Remote gateway cluster control system and method based on zero trust

Abstract

The present application relates to a zero-trust-based remote gateway cluster control system and method, the remote gateway cluster control system includes: a zero-trust control center, configured to encrypt the registration code content to generate a gateway registration code; at least one gateway cluster, each gateway cluster has at least one gateway, the gateway is configured to obtain the registration code content based on the gateway registration code decryption at the gateway registration page; wherein, the zero-trust control center has an IAM service component, each gateway cluster has a cache service component, and each gateway is also configured to establish a connection with the IAM service component based on the registration code content; the IAM service component is configured to push the current configuration information to the first gateway that has established a connection, and after the first gateway stores the current configuration information in the cache service component, the gateway cluster updates all gateways therein accordingly. Through the above-mentioned remote gateway cluster control system, real-time registration and management of cross-regional gateway clusters can be achieved.

Description

Technical Field

[0001] The present invention relates to a zero-trust-based remote gateway cluster control system and method, and belongs to the technical field of network security. Background Art

[0002] With the rapid development of information technology, the enterprise network environment has become increasingly complex, especially in the context of multi-regional and multinational operations, the difficulty and importance of ensuring information security are constantly increasing. Traditional network security strategies, such as those based on border defense, have gradually shown their limitations. The zero-trust model emphasizes that access control at any time and any place must be based on strict identity authentication and authorization. In actual business application scenarios, when faced with high concurrent access by a large number of users, it is often necessary to deploy a zero-trust gateway cluster in a different location to alleviate the high network latency and resource isolation caused by a single gateway cluster environment. In particular, gateways deployed in different geographical locations need to be configured and managed efficiently and securely to ensure the security of data and access, while also responding to the real-time requirements of configuration updates and policy changes. Summary of the invention

[0003] The purpose of the present invention is to provide a zero-trust based remote gateway cluster control system and method, which can realize real-time registration and management of cross-regional gateway clusters.

[0004] In order to achieve the above object, the present invention provides the following technical solutions:

[0005] In a first aspect, a zero-trust based remote gateway cluster control system includes:

[0006] The zero trust control center is configured to encrypt the registration code content to generate a gateway registration code;

[0007] At least one gateway cluster, each of the gateway clusters having at least one gateway, the gateway being configured to obtain the registration code content based on the gateway registration code decryption at the gateway registration page;

[0008] The zero trust control center has an IAM service component, each gateway cluster has a cache service component, and each gateway is further configured to establish a connection with the IAM service component based on the registration code content;

[0009] The IAM service component is configured to push current configuration information to the first gateway with which the connection has been established. After the first gateway stores the current configuration information in the cache service component, the gateway cluster updates all the gateways therein accordingly.

[0010] In one or more feasible implementations, the registration code content includes the zero-trust IAM external network IP, port, knock code, cluster serial number and gateway expiration time.

[0011] In one or more feasible implementations, the registration code content is encrypted based on the symmetric encryption algorithm.

[0012] In one or more feasible implementations, the symmetric encryption algorithm is selected from any one or more of AES, DES, Blowfish, Twofish or ChaCha20.

[0013] In one or more feasible implementations, the gateway communicates with the IAM service component based on the registration code content, completes single packet authorization (SPA), and establishes a TCP connection.

[0014] In one or more feasible implementation modes, the gateway is further configured to periodically send heartbeat packets to the IAM service component.

[0015] In one or more feasible implementation manners, the current configuration information includes gateway resources, policies, trusted terminal IDs, and cluster user lists.

[0016] In one or more feasible implementations, the current configuration information is encrypted by the IAM service component and then pushed to the gateway.

[0017] In one or more feasible implementations, the gateway cluster further includes a rule policy engine, and the gateway cluster updates the rule policy engine based on the current configuration information.

[0018] In one or more feasible implementations, when the gateway receives the policy, it immediately performs a local verification. At the same time, after a preset time, the zero trust control center initiates a round of remote verification to reconfirm the execution of the policy on the corresponding gateway end, thereby improving the accuracy and completeness of policy rule synchronization.

[0019] In one or more feasible implementations, the gateway cluster further has an LVS load balancer, and the gateway cluster is configured to respond to a join or delete event to trigger a cluster election process and synchronize cluster health information to the LVS load balancer;

[0020] The gateway cluster also has a node status monitoring unit, which responds to instructions or regularly collects host status information of the current gateway cluster and stores it in the cache service component;

[0021] The cluster election process uses the Raft protocol to elect a master node, and the master node reports the host status information stored in the cache component to the IAM service component.

[0022] In one or more feasible implementations, the cluster health information includes one or more of the following:

[0023] Gateway status: The operating status of each gateway, including whether it is online, whether it is responsive, and the current load situation.

[0024] Resource usage: Gateway resource usage data such as CPU usage, memory usage, disk I / O, and network traffic.

[0025] Service health: The operating status and performance indicators of each service (such as authentication service, database service, etc.).

[0026] Errors and exceptions: Error and exception events logged in the system, including number, type, and frequency of occurrence.

[0027] Response time: The response time of service requests, including average response time and maximum response time.

[0028] Failures and Recovery: The number of times a gateway or service failed and the average time it took to recover.

[0029] Configuration consistency: Whether the configurations of each gateway are consistent and how configuration changes are propagated.

[0030] Data synchronization status: the synchronization status of data between gateways, including synchronization delay and synchronization errors.

[0031] Security events: security alerts, intrusion attempts, and other security-related events.

[0032] System log: Log records of system operations and events for troubleshooting and performance analysis.

[0033] Cluster load balancing status: The operating status and performance of the load balancer, including the traffic allocated to each gateway and the effect of the load balancing algorithm.

[0034] In one or more feasible implementations, the LVS load balancer is configured to dynamically adjust the weight of each gateway in load balancing according to the cluster health information.

[0035] In one or more feasible implementations, the dynamic adjustment of the weight of each gateway in load balancing includes: when a gateway is overloaded, its weight will be automatically reduced to reduce the traffic allocated to it; and for gateways with lower loads, the weight will be increased accordingly to increase the traffic it handles.

[0036] In one or more feasible implementations, the LVS load balancer is configured to predict traffic distribution in the future by analyzing historical traffic data and business patterns, and adjust the weight and resource allocation of each gateway in advance to better cope with sudden high-concurrency access.

[0037] In one or more feasible implementations, the zero-trust control center also has an intelligent analysis module, which is configured to pre-evaluate the current configuration information and analyze its impact on the network traffic and resource usage of the pushed gateway and the gateway cluster to determine whether it will cause performance degradation or access anomalies of the specific gateway and / or the gateway cluster.

[0038] In a second aspect, the present application provides a method for controlling a remote gateway cluster, which controls each of the gateway clusters based on the remote gateway cluster control system described in the first aspect.

[0039] In a third aspect, the present application provides a method for docking a remote gateway cluster, which is based on the remote gateway cluster control system described in the first aspect, and the gateway cluster performs authentication docking with the zero-trust control center.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] 1) Improved the security of cross-regional gateway cluster registration and management: By obtaining the registration code from the headquarters control center and encrypting the registration code content, gateway clusters in various regions can complete registration and establish trusted connections, ensuring the security of registration information during transmission and reducing the risk of theft or tampering.

[0042] 2) Enhanced the accuracy and completeness of configuration information push: The dual mechanism of local verification and remote verification is adopted to ensure the accurate execution of policies on the gateway side, improving the stability and reliability of the system.

[0043] 3) Optimized the load balancing of the gateway cluster: Dynamically adjusted the weight according to the load of the gateway, and allocated resources in advance based on traffic prediction, which effectively improved the performance and response speed of the system and reduced network latency and resource waste.

[0044] 4) Improved system availability and fault tolerance: By electing the master node through the Raft protocol, setting up the LVS load balancer and backup nodes, it can quickly respond to node failures and ensure service continuity.

[0045] 5) Achieved efficient policy update and synchronization: timely pushed the latest configuration information to the gateway cluster and ensured that each gateway could be updated in time to adapt to changes in business needs.

[0046] 6) Convenient for centralized management and monitoring: The zero-trust control center can fully grasp the health information, resource usage, etc. of the gateway cluster, facilitating unified management and optimized decision-making.

[0047] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention and implement it according to the contents of the specification, the following is a detailed description of the preferred embodiments of the present invention in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a schematic diagram of the architecture of a zero-trust-based remote gateway cluster control system shown in an embodiment of the present application;

[0049] Figure 2 This is a timing diagram of a remote cluster registration user operation shown in an embodiment of the present application;

[0050] Figure 3 This is a timing diagram of the interaction between components within a cluster as shown in an embodiment of the present application;

[0051] Figure 4 A schematic diagram of the structure of a computer device shown in an embodiment of the present application;

[0052] Figure 5 A schematic diagram of the specific structure of a computer device shown in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0054] It should be noted that the illustrations provided in the following embodiments are only used to illustrate the basic concept of the present invention in a schematic manner, and thus the illustrations only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0055] While some exemplary embodiments of the present invention have been described for the purpose of illustration, it should be understood that the present invention may be implemented in other ways not specifically shown in the drawings.

[0056] Figure 1 The zero-trust based remote gateway cluster control system shown in an embodiment of the present application is shown, such as Figure 1 As shown, it includes a zero-trust control center, at least one gateway cluster, and corresponding services and protocols, aiming to achieve cross-regional network security management and control.

[0057] Specifically, the zero trust control center is configured to encrypt the registration code content to generate a gateway registration code;

[0058] The zero-trust control center is used to control one or more gateway clusters, each of which has at least one gateway. The gateway is configured to obtain the registration code content based on the gateway registration code decryption on the gateway registration page;

[0059] Among them, the zero trust control center has an IAM service component, each gateway cluster has a cache service component, and each gateway is also configured to establish a connection with the IAM service component based on the registration code content;

[0060] The IAM service component is configured to push current configuration information to the first gateway with which the connection has been established. After the first gateway stores the current configuration information in the cache service component, the gateway cluster updates all gateways therein accordingly.

[0061] Specifically, Figure 2 As shown in the figure, after starting the remote gateway, the zero-trust control center generates a gateway registration code. The user fills in the gateway registration code on the remote gateway registration page, and the remote gateway parses and starts the SPA knock authentication. After the knock is successful, the IAM service component of the zero-trust control center opens the network permission, and the remote gateway cluster establishes a long link with the IAM service component, broadcasts the cluster configuration information issued by it, and continuously reports the cluster status.

[0062] As an example but not a limitation, the registration code content includes the zero-trust IAM external network IP, port, knock code, cluster serial number and gateway expiration time, and the registration code content is encrypted based on a symmetric encryption algorithm. It is understandable that the symmetric encryption algorithm is selected from any one or more of AES, DES, Blowfish, Twofish or ChaCha20.

[0063] In another embodiment, a key management system (KMS) may also be used to generate, store, distribute, and revoke keys.

[0064] For example, the Zero Trust Control Center generates a gateway registration code that includes the IAM external network IP, port, knock code, cluster serial number, gateway expiration time, and other information, and uses the AES symmetric encryption algorithm to generate ciphertext. After the gateway is started, fill in the registration code information by visiting the registration page, and use the pre-shared key to automatically decrypt and obtain the registration code content. After the gateway decrypts successfully, start the SPA knock authentication to verify the identity of the gateway and request authorization. After the knock is successful, establish a connection with IAM for subsequent secure communication, and maintain the heartbeat packet to ensure the security and real-time nature of the communication.

[0065] Specifically, after the gateway decrypts successfully, the gateway communicates with the IAM service component based on the registration code content, completes single-packet authorization authentication, and establishes a TCP connection. At the same time, the gateway is also configured to periodically send heartbeat packets to the IAM service component to maintain an active connection status and ensure the continuity and stability of the TCP connection; at the same time, IAM also confirms the online status and health status of the gateway through heartbeat packets.

[0066] As an example but not a limitation, the current configuration information includes gateway resources, policies, trusted terminal IDs, and cluster user lists. The current configuration information is encrypted by the IAM service component and then pushed to the gateway.

[0067] Specifically, they include:

[0068] In the zero-trust control center, the IAM service component obtains information such as current gateway resources, policies, trusted terminal IDs, and cluster user lists. Subsequently, the IAM service component encrypts the collected information and generates a key or an encryption algorithm, such as the Advanced Encryption Standard (AES) or the Triple Data Encryption Algorithm (3DES), to ensure the security and integrity of the information during transmission;

[0069] Secure transmission step: The encrypted information is transmitted to the target gateway through a secure communication channel, such as an encrypted channel established by the TLS (Transport Layer Security) protocol.

[0070] Information decryption step: At the gateway cluster, the transmitted information is decrypted using the same key or algorithm to obtain the original gateway resources, policies, trusted terminal IDs, cluster user lists and other information.

[0071] In one embodiment, the gateway cluster also has a rule policy engine, and the gateway cluster updates the rule policy engine based on the current configuration information. Specifically, the security policy is defined by the zero trust control center, distributed to the cluster configuration center, and then synchronized to the rule policy engine of each cluster node. The rule policy engine is at least configured to control the network access and resource allocation of the gateway according to predefined rules and policies to determine whether to allow a specific gateway / user, device or service to access network resources.

[0072] Optionally, the rule policy engine is further configured to:

[0073] 1) Real-time monitoring: monitor network traffic and gateway / user behavior to ensure they comply with established security policies;

[0074] 2) Dynamic adjustment: Dynamically adjust policies and rules based on network conditions, user behavior, and environmental changes;

[0075] 3) Compliance check: Ensure that all gateway network activities meet compliance requirements and internal regulations;

[0076] 4) Logging and auditing: Record access attempts and network events to provide data for security audits and post-event analysis.

[0077] As a demonstration rather than a limitation, in order to improve the accuracy and completeness of policy rule synchronization, a double verification mechanism is adopted: when the gateway receives the policy, it immediately performs a local verification. At the same time, after a preset time, the zero trust control center initiates a round of remote verification to reconfirm the execution of the policy on the corresponding gateway end, thereby improving the accuracy and completeness of policy rule synchronization.

[0078] like Figure 3 As shown, the gateway cluster also has an LVS load balancer, and the gateway cluster is configured to respond to a join or delete event to trigger a cluster election process and synchronize cluster health information to the LVS load balancer;

[0079] The gateway cluster also has a node status monitoring unit, which responds to instructions or regularly collects host status information of the current gateway cluster and stores it in the cache service component;

[0080] The cluster election process uses the Raft protocol to elect a master node, and the master node reports the host status information stored in the cache component to the IAM service component.

[0081] Based on the acquired host status information, in order to ensure the continuous and stable operation of the system, the Zero Trust Control Center will regularly or automatically push security patches and function updates to different gateway clusters. After receiving the update command, each gateway cluster can automatically complete the corresponding upgrade operation, and the normal network service will not be affected during the upgrade process. At the same time, the system provides a convenient maintenance interface to facilitate technical personnel to troubleshoot and optimize performance.

[0082] Specifically, for a newly added gateway, when it starts the service, it requests the cluster registration address from the LVS load balancer of the gateway cluster where it is located. The LVS load balancer forwards it to the cluster, and then the master node processes the registration request and requests the local cache service component to read the load balancing policy. Based on the returned load balancing policy, the gateway cluster regenerates the LVS load rules and notifies LVS. The master node of the gateway cluster continuously reports the cluster status to the IAM service component of the zero-trust control center. The zero-trust IAM module verifies and confirms that it is correct. The gateway cluster writes the returned cluster policy to the local cache service component and broadcasts the cluster. At the same time, based on the returned cluster policy, the new gateway node begins to receive traffic, completes capacity expansion and provides services.

[0083] By way of example and not limitation, cluster health information includes one or more of the following:

[0084] Gateway status: The operating status of each gateway, including whether it is online, whether it is responsive, and the current load situation.

[0085] Resource usage: Gateway resource usage data such as CPU usage, memory usage, disk I / O, and network traffic.

[0086] Service health: The operating status and performance indicators of each service (such as authentication service, database service, etc.).

[0087] Errors and exceptions: Error and exception events logged in the system, including number, type, and frequency of occurrence.

[0088] Response time: The response time of service requests, including average response time and maximum response time.

[0089] Failures and Recovery: The number of times a gateway or service failed and the average time it took to recover.

[0090] Configuration consistency: Whether the configurations of each gateway are consistent and how configuration changes are propagated.

[0091] Data synchronization status: the synchronization status of data between gateways, including synchronization delay and synchronization errors.

[0092] Security events: security alerts, intrusion attempts, and other security-related events.

[0093] System log: Log records of system operations and events for troubleshooting and performance analysis.

[0094] Cluster load balancing status: The operating status and performance of the load balancer, including the traffic allocated to each gateway and the effect of the load balancing algorithm.

[0095] In one of the embodiments, the LVS load balancer is configured to dynamically adjust the weight of each gateway in the load balancing according to one or more information in the cluster health information, such as the gateway status and resource usage. Specifically, when a gateway is overloaded, its weight will be automatically reduced and the traffic allocated to it will be reduced; while for gateways with lower loads, their weights will be increased accordingly and the traffic they process will be increased, thereby effectively allocating network traffic and resources.

[0096] In one embodiment, the LVS load balancer is configured to predict the traffic distribution in the future by analyzing historical traffic data and business patterns, and adjust the weight and resource allocation of each gateway in advance to better cope with sudden high-concurrency access.

[0097] As an example but not a limitation, when adjusting the weights of gateways in a gateway cluster, when gateways with the same weight appear, the cluster health information based on the information is added according to specific needs, and then the weights are adjusted to improve the differentiation. This is suitable for the master-slave gateway switching scenarios of various distributed gateway clusters.

[0098] In one of the embodiments, the zero trust control center also has an intelligent analysis module, which is configured to pre-evaluate the current configuration information and analyze its impact on the network traffic and resource usage of the pushed gateways and gateway clusters to determine whether it will cause performance degradation or access anomalies of specific gateways and / or gateway clusters.

[0099] As an example rather than a limitation, in this embodiment, when the system detects a malicious attack or abnormal traffic, the zero-trust control center can immediately trigger an emergency response mechanism, temporarily block access from suspicious sources, and notify the relevant gateway cluster to strengthen security policies. At the same time, the intelligent analysis module will analyze the attack behavior to provide a basis for subsequent preventive measures.

[0100] In summary, the remote gateway cluster control system of this application has good scalability and can easily support new gateway clusters and growing business needs. At the same time, the system is compatible with a variety of mainstream network devices and operating systems, reducing the deployment cost and technical threshold of enterprises.

[0101] In another non-illustrated embodiment, the present application provides a method for controlling a remote gateway cluster, which controls each gateway cluster based on the remote gateway cluster control system described above.

[0102] In another non-demonstration embodiment, the present application provides a method for docking a remote gateway cluster, which is based on the above-mentioned remote gateway cluster control system, and the gateway cluster performs authentication docking with the zero-trust control center.

[0103] Corresponding to the above method embodiment, an embodiment of the present invention further provides a computer device. The computer device described below and the method for controlling a remote gateway cluster and the method for docking a remote gateway cluster described above can refer to each other.

[0104] Please refer to Figure 4 , Figure 4 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. The computer device may include:

[0105] A memory A1 and a processor A2, wherein the memory A1 is used to store a computer program, and the processor A2 is used to implement the steps of the related method provided in the above method embodiment when executing the computer program.

[0106] For details, please refer to Figure 5 , Figure 5 A specific structural diagram of a computer device provided in an embodiment of the present invention. The computer device 100 may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 101 (for example, one or more processors) and memory 102, and one or more storage media 200 (for example, one or more mass storage devices) for storing application programs 103 or data 104.

[0107] The memory 102 is a computer-readable storage medium that can be used to store software programs, computer executable programs, and modules. The processor 101 executes various functional applications and data processing of the device by running the software programs, instructions, and modules stored in the memory 102, that is, implementing the relevant methods in the above-mentioned embodiments.

[0108] The memory 102 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 102 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 102 may further include a memory remotely arranged relative to the processor 101, and these remote memories may be connected to the device / terminal / server via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0109] The steps in the cluster management method described above may be implemented by the structure of a computer device. Specifically, the computer device may include one or more operating systems 105, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0110] Corresponding to the above method embodiment, an embodiment of the present invention further provides a readable storage medium. The readable storage medium described below and the method for controlling a remote gateway cluster and the method for docking a remote gateway cluster described above can refer to each other.

[0111] A readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for controlling a remote gateway cluster and the method for docking a remote gateway cluster provided in the above method embodiment.

[0112] The readable storage medium may specifically be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, or other readable storage medium that can store program codes.

[0113] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device, computer device and readable storage medium disclosed in the embodiment, since they correspond to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0114] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0115] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0116] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0117] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A zero-trust based remote gateway cluster control system, characterized in that: include: The zero trust control center is configured to encrypt the registration code content to generate a gateway registration code; At least one gateway cluster, each of which has at least one gateway, and the gateway is configured to obtain the registration code content based on the gateway registration code decryption at the gateway registration page, and the registration code content includes the zero-trust IAM external network IP, port, knock code, cluster serial number and gateway expiration time; The zero trust control center has an IAM service component, each gateway cluster has a cache service component, and each gateway is further configured to establish a connection with the IAM service component based on the registration code content; The IAM service component is configured to push current configuration information to the first gateway with which the connection has been established. After the first gateway stores the current configuration information in the cache service component, the gateway cluster updates all the gateways therein accordingly.

2. The remote gateway cluster control system according to claim 1, characterized in that: The registration code content is encrypted based on a symmetric encryption algorithm.

3. The remote gateway cluster control system according to claim 2, characterized in that: The symmetric encryption algorithm is selected from any one or more of AES, DES, Blowfish, Twofish or ChaCha20.

4. The remote gateway cluster control system according to any one of claims 1 to 3, characterized in that: The gateway communicates with the IAM service component based on the registration code content, completes single-packet authorization authentication, and establishes a TCP connection.

5. The remote gateway cluster control system according to claim 4, characterized in that: The gateway is also configured to periodically send a heartbeat packet to the IAM service component.

6. The remote gateway cluster control system according to claim 1, characterized in that: The current configuration information includes gateway resources, policies, trusted terminal IDs and cluster user lists; and / or, The current configuration information is encrypted by the IAM service component and then pushed to the gateway.

7. The remote gateway cluster control system according to claim 6, characterized in that: The gateway cluster also has a rule policy engine, and the gateway cluster updates the rule policy engine based on the current configuration information.

8. The remote gateway cluster control system according to claim 6 or 7, characterized in that: The gateway cluster also has an LVS load balancer, and the gateway cluster is configured to respond to a join or delete event to trigger a cluster election process and synchronize cluster health information to the LVS load balancer; The gateway cluster also has a node status monitoring unit, which responds to instructions or regularly collects host status information of the current gateway cluster and stores it in the cache service component; The cluster election process uses the Raft protocol to elect a master node, and the master node reports the host status information stored in the cache service component to the IAM service component.

9. A method for controlling a remote gateway cluster, characterized in that: Based on the remote gateway cluster control system according to any one of claims 1 to 8, each gateway cluster is controlled.

10. A method for connecting a remote gateway cluster, characterized in that: Based on the remote gateway cluster control system according to any one of claims 1 to 8, the gateway cluster performs authentication connection with the zero-trust control center.

Images