Networking communication method and communication system based on zero trust security management platform

Abstract

The embodiment of the application discloses a networking communication method and a communication system based on a zero-trust security management platform, the method comprising: after a client logs in, performing network access authentication on a server; after the network access authentication is completed, the client acquires a first networking configuration file issued by the zero-trust security management platform; the client establishes networking with the server according to the first networking configuration file and a randomly generated communication secret key, and establishes networking; when the zero-trust security management platform receives an input updated configuration file, the zero-trust security management platform issues an HTTP update notification to a center network in response to the received updated configuration file; the center network performs configuration file update processing with a subnet in response to the HTTP update notification, and updates the configuration of the center network and the subnet. The application can establish networking more safely and conveniently through the issued networking configuration file, and flexibly implement remote update configuration, thereby reducing maintenance cost.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a networking communication method and a communication system based on a zero-trust security management platform. BACKGROUND

[0002] With the development and perfection of new technologies such as cloud computing, Internet of Things, and big data, zero-trust security technology has gradually entered people's field of vision and become a new concept, new architecture, and new solution to solve network security in the new era. Zero-trust technology is a network security defense mode, and its core concept is "never trust, always verify". Under the zero-trust security mode, all access requests are required to be continuously verified and authorized to ensure that only legitimate requests can access network resources.

[0003] The application of zero-trust access is mainly divided into B / S application and C / S application, and the zero-trust system needs to distribute the access tunnels of B / S application and C / S application. Among them, the B / S application adopts an application layer proxy tunnel to forward data traffic, and the C / S application adopts a terminal to create a virtual network card to forward data traffic at the network layer. In the traditional technology, the method for realizing network tunnel configuration is complex and the update configuration is not flexible, so that it is necessary to configure and process by a special person to build a virtual network management, and the maintenance cost is high and difficult. And in the process of building a network tunnel, there may be intrusion into the original application system and threat to the original security. SUMMARY

[0004] The following is a summary of the subject matter described in detail herein.

[0005] The embodiment of the present application provides a networking communication method and system based on a zero-trust security management platform, an electronic device, and a medium, which can establish networking more safely and conveniently through the issued networking configuration file, and flexibly realize remote update configuration to reduce maintenance cost.

[0006] In a first aspect, the embodiment of the present application provides a networking communication method based on a zero-trust security management platform, applied to a communication system, the communication system comprising: a zero-trust security management platform, a server, and a plurality of clients; wherein the server is deployed in a center network; the client is deployed in a subnet; the zero-trust security management platform and the client are in communication connection with the server.

[0007] The method comprises:

[0008] After the client logs in, the client performs network access authentication on the server;

[0009] After the network access authentication is completed, the client obtains a first networking configuration file issued by the zero-trust security management platform;

[0010] The client establishes a networking establishment process with the server according to the first set of networking configuration files and the randomly generated communication key, and establishes networking;

[0011] When the zero-trust security management platform receives an input updated configuration file, an HTTP update notification is issued to the center network in response to the received updated configuration file; wherein the updated configuration file includes: an updated second set of networking configuration files or a policy configuration file;

[0012] The center network updates the configuration of the center network and the subnetwork in response to the HTTP update notification and the configuration file update process with the subnetwork.

[0013] According to some embodiments of the present application, the network authentication on the server includes:

[0014] The client sends a first UDP knock request to the server in response to user login knock; wherein the first UDP knock request includes first request data; the first request data includes the first key generated by the client, the first random number, and SPA assembly data;

[0015] The server responds to the first UDP knock request, and based on the first key, the first random number and the SPA assembly data, performs first data processing on the first request data, caches the first random number, and temporarily opens the real IP and real port;

[0016] The client uses the first key to encrypt the first random number and the generated first temporary public key to generate second request data, and sends a first UDP service request to the server; the first UDP service request includes the second request data;

[0017] The server responds to the first UDP service request, calculates a session key according to the first random number, the first temporary key, a generated second random number and a second temporary key, encrypts the second random number and the second temporary public key based on the first key to generate first response data, and returns a first UDP service response to the client; the first UDP service response carries the first response data;

[0018] The client decrypts the first response data according to the first key to obtain the second random number and the second temporary key; and calculates and caches a session key according to the first random number, the first temporary key, the second random number and the second temporary key.

[0019] According to some embodiments of the present application, before the session key is calculated according to the first random number, the first temporary key, the generated second random number and the second temporary key, the method further comprises:

[0020] The server side performs second data processing on the second request data based on the first key in response to the first UDP service request, to obtain the first random number carried in the first UDP service request;

[0021] In the case that the first random number in the first UDP service request is consistent with the cached first random number, the second random number and the second temporary public key are generated.

[0022] According to some embodiments of the present application, the client performs a networking establishment process with the server side according to the first networking configuration file and the randomly generated communication key, to establish networking, comprising:

[0023] The client performs third data processing according to the randomly generated communication key, the client networking key obtained from the first networking configuration file, the virtual IP, the center network point public key of the center network to be connected, and the server side public network IP, to obtain third request data; the second UDP knock request is sent to the server side; the second UDP knock request includes the third request data;

[0024] The server side performs verification processing according to the center network point private key and the client public key obtained from the first networking configuration file in response to the second UDP knock request, and temporarily opens the virtual IP, the real IP and the real IP port to the client after the verification is passed.

[0025] The client sends a heartbeat packet to the server side at regular intervals.

[0026] According to some embodiments of the present application, when the client includes a first client and a second client; after the networking is established, the method further comprises:

[0027] Through the server, the first client and the second client perform encrypted communication according to the first session key and the second session key; wherein the first session key is established by the first client and the center network; and the second session key is established by the second client and the center network.

[0028] According to some embodiments of the present application, the center network performs configuration file update processing with the subnetwork in response to the HTTP update notification, to update the configuration of the center network and the subnetwork, comprising:

[0029] The central network updates according to the updated configuration file in response to the HTTP update notification, and broadcasts a configuration file update notification to the connected subnetworks when it is confirmed that an update is needed.

[0030] The subnetwork updates according to the updated configuration file in response to the configuration file update notification, and returns a knock-and-get request for obtaining a configuration file and a get request to the zero-trust security management platform when it is confirmed that an update is needed.

[0031] The zero-trust security management platform sends the updated configuration file to the subnetwork in response to the knock-and-get request for obtaining a configuration file and the get request, so that the subnetwork updates according to the updated configuration file.

[0032] According to some embodiments of the present application, before the onboarding authentication on the service end, the method further comprises: the client logs in on the zero-trust security management platform and the service end.

[0033] In a second aspect, the embodiments of the present application provide a communication system, comprising: a zero-trust security management platform, a service end, and a plurality of clients; wherein the service end is deployed in a central network; the clients are deployed in subnetworks; the zero-trust security management platform and the clients are in communication connection with the service end.

[0034] The client is configured to: after logging in, perform onboarding authentication on the service end; after the onboarding authentication is completed, obtain a first network configuration file issued by the zero-trust security management platform; and perform a network establishment process with the service end according to the first network configuration file and a randomly generated communication key, to establish a network.

[0035] The zero-trust security management platform is configured to: receive an inputted updated configuration file, and issue an HTTP update notification in response to the received updated configuration file to the central network; wherein the updated configuration file comprises an updated second network configuration file or a policy configuration file.

[0036] The central network is configured to: respond to the HTTP update notification, and perform network configuration file update processing with the subnetworks, to update the central network and the subnetworks.

[0037] In a third aspect, the embodiments of the present application provide an electronic device, comprising at least one processor and a memory in communication connection with the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the zero-trust security management platform-based network communication method according to any one of the first aspect.

[0038] In a fourth aspect, an embodiment of the present application provides a storage medium, which is a computer readable storage medium, and stores computer executable instructions for causing a computer to execute the networking communication method based on the zero-trust security management platform according to any one of the first aspect.

[0039] Embodiments of the present application include: after a client logs in, in-network authentication is performed on a server; after the in-network authentication is completed, the client obtains a first networking configuration file issued by a zero-trust security management platform; the client establishes networking with the server according to the first networking configuration file and a randomly generated communication key, and establishes networking; the networking is established more safely and conveniently; when the zero-trust security management platform receives an input updated configuration file, an HTTP update notification is issued to a center network in response to the received updated configuration file; wherein the updated configuration file includes an updated second networking configuration file or a policy configuration file; the center network performs configuration file update processing with the subnet in response to the HTTP update notification, and updates the configuration of the center network and the subnet; remote configuration update is realized, and the maintenance cost is reduced. That is, the embodiments of the present application can establish networking more safely and conveniently through the issued networking configuration file, and flexibly realize remote configuration update and reduce the maintenance cost.

[0040] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the present application. The objects and other advantages of the present application can be achieved and obtained by means of the structure particularly pointed out in the description and the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 is a structural schematic diagram of a communication system provided by an embodiment of the present application;

[0042] Figure 2 is a flowchart of a networking communication method based on a zero-trust security management platform provided by an embodiment of the present application;

[0043] Figure 3 is a flowchart of a client logging in a zero-trust security management platform provided by an embodiment of the present application;

[0044] Figure 4 is a flowchart of in-network authentication provided by an embodiment of the present application;

[0045] Figure 5 is a flowchart of establishing networking provided by an embodiment of the present application;

[0046] Figure 6 is a flowchart of encrypted communication based on established networking provided by an embodiment of the present application;

[0047] Figure 7 Figure 1 is a flow diagram of updating a configuration file according to an embodiment of the present application.

[0048] Figure 8 Figure 2 is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments.

[0050] It should be noted that although the logical order is shown in the flowchart in the description of the present application, in some cases, the steps shown or described can be performed in an order different from that in the flowchart. In the description of the present application, the meaning of "one or more" is one or more, and the meaning of "multiple" is two or more. The description of "first", "second" is only for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or the order of indicated technical features.

[0051] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0052] First, some terms involved in the present application are explained:

[0053] UDP (User Datagram Protocol) is a connectionless network communication protocol, which together with TCP (Transmission Control Protocol) constitutes the core of the Internet Protocol Suite (TCP / IP). UDP provides a method for transmitting data packets in a network.

[0054] TUN technology is a virtual network device created in the operating system kernel, allowing user space programs to read or write IP packets. TUN technology is commonly used to implement network layer tunnels, such as point-to-point IP tunnels, such as OpenVPN and IPSec. The TUN device simulates a three-layer network device that can handle data from the network layer, i.e. IP packets.

[0055] The embodiment of the present application provides a networking communication method and communication system, electronic device, and computer-readable storage medium based on a zero-trust security management platform. The method includes: after the client logs in, network authentication is performed on the server; after the network authentication is completed, the client obtains the first networking configuration file issued by the zero-trust security management platform; the client performs a networking establishment process with the server based on the first networking configuration file and a randomly generated communication key to establish a network; when the zero-trust security management platform receives the input updated configuration file, it sends an HTTP update notification to the central network in response to the received updated configuration file; the central network performs configuration file update processing with the subnet in response to the HTTP update notification, and updates the configuration of the central network and the subnet. The present application can establish a network more safely and conveniently through the issued networking configuration file, and flexibly implement remote configuration updates to reduce maintenance costs.

[0056] The embodiments of the present application are further described below with reference to the accompanying drawings.

[0057] like Figure 1 As shown, the present application provides a communication system, including: a zero-trust security management platform, a server, and multiple clients; wherein, the server is deployed in a central network; the client is deployed in a subnet; the zero-trust security management platform and the client are both communicated with the server.

[0058] The client is used to: after logging in, perform network authentication on the server; after completing the network authentication, obtain the first network configuration file issued by the zero-trust security management platform; and establish a network with the server based on the first network configuration file and the randomly generated communication key.

[0059] When the zero trust security management platform is used to: receive an input updated second networking configuration file, and send an HTTP update notification to the central network in response to the received second networking configuration file;

[0060] The central network is used to: respond to HTTP update notifications, perform networking configuration file update processing with the subnets, and update the central network and the subnets.

[0061] It can be understood that the zero-trust security management platform is a platform based on a zero-trust trusted digital identity security project, and the zero-trust security management platform manages the network access authentication, networking authentication, and access permission configuration and remote update of all protected devices (such as terminals, servers, clients, and the like). The configuration range of the zero-trust security management platform includes: issuing a networking configuration file and a policy configuration file to the center network, wherein the networking configuration file defines the network access mode and networking credentials of the protected device; and the policy configuration file defines the accessible range and flow limiting speed of the protected devices. The remote update refers to that after the configuration file is modified, the configuration file can be issued to the protected device or the protected device actively requests to update the configuration file.

[0062] It can be understood that the networking configuration file is used between the center network and the subnetwork, and the center network and the subnetwork complete mutual two-way security authentication and negotiate a session key for encrypted data transmission in a defined knock authentication, computing negotiation key, and timing heartbeat manner. The center network can also receive the policy configuration file issued by the zero-trust security management platform, and intercept and filter the data flowing through the center network in an actual communication process by using a firewall and the like.

[0063] It can be understood that the application uses the TUN technology to establish a network tunnel, and completes the construction of a virtual network without affecting (not invading) the original application system deployment. The center network provides a container deployment mode. The subnetwork provides multiple installation modes, and supports clients of platforms such as windows, linux, and mac. After a user installs the client, selects a login mode to connect to the network, and completes network access authentication, the user can obtain the networking configuration file. The client subsequently calculates a secure session key according to the networking configuration file, and automatically completes the networking process. When the configuration file (including the updated second networking configuration file and the policy configuration file) needs to be updated, the latest configuration file is automatically requested to update.

[0064] In summary, according to the communication system provided by the embodiments of the application, under the mutual cooperation of the zero-trust security management platform, the server, and the client, the networking can be relatively safely and conveniently established through the issued networking configuration file, and the remote configuration update is flexibly implemented, thereby reducing the maintenance cost.

[0065] It can be understood by those skilled in the art that the system structure shown in the figure does not constitute a limitation on the embodiments of the application, and can include more or fewer components than those shown in the figure, or combine certain components, or different component arrangements.

[0066] The system embodiment described above is merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0067] Those skilled in the art will understand that the system architecture and application scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will know that with the evolution of the system architecture and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0068] Based on the above system structure, various embodiments of the networking communication method based on the zero-trust security management platform of the present application are proposed below.

[0069] like Figure 2 As shown, the networking communication method based on the zero-trust security management platform can be applied to Figure 1 The communication system shown includes: a zero-trust security management platform, a server, and multiple clients; wherein the server is deployed in a central network; the clients are deployed in a subnet; and the zero-trust security management platform and the clients are both in communication with the server. The network communication method may include, but is not limited to, steps S110 to S150.

[0070] Step S110: After the client logs in, network authentication is performed on the server.

[0071] Step S120: After the network access authentication is completed, the client obtains the first networking configuration file issued by the zero-trust security management platform.

[0072] Step S130: The client performs a network establishment process with the server according to the first networking configuration file and the randomly generated communication key to establish a network.

[0073] Step S140: When the zero-trust security management platform receives the input updated configuration file, it sends an HTTP update notification to the central network in response to the received updated configuration file; wherein the updated configuration file includes: an updated second networking configuration file or a policy configuration file.

[0074] Step S150: The central network responds to the HTTP update notification and performs configuration file update processing with the subnet to update the configuration of the central network and the subnet.

[0075] According to some embodiments of the present application, before performing network access authentication on the server, the method also includes: the client logs in to the zero-trust security management platform and the server.

[0076] Through steps S110 to S150, after the client logs in, the network access authentication is performed on the server in the communication system; after the network access authentication is completed, the client obtains the first group network configuration file issued by the zero-trust security management platform; the client establishes the group network with the server according to the first group network configuration file and the randomly generated communication secret key, and establishes the group network; the group network is more securely and conveniently established; when the zero-trust security management platform receives the input updated configuration file, the HTTP update notification is issued to the center network in response to the received updated configuration file; wherein the updated configuration file includes: the updated second group network configuration file or the policy configuration file; the center network performs the configuration file update processing with the subnet in response to the HTTP update notification, and updates the configuration of the center network and the subnet; the remote configuration update is realized, and the maintenance cost is reduced. Therefore, the embodiments of the application can more securely and conveniently establish the group network through the issued group network configuration file, and flexibly realize the remote configuration update and reduce the maintenance cost.

[0077] Taking an example, the process of the client logging in the zero-trust security management platform is further described in combination with Figure 3 The process of the client logging in the zero-trust security management platform mainly includes a login knocking stage and a login stage.

[0078] Specifically, after the client installs the preset root certificate, the login knocking is performed. The login knocking stage includes:

[0079] Firstly, the client generates a random number in response to receiving the user input account and password, and encrypts the account, the password and the random number using the root certificate for protection; and requests the zero-trust security management platform for login knocking.

[0080] Then, the zero-trust security management platform decrypts the ciphertext carried by the login knocking request using the root certificate secret key, obtains the account and the password, and verifies the account password to obtain the random factor (i.e. the random number) and the secret key; and then performs business processing and temporarily opens the knocking port.

[0081] Finally, after the knocking port is temporarily opened, the client performs login. The login stage includes:

[0082] Firstly, the client encrypts the login information (including the account and the password) using the random factor (i.e. the random number), assembles a message, and requests the zero-trust security management platform for login, wherein the request data for requesting login includes the assembled message.

[0083] Then, the zero-trust security management platform parses the message, decrypts to obtain the login information using the cache secret key, signs the login mode and other information using the root certificate private key, deletes the temporary knocking port, deletes the online random number, and responds to login.

[0084] Then, the client parses the message carried in the login response, decrypts using the secret key, verifies using the root certificate, and saves the agency information encrypted using the account password to the local.

[0085] Taking an example, the process of the client logging into the server provided by the embodiments of the present application is further described.

[0086] First, the user inputs the account password on the client, the client assembles the message data according to the message protocol, and sends a login knock to the server using UDP.

[0087] Second, after receiving the login knock, the server checks the reported data for legality, and temporarily opens the firewall if the check is passed.

[0088] Then, the client sends a login request after a 1s delay, and the server can receive the reported message during the temporary opening of the firewall.

[0089] Finally, the server processes the request login message and responds to the agency information of the user.

[0090] According to some embodiments of the present application, step S110 is further described, wherein the network access authentication on the server includes but is not limited to steps S111 to S115.

[0091] Step S111: the client sends a first UDP knock request to the server in response to the user login knock; wherein the first UDP knock request includes first request data; the first request data includes a first secret key generated by the client, a first random number, and SPA assembly data;

[0092] Step S112: the server, in response to the first UDP knock request, performs first data processing on the first request data based on the first secret key, the first random number, and the SPA assembly data, caches the first random number, and temporarily opens the real IP and real port;

[0093] Step S113: the client encrypts the first random number and the generated first temporary public key using the first secret key to generate second request data, and sends a first UDP service request to the server; the first UDP service request includes the second request data;

[0094] Step S114: the server, in response to the first UDP service request, calculates a session key according to the first random number, the first temporary secret key, a generated second random number, and a second temporary secret key; encrypts the second random number and the second temporary public key based on the first secret key to generate first response data; returns a first UDP service response to the client; the first UDP service response carries the first response data;

[0095] Step S115: The client decrypts the first response data according to the first secret key, to obtain the second random number and the second temporary secret key; and calculates and caches the session key according to the first random number, the first temporary secret key, the second random number and the second temporary secret key.

[0096] According to some embodiments of the present application, step S114 is further explained as follows: before the session key is calculated according to the first random number, the first temporary secret key, the generated second random number and the second temporary secret key, the method further comprises:

[0097] Firstly, the server responds to the first UDP service request, performs second data processing on the second request data based on the first secret key, and obtains the first random number carried in the first UDP service request.

[0098] Secondly, in the case that the first random number in the first UDP service request is consistent with the cached first random number, the second random number and the second temporary public key are generated.

[0099] Through steps S111 to S115, the client realizes network access authentication, which lays a foundation for subsequent communication.

[0100] Taking an example, in combination with Figure 4 , the network access authentication process provided by the embodiments of the present application is further explained.

[0101] Specifically, the network access authentication process mainly includes four stages, which are: client request for knocking on the door, server response to knocking on the door, client request for service, server response to service, and client processing service.

[0102] Among them, the client request for knocking on the door includes:

[0103] (1) The user selects a certain institution in the institution list through the interface; that is, selects the login authentication institution list that needs to be selected.

[0104] (2) The client calls the account password (institution list) of the virtual user command, requests the password to be signed using the private key according to the data format, assembles the response signature and objeatld, and obtains the secret key encrypted SPA data.

[0105] (3) The client randomly generates a random number (i.e. the first random number) and a timestamp; assembles the account, timestamp, random number, etc. to assemble SPA; uses the secret key encrypted SPA data generated by the user login knocking on the door to calculate MAC; and generates request data.

[0106] (4) The client initiates a UDP request to the server with the request data.

[0107] The server response to knocking on the door includes:

[0108] (1) The server receives the UDP, checks the timestamp to prevent replay and the legality of the user account.

[0109] (2) The virtual user corresponding to the key generated by the login knocking of the user is queried, the request data is decrypted, and the SPA is obtained.

[0110] (3) The objectid in the SPA is extracted, the corresponding terminal public key is queried using the objectid, and the SPA is verified.

[0111] (4) The server caches the random number in the request data.

[0112] (5) The real IP and its port are temporarily opened.

[0113] The client requests services, including: the client encrypts the first random number and the first temporary public key using the key generated by the login knocking of the user, as request data. The client initiates a UDP request to the server.

[0114] The server responds to the service, including:

[0115] (1) The server receives the UDP, checks the timestamp to prevent replay and the legality of the user account.

[0116] (2) The virtual user corresponding to the key generated by the login knocking of the user is queried, the request data is decrypted, and the SPA is obtained.

[0117] (3) The first random number in the cache is compared with the random number in the request data.

[0118] (4) If they are consistent, a second temporary public key and a second random number are generated, encrypted using the key generated by the login knocking of the user, and the response data is generated according to the data format.

[0119] (5) The SM2 key agreement is calculated using the (temporary) public and private keys and the random number, and the session key is obtained.

[0120] The client processes the service, including:

[0121] (1) The client receives the response service UDP, decrypts the service data using the private key generated by the login knocking of the user, calculates the SM2 key agreement using the (temporary) public and private keys, and obtains the session key.

[0122] (2) The transmission session key is cached locally. The user is returned a login success message.

[0123] According to some embodiments of the present application, step S130 is further described, and the client establishes a networking process with the server according to the first networking configuration file and the randomly generated communication key, and establishes networking, including:

[0124] Step S131: The client performs third data processing according to the randomly generated communication secret key, the client networking secret key obtained from the first networking configuration file, the virtual IP, the central network point public key of the central network to be connected, and the server public network IP, to obtain third request data; the second UDP knock request is sent to the server; the second UDP knock request includes the third request data.

[0125] Step S132: The server responds to the second UDP knock request, performs verification processing according to the central network point private key and the client public key obtained from the first networking configuration file, and temporarily opens the virtual IP, the real IP, and the real IP port to the client after the verification is passed.

[0126] Step S133: The client sends a heartbeat packet to the server at regular intervals.

[0127] Through steps S131 to S133, the embodiment of the application establishes networking based on the first networking configuration file more safely and conveniently.

[0128] Taking an example, in combination with Figure 5 , the process of establishing networking provided by the embodiment of the application is further described.

[0129] Specifically, the process of establishing networking includes two stages, which are: client request knock and server response knock.

[0130] Among them, the client request knock includes:

[0131] (1) The user initiates a request connection by clicking an interface.

[0132] (2) The client randomly generates a plaintext key as a communication secret key.

[0133] (3) The program uses the client networking private key to sign the virtual IP and the plaintext key according to the configuration file.

[0134] (4) The public key of the central network point (i.e. the public key of the peer server) that needs to be connected is used to encrypt (i.e. encrypt the plaintext key) the virtual IP and the signature value to generate SPA data.

[0135] (5) Record the public network IP and virtual IP of the peer server for maintaining socket link;

[0136] (6) The client assembles SPA by splicing the virtual IP, the ciphertext key, etc. to generate request data;

[0137] (7) The client initiates a knock UDP request to the server according to the request data.

[0138] The server response knock includes:

[0139] (1) The server receives the UDP, and checks the timestamp to prevent replay.

[0140] (2) The SPA is decrypted using the center node private key (i.e., the service end group network private key) to obtain the virtual IP of the client and a random secret key (i.e., the plaintext key).

[0141] (3) The public key of the peer client is obtained by querying the group network configuration file through the virtual IP of the client, and the public IP and virtual IP of the peer client are recorded.

[0142] (4) The decrypted SPA is verified using the public key of the client.

[0143] (5) The real IP and port of the peer client are recorded, and the virtual IP and real IP and port are temporarily opened.

[0144] (6) The client returns a notification of successful link to the user, and periodically sends a heartbeat packet UDP to the server.

[0145] According to some embodiments of the present application, when the client includes a first client and a second client; after the group network is established, the method further includes:

[0146] Through the server, the first client and the second client perform encrypted communication according to the first session key and the second session key; wherein the first session key is established by the first client and the center network; and the second session key is established by the second client and the center network.

[0147] Taking an example, combining Figure 6 , further illustrate the encryption and decryption communication process provided by the embodiments of the present application. Wherein the first client is client A, and the second client is client B. The first session key established by the first client and the center network is denoted as key A, and the second session key established by the second client and the center network is denoted as key B.

[0148] In the process of encrypted communication after the group network is completed, the client is configured to: use the session key established with the center network to transmit data, and encrypt or decrypt the request data according to the data format. It is also used to initiate a UDP request to the server.

[0149] The server is configured to: receive the UDP, use the session key established with the corresponding subnet, encrypt or decrypt the request data according to the data format, and initiate a UDP request to the client.

[0150] Specifically, first, the client A encrypts the request data using the session key A, and sends a UDP request to the server. The IP header of the UDP request is the public IP of the server, and the data packet contains the virtual IP of the client B as the destination address.

[0151] Secondly, the server decrypts the request data using the session key, encrypts the request data using the session key B according to the sending target address in the request data, and sends a UDP request to the client B, wherein the IP header of the UDP request is the public network IP of the client B, and the data packet contains the virtual IP of the client B as the destination address.

[0152] Then, the client B decrypts the request data using the session key B, encrypts the response data using the session key B, and returns a UDP response to the server, wherein the IP header of the UDP response is the public network IP of the server, and the data packet contains the virtual IP of the client A as the destination address.

[0153] Then, the server decrypts the response data using the session key B, encrypts the response data using the session key A according to the sending target address in the response data, and returns a UDP response to the client A, wherein the IP header of the UDP response is the public network IP of the client A, and the data packet contains the virtual IP of the client A as the destination address.

[0154] Finally, the client A decrypts the response data using the session key A, and completes the encrypted communication with the client B.

[0155] According to some embodiments of the present application, step S150 is further illustrated as follows: step S150: the center network responds to the HTTP update notification, and performs configuration file update processing with the subnet to update the configuration of the center network and the subnet, including but not limited to:

[0156] Step S151: the center network responds to the HTTP update notification, and when it is confirmed that the update is needed, the updated configuration file is used for updating, and a configuration file update notification is broadcast to the connected subnet;

[0157] Step S152: the subnet responds to the configuration file update notification, and when it is confirmed that the update is needed, a knocking request and an acquisition request for obtaining the configuration file are returned to the zero-trust security management platform;

[0158] Step S153: the zero-trust security management platform responds to the knocking request and the acquisition request for obtaining the configuration file, and sends the updated configuration file to the subnet, so that the subnet is updated according to the updated configuration file.

[0159] Through steps S151 to S153, the updated configuration file is issued by the zero-trust security management platform, and remote configuration update is realized, thereby reducing the maintenance cost.

[0160] Taking an example, the process of updating the configuration file provided by the embodiments of the present application is further illustrated in combination with Figure 7

[0161] ​Specifically, first, the zero-trust security management platform configures the center network and subnet information in response to a configuration modification operation through an interface to obtain an updated configuration file; and issues an HTTP update notification to the center network.

[0162] The center network checks whether the center network configuration file is legal and needs to be updated in response to the HTTP update notification, and updates the configuration of the center network when it is confirmed that the updated configuration file is legal and needs to be updated, and broadcasts a configuration file update notification to the subnet.

[0163] Then, the subnet checks whether it needs to be updated in response to the configuration file update notification, and requests the zero-trust security management platform to obtain a configuration file knocking and to obtain a configuration file when it is confirmed that it needs to be updated.

[0164] Next, the zero-trust security management platform responds to the updated configuration file in response to the request of the subnet.

[0165] Finally, the subnet receives the updated configuration file and updates the configuration of the subnet according to the updated configuration file.

[0166] It can be understood that when the administrator modifies the configuration file in the zero-trust security management platform and needs to notify the subnet, the center network will check the configuration file and automatically update the configuration in the case of needing to update the configuration. At the same time, the center network will poll to initiate an update configuration file notification to the connected subnet. The subnet receives the update notification, compares the last update time of the current configuration file, and judges whether it needs to request the management platform to download the configuration file and update the configuration. If it needs to be updated, it requests the zero-trust security management platform to obtain the configuration file, obtains the configuration file, and updates the configuration. Thus, the center network and the subnet are remotely updated, and the maintenance cost is reduced.

[0167] There can be many specific implementation methods, depending on the development of the message protocol and the management method of the networking configuration file. The firewall method and the proxy interception method are different. This application does not repeat here.

[0168] In summary, the embodiment of the application manages the use of the networking configuration file by the protected device (center network and subnet) through the zero-trust security management platform to perform the business process of authentication, network access, and configuration update, which can effectively control the authentication and authorized access of the protected terminal. The center network uses a broadcast method to notify the subnet to judge whether the configuration file is expired and needs to be downloaded and updated. Through the defined transmission message format, the knocking authentication, login authentication, and encrypted transmission (forwarding) of both parties can be realized. Simple deployment can be applied in many fields, such as off-site networking, cross-network office, terminal private network communication, etc., which can effectively protect the communication security.

[0169] In a third aspect, as Figure 8As shown, the present application also provides an electronic device 800, comprising:

[0170] The processor 801 can be implemented in the form of a general-purpose central processing unit, a microprocessor, an application-specific integrated circuit, or one or more integrated circuits, and is used to execute related programs to implement the technical solutions provided by the embodiments of the present application.

[0171] The memory 802 can be implemented in the form of a read-only memory, a static storage device, a dynamic storage device, or a random access memory. The memory 802 can store an operating system and other application programs. When the technical solutions provided by the embodiments of the present application are implemented by software or firmware, the related program codes are stored in the memory 802 and are called and executed by the processor 801 to implement the zero-trust security management platform-based networking communication method of the embodiments of the present application.

[0172] The input / output interface 803 is used to realize information input and output.

[0173] The communication interface 804 is used to realize the communication interaction between the device and other devices, which can realize communication through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0174] The bus 805 transmits information between various components (such as the processor 801, the memory 802, the input / output interface 803, and the communication interface 804) of the device.

[0175] The processor 801, the memory 802, the input / output interface 803, and the communication interface 804 realize communication connection between each other inside the device through the bus 805.

[0176] In a fourth aspect, the embodiments of the present application provide a storage medium, which is a computer-readable storage medium, and the computer-readable storage medium stores computer executable instructions. The computer executable instructions are used to make a computer execute the zero-trust security management platform-based networking communication method of the above-mentioned embodiments.

[0177] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory disposed remotely relative to the processor, which can be connected to the processor through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The above-described device embodiments are only illustrative, and units described as separate components can or can not be physically separated, implemented in one place, or distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the present embodiment.

[0178] Those of ordinary skill in the art can understand that all or some steps in the above disclosed method and system can be implemented as software, firmware, hardware, and appropriate combinations thereof. Some or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transitory media). As known to those of ordinary skill in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage, or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, as known to those of ordinary skill in the art, communication media typically includes computer readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transport mechanisms, and can include any information delivery medium.

[0179] The above is a specific description of the preferred embodiments of the present application, but the present application is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or replacements without departing from the spirit of the present application, and these equivalent modifications or replacements are all included in the scope defined by the claims of the present application.

Claims

1. A networking communication method based on a zero-trust security management platform, characterized in that: Applied to a communication system, the communication system includes: a zero-trust security management platform, a server, and multiple clients; wherein the server is deployed in a central network; the clients are deployed in a subnet; the zero-trust security management platform and the clients are both in communication connection with the server; The method comprises: After logging in, the client performs network authentication on the server; After the network access authentication is completed, the client obtains the first networking configuration file issued by the zero-trust security management platform; The client performs a network establishment process with the server according to the first networking configuration file and the randomly generated communication key to establish a network; When the zero-trust security management platform receives the input updated configuration file, it sends an HTTP update notification to the central network in response to the received updated configuration file; wherein the updated configuration file includes: an updated second networking configuration file or a policy configuration file; In response to the HTTP update notification, the central network performs configuration file update processing with the subnet to update the configurations of the central network and the subnet.

2. The networking communication method based on the zero-trust security management platform according to claim 1, characterized in that: The network access authentication on the server includes: In response to the user logging in and knocking on the door, the client sends a first UDP knock request to the server; wherein the first UDP knock request includes first request data; the first request data includes a first secret key, a first random number, and SPA assembly data generated by the client; The server responds to the first UDP knock request, performs first data processing on the first request data based on the first secret key, the first random number, and the SPA assembly data, caches the first random number, and temporarily opens the real IP and real port; The client encrypts the first random number and the generated first temporary public key using the first secret key to generate second request data, and sends a first UDP service request to the server; the first UDP service request includes the second request data; The server, in response to the first UDP service request, calculates a session key based on the first random number, the first temporary key, the generated second random number, and the second temporary key; encrypts the second random number and the second temporary public key based on the first key to generate first response data; and returns a first UDP service response to the client; the first UDP service response carries the first response data; The client decrypts the first response data according to the first key to obtain the second random number and the second temporary key; and calculates and caches the session key according to the first random number, the first temporary key, the second random number, and the second temporary key.

3. The networking communication method based on the zero-trust security management platform according to claim 2, characterized in that: Before calculating the session key according to the first random number, the first temporary key, the generated second random number, and the second temporary key, the method further includes: The server performs second data processing on the second request data based on the first secret key in response to the first UDP service request to obtain a first random number carried in the first UDP service request; When the first random number in the first UDP service request is consistent with the cached first random number, the second random number and the second temporary public key are generated.

4. The networking communication method based on the zero-trust security management platform according to claim 1, characterized in that: The client performs a network establishment process with the server according to the first networking configuration file and the randomly generated communication key to establish a network, including: The client performs third data processing based on the randomly generated communication key, the client networking key obtained from the first networking configuration file, the virtual IP, the central network node public key of the central network to be connected, and the public network IP of the server to obtain third request data; sends a second UDP knock request to the server; the second UDP knock request includes the third request data; The server responds to the second UDP knock request by performing verification based on the central node private key and the client public key obtained from the first networking configuration file. If the verification passes, the server temporarily opens the virtual IP, real IP, and real IP port to the client. The client sends heartbeat packets to the server at regular intervals.

5. The networking communication method based on the zero-trust security management platform according to claim 2, characterized in that: When the client includes a first client and a second client; After establishing the network, the method further includes: Through the server, the first client and the second client perform encrypted communication based on a first session key and a second session key; wherein, the first session key is established by the first client and the central network; the second session key is established by the second client and the central network.

6. The networking communication method based on the zero-trust security management platform according to claim 1, characterized in that: The central network performs configuration file update processing with the subnet in response to the HTTP update notification to update the configuration of the central network and the subnet, including: The central network responds to the HTTP update notification, and when confirming that an update is required, updates the configuration file according to the updated configuration file, and broadcasts the configuration file update notification to the connected subnets; The subnet responds to the configuration file update notification and, when confirming that an update is required, returns a knock request and an acquisition request for obtaining the configuration file to the zero-trust security management platform; The zero-trust security management platform sends the updated configuration file to the subnet in response to the knock request and the get request for obtaining the configuration file, so that the subnet is updated according to the updated configuration file.

7. The networking communication method based on the zero-trust security management platform according to claim 1, characterized in that: Before performing network access authentication on the server, the method further includes: the client logging in to the zero-trust security management platform and the server.

8. A communication system, characterized in that: include: A zero-trust security management platform, a server, and multiple clients; wherein the server is deployed in a central network; the client is deployed in a subnet; the zero-trust security management platform and the client are both in communication with the server; The client is configured to: after logging in, perform network authentication on the server; after completing the network authentication, obtain a first networking configuration file issued by the zero-trust security management platform; and perform a network establishment process with the server based on the first networking configuration file and a randomly generated communication key to establish a network; When the zero trust security management platform is used to: receive an input updated configuration file, in response to the received updated configuration file, send an HTTP update notification to the central network; wherein the updated configuration file includes: an updated second networking configuration file or a policy configuration file; The central network is used to: in response to the HTTP update notification, perform networking configuration file update processing with the subnet to update the central network and the subnet.

9. An electronic device, characterized in that: It includes at least one processor and a memory for communicating with the at least one processor; the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the networking communication method based on the zero trust security management platform as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, which stores computer-executable instructions. The computer-executable instructions are used to enable a computer to execute the networking communication method based on the zero-trust security management platform as described in any one of claims 1 to 7.

Images