Multi-network partition TCP traffic scheduling method and system based on zero trust

Abstract

The present invention belongs to the field of communication technology, and specifically discloses a multi-network partition TCP traffic scheduling method and system based on zero trust. The method includes: establishing a long connection channel between Agents and servers in different network partitions, then performing networking connections, and finally establishing a bridge to achieve traffic intercommunication. The system includes: a server and an Agent; the server, as the core of the entire system, is responsible for coordinating communications between network partitions, managing security policies, and scheduling network traffic; the Agent is a lightweight software component deployed in each network partition, responsible for communicating with the server and forwarding traffic in the local network. The present invention realizes network interconnection in a software-defined manner, without the need for expensive dedicated hardware equipment, greatly reducing deployment and maintenance costs. The lightweight Agent design enables the system to be quickly deployed and expanded to adapt to network environments of different sizes and types.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a multi-network partition TCP traffic scheduling method and system based on zero trust. Background Art

[0002] In today's globalized business environment, large enterprises often have business branches in multiple geographical locations. These distributed business units need to frequently exchange data and communicate to ensure business continuity and collaborative efficiency. However, traditional network interconnection solutions often face problems such as high cost, insufficient security, and lack of flexibility:

[0003] Leased Lines: Enterprises can lease dedicated physical lines to connect networks in different geographical locations. This method provides high-speed, stable connections, but is extremely costly and lacks flexibility.

[0004] Virtual Private Network (VPN): VPN technology allows the creation of encrypted channels through public networks, enabling secure connections between remote networks. However, traditional VPNs can have performance bottlenecks and are complex to manage when deployed on a large scale.

[0005] Software-defined wide area network (SD-WAN): SD-WAN provides a more flexible network management solution that can dynamically select the best path to transmit data. However, SD-WAN solutions usually require specialized hardware equipment and have a higher initial investment.

[0006] Cloud connection services: Some cloud service providers offer dedicated network services that connect directly to their data centers, such as AWS Direct Connect or Azure ExpressRoute. Although these services have good performance, they are limited to specific cloud platforms and are more expensive.

[0007] Therefore, the current technology has the following technical problems:

[0008] High cost: The cost of renting or purchasing dedicated lines and high-end network equipment is extremely high, which is a huge expense for many companies.

[0009] Lack of flexibility: Traditional solutions usually require complex configuration and maintenance by professional IT personnel, and are difficult to quickly adapt to business changes.

[0010] Insufficient security: Some solutions may not provide end-to-end encryption or lack fine-grained access control, increasing the risk of data leakage.

[0011] Limited scalability: As business grows, traditional solutions may have difficulty scaling quickly to meet growing network demands.

[0012] Performance bottlenecks: Some VPN solutions may cause increased network latency, affecting the performance of critical business applications.

[0013] Complex management: Large-scale deployment and management of traditional VPN or private network solutions usually requires a lot of human resources and expertise.

[0014] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present invention, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0015] The purpose of the present invention is to solve the technical problems existing in the background technology. To this end, a multi-network partition TCP traffic scheduling method and system based on zero trust are provided.

[0016] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0017] The multi-network partition TCP traffic scheduling method based on zero trust includes the following steps:

[0018] Step S1: When the Agent in different network partitions receives the corresponding task, a long connection channel is established between the Agent and the server. At the same time, the Agent sends a handshake message to the server.

[0019] Step S2: After receiving the handshake message, the server parses the handshake message and queries its own networking task table to see if there is a corresponding task;

[0020] If there is no corresponding task, the connection between the Agents that initiate the network connection will be rejected;

[0021] If there is a corresponding task, query the task details to see whether the Agent ID that initiated the network connection is included in the corresponding details;

[0022] If the Agent ID is not included, the connection between the Agents that initiate the networking connection will be rejected;

[0023] If the Agent ID is included, a connection is established between the Agents that initiate the networking connection;

[0024] Step S3: Push the established connection into the matching queue of the connection pool;

[0025] Step S4: When a traffic request is received, the server checks the connection in the matching queue to see if a corresponding connection exists;

[0026] If there is no corresponding connection, repeat steps S1-S3, and the traffic requests the peer Agent to establish a connection;

[0027] If there is a corresponding connection, determine whether the corresponding connection is a local connection or a remote connection;

[0028] If it is a local connection, the traffic requests the peer Agent to directly establish a bridge to achieve traffic intercommunication;

[0029] If it is a remote connection, the traffic is forwarded to the remote server, and the remote server responds to the traffic request.

[0030] The following is a technical solution further defined by the method of the present invention, wherein a long connection channel is established between the Agent and the server, including:

[0031] The server monitors the open port of the server agent. When the business end initiates a connection to the open port of the server agent, the server checks the IP address of the business end to determine whether it is in the whitelist;

[0032] If the IP is not in the whitelist, the connection between the server agent and the server will be rejected;

[0033] If the IP is in the whitelist, a connection channel is established between the server agent and the server, and the corresponding business end is identified;

[0034] The server establishes a connection channel with the client Agent that requests the target service address based on the business end target service address of the listening port.

[0035] The following is a technical solution further limited by the method of the present invention. After a connection channel is established between the server-side Agent and the server, the server-side Agent only allows access by the corresponding connected business end IP.

[0036] The following is a technical solution further defined by the method in the present invention, which uses the CDTP multi-connection conversion protocol to put the TCP connection traffic of multiple business terminals into the long connection channel established between the Agent and the server, and reuses a long connection channel.

[0037] The following is a technical solution further defined by the method of the present invention, wherein the server parses domain names of multiple service terminals and determines the message type, wherein the message type includes heartbeat, flow, and closed connection;

[0038] If the message type is heartbeat, it is skipped and the server does not respond;

[0039] When the message type is to close the connection, the server closes the currently managed bridge;

[0040] When the message type is traffic, it is determined whether the service end corresponding to the traffic has an identified service end;

[0041] If there is no identified business end, the business end and its corresponding target service address reuse a long connection channel to build a virtual bridge and identify the corresponding business end;

[0042] At this time, for the server, its management table has real bridges and their corresponding identification service ends, virtual bridges and their corresponding identification service ends;

[0043] Take out the virtual bridge corresponding to the business end, copy the traffic data of the corresponding business end, and forward it to the corresponding target service address.

[0044] The following is a technical solution further limited by the method in the present invention: the metadata of the message type heartbeat has no information and the Paylaod has no data; the metadata of the message type closing the connection contains the Agent ID and task ID corresponding to the bridge and the Paylaod has no data; the metadata of the message type traffic contains the Agent ID and task ID corresponding to the bridge and the Payload contains actual traffic data.

[0045] The following is a technical solution further defined by the method of the present invention, using a connection detector to detect whether the connection in the connection pool is active, including:

[0046] Traverse the connection pool;

[0047] Set the connection read data timeout to 1ms;

[0048] Read one byte of data. If the read timeout occurs, the connection is unavailable and closed.

[0049] If the reading is normal, it means the connection is active and the read data is placed in the local buffer.

[0050] The following is a technical solution further limited by the method of the present invention. When two Agents bridge data, if there is data in the buffer, the data is read from the buffer first. If there is no data in the buffer, the data is read from the actual connection.

[0051] The following is a technical solution further defined in the method of the present invention, wherein a command channel and a data channel are set between the Agent and the server;

[0052] Command channel: Based on Websocket, using WSS protocol for connection, the Agent is configured with a public key certificate;

[0053] Data channel: Based on TCP, using TLS protocol for encrypted connection, the public key certificate is issued by the server through the command channel;

[0054] When the Agent establishes a connection with the server, if the public key certificate sent by the server to the Agent is consistent with the public key certificate configured by the Agent, the connection is established; if the public key certificate sent by the server to the Agent is inconsistent with the public key certificate configured by the Agent, the connection is rejected.

[0055] A multi-network partition TCP traffic scheduling system based on zero trust, used to implement the above-mentioned multi-network partition TCP traffic scheduling method based on zero trust, including: a server and an Agent;

[0056] The server, as the core of the entire system, is responsible for coordinating communications between network partitions, managing security policies, and scheduling network traffic;

[0057] Agent is a lightweight software component deployed in each network partition. It is responsible for communicating with the server and forwarding traffic in the local network. Agent is divided into server agent and client agent.

[0058] The server-side Agent is used to accept requests from the business side and forward the request traffic from the business side to the server intact;

[0059] The client agent is used to receive the request traffic from the business end passed by the server and forward the traffic intact to the target service address.

[0060] Compared with the prior art, the present invention has the following technical effects:

[0061] Significantly reduce costs: Network interconnection is achieved through software-defined methods, eliminating the need for expensive dedicated hardware equipment, greatly reducing deployment and maintenance costs.

[0062] Improved security: Zero-trust architecture and dynamic SSL Pinning mechanism significantly improve system security, effectively preventing data leakage and unauthorized access;

[0063] Enhanced flexibility: The lightweight Agent design enables the system to be quickly deployed and expanded to adapt to network environments of different sizes and types;

[0064] Optimized performance: Intelligent traffic scheduling algorithm and WebSocket based communication mechanism improve data transmission efficiency and reduce network latency.

[0065] The present invention is further described below in conjunction with the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0067] Figure 1 It is a schematic flow chart of the method of the present invention;

[0068] Figure 2 It is a schematic diagram of the process of establishing a long connection channel between the Agent and the server in the present invention;

[0069] Figure 3 It is a schematic diagram of the connection relationship between the service end and the target service address of the present invention, which corresponds one to one, using a long connection channel;

[0070] Figure 4 It is a schematic diagram of the connection relationship between multiple service terminals and multiple target service addresses of the present invention, in which a long connection channel is multiplexed;

[0071] Figure 5 It is a connection block diagram of TCP flow scheduling performed by the system in the present invention. DETAILED DESCRIPTION

[0072] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention can be implemented in many other ways different from those described herein, and those skilled in the art can make similar improvements without violating the connotation of the present invention, so the present invention is not limited by the specific embodiments disclosed below.

[0073] like Figure 1-5 As shown, this embodiment provides a multi-network partition TCP traffic scheduling method based on zero trust and a multi-network partition TCP traffic scheduling system based on zero trust.

[0074] The system is mainly composed of the following key components:

[0075] Server: As the core of the entire system, it is responsible for coordinating the communication between network partitions (for example, coordinating the communication between network partition A and network partition B), managing security encryption policies, and scheduling network traffic. The server dynamically adjusts the traffic forwarding path in real time according to network conditions and security policies.

[0076] Agent (network partition agent component): A lightweight software component deployed in each network partition, responsible for communicating with the server and forwarding traffic in the local network.

[0077] WebSocket channel (command channel): used to establish a persistent two-way communication connection between the Agent and the server.

[0078] TCP channel (data channel): Use TLS protocol for encrypted connection, and the public key certificate is issued by the server through the command channel.

[0079] SSL Pinning mechanism: further ensures the communication security between the Agent and the server.

[0080] Agent: has two functions

[0081] 1. As a server (i.e., server Agent): accept requests from the business side and forward the business side's TCP traffic to the server intact.

[0082] 2. As a client (i.e., client Agent): accept the TCP traffic from the business end transmitted by the server, and forward the traffic intact to the target service address.

[0083] Server: Has two functions

[0084] 1. As a data router:

[0085] When establishing a data channel connection with the Agent, the Agent will inform the server which task its data channel is used for; that is, when establishing a connection with Agent-A on the server side and Agent-B on the client side, because the data channels are identified, the data channels of the two same tasks will be bridged so that the traffic on both sides can pass.

[0086] 2. As a network command issuer:

[0087] Issue networking commands, including:

[0088] 1) Send the "Networking-Accept Connection" command to Agent-A on the server side, and monitor whether the business side initiates a connection to Agent-A on the server side by monitoring the open port of Agent-A on the server side; when the business side initiates a connection, it will check the IP address of the business side to see if it is in the whitelist.

[0089] 2) Send the "Networking-Request Target Service" command to Agent-B on the client side to request the address of the target service.

[0090] Therefore, networking is not initiated by the Agent, but is uniformly scheduled by the server, which ensures the security of the network environment. Even if one of the Agents is invaded, it will not invade the Agents in other network partitions.

[0091] It should be noted that, in this embodiment, in order to further ensure the security of the server, a proxy server is used: the Agent will not connect directly to the server, but to the proxy server, which will forward the traffic to the server. In this way, the server only needs to open the IP whitelist for the proxy server, which can effectively limit the scope of whitelisting and protect the security of the server.

[0092] like Figure 1 As shown, the multi-network partition TCP traffic scheduling method based on zero trust specifically includes the following steps:

[0093] Step S1: When the Agent in different network partitions receives the corresponding task, a long connection channel is established between the Agent and the server. At the same time, the Agent sends a handshake message to the server.

[0094] Step S2: After receiving the handshake message, the server parses the handshake message and queries its own networking task table to see if there is a corresponding task;

[0095] If there is no corresponding task, the connection between the Agents that initiate the network connection will be rejected;

[0096] If there is a corresponding task, query the task details to see whether the Agent ID that initiated the network connection is included in the corresponding details;

[0097] If the Agent ID is not included, the connection between the Agents that initiate the networking connection will be rejected;

[0098] If the Agent ID is included, a connection is established between the Agents that initiate the networking connection.

[0099] Step S3: Push the established connection into the matching queue of the connection pool.

[0100] Step S4: When a traffic request is received, the server checks the connection in the matching queue to see if a corresponding connection exists;

[0101] If there is no corresponding connection, repeat steps S1-S3, and the traffic requests the peer Agent to establish a connection;

[0102] If there is a corresponding connection, determine whether the corresponding connection is a local connection or a remote connection;

[0103] If it is a local connection, the traffic requests the peer Agent to directly establish a bridge to achieve traffic intercommunication;

[0104] If it is a remote connection, the traffic is forwarded to the remote server, and the remote server responds to the traffic request.

[0105] like Figure 2 As shown in the figure, a long connection channel is established between the Agent and the server, including:

[0106] The server monitors the open port of the server agent. When the business end initiates a connection to the open port of the server agent, the server checks the IP address of the business end to determine whether it is in the whitelist;

[0107] If the IP is not in the whitelist, the connection between the server agent and the server will be rejected;

[0108] If the IP is in the whitelist, a connection channel is established between the server agent and the server, and the corresponding business end is identified;

[0109] The server establishes a connection channel with the client Agent that requests the target service address based on the business end target service address of the listening port.

[0110] In one embodiment of the present invention, after a connection channel is established between the server-side Agent and the server, the server-side Agent only allows the corresponding service-side IP to access. Figure 3 As shown, usually, a business end uses a dedicated long connection channel to correspond to a target service address one by one for traffic bridging.

[0111] In another embodiment of the present invention, Figure 4As shown in the figure, when each network is prone to congestion, the CDTP multi-connection conversion protocol is used to put the TCP connection traffic of multiple service ends into the long connection channel established between the Agent and the server, and reuse a long connection channel. Specifically: the server parses the domain names of multiple service ends and determines the message type, where the message type includes heartbeat, traffic and closed connection; when the message type is heartbeat, it is skipped and the server does not respond; when the message type is closed connection, the server closes the currently managed bridge; when the message type is traffic, it is determined whether there is an identified service end for the service end corresponding to the traffic; if there is no identified service end, the service end and its corresponding target service address reuse a long connection channel to build a virtual bridge and identify the corresponding service end; at this time, for the server, its management table has a real bridge and its corresponding identified service end, a virtual bridge and its corresponding identified service end; take out the virtual bridge corresponding to the identified service end, copy the traffic data of the corresponding service end, and forward it to the corresponding target service address. It should be noted that the specific method for determining the message type is as follows: if the message type is heartbeat, the metadata has no information and the Payload has no data; if the message type is connection close, the metadata contains the Agent ID and task ID corresponding to the bridge and the Payload has no data; if the message type is traffic, the metadata contains the Agent ID and task ID corresponding to the bridge and the Payload contains the actual traffic data.

[0112] like Figure 4 As shown, the long connection channel is: Agent-A on the service side, server, and Agent-B on the client side. A real bridge is: business side B, Agent-A on the service side, server, Agent-B on the client side, and target service address B. A virtual bridge is: business side A, Agent-A on the service side, server, Agent-B on the client side, and target service address A. Another virtual bridge is: business side C, Agent-A on the service side, server, Agent-B on the client side, and target service address C.

[0113] Use the connection detector to detect whether the connection in the connection pool is active, including: traversing the connection pool; setting the connection read data timeout to 1ms; reading one byte of data. If the read timeout occurs, the connection is unavailable and the connection is closed to avoid connection occupation and further prevent network delays; if the read is normal, it means the connection is active and the read data is placed in the local buffer. When two Agents bridge data, if there is data in the buffer, the data is read from the buffer first. If there is no data in the buffer, the data is read from the actual connection.

[0114] In order to ensure the security of connection traffic transmission, a command channel and a data channel are set up between the Agent and the server; the command channel: based on Websocket, uses the WSS protocol for connection, and the Agent is configured with a public key certificate; the data channel: based on TCP, uses the TLS protocol for encrypted connection, and the public key certificate is issued by the server through the command channel. When the Agent establishes a connection with the server, if the public key certificate issued by the server to the Agent is consistent with the public key certificate configured by the Agent, the connection is established; if the public key certificate issued by the server to the Agent is inconsistent with the public key certificate configured by the Agent, the connection is rejected.

[0115] The following is a further description of the system working process of this embodiment:

[0116] like Figure 5 As shown in the figure, the server monitors the open ports of the Agents in each network partition, monitors the open port of Agent-A in network partition A with the connection request of the business end, checks whether the IP address 192.168.1.1 of the business end is in the whitelist, and then establishes a connection channel with Agent-B in network partition B that requests the target service address based on the target service address 192.168.1.1:9090 of the business end. The server queries its own networking task table and once again determines Agent-A in network partition A as the server and Agent-B in network partition B as the client. Therefore, Agent-A accepts the request from the business end and forwards the TCP traffic of the business end to the server. Agent-B accepts the TCP traffic of the business end transmitted by the server and forwards it to the target service address, thereby realizing the indirect interaction of traffic between the business end and the target service address. When the target service address successfully receives the TCP traffic, it will return the response traffic, which will be read by Agent-A through Agent-B and the server and forwarded to the business end. It should be noted that Agent-B of network partition B can also act as a server, accept requests from the business end, and forward the TCP traffic of the business end to the server. It makes specific settings according to the received tasks. Similarly, Agent-A of network partition A can also act as a client, accept the TCP traffic of the business end transmitted by the server, and forward it to the target service address. It makes specific settings according to the received tasks.

[0117] The above is only a preferred embodiment of the present invention, and does not limit the present invention in any form. Any technician familiar with the art can make many possible changes and modifications to the technical solution of the present invention by using the above disclosed methods and technical contents without departing from the scope of the technical solution of the present invention, or modify it into an equivalent embodiment of equivalent changes. Therefore, all equivalent changes made according to the shape, structure and principle of the present invention without departing from the content of the technical solution of the present invention should be included in the protection scope of the present invention.

Claims

1. A multi-network partition TCP traffic scheduling method based on zero trust, characterized in that: The following steps are involved: Step S1: When the Agent in different network partitions receives the corresponding task, a long connection channel is established between the Agent and the server. At the same time, the Agent sends a handshake message to the server. The agent establishes a long connection channel with the server, including: The server monitors the open port of the server agent. When the business end initiates a connection to the open port of the server agent, the server checks the IP address of the business end to determine whether it is in the whitelist; If the IP is not in the whitelist, the connection between the server agent and the server will be rejected; If the IP is in the whitelist, a connection channel is established between the server agent and the server, and the corresponding business end is identified; The server establishes a connection channel with the client agent that requests the target service address based on the business end target service address of the listening port; Step S2: After receiving the handshake message, the server parses the handshake message and queries its own networking task table to see if there is a corresponding task; If there is no corresponding task, the connection between the Agents that initiate the network connection will be rejected; If there is a corresponding task, query the task details to see whether the AgentID that initiated the network connection is included in the corresponding details; If the Agent ID is not included, the connection between the Agents that initiate the networking connection will be rejected; If the Agent ID is included, a connection is established between the Agents that initiate the networking connection; Step S3: Push the established connection into the matching queue of the connection pool; Step S4: When a traffic request is received, the server checks the connection in the matching queue to see if a corresponding connection exists; If there is no corresponding connection, repeat steps S1-S3, and the traffic requests the peer Agent to establish a connection; If there is a corresponding connection, the traffic requests the peer Agents to directly establish a bridge to achieve traffic intercommunication.

2. The multi-network partition TCP traffic scheduling method based on zero trust as claimed in claim 1 is characterized in that: After the connection channel is established between the server-side Agent and the server, the server-side Agent only allows access from the corresponding business-side IP address.

3. The zero-trust based multi-network partition TCP traffic scheduling method according to claim 1, characterized in that: Use the CDTP multi-connection conversion protocol to put the TCP connection traffic of multiple business ends into the long connection channel established between the Agent and the server, and reuse a long connection channel.

4. The multi-network partition TCP traffic scheduling method based on zero trust as claimed in claim 3 is characterized in that: The server resolves the domain names of multiple service terminals and determines the message type, where the message type includes heartbeat, traffic, and closed connection; If the message type is heartbeat, it is skipped and the server does not respond; When the message type is to close the connection, the server closes the currently managed bridge; When the message type is traffic, it is determined whether the service end corresponding to the traffic has an identified service end; If there is no identified business end, the business end and its corresponding target service address reuse a long connection channel to build a virtual bridge and identify the corresponding business end; At this time, for the server, its management table has real bridges and their corresponding identification service ends, virtual bridges and their corresponding identification service ends; Take out the virtual bridge corresponding to the business end, copy the traffic data of the corresponding business end, and forward it to the corresponding target service address.

5. The multi-network partition TCP traffic scheduling method based on zero trust as claimed in claim 4 is characterized in that: The metadata of the message type "heartbeat" contains no information and the Payload contains no data. The metadata of the message type "close connection" contains the Agent ID and task ID corresponding to the bridge and the Payload contains no data. The metadata of the message type "traffic" contains the Agent ID and task ID corresponding to the bridge and the Payload contains the actual traffic data.

6. The multi-network partition TCP traffic scheduling method based on zero trust as claimed in claim 1 is characterized in that: Use the connection detector to detect whether the connection in the connection pool is active, including: Traverse the connection pool; Set the connection read data timeout to 1ms; Read one byte of data. If the read timeout occurs, the connection is unavailable and closed. If the reading is normal, it means the connection is active and the read data is placed in the local buffer.

7. The multi-network partition TCP traffic scheduling method based on zero trust as claimed in claim 6 is characterized in that: When two Agents bridge data, if there is data in the buffer, the data is read from the buffer first. If there is no data in the buffer, the data is read from the actual connection.

8. The zero-trust based multi-network partition TCP traffic scheduling method according to claim 1, characterized in that: Set up a command channel and a data channel between the Agent and the server; Command channel: Based on Websocket, using WSS protocol for connection, the Agent is configured with a public key certificate; Data channel: Based on TCP, using TLS protocol for encrypted connection, the public key certificate is issued by the server through the command channel; When the Agent establishes a connection with the server, if the public key certificate sent by the server to the Agent is consistent with the public key certificate configured by the Agent, the connection is established; If the public key certificate sent by the server to the Agent is inconsistent with the public key certificate configured on the Agent, the connection is rejected.

9. A multi-network partition TCP traffic scheduling system based on zero trust, used to implement the multi-network partition TCP traffic scheduling method based on zero trust according to any one of claims 1 to 8, characterized in that: include: Server and Agent; The server, as the core of the entire system, is responsible for coordinating communications between network partitions, managing security policies, and scheduling network traffic; Agent is a lightweight software component deployed in each network partition. It is responsible for communicating with the server and forwarding traffic in the local network. Agent is divided into server agent and client agent. The server-side Agent is used to accept requests from the business side and forward the request traffic from the business side to the server intact; The client agent is used to receive the request traffic from the business end passed by the server and forward the traffic intact to the target service address.

Images