Traffic identification method, device and computer equipment

Abstract

The present application relates to a traffic identification method, device and computer equipment. Applied to a gateway, the method includes: receiving a user virtual number and access traffic sent by a client, the access traffic being the traffic of the client accessing a target application; matching a connector corresponding to the user virtual number from multiple connectors based on a virtual address pool corresponding to each connector, and determining a target connector; forwarding the user virtual number and access traffic to the target connector, so that the target connector modifies the source address of the client based on the user virtual number to obtain a modified source address, establishes a connection with the target application based on the modified source address information, and forwards the access traffic to the target application, so that the target application identifies the modified source address and responds to the access traffic, and the modified source address is consistent with the user virtual number. The use of this method can improve the accuracy of traffic identification.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a traffic identification method, device and computer equipment. Background Art

[0002] With the changes in the office environment and the development of cloud computing, the zero-trust network architecture has been introduced to ensure the security of network access. The zero-trust network architecture usually uses gateways and connectors as key components, which are responsible for connecting clients and proxy access to application servers respectively. In the zero-trust network architecture, the connector loses the client's source Internet Protocol (IP) address when forwarding proxy traffic to the application actually accessed, and instead uses the connector's own IP address to access the application server, so that the application server or audit device can only receive the connector's IP address and cannot distinguish users based on the IP address, resulting in low accuracy in user traffic identification. Summary of the invention

[0003] Based on this, it is necessary to provide a flow identification method, device and computer equipment that can improve the accuracy of flow identification in response to the above technical problems.

[0004] In a first aspect, the present application provides a traffic identification method, which is applied to a gateway, comprising:

[0005] Receiving a user virtual number and access traffic sent by a client, wherein the access traffic is traffic for the client to access a target application;

[0006] Based on the virtual address pool corresponding to each connector, a connector corresponding to the user virtual number is matched from multiple connectors to determine a target connector;

[0007] The user virtual number and the access traffic are forwarded to the target connector, so that the target connector modifies the source address of the client based on the user virtual number to obtain a modified source address, establishes a connection with the target application based on the modified source address information, and forwards the access traffic to the target application, so that the target application identifies the modified source address and responds to the access traffic, and the modified source address is consistent with the user virtual number.

[0008] In one embodiment, the step of matching a connector corresponding to the user virtual number from multiple connectors based on a virtual address pool corresponding to each connector to determine a target connector includes:

[0009] Based on the user virtual number, matching is performed with the virtual address pool in each connector, each of the virtual address pools includes multiple network segments;

[0010] A connector corresponding to the network segment matching the user virtual number is determined as a target connector.

[0011] In one embodiment, the method further comprises:

[0012] If a connector corresponding to the user virtual number is not matched based on the virtual address pool of each connector, a target connector is selected based on a preset selection strategy, and the access traffic is forwarded to the target connector.

[0013] In one embodiment, selecting a target connector based on a preset selection strategy includes:

[0014] Based on the priority of each connector, a target connector group that meets the preset screening conditions is obtained;

[0015] The numbering information is mapped based on a preset hash algorithm to obtain a hash value corresponding to the numbering information, and a target connector matching the hash value is screened out from the target connector group, wherein the numbering information includes the user virtual number and / or application number.

[0016] In one embodiment, the method further comprises:

[0017] If an abnormality is detected in the target connector, an abnormality signal is sent to the management and control system, so that the management and control system updates the routing configuration table based on the abnormality signal to obtain an updated routing configuration table; the routing configuration table indicates that different connectors correspond to different virtual address pools;

[0018] The target connector is updated based on the updated routing configuration table and the user virtual number to obtain an updated target connector.

[0019] In a second aspect, the present application provides a traffic identification method, which is applied to a target connector, wherein the target connector is determined by matching a connector corresponding to a user virtual number from multiple connectors based on a virtual address pool corresponding to each connector by a gateway, and the method comprises:

[0020] Receiving the user virtual number and access traffic sent by the gateway, wherein the user virtual number is received by the gateway from the client, and the access traffic is the traffic of the client accessing the target application;

[0021] The source address of the client is modified based on the user virtual number to obtain a modified source address, and a connection is established with the target application based on the modified source address information, and the access traffic is forwarded to the target application so that the target application recognizes the modified source address and responds to the access traffic, and the modified source address is consistent with the user virtual number.

[0022] In one of the embodiments, a return static route is configured between the target connector and the target application, and the method further includes:

[0023] The response traffic corresponding to the access traffic sent by the target application is received through the return static routing; and the response traffic is sent to the gateway through a preset local loopback interface.

[0024] In a third aspect, the present application provides a traffic identification method, which is applied to a target application, including:

[0025] The modified source address is identified, and the access traffic is responded to. The modified source address is obtained by the target connector modifying the source address of the client based on the user virtual number, and the modified source address is consistent with the user virtual number. The access traffic is the traffic of the client accessing the target application. The target connector is determined by the gateway based on the virtual address pool corresponding to each connector, and the connector corresponding to the user virtual number is matched from multiple connectors. The user virtual number is obtained based on the connection established with the target connection, and the access traffic is received from the target connector.

[0026] In a fourth aspect, the present application further provides a traffic identification device, applied to a gateway, comprising:

[0027] A receiving module, used to receive a user virtual number and access traffic sent by a client, wherein the access traffic is the traffic of the client accessing a target application;

[0028] A matching module, configured to match a connector corresponding to the user virtual number from a plurality of connectors based on a virtual address pool corresponding to each connector, and determine a target connector;

[0029] A forwarding module is used to connect the user virtual number and the target connector so that the target connector modifies the source address of the client based on the user virtual number to obtain a modified source address, establishes a connection with the target application based on the modified source address information, and forwards the access traffic to the target application, so that the target application identifies the modified source address and responds to the access traffic, and the modified source address is consistent with the user virtual number.

[0030] In a fifth aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0031] Receiving a user virtual number and access traffic sent by a client, wherein the access traffic is traffic for the client to access a target application;

[0032] Based on the virtual address pool corresponding to each connector, a connector corresponding to the user virtual number is matched from multiple connectors to determine a target connector;

[0033] The user virtual number and the access traffic are forwarded to the target connector, so that the target connector modifies the source address of the client based on the user virtual number to obtain a modified source address, establishes a connection with the target application based on the modified source address information, and forwards the access traffic to the target application, so that the target application identifies the modified source address and responds to the access traffic, and the modified source address is consistent with the user virtual number.

[0034] In a sixth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0035] Receiving a user virtual number and access traffic sent by a client, wherein the access traffic is traffic for the client to access a target application;

[0036] Based on the virtual address pool corresponding to each connector, a connector corresponding to the user virtual number is matched from multiple connectors to determine a target connector;

[0037] The user virtual number and the access traffic are forwarded to the target connector, so that the target connector modifies the source address of the client based on the user virtual number to obtain a modified source address, establishes a connection with the target application based on the modified source address information, and forwards the access traffic to the target application, so that the target application identifies the modified source address and responds to the access traffic, and the modified source address is consistent with the user virtual number.

[0038] In a seventh aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0039] Receiving a user virtual number and access traffic sent by a client, wherein the access traffic is traffic for the client to access a target application;

[0040] Based on the virtual address pool corresponding to each connector, a connector corresponding to the user virtual number is matched from multiple connectors to determine a target connector;

[0041] The user virtual number and the access traffic are forwarded to the target connector, so that the target connector modifies the source address of the client based on the user virtual number to obtain a modified source address, establishes a connection with the target application based on the modified source address information, and forwards the access traffic to the target application, so that the target application identifies the modified source address and responds to the access traffic, and the modified source address is consistent with the user virtual number.

[0042] The above-mentioned traffic identification method, device and computer equipment match the virtual address pool corresponding to multiple connectors through the user virtual number, determine the target connector, forward the user virtual number and access traffic to the target connector, and realize load balancing of traffic by multiple connectors; modify the source address of the client to the user virtual number through the target connector to obtain the modified source address; establish a connection with the target application through the modified source address, and forward the access traffic to the target application. The target application can identify and respond to the access traffic based on the modified source address, thereby improving the accuracy of identifying users when users access the target application. At the same time, the virtual address is used as a benchmark to facilitate the subsequent security policy management and traffic auditing of the target application, thereby improving the security of access to the application. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 A schematic diagram of a flow identification system in one embodiment;

[0045] Figure 2 A flow chart of a flow identification method in one embodiment;

[0046] Figure 3 A schematic diagram of a flow identification system in one embodiment;

[0047] Figure 4 A flow chart of a flow identification method in one embodiment;

[0048] Figure 5 A flow chart of a flow identification method in one embodiment;

[0049] Figure 6 An interactive diagram of a traffic identification method in one embodiment;

[0050] Figure 7 is a structural block diagram of a flow identification device in one embodiment;

[0051] Figure 8 is a structural block diagram of a flow identification device in one embodiment;

[0052] Fig. 9 is a structural block diagram of a flow identification device in one embodiment;

[0053] Fig.10 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] The flow identification method provided in the embodiment of the present application can be applied to Figure 1 In the traffic identification system, the gateway (POP) can establish a connection with the client; the gateway can establish a connection with multiple connectors (connector 1, connector 2, connector 3, ..., connector n), and the connector can establish a connection with the target application. The client and each connector can obtain relevant information from the management and control system.

[0056] The client can be a zero-trust client. The client can be, but is not limited to, various personal computers, laptops, smart phones, tablets, IoT devices, and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The connector can be deployed in the core network of the intranet where the target application is located, and multiple connectors are supported.

[0057] The target application may include security devices and applications. The target application may be an application server, an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services.

[0058] In an exemplary embodiment, Figure 2 As shown, a flow identification method is provided, which is applied to Figure 1 The method includes the following steps:

[0059] Step 201: Receive the user virtual number and access traffic sent by the client.

[0060] The user virtual number may represent the identity of the user, each user corresponds to a user virtual number, and the user virtual number may be a virtual IP. The access traffic may be the traffic of the client accessing the target application.

[0061] Specifically, when the management and control system detects that a user is registering for the first time, it can assign a user virtual number to the user. The management and control system can store the user and the user virtual number bound to the user. The client detects the user's login signal and obtains the user virtual number corresponding to the user from the management and control system. The client can establish a long connection with the gateway and carry the user virtual number. After establishing a long connection with the gateway, the client can forward the access traffic to the gateway based on the established long connection. Optionally, the client can establish a long connection with the gateway and then forward the user virtual code and access traffic to the gateway.

[0062] In addition, when a user registers for the first time in the management and control system, the management and control platform can determine whether to assign a user virtual number to the user according to the actual application environment. For example, when the virtual address network segment resources of the current system are sufficient, the management and control platform can choose not to match the user virtual number for the user, but can match the user number for the user; however, when the virtual address network segment resources of the current system are limited and there are many users, the management and control system needs to assign a user virtual number to the user.

[0063] Step 202: Based on the virtual address pool corresponding to each connector, a connector corresponding to the user virtual number is matched from multiple connectors to determine a target connector.

[0064] The virtual address pool may be a virtual IP network segment pool.

[0065] Specifically, the gateway can obtain a routing configuration table from the management and control system, and the routing configuration table can include non-overlapping virtual address pools configured for each connector. The gateway can match the connector with the user's virtual number from multiple connectors according to the virtual address pools corresponding to each connector, and determine the connector that successfully matches the user's virtual number with the virtual address pool of the connector as the target connector. In addition, if the gateway does not find a connector that matches the user's virtual number, it can select the target connector corresponding to the user's virtual number according to other rules for selecting connectors.

[0066] Step 203: forward the user virtual number and access traffic to the target connector, so that the target connector modifies the source address of the client based on the user virtual number to obtain the modified source address, establishes a connection with the target application based on the modified source address information, and forwards the access traffic to the target application, so that the target application identifies the modified source address and responds to the access traffic.

[0067] The modified source address is consistent with the user's virtual number.

[0068] Specifically, the gateway can forward the user virtual number and access traffic to the target connector. If the user virtual number is included in the virtual address pool in the target connector, the target connector can modify the source address of the client based on the user virtual number to obtain the modified source address. The target connector initiates a transmission control protocol connection to the target application through the target virtual address. The target connector can forward the access traffic to the target application based on the connection established with the target application. The target application can obtain the virtual address pool of each connector in advance. The security device in the target application can identify whether the modified source address belongs to the virtual address pool configured for each connector. If the modified source address belongs to the virtual address pool configured for each connector, the security device in the target application can respond based on the access traffic, obtain the response traffic, and return the response traffic to the client by the original route. If the modified source address does not belong to the virtual address pool configured for each connector, the security device in the target application can intercept the access traffic.

[0069] Exemplarily, the gateway may transmit the user virtual number to the target connector through a tag-length-value (tlv) protocol.

[0070] The above-mentioned traffic identification method matches the virtual address pools corresponding to multiple connectors through the user virtual number, determines the target connector, forwards the user virtual number and the access traffic to the target connector, and realizes load balancing of traffic by multiple connectors; modifies the source address of the client to the user virtual number through the target connector to obtain the modified source address; establishes a connection with the target application through the modified source address, and forwards the access traffic to the target application. The target application can identify and respond to the access traffic based on the modified source address, thereby improving the accuracy of identifying users when users access the target application. At the same time, the virtual address is used as a benchmark to facilitate the subsequent security policy management and traffic auditing of the target application, thereby improving the security of access to the application.

[0071] In an exemplary embodiment, the specific implementation process of step 202 may include:

[0072] Based on the user virtual number, the virtual address pools in each connector are matched respectively; the connector corresponding to the network segment matching the user virtual number is determined as the target connector.

[0073] Each virtual address pool includes multiple network segments.

[0074] Specifically, the gateway can obtain the identity document (id) information of each connector from the management and control system, as well as the virtual address pool corresponding to each connector, which includes multiple virtual address segments. The gateway can match the multiple virtual address segments included in the virtual address pool in each connector based on the user virtual number. If the multiple virtual address segments corresponding to a connector include the user virtual number, the gateway determines that the user virtual number matches the connector successfully, and then determines the connector as the target connector corresponding to the user virtual number. Exemplarily, taking a connector as an example, the virtual address segment corresponding to the connector can be 10.10.40.16 / 24. If the user virtual number is within the range of 10.10.40.16 / 24, the connector is determined as the target connector. It should be understood that the examples given here are only for illustration and do not constitute specific limitations.

[0075] In this embodiment, the user virtual number is matched to the target connector, so that one user virtual number is bound to one connector, and access traffic is forwarded to the corresponding connector according to the user virtual number, thereby achieving load balancing.

[0076] In an exemplary embodiment, the traffic identification method further includes:

[0077] If a connector corresponding to the user's virtual number is not matched based on the virtual address pool of each connector, a target connector is selected based on a preset selection strategy, and the access traffic is forwarded to the target connector.

[0078] Specifically, when there are many users but limited virtual address segment resources, when the gateway matches the corresponding target connector based on the user's virtual number, the user's virtual number will be within the range of the virtual address segments configured for all connectors. If the gateway does not match the connector corresponding to the user's virtual number based on the virtual address pool of each connector, it can process the user's virtual number based on the preset selection strategy to determine the target connector. The gateway can forward the access traffic to the target connector. The target connector can forward the access traffic to the target application. The target application can respond to the access traffic, obtain response traffic, and forward the response traffic to the client along the original route. Optionally, the target connector can establish a connection with the target application based on its own IP and forward the access traffic to the target application. The target application can forward the response traffic to the corresponding target connector based on the IP of the target connector.

[0079] In this embodiment, when a connector corresponding to the user's virtual number is not matched, a preset selection strategy is used to select a target connector, thereby ensuring that the user's access traffic can be responded to normally.

[0080] In an exemplary embodiment, the specific implementation process of the step “selecting a target connector based on a preset selection strategy” may include:

[0081] Based on the priority of each connector, a target connector group that meets the preset screening condition is obtained; based on a preset hash algorithm, the numbering information is mapped to obtain a hash value corresponding to the numbering information, and in the target connector group, a target connector matching the hash value is screened out.

[0082] The gateway establishes connections with multiple connectors, and the numbering information includes a user number and / or an application number.

[0083] Specifically, the gateway may obtain the priority of each connector, and determine one or more connectors whose priorities meet a preset threshold as a target connector group that meets a preset screening condition. The gateway may calculate the user number based on a preset hash algorithm to obtain a hash value corresponding to the user number. Based on the hash value corresponding to the user number, the user number is mapped to a connector in the target connector group that matches the hash value. The gateway may determine the connector that matches the hash value as the target connector.

[0084] Optionally, the gateway may calculate the user number and the application code based on a preset hash algorithm to obtain a hash value corresponding to the user number and the application code. Based on the hash value corresponding to the user number and the application code, the user number is mapped to a connector in the target connector group that matches the hash value. The gateway may determine the connector that matches the hash value as the target connector.

[0085] Exemplarily, the gateway may group and sort the connectors from high to low according to the priority of each connector, group connectors with priorities within a certain range or the same into a connector group, and select the connector group with the highest priority as the target connector group that meets the preset screening conditions.

[0086] In addition, due to different rules for selecting connectors, the same user may correspond to different target connectors under different selection rules. Different target connectors have different virtual address pools, that is, the same user will be mapped to different target virtual addresses on different target connectors.

[0087] In this embodiment, the user code of each user can be forwarded to different connectors through gateway matching, so that load balancing can be achieved even in the case of multiple connectors.

[0088] In an exemplary embodiment, the traffic identification method further includes:

[0089] If an abnormality is detected in the target connector, an abnormal signal is sent to the management and control system, so that the management and control system updates the routing configuration table based on the abnormal signal to obtain an updated routing configuration table; the target connector is updated based on the updated routing configuration table and the user virtual number to obtain an updated target connector.

[0090] The abnormal signal may indicate that the target connector itself is abnormal or that the connection between the target connector and the gateway is abnormal. The routing configuration table may indicate different virtual address pools corresponding to different connectors.

[0091] Specifically, Figure 3 As shown, after the gateway establishes a connection with the target connector, the gateway can monitor the abnormality of the target connector. If the connection between the gateway and the target connector is abnormal or the target connector itself is abnormal, it is determined that the target connector is abnormal and sends an abnormal signal to the management and control system. Based on the received abnormal signal, the management and control system can remove the abnormal target connector from the routing configuration table and generate a new routing configuration table. The gateway can obtain a new routing configuration table from the management and control system, and select a new connector from the updated routing configuration table as the target connector based on the user number. The gateway can adjust the forwarding path of the traffic in time according to the new target connector, and transfer the traffic of the original abnormal target connector to the new target connector. Optionally, the gateway can establish a Transmission Control Protocol (TCP) long connection to each connector.

[0092] In addition, when the gateway detects that the target connector before the update has returned to normal, the gateway can perceive that a long connection has been established with the target connector before the update and restore the previous forwarding path.

[0093] In this embodiment, by timely adjusting the forwarding path of the target connector that has an abnormality, it is ensured that the traffic can be forwarded to the target application even when the target connector has an abnormality, thereby ensuring the normal operation of the traffic forwarding function.

[0094] In an exemplary embodiment, Figure 4 As shown, a flow identification method is provided, which is applied to Figure 1 The target connector in is used as an example for explanation. The target connector is determined by the gateway by matching the connector corresponding to the user's virtual number from multiple connectors based on the virtual address pool corresponding to each connector. The method includes the following steps:

[0095] Step 401: Receive the user virtual number and access traffic sent by the gateway.

[0096] The user virtual number may be received by the gateway from the client, and the access traffic may be the traffic of the client accessing the target application.

[0097] Step 402: modify the source address of the client based on the user virtual number to obtain a modified source address, establish a connection with the target application based on the modified source address information, and forward the access traffic to the target application so that the target application can identify the modified source address and respond to the access traffic.

[0098] The modified source address is consistent with the user's virtual number.

[0099] Specifically, if the user virtual number is included in the virtual address pool in the target connector, the target connector can modify the source address of the client based on the user virtual number to obtain the modified source address. The target connector initiates a transmission control protocol connection to the target application through the target virtual address. The target connector can forward the access traffic to the target application based on the connection established with the target application. The target application can obtain the virtual address pool of each connector in advance. The security device in the target application can identify whether the modified source address belongs to the virtual address pool configured for each connector. If the modified source address belongs to the virtual address pool configured for each connector, the security device in the target application can respond based on the access traffic, obtain the response traffic, and return the response traffic to the client by the original route. If the modified source address does not belong to the virtual address pool configured for each connector, the security device in the target application can intercept the access traffic.

[0100] The above-mentioned traffic identification method matches the virtual address pools corresponding to multiple connectors through the user virtual number, determines the target connector, forwards the user virtual number and the access traffic to the target connector, and realizes load balancing of traffic by multiple connectors; modifies the source address of the client to the user virtual number through the target connector to obtain the modified source address; establishes a connection with the target application through the modified source address, and forwards the access traffic to the target application. The target application can identify and respond to the access traffic based on the modified source address, thereby improving the accuracy of identifying users when users access the target application. At the same time, the virtual address is used as a benchmark to facilitate the subsequent security policy management and traffic auditing of the target application, thereby improving the security of access to the application.

[0101] In an exemplary embodiment, the traffic identification method further includes:

[0102] Receive the response traffic corresponding to the access traffic sent by the target application through the return static route; send the response traffic to the gateway through the preset local loopback interface.

[0103] Among them, a return static route is configured between the target connector and the target application.

[0104] A return static route is configured between the target connector and the target application.

[0105] Specifically, for the virtual address pool of each connector, a return static route from the connector to the target application is configured in the network, and the network segment corresponding to the virtual address pool in the connector can return the response traffic of the access traffic to the corresponding connector through the return static route. Each connector can send the traffic data of the virtual address pool configured on the local machine to the preset local loopback interface, and the traffic data can be returned to the client through the preset local loopback interface.

[0106] The target connector can receive the response traffic corresponding to the access traffic sent by the target application through the return static route. The target connector sends the received response traffic to the preset local loopback interface and sends it to the gateway through the preset local loopback interface. The gateway can return the response traffic to the client.

[0107] In this embodiment, by configuring the return static route, the response traffic of the target application can be returned to the target connector and returned to the client by the original route. This can ensure that the target application can accurately send the response traffic to the target connector and return the response traffic to the client by the original route under the premise of the virtual address.

[0108] In an exemplary embodiment, Figure 5 As shown, a flow identification method is provided, which is applied to Figure 1The target application in is taken as an example. The method includes the following steps:

[0109] Step 501: Identify the modified source address and respond to the access traffic.

[0110] Among them, the modified source address is obtained by the target connector modifying the client's source address based on the user virtual number. The modified source address is consistent with the user virtual number. The access traffic is the traffic of the client accessing the target application. The target connector is determined by the gateway based on the virtual address pool corresponding to each connector, and the connector corresponding to the user virtual number is matched from multiple connectors. The user virtual number is obtained based on the connection established with the target connection, and the access traffic is received from the target connector.

[0111] Specifically, the gateway can forward the user virtual number and access traffic to the target connector. If the user virtual number is included in the virtual address pool in the target connector, the target connector can modify the source address of the client based on the user virtual number to obtain the modified source address. The target connector initiates a transmission control protocol connection to the target application through the target virtual address. The target connector can forward the access traffic to the target application based on the connection established with the target application. The target application can obtain the virtual address pool of each connector in advance. The security device in the target application can identify whether the modified source address belongs to the virtual address pool configured for each connector. If the modified source address belongs to the virtual address pool configured for each connector, the security device in the target application can respond based on the access traffic, obtain the response traffic, and return the response traffic to the client by the original route. If the modified source address does not belong to the virtual address pool configured for each connector, the security device in the target application can intercept the access traffic.

[0112] The above-mentioned traffic identification method matches the virtual address pools corresponding to multiple connectors through the user virtual number, determines the target connector, forwards the user virtual number and the access traffic to the target connector, and realizes load balancing of traffic by multiple connectors; modifies the source address of the client to the user virtual number through the target connector to obtain the modified source address; establishes a connection with the target application through the modified source address, and forwards the access traffic to the target application. The target application can identify and respond to the access traffic based on the modified source address, thereby improving the accuracy of identifying users when users access the target application. At the same time, the virtual address is used as a benchmark to facilitate the subsequent security policy management and traffic auditing of the target application, thereby improving the security of access to the application.

[0113] In one example, the target application may have the functions of allowing access traffic, denying access traffic, and auditing access traffic. The security device and application may reverse-check the received modified source address according to the virtual address pool of the target connector to obtain the user virtual number, and the identity of the accessing user may be determined based on the user virtual number.

[0114] In this embodiment, the target application can determine the corresponding user through the modified source address, and reversely identify the user through the modified source address, so as to more accurately identify user information, facilitate security policy management and traffic auditing based on the virtual address, and ensure the security of user access to the target application.

[0115] In one instance, when the target connector corresponding to the virtual IP does not fail, when the same user logs in to the client using the user virtual number, a user will be bound to a target connector by default. After the user logs in to the zero-trust client, the user virtual number is bound to the user account, and the user virtual number will not be recycled. The user virtual number is renewed each time the user logs in to ensure that the user virtual number corresponding to each user is fixed and does not change each time the user logs in, which is convenient for auditing and traffic analysis devices to build context. When the management and control system detects that the time since the user last logged in to the client exceeds the preset recycling time threshold, the user virtual number renewal will not be reported, and the management and control system will recycle the user virtual number resource.

[0116] In an exemplary embodiment, Figure 6 As shown, an interactive diagram of a traffic identification method is provided, which specifically includes the following steps:

[0117] Step 601: The management and control system allocates a user virtual IP to the user. The management and control system may set a non-overlapping virtual IP network segment pool for each connector.

[0118] Step 602: When a user logs in to the zero-trust client, the user's virtual IP is obtained from the management and control system, and the virtual IP is renewed regularly.

[0119] Step 603: The gateway obtains the virtual IP segment pool corresponding to each connector from the management and control system.

[0120] Step 604: Each connector obtains its own virtual IP network segment pool from the management and control system and loads it into the memory.

[0121] Step 605: The zero-trust client can establish a long connection to the gateway, report the user's virtual IP to the gateway, and then divert the access traffic to the gateway.

[0122] Step 606: The gateway matches the virtual IP segments corresponding to all connectors based on the user virtual IP. If the match is successful, the successfully matched connector is selected as the target connector. If the match is unsuccessful, the target connector is determined according to the preset selection strategy.

[0123] Step 607: If the match is successful, the gateway will forward the access traffic to the target connector carrying the user's virtual IP; if the match is unsuccessful, the gateway will forward the access traffic to the target connector.

[0124] Step 608: The target connector determines whether the user's virtual IP is in its own virtual IP network segment pool.

[0125] Step 609: If the user's virtual IP is not in the virtual IP segment pool, the target connector forwards the access traffic to the target application; if the user's virtual IP is in the virtual IP segment pool, the target connector modifies the client's source IP based on the user's virtual IP, and establishes a connection with the target application based on the user's virtual IP, and forwards the access traffic to the target application.

[0126] Step 610: The target application identifies the virtual IP and responds to the access traffic to obtain response traffic, or the target application responds to the access traffic to obtain response traffic.

[0127] Step 611: The target application forwards the response traffic to the target connector based on the return static route established between the target application and the target connector.

[0128] Step 612: The target connector sends the response traffic to the gateway based on the loopback port.

[0129] Step 613: The gateway forwards the response traffic to the client and displays it on the client.

[0130] In this embodiment, the embodiment of the present application does not require development and changes on the application side under the zero-trust network architecture, and has good universality. The embodiment of the present application binds a unique virtual IP to each employee, preferentially forwards the employee traffic to the connector where the virtual IP is located, and uses the virtual IP as the source address on the connector to access the target application, thereby solving the problem that the source IP is uniformly rewritten as the connector IP, resulting in the inability to identify the employee traffic. At the same time, to ensure the high availability of the connector, multiple connectors are supported to load balance the traffic. The embodiment of the present application has the characteristics of simple implementation, strong scalability and wide application range.

[0131] Under the zero-trust network architecture of the embodiment of the present application, through the virtual IP address (VIP) mechanism, the target application can identify different user accesses and perform tasks such as traffic statistics, restrictions and audits on demand. The application side does not need to be developed or modified, and has better applicability; it is also applicable to scenarios where each data packet needs to have a VIP; the connector side supports cluster mode deployment to achieve high availability; and effectively reduces the consumption of virtual IP segment resources.

[0132] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0133] Based on the same inventive concept, the embodiment of the present application also provides a flow identification device for implementing the flow identification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more flow identification device embodiments provided below can refer to the limitations on the flow identification method above, and will not be repeated here.

[0134] In an exemplary embodiment, Figure 7 As shown, a traffic identification device 70 is provided, which is applied to a gateway and includes: a receiving module 71, a matching module 72 and a forwarding module 73, wherein:

[0135] The receiving module 71 is used to receive the user virtual number and access traffic sent by the client, where the access traffic is the traffic used by the client to access the target application;

[0136] A matching module 72, configured to match a connector corresponding to a user virtual number from a plurality of connectors based on a virtual address pool corresponding to each connector, and determine a target connector;

[0137] The forwarding module 73 is used to connect the user virtual number and the target connector so that the target connector modifies the source address of the client based on the user virtual number to obtain the modified source address, establishes a connection with the target application based on the modified source address information, and forwards the access traffic to the target application, so that the target application identifies the modified source address and responds to the access traffic, and the modified source address is consistent with the user virtual number.

[0138] In one embodiment, the matching module 72 is used to match the virtual address pools in each connector based on the user virtual number, each of the virtual address pools includes multiple network segments;

[0139] A connector corresponding to the network segment matching the user virtual number is determined as a target connector.

[0140] In one embodiment, the matching module 72 is further used to select a target connector based on a preset selection strategy and forward the access traffic to the target connector if a connector corresponding to the user virtual number is not matched based on the virtual address pool of each connector.

[0141] In one embodiment, the matching module 72 is further configured to obtain a target connector group that meets a preset screening condition based on the priority of each connector;

[0142] The numbering information is mapped based on a preset hash algorithm to obtain a hash value corresponding to the numbering information, and a target connector matching the hash value is screened out from the target connector group, wherein the numbering information includes the user virtual number and / or application number.

[0143] In one embodiment, the matching module 72 is further configured to send an abnormality signal to the management and control system if an abnormality is detected in the target connector, so that the management and control system updates the routing configuration table based on the abnormality signal to obtain an updated routing configuration table; the routing configuration table indicates that different connectors correspond to different virtual address pools;

[0144] The target connector is updated based on the updated routing configuration table and the user virtual number to obtain an updated target connector.

[0145] In an exemplary embodiment, Figure 8 As shown, a flow identification device 80 is provided, comprising: a receiving module 81 and a modifying module 82, wherein:

[0146] The receiving module 81 is used to receive the user virtual number and access traffic sent by the gateway, the user virtual number is received by the gateway from the client, and the access traffic is the traffic of the client accessing the target application;

[0147] The modification module 82 is used to modify the source address of the client based on the user virtual number to obtain a modified source address, establish a connection with the target application based on the modified source address information, and forward the access traffic to the target application so that the target application can identify the modified source address and respond to the access traffic, and the modified source address is consistent with the user virtual number.

[0148] In one of the embodiments, the receiving module 81 is further used to receive the response traffic corresponding to the access traffic sent by the target application through the return static route; and send the response traffic to the gateway through a preset local loopback interface.

[0149] In an exemplary embodiment, Fig. 9 As shown, a flow identification device 90 is provided, comprising: an identification module 91, wherein:

[0150] The identification module 91 is used to identify the modified source address and respond to the access traffic. The modified source address is obtained by modifying the source address of the client based on the user virtual number by the target connector. The modified source address is consistent with the user virtual number. The access traffic is the traffic of the client accessing the target application. The target connector is determined by the gateway based on the virtual address pool corresponding to each connector, and the connector corresponding to the user virtual number is matched from multiple connectors. The user virtual number is obtained based on the connection established with the target connection, and the access traffic is received from the target connector.

[0151] Each module in the above-mentioned traffic identification device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0152] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Fig.10As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a traffic identification method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0153] Those skilled in the art will understand that Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0154] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0155] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0156] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0157] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0158] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0159] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0160] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A flow identification method, characterized in that: Applied to a gateway, the method comprises: Receiving a user virtual number and access traffic sent by a client, wherein the access traffic is traffic for the client to access a target application; Based on the virtual address pool corresponding to each connector, a connector corresponding to the user virtual number is matched from multiple connectors to determine a target connector; The user virtual number and the access traffic are forwarded to the target connector, so that the target connector modifies the source address of the client based on the user virtual number to obtain a modified source address, establishes a connection with the target application based on the modified source address information, and forwards the access traffic to the target application, so that the target application identifies the modified source address and responds to the access traffic, and the modified source address is consistent with the user virtual number.

2. The method according to claim 1, characterized in that The step of matching a connector corresponding to the user virtual number from multiple connectors based on a virtual address pool corresponding to each connector to determine a target connector includes: Based on the user virtual number, matching is performed with the virtual address pool in each connector, each of the virtual address pools includes multiple network segments; A connector corresponding to the network segment matching the user virtual number is determined as a target connector.

3. The method according to claim 1, characterized in that The method further comprises: If a connector corresponding to the user virtual number is not matched based on the virtual address pool of each connector, a target connector is selected based on a preset selection strategy, and the access traffic is forwarded to the target connector.

4. The method according to claim 3, characterized in that The selecting a target connector based on a preset selection strategy includes: Based on the priority of each connector, a target connector group that meets the preset screening conditions is obtained; The numbering information is mapped based on a preset hash algorithm to obtain a hash value corresponding to the numbering information, and a target connector matching the hash value is screened out from the target connector group, wherein the numbering information includes the user virtual number and / or application number.

5. The method according to claim 1, characterized in that The method further comprises: If an abnormality is detected in the target connector, an abnormality signal is sent to the management and control system, so that the management and control system updates the routing configuration table based on the abnormality signal to obtain an updated routing configuration table; the routing configuration table indicates that different connectors correspond to different virtual address pools; The target connector is updated based on the updated routing configuration table and the user virtual number to obtain an updated target connector.

6. A flow identification method, characterized in that: Applied to a target connector, the target connector is determined by a gateway matching a connector corresponding to a user virtual number from multiple connectors based on a virtual address pool corresponding to each connector, the method comprising: Receiving the user virtual number and access traffic sent by the gateway, wherein the user virtual number is received by the gateway from the client, and the access traffic is the traffic of the client accessing the target application; The source address of the client is modified based on the user virtual number to obtain a modified source address, and a connection is established with the target application based on the modified source address information, and the access traffic is forwarded to the target application so that the target application recognizes the modified source address and responds to the access traffic, and the modified source address is consistent with the user virtual number.

7. The method according to claim 6, characterized in that A return static route is configured between the target connector and the target application, and the method further includes: The response traffic corresponding to the access traffic sent by the target application is received through the return static routing; and the response traffic is sent to the gateway through a preset local loopback interface.

8. A flow identification method, characterized in that: Applied to the target application, the method comprises: The modified source address is identified, and the access traffic is responded to. The modified source address is obtained by the target connector modifying the source address of the client based on the user virtual number, and the modified source address is consistent with the user virtual number. The access traffic is the traffic of the client accessing the target application. The target connector is determined by the gateway based on the virtual address pool corresponding to each connector, and the connector corresponding to the user virtual number is matched from multiple connectors. The user virtual number is obtained based on the connection established with the target connection, and the access traffic is received from the target connector.

9. A flow identification device, characterized in that: Applied to a gateway, the device comprises: A receiving module, used to receive a user virtual number and access traffic sent by a client, wherein the access traffic is the traffic of the client accessing a target application; A matching module, configured to match a connector corresponding to the user virtual number from a plurality of connectors based on a virtual address pool corresponding to each connector, and determine a target connector; A forwarding module is used to connect the user virtual number and the target connector so that the target connector modifies the source address of the client based on the user virtual number to obtain a modified source address, establishes a connection with the target application based on the modified source address information, and forwards the access traffic to the target application, so that the target application identifies the modified source address and responds to the access traffic, and the modified source address is consistent with the user virtual number.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images