Network management method and device, network architecture system and storage medium

Abstract

The embodiment of the invention discloses a network management method. The method comprises the following steps: determining current fault information of a network architecture system; wherein the network architecture system comprises the proxy gateway; determining the current working state of the client node; determining a target escape mechanism of the network architecture system based on the current fault information and the current working state; wherein the network architecture system comprises at least one preset escape mechanism; and switching the escape mechanism of the proxy gateway to the target escape mechanism, so that the proxy gateway provides an escape authentication service for the client node. The embodiment of the invention also discloses a network management device, a network architecture system and a storage medium.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a network management method, device, network architecture system and storage medium. Background Art

[0002] With the development and improvement of science and technology, the security requirements for data operation are getting higher and higher. In order to ensure the security of data, new network security architectures such as zero-trust software defined perimeter (SDP) have been widely developed. Among them, new network security architectures such as SDP break the physical boundary limitations of traditional firewalls, allowing enterprise servers to be set up in any data center or cloud, and office equipment to be located anywhere. It conforms to the trend of the era of cloud, big data and mobile, and has become a zero-trust security best practice solution for enterprise cloud, mobile office, remote office, IoT security, and big data security. In the application process of the new network security architecture, the new network security architecture carries the core business of the customer. In order to avoid the impact of the failure of the new network security architecture on the customer's business, the new network security architecture is generally required to have high availability deployment and high disaster recovery capabilities. For example, when a business logic in the new network security architecture fails and the high availability of the new security network architecture fails, a business escape mechanism is usually set up in an emergency state.

[0003] However, there is currently no reliable and complete escape mechanism for the new security network architecture, which leads to a rash escape when the new security network architecture fails, and cannot provide customers with reliable network services, causing major security accidents. Summary of the invention

[0004] In view of this, the embodiments of the present application hope to provide a network management method, device, network architecture system and storage medium, which solves the problem that the current new security network architecture does not have a reliable and complete escape mechanism, and proposes a reliable network management method to ensure that the new security network architecture executes the escape mechanism in an orderly manner when a failure occurs, thereby ensuring that reliable and secure network services are provided to customers and reducing the possibility of security accidents.

[0005] To achieve the above purpose, the technical solution of this application is implemented as follows:

[0006] In a first aspect, a network management method is provided, the method being applied to a proxy gateway, the method comprising:

[0007] Determine current fault information of a network architecture system; wherein the network architecture system includes the proxy gateway;

[0008] Determine the current working status of the client node;

[0009] Based on the current fault information and the current working state, determining a target escape mechanism of the network architecture system; wherein the network architecture system includes at least one preset escape mechanism;

[0010] The escape mechanism of the proxy gateway is switched to the target escape mechanism so that the proxy gateway provides an escape authentication service for the client node.

[0011] Optionally, determining a target escape mechanism of the network architecture system based on the current fault information and the current working state includes:

[0012] If the current fault information is that a first type of fault occurs in the control center, and the current working state is that the client is not logged in or the client node has passed the identity authentication state, the target escape mechanism is determined to be the first escape mechanism; wherein the network architecture system includes the control center, and the control center is used to implement the scheduling and management of the network architecture system;

[0013] If the current fault information is that the control center has a second type of fault, and the current working state is that the client node has passed the identity authentication state, determining that the target escape mechanism is the second escape mechanism;

[0014] If the current fault information is that a third type of fault occurs in the control center, and the current working state is that the client node has passed the identity authentication state, the target escape mechanism is determined to be a third escape mechanism; wherein the first escape mechanism, the second escape mechanism and the third escape mechanism are all different.

[0015] Optionally, when the target escape mechanism is the first type of escape mechanism, after the escape mechanism of the proxy gateway is switched to the target escape mechanism, the method further includes:

[0016] Send a notification message to the client node; wherein the notification message is used to instruct the client node to switch to the client escape mode.

[0017] Optionally, the method further includes:

[0018] If a first application access request and a first escape ticket sent by the client node are received, the first escape ticket is authenticated to obtain a first authentication result; wherein the first application access request is used to request access to a first application, and the first escape ticket is used to record escape information of the first application, and the first application is an application in the target application list information accessed by the client node in a previous access process after identity authentication adjacent to the current login;

[0019] If the first authentication result is authentication passed, sending the first application access request to a first server; wherein the first server is used to provide services for the first application.

[0020] Optionally, when the target escape mechanism is the second type of escape mechanism, after the escape mechanism of the proxy gateway is switched to the target escape mechanism, the method further includes:

[0021] If a second application access request and a second escape ticket sent by the client node are received, the second escape ticket is authenticated to obtain a second authentication result; wherein the second application access request is used to request access to a second application, the second application is an application in the target application list information currently obtained by the client node after identity authentication, and the second escape ticket is used to record the escape information of the second application;

[0022] If the second authentication result is authentication passed, sending the second application access request to the second server; wherein the second server is used to provide services for the second application.

[0023] Optionally, when the target escape mechanism is the third type escape mechanism, after the escape mechanism of the proxy gateway is switched to the target escape mechanism, the method further includes:

[0024] If a third application access request sent by the client node is received, the third application access request is parsed to obtain a parsing result; wherein the third application access request is used to request access to a third application in the client node;

[0025] If there is a target authentication ticket that matches the third application identifier included in the parsing result, authenticate the target authentication ticket to obtain a third authentication result;

[0026] If the third authentication result is authentication passed, the third application access request is sent to a third server; wherein the third server is used to provide services for the third application.

[0027] Optionally, if there is a target authentication ticket that matches the third application identifier included in the parsing result, authenticating the target authentication ticket to obtain a third authentication result includes:

[0028] If there is a target authentication ticket that matches the third application identifier included in the parsing result, obtaining a preset validity period of the target authentication ticket;

[0029] If the current access time is not within the preset validity period, the preset validity period is extended by a preset time to obtain a target validity period;

[0030] If the current access time is within the target validity period, the third authentication result is determined to be authentication passed.

[0031] In a second aspect, a network management device is provided, the device comprising: a first determination unit, a second determination unit, a third determination unit and a switching unit; wherein:

[0032] The first determining unit is used to determine current fault information of the network architecture system; wherein the network architecture system includes the proxy gateway;

[0033] The second determining unit is used to determine the current working state of the client node;

[0034] The third determination unit is used to determine a target escape mechanism of the network architecture system based on the current fault information and the current working state; wherein the network architecture system includes at least one preset escape mechanism;

[0035] The switching unit is used to switch the escape mechanism of the proxy gateway to the target escape mechanism.

[0036] In a third aspect, a network architecture system is provided, the system comprising at least: at least one client node, at least one proxy gateway and a control center; wherein:

[0037] The client node is used to provide client services for users. When the client node logs in, it sends an identity authentication message to the control center, receives the application list information sent by the control center, the escape data ticket and the authentication ticket corresponding to each application in the application list information, encrypts the application list information, the escape data ticket and the authentication ticket corresponding to each application in a preset encryption method, obtains the target application list information, and stores the target application list information;

[0038] The control center is configured to receive the identity authentication message sent by the client node, authenticate the client node based on the identity authentication message, obtain an authentication result, and if the authentication result is authentication passed, send the application list information of the client node, the escape data ticket corresponding to each application in the application list information, and the authentication ticket to the client node;

[0039] The control center is further used to schedule and manage at least one of the proxy gateways and at least one of the client nodes;

[0040] The proxy gateway is used to implement the steps of the network management method as described in any one of the above items.

[0041] In a fourth aspect, a storage medium is provided, wherein a network management program is stored on the storage medium, and when the network management program is executed by a processor, the steps of the network management method as described in any one of the above items are implemented.

[0042] The network management method, device, network architecture system and storage medium provided by the embodiments of the present application determine the current working state of the client node after determining the current fault information of the network architecture system through the proxy gateway, and then determine the target escape mechanism of the network architecture system based on the current fault information and the current working state, and finally switch the escape mechanism of the proxy gateway to the target escape mechanism, so that the proxy gateway provides escape authentication services for the client node. In this way, when the network architecture system fails and cannot provide services to the client node, the proxy gateway in the network architecture system determines the target escape mechanism according to the current fault information and the current working state of the client node, and then provides escape authentication services to the client node according to the target escape mechanism, so that the client node can still provide services to the user, which solves the problem that the current new security network architecture does not have a reliable and complete escape mechanism, and proposes a reliable network management method, which ensures that the new security network architecture executes the escape mechanism in an orderly manner when a fault occurs, ensures that reliable and safe network services are provided to customers, and reduces the possibility of security accidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 Schematic diagram of the network management method provided in the embodiment of the present application Figure 1 ;

[0044] Figure 2 Schematic diagram of the network management method provided in the embodiment of the present application Figure 2 ;

[0045] Figure 3 Schematic diagram of the network management method provided in the embodiment of the present application Figure 3 ;

[0046] Figure 4 Schematic diagram of the network management method provided in the embodiment of the present application Figure 4 ;

[0047] Figure 5 Schematic diagram of the network management method provided in the embodiment of the present application Figure 5 ;

[0048] Figure 6 Schematic diagram of the network management method provided in the embodiment of the present application Figure 6 ;

[0049] Figure 7 A schematic diagram of a network architecture system structure provided in an embodiment of the present application;

[0050] Figure 8 Schematic diagram of the implementation process of the network management method provided in the present application embodiment Figure 1 ;

[0051] Fig. 9 Schematic diagram of the implementation process of the network management method provided in the present application embodiment Figure 2 ;

[0052] Fig.10 Schematic diagram of the implementation process of the network management method provided in the present application embodiment Figure 3 ;

[0053] Fig.11 Schematic diagram of the implementation process of the network management method provided in the present application embodiment Figure 4 ;

[0054] Fig.12 A schematic diagram of the structure of a network management device provided in an embodiment of the present application;

[0055] Fig.13 A schematic diagram of the structure of another network architecture system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0057] The embodiment of the present application provides a network management method, which is applied to a proxy gateway, referring to Figure 1 As shown, the method comprises the following steps:

[0058] Step 101: Determine current fault information of the network architecture system.

[0059] Among them, the network architecture system includes a proxy gateway.

[0060] In an embodiment of the present application, the network architecture system is used to provide users with a reliable and secure communication network environment, which can ensure the security of the user's work environment, work data, etc. The network architecture system includes at least at least one client node, at least one proxy gateway and at least one control center. The control center can be used to schedule and manage at least one client node and at least one proxy gateway. The proxy gateway is used to forward resource requests sent by client nodes or send return data corresponding to received resource requests to client nodes and other diversion operations. The client node is at least used to provide client services to users. The proxy gateway can detect the current fault of the network architecture system and determine the current fault information of the network architecture system. In some application scenarios, the current fault information of the network architecture system can also be notified to the proxy gateway by users or business managers.

[0061] Step 102: Determine the current working status of the client node.

[0062] In the embodiment of the present application, the client node needs to be logged in before use to ensure the user's data security. Therefore, the current working state of the client node can be a non-logged in state, a logged in state, a logged in state, etc., which can be determined by the actual situation.

[0063] Step 103: Based on the current fault information and the current working status, determine the target escape mechanism of the network architecture system.

[0064] Among them, the network architecture system includes at least one preset escape mechanism.

[0065] In the embodiment of the present application, the proxy gateway analyzes the current fault information and current working state of the network architecture system to determine the target escape mechanism that needs to be switched to. In this way, different levels of escape mechanisms are set in advance for different fault information of the proxy architecture system and different working states of the client node, ensuring the maximum possible reliable service for users and guaranteeing the user experience.

[0066] Step 104: Switch the escape mechanism of the proxy gateway to the target escape mechanism.

[0067] Among them, the escape mechanism of the switching proxy gateway is the target escape mechanism, so that the proxy gateway provides an escape authentication service for the client node.

[0068] In the embodiment of the present application, the proxy gateway switches its own escape mechanism to a target escape mechanism. In this way, after the proxy gateway receives the relevant access request of the client node, it directly performs escape processing on the access request of the client node, and it is no longer processed by the control center, thereby ensuring that reliable and feasible services are provided to users. Among them, the proxy gateway is usually required to determine the current fault information only when a fault occurs in the control center of the network architecture system, and the escape mechanism is controlled by the proxy gateway. In this way, when a fault occurs in the control center, the network architecture system can still provide effective services to users, reduce user losses, and improve user experience.

[0069] The network management method provided by the embodiment of the present application determines the current working state of the client node after determining the current fault information of the network architecture system through the proxy gateway, and then determines the target escape mechanism of the network architecture system based on the current fault information and the current working state, and finally switches the escape mechanism of the proxy gateway to the target escape mechanism, so that the proxy gateway provides escape authentication services for the client node. In this way, when the network architecture system fails and cannot provide services to the client node, the proxy gateway in the network architecture system determines the target escape mechanism according to the current fault information and the current working state of the client node, and then provides escape authentication services to the client node according to the target escape mechanism, so that the client node can still provide services to the user, which solves the problem that the current new security network architecture does not have a reliable and complete escape mechanism, and proposes a reliable network management method, which ensures that the new security network architecture executes the escape mechanism in an orderly manner when a fault occurs, ensures that reliable and safe network services are provided to customers, and reduces the possibility of security accidents.

[0070] Based on the above embodiments, the embodiments of the present application provide a network management method, referring to Figure 2 As shown, the method is applied to a proxy gateway, and the method comprises the following steps:

[0071] Step 201: Determine the current fault information of the network architecture system.

[0072] Among them, the network architecture system includes a proxy gateway.

[0073] In an embodiment of the present application, the network architecture system may be a zero-trust SDP network architecture system, the corresponding proxy gateway may be an SDP proxy gateway, the client node may be an SDP client node, and the control center may be an SDP control center. In some application scenarios, the network architecture system may also be a zero-trust network access (Zero Trust Network Access, ZTNA) architecture. During the operation of the network architecture system, there is a communication link between the client node, the proxy gateway, and the control center. When the proxy gateway cannot detect the normal communication link information sent by the control center, it can be determined that the control center has a fault. At this time, the proxy gateway determines that the current fault information of the network architecture system is that the control center has a fault. Usually, the escape mechanism needs to be activated only when the control center fails.

[0074] Step 202: Determine the current working status of the client node.

[0075] In the embodiment of the present application, since the client node needs the participation of the proxy gateway during the login process, the proxy gateway can determine the current working state of the obtained client node. The client node can run on the client device.

[0076] After executing step 202, the proxy gateway may choose to execute step 203 and step 206, or step 204 and step 206, or steps 205 to 206 according to the actual situation. If the current fault information is that the control center has a first type of fault, and the current working state is the client not logged in state or the client node has passed the identity authentication state, you can choose to execute step 203 and step 206; if the current fault information is that the control center has a second type of fault, and the current working state is the client node has passed the identity authentication state, you can choose to execute step 204 and step 206; if the current fault information is that the control center has a third type of fault, and the current working state is the client node has passed the identity authentication state, you can choose to execute steps 205 to 206.

[0077] Step 203: If the current fault information is that a first type of fault occurs in the control center, and the current working state is a client not logged in state or a client node has passed identity authentication state, determine that the target escape mechanism is a first escape mechanism.

[0078] Among them, the network architecture system includes a control center, which is used to implement the scheduling and management of the network architecture system.

[0079] In the embodiment of the present application, there are many types of faults in the control center, such as abnormal faults on the user authentication link, abnormal faults on the application authentication link, control center downtime, etc. When the client node is not logged in, because login authentication is required, if the current fault information is that the control center has a first type of fault, such as when the user authentication link of the control center fails, the client node cannot be authenticated, resulting in the need for escape processing at this time, the target escape mechanism can be determined to be the first escape mechanism, or when the client node has passed the identity authentication state, which can be called the client node is online in some cases, if the proxy gateway is notified by the control center that its user authentication link is abnormal, the target escape mechanism can also be determined to be the first escape mechanism.

[0080] Step 204: If the current fault information is that a second type of fault occurs in the control center, and the current working state is that the client node has passed the identity authentication state, determine that the target escape mechanism is the second escape mechanism.

[0081] In an embodiment of the present application, when a second type of failure occurs in the control center, such as an abnormal failure on the application authentication link, when the current working status of the client node is logged in and has passed the identity authentication status, the proxy gateway can determine that the target escape mechanism is the second escape mechanism.

[0082] Step 205: If the current fault information is that the third type of fault occurs in the control center, and the current working state is that the client node has passed the identity authentication state, determine that the target escape mechanism is the third escape mechanism.

[0083] Among them, the first escape mechanism, the second escape mechanism and the third escape mechanism are all different.

[0084] In an embodiment of the present application, when a third type of failure occurs in the control center, such as when the control center goes down, and the client node is currently logged in and has passed identity authentication, the proxy gateway can determine that the target escape mechanism is the third escape mechanism.

[0085] Step 206: Switch the escape mechanism of the proxy gateway to the target escape mechanism.

[0086] Among them, the escape mechanism of the switching proxy gateway is the target escape mechanism, so that the proxy gateway provides an escape authentication service for the client node.

[0087] In an embodiment of the present application, after the proxy gateway determines the target escape mechanism, it switches to the corresponding target escape mechanism to provide corresponding escape services for the client node. In this way, when a failure occurs in the control center, the network architecture system, under the action of the proxy gateway, can still provide services to users at the client node, thereby ensuring user use and improving user experience.

[0088] Based on the above embodiments, in other embodiments of the present application, refer to Figure 3 As shown, after the proxy gateway executes steps 201 to 203 and step 206, it is also used to execute step 207:

[0089] Step 207: Send a notification message to the client node.

[0090] The notification message is used to instruct the client node to switch to the client escape mode.

[0091] In an embodiment of the present application, after the proxy gateway switches to the target escape mechanism, it is also necessary to notify the client node to switch to the client escape mode. After the client node receives the notification message, it responds to the notification message and switches to the client escape mode. In some application scenarios, after the client node receives the notification message and switches to the client escape mode, a prompt message for prompting to switch to the client escape mode can be displayed on the client node, so that the user knows that the client node is currently in escape mode. After the client node switches to the client escape mode, when the client node performs access work, it will send some escape data information related to whether to perform subsequent access operations by the proxy gateway, so that the client node can enjoy the services provided by the corresponding application server without going through the control center, thereby ensuring the business capabilities provided by the client node.

[0092] Based on the above embodiments, in other embodiments of the present application, refer to Figure 4 As shown, after the proxy gateway executes step 207, it is also used to execute steps 208 to 209:

[0093] Step 208: If the first application access request and the first escape ticket sent by the client node are received, the first escape ticket is authenticated to obtain a first authentication result.

[0094] The first application access request is used to request access to the first application, the first escape ticket is used to record the escape information of the first application, and the first application is an application in the target application list information accessed by the client node during the previous access process after identity authentication adjacent to the current login.

[0095] In an embodiment of the present application, after each successful login, the client node will record and store the information of the applications accessed during the access process, and obtain the target application list information, so that the client node can continue to access the applications in the target application list information during the subsequent escape process to ensure basic use by the user. In some application scenarios, in order to ensure the security of the data, the client node can use a pre-set data encryption method to encrypt the information of the applications accessed during the access process, that is, the target application list information can be the information obtained after encryption. The first escape ticket can be the ticket information returned to the first client node by the control center after the first application performs access authentication and other operations at the control center when there is no failure in the control center, so as to perform subsequent escape authentication processing.

[0096] After receiving the notification message sent by the proxy gateway, the client node also switches to the escape mode. In some application scenarios, the client node can generate prompt information to remind the user that it has currently switched to the escape mode. In some application scenarios, it may not generate prompt information to remind the user that it has currently switched to the escape mode. The specific situation can be determined according to the actual situation. After switching to the escape mode, when the client node receives the corresponding access operation of the user, it determines that the operation object is the first application according to the corresponding access operation of the user, and generates a first application access request to access the first application. At the same time, the first escape ticket corresponding to the first application is obtained from the target application list information, so as to send the first application access request and the first escape ticket to the proxy gateway. In this way, the proxy gateway authenticates the proxy gateway of the first application and obtains the first authentication result. In the event of a failure in the control center, the first application is authenticated by the proxy gateway, which ensures the safety of use, realizes reliable and effective escape, provides services to users, and ensures the user experience.

[0097] Step 209: If the first authentication result is authentication passed, send a first application access request to the first server.

[0098] The first server is used to provide services for the first application.

[0099] In an embodiment of the present application, after the proxy gateway performs authentication processing on the first escape ticket, when the first authentication result obtained is that the authentication is passed, that is, the first application access request is not illegal and is a reliable access operation. Therefore, the proxy gateway sends the first application access request to the first server corresponding to the first application, so that the first server responds to the first application access request and provides the client node with the service corresponding to the first application access request, thereby ensuring the user experience.

[0100] Based on the above embodiments, in other embodiments of the present application, refer to Figure 5As shown, after the proxy gateway executes steps 201-202, step 204 and step 206, it is also used to execute steps 210-211:

[0101] Step 210: If a second application access request and a second escape ticket sent by the client node are received, the second escape ticket is authenticated to obtain a second authentication result.

[0102] The second application access request is used to request access to a second application, the second application is an application in the target application list information currently obtained by the client node after identity authentication, and the second escape ticket is used to record the escape information of the second application.

[0103] In an embodiment of the present application, after the client node has passed the identity authentication and has gone online, when the control center fails, the user can operate all the applications in the target application list information obtained by the client node after going online. In this way, when the user performs an access operation on the second application, the client node generates a second application access request for the second application, obtains the second escape ticket for the second application from the target application list information, and then sends the second application access request and the second escape ticket to the proxy gateway so that the proxy gateway performs authentication processing on the second escape ticket to obtain a second authentication result. If the application operated by the user at the client node is not in the target application list information, the client node may not respond to the user operation. In some application scenarios, the client node may generate a prompt message indicating that the currently operated application cannot be used, so that the user is aware of the fault situation and improves the user's usage experience.

[0104] Step 211: If the second authentication result is authentication passed, send a second application access request to the second server.

[0105] The second server is used to provide services for the second application.

[0106] Based on the above embodiments, in other embodiments of the present application, refer to Figure 6 As shown, after the proxy gateway executes steps 201-202 and steps 205-206, it is also used to execute steps 212-214:

[0107] Step 212: If a third application access request sent by the client node is received, the third application access request is parsed to obtain a parsing result.

[0108] The third application access request is used to request access to a third application in the client node.

[0109] In an embodiment of the present application, after the client node is online and the control center is down, the user performs an access operation on the third application in the client node, and the client node generates a corresponding third application access request for the access operation on the third application, and then sends the third application access request to the proxy gateway. After receiving the third application access request, the proxy gateway parses the third application access request to obtain a parsing result.

[0110] Step 213: If there is a target authentication ticket that matches the third application identifier included in the parsing result, authenticate the target authentication ticket to obtain a third authentication result.

[0111] In an embodiment of the present application, if there is a target authentication ticket in the proxy gateway that matches the third application identifier of the third application included in the parsing result, the proxy gateway performs authentication processing on the target authentication ticket to obtain a third authentication result. Wherein, the authentication ticket is an authentication ticket issued by a control center that has not yet failed to the third application in the client node after the client node logs in and goes online, when the user uses the client node to access the third application, wherein the authentication ticket may be set with a validity period of the ticket, for example, the valid usage period may be 4 hours, so that the proxy gateway can authenticate the corresponding application through the authentication ticket regardless of whether the control center fails or not. For example, if the valid usage period of the authentication of an application is 4 hours, when the user accesses the third application, the proxy gateway authenticates the access to the third application based on the authentication ticket. If the current access time is within the valid usage period of 4 hours, an authentication result of authentication passing can be obtained. If it exceeds 4 hours, it can be determined that the authentication failed.

[0112] If the parsing result does not include the authentication ticket of the third application, due to a failure in the control center, the client node cannot perform the escape operation at this time, resulting in the user being unable to access the third application normally. At this time, the client node can generate a prompt message to remind the user that the control center is currently faulty, so that the user knows that there is a current failure and cannot access the third application. The user can seek help from the security management personnel of the network architecture system to troubleshoot the problem, thereby improving the user experience.

[0113] Step 214: If the third authentication result is authentication passed, send a third application access request to the third server.

[0114] The third server is used to provide services for the third application.

[0115] Based on the above embodiment, in other embodiments of the present application, step 213 can be implemented by steps 213a to 213c:

[0116] Step 213a: If there is a target authentication ticket that matches the third application identifier included in the parsing result, obtain a preset validity period of the target authentication ticket.

[0117] In the embodiment of the present application, when the parsing result includes the authentication ticket, the authentication ticket is analyzed to obtain the preset validity period set in the authentication ticket, that is, the aforementioned effective usage time.

[0118] Step 213b: If the current access time is not within the preset validity period, the preset validity period is extended by a preset time length to obtain a target validity period.

[0119] In an embodiment of the present application, the preset duration may be a certain duration set in advance, and the preset duration may be an empirical duration obtained based on a large number of experiments that can ensure the maximum security and reliability of data, and may be adjusted in different application scenarios. When the current access time is not within the preset validity period of the authentication ticket, in order to ensure effective escape, the proxy gateway extends the preset validity period in the authentication ticket to obtain a target validity period. For example, when the preset validity period is 4 hours, and the current access time has exceeded the preset validity period, the proxy gateway extends the validity period of the authentication ticket by 3 hours, so that the target validity period is 7 hours.

[0120] Step 213c: If the current access time is within the target validity period, determine that the third authentication result is authentication passed.

[0121] In an embodiment of the present application, the current access time is determined, and it is analyzed whether the current access time is within the target validity period set in the authentication ticket. If the current access time is within the target validity period of the authentication ticket, the third authentication result is determined to be authentication passed. Otherwise, if the current access time exceeds the target validity period of the authentication ticket, the third authentication result can be determined to be authentication failed.

[0122] Based on the above embodiments, the present application embodiment provides a structural diagram of a secure network architecture. Figure 7 As shown, the security network architecture includes at least: SDP client node Q1, SDP control center Q2, SDP proxy gateway Q3 and business server Q4. SDP control center: responsible for user authentication, authorization and policy management and issuance, it is the overall scheduling and management center; responsible for controlling the establishment of connections and cutting off the communication connection between the subject (server) and the object (client node); SDP proxy gateway: responsible for establishing, monitoring and cutting off the connection between the access subject and the object, it communicates with the SDP control center and receives policies and instructions from the control center. SDP client node: provides terminal security detection capabilities, collects and reports the current environment of the accessed terminal (such as operating system, firewall, anti-virus software, application process), and reports it to the SDP control center for trust assessment policy management.

[0123] based on Figure 7The security network architecture system shown, the workflow when the security network architecture is working normally is as follows: Step a101, when the security network architecture is working normally, when the SDP client node logs in and goes online, the SDP client node sends authentication information to the SDP control center, so that the SDP control center can authenticate the SDP client node login process; Step a102, after the SDP client node logs in and goes online, the SDP client node sends the user's access resource request to the SDP proxy gateway; Step a103, the SDP proxy gateway sends the access resource request to the SDP control center, so that the SDP control center can perform user application authentication on the access resource request and obtain the application authentication result; Step a104, when the application authentication result is passed, the SDP control center returns a control message to the SDP proxy gateway; Step a105, the SDP proxy gateway forwards the access resource request to the business server according to the control message to request the corresponding application resources.

[0124] When the secure network architecture system is working properly, the SDP client node authentication process can refer to Figure 8 As shown, including:

[0125] Step b101: When the SDP client node detects a user login operation, it generates a client node authentication request and sends the client node authentication request to the SDP control center.

[0126] Step b102: The SDP control center performs authentication processing on the client node authentication request. After the client node authentication request is authenticated, the application list data including the escape ticket and the authentication ticket are sent to the SDP client node.

[0127] Step b103: The SDP client node encrypts the received application list data to obtain target application list information.

[0128] The client node encrypts the received application list data to ensure that other applications cannot tamper with the application list data or read and decrypt it.

[0129] Step b104: When the SDP client node detects an access operation instruction to application A, it sends the access operation instruction to the SDP proxy gateway.

[0130] Among them, application A is in the target application list information.

[0131] Step b105: The SDP proxy gateway sends the access operation instruction to the SDP control center.

[0132] Step b106: The SDP control center performs application authentication on the access operation instruction, and issues an authentication ticket to the SDP proxy gateway after the authentication is passed.

[0133] The SDP proxy gateway stores the authentication ticket of application A so that the access operation of application A can be directly authenticated later.

[0134] Step b107: The SDP proxy gateway sends an access operation instruction to the service server.

[0135] The SDP proxy gateway sends the access operation instruction to the business server corresponding to application A so that the business server can provide corresponding business services for application A.

[0136] Based on steps b101 to b107 of the above embodiment, when the SDP proxy gateway detects a fault in the SDP control center, the corresponding escape mode is enabled according to the SDP fault type and the state of the SDP client node. In the event of a fault in the SDP control center, such as an abnormality in the user authentication link, the SDP client node is not logged in or online at this time, and the application in the application list most recently obtained by the SDP client is escaped, and the SDP proxy gateway switches to the first-level escape mode. The specific escape implementation process can be referred to Fig. 9 As shown:

[0137] Step c101: The SDP client node sends user login information to the SDP proxy gateway.

[0138] Step c102: The SDP proxy gateway returns information indicating that it has entered the first-level escape mode to the SDP client node.

[0139] Step c103: The SDP client node switches to the escape mode.

[0140] Step c104: The SDP client node decrypts the most recent application list information data.

[0141] Step c105 : After the SDP client node detects the user's most recent access request to application A in the application list information, it sends the access request of application A and the escape ticket of application A to the SDP proxy gateway.

[0142] The escape ticket at least includes the application identifier of application A, user information of the user using the client node, issuance timestamp, validity period and other information.

[0143] Step c106: The SDP proxy gateway authenticates the escape ticket of application A and obtains an authentication result.

[0144] Step c107: When the authentication result is authentication passed, the SDP proxy gateway sends an access request of application A to the service server.

[0145] Based on steps b101 to b107 of the above embodiment, when a fault occurs in the SDP control center, the fault type is such as an abnormality in the application authentication link. At this time, the SDP client node is online, and the application in the application list obtained when the client node goes online is escaped. The SDP proxy gateway enters the secondary escape mode. The specific escape implementation process can be referred to Fig.10 As shown:

[0146] Step d101: After the SDP client node detects that the user accesses application A in the application list, it sends an access request of application A and an escape ticket of application A to the SDP proxy gateway.

[0147] Step d102: The SDP proxy gateway authenticates the escape ticket of application A and obtains an authentication result.

[0148] Step d103: When the authentication result is authentication passed, the SDP proxy gateway sends an access request of application A to the service server.

[0149] Based on steps b101 to b107 of the above embodiment, when the SDP control center fails, the failure type is such as the SDP control center crashes, and the SDP client node is online at this time, and the application in the application list accessed by the client node is escaped, and the SDP proxy gateway enters the third-level escape mode. The specific escape implementation process can be referred to Fig.11 As shown:

[0150] Step e101: When the SDP client node detects a user's access operation to the accessed application A, it sends the access operation to the SDP proxy gateway.

[0151] Step e102: The SDP proxy gateway receives the access operation and detects whether there is an authentication ticket for application A.

[0152] Step e103: If there is an authentication ticket for application A, the SDP proxy gateway determines the validity period of the authentication ticket.

[0153] Step e104: If the current access time exceeds the validity period of the authentication ticket, the SDP proxy gateway extends the validity period of the authentication ticket to obtain a target validity period.

[0154] If the current access time is within the validity period of the authentication ticket, the SDP proxy gateway sends the access request to the service server.

[0155] Step e105: If the SDP proxy gateway determines that the current access time is within the target usage validity period, the SDP proxy gateway sends an access request to the service server.

[0156] In this way, when an abnormality occurs in the SDP control center, the security network architecture system can execute the corresponding escape mode according to the actual situation to ensure the user experience, improve the competitiveness of the security network architecture system, enhance the high availability of the product, and build the overall high concurrency and high availability competitiveness of the product.

[0157] It should be noted that the explanations of the same steps or concepts in this embodiment as those in other embodiments can refer to the descriptions in other embodiments and will not be repeated here.

[0158] The network management method provided by the embodiment of the present application determines the current working state of the client node after determining the current fault information of the network architecture system through the proxy gateway, and then determines the target escape mechanism of the network architecture system based on the current fault information and the current working state, and finally switches the escape mechanism of the proxy gateway to the target escape mechanism, so that the proxy gateway provides escape authentication services for the client node. In this way, when the network architecture system fails and cannot provide services to the client node, the proxy gateway in the network architecture system determines the target escape mechanism according to the current fault information and the current working state of the client node, and then provides escape authentication services to the client node according to the target escape mechanism, so that the client node can still provide services to the user, which solves the problem that the current new security network architecture does not have a reliable and complete escape mechanism, and proposes a reliable network management method, which ensures that the new security network architecture executes the escape mechanism in an orderly manner when a fault occurs, ensures that reliable and safe network services are provided to customers, and reduces the possibility of security accidents.

[0159] Based on the above embodiments, the present application provides a network management device 3, which can be applied to Figures 1 to 6 In the corresponding embodiment, refer to Fig.12 As shown, the network management device 3 includes: a first determination unit 31, a second determination unit 32, a third determination unit 33 and a switching unit 34; wherein:

[0160] A first determining unit 31 is used to determine current fault information of a network architecture system; wherein the network architecture system includes a proxy gateway;

[0161] A second determining unit 32, configured to determine a current working state of the client node;

[0162] A third determining unit 33 is used to determine a target escape mechanism of the network architecture system based on the current fault information and the current working state; wherein the network architecture system includes at least one preset escape mechanism;

[0163] The switching unit 34 is used to switch the escape mechanism of the proxy gateway to a target escape mechanism.

[0164] In other embodiments of the present application, the third determining unit is specifically used to implement the following steps:

[0165] If the current fault information is that the control center has a first type of fault, and the current working state is that the client is not logged in or the client node has passed the identity authentication state, the target escape mechanism is determined to be the first escape mechanism; wherein the network architecture system includes a control center, and the control center is used to implement the scheduling and management of the network architecture system;

[0166] If the current fault information is that the control center has a second type of fault, and the current working state is that the client node has passed the identity authentication state, the target escape mechanism is determined to be the second escape mechanism;

[0167] If the current fault information is that a third type of fault occurs in the control center, and the current working state is that the client node has passed the identity authentication state, the target escape mechanism is determined to be the third escape mechanism; wherein the first escape mechanism, the second escape mechanism and the third escape mechanism are all different.

[0168] In other embodiments of the present application, when the target escape mechanism is a first type escape mechanism, after the switching unit, the network management device further includes: a sending unit; wherein:

[0169] A sending unit is used to send a notification message to a client node; wherein the notification message is used to instruct the client node to switch to a client escape mode.

[0170] In other embodiments of the present application, the network management device further includes: an authentication unit; wherein:

[0171] an authentication unit, configured to authenticate the first escape ticket upon receiving a first application access request and a first escape ticket sent by a client node, and obtain a first authentication result; wherein the first application access request is used to request access to a first application, and the first escape ticket is used to record escape information of the first application, and the first application is an application in the target application list information accessed by the client node in a previous access process after identity authentication adjacent to the current login;

[0172] The sending unit is further used to send a first application access request to the first server if the first authentication result is authentication passed; wherein the first server is used to provide services for the first application.

[0173] In other embodiments of the present application, when the target escape mechanism is the second type of escape mechanism,

[0174] The authentication unit is further configured to authenticate the second escape ticket to obtain a second authentication result if a second application access request and a second escape ticket sent by the client node are received; wherein the second application access request is used to request access to a second application, the second application is an application in the target application list information currently obtained by the client node after identity authentication, and the second escape ticket is used to record the escape information of the second application;

[0175] The sending unit is further used to send a second application access request to a second server if the second authentication result is authentication passed; wherein the second server is used to provide services for the second application.

[0176] In other embodiments of the present application, when the target escape mechanism is the third type escape mechanism, the network management device further includes: a parsing unit; wherein:

[0177] A parsing unit, configured to parse the third application access request sent by the client node to obtain a parsing result if a third application access request is received; wherein the third application access request is used to request access to a third application in the client node;

[0178] The authentication unit is further configured to authenticate the target authentication ticket if there is a target authentication ticket matching the third application identifier included in the parsing result, to obtain a third authentication result;

[0179] The sending unit is further used to send a third application access request to a third server if the third authentication result is authentication passed; wherein the third server is used to provide services for the third application.

[0180] In other embodiments of the present application, the authentication unit includes: an acquisition module and a determination module; wherein:

[0181] An acquisition module is used to extend the preset validity period by a preset time if the current access time is not within the preset validity period to obtain a target validity period;

[0182] The determination module is used to determine that the third authentication result is authentication passed if the current access time is within the target validity period.

[0183] It should be noted that the information interaction process between nodes in this embodiment can refer to the information interaction process described in the aforementioned method embodiment, and will not be repeated here.

[0184] The network management device provided in the embodiment of the present application determines the current working state of the client node after determining the current fault information of the network architecture system through the proxy gateway, and then determines the target escape mechanism of the network architecture system based on the current fault information and the current working state, and finally switches the escape mechanism of the proxy gateway to the target escape mechanism, so that the proxy gateway provides escape authentication services for the client node. In this way, when the network architecture system fails and cannot provide services to the client node, the proxy gateway in the network architecture system determines the target escape mechanism according to the current fault information and the current working state of the client node, and then provides escape authentication services to the client node according to the target escape mechanism, so that the client node can still provide services to the user, which solves the problem that the current new security network architecture does not have a reliable and complete escape mechanism, and proposes a reliable network management method, which ensures that the new security network architecture executes the escape mechanism in an orderly manner when a fault occurs, ensures that reliable and safe network services are provided to customers, and reduces the possibility of security accidents.

[0185] Based on the above embodiments, the embodiments of the present application provide a network architecture system 4, which can be applied to Figures 1 to 6 In the corresponding embodiment, refer to Fig.13 As shown, the network architecture system 4 includes: at least one client node 41, at least one proxy gateway 42 and a control center 43; wherein:

[0186] The client node 41 is used to provide client services for users. When the client node logs in, it sends an identity authentication message to the control center, receives the application list information sent by the control center, the escape data ticket and the authentication ticket corresponding to each application in the application list information, encrypts the application list information, the escape data ticket and the authentication ticket corresponding to each application in a preset encryption method, obtains the target application list information, and stores the target application list information;

[0187] The control center 43 is used to receive the identity authentication message sent by the client node, authenticate the client node based on the identity authentication message, and obtain an authentication result. If the authentication result is authentication passed, the application list information of the client node, the escape data ticket corresponding to each application in the application list information, and the authentication ticket are sent to the client node;

[0188] The control center 43 is also used to schedule and manage at least one proxy gateway and at least one client node;

[0189] The proxy gateway 42 is used to implement Figures 1 to 6 The network management method provided by the corresponding embodiment will not be described in detail here.

[0190] Based on the foregoing embodiments, the embodiments of the present application provide a computer-readable storage medium, referred to as a storage medium, which stores one or more network management methods, and the one or more network management methods can be executed by one or more processors to implement the following. Figures 1 to 6 The network management method provided by the corresponding embodiment will not be described in detail here.

[0191] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0192] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0193] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, ..., an air conditioner, or a network communication link device, etc.) to execute the methods described in each embodiment of the present application.

[0194] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0195] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0196] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0197] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A network management method, characterized in that: The method is applied to a proxy gateway, and the method comprises: Determine current fault information of a network architecture system; wherein the network architecture system includes the proxy gateway; Determine the current working status of the client node; Based on the current fault information and the current working state, determining a target escape mechanism of the network architecture system; wherein the network architecture system includes at least one preset escape mechanism; The escape mechanism of the proxy gateway is switched to the target escape mechanism so that the proxy gateway provides an escape authentication service for the client node.

2. The method according to claim 1, characterized in that The determining, based on the current fault information and the current working state, a target escape mechanism of the network architecture system includes: If the current fault information is that a first type of fault occurs in the control center, and the current working state is that the client is not logged in or the client node has passed the identity authentication state, the target escape mechanism is determined to be the first escape mechanism; wherein the network architecture system includes the control center, and the control center is used to implement the scheduling and management of the network architecture system; If the current fault information is that the control center has a second type of fault, and the current working state is that the client node has passed the identity authentication state, determining that the target escape mechanism is the second escape mechanism; If the current fault information is that a third type of fault occurs in the control center, and the current working state is that the client node has passed the identity authentication state, the target escape mechanism is determined to be a third escape mechanism; wherein the first escape mechanism, the second escape mechanism and the third escape mechanism are all different.

3. The method according to claim 2, characterized in that When the target escape mechanism is the first type of escape mechanism, after the escape mechanism of the proxy gateway is switched to the target escape mechanism, the method further includes: Send a notification message to the client node; wherein the notification message is used to instruct the client node to switch to the client escape mode.

4. The method according to claim 3, characterized in that: The method further comprises: If a first application access request and a first escape ticket sent by the client node are received, the first escape ticket is authenticated to obtain a first authentication result; wherein the first application access request is used to request access to a first application, and the first escape ticket is used to record escape information of the first application, and the first application is an application in the target application list information accessed by the client node in a previous access process after identity authentication adjacent to the current login; If the first authentication result is authentication passed, sending the first application access request to a first server; wherein the first server is used to provide services for the first application.

5. The method according to claim 2, characterized in that: When the target escape mechanism is the second type of escape mechanism, after the escape mechanism of the proxy gateway is switched to the target escape mechanism, the method further includes: If a second application access request and a second escape ticket sent by the client node are received, the second escape ticket is authenticated to obtain a second authentication result; wherein the second application access request is used to request access to a second application, the second application is an application in the target application list information currently obtained by the client node after identity authentication, and the second escape ticket is used to record the escape information of the second application; If the second authentication result is authentication passed, sending the second application access request to the second server; wherein the second server is used to provide services for the second application.

6. The method according to claim 3, characterized in that When the target escape mechanism is the third type escape mechanism, after the escape mechanism of the proxy gateway is switched to the target escape mechanism, the method further includes: If a third application access request sent by the client node is received, the third application access request is parsed to obtain a parsing result; wherein the third application access request is used to request access to a third application in the client node; If there is a target authentication ticket that matches the third application identifier included in the parsing result, authenticate the target authentication ticket to obtain a third authentication result; If the third authentication result is authentication passed, the third application access request is sent to a third server; wherein the third server is used to provide services for the third application.

7. The method according to claim 6, characterized in that If there is a target authentication ticket that matches the third application identifier included in the parsing result, authenticating the target authentication ticket to obtain a third authentication result includes: If there is a target authentication ticket that matches the third application identifier included in the parsing result, obtaining a preset validity period of the target authentication ticket; If the current access time is not within the preset validity period, the preset validity period is extended by a preset time to obtain a target validity period; If the current access time is within the target validity period, the third authentication result is determined to be authentication passed.

8. A network management device, characterized in that: The device is applied to a proxy gateway, and comprises: a first determining unit, a second determining unit, a third determining unit and a switching unit; wherein: The first determining unit is used to determine current fault information of the network architecture system; wherein the network architecture system includes the proxy gateway; The second determining unit is used to determine the current working state of the client node; The third determination unit is used to determine a target escape mechanism of the network architecture system based on the current fault information and the current working state; wherein the network architecture system includes at least one preset escape mechanism; The switching unit is used to switch the escape mechanism of the proxy gateway to the target escape mechanism.

9. A network architecture system, characterized in that: The system at least comprises: at least one client node, at least one proxy gateway and a control center; wherein: The client node is used to provide client services for users. When the client node logs in, it sends an identity authentication message to the control center, receives the application list information sent by the control center, the escape data ticket and the authentication ticket corresponding to each application in the application list information, encrypts the application list information, the escape data ticket and the authentication ticket corresponding to each application in a preset encryption method, obtains the target application list information, and stores the target application list information; The control center is configured to receive the identity authentication message sent by the client node, authenticate the client node based on the identity authentication message, obtain an authentication result, and if the authentication result is authentication passed, send the application list information of the client node, the escape data ticket corresponding to each application in the application list information, and the authentication ticket to the client node; The control center is further used to schedule and manage at least one of the proxy gateways and at least one of the client nodes; The proxy gateway is used to implement the steps of the network management method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a network management program, and when the network management program is executed by the processor, the steps of the network management method according to any one of claims 1 to 7 are implemented.

Images