Application access method and device

Abstract

The invention provides an application access method and device, and relates to the technical field of communication. The method is applied to gateway equipment in a zero-trust network, and comprises the following steps: receiving a first service message which is sent by terminal equipment through a zero-trust client and is used for accessing a web application; according to a user token in the first service message, a virtual IP address corresponding to the user token is acquired, and the virtual IP address is allocated to the terminal equipment and issued to the gateway equipment by a controller in the zero-trust network after the terminal equipment is successfully online; replacing the source IP address in the first service message with the virtual IP address to obtain a second service message; and forwarding the second service message to a resource server of the web application.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an application access method and device. Background Art

[0002] With the rise of Internet technologies such as cloud computing, the Internet of Things, and mobile office, enterprise resources are no longer limited to the enterprise. The demand for enterprise employees to access the enterprise intranet anytime and anywhere is becoming more and more common. The traditional network protection boundary is becoming more and more blurred, and the traditional security protection measures based on network boundaries are increasingly difficult to meet the needs. In order to solve the above problems, a software-defined perimeter (SDP) zero-trust function is provided. In this function, the network device acts as an SDP gateway and works with the SDP controller to authenticate and authorize users who access specified applications or APIs in the zero-trust network, so as to achieve centralized control of user identities and access rights and prevent illegal users from accessing.

[0003] When accessing resources in a zero-trust network, the terminal device can access non-web applications in the zero-trust network through an SSL VPN tunnel based on the built-in zero-trust client, and can also access web applications in the zero-trust network based on the zero-trust client. When accessing a web application based on a zero-trust client, the user opens a web browser through the zero-trust client, and the web browser displays the application navigation page of the accessible web application. The user selects the web application to be accessed based on the application navigation interface to trigger a web access request. At this time, the business message of the web access request will be sent to the SDP gateway in the zero-trust network. The SDP gateway will verify the user's identity. After the verification is passed, the SDP gateway acts as a web proxy and sends the business message to the resource server of the web application based on its own address. That is to say, when a large number of users access the web application in zero-trust client mode, the source IP address of each business message forwarded by the SDP gateway is that of the SDP gateway. This will cause the following problem: When the audit and log analysis functions are configured in the zero-trust network, when risk identification is performed based on the logs generated during the web application access process and security risks are found, it is impossible to know which user accessed the application on the resource server, resulting in the problem of being unable to trace the source. Summary of the invention

[0004] In view of this, the present application provides an application access method and device, which is used to solve the problem of being unable to trace the source when risk identification is caused by the messages forwarded to the resource server of the web application having the same source IP address when accessing the web application based on a zero-trust client.

[0005] Specifically, the present application is implemented through the following technical solutions:

[0006] According to a first aspect of the present application, there is provided an application access method, which is applied to a gateway device in a zero-trust network, the method comprising:

[0007] Receiving a first service message for accessing a web application sent by a terminal device through a zero-trust client;

[0008] According to the user token in the first service message, obtain a virtual IP address corresponding to the user token, where the virtual IP address is allocated to the terminal device by a controller in the zero-trust network after the terminal device successfully goes online and is sent to the gateway device;

[0009] The source IP address in the first service message is replaced with the virtual IP address, and the destination IP address of the first service message is replaced with the IP address of the resource server of the web application to obtain a second service message;

[0010] The second service message is forwarded to the resource server of the web application.

[0011] According to a second aspect of the present application, there is provided an application access device, which is applied to a gateway device in a zero-trust network, and the device includes:

[0012] A receiving unit, configured to receive a first service message for accessing a web application sent by a terminal device through a zero-trust client;

[0013] An acquisition unit, configured to acquire a virtual IP address corresponding to the user token according to the user token in the first service message, wherein the virtual IP address is allocated to the terminal device by a controller in a zero-trust network after the terminal device successfully goes online and is sent to the gateway device;

[0014] A replacement unit, configured to replace the source IP address in the first service message with the virtual IP address, and replace the destination IP address of the first service message with the IP address of the resource server of the web application, to obtain a second service message;

[0015] A sending unit is used to forward the second service message to the resource server of the web application.

[0016] According to the third aspect of the present application, an electronic device is provided, including a processor and a machine-readable storage medium, the machine-readable storage medium storing a computer program that can be executed by the processor, and the processor is prompted by the computer program to execute the method provided in the first aspect of the embodiment of the present application.

[0017] According to the fourth aspect of the present application, a machine-readable storage medium is provided, which stores a computer program. When called and executed by a processor, the computer program prompts the processor to execute the method provided in the first aspect of the embodiment of the present application.

[0018] Beneficial effects of the embodiments of the present application:

[0019] In the application access method and device provided in the embodiment of the present application, the gateway device in the zero-trust network receives the first business message for accessing the web application sent by the terminal device through the zero-trust client; according to the user token in the first business message, obtain the virtual IP address corresponding to the user token, replace the destination IP address of the first business message with the IP address of the resource server of the web application, and the virtual IP address is allocated to the terminal device by the controller in the zero-trust network after the terminal device successfully goes online and sent to the gateway device; replace the source IP address in the first business message with the virtual IP address to obtain the second business message; forward the second business message to the resource server of the web application. Therefore, on the basis of accessing the web application based on the zero-trust client, since the source IP address of the business message arriving at the resource server is the virtual IP address corresponding to the unique user token of the user to which the terminal device belongs, and different user tokens correspond to different virtual IP addresses, therefore, the problem that the message arriving at the resource server cannot be traced when risk identification is caused by the source IP address being the IP address of the gateway device is solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a flowchart of an application access method provided in an embodiment of the present application;

[0021] Figure 2 It is a flowchart of another application access method provided in an embodiment of the present application;

[0022] Figure 3 This is a schematic diagram of an application scenario of an application access method provided in an embodiment of the present application;

[0023] Figure 4 It is a structural diagram of an application access device provided in an embodiment of the present application;

[0024] Figure 5 It is a hardware structure diagram of an electronic device for implementing an application access method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] Here, exemplary embodiments will be described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application.

[0026] The terms used in this application are only for the purpose of describing specific embodiments and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in this article refers to and includes any or all possible combinations of one or more corresponding listed items.

[0027] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0028] The application access method provided by this application is described in detail below.

[0029] See also Figure 1 , Figure 1 This is a flowchart of an application access method provided by the present application. The application access method is also applied to a gateway device in a zero-trust network. The gateway device may be an SDP gateway, etc. When implementing the method, the gateway device may include the following steps:

[0030] Step 101: Receive a first business message for accessing a web application sent by a terminal device through a zero-trust client.

[0031] In this step, a zero-trust client is set in the user's terminal device, and the zero-trust client supports the function of accessing web applications. When the user expects to access the web application (also known as bs (browser) application) in the zero-trust network through the zero-trust client, the zero-trust client can be triggered to send the above-mentioned first business message to the gateway device in the zero-trust network. The source IP address of the first business message is the IP address of the terminal device, and the destination IP address is the IP address of the gateway device.

[0032] In order to facilitate the gateway device to know which application the terminal device wants to request access to, the first business message will also carry the application identifier of the web application requested to be accessed. It should be noted that the application identifier of the above web application is the application identifier of the application that the controller authorizes the user of the terminal device to access after the terminal device is successfully authenticated and online in the zero-trust network, and the application list constructed by the application identifier of the authorized application is sent to the terminal device. In addition, after the online authentication of the terminal device is passed, the controller will also allocate a user token to the user of the terminal device and send it to the terminal device; in addition, when sending the above content, the controller will also send the device information of the gateway device corresponding to the application that the user can access.

[0033] Optionally, the above application list may include both web applications and non-web applications. Based on this, when a user accesses a web application, the terminal device can obtain the gateway device corresponding to the web application based on the correspondence between the application and the gateway device, and then send the above first service message to the gateway device. In addition, the above first service message may also carry a user token so that the gateway device can verify the credibility of the terminal device based on the user token.

[0034] Step 102: According to the user token in the first service message, obtain the virtual IP address corresponding to the user token.

[0035] Among them, the above-mentioned virtual IP address is allocated to the terminal device by the controller in the zero-trust network and sent to the gateway device after the terminal device successfully goes online.

[0036] In this step, when the gateway device receives the first service message, it can obtain the user token from the first service message, and authenticate the identity of the user of the terminal device based on the user token. Specifically, after the controller authenticates the terminal device, it will also send the user token of the user and the above application list to the gateway device corresponding to the application that the user of the authorized terminal device can access. Based on this, the gateway device can verify whether the user token is consistent with the user token issued by the controller. If they are consistent, the user's identity authentication is passed. Then, the application identifier of the web application is obtained from the first service message, and it is determined whether the application identifier is in the above application list. If it is, it is confirmed that the access right to access the web application is available.

[0037] Furthermore, in order to solve the problem of being unable to trace the source when identifying risks due to the fact that the messages forwarded to the resource server have the same source IP address while ensuring that the terminal device successfully accesses the above-mentioned web application, this embodiment proposes to obtain the virtual IP address corresponding to the user token.

[0038] Specifically, when the controller sends the user token and application list to the gateway device, it will also send the virtual IP address. The virtual IP address is uniquely assigned by the controller to the user of the terminal device. In other words, different users have different user tokens and virtual IP addresses. Therefore, the gateway device can obtain the above content sent by the controller and can record the correspondence between the user token, application list, and virtual IP address locally. In this way, after the identity authentication based on the user token is passed and it is confirmed that the user has access rights to the above web application, the virtual IP address corresponding to the user token in the first business message can be obtained based on the above correspondence.

[0039] Step 103: Replace the source IP address in the first service message with the virtual IP address, and replace the destination IP address of the first service message with the IP address of the resource server of the web application to obtain a second service message.

[0040] Step 104: forward the second service message to the resource server of the web application.

[0041] In step 103 and step 104, after obtaining the virtual IP address corresponding to the user token, the source IP address can be replaced with the virtual IP address. At the same time, in order to successfully access the web application, the destination IP address of the first business message needs to be replaced with the IP address of the resource server of the web application. Then the obtained second business message is sent to the resource server corresponding to the web application, thereby achieving access to the web application. Since the source IP address of the second business message sent to the resource server is the virtual IP address corresponding to the user token, instead of the IP address of the gateway device. In this way, since different user tokens correspond to different virtual IP addresses, the source can be traced to the real terminal device based on the virtual IP address. Then, when the resource server is configured with audit and log analysis functions, when the resource server performs security risk assessment based on log data, if a security risk is identified, it can be traced to the corresponding terminal device based on the virtual IP address in the log data, thereby solving the problem that the message arriving at the resource server cannot be traced when the risk is identified because the source IP address is the IP address of the gateway device.

[0042] In the implementation of the above-mentioned application access method, the gateway device in the zero-trust network receives the first business message for accessing the web application sent by the terminal device through the zero-trust client; according to the user token in the first business message, obtain the virtual IP address corresponding to the user token, and the virtual IP address is allocated to the terminal device by the controller in the zero-trust network after the terminal device successfully goes online and sent to the gateway device; replace the source IP address in the first business message with the virtual IP address, and replace the destination IP address of the first business message with the IP address of the resource server of the web application to obtain the second business message; forward the second business message to the resource server of the web application. Therefore, on the basis of accessing the web application based on the zero-trust client, since the source IP address of the business message arriving at the resource server is the virtual IP address corresponding to the unique user token of the user to which the terminal device belongs, and different user tokens correspond to different virtual IP addresses, therefore, the problem that the message arriving at the resource server cannot be traced when identifying risks due to the source IP address being the IP address of the gateway device is solved.

[0043] Optionally, the application access method provided in this embodiment may also include: Figure 2 The application access process shown may include the following steps:

[0044] Step 201: Receive a first response message to the first service message fed back by a resource server.

[0045] Specifically, when the second service message reaches the resource server, the resource server will perform security detection based on the second service message and generate log data at the same time. The log data can record the five-tuple information in the second service message to facilitate tracing based on the log data.

[0046] In addition, after the resource server performs security detection, if the security detection is qualified, it can respond to the second service message and obtain a first response message; then send the first response message to the gateway device. The source IP address of the first response message is the IP address of the resource server, and the destination IP address is the source IP address in the second service message, that is, the virtual IP address.

[0047] Step 202: Replace the destination IP address in the first response message with the source IP address in the first service message, and replace the source IP address of the first response message with the IP address of the gateway device to obtain a second response message.

[0048] Step 203: forward the second response message to the terminal device.

[0049] In step 202 and step 203, after receiving the first response message, the gateway device can replace the destination IP address in the first response message to accurately reach the terminal device. That is, the destination IP address in the first response message is replaced with the source IP address in the first service message, that is, the IP address of the terminal device, and the source IP address of the first response message is replaced with the IP address of the gateway device to obtain the second response message. In this way, when the gateway device forwards the second response message to the terminal device, it can ensure that the second response message successfully reaches the terminal device, thereby obtaining the response fed back to the terminal device by the resource server.

[0050] Optionally, this embodiment proposes that after executing step 104, the following process may also be executed: binding a correspondence between the first session to which the first service message belongs and the second session to which the second service message belongs.

[0051] Specifically, since the present application involves the replacement operation of the IP address when performing application access, in order to accurately find the replaced IP address, the present embodiment proposes that session recording will be performed, that is, the session to which the first business message belongs is recorded as session 1, and the session 1 is the session between the terminal device and the gateway device for accessing the web application; at the same time, when the gateway device is used as a proxy to access the resource server of the web application, the session between the resource server is recorded as session 2. Then the session 1 and the session 2 are bound in a corresponding relationship. For example, when performing session binding, different session identifiers can be set for different sessions, recorded as sessionID. Based on this, a corresponding relationship between sessionID1 of the first session and sessionID2 of the second session can be established to achieve the binding of session 1 and session 2.

[0052] Furthermore, the step of replacing the destination IP address in the first response message with the source IP address in the first business message in step 202 can be performed according to the following process: based on the second session to which the first response message belongs, checking the corresponding relationship to obtain the source IP address in the first business message based on the first session found; replacing the destination IP address in the first response message with the source IP address in the first business message.

[0053] Specifically, in one embodiment, when the gateway device sends a second service message to the resource server, the second service message may carry the session identifier (sessionID2) of session 2. In this way, when the resource server generates a first response message in response to the second service message, the first response message may carry the session identifier (sessionID2) of session 2 parsed from the second service message. Then, after receiving the first response message, the gateway device may obtain the session identifier (sessionID2) from the first response message, and based on the session identifier (sessionID2), the session to which the first response message belongs may be determined, i.e., session 2. Then, the above correspondence may be searched based on the above session 2 to determine the target session corresponding to the session 1, i.e., session 1, i.e., the session between the terminal device and the gateway device. After finding session 1, the source IP address in the first service message, i.e., the IP address of the terminal device, may be obtained based on session 1, so that the destination IP address in the first response message may be replaced based on the IP address of the terminal device to obtain the above second response message. Thus, the IP address is successfully replaced, so that the second response message can successfully reach the terminal device corresponding to the destination IP address to complete the access to the web application resource.

[0054] Optionally, in this embodiment, the first session corresponds to a first session table entry, the first session table entry includes a correspondence between an IP address of a terminal device and an IP address of a gateway device; the second session corresponds to a second session table entry, the second session table entry includes the virtual IP address and the IP address of the resource server. On this basis, the second session to which the first response message belongs can be determined according to the following process: a source IP address and a destination IP address are obtained from the first response message, and when the source IP address and the destination IP address hit the second session table entry, it is determined that the first response message belongs to the second session.

[0055] In this step, in order to better search for IP addresses, a corresponding session table entry is maintained for each session, that is, after receiving the first service message, the first session table entry is created based on the first session corresponding to the first service message; similarly, after sending the second service message to the resource server, the second session table entry is constructed based on the second session to which the second service message belongs. In this way, after the first session and the second session establish a binding relationship, the first session table entry and the second session table entry are also associated.

[0056] Furthermore, taking the above-mentioned session 1 and session 2 as an example for explanation, in another embodiment, when the first response message does not carry a session identifier, the session to which the first response message belongs can also be determined by the IP address. Specifically, the source IP address and the destination IP address in the first response message can be matched with the second session table entry. When the match is successful, the session 2 corresponding to the successfully matched session table entry is the session to which the first response message belongs, thereby realizing the confirmation of the session to which the first response message belongs.

[0057] On this basis, the step of obtaining the source IP address in the first service message based on the found first session may be performed according to the following process: obtaining the IP address of the terminal device according to the first session table entry of the first session.

[0058] Specifically, after determining that the first response message belongs to session 2, the above-mentioned session 1 can be obtained based on the binding relationship between session 1 and the session, and then the first session table entry of session 1 can be obtained. Then, the IP address of the terminal device can be obtained from the first session table entry, that is, the source IP address in the first business message.

[0059] Furthermore, in this embodiment, step 202 may be performed according to the following process: replacing the destination IP address in the first response message with the IP address of the terminal device.

[0060] In this step, after obtaining the IP address of the terminal device from the first session table entry, the IP address of the terminal device can be used to replace the destination IP address (virtual IP address) in the first response message, and then combined with the step of replacing the source IP address of the first response message with the IP address of the gateway device, the above-mentioned second response message is obtained, so that the second response message can successfully reach the terminal device corresponding to the destination IP address to complete the access to the web application resources this time.

[0061] In order to better understand this embodiment, Figure 3 The application scenario diagram of the application access method shown in the figure is used as an example to illustrate. Figure 3 The zero-trust network shown in the figure includes a controller, a gateway device, and a resource server for a web application. User 1 accesses a web application in the zero-trust network through a terminal device, which is referred to as application a. For example, a zero-trust client is installed in the terminal device, and the controller is configured with Figure 3 The address of application a is 192.168.1.10, that is Figure 3The IP address of the resource server is 192.168.1.10, and the controller authorizes the terminal device to access the application a. The IP address of the terminal device is the IP address of the physical network card, recorded as 10.1.1.10. Based on this, the access process of user 1 accessing the above application a through the zero-trust client in the terminal device is roughly as follows:

[0062] User 1 performs online authentication to the controller in the zero-trust network through the terminal device. After the controller authenticates user 1, the virtual IP address assigned to user 1 is 172.1.1.10. At the same time, the controller sends the virtual IP address to the gateway device corresponding to the application that authorized user 1 can access.

[0063] Regarding the request direction of application resources, when user 1 accesses application a, a service message 1 for accessing application a can be sent to the gateway device. The source IP address of the service message 1 is 10.1.1.10, and the destination IP address is the IP address of the gateway device: 10.1.1.3. In addition, the destination port of the service message 1 is 10443, which is the SSLVPN service port.

[0064] After receiving the service message 1, the gateway device executes the TCP and SSLVPN web proxy functions, that is, obtains the virtual IP address corresponding to the user token in the service message 1, that is, 172.1.1.10, and then uses the virtual IP address to replace the source IP address in the service message 1, so that the source IP address of the obtained service message 2 is 172.1.1.10, and the destination IP address is changed to the IP address of application a, that is, 192.168.1.10, to obtain service message 2. In this way, the gateway device can send the service message 2 to the resource server of application a. In this way, since the source IP address of the service message arriving at the resource server is the unique corresponding virtual IP address of the user to which the terminal device belongs, the problem that the service message arriving at the resource server cannot be traced during risk identification due to the source IP address being the IP address of the gateway device is solved, that is, when tracing the source, the corresponding terminal device can be found based on the virtual IP address in the service message, thereby achieving the purpose of tracing the source during security risk assessment.

[0065] Regarding the response direction of the request application resource, when the resource server responds to the service message 2 of the request direction, a response message 1 is generated and then sent to the gateway device.

[0066] After receiving the response message 1, the gateway device can find the source IP address in the service message 1, that is, the IP address of the terminal device: 10.1.1.10. In this way, the gateway device can change the destination IP address in the response message to the IP address of the above-mentioned terminal device (10.1.1.10). At the same time, the source IP address in the response message is changed from the IP address of the resource server (192.168.1.10) to the IP address of the gateway device (10.1.1.3), thereby obtaining the response message 2, and then the response message 2 can be forwarded to the terminal device according to the destination IP address in the response message 2.

[0067] Therefore, in the scenario of accessing web applications based on zero-trust clients in a zero-trust network, the gateway device, when acting as a web proxy, will modify the source IP address of the message to be sent to the accessed web application to the virtual IP address corresponding to the terminal device, so that after the message modified to the virtual IP address reaches the resource server of the web application, the source tracing and auditing are also implemented through the virtual IP address, thereby solving the problem that the business message arriving at the resource server cannot be traced during risk identification because the source IP address is the IP address of the gateway device.

[0068] Based on the same inventive concept, the present application also provides an application access device corresponding to the above application access method. The implementation of the application access device can refer to the above description of the application access method, which will not be discussed here one by one.

[0069] See also Figure 4 , Figure 4 An application access device provided by an exemplary embodiment of the present application is applied to a gateway device in a zero-trust network, and the device includes:

[0070] The receiving unit 401 is configured to receive a first service message for accessing a web application sent by a terminal device through a zero-trust client;

[0071] An acquisition unit 402 is used to acquire a virtual IP address corresponding to the user token according to the user token in the first service message, where the virtual IP address is allocated to the terminal device by a controller in a zero-trust network after the terminal device successfully goes online and is sent to the gateway device;

[0072] A replacement unit 403 is used to replace the source IP address in the first service message with the virtual IP address, and replace the destination IP address of the first service message with the IP address of the resource server of the web application to obtain a second service message;

[0073] The sending unit 404 is configured to forward the second service message to the resource server of the web application.

[0074] In implementing the above-mentioned application access device, on the basis of accessing the web application based on the zero-trust client, since the source IP address of the business message reaching the resource server is the virtual IP address corresponding to the unique user token of the user to which the terminal device belongs, and different user tokens correspond to different virtual IP addresses, therefore, it also solves the problem that the message reaching the resource server cannot be traced during risk identification due to the source IP address being the IP address of the gateway device.

[0075] Optionally, in this embodiment, the receiving unit 401 is further configured to receive a first response message to the first service message fed back by the resource server;

[0076] The replacement unit 403 is further configured to replace the destination IP address in the first response message with the source IP address in the first service message, and replace the source IP address of the first response message with the IP address of the gateway device, to obtain a second response message;

[0077] The sending unit 404 is further configured to forward the second response message to the terminal device.

[0078] Optionally, the application access device provided in this embodiment may further include:

[0079] A binding unit (not shown in the figure) is used to bind the correspondence between the first session to which the first service message belongs and the second session to which the second service message belongs after the sending unit forwards the second service message to the resource server of the web application.

[0080] Furthermore, the above-mentioned replacement unit 403 is specifically used to check the corresponding relationship based on the second session to which the first response message belongs, so as to obtain the source IP address in the first business message based on the first session found; and replace the destination IP address in the first response message with the source IP address in the first business message.

[0081] Optionally, in this embodiment, the first session corresponds to a first session table entry, the first session table entry includes a correspondence between an IP address of a terminal device and an IP address of a gateway device; the second session corresponds to a second session table entry, the second session table entry includes the virtual IP address and the IP address of the resource server;

[0082] On this basis, the replacement unit 403 is specifically used to determine the second session to which the first response message belongs according to the following method: obtaining a source IP address and a destination IP address from the first response message, and when the source IP address and the destination IP address hit the second session table entry, determining that the first response message belongs to the second session;

[0083] The replacement unit 403 is further configured to obtain the IP address of the terminal device according to the first session table entry of the first session;

[0084] The above-mentioned replacement unit 403 is also used to replace the destination IP address in the first response message with the IP address of the terminal device.

[0085] Based on the same inventive concept, an embodiment of the present application provides an electronic device, which may be the above-mentioned gateway device, etc. Figure 5 As shown, the electronic device may include a processor 501 and a machine-readable storage medium 502, the machine-readable storage medium 502 stores a computer program that can be executed by the processor 501, and the processor 501 is prompted by the computer program to execute the application access method provided by any embodiment of the present application. In addition, the electronic device also includes a communication interface 503 and a communication bus 504, wherein the processor 501, the communication interface 503, and the machine-readable storage medium 502 communicate with each other through the communication bus 504.

[0086] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0087] The communication interface is used for communication between the above electronic device and other devices.

[0088] The machine-readable storage medium 502 may be a memory, which may include a random access memory (RAM), a DDR SRAM (Double Data Rate Synchronous Dynamic Random Access Memory), or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the processor.

[0089] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0090] In addition, this embodiment also provides a machine-readable storage medium, which stores a computer program. When called and executed by a processor, the computer program prompts the processor to execute the method provided by any embodiment of the present application.

[0091] As for the electronic device and machine-readable storage medium embodiments, since the method contents involved are basically similar to the aforementioned method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0092] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0093] The implementation process of the functions and effects of each unit / module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0094] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are merely schematic, wherein the units / modules described as separate components may or may not be physically separated, and the components displayed as units / modules may or may not be physical units / modules, that is, they may be located in one place, or they may be distributed on multiple network units / modules. Some or all of the units / modules may be selected according to actual needs to achieve the purpose of the present application. A person of ordinary skill in the art can understand and implement it without creative work.

[0095] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. An application access method, characterized in that: Applied to a gateway device in a zero-trust network, the method comprises: Receiving a first service message for accessing a web application sent by a terminal device through a zero-trust client; According to the user token in the first service message, obtain a virtual IP address corresponding to the user token, where the virtual IP address is allocated to the terminal device by a controller in the zero-trust network after the terminal device successfully goes online and is sent to the gateway device; The source IP address in the first service message is replaced with the virtual IP address, and the destination IP address of the first service message is replaced with the IP address of the resource server of the web application to obtain a second service message; The second service message is forwarded to the resource server of the web application.

2. The method according to claim 1, characterized in that Also includes: Receive a first response message to the first service message fed back by the resource server; Replacing the destination IP address in the first response message with the source IP address in the first service message, and replacing the source IP address of the first response message with the IP address of the gateway device, to obtain a second response message; Forward the second response message to the terminal device.

3. The method according to claim 2, characterized in that After forwarding the second service message to the resource server of the web application, the method further includes: Bind the correspondence between the first session to which the first service message belongs and the second session to which the second service message belongs.

4. The method according to claim 3, characterized in that: Replacing the destination IP address in the first response message with the source IP address in the first service message includes: Based on the second session to which the first response message belongs, checking the corresponding relationship to obtain the source IP address in the first service message based on the found first session; The destination IP address in the first response message is replaced with the source IP address in the first service message.

5. The method according to claim 4, characterized in that The first session corresponds to a first session table entry, the first session table entry including a correspondence between an IP address of a terminal device and an IP address of a gateway device; the second session corresponds to a second session table entry, the second session table entry including the virtual IP address and an IP address of the resource server; Determine the second session to which the first response message belongs by the following method: Acquire a source IP address and a destination IP address from the first response message, and when the source IP address and the destination IP address hit the second session table entry, determine that the first response message belongs to the second session; Obtaining a source IP address in the first service message based on the found first session includes: Obtaining an IP address of the terminal device according to the first session table entry of the first session; Replacing the destination IP address in the first response message with the source IP address in the first service message includes: The destination IP address in the first response message is replaced with the IP address of the terminal device.

6. An application access device, characterized in that: Applied to a gateway device in a zero-trust network, the device comprises: A receiving unit, configured to receive a first service message for accessing a web application sent by a terminal device through a zero-trust client; An acquisition unit, configured to acquire a virtual IP address corresponding to the user token according to the user token in the first service message, wherein the virtual IP address is allocated to the terminal device by a controller in a zero-trust network after the terminal device successfully goes online and is sent to the gateway device; A replacement unit, configured to replace the source IP address in the first service message with the virtual IP address, and replace the destination IP address of the first service message with the IP address of the resource server of the web application, to obtain a second service message; A sending unit is used to forward the second service message to the resource server of the web application.

7. The device according to claim 6, characterized in that The receiving unit is further configured to receive a first response message to the first service message fed back by the resource server; The replacement unit is further configured to replace the destination IP address in the first response message with the source IP address in the first service message, and replace the source IP address of the first response message with the IP address of the gateway device to obtain a second response message; The sending unit is further used to forward the second response message to the terminal device.

8. The device according to claim 7, characterized in that Also includes: A binding unit is used to bind the correspondence between the first session to which the first service message belongs and the second session to which the second service message belongs after the sending unit forwards the second service message to the resource server of the web application.

9. The device according to claim 8, characterized in that The replacement unit is specifically configured to check the corresponding relationship based on the second session to which the first response message belongs, so as to obtain the source IP address in the first service message based on the found first session; The destination IP address in the first response message is replaced with the source IP address in the first service message.

10. The device according to claim 9, characterized in that The first session corresponds to a first session table entry, the first session table entry including a correspondence between an IP address of a terminal device and an IP address of a gateway device; the second session corresponds to a second session table entry, the second session table entry including the virtual IP address and an IP address of the resource server; The replacement unit is specifically configured to determine the second session to which the first response message belongs according to the following method: obtaining a source IP address and a destination IP address from the first response message, and when the source IP address and the destination IP address hit the second session table entry, determining that the first response message belongs to the second session; The replacement unit is further configured to obtain the IP address of the terminal device according to the first session table entry of the first session; The replacement unit is further used to replace the destination IP address in the first response message with the IP address of the terminal device.

Images