IPSec tunnel management method, gateway, electronic equipment and storage medium

Abstract

The invention relates to the field of communication, and discloses an IPSec tunnel management method, a zero-trust gateway, a client gateway, electronic equipment, a computer readable storage medium and a computer program product. The IPSec tunnel management method comprises the following steps: receiving IPSec tunnel request information sent by a first client gateway; iPSec tunnel configuration information is generated based on the IPSec tunnel request information, the IPSec tunnel configuration information at least comprises an IPSec tunnel encryption algorithm and a key exchange protocol, and the IPSec tunnel configuration information is sent to the first client gateway and the second client gateway to construct an IPSec tunnel. Compared with the prior art, the IPSec tunnel management method, the zero-trust gateway, the client gateway, the electronic equipment, the computer readable storage medium and the computer program product provided by the embodiment of the invention have the advantage that the security of the IPSec tunnel communication process can be improved.

Description

Technical Field

[0001] The present invention relates to the field of communications, and in particular to an IPSec tunnel management method, a zero-trust gateway, a client gateway, an electronic device, a computer-readable storage medium, and a computer program product. Background Art

[0002] Zero Trust is a network security design framework, and its core idea is "do not trust any form of data, always verify". The assumption of the zero trust model is that both internal and external networks may be threatened, so all data requests need to be authenticated and authorized. The implementation based on the zero trust framework generally consists of the following five parts: multi-factor authentication (MFA), identity and access management (IAM), network segmentation and micro-segmentation, encryption and data protection, and continuous monitoring and analysis.

[0003] IPsec (Internet Protocol Security) is a set of protocols and services used to provide data security in network communications. It works at the Internet Protocol (IP) layer and can ensure the confidentiality, integrity, and authenticity of data. IPsec is often used to establish a virtual private network (VPN) to protect sensitive data transmitted over public networks.

[0004] Zero Trust Architecture requires that all access requests, whether from inside or outside, always need to be authenticated and follow the principle of least privilege. By combining IPSec VPN, the system can encrypt and authenticate the establishment and data transmission of each tunnel, ensuring that only authenticated users and devices can access the protected subnet.

[0005] However, in the related technology, a zero-trust gateway is usually introduced to perform security management on the IPSec tunnel only after the IPSec tunnel is built. The control over the security risks generated during the construction of the IPSec tunnel is low, which affects the security of the IPSec tunnel communication process. Summary of the invention

[0006] The object of the present invention is to provide an IPSec tunnel management method, a zero-trust gateway, a client gateway, an electronic device, a computer-readable storage medium and a computer program product, which can improve the security of the IPSec tunnel communication process.

[0007] In a first aspect, an embodiment of the present application provides an IPSec tunnel management method, which is applied to a zero-trust gateway. The IPSec tunnel management method includes: receiving IPSec tunnel request information sent by a first client gateway, the IPSec tunnel request information includes at least a first gateway address of the first client gateway, a second gateway address of the second client gateway, and a negotiation form; when the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, generating IPSec tunnel configuration information based on the IPSec tunnel request information, the IPSec tunnel configuration information includes at least an IPSec tunnel encryption algorithm and a key exchange protocol, and sending the IPSec tunnel configuration information to the first client gateway and the second client gateway to build an IPSec tunnel.

[0008] Compared with the related art, in the IPSec tunnel management method provided in the embodiment of the present application, when the first client gateway wants to build an IPSec tunnel with the second client gateway, it first sends the first gateway address of the first client gateway, the second gateway address of the second client gateway, and the negotiation form to the zero-trust gateway in the form of IPSec tunnel request information. After receiving the IPSec tunnel request information, the zero-trust gateway determines whether the first client gateway and the second client gateway have completed identity authentication based on the concept of zero trust. When the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, the zero-trust gateway generates IPSec tunnel configuration information corresponding to the first client gateway and the second client gateway based on the IPSec tunnel request information. The IPSec tunnel configuration information includes an IPSec tunnel encryption algorithm and a key exchange protocol applicable to the negotiation form between the first client gateway and the second client gateway. Subsequently, the first client gateway and the second client gateway An IPSec tunnel can be constructed based on the IPSec tunnel encryption algorithm and the key exchange protocol. The IPSec tunnel encryption algorithm and the key exchange protocol used for constructing the IPSec tunnel between the first client gateway and the second client are generated by the zero-trust gateway. Therefore, compared with the related technology in which the encryption algorithm and the key are directly communicated between the first client gateway and the second client gateway based on risk communication, the possibility of leakage of the IPSec tunnel encryption algorithm and the key exchange protocol during the communication and storage process can be reduced, thereby improving the communication security of the IPSec tunnel and reducing the network bandwidth occupied by the communication between the first client gateway and the second client gateway. In addition, the zero-trust gateway generates IPSec tunnel configuration information based on the IPSec tunnel request information only when the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, that is, the first client gateway and the second client gateway that construct the IPSec tunnel have both been authenticated, thereby further improving the communication security of the IPSec tunnel.

[0009] In an optional embodiment, the IPSec tunnel management method further includes: receiving an identity authentication request sent by a client gateway, the identity authentication request at least including protection subnet information of the client gateway, and authenticating the client gateway based on the identity authentication request, the client gateway being the first client gateway or the second client gateway. Authenticating the protection subnet information of the client gateway can improve the security of the client gateway's protection subnet communication.

[0010] In an optional embodiment, the IPSec tunnel management method further includes: obtaining data packets transmitted in the IPSec tunnel, verifying whether the IPSec tunnel is in a secure communication state according to the data packets; and closing the IPSec tunnel when the IPSec tunnel is not in the secure communication state. After the IPSec tunnel is constructed, in the process of communicating based on the IPSec tunnel, the zero-trust gateway obtains the data packets transmitted in the IPSec tunnel in real time, verifies whether the current IPSec tunnel is in a secure communication state according to the data packets transmitted in the IPSec tunnel, and closes the IPSec tunnel when the IPSec tunnel is not in a secure communication state, thereby maintaining the detection of the communication security of the IPSec tunnel during the real-time communication process of the IPSec tunnel, and only communicates when the IPSec tunnel is in a secure communication state, thereby improving the security of the communication process; in addition, since the IPSec tunnel configuration information used to construct the IPSec tunnel is generated by the zero-trust gateway, the accuracy and completeness of the data packets in the IPSec tunnel obtained by the zero-trust gateway can also be improved, and more accurate and complete data packets can make the reliability of the verification structure of whether the current IPSec tunnel is in a secure communication state higher, further improving the security of the communication process, and reducing the frequent closure of the IPSec tunnel due to misjudgment.

[0011] In an optional embodiment, the verification of whether the IPSec tunnel is in a secure communication state according to the data message includes: obtaining user information of the data message, the user information at least including the authorized access behavior of the user; obtaining the Next Header field of the AH packet in the data message, and verifying whether the access behavior of the data message belongs to the authorized access behavior according to the Next Header field; if the access behavior of the data message belongs to the authorized access behavior, it is determined that the IPSec tunnel is in the secure communication state, and if the access behavior of the data message does not belong to the authorized access behavior, it is determined that the IPSec tunnel is not in the secure communication state. When the IPSec tunnel is in a secure communication state, each user can only access the target website that he is authorized to access. By judging whether the actual access behavior of the data message is the authorized access behavior that the corresponding user has been authorized to access, if the access behavior of the data message does not belong to the authorized access behavior, it means that the corresponding user is making illegal access, destroying the security of the communication process of the IPSec tunnel, and determining that the IPSec tunnel is not in a secure communication state.

[0012] In an optional embodiment, the verification of whether the IPSec tunnel is in a secure communication state according to the data message includes: obtaining whether the security parameter index and / or sequence number of the ESP packet in the data message is updated according to the update rule configured by the zero-trust gateway; if the security parameter index and / or the sequence number are updated according to the update rule, it is determined that the IPSec tunnel is in the secure communication state; if the security parameter index and / or the sequence number are not updated according to the update rule, it is determined that the IPSec tunnel is not in the secure communication state. As the communication proceeds, the security parameter index and / or sequence number of the data message needs to be updated according to the update rule configured by the zero-trust gateway. If the security parameter index and / or sequence number in the data message is not updated according to the update rule configured by the zero-trust gateway, it means that the communication text that generates the data message has not been subject to the security inspection of the zero-trust gateway, and there is data message transmission in the IPSec tunnel that has not been subject to the security inspection of the zero-trust gateway, which destroys the security of the communication process of the IPSec tunnel, and it is determined that the IPSec tunnel is not in a secure communication state.

[0013] In a second aspect, an embodiment of the present application provides an IPSec tunnel management method, which is applied to a client gateway. The IPSec tunnel management method includes: sending IPSec tunnel request information to a zero-trust gateway, the IPSec tunnel request information includes at least a first gateway address of the client gateway, a second gateway address of a target client gateway, and a negotiation form, the first gateway address is used by the zero-trust gateway to determine whether the client gateway is a client gateway after identity authentication via the zero-trust gateway, and the second gateway address is used by the zero-trust gateway to determine whether the target client gateway is a client gateway after identity authentication via the zero-trust gateway; receiving IPSec tunnel configuration information sent by the zero-trust gateway and generated based on the IPSec tunnel request information, the IPSec tunnel configuration information includes at least an IPSec tunnel encryption algorithm and a key exchange protocol; generating a key according to the IPSec tunnel encryption algorithm and exchanging the key with the target client gateway according to the key exchange protocol to build an IPSec tunnel between the client gateway and the target client gateway.

[0014] Compared with the related art, in the IPSec tunnel management method provided in the embodiment of the present application, before each client gateway wants to build an IPSec tunnel with the target client gateway for data communication, it first sends IPSec tunnel request information to the zero-trust gateway. Since the IPSec tunnel request information includes at least the first gateway address of the client gateway and the second gateway address of the target client gateway, the zero-trust gateway can confirm the identity of the client gateway and the target client gateway according to the first gateway address and the second gateway address, and determine whether the client gateway and the corresponding target client gateway are client gateways that have been authenticated by the zero-trust gateway. Identity verification is performed through the zero-trust gateway before the IPSec tunnel is built, which can improve the security of the IPSec tunnel. In addition, the IPSec tunnel between the client gateway and the target client gateway is built based on the IPSec tunnel configuration information sent by the zero-trust gateway and generated by the IPSec tunnel request information, which can also enable the zero-trust gateway to have a higher degree of understanding of the relevant parameters of the built IPSec tunnel, so that the subsequent zero-trust gateway can monitor the communication security of the IPSec tunnel.

[0015] In an optional embodiment, before sending the IPSec tunnel request information to the zero-trust gateway, the IPSec tunnel management method further includes: sending an identity authentication request to the zero-trust gateway, the identity authentication request at least including the protection subnet information of the client gateway, the identity authentication request is used by the zero-trust gateway to authenticate the client gateway; after the zero-trust gateway authenticates the legality of the client gateway identity, the IPSec tunnel request information is sent to the zero-trust gateway. Sending the protection subnet information of the client gateway to the IPSec tunnel for identity authentication before building the IPSec tunnel can improve the security of the client gateway's protection subnet communication.

[0016] In an optional embodiment, the IPSec tunnel management method also includes: receiving a user identity authentication request sent by a client, and sending an authorized access behavior corresponding to the user identity to the client after the user identity authentication is legal; obtaining the data packet transmitted in the IPSec tunnel, and sending the data packet to the zero trust gateway, the zero trust gateway verifying whether the IPSec tunnel is in a secure communication state based on the data packet, and closing the IPSec tunnel when the IPSec tunnel is not in the secure communication state. Before the user accesses data through the client gateway, since the client gateway has been authenticated by the zero-trust gateway, the client gateway can directly authenticate the user identity after receiving the user authentication request sent by the client. There is no need for the zero-trust gateway to authenticate the user identity information, thereby simplifying the user authentication process. In addition, the data packet being transmitted is obtained in the IPSec tunnel and sent to the zero-trust gateway. The zero-trust gateway verifies whether the IPSec tunnel is in a secure communication state based on the data packet, and closes the IPSec tunnel when it is not in a secure communication state, thereby maintaining the communication security of the IPSec tunnel during the real-time communication process of the IPSec tunnel, and only communicates when the IPSec tunnel is in a secure communication state, thereby improving the security of the communication process.

[0017] In the third aspect, an embodiment of the present application provides a zero-trust gateway, including: a communication module, the communication module is used to receive IPSec tunnel request information sent by a first client gateway, the IPSec tunnel request information includes at least a first gateway address of the first client gateway, a second gateway address of the second client gateway, and a negotiation form; a policy execution module, the policy execution module is used to generate IPSec tunnel configuration information based on the IPSec tunnel request information when the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, the IPSec tunnel configuration information includes at least an IPSec tunnel encryption algorithm and a key exchange protocol; the communication module is also used to send the IPSec tunnel configuration information to the first client gateway and the second client gateway to build an IPSec tunnel.

[0018] Compared with the related art, in the zero-trust gateway provided in the embodiment of the present application, when the first client gateway wants to build an IPSec tunnel with the second client gateway, it first sends the first gateway address of the first client gateway, the second gateway address of the second client gateway and the negotiation form to the zero-trust gateway in the form of IPSec tunnel request information. After receiving the IPSec tunnel request information, the communication module of the zero-trust gateway determines whether the first client gateway and the second client gateway have completed identity authentication based on the concept of zero trust. When the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, the communication module of the zero-trust gateway generates IPSec tunnel configuration information corresponding to the first client gateway and the second client gateway based on the IPSec tunnel request information. The IPSec tunnel configuration information includes an IPSec tunnel encryption algorithm applicable to the negotiation form between the first client gateway and the second client gateway. The zero-trust gateway can then generate a zero-trust key based on the IPSec tunnel encryption algorithm and key exchange protocol. The IPSec tunnel encryption algorithm and key exchange protocol used for the first client gateway and the second client to build the IPSec tunnel are generated by the zero-trust gateway. Therefore, compared with the related art in which the first client gateway and the second client gateway directly communicate the encryption algorithm and key based on risk communication, the possibility of leakage of the IPSec tunnel encryption algorithm and key exchange protocol can be reduced, thereby improving the communication security of the IPSec tunnel. In addition, the zero-trust gateway generates the IPSec tunnel configuration information based on the IPSec tunnel request information only when the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, that is, the first client gateway and the second client gateway that build the IPSec tunnel have both been authenticated, thereby further improving the communication security of the IPSec tunnel.

[0019] In a fourth aspect, an embodiment of the present application provides a client gateway, comprising: a communication module, the communication module being used to send IPSec tunnel request information to a zero-trust gateway, the IPSec tunnel request information comprising at least a first gateway address of the client gateway, a second gateway address of a target client gateway, and a negotiation form; the communication module being also used to receive IPSec tunnel configuration information sent by the zero-trust gateway and generated based on the IPSec tunnel request information, the IPSec tunnel configuration information comprising at least an IPSec tunnel encryption algorithm and a key exchange protocol; a tunnel construction module, the tunnel construction module being used to generate a key according to the IPSec tunnel encryption algorithm and to exchange a key with the target client gateway according to the key exchange protocol, so as to construct an IPSec tunnel between the client gateway and the target client gateway.

[0020] Compared with the related art, in the client gateway provided in the embodiment of the present application, before each client gateway wants to build an IPSec tunnel with the target client gateway for data communication, it first sends IPSec tunnel request information to the zero-trust gateway via the communication module. Since the IPSec tunnel request information includes at least the first gateway address of the client gateway and the second gateway address of the target client gateway, the zero-trust gateway can confirm the identity of the client gateway and the target client gateway according to the first gateway address and the second gateway address, and determine whether the client gateway and the corresponding target client gateway are client gateways that have been authenticated by the zero-trust gateway. Identity verification is performed through the zero-trust gateway before the IPSec tunnel is built, which can improve the security of the IPSec tunnel; in addition, the tunnel construction module builds the IPSec tunnel between the client gateway and the target client gateway based on the IPSec tunnel configuration information sent by the zero-trust gateway and generated by the IPSec tunnel request information, and can also enable the zero-trust gateway to have a higher degree of understanding of the relevant parameters of the constructed IPSec tunnel, so as to facilitate the subsequent zero-trust gateway to monitor the communication security of the IPSec tunnel.

[0021] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the IPSec tunnel management method as described above.

[0022] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program, wherein the computer program is executed by a processor to implement the IPSec tunnel management method as described above.

[0023] In a seventh aspect, an embodiment of the present application provides a computer program product, which, when running on a computer, enables the computer to execute the IPSec tunnel management method as described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can also be obtained based on these drawings.

[0025] Figure 1 A flowchart of the IPSec tunnel management method provided in Example 1 of the present application;

[0026] Figure 2 A schematic diagram of a process of authenticating the first client gateway and the second client gateway in the IPSec tunnel management method provided in the first embodiment of the present application;

[0027] Figure 3 A flowchart of the IPSec tunnel management method provided in the second embodiment of the present application;

[0028] Figure 4 A schematic diagram of a process for verifying whether an IPSec tunnel is in a secure communication state in an IPSec tunnel management method provided in an embodiment of the present application;

[0029] Figure 5 A schematic diagram of a flow chart of verifying whether an IPSec tunnel is in a secure communication state in an IPSec tunnel management method provided in another embodiment of the present application;

[0030] Figure 6 A flowchart of the IPSec tunnel management method provided in Embodiment 3 of the present application;

[0031] Figure 7 A flowchart of the IPSec tunnel management method provided in the fourth embodiment of the present application;

[0032] Figure 8 A flowchart of the IPSec tunnel management method provided in Embodiment 5 of the present application;

[0033] Fig. 9 A schematic diagram of the structure of the zero-trust gateway provided in Example 6 of the present application;

[0034] Fig.10 A schematic diagram of the structure of the client gateway provided in Embodiment 7 of the present application;

[0035] Fig.11 This is a schematic diagram of the structure of the electronic device provided in Example 8 of the present application. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0037] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed but is merely representative of selected embodiments of the present invention.

[0038] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0039] In addition, the terms “first”, “second”, etc., if used, are merely used to distinguish between the descriptions and should not be understood as indicating or implying relative importance.

[0040] It should be noted that, in the absence of conflict, the features in the embodiments of the present invention may be combined with each other.

[0041] Embodiment 1

[0042] Embodiment 1 of the present invention provides an IPSec tunnel management method, which is applied to a zero-trust gateway. The so-called zero-trust gateway is a gateway built based on the zero-trust concept. The zero-trust concept is a network security protection concept. Its key lies in breaking the default "trust", that is, "continuous verification, never trust". By default, no one, device, or system inside or outside the enterprise network is trusted. The trust foundation of access control is rebuilt based on identity authentication and authorization, thereby ensuring that identities, devices, applications, and links are trusted. On this basis, Figure 1 As shown, the IPSec tunnel management method provided in this embodiment includes:

[0043] Step S101: receiving IPSec tunnel request information sent by a first client gateway, where the IPSec tunnel request information at least includes a first gateway address of the first client gateway, a second gateway address of the second client gateway, and a negotiation form.

[0044] In this step, the client gateway is a gateway device used to communicate with the user device. When the client running on the user device needs to access the network or communicate with the user, the actual communication object is the client gateway, and the client gateway seeks network access and communication from the network server or other user devices connected to the network.

[0045] Among them, the first client gateway and the second client gateway are two client gateways that want to establish an IPSec tunnel, that is, before the first client gateway wants to establish an IPSec tunnel with the second client gateway, it first sends IPSec tunnel request information to the zero trust gateway, and the zero trust gateway reviews the IPSec tunnel.

[0046] In this step, the negotiation form between the first client gateway and the second client gateway includes a series of gateway protocols, which are specifically gateway protocols supported by the first client gateway and the second client gateway, including internal gateway protocols and external gateway protocols. Among them, the internal gateway protocol is the gateway protocol between each subnet inside the first client gateway or the second client gateway, and the external gateway protocol is the gateway protocol for direct communication between the first client gateway and the second client gateway.

[0047] Step S102: When the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, IPSec tunnel configuration information is generated based on the IPSec tunnel request information, and the IPSec tunnel configuration information includes at least an IPSec tunnel encryption algorithm and a key exchange protocol.

[0048] In this step, after receiving the IPSec tunnel request information, the zero-trust gateway determines whether the first client gateway and the second client gateway are client gateways that have been authenticated by the zero-trust gateway based on the first gateway address of the first client gateway and the second gateway address of the second client gateway in the IPSec tunnel request information, that is, whether the first client gateway and the second client gateway have been authenticated before receiving the IPSec tunnel request information, and whether the authentication of the first client gateway and the second client gateway has passed. If the first client gateway and the second client gateway have been authenticated before receiving the IPSec tunnel request information, and the authentication of the first client gateway and the second client gateway have all passed, then the IPSec tunnel configuration information is generated based on the IPSec tunnel request information.

[0049] Among them, Figure 2 As shown, performing identity authentication on the first client gateway and the second client gateway before receiving the IPSec tunnel request information may specifically include:

[0050] Step S201: receiving an identity authentication request sent by a client gateway, where the identity authentication request at least includes protection subnet information of the client gateway.

[0051] In this step, the protection subnet information of the client gateway may specifically include the website address of each protection subnet, the server device identifier corresponding to the protection subnet, and other information.

[0052] Step S202: authenticating the client gateway based on the identity authentication request, where the client gateway is the first client gateway or the second client gateway.

[0053] In this step, the client gateway can be authenticated based on the protection subnet information of the client gateway. Specifically, for example, the security of each protection subnet can be checked based on the URL of each protection subnet of the client gateway, the server device identification corresponding to the protection subnet, and other information. For example, it can be checked whether there are Trojan scripts, crawler scripts, and other scripts that endanger communication security in each protection subnet. For client gateways without security risks, the zero-trust gateway can mark the client gateway, and in step S102, it can be determined based on the mark whether the first client gateway and the second client gateway have been authenticated before receiving the IPSec tunnel request information, and whether the authentication of the first client gateway and the second client gateway has passed.

[0054] Performing identity authentication on the protection subnet information of the client gateway before building the IPSec tunnel can improve the security of the protection subnet communication of the client gateway.

[0055] Furthermore, in this step, generating IPSec tunnel configuration information based on IPSec tunnel request information can specifically be based on a policy protocol preset in the zero-trust gateway, and determining the IPSec tunnel encryption algorithm and key exchange protocol according to the negotiation form between the first client gateway and the second client gateway. The policy protocol is a program pre-set in the zero-trust gateway for generating IPSec tunnel encryption algorithms and key exchange protocols, which can generate corresponding IPSec tunnel encryption algorithms and key exchange protocols according to different negotiation forms and their corresponding different confidentiality requirements. For negotiation forms with higher confidentiality requirements, the generated IPSec tunnel encryption algorithm is more complex; conversely, for negotiation forms with lower confidentiality requirements, the generated IPSec tunnel encryption algorithm is simpler.

[0056] Step S103: Send the IPSec tunnel configuration information to the first client gateway and the second client gateway to build an IPSec tunnel.

[0057] In this step, the generated IPSec tunnel configuration information can be sent to the first client gateway and the second client gateway respectively based on the first gateway address of the first client gateway and the second gateway address of the second client gateway in the IPSec tunnel request information. After the first client gateway and the second client gateway receive the IPSec tunnel configuration information, they can build an IPSec tunnel based on the IPSec tunnel configuration information for tunnel communication.

[0058] Compared with the related art, in the IPSec tunnel management method provided in the embodiment of the present application, when the first client gateway wants to build an IPSec tunnel with the second client gateway, it first sends the first gateway address of the first client gateway, the second gateway address of the second client gateway, and the negotiation form to the zero-trust gateway in the form of IPSec tunnel request information. After receiving the IPSec tunnel request information, the zero-trust gateway determines whether the first client gateway and the second client gateway have completed identity authentication based on the concept of zero trust. When the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, the zero-trust gateway generates IPSec tunnel configuration information corresponding to the first client gateway and the second client gateway based on the IPSec tunnel request information. The IPSec tunnel configuration information includes an IPSec tunnel encryption algorithm and a key exchange algorithm applicable to the negotiation form between the first client gateway and the second client gateway. After the protocol is changed, the first client gateway and the second client gateway can subsequently build an IPSec tunnel based on the IPSec tunnel encryption algorithm and the key exchange protocol. The IPSec tunnel encryption algorithm and the key exchange protocol used for the first client gateway and the second client to build the IPSec tunnel are generated by the zero-trust gateway. Therefore, compared with the related technology in which the encryption algorithm and the key are directly communicated between the first client gateway and the second client gateway based on risk communication, the possibility of leakage of the IPSec tunnel encryption algorithm and the key exchange protocol can be reduced, and the communication security of the IPSec tunnel can be improved. In addition, the zero-trust gateway generates IPSec tunnel configuration information based on the IPSec tunnel request information only when the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, that is, the first client gateway and the second client gateway that build the IPSec tunnel have both been authenticated, thereby further improving the communication security of the IPSec tunnel.

[0059] Embodiment 2

[0060] Embodiment 2 of the present application provides an IPSec tunnel management method, which is substantially the same as the IPSec tunnel management method provided in Embodiment 1, and also includes steps S101 to S103, except that: Figure 3 As shown, in the IPSec tunnel management method provided in the second embodiment, after the first client gateway and the second client gateway establish an IPSec tunnel, the process of performing tunnel communication also includes:

[0061] Step S104: Acquire the data message transmitted in the IPSec tunnel, and verify whether the IPSec tunnel is in a secure communication state according to the data message.

[0062] In this step, the data message is a data packet transmitted in the IPSec tunnel. After the first client gateway and the second client gateway establish the IPSec tunnel, they can transmit data messages in the IPSec tunnel to achieve communication between the first client gateway and the second client gateway.

[0063] In different embodiments of the present application, based on different forms of data packets, different methods can be used to verify whether the IPSec tunnel is in a secure communication state according to the data packets.

[0064] For example Figure 4 As shown, verifying whether the IPSec tunnel is in a secure communication state according to the data message may specifically include:

[0065] Step S301: obtaining user information of a transmission data message, where the user information at least includes the user's authorized access behavior.

[0066] In this step, the communication between the first client gateway and the second client gateway is actually the communication between the user clients connected to the first client gateway and the second client gateway. The data packets transmitted in the IPSec tunnel between the first client gateway and the second client gateway are actually data packets corresponding to each user client, which encapsulates the user identifier corresponding to the data packet. The zero-trust gateway can obtain the authorized access behavior corresponding to the user representation according to the user identifier. The authorized access behavior is the data network access behavior that the user is allowed to perform, for example, the website that the user is allowed to access, other communication terminals that the user is allowed to communicate, etc.

[0067] Step S302: Obtain the Next Header field of the AH packet in the data message, and verify whether the access behavior of the data message is an authorized access behavior according to the Next Header field. If so, execute step S303; if not, execute step S304.

[0068] In this step, the Next Header field of the AH packet of the data packet includes the actual access behavior of the data message, such as the website actually accessed by the data message or the communication terminal actually corresponding to the data message, etc. By comparing the authorized access behavior of the user corresponding to the data message obtained in step S301 with the actual access behavior of the data message, it can be determined whether the data message is an unauthorized access. If the data message is an unauthorized access, it means that there is an unauthorized risk access in the IPSec tunnel, and step S304 is executed at this time, otherwise, step S303 is executed.

[0069] Step S303: Determine whether the IPSec tunnel is in a secure communication state.

[0070] Step S304: Determine that the IPSec tunnel is not in a secure communication state.

[0071] When the IPSec tunnel is in a secure communication state, each user can only access the target website that he is authorized to access. By judging whether the actual access behavior of the data message is the authorized access behavior that the corresponding user has been authorized to access, if the access behavior of the data message does not belong to the authorized access behavior, it means that the corresponding user is making illegal access, which destroys the security of the communication process of the IPSec tunnel, and determines that the IPSec tunnel is not in a secure communication state.

[0072] or for example Figure 5 As shown, verifying whether the IPSec tunnel is in a secure communication state according to the data message may specifically include:

[0073] Step S401: Obtain whether the security parameter index and / or serial number of the ESP packet in the data message is updated according to the update rule configured by the zero-trust gateway. If so, execute step S402; if not, execute step S403.

[0074] In this step, the zero-trust gateway is configured with update rules corresponding to the security parameter index and / or serial number of the data message. As the first client gateway and the second client gateway communicate in the IPSec tunnel, the security parameter index and / or serial number of the transmitted data message needs to be updated based on the update rule. If there is a data message that is not updated in time according to the update rule, it means that the data message is a violation message. Based on the communication behavior risk behavior of the data message, the existence of risk behavior means that the communication security of the current IPSec tunnel is low and the IPSec tunnel is not in a secure communication state. At this time, step S403 is executed, otherwise step S402 is executed.

[0075] Step S402: Determine whether the IPSec tunnel is in a secure communication state.

[0076] Step S403: Determine that the IPSec tunnel is not in a secure communication state.

[0077] As communication proceeds, the security parameter index and / or serial number of the data message needs to be updated according to the update rules configured by the zero-trust gateway. If the security parameter index and / or serial number in the data message is not updated according to the update rules configured by the zero-trust gateway, it means that the communication text that generated the data message has not been subject to the security check of the zero-trust gateway. There is data message transmission in the IPSec tunnel that has not been subject to the security check of the zero-trust gateway, which destroys the security of the communication process of the IPSec tunnel and determines that the IPSec tunnel is not in a secure communication state.

[0078] Step S105: When the IPSec tunnel is not in a secure communication state, close the IPSec tunnel.

[0079] Compared with the related art, in the IPSec tunnel management method provided in the second embodiment of the present application, after the IPSec tunnel is constructed, during the communication based on the IPSec tunnel, the zero-trust gateway obtains the data packets transmitted in the IPSec tunnel in real time, and verifies whether the current IPSec tunnel is in a secure communication state based on the data packets transmitted in the IPSec tunnel, and closes the IPSec tunnel when the IPSec tunnel is not in a secure communication state, thereby maintaining the detection of the communication security of the IPSec tunnel during the real-time communication of the IPSec tunnel, and only communicates when the IPSec tunnel is in a secure communication state, thereby improving the security of the communication process; in addition, since the IPSec tunnel configuration information used to construct the IPSec tunnel is generated by the zero-trust gateway, the accuracy and completeness of the data packets in the IPSec tunnel obtained by the zero-trust gateway can also be improved. More accurate and complete data packets can make the reliability of the verification structure of whether the current IPSec tunnel is in a secure communication state higher, further improving the security of the communication process, and can also reduce the situation where the IPSec tunnel is frequently closed due to misjudgment.

[0080] Embodiment 3

[0081] Embodiment 3 of the present application provides an IPSec tunnel management method, which is applied to a client gateway, such as Figure 6 As shown, including:

[0082] Step S501: Send IPSec tunnel request information to the zero-trust gateway, where the IPSec tunnel request information includes at least the first gateway address of the client gateway, the second gateway address of the target client gateway, and the negotiation form.

[0083] In this step, the IPSec tunnel request information sent to the zero-trust gateway is the IPSec tunnel request information received by the zero-trust gateway in the aforementioned embodiment. For details, please refer to the specific description in the aforementioned embodiment.

[0084] Step S502: Receive IPSec tunnel configuration information sent by the zero-trust gateway and generated based on the IPSec tunnel request information, where the IPSec tunnel configuration information at least includes an IPSec tunnel encryption algorithm and a key exchange protocol.

[0085] In this step, the received IPSec tunnel configuration information is the IPSec tunnel configuration information issued by the zero-trust gateway in the aforementioned embodiment. For details, please refer to the specific instructions in the aforementioned embodiment.

[0086] Step S503: Generate a key according to the IPSec tunnel encryption algorithm and exchange the key with the target client gateway according to the key exchange protocol to build an IPSec tunnel between the client gateway and the target client gateway.

[0087] It can be understood that the IPSec tunnel management method provided in the third embodiment is an IPSec tunnel management method applied to the client gateway corresponding to the IPSec tunnel management method applied to the zero-trust gateway provided in the aforementioned embodiment, that is, the IPSec tunnel management method provided in the embodiment of the present application involves mutual communication between the zero-trust gateway and the client gateway. The IPSec tunnel management method provided in the third embodiment and applied to the client gateway and the IPSec tunnel management method provided in the aforementioned embodiment and applied to the zero-trust gateway can be implemented in coordination with each other to jointly realize the construction of the IPSec tunnel.

[0088] Compared with the related art, in the IPSec tunnel management method provided in the third embodiment of the present application, before each client gateway wants to build an IPSec tunnel with the target client gateway for data communication, it first sends IPSec tunnel request information to the zero-trust gateway. Since the IPSec tunnel request information includes at least the first gateway address of the client gateway and the second gateway address of the target client gateway, the zero-trust gateway can confirm the identity of the client gateway and the target client gateway according to the first gateway address and the second gateway address, and determine whether the client gateway and the corresponding target client gateway are client gateways that have been authenticated by the zero-trust gateway. Identity verification is performed through the zero-trust gateway before the IPSec tunnel is built, which can improve the security of the IPSec tunnel. In addition, the IPSec tunnel between the client gateway and the target client gateway is built based on the IPSec tunnel configuration information sent by the zero-trust gateway and generated by the IPSec tunnel request information, which can also enable the zero-trust gateway to have a higher degree of understanding of the relevant parameters of the built IPSec tunnel, so that the subsequent zero-trust gateway can monitor the communication security of the IPSec tunnel.

[0089] Embodiment 4

[0090] Embodiment 4 of the present application provides an IPSec tunnel management method, which is applied to a client gateway, such as Figure 7 As shown, including:

[0091] Step S601: Send an identity authentication request to the zero-trust gateway, where the identity authentication request includes at least the protection subnet information of the client gateway. After the zero-trust gateway authenticates the legality of the client gateway identity, execute step S602.

[0092] In this step, the identity authentication request sent to the zero trust gateway is the identity authentication request received by the zero trust gateway in the aforementioned embodiment applied to the zero trust gateway. For details, please refer to the specific instructions in the aforementioned embodiment.

[0093] Step S602: Send IPSec tunnel request information to the zero-trust gateway, where the IPSec tunnel request information includes at least the first gateway address of the client gateway, the second gateway address of the target client gateway, and the negotiation form.

[0094] Step S603: Receive IPSec tunnel configuration information sent by the zero-trust gateway and generated based on the IPSec tunnel request information, where the IPSec tunnel configuration information at least includes an IPSec tunnel encryption algorithm and a key exchange protocol.

[0095] Step S604: Generate a key according to the IPSec tunnel encryption algorithm and exchange the key with the target client gateway according to the key exchange protocol to build an IPSec tunnel between the client gateway and the target client gateway.

[0096] Compared with the related art, in the IPSec tunnel management method provided in the fourth embodiment of the present application, the protection subnet information of the client gateway is sent to the IPSec tunnel for identity authentication before building the IPSec tunnel, which can improve the security of the protection subnet communication of the client gateway.

[0097] Embodiment 5

[0098] Embodiment 5 of the present application provides an IPSec tunnel management method, which is applied to a client gateway, such as Figure 8 As shown, including:

[0099] Step S701: Send an identity authentication request to the zero-trust gateway, where the identity authentication request includes at least the protection subnet information of the client gateway. After the zero-trust gateway authenticates the legality of the client gateway identity, execute step S702.

[0100] In this step, the identity authentication request sent to the zero trust gateway is the identity authentication request received by the zero trust gateway in the aforementioned embodiment applied to the zero trust gateway. For details, please refer to the specific instructions in the aforementioned embodiment.

[0101] Step S702: Send IPSec tunnel request information to the zero-trust gateway, where the IPSec tunnel request information includes at least the first gateway address of the client gateway, the second gateway address of the target client gateway, and the negotiation form.

[0102] Step S703: Receive IPSec tunnel configuration information sent by the zero-trust gateway and generated based on the IPSec tunnel request information, where the IPSec tunnel configuration information at least includes an IPSec tunnel encryption algorithm and a key exchange protocol.

[0103] Step S704: Generate a key according to the IPSec tunnel encryption algorithm and exchange the key with the target client gateway according to the key exchange protocol to build an IPSec tunnel between the client gateway and the target client gateway.

[0104] Step S705: receiving a user identity authentication request sent by the client, and sending an authorized access behavior corresponding to the user identity to the client after the user identity authentication is legal.

[0105] In this step, the client running on the user device can send a user identity authentication request to the client gateway to request the client gateway to authenticate the user. Specifically, relevant information of the user such as the user account identifier and the device identifier of the user device can be sent to the client gateway. The client gateway marks and authorizes the access behavior allowed by the user based on the relevant information of the user such as the user account identifier and the device identifier of the user device, and feeds back the mark and authorization result as the authorized access behavior corresponding to the user identity to the client to realize the authorization of the user.

[0106] Step S706: Obtain the data message transmitted in the IPSec tunnel, and send the data message to the zero-trust gateway. The zero-trust gateway verifies whether the IPSec tunnel is in a secure communication state based on the data message, and closes the IPSec tunnel if the IPSec tunnel is not in a secure communication state.

[0107] In this step, the data message sent to the zero-trust gateway is the data message in the IPSec tunnel obtained by the zero-trust gateway in the aforementioned embodiment. On this basis, the zero-trust gateway verifies whether the IPSec tunnel is in a secure communication state based on the data message. For details, please refer to the specific instructions in the aforementioned embodiment.

[0108] Compared with the related art, in the IPSec tunnel management method provided in Example 5 of the present application, before the user accesses data via the client gateway, since the client gateway has been authenticated by the zero-trust gateway, the client gateway can directly authenticate the user identity after receiving the user authentication request sent by the client, without the need for the zero-trust gateway to authenticate the user identity information, thereby simplifying the user authentication process; in addition, the data packet being transmitted is obtained in the IPSec tunnel, and the data packet is sent to the zero-trust gateway, and the zero-trust gateway verifies whether the IPSec tunnel is in a secure communication state based on the data packet, and closes the IPSec tunnel when the IPSec tunnel is not in a secure communication state, thereby maintaining the communication security of the IPSec tunnel during the real-time communication process of the IPSec tunnel, and only communicates when the IPSec tunnel is in a secure communication state, thereby improving the security of the communication process.

[0109] Embodiment 6

[0110] Embodiment 6 of the present application provides a zero-trust gateway, such as Fig. 9 As shown, it includes: a first communication module 101, the first communication module 101 is used to receive IPSec tunnel request information sent by the first client gateway, the IPSec tunnel request information at least includes the first gateway address of the first client gateway, the second gateway address of the second client gateway and the negotiation form; a policy execution module 102, the policy execution module 102 is used to generate IPSec tunnel configuration information based on the IPSec tunnel request information when both the first client gateway and the second client gateway are client gateways that have been authenticated by the zero trust gateway, the IPSec tunnel configuration information at least includes the IPSec tunnel encryption algorithm and the key exchange protocol; the communication module is also used to send the IPSec tunnel configuration information to the first client gateway and the second client gateway to build an IPSec tunnel.

[0111] Compared with the related art, in the zero-trust gateway provided in the sixth embodiment of the present application, when the first client gateway wants to build an IPSec tunnel with the second client gateway, it first sends the first gateway address of the first client gateway, the second gateway address of the second client gateway, and the negotiation form to the zero-trust gateway in the form of IPSec tunnel request information. After receiving the IPSec tunnel request information, the first communication module 101 of the zero-trust gateway determines whether the first client gateway and the second client gateway have completed identity authentication based on the concept of zero trust. When the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, the communication module of the zero-trust gateway generates IPSec tunnel configuration information corresponding to the first client gateway and the second client gateway based on the IPSec tunnel request information. The IPSec tunnel configuration information includes the IPSec tunnel configuration information applicable to the negotiated form between the first client gateway and the second client gateway. The zero-trust gateway generates an encryption algorithm and a key exchange protocol, and then the first client gateway and the second client gateway can build an IPSec tunnel based on the IPSec tunnel encryption algorithm and the key exchange protocol. The IPSec tunnel encryption algorithm and the key exchange protocol used for the first client gateway and the second client to build the IPSec tunnel are generated by the zero-trust gateway. Therefore, compared with the related art in which the encryption algorithm and the key are directly communicated between the first client gateway and the second client gateway based on risk communication, the possibility of leakage of the IPSec tunnel encryption algorithm and the key exchange protocol can be reduced, and the communication security of the IPSec tunnel can be improved. In addition, the zero-trust gateway generates the IPSec tunnel configuration information based on the IPSec tunnel request information only when the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, that is, the first client gateway and the second client gateway that build the IPSec tunnel have both been authenticated, thereby further improving the communication security of the IPSec tunnel.

[0112] Furthermore, in some other embodiments of the present application, the first communication module 101 is also used to receive an authentication request sent by a client gateway, the authentication request includes at least the protection subnet information of the client gateway, and the policy execution module 102 is also used to authenticate the client gateway based on the authentication request, and the client gateway is the first client gateway or the second client gateway.

[0113] Furthermore, in some other embodiments of the present application, the first communication module 101 is also used to obtain data packets transmitted in the IPSec tunnel, and verify whether the IPSec tunnel is in a secure communication state based on the data packets; the policy execution module 102 is also used to close the IPSec tunnel when the IPSec tunnel is not in a secure communication state.

[0114] Embodiment 7

[0115] Embodiment 7 of the present application provides a client gateway, such as Fig.10 As shown, it includes: a second communication module 201, the second communication module 201 is used to send IPSec tunnel request information to the zero-trust gateway, the IPSec tunnel request information at least includes the first gateway address of the client gateway, the second gateway address of the target client gateway and the negotiation form; the second communication module 201 is also used to receive IPSec tunnel configuration information sent by the zero-trust gateway and generated based on the IPSec tunnel request information, the IPSec tunnel configuration information at least includes the IPSec tunnel encryption algorithm and the key exchange protocol; a tunnel construction module 202, the tunnel construction module 202 is used to generate a key according to the IPSec tunnel encryption algorithm and exchange the key with the target client gateway according to the key exchange protocol to build an IPSec tunnel between the client gateway and the target client gateway.

[0116] Compared with the related art, in the client gateway provided in the seventh embodiment of the present application, before each client gateway wants to build an IPSec tunnel with the target client gateway for data communication, it first sends IPSec tunnel request information to the zero-trust gateway via the second communication module 201. Since the IPSec tunnel request information includes at least the first gateway address of the client gateway and the second gateway address of the target client gateway, the zero-trust gateway can confirm the identity of the client gateway and the target client gateway according to the first gateway address and the second gateway address, and determine whether the client gateway and the corresponding target client gateway are client gateways that have been authenticated by the zero-trust gateway. Identity verification is performed through the zero-trust gateway before the IPSec tunnel is built, which can improve the security of the IPSec tunnel. In addition, the tunnel construction module 202 builds the IPSec tunnel between the client gateway and the target client gateway based on the IPSec tunnel configuration information sent by the zero-trust gateway and generated by the IPSec tunnel request information, and can also enable the zero-trust gateway to have a higher degree of understanding of the relevant parameters of the constructed IPSec tunnel, which is convenient for the subsequent zero-trust gateway to monitor the communication security of the IPSec tunnel.

[0117] Furthermore, in some other embodiments of the present application, the first communication module 101 is also used to send an identity authentication request to the zero-trust gateway, the identity authentication request includes at least the protection subnet information of the client gateway, and the identity authentication request is used by the zero-trust gateway to authenticate the client gateway; after the zero-trust gateway authenticates that the identity of the client gateway is legitimate, it sends IPSec tunnel request information to the zero-trust gateway.

[0118] Furthermore, in some other embodiments of the present application, the first communication module 101 is also used to receive a user identity authentication request sent by the client, and after the user identity authentication is legal, send an authorized access behavior corresponding to the user identity to the client; the first communication module 101 is also used to obtain data packets transmitted in the IPSec tunnel, and send the data packets to the zero trust gateway.

[0119] Embodiment 8

[0120] Embodiment 8 of the present invention relates to an electronic device, such as Fig.11 As shown, it includes: at least one processor 301; and a memory 302 that is communicatively connected to the at least one processor 301; wherein the memory 302 stores instructions that can be executed by the at least one processor 301, and the instructions are executed by the at least one processor 301 so that the at least one processor 301 can execute the methods in the above-mentioned embodiments.

[0121] Among them, the memory and the processor are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus can also connect various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor.

[0122] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0123] Embodiment 9

[0124] Embodiment 9 of the present invention relates to a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the above method embodiment is implemented.

[0125] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0126] Embodiment 10

[0127] Embodiment 10 of the present application provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the IPSec tunnel management method provided in any of the aforementioned embodiments.

[0128] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. An IPSec tunnel management method, applied to a zero-trust gateway, characterized in that: The IPSec tunnel management method comprises: Receiving IPSec tunnel request information sent by the first client gateway, the IPSec tunnel request information at least including a first gateway address of the first client gateway, a second gateway address of the second client gateway, and a negotiation form; When the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, IPSec tunnel configuration information is generated based on the IPSec tunnel request information, and the IPSec tunnel configuration information includes at least an IPSec tunnel encryption algorithm and a key exchange protocol. The IPSec tunnel configuration information is sent to the first client gateway and the second client gateway to build an IPSec tunnel.

2. The IPSec tunnel management method according to claim 1, characterized in that: The IPSec tunnel management method further includes: An identity authentication request sent by a client gateway is received, the identity authentication request at least including protection subnet information of the client gateway, and the client gateway is authenticated based on the identity authentication request, the client gateway being the first client gateway or the second client gateway.

3. The IPSec tunnel management method according to claim 1, characterized in that: The IPSec tunnel management method further includes: Acquire a data message transmitted in the IPSec tunnel, and verify whether the IPSec tunnel is in a secure communication state according to the data message; When the IPSec tunnel is not in the secure communication state, closing the IPSec tunnel.

4. The IPSec tunnel management method according to claim 3, characterized in that: The verifying, according to the data message, whether the IPSec tunnel is in a secure communication state comprises: Acquire user information of the user transmitting the data message, wherein the user information at least includes authorized access behavior of the user; Obtaining the Next Header field of the AH packet in the data message, and verifying whether the access behavior of the data message belongs to the authorized access behavior according to the Next Header field; If the access behavior of the data message belongs to the authorized access behavior, it is determined that the IPSec tunnel is in the secure communication state; if the access behavior of the data message does not belong to the authorized access behavior, it is determined that the IPSec tunnel is not in the secure communication state.

5. The IPSec tunnel management method according to claim 3, characterized in that: The verifying, according to the data message, whether the IPSec tunnel is in a secure communication state comprises: Obtaining whether the security parameter index and / or the sequence number of the ESP packet in the data message is updated according to the update rule configured by the zero-trust gateway; If the security parameter index and / or the sequence number are updated according to the update rule, it is determined that the IPSec tunnel is in the secure communication state; if the security parameter index and / or the sequence number are not updated according to the update rule, it is determined that the IPSec tunnel is not in the secure communication state.

6. An IPSec tunnel management method, applied to a client gateway, characterized in that: The IPSec tunnel management method comprises: Sending IPSec tunnel request information to the zero-trust gateway, the IPSec tunnel request information at least including a first gateway address of the client gateway, a second gateway address of the target client gateway, and a negotiation form, the first gateway address is used by the zero-trust gateway to determine whether the client gateway is a client gateway after identity authentication via the zero-trust gateway, and the second gateway address is used by the zero-trust gateway to determine whether the target client gateway is a client gateway after identity authentication via the zero-trust gateway; Receive IPSec tunnel configuration information sent by the zero-trust gateway and generated based on the IPSec tunnel request information, where the IPSec tunnel configuration information at least includes an IPSec tunnel encryption algorithm and a key exchange protocol; A key is generated according to the IPSec tunnel encryption algorithm and a key is exchanged with the target client gateway according to the key exchange protocol to build an IPSec tunnel between the client gateway and the target client gateway.

7. The IPSec tunnel management method according to claim 6, characterized in that: Before sending the IPSec tunnel request information to the zero-trust gateway, the IPSec tunnel management method further includes: Sending an identity authentication request to the zero-trust gateway, the identity authentication request including at least the protection subnet information of the client gateway, the identity authentication request being used by the zero-trust gateway to authenticate the client gateway; After the zero-trust gateway authenticates the legality of the client gateway identity, an IPSec tunnel request message is sent to the zero-trust gateway.

8. The IPSec tunnel management method according to claim 6, characterized in that: The IPSec tunnel management method further includes: Receiving a user identity authentication request sent by a client, and sending an authorized access behavior corresponding to the user identity to the client after the user identity authentication is legal; Obtain a data message transmitted in the IPSec tunnel, and send the data message to the zero-trust gateway. The zero-trust gateway verifies whether the IPSec tunnel is in a secure communication state based on the data message, and closes the IPSec tunnel when the IPSec tunnel is not in the secure communication state.

9. A zero-trust gateway, characterized in that: include: A communication module, the communication module is used to receive IPSec tunnel request information sent by the first client gateway, the IPSec tunnel request information at least including a first gateway address of the first client gateway, a second gateway address of the second client gateway, and a negotiation form; a policy execution module, wherein the policy execution module is used to generate IPSec tunnel configuration information based on the IPSec tunnel request information when both the first client gateway and the second client gateway are client gateways authenticated by the zero-trust gateway, wherein the IPSec tunnel configuration information includes at least an IPSec tunnel encryption algorithm and a key exchange protocol; The communication module is further configured to send the IPSec tunnel configuration information to the first client gateway and the second client gateway to construct an IPSec tunnel.

10. A client gateway, characterized in that: include: A communication module, the communication module is used to send IPSec tunnel request information to the zero-trust gateway, the IPSec tunnel request information at least including a first gateway address of the client gateway, a second gateway address of the target client gateway, and a negotiation form; The communication module is also used to receive IPSec tunnel configuration information sent by the zero-trust gateway and generated based on the IPSec tunnel request information, wherein the IPSec tunnel configuration information at least includes an IPSec tunnel encryption algorithm and a key exchange protocol; A tunnel construction module, wherein the tunnel construction module is used to generate a key according to the IPSec tunnel encryption algorithm and exchange keys with the target client gateway according to the key exchange protocol to build an IPSec tunnel between the client gateway and the target client gateway.

11. An electronic device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the IPSec tunnel management method as described in any one of claims 1 to 8.

12. A computer-readable storage medium storing a computer program, characterized in that: The computer program is executed by a processor to implement the IPSec tunnel management method according to any one of claims 1 to 8.

13. A computer program product, characterized in that When the computer program product runs on a computer, it enables the computer to execute the IPSec tunnel management method according to any one of claims 1 to 8.

Images