630 that stores machine-executable instructions. When called and executed by a processor 610, the machine-executable instructions cause the processor 610 itself and the transceiver 620 to execute the method for establishing a secure connection described in the foregoing embodiments of this disclosure.

[0096] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0097] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0098] For the embodiments of the apparatus for establishing a secure connection and the machine-readable storage medium, since the methods involved are basically similar to those in the foregoing method embodiments, the description is relatively simple, and relevant details can be found in the descriptions of the method embodiments.

[0099] The above description is merely a preferred embodiment of this disclosure and is not intended to limit this disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for establishing a secure connection, characterized in that, The method, applied to a first component in a zero-trust system, includes: The first password is calculated based on the locally stored system identifier and the first MAC information; wherein, the system identifier is determined in the following way: a system identifier is generated based on the component identifier of each component in the zero trust system, which serves as the unique identifier of the zero trust system, is distributed to each component and stored locally on the component; the first MAC information is the MAC information of the first component; Send a first connection request to the second component in the zero-trust system, the first connection request including a first password and first MAC information; Receive a first response sent by the second component corresponding to the first connection request, the first response including a second password and second MAC information; the second MAC information is the MAC information of the second component; Calculate the first reference password based on the second MAC information and the locally stored system identifier; If the first reference password and the second password match, a secure connection is established with the second component.

2. The method according to claim 1, characterized in that, The method further includes: Receive a second connection request sent by a third component, the second connection request including a third password and third MAC information; Calculate the second reference password based on the locally stored system identifier and the third MAC information; If the second reference password matches the third password, then the fourth password is calculated based on the locally stored system identifier and the first MAC information; A second response is sent to the third component, the second response including the fourth password and the first MAC information.

3. The method according to claim 1, characterized in that, The first connection request includes a first extended field, and the method further includes: Add the first password and the first MAC information to the first extended field.

4. The method according to claim 2, characterized in that, The second response includes a second extended field, and the method further includes: Add the fourth password and the first MAC information to the second extended field.

5. The method according to claim 1, characterized in that, The method further includes: Obtain the component identifier of each component in the zero-trust system; The system identifier is generated based on the component identifier of each component.

6. A device for establishing a secure connection, characterized in that, A first component applied in a zero-trust system, the device comprising: The first calculation module is used to calculate the first password based on the locally stored system identifier and the first MAC information; wherein, the system identifier is determined by generating a system identifier based on the component identifier of each component in the zero trust system, which serves as the unique identifier of the zero trust system, is distributed to each component and stored locally in the component; the first MAC information is the MAC information of the first component; A first sending module is configured to send a first connection request to a second component in the zero-trust system, the first connection request including a first password and first MAC information; The first receiving module is configured to receive a first response sent by the second component corresponding to the first connection request, wherein the first response includes a second password and second MAC information; the second MAC information is the MAC information of the second component. The second calculation module is used to calculate the first reference password based on the second MAC information and the locally stored system identifier; A connection module is used to establish a secure connection with the second component if the first reference password and the second password are the same.

7. The apparatus according to claim 6, characterized in that, The device further includes: The second receiving module is used to receive a second connection request sent by the third component, the second connection request including a third password and third MAC information; The third calculation module is used to calculate the second reference password based on the locally stored system identifier and the third MAC information; The fourth calculation module is used to calculate the fourth password based on the locally stored system identifier and the first MAC information if the second reference password is consistent with the third password; The second sending module is used to send a second response to the third component, the second response including the fourth password and the first MAC information.

8. The apparatus according to claim 6, characterized in that, The first connection request includes a first extended field, and the device further includes: The second adding module is used to add the first password and the first MAC information to the first extended field.

9. The apparatus according to claim 7, characterized in that, The second response includes a second extended field, and the device further includes: The second adding module is used to add the fourth password and the first MAC information to the second extended field.

10. The apparatus according to claim 6, characterized in that, The device further includes: The acquisition module is used to acquire the component identifier of each component in the zero-trust system; The generation module is used to generate the system identifier based on the component identifier of each component.

Images