Ips tunnel management method, gateway, electronic device and storage medium

Abstract

The application relates to the field of communication and discloses an IPSec tunnel management method, a zero-trust gateway, a client gateway, an electronic device, a computer readable storage medium and a computer program product. The IPSec tunnel management method comprises the following steps: receiving IPSec tunnel request information sent by a first client gateway; generating IPSec tunnel configuration information based on the IPSec tunnel request information, wherein the IPSEc tunnel configuration information at least comprises an IPSec tunnel encryption algorithm and a key exchange protocol; and sending the IPSec tunnel configuration information to the first client gateway and a second client gateway to build an IPSEc tunnel. Compared with the related art, the IPSec tunnel management method, the zero-trust gateway, the client gateway, the electronic device, the computer readable storage medium and the computer program product provided by the application have the advantage of being capable of improving the security of an IPSec tunnel communication process.

Description

Technical Field

[0001] The present invention relates to the field of communications, and in particular to an IPSec tunnel management method, a zero-trust gateway, a client gateway, an electronic device, a computer-readable storage medium, and a computer program product. Background Art

[0002] Zero Trust is a network security design framework whose core concept is "distrust all forms of data and always verify." The Zero Trust model assumes that both internal and external networks are vulnerable to threats, so all data requests require authentication and authorization. Implementations based on the Zero Trust framework generally consist of the following five components: multi-factor authentication (MFA), identity and access management (IAM), network segmentation and micro-segmentation, encryption and data protection, and continuous monitoring and analysis.

[0003] IPsec (Internet Protocol Security) is a set of protocols and services used to provide data security in network communications. It operates at the Internet Protocol (IP) layer to ensure data confidentiality, integrity, and authenticity. IPsec is often used to establish virtual private networks (VPNs) and protect sensitive data transmitted over public networks.

[0004] Zero Trust Architecture requires that all access requests, whether from internal or external sources, always require identity verification and adhere to the principle of least privilege. By combining it with IPSec VPN, the system can encrypt and authenticate each tunnel establishment and data transmission, ensuring that only authenticated users and devices can access the protected subnet.

[0005] However, in related technologies, a zero-trust gateway is usually introduced to perform security management of the IPSec tunnel only after the IPSec tunnel is built. The control over the security risks generated during the construction of the IPSec tunnel is low, which affects the security of the IPSec tunnel communication process. Summary of the Invention

[0006] The purpose of the present invention is to provide an IPSec tunnel management method, a zero-trust gateway, a client gateway, an electronic device, a computer-readable storage medium and a computer program product, which can improve the security of the IPSec tunnel communication process.

[0007] In a first aspect, the embodiments of the present application provide an IPSec tunnel management method applied to a zero-trust gateway, the IPSec tunnel management method comprising: receiving IPSec tunnel request information sent by a first client gateway, the IPSec tunnel request information at least comprising a first gateway address of the first client gateway, a second gateway address of a second client gateway, and a negotiation form; when the first client gateway and the second client gateway are both client gateways that have been authenticated via the zero-trust gateway, generating IPSec tunnel configuration information based on the IPSec tunnel request information, the IPSec tunnel configuration information at least comprising an IPSec tunnel encryption algorithm and a key exchange protocol, and sending the IPSec tunnel configuration information to the first client gateway and the second client gateway to construct an IPSec tunnel.

[0008] Compared with the related art, in the IPSec tunnel management method provided in the embodiment of the present application, when the first client gateway wants to build an IPSec tunnel with the second client gateway, it first sends the first gateway address of the first client gateway, the second gateway address of the second client gateway and the negotiation form to the zero trust gateway in the form of IPSec tunnel request information. After receiving the IPSec tunnel request information, the zero trust gateway determines whether the first client gateway and the second client gateway have completed identity authentication based on the concept of zero trust. When the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero trust gateway, the zero trust gateway generates IPSec tunnel configuration information corresponding to the first client gateway and the second client gateway based on the IPSec tunnel request information. The IPSec tunnel configuration information includes the IPSec tunnel encryption algorithm and key exchange protocol applicable to the negotiation form between the first client gateway and the second client gateway. Subsequently, the first client gateway and the second client gateway are An IPSec tunnel can be constructed based on the IPSec tunnel encryption algorithm and key exchange protocol. The IPSec tunnel encryption algorithm and key exchange protocol used to construct the IPSec tunnel between the first client gateway and the second client are generated by the zero-trust gateway. Therefore, compared with the related technology in which the encryption algorithm and key are directly communicated between the first client gateway and the second client gateway based on risk communication, the possibility of leakage of the IPSec tunnel encryption algorithm and key exchange protocol during the communication and storage process can be reduced, thereby improving the communication security of the IPSec tunnel and reducing the network bandwidth occupied by the communication between the first client gateway and the second client gateway. In addition, the zero-trust gateway generates IPSec tunnel configuration information based on the IPSec tunnel request information only when the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, that is, the first client gateway and the second client gateway that construct the IPSec tunnel have both been authenticated, further improving the communication security of the IPSec tunnel.

[0009] In an optional embodiment, the IPSec tunnel management method further includes: receiving an identity authentication request from a client gateway, the identity authentication request including at least protection subnet information of the client gateway, and authenticating the client gateway based on the identity authentication request, where the client gateway is the first client gateway or the second client gateway. Authenticating the protection subnet information of the client gateway can improve security during communication within the protection subnet of the client gateway.

[0010] In an optional embodiment, the IPSec tunnel management method further includes: obtaining data packets transmitted in the IPSec tunnel, verifying whether the IPSec tunnel is in a secure communication state based on the data packets; and closing the IPSec tunnel when the IPSec tunnel is not in the secure communication state. After the IPSec tunnel is established, during the communication process based on the IPSec tunnel, the zero-trust gateway obtains data packets transmitted in the IPSec tunnel in real time, verifies whether the current IPSec tunnel is in a secure communication state based on the data packets transmitted in the IPSec tunnel, and closes the IPSec tunnel when the IPSec tunnel is not in a secure communication state, thereby maintaining the detection of the communication security of the IPSec tunnel during the real-time communication process of the IPSec tunnel, and only communicates when the IPSec tunnel is in a secure communication state, thereby improving the security of the communication process. In addition, since the IPSec tunnel configuration information used to establish the IPSec tunnel is generated by the zero-trust gateway, the accuracy and completeness of the data packets in the IPSec tunnel obtained by the zero-trust gateway can also be improved. More accurate and complete data packets can make the reliability of the verification structure of whether the current IPSec tunnel is in a secure communication state higher, further improving the security of the communication process, and reducing the frequent closure of the IPSec tunnel due to misjudgment.

[0011] In an optional embodiment, the verification of whether the IPSec tunnel is in a secure communication state based on the data message includes: obtaining user information of the data message, the user information at least including the user's authorized access behavior; obtaining the Next Header field of the AH packet in the data message, and verifying whether the access behavior of the data message belongs to the authorized access behavior based on the Next Header field; if the access behavior of the data message belongs to the authorized access behavior, determining that the IPSec tunnel is in the secure communication state; if the access behavior of the data message does not belong to the authorized access behavior, determining that the IPSec tunnel is not in the secure communication state. When the IPSec tunnel is in a secure communication state, each user can only access the target website that he or she is authorized to access. By judging whether the actual access behavior of the data message is the authorized access behavior that the corresponding user has been authorized to access, if the access behavior of the data message does not belong to the authorized access behavior, it means that the corresponding user is making illegal access, destroying the security of the communication process of the IPSec tunnel, and determining that the IPSec tunnel is not in a secure communication state.

[0012] In an optional embodiment, the verification of whether the IPSec tunnel is in a secure communication state based on the data message includes: obtaining whether the security parameter index and / or serial number of the ESP packet in the data message is updated according to the update rule configured by the zero-trust gateway; if the security parameter index and / or the serial number are updated according to the update rule, determining that the IPSec tunnel is in the secure communication state; if the security parameter index and / or the serial number are not updated according to the update rule, determining that the IPSec tunnel is not in the secure communication state. As the communication proceeds, the security parameter index and / or the serial number of the data message needs to be updated according to the update rule configured by the zero-trust gateway. If the security parameter index and / or the serial number in the data message is not updated according to the update rule configured by the zero-trust gateway, it means that the communication text that generated the data message has not been subject to security inspection by the zero-trust gateway, and there is data message transmission in the IPSec tunnel that has not been subject to security inspection by the zero-trust gateway, which destroys the security of the communication process of the IPSec tunnel, and determines that the IPSec tunnel is not in a secure communication state.

[0013] In a second aspect, an embodiment of the present application provides an IPSec tunnel management method, which is applied to a client gateway. The IPSec tunnel management method includes: sending IPSec tunnel request information to a zero-trust gateway, the IPSec tunnel request information includes at least a first gateway address of the client gateway, a second gateway address of the target client gateway, and a negotiation form, the first gateway address is used by the zero-trust gateway to determine whether the client gateway is a client gateway after identity authentication via the zero-trust gateway, and the second gateway address is used by the zero-trust gateway to determine whether the target client gateway is a client gateway after identity authentication via the zero-trust gateway; receiving IPSec tunnel configuration information sent by the zero-trust gateway, which is generated based on the IPSec tunnel request information, the IPSec tunnel configuration information includes at least an IPSec tunnel encryption algorithm and a key exchange protocol; generating a key according to the IPSec tunnel encryption algorithm and exchanging the key with the target client gateway according to the key exchange protocol to construct an IPSec tunnel between the client gateway and the target client gateway.

[0014] Compared with the related art, in the IPSec tunnel management method provided in the embodiment of the present application, before each client gateway wants to establish an IPSec tunnel with the target client gateway for data communication, it first sends IPSec tunnel request information to the zero-trust gateway. Since the IPSec tunnel request information includes at least the first gateway address of the client gateway and the second gateway address of the target client gateway, the zero-trust gateway can confirm the identity of the client gateway and the target client gateway based on the first gateway address and the second gateway address, and determine whether the client gateway and the corresponding target client gateway are client gateways that have been authenticated by the zero-trust gateway. Identity verification is performed by the zero-trust gateway before the IPSec tunnel is established, which can improve the security of the IPSec tunnel. In addition, the IPSec tunnel between the client gateway and the target client gateway is established based on the IPSec tunnel configuration information sent by the zero-trust gateway and generated by the IPSec tunnel request information, which can also enable the zero-trust gateway to have a higher degree of understanding of the relevant parameters of the established IPSec tunnel, so that the zero-trust gateway can subsequently monitor the communication security of the IPSec tunnel.

[0015] In an optional embodiment, before sending the IPSec tunnel request information to the zero-trust gateway, the IPSec tunnel management method further includes: sending an identity authentication request to the zero-trust gateway, the identity authentication request including at least the protection subnet information of the client gateway, the identity authentication request being used by the zero-trust gateway to authenticate the client gateway; after the zero-trust gateway authenticates the legitimacy of the client gateway identity, sending the IPSec tunnel request information to the zero-trust gateway. Sending the protection subnet information of the client gateway to the IPSec tunnel for identity authentication before building the IPSec tunnel can improve the security of the client gateway's protection subnet communication.

[0016] In an optional embodiment, the IPSec tunnel management method further comprises: receiving a user identity authentication request sent by the client, sending authorized access behavior corresponding to the user identity to the client after the user identity authentication is legal; obtaining a data packet transmitted in the IPSec tunnel, and sending the data packet to the zero trust gateway, the zero trust gateway verifying whether the IPSec tunnel is in a safe communication state according to the data packet, and closing the IPSec tunnel when the IPSec tunnel is not in the safe communication state. Before the user accesses data via the client gateway, the client gateway has been authenticated by the zero trust gateway, so that the client gateway can authenticate the user identity directly by the client gateway after receiving the user identity authentication request sent by the client, without the need for the zero trust gateway to authenticate the user identity information, thereby simplifying the user identity authentication process. In addition, the data packet being transmitted in the IPSec tunnel is obtained, and the data packet is sent to the zero trust gateway, the zero trust gateway verifies whether the IPSec tunnel is in a safe communication state according to the data packet, and closes the IPSec tunnel when the IPSec tunnel is not in the safe communication state, thereby maintaining the detection of the communication security of the IPSec tunnel in the real-time communication process of the IPSec tunnel, and only communicating when the IPSec tunnel is in a safe communication state, thereby improving the security of the communication process.

[0017] In a third aspect, the embodiments of the present application provide a zero trust gateway, comprising: a communication module, the communication module is configured to receive IPSec tunnel request information sent by a first client gateway, the IPSec tunnel request information at least comprising a first gateway address of the first client gateway, a second gateway address of a second client gateway and a negotiation form; a policy execution module, the policy execution module is configured to generate IPSec tunnel configuration information based on the IPSec tunnel request information when the first client gateway and the second client gateway are both client gateways authenticated via the zero trust gateway, the IPSec tunnel configuration information at least comprising an IPSec tunnel encryption algorithm and a key exchange protocol; the communication module is further configured to send the IPSec tunnel configuration information to the first client gateway and the second client gateway to build an IPSec tunnel.

[0018] Compared with the related art, in the zero-trust gateway provided in the embodiment of the present application, when the first client gateway wants to establish an IPSec tunnel with the second client gateway, it first sends the first gateway address of the first client gateway, the second gateway address of the second client gateway and the negotiation form to the zero-trust gateway in the form of an IPSec tunnel request message. After receiving the IPSec tunnel request message, the communication module of the zero-trust gateway determines whether the first client gateway and the second client gateway have completed identity authentication based on the concept of zero trust. When the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, the communication module of the zero-trust gateway generates IPSec tunnel configuration information corresponding to the first client gateway and the second client gateway based on the IPSec tunnel request message. The IPSec tunnel configuration information includes an IPSec tunnel encryption algorithm applicable to the negotiation form between the first client gateway and the second client gateway. The zero-trust gateway then generates the IPSec tunnel encryption algorithm and key exchange protocol. The IPSec tunnel encryption algorithm and key exchange protocol used for the first client gateway and the second client to build the IPSec tunnel are generated by the zero-trust gateway. Therefore, compared with the related technology in which the encryption algorithm and key are directly communicated between the first client gateway and the second client gateway based on risk communication, the possibility of leakage of the IPSec tunnel encryption algorithm and key exchange protocol can be reduced, thereby improving the communication security of the IPSec tunnel. In addition, the zero-trust gateway generates the IPSec tunnel configuration information based on the IPSec tunnel request information only when the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, that is, the first client gateway and the second client gateway that build the IPSec tunnel have both been authenticated, thereby further improving the communication security of the IPSec tunnel.

[0019] In a fourth aspect, an embodiment of the present application provides a client gateway, comprising: a communication module, the communication module being used to send IPSec tunnel request information to a zero-trust gateway, the IPSec tunnel request information including at least the first gateway address of the client gateway, the second gateway address of the target client gateway, and a negotiation form; the communication module being also used to receive IPSec tunnel configuration information sent by the zero-trust gateway and generated based on the IPSec tunnel request information, the IPSec tunnel configuration information including at least an IPSec tunnel encryption algorithm and a key exchange protocol; a tunnel construction module, the tunnel construction module being used to generate a key according to the IPSec tunnel encryption algorithm and to exchange a key with the target client gateway according to the key exchange protocol, so as to construct an IPSec tunnel between the client gateway and the target client gateway.

[0020] Compared with the related art, in the client gateway provided by the embodiments of the present application, each client gateway first sends IPSec tunnel request information to the zero trust gateway via the communication module before intending to build an IPSec tunnel with a target client gateway for data communication. Since the IPSec tunnel request information at least includes a first gateway address of the client gateway and a second gateway address of the target client gateway, the zero trust gateway can perform identity verification on the client gateway and the target client gateway according to the first gateway address and the second gateway address, and determine whether the client gateway and the corresponding target client gateway are client gateways that have been authenticated by the zero trust gateway. The identity verification via the zero trust gateway before the IPSec tunnel is built can improve the security of the IPSec tunnel. In addition, the tunnel building module builds the IPSec tunnel between the client gateway and the target client gateway based on the IPSec tunnel configuration information generated by the IPSec tunnel request information and sent by the zero trust gateway, which can also make the zero trust gateway have a higher degree of understanding of the related parameters of the built IPSec tunnel, thereby facilitating the zero trust gateway to monitor the communication security of the IPSec tunnel.

[0021] In a fifth aspect, the embodiments of the present application provide an electronic device, comprising: at least one processor; and a memory communicatively connected with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the IPSec tunnel management method as described above.

[0022] In a sixth aspect, the embodiments of the present application provide a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the IPSec tunnel management method as described above.

[0023] In a seventh aspect, the embodiments of the present application provide a computer program product, which, when running on a computer, causes the computer to perform the IPSec tunnel management method as described above. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be considered as limiting the scope. For those skilled in the art, other related drawings can also be obtained from these drawings.

[0025] Figure 1 Flowchart of the IPSec tunnel management method provided by the first embodiment of the present application;

[0026] Figure 2 This is a flow chart of identity authentication for a first client gateway and a second client gateway in the IPSec tunnel management method provided in Example 1 of the present application;

[0027] Figure 3 This is a flowchart of the IPSec tunnel management method provided in Example 2 of this application;

[0028] Figure 4 A flowchart of verifying whether an IPSec tunnel is in a secure communication state in an IPSec tunnel management method provided in one embodiment of the present application;

[0029] Figure 5 A schematic diagram of a process for verifying whether an IPSec tunnel is in a secure communication state in an IPSec tunnel management method provided in another embodiment of the present application;

[0030] Figure 6 This is a flowchart of the IPSec tunnel management method provided in Example 3 of the present application;

[0031] Figure 7 This is a flowchart of the IPSec tunnel management method provided in Example 4 of the present application;

[0032] Figure 8 This is a flowchart of the IPSec tunnel management method provided in Example 5 of the present application;

[0033] Figure 9 This is a schematic diagram of the structure of the zero-trust gateway provided in Example 6 of the present application;

[0034] Figure 10 A schematic diagram of the structure of the client gateway provided in Example 7 of the present application;

[0035] Figure 11 This is a structural diagram of the electronic device provided in Example 8 of the present application. DETAILED DESCRIPTION

[0036] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0037] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention but is merely representative of selected embodiments of the present invention.

[0038] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0039] In addition, the terms "first", "second", etc., if used, are merely used to distinguish and describe, and should not be understood as indicating or implying relative importance.

[0040] It should be noted that, in the absence of conflict, the features in the embodiments of the present invention may be combined with each other.

[0041] Example 1

[0042] The first embodiment of the present invention provides an IPSec tunnel management method, which is applied to a zero-trust gateway. The so-called zero-trust gateway is a gateway built based on the zero-trust concept. The zero-trust concept is a network security protection concept. Its key lies in breaking the default "trust", that is, "continuous verification, never trust". By default, no one, device, or system inside or outside the enterprise network is trusted. The trust foundation of access control is rebuilt based on identity authentication and authorization, thereby ensuring that the identity is trustworthy, the device is trustworthy, the application is trustworthy, and the link is trustworthy. On this basis, Figure 1 As shown, the IPSec tunnel management method provided in this embodiment includes:

[0043] Step S101: Receive IPSec tunnel request information sent by a first client gateway, where the IPSec tunnel request information at least includes a first gateway address of the first client gateway, a second gateway address of a second client gateway, and a negotiation mode.

[0044] In this step, the client gateway is a gateway device used to communicate with the user device. When the client running on the user device needs to access the network or communicate with the user, the actual communication object is the client gateway, and the client gateway seeks network access and communication from the network server or other user devices connected to the network.

[0045] Among them, the first client gateway and the second client gateway are two client gateways that want to establish an IPSec tunnel. That is, before the first client gateway wants to establish an IPSec tunnel with the second client gateway, it first sends IPSec tunnel request information to the zero trust gateway, and the zero trust gateway reviews the IPSec tunnel.

[0046] In this step, the negotiation between the first and second client gateways involves a series of gateway protocols, specifically gateway protocols supported by the first and second client gateways, including internal gateway protocols and external gateway protocols. An internal gateway protocol is a gateway protocol between subnets within the first or second client gateway, while an external gateway protocol is a gateway protocol for direct communication between the first and second client gateways.

[0047] Step S102: When the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, IPSec tunnel configuration information is generated based on the IPSec tunnel request information. The IPSec tunnel configuration information includes at least an IPSec tunnel encryption algorithm and a key exchange protocol.

[0048] In this step, after receiving the IPSec tunnel request information, the zero-trust gateway determines whether the first client gateway and the second client gateway are client gateways that have been authenticated by the zero-trust gateway based on the first gateway address of the first client gateway and the second gateway address of the second client gateway in the IPSec tunnel request information. That is, before receiving the IPSec tunnel request information, it determines whether the first client gateway and the second client gateway have been authenticated, and whether the authentication of the first client gateway and the second client gateway has passed. If the first client gateway and the second client gateway have been authenticated before receiving the IPSec tunnel request information, and the authentication of the first client gateway and the second client gateway have all passed, then IPSec tunnel configuration information is generated based on the IPSec tunnel request information.

[0049] Among them, such as Figure 2 As shown, performing identity authentication on the first client gateway and the second client gateway before receiving the IPSec tunnel request information may specifically include:

[0050] Step S201: receiving an identity authentication request sent by a client gateway, where the identity authentication request at least includes protection subnet information of the client gateway.

[0051] In this step, the protection subnet information of the client gateway may specifically include the website address of each protection subnet, the server device identifier corresponding to the protection subnet, and other information.

[0052] Step S202: performing identity authentication on the client gateway based on the identity authentication request, where the client gateway is the first client gateway or the second client gateway.

[0053] In this step, the identity of the client gateway can be authenticated based on the protection subnet information of the client gateway. Specifically, for example, the security of each protection subnet can be checked based on the URL of each protection subnet of the client gateway, the server device identification corresponding to the protection subnet, and other information. For example, it can be checked whether there are Trojan scripts, crawler scripts, and other scripts that endanger communication security in each protection subnet. For client gateways without security risks, the zero-trust gateway can mark the client gateway, and in step S102, it can be determined based on the mark whether the first client gateway and the second client gateway have been authenticated before receiving the IPSec tunnel request information, and whether the identity authentication of the first client gateway and the second client gateway has passed.

[0054] Authenticating the client gateway's protected subnet information before establishing an IPSec tunnel can improve the security of client gateway protected subnet communications.

[0055] Furthermore, in this step, generating the IPSec tunnel configuration information based on the IPSec tunnel request information can specifically be based on a policy protocol preset in the zero-trust gateway, and determining the IPSec tunnel encryption algorithm and key exchange protocol according to the negotiation format between the first client gateway and the second client gateway. The policy protocol is a program preset in the zero-trust gateway for generating the IPSec tunnel encryption algorithm and key exchange protocol. The policy protocol can generate corresponding IPSec tunnel encryption algorithms and key exchange protocols based on different negotiation formats and corresponding different confidentiality requirements. For negotiation formats with higher confidentiality requirements, the generated IPSec tunnel encryption algorithm is more complex; conversely, for negotiation formats with lower confidentiality requirements, the generated IPSec tunnel encryption algorithm is simpler.

[0056] Step S103: Send the IPSec tunnel configuration information to the first client gateway and the second client gateway to establish an IPSec tunnel.

[0057] In this step, the generated IPSec tunnel configuration information can be sent to the first client gateway and the second client gateway respectively based on the first gateway address of the first client gateway and the second gateway address of the second client gateway in the IPSec tunnel request information. After the first client gateway and the second client gateway receive the IPSec tunnel configuration information, they can build an IPSec tunnel based on the IPSec tunnel configuration information for tunnel communication.

[0058] Compared with the related art, in the IPSec tunnel management method provided in the embodiment of the present application, when the first client gateway wants to build an IPSec tunnel with the second client gateway, it first sends the first gateway address of the first client gateway, the second gateway address of the second client gateway, and the negotiation form to the zero trust gateway in the form of IPSec tunnel request information. After receiving the IPSec tunnel request information, the zero trust gateway determines whether the first client gateway and the second client gateway have completed identity authentication based on the concept of zero trust. When the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero trust gateway, the zero trust gateway generates IPSec tunnel configuration information corresponding to the first client gateway and the second client gateway based on the IPSec tunnel request information. The IPSec tunnel configuration information includes the IPSec tunnel encryption algorithm and key exchange algorithm applicable to the negotiated form between the first client gateway and the second client gateway. After the protocol is changed, the first client gateway and the second client gateway can subsequently build an IPSec tunnel based on the IPSec tunnel encryption algorithm and the key exchange protocol. The IPSec tunnel encryption algorithm and the key exchange protocol used for the first client gateway and the second client to build the IPSec tunnel are generated by the zero-trust gateway. Therefore, compared with the related technology in which the encryption algorithm and the key are directly communicated between the first client gateway and the second client gateway based on risk communication, the possibility of leakage of the IPSec tunnel encryption algorithm and the key exchange protocol can be reduced, and the communication security of the IPSec tunnel can be improved. In addition, the zero-trust gateway generates IPSec tunnel configuration information based on the IPSec tunnel request information only when the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero-trust gateway, that is, the first client gateway and the second client gateway that build the IPSec tunnel have both been authenticated, further improving the communication security of the IPSec tunnel.

[0059] Example 2

[0060] The second embodiment of the present application provides an IPSec tunnel management method, which is substantially the same as the IPSec tunnel management method provided in the first embodiment, and also includes steps S101 to S103, except that: Figure 3 As shown, in the IPSec tunnel management method provided in the second embodiment, after the first client gateway and the second client gateway establish an IPSec tunnel, the process of performing tunnel communication further includes:

[0061] Step S104: Acquire the data message transmitted in the IPSec tunnel, and verify whether the IPSec tunnel is in a secure communication state based on the data message.

[0062] In this step, the data message is a data packet transmitted in the IPSec tunnel, and the first client gateway and the second client gateway can transmit the data message in the IPSec tunnel after establishing the IPSec tunnel, thereby realizing the communication between the first client gateway and the second client gateway.

[0063] In different embodiments of the present application, different methods can be used to verify whether the IPSec tunnel is in a safe communication state according to different forms of data messages.

[0064] For example Figure 4 As shown, verifying whether the IPSec tunnel is in a safe communication state according to the data message can specifically include:

[0065] Step S301: Obtain user information of a transmitted data message, wherein the user information at least includes authorized access behavior of the user.

[0066] In this step, the communication between the first client gateway and the second client gateway is essentially the communication of a user client connected to the first client gateway and the second client gateway, and the data message transmitted in the IPSec tunnel between the first client gateway and the second client gateway is actually a data message corresponding to each user client, wherein a user identifier corresponding to the data message is encapsulated, and the zero trust gateway can obtain the authorized access behavior corresponding to the user identifier according to the user identifier. The authorized access behavior is the data network access behavior allowed to be performed by the user, for example, the website allowed to be accessed by the user, the other communication terminal allowed to be communicated by the user, and the like.

[0067] Step S302: Obtain the Next Header field of the AH packet in the data message, and verify whether the access behavior of the data message belongs to the authorized access behavior according to the Next Header field, if yes, execute step S303, and if no, execute step S304.

[0068] In this step, the Next Header field of the AH packet of the data packet includes the actual access behavior of the data message, for example, the website actually accessed by the data message or the communication terminal actually corresponding to the data message, and the like. Comparing the authorized access behavior allowed to be performed by the user corresponding to the data message obtained in step S301 with the actual access behavior of the data message can determine whether the data message is an unauthorized access, if the data message is an unauthorized access, it indicates that there is an unauthorized risk access in the IPSec tunnel, and step S304 is executed at this time, otherwise, step S303 is executed.

[0069] Step S303: Determine that the IPSec tunnel is in a safe communication state.

[0070] Step S304: determining that the IPSec tunnel is not in the safe communication state.

[0071] When the IPSec tunnel is in the safe communication state, each user can only access the target website to which the user is authorized to access. By judging whether the actual access behavior of the data packet is the authorized access behavior to which the corresponding user is authorized, if the access behavior of the data packet is not the authorized access behavior, it indicates that the corresponding user is performing illegal access, which destroys the safety of the communication process of the IPSec tunnel, and it is determined that the IPSec tunnel is not in the safe communication state.

[0072] Or for example Figure 5 As shown, the specific method for determining whether the IPSec tunnel is in the safe communication state according to the data packet can include the following steps.

[0073] Step S401: obtaining whether the security parameter index and / or the sequence number of the ESP packet in the data packet is updated according to the update rule configured by the zero trust gateway. If yes, step S402 is performed; if no, step S403 is performed.

[0074] In this step, the update rule corresponding to the security parameter index and / or the sequence number of the data packet is configured in the zero trust gateway. As the first client gateway and the second client gateway communicate in the IPSec tunnel, the security parameter index and / or the sequence number of the transmitted data packet needs to be updated based on the update rule. If there is a data packet that is not updated in time according to the update rule, it indicates that the data packet is an illegal packet. Based on the communication behavior risk of the data packet, there is a risk behavior, which indicates that the communication safety of the current IPSec tunnel is low, and the IPSec tunnel is not in the safe communication state. At this time, step S403 is performed; otherwise, step S402 is performed.

[0075] Step S402: determining that the IPSec tunnel is in the safe communication state.

[0076] Step S403: determining that the IPSec tunnel is not in the safe communication state.

[0077] As the communication proceeds, the security parameter index and / or the sequence number of the data packet needs to be updated according to the update rule configured by the zero trust gateway. If the security parameter index and / or the sequence number in the data packet is not updated according to the update rule configured by the zero trust gateway, it indicates that the communication process that generates the data packet does not accept the security inspection of the zero trust gateway. There is a data packet that does not accept the security inspection of the zero trust gateway in the IPSec tunnel, which destroys the safety of the communication process of the IPSec tunnel, and it is determined that the IPSec tunnel is not in the safe communication state.

[0078] Step S105: When the IPSec tunnel is not in a secure communication state, close the IPSec tunnel.

[0079] Compared with the related art, in the IPSec tunnel management method provided in Example 2 of the present application, after the IPSec tunnel is constructed, during the communication based on the IPSec tunnel, the zero-trust gateway obtains the data packets transmitted in the IPSec tunnel in real time, and verifies whether the current IPSec tunnel is in a secure communication state based on the data packets transmitted in the IPSec tunnel, and closes the IPSec tunnel when the IPSec tunnel is not in a secure communication state, thereby maintaining the detection of the communication security of the IPSec tunnel during the real-time communication of the IPSec tunnel, and only communicates when the IPSec tunnel is in a secure communication state, thereby improving the security of the communication process; in addition, since the IPSec tunnel configuration information used to construct the IPSec tunnel is generated by the zero-trust gateway, the accuracy and completeness of the data packets in the IPSec tunnel obtained by the zero-trust gateway can also be improved. More accurate and complete data packets can make the reliability of the verification structure of whether the current IPSec tunnel is in a secure communication state higher, further improving the security of the communication process, and reducing the situation where the IPSec tunnel is frequently closed due to misjudgment.

[0080] Example 3

[0081] The third embodiment of the present application provides an IPSec tunnel management method, which is applied to a client gateway, such as Figure 6 Shown, including:

[0082] Step S501: Send IPSec tunnel request information to the zero-trust gateway, where the IPSec tunnel request information includes at least the first gateway address of the client gateway, the second gateway address of the target client gateway, and the negotiation form.

[0083] In this step, the IPSec tunnel request information sent to the zero-trust gateway is the IPSec tunnel request information received by the zero-trust gateway in the aforementioned embodiment. For details, please refer to the specific description in the aforementioned embodiment.

[0084] Step S502: Receive IPSec tunnel configuration information sent by the zero-trust gateway and generated based on the IPSec tunnel request information. The IPSec tunnel configuration information includes at least the IPSec tunnel encryption algorithm and the key exchange protocol.

[0085] In this step, the received IPSec tunnel configuration information is the IPSec tunnel configuration information issued by the zero-trust gateway in the aforementioned embodiment. For details, please refer to the specific description in the aforementioned embodiment.

[0086] Step S503: generating a key according to the IPSec tunnel encryption algorithm and exchanging the key with the target client gateway according to a key exchange protocol to build the IPSec tunnel between the client gateway and the target client gateway.

[0087] It can be understood that the IPSec tunnel management method provided in Embodiment Three is an IPSec tunnel management method applied to a client gateway, which corresponds to the IPSec tunnel management method applied to a zero-trust gateway provided in the foregoing embodiments, that is, the IPSec tunnel management method provided in the embodiments of the present application involves mutual communication between a zero-trust gateway and a client gateway, and the IPSec tunnel management method applied to a client gateway provided in Embodiment Three and the IPSec tunnel management method applied to a zero-trust gateway provided in the foregoing embodiments can be implemented in cooperation to jointly implement the building of an IPSec tunnel.

[0088] Compared with the related art, in the IPSec tunnel management method provided in Embodiment Three of the present application, each client gateway first sends IPSec tunnel request information to the zero-trust gateway before intending to build an IPSec tunnel with a target client gateway for data communication, and since the IPSec tunnel request information at least includes a first gateway address of the client gateway and a second gateway address of the target client gateway, the zero-trust gateway can perform identity verification on the client gateway and the target client gateway according to the first gateway address and the second gateway address, and determine whether the client gateway and the corresponding target client gateway are client gateways that have been identity authenticated via the zero-trust gateway, so that identity verification via the zero-trust gateway before the building of the IPSec tunnel can improve the security of the IPSec tunnel. In addition, the building of the IPSec tunnel between the client gateway and the target client gateway based on the IPSec tunnel configuration information generated from the IPSec tunnel request information sent by the zero-trust gateway can also make the zero-trust gateway have a higher degree of understanding of the related parameters of the built IPSec tunnel, thereby facilitating the monitoring of the communication security of the IPSec tunnel by the zero-trust gateway.

[0089] Embodiment Four

[0090] Embodiment Four of the present application provides an IPSec tunnel management method applied to a client gateway, as shown in Figure 7 , which comprises:

[0091] Step S601: sending an identity authentication request to the zero-trust gateway, the identity authentication request at least including protection subnet information of the client gateway, and after the zero-trust gateway authenticates that the identity of the client gateway is legal, performing step S602.

[0092] In this step, the identity authentication request sent to the zero-trust gateway is the identity authentication request received by the zero-trust gateway in the aforementioned embodiment applied to the zero-trust gateway. For details, please refer to the specific description in the aforementioned embodiment.

[0093] Step S602: Send IPSec tunnel request information to the zero-trust gateway, where the IPSec tunnel request information includes at least the first gateway address of the client gateway, the second gateway address of the target client gateway, and the negotiation form.

[0094] Step S603: Receive IPSec tunnel configuration information sent by the zero-trust gateway and generated based on the IPSec tunnel request information. The IPSec tunnel configuration information includes at least the IPSec tunnel encryption algorithm and the key exchange protocol.

[0095] Step S604: Generate a key according to the IPSec tunnel encryption algorithm and exchange the key with the target client gateway according to the key exchange protocol to build an IPSec tunnel between the client gateway and the target client gateway.

[0096] Compared with the related art, in the IPSec tunnel management method provided in Example 4 of the present application, the protection subnet information of the client gateway is sent to the IPSec tunnel for identity authentication before building the IPSec tunnel, which can improve the security of the client gateway's protection subnet communication.

[0097] Example 5

[0098] The fifth embodiment of the present application provides an IPSec tunnel management method, which is applied to a client gateway, such as Figure 8 Shown, including:

[0099] Step S701: Send an identity authentication request to the zero-trust gateway. The identity authentication request includes at least the protection subnet information of the client gateway. After the zero-trust gateway authenticates the legality of the client gateway identity, execute step S702.

[0100] In this step, the identity authentication request sent to the zero-trust gateway is the identity authentication request received by the zero-trust gateway in the aforementioned embodiment applied to the zero-trust gateway. For details, please refer to the specific description in the aforementioned embodiment.

[0101] Step S702: Send IPSec tunnel request information to the zero-trust gateway, where the IPSec tunnel request information includes at least the first gateway address of the client gateway, the second gateway address of the target client gateway, and the negotiation form.

[0102] Step S703: receiving the IPSec tunnel configuration information sent by the zero trust gateway and generated based on the IPSec tunnel request information, the IPSec tunnel configuration information at least including an IPSec tunnel encryption algorithm and a key exchange protocol.

[0103] Step S704: generating a key according to the IPSec tunnel encryption algorithm and exchanging the key with the target client gateway according to the key exchange protocol, to construct an IPSec tunnel between the client gateway and the target client gateway.

[0104] Step S705: receiving a user identity authentication request sent by the client, and sending authorized access behaviors corresponding to the user identity to the client after the user identity authentication is legal.

[0105] In this step, the client running on the user equipment can send a user identity authentication request to the client gateway to request the client gateway to perform identity authentication on the user. Specifically, the user's related information such as a user account identifier and a device identifier of the user equipment can be sent to the client gateway, the client gateway marks and authorizes the access behaviors allowed by the user based on the user's related information such as the user account identifier and the device identifier of the user equipment, and feeds back the marking and authorization results as authorized access behaviors corresponding to the user identity to the client, to realize authorization on the user.

[0106] Step S706: obtaining a data packet transmitted in the IPSec tunnel, and sending the data packet to the zero trust gateway, the zero trust gateway verifying whether the IPSec tunnel is in a safe communication state according to the data packet, and closing the IPSec tunnel when the IPSec tunnel is not in the safe communication state.

[0107] In this step, the data packet sent to the zero trust gateway is the data packet in the IPSec tunnel obtained by the zero trust gateway in the foregoing embodiments, and on this basis, the zero trust gateway verifies whether the IPSec tunnel is in a safe communication state according to the data packet, which can refer to the specific description in the foregoing embodiments.

[0108] Compared with the related art, in the IPSec tunnel management method provided in Example 5 of the present application, before the user accesses data through the client gateway, since the client gateway has been authenticated by the zero-trust gateway, the client gateway can directly authenticate the user identity after receiving the user authentication request sent by the client, without the need for the zero-trust gateway to authenticate the user identity information, thereby simplifying the user authentication process; in addition, the data packet being transmitted is obtained in the IPSec tunnel and sent to the zero-trust gateway, which verifies whether the IPSec tunnel is in a secure communication state based on the data packet, and closes the IPSec tunnel when the IPSec tunnel is not in a secure communication state, thereby maintaining the detection of the communication security of the IPSec tunnel during the real-time communication process of the IPSec tunnel, and only communicates when the IPSec tunnel is in a secure communication state, thereby improving the security of the communication process.

[0109] Example 6

[0110] The sixth embodiment of the present application provides a zero-trust gateway, such as Figure 9 As shown, it includes: a first communication module 101, the first communication module 101 is used to receive IPSec tunnel request information sent by the first client gateway, the IPSec tunnel request information at least includes the first gateway address of the first client gateway, the second gateway address of the second client gateway and the negotiation form; a policy execution module 102, the policy execution module 102 is used to generate IPSec tunnel configuration information based on the IPSec tunnel request information when both the first client gateway and the second client gateway are client gateways that have been authenticated by the zero trust gateway, the IPSec tunnel configuration information at least includes the IPSec tunnel encryption algorithm and the key exchange protocol; the communication module is also used to send the IPSec tunnel configuration information to the first client gateway and the second client gateway to build an IPSec tunnel.

[0111] Compared with the related art, in the zero trust gateway provided in the embodiment six of the present application, when the first client gateway and the second client gateway want to build an IPSec tunnel, the first client gateway first sends the first gateway address of the first client gateway, the second gateway address of the second client gateway and the negotiation form to the zero trust gateway in the form of IPSec tunnel request information. After receiving the IPSec tunnel request information, the first communication module 101 of the zero trust gateway determines whether the first client gateway and the second client gateway have completed identity authentication based on the concept of zero trust. When the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero trust gateway, the communication module of the zero trust gateway generates the IPSec tunnel configuration information corresponding to the first client gateway and the second client gateway based on the IPSec tunnel request information. The IPSec tunnel configuration information includes the IPSec tunnel encryption algorithm and the key exchange protocol suitable for the negotiation form between the first client gateway and the second client gateway. Subsequently, the first client gateway and the second client gateway can build the IPSec tunnel based on the IPSec tunnel encryption algorithm and the key exchange protocol. The IPSec tunnel encryption algorithm and the key exchange protocol used by the first client gateway and the second client gateway to build the IPSec tunnel are generated by the zero trust gateway. Therefore, compared with the related art in which the encryption algorithm and the key are communicated directly between the first client gateway and the second client gateway based on risk communication, the possibility of leakage of the IPSec tunnel encryption algorithm and the key exchange protocol can be reduced, and the communication security of the IPSec tunnel is improved. In addition, the zero trust gateway generates the IPSec tunnel configuration information based on the IPSec tunnel request information only when the first client gateway and the second client gateway are both client gateways that have been authenticated by the zero trust gateway. That is, the first client gateway and the second client gateway that build the IPSec tunnel have both been authenticated, further improving the communication security of the IPSec tunnel.

[0112] Further, in some other embodiments of the present application, the first communication module 101 is further configured to receive an identity authentication request sent by the client gateway, the identity authentication request at least including protection subnet information of the client gateway, and the policy execution module 102 is further configured to perform identity authentication on the client gateway based on the identity authentication request, the client gateway being the first client gateway or the second client gateway.

[0113] Further, in some other embodiments of the present application, the first communication module 101 is further configured to obtain a data packet transmitted in the IPSec tunnel, and verify whether the IPSec tunnel is in a secure communication state according to the data packet; and the policy execution module 102 is further configured to close the IPSec tunnel when the IPSec tunnel is not in the secure communication state.

[0114] Example 7

[0115] The seventh embodiment of the present application provides a client gateway, such as Figure 10 As shown, it includes: a second communication module 201, the second communication module 201 is used to send IPSec tunnel request information to the zero trust gateway, the IPSec tunnel request information includes at least the first gateway address of the client gateway, the second gateway address of the target client gateway and the negotiation form; the second communication module 201 is also used to receive IPSec tunnel configuration information sent by the zero trust gateway and generated based on the IPSec tunnel request information, the IPSec tunnel configuration information includes at least the IPSec tunnel encryption algorithm and the key exchange protocol; the tunnel construction module 202, the tunnel construction module 202 is used to generate a key according to the IPSec tunnel encryption algorithm and exchange the key with the target client gateway according to the key exchange protocol to build an IPSec tunnel between the client gateway and the target client gateway.

[0116] Compared with the related art, in the client gateway provided in Example 7 of the present application, before each client gateway wants to establish an IPSec tunnel with the target client gateway for data communication, it first sends IPSec tunnel request information to the zero-trust gateway via the second communication module 201. Since the IPSec tunnel request information includes at least the first gateway address of the client gateway and the second gateway address of the target client gateway, the zero-trust gateway can confirm the identity of the client gateway and the target client gateway based on the first gateway address and the second gateway address, and determine whether the client gateway and the corresponding target client gateway are client gateways that have been authenticated by the zero-trust gateway. Identity verification is performed by the zero-trust gateway before the IPSec tunnel is established, which can improve the security of the IPSec tunnel. In addition, the tunnel construction module 202 constructs the IPSec tunnel between the client gateway and the target client gateway based on the IPSec tunnel configuration information sent by the zero-trust gateway and generated by the IPSec tunnel request information, and can also enable the zero-trust gateway to have a higher degree of understanding of the relevant parameters of the constructed IPSec tunnel, which facilitates the subsequent zero-trust gateway to monitor the communication security of the IPSec tunnel.

[0117] Furthermore, in some other embodiments of the present application, the first communication module 101 is also used to send an identity authentication request to the zero-trust gateway, the identity authentication request includes at least the protection subnet information of the client gateway, and the identity authentication request is used by the zero-trust gateway to authenticate the client gateway; after the zero-trust gateway authenticates that the identity of the client gateway is legal, it sends IPSec tunnel request information to the zero-trust gateway.

[0118] Furthermore, in some other embodiments of the present application, the first communication module 101 is also used to receive a user identity authentication request sent by the client, and send an authorized access behavior corresponding to the user identity to the client after the user identity authentication is legal; the first communication module 101 is also used to obtain data packets transmitted in the IPSec tunnel and send the data packets to the zero trust gateway.

[0119] Example 8

[0120] An eighth embodiment of the present invention relates to an electronic device, such as Figure 11 As shown, it includes: at least one processor 301; and a memory 302 that is communicatively connected to the at least one processor 301; wherein the memory 302 stores instructions that can be executed by the at least one processor 301, and the instructions are executed by the at least one processor 301 so that the at least one processor 301 can execute the methods in the above embodiments.

[0121] The memory and processor are connected using a bus, which can include any number of interconnected buses and bridges. The bus connects various circuits of one or more processors and memories. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits. These are all well known in the art and are therefore not described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over a wireless medium via an antenna. Furthermore, the antenna receives data and transmits it to the processor.

[0122] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0123] Example 9

[0124] A ninth embodiment of the present invention relates to a computer-readable storage medium storing a computer program, which implements the above method embodiment when executed by a processor.

[0125] That is, those skilled in the art will understand that all or part of the steps in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a program, which is stored in a storage medium and includes a number of instructions for causing a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps in the various embodiments of the present application. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., various media that can store program code.

[0126] Example 10

[0127] Embodiment 10 of the present application provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the IPSec tunnel management method provided in any of the aforementioned embodiments.

[0128] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. An IPSec tunnel management method, applied to a zero-trust gateway, characterized in that: The IPSec tunnel management method includes: Receive IPSec tunnel request information sent by a first client gateway, the IPSec tunnel request information including at least a first gateway address of the first client gateway, a second gateway address of a second client gateway, and a negotiation form; the first gateway address is used by the zero-trust gateway to determine whether the first client gateway is a client gateway that has been authenticated by the zero-trust gateway, and the second gateway address is used by the zero-trust gateway to determine whether the second client gateway is a client gateway that has been authenticated by the zero-trust gateway; When both the first client gateway and the second client gateway are client gateways authenticated by the zero-trust gateway, generating IPSec tunnel configuration information based on the IPSec tunnel request information, the IPSec tunnel configuration information including at least an IPSec tunnel encryption algorithm and a key exchange protocol, and sending the IPSec tunnel configuration information to the first client gateway and the second client gateway to establish an IPSec tunnel; The IPSec tunnel management method further includes: An identity authentication request is received from a client gateway, the identity authentication request including at least protection subnet information of the client gateway, and identity authentication is performed on the client gateway based on the identity authentication request, where the client gateway is the first client gateway or the second client gateway.

2. The IPSec tunnel management method according to claim 1, wherein: The IPSec tunnel management method further includes: Acquire a data message transmitted in the IPSec tunnel, and verify whether the IPSec tunnel is in a secure communication state according to the data message; When the IPSec tunnel is not in the secure communication state, closing the IPSec tunnel.

3. The IPSec tunnel management method according to claim 2, wherein: The verifying, according to the data message, whether the IPSec tunnel is in a secure communication state includes: Acquire user information of the user transmitting the data message, wherein the user information at least includes authorized access behavior of the user; Obtaining a Next Header field of an AH packet in the data message, and verifying whether the access behavior of the data message belongs to the authorized access behavior according to the Next Header field; If the access behavior of the data message belongs to the authorized access behavior, it is determined that the IPSec tunnel is in the secure communication state; if the access behavior of the data message does not belong to the authorized access behavior, it is determined that the IPSec tunnel is not in the secure communication state.

4. The IPSec tunnel management method according to claim 2, wherein: The verifying, according to the data message, whether the IPSec tunnel is in a secure communication state includes: Obtaining whether the security parameter index and / or serial number of the ESP packet in the data message is updated according to the update rule configured by the zero trust gateway; If the security parameter index and / or the serial number are updated according to the update rule, it is determined that the IPSec tunnel is in the secure communication state; if the security parameter index and / or the serial number are not updated according to the update rule, it is determined that the IPSec tunnel is not in the secure communication state.

5. An IPSec tunnel management method, applied to a client gateway, characterized in that: The IPSec tunnel management method includes: Sending an identity authentication request to the zero-trust gateway, the identity authentication request including at least the protection subnet information of the client gateway, the identity authentication request being used by the zero-trust gateway to authenticate the client gateway; After the zero-trust gateway authenticates the client gateway identity as legitimate, sending IPSec tunnel request information to the zero-trust gateway; Sending IPSec tunnel request information to the zero-trust gateway, the IPSec tunnel request information including at least a first gateway address of the client gateway, a second gateway address of the target client gateway, and a negotiation form, the first gateway address being used by the zero-trust gateway to determine whether the client gateway is a client gateway that has been authenticated by the zero-trust gateway, and the second gateway address being used by the zero-trust gateway to determine whether the target client gateway is a client gateway that has been authenticated by the zero-trust gateway; When both the client gateway and the target client gateway are client gateways authenticated by the zero-trust gateway, receiving IPSec tunnel configuration information sent by the zero-trust gateway and generated based on the IPSec tunnel request information, the IPSec tunnel configuration information including at least an IPSec tunnel encryption algorithm and a key exchange protocol; A key is generated according to the IPSec tunnel encryption algorithm and a key is exchanged with the target client gateway according to the key exchange protocol to build an IPSec tunnel between the client gateway and the target client gateway.

6. The IPSec tunnel management method according to claim 5, characterized in that: The IPSec tunnel management method further includes: Receive a user identity authentication request from a client, and after the user identity is authenticated as legitimate, send the client an authorized access behavior corresponding to the user identity; Obtain the data message transmitted in the IPSec tunnel and send the data message to the zero-trust gateway. The zero-trust gateway verifies whether the IPSec tunnel is in a secure communication state based on the data message, and closes the IPSec tunnel when the IPSec tunnel is not in the secure communication state.

7. A zero-trust gateway, characterized in that: include: a communication module, configured to receive IPSec tunnel request information sent by a first client gateway, wherein the IPSec tunnel request information includes at least a first gateway address of the first client gateway, a second gateway address of the second client gateway, and a negotiation form; The first gateway address is used by the zero-trust gateway to determine whether the first client gateway is a client gateway that has been authenticated by the zero-trust gateway, and the second gateway address is used by the zero-trust gateway to determine whether the second client gateway is a client gateway that has been authenticated by the zero-trust gateway; a policy execution module, the policy execution module being configured to generate IPSec tunnel configuration information based on the IPSec tunnel request information when both the first client gateway and the second client gateway are client gateways authenticated by the zero-trust gateway, the IPSec tunnel configuration information including at least an IPSec tunnel encryption algorithm and a key exchange protocol; The communication module is further configured to send the IPSec tunnel configuration information to the first client gateway and the second client gateway to establish an IPSec tunnel; The communication module is further configured to receive an identity authentication request sent by a client gateway, the identity authentication request including at least protection subnet information of the client gateway, and perform identity authentication on the client gateway based on the identity authentication request, where the client gateway is the first client gateway or the second client gateway.

8. A client gateway, characterized in that: include: A communication module, wherein the communication module is used to send an identity authentication request to the zero-trust gateway, wherein the identity authentication request includes at least the protection subnet information of the client gateway, and the identity authentication request is used by the zero-trust gateway to authenticate the client gateway; After the zero-trust gateway authenticates the client gateway identity as legitimate, sending IPSec tunnel request information to the zero-trust gateway; Sending IPSec tunnel request information to the zero-trust gateway, the IPSec tunnel request information including at least a first gateway address of the client gateway, a second gateway address of the target client gateway, and a negotiation form; The first gateway address is used by the zero-trust gateway to determine whether the client gateway is a client gateway that has been authenticated by the zero-trust gateway, and the second gateway address is used by the zero-trust gateway to determine whether the target client gateway is a client gateway that has been authenticated by the zero-trust gateway; The communication module is further configured to receive, when both the client gateway and the target client gateway are client gateways authenticated by the zero-trust gateway, IPSec tunnel configuration information generated based on the IPSec tunnel request information and sent by the zero-trust gateway, the IPSec tunnel configuration information including at least an IPSec tunnel encryption algorithm and a key exchange protocol; A tunnel construction module is used to generate a key according to the IPSec tunnel encryption algorithm and exchange the key with the target client gateway according to the key exchange protocol to build an IPSec tunnel between the client gateway and the target client gateway.

9. An electronic device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the IPSec tunnel management method according to any one of claims 1 to 6.

10. A computer-readable storage medium storing a computer program, characterized in that: The computer program is executed by a processor to implement the IPSec tunnel management method according to any one of claims 1 to 6.

11. A computer program product, characterized in that When the computer program product is run on a computer, the computer is enabled to execute the IPSec tunnel management method according to any one of claims 1 to 6.

Images