A SDP gateway access authentication data transmission method based on multi-link aggregation

Abstract

The embodiment of the application discloses a kind of based on the data transmission method of SDP gateway access authentication of multi-link aggregation, and the embodiment of the application is deeply fused by SDP framework and multi-link aggregation technology, completes link quality evaluation and dynamic binding in two-way authentication stage, and realizes data fragment encryption transmission based on service demand and security score.This method supports cross-link redundancy check and millisecond-level fault switching, solves the problems of single point failure, low bandwidth utilization and insufficient security protection in traditional scheme, significantly improves the reliability, security and efficiency of data transmission.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical fields of network security and data transmission, and in particular to a SDP gateway access authentication data transmission method based on multi-link aggregation. Background Art

[0002] As network environments become increasingly complex, traditional SDP architectures rely on a single link for authentication and data transmission, creating a single point of failure and failing to fully utilize the bandwidth resources of multiple links. Existing multi-link aggregation technologies primarily focus on bandwidth aggregation but lack deep integration with the SDP security framework. This results in the authentication process being rigidly tied to the data transmission link, making it difficult to dynamically adapt to network fluctuations or security threats.

[0003] In addition, traditional solutions have certain shortcomings in link selection, load balancing, and cross-link security protection:

[0004] Authentication and link separation: After authentication is completed, the link is fixed and cannot be dynamically adjusted according to the real-time network status;

[0005] Insufficient security redundancy: In multi-link scenarios, there is no cross-link protection mechanism against link hijacking or man-in-the-middle attacks.

[0006] Low resource utilization: The lack of intelligent scheduling strategies based on service type and link quality leads to conflicts between high-priority services and low-security links. Summary of the Invention

[0007] To this end, an embodiment of the present invention provides an SDP gateway access authentication data transmission method based on multi-link aggregation to solve the technical problems of the existing technology such as blurred network boundaries, inability to cope with dynamic and distributed network environments, lack of fine-grained control, complex policy maintenance, and difficulty in adapting to multi-cloud environments.

[0008] In order to achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0009] According to a first aspect of an embodiment of the present invention, a method for transmitting SDP gateway access authentication data based on multi-link aggregation is provided, the method comprising:

[0010] S1. Obtain user requirements and verify the identities of the terminal and the SDP gateway according to the two-way authentication protocol and the user requirements, and simultaneously report the terminal's available link information and link quality score during the authentication process;

[0011] S2, the SDP controller dynamically binds the primary link and the backup link based on the link quality score and service requirements, and generates a dynamic token bound to the link;

[0012] S3: The sender fragments the data according to the link bandwidth ratio. After fragmentation, the data is encrypted and transmitted in parallel through multiple links. The sender dynamically adjusts the fragmentation ratio based on the real-time bandwidth of each link. The receiver reassembles the data based on the redundancy check code.

[0013] S4. Real-time monitoring of link status. When a link anomaly or security threat is detected, the link switching process is triggered to adjust to the backup link and update the dynamic token and encryption key;

[0014] The link quality score is calculated by weighting the latency, packet loss rate, historical security records, and encryption strength.

[0015] Furthermore, the two-way authentication protocol is the TLS1.3 protocol, and the terminal and the SDP gateway complete two-way identity authentication through digital certificates.

[0016] Furthermore, the SDP controller dynamically binds the primary link and the backup link based on the link quality score and service requirements, and generates a dynamic token bound to the link, including:

[0017] The dynamic token includes a link identifier, an encryption key and a validity period, and is used to verify data transmission authority and link legitimacy.

[0018] Furthermore, the encrypted transmission of the fragmented data adopts IPSec protocol or MACsec protocol, and each fragment is transmitted through an independent encrypted channel.

[0019] Furthermore, the receiving end reconstructs the data based on the redundancy check code, including:

[0020] The redundant check code adopts forward error correction coding, and a cross-link retransmission request is triggered when the receiving end detects that a fragment is lost.

[0021] Furthermore, the link abnormality includes a link quality score being lower than a preset threshold, a DDoS attack being detected, or a packet loss rate exceeding a service tolerance threshold.

[0022] Furthermore, the encryption key is dynamically rotated according to a preset time threshold or a data transmission volume threshold, and the maximum rotation period is 24 hours.

[0023] Furthermore, the business requirements include real-time performance, bandwidth requirements, and data sensitivity, and high-security links are given priority in allocating sensitive data transmission tasks.

[0024] Furthermore, when the standby link is switched, the SDP controller synchronously updates the link identifier and encryption key of the dynamic token, and notifies the terminal to rebind the link.

[0025] Further, the method further comprises obtaining a current network topology and a binding policy of each link, and dynamically optimizing the network topology according to the current network topology and the binding policy.

[0026] The embodiment of the application has the following advantages:

[0027] The embodiment of the application deeply integrates the SDP architecture and the multi-link aggregation technology, completes link quality evaluation and dynamic binding in the bidirectional authentication stage, and realizes data fragmentation encryption transmission based on service requirements and security scores. The method supports cross-link redundancy check and millisecond-level fault switching, solves the problems of single-point failure, low bandwidth utilization and insufficient security protection in the traditional scheme, and significantly improves the reliability, security and efficiency of data transmission. BRIEF DESCRIPTION OF DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the application or the technical solutions in the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only exemplary, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of the provided drawings.

[0029] The structures, proportions, sizes, etc. shown in the specification are only used to cooperate with the content disclosed in the specification, to be understood and read by those skilled in the art, and do not define the limiting conditions for the implementation of the application, so they do not have technical significance. Any modification of structure, change of proportion relationship or adjustment of size, without affecting the effect and purpose that can be achieved by the application, should still fall within the scope of the technical content disclosed by the application.

[0030] Figure 1 A schematic diagram of changes in network security boundaries in the prior art;

[0031] Figure 2 A flowchart of a multi-link aggregation-based SDP gateway access authentication data transmission method provided by the embodiment of the application;

[0032] Figure 3 A schematic diagram of the construction of a multi-link aggregation-based SDP gateway access authentication data transmission method provided by the embodiment of the application;

[0033] Figure 4 A schematic diagram of the architecture of a multi-link aggregation-based SDP gateway access authentication data transmission method provided by the embodiment of the application. DETAILED DESCRIPTION

[0034] The following embodiments of the application are explained by way of specific examples only, and other advantages and benefits will be apparent to those skilled in the art upon consideration of the disclosure herein. It is to be understood that the examples described herein are merely exemplary and are not intended to be limiting. All other examples arising from the disclosure herein are contemplated as falling within the scope of the application.

[0035] Reference Figure 1 With the emergence of new IT technologies such as cloud computing, BYOD (mobile office), it is more and more difficult to define the network security boundary. The complex network access environment, large number of network assets and ubiquitous security threats (DDOS, phishing attacks, APT, scanning, penetration, dictionary attack, etc.) are constantly threatening enterprise security. In recent years, with the rapid development and application of mobile Internet technology, more and more enterprise personnel tend to work mobile; the network use of users is highly dynamic, and a user may have different roles at the same time, and the application services and resources accessed by different roles may be different or cross. This new way of working has also caused changes in the new system boundary, and the boundary has become more complex and blurred. The traditional protection scheme based on fixed boundary has begun to gradually fail, and a new security model is needed to cope with the security threats brought by cloud computing.

[0036] Traditional network security relies on a series of products such as FW, WAF, IDS, IPS, etc. for security protection. Although they seem to be full of choices, they are actually not as good as they seem. The security operation and maintenance personnel are required to be high, and even if various security products are deployed, it is still difficult to effectively avoid potential threats such as APT and 0day vulnerabilities. The traditional security protection method is not up to the task. In addition, the TCP / IP architecture has both provided impetus for the rapid development of the Internet and become a soft spot for Internet use. Remote connection security problems have been improved to some extent since the advent of VPN, but they have also extended the problem of difficult control refinement. At the same time, there is no perfect access mechanism, which is also one of the core problems that cannot establish an effective security protection in network use.

[0037] In the TCP / IP network architecture, people overemphasized its development and convenience at the beginning of its design, without carefully considering its security. The feature of connecting first and verifying later inevitably exposes network assets and facilities to the public network. Although its convenience has accelerated the development of the Internet, its security problems are becoming more and more numerous. Network assets and facilities exposed to the public network are very vulnerable to network attacks, resulting in service terminals, data theft, information leakage and other problems. The feature of connecting first and verifying later needs a better solution to stop this weakness.

[0038] In the use of the Internet, limited by the existing technology base and management mechanism, key network assets and facilities are inevitably exposed in the Internet environment without protection, including IP addresses, ports, etc.; and the Internet asset exposure includes open websites, systems, applications, APP interfaces, etc. Network assets themselves may not have security problems, but exposure to the Internet increases security risks. In the traditional network architecture, a firewall is used to build a wall to frame the organization network into an intranet. However, the firewall itself has become a weak link between the intranet and the extranet. With the development of business cloud, the network boundary is blurred, and the role of the firewall is gradually reduced. The application port providing services is always exposed to the Internet due to the dynamic demand of business use. Such network assets and facilities exposed to the public network will face various security threats on the Internet, such as DDOS attacks, port scanning, brute force cracking, etc.

[0039] The traditional border-based network security architecture assumes or defaults that the intranet is secure to some extent, and considers that security is to build a digital moat for the enterprise, and ignores the security of the intranet by using border security products / solutions such as firewalls, WAFs, IPSs, etc. to protect the enterprise network export. At the same time, the traditional security protection concept is to trust but verify, which results in that the border security method of focusing on protecting terminals and networks cannot protect threats based on identity and credentials, and account theft attacks become a perfect cover for data breaches. The core idea of zero trust is: by default, no one / equipment / system inside and outside the network should be trusted, and the trust basis of access control needs to be reconstructed based on authentication and authorization. Zero trust revolutionizes access control in paradigm, leading the security architecture from network centralization to identity centralization, and its essence is to perform access control based on identity.

[0040] SDP (Software Defined Perimeter) is a new network border concept. Defined by the CSA International Cloud Security Alliance, the core idea is that the core network assets and facilities can be hidden by the SDP architecture to avoid exposure to the Internet, greatly reducing various attack behaviors and security threats.

[0041] However, the traditional SDP architecture relies on a single link for authentication and data transmission, which has a single point of failure risk and cannot fully utilize the bandwidth resources of multiple links. Multi-link aggregation technology focuses on bandwidth stacking, but lacks deep integration with the SDP security framework, resulting in fixed binding of the authentication process and data transmission link, which is difficult to dynamically adapt to network fluctuations or security threats.

[0042] In addition, the traditional scheme has deficiencies in link selection, load balancing, and cross-link security protection, for example:

[0043] Authentication and link separation: After authentication is completed, the link is fixed and cannot be dynamically adjusted according to the real-time network status.

[0044] Insufficient security redundancy: No cross-link protection mechanism is designed for link hijacking or man-in-the-middle attacks in multi-link scenarios.

[0045] Low resource utilization: The lack of intelligent scheduling strategies based on service type and link quality leads to conflicts between high-priority services and low-security links.

[0046] In order to solve the above-mentioned technical problems of relying on a single link for authentication and data transmission, there is a risk of single point failure and the bandwidth resources of multiple links cannot be fully utilized. The authentication process is fixedly bound to the data transmission link, making it difficult to dynamically adapt to network fluctuations or security threats.

[0047] refer to Figure 2 The present invention discloses a method for SDP gateway access authentication and data transmission based on multi-link aggregation. By dynamically binding authentication and multi-link resources, the method realizes the coordinated optimization of security authentication, link quality assessment, data fragmentation transmission and dynamic protection, and solves the problems of single point failure, low bandwidth utilization and insufficient security protection in traditional solutions. The method includes:

[0048] S1. Obtain user requirements and verify the identities of the terminal and the SDP gateway according to the two-way authentication protocol and the user requirements, and simultaneously report the terminal's available link information and link quality score during the authentication process;

[0049] S2, the SDP controller dynamically binds the primary link and the backup link based on the link quality score and service requirements, and generates a dynamic token bound to the link;

[0050] S3: The sender fragments the data according to the link bandwidth ratio. After fragmentation, the data is encrypted and transmitted in parallel through multiple links. The sender dynamically adjusts the fragmentation ratio based on the real-time bandwidth of each link. The receiver reassembles the data based on the redundancy check code.

[0051] S4. Monitor the link status in real time. When a link anomaly or security threat is detected, trigger the link switching process to adjust to the backup link and update the dynamic token and encryption key.

[0052] The link quality score is calculated by weighting the latency, packet loss rate, historical security records, and encryption strength.

[0053] Furthermore, the two-way authentication protocol is the TLS1.3 protocol, and the terminal and the SDP gateway complete two-way identity authentication through digital certificates.

[0054] Further, the SDP controller dynamically binds the primary link and the backup link according to the link quality score and the service requirement, and generates a dynamic token bound with the link, wherein the dynamic token comprises a link identifier, an encryption key and a validity period, and is used for verifying data transmission authority and link legality.

[0055] Further, the encrypted transmission of the data fragments adopts an IPSec protocol or a MACsec protocol, and each fragment is transmitted through an independent encrypted channel.

[0056] Further, the receiving end recombines the data based on a redundancy check code, wherein the redundancy check code adopts a forward error correction code, and the receiving end triggers a cross-link retransmission request when detecting that a fragment is lost.

[0057] Further, the link exception comprises that a link quality score is lower than a preset threshold, a DDoS attack is detected or a packet loss rate exceeds a service tolerance threshold range.

[0058] Further, the encryption key is dynamically rotated according to a preset time threshold or a data transmission amount threshold, and a maximum rotation period is 24 hours.

[0059] Further, the service requirement comprises real-time performance, bandwidth requirement and data sensitivity, and a high-security link preferentially allocates a sensitive data transmission task.

[0060] Further, when the backup link is switched, the SDP controller synchronously updates the link identifier and the encryption key of the dynamic token, and notifies the terminal to rebind the link.

[0061] Further, the method further comprises obtaining a current network topology structure and a binding strategy of each link, and dynamically optimizing the network topology according to the current network topology structure and the binding strategy.

[0062] The embodiment of the application has the following beneficial effects:

[0063] Performance improvement: multi-link aggregation improves effective bandwidth by 40%-60% and reduces latency by 20%-30%.

[0064] Security enhancement: the dynamic token and key rotation mechanism resists more than 99% of link hijacking attacks.

[0065] High reliability: link fault switching time is less than or equal to 50 ms, and data packet integrity rate is greater than or equal to 99.9%.

[0066] Reference Figure 3 and Figure 4 The architecture of the embodiment of the application comprises:

[0067] SDP controller: responsible for terminal identity authentication, policy distribution and link security score calculation.

[0068] Multi-link aggregation gateway: Integrates a multi-link management module, dynamic encryption module, and anomaly detection module, supporting wired, wireless, and SD-WAN link aggregation.

[0069] Terminal devices: Deploy lightweight SDP clients to support multi-link detection and dynamic token management.

[0070] Please combine Figures 2 to 4 For reference, the process of the embodiment of the present invention includes:

[0071] Step 1: Bidirectional authentication with multi-link awareness

[0072] The terminal initiates an authentication request to the SDP gateway, and the gateway completes two-way certificate authentication with the terminal using the TLS 1.3 protocol.

[0073] During the authentication process, the terminal synchronously reports available link information (such as Wi-Fi, 5G, and Ethernet), and the gateway generates a link quality score based on latency, packet loss rate, and historical security records.

[0074] Step 2: Dynamic link binding and token allocation

[0075] The SDP controller allocates primary and backup links to terminals based on link scores and service requirements (such as real-time performance and bandwidth requirements), and generates dynamic tokens bound to the links.

[0076] The token contains a link identifier (Link ID), an encryption key, and a validity period, which are used for authorization verification of subsequent data transmission.

[0077] Step 3: Fragmented encryption and multi-link transmission

[0078] The sender fragments the data according to the link bandwidth ratio, and each fragment is transmitted through an independent encryption channel (IPSec or MACsec).

[0079] The receiving end reassembles the data packet based on the redundancy check code (such as FEC). If fragment loss is detected, a cross-link retransmission request is triggered.

[0080] Step 4: Dynamic security protection and link switching

[0081] Monitor link status in real time. If abnormal traffic (such as a DDoS attack) is detected or the link quality falls below the threshold, immediately switch to the backup link and update the token.

[0082] Encryption keys are dynamically rotated based on time or data volume thresholds to avoid security risks caused by long-term use.

[0083] In an embodiment of the present invention, authentication and link binding are integrated, and link quality assessment and binding are completed during the SDP authentication stage, avoiding the defects of the traditional scheme of separating authentication and transmission; cross-link redundant security mechanism: through fragmented encryption, redundant verification and dynamic tokens, seamless switching and data integrity protection under single link failure or attack are achieved; business-driven intelligent scheduling: dynamic allocation of traffic based on business type (such as video, file transfer) and link security score, giving priority to ensuring the transmission of sensitive data on high-security links.

[0084] For example, when an enterprise transmits data across regions, the system is configured first: the SDP gateway is deployed at the corporate headquarters, integrating dedicated lines, 5G and SD-WAN links; branch office terminals are pre-installed with digital certificates to support multi-link access.

[0085] Authentication and link binding are then performed: After the terminal initiates authentication, the gateway detects its available links (5G latency is 30ms, dedicated line latency is 10ms) and calculates the link score (dedicated line security score is 90, 5G score is 70). A highly secure dedicated line is allocated for video conferencing, and a 5G and SD-WAN aggregate link is allocated for file transfer.

[0086] Data transmission and protection: Video streams are transmitted via dedicated lines, and file fragments are encrypted and transmitted in parallel via 5G and SD-WAN. When the dedicated line packet loss rate exceeds 5%, the video traffic is automatically switched to the 5G link and the token key is updated.

[0087] The SDP workflow is as follows:

[0088] (1) The SDP client goes online and initiates a single packet authentication (SPA) request to the SDP controller;

[0089] (2) After receiving the SPA authentication request from the client, the SDP controller can forward the authentication to the third-party IAM for identity authentication and verification;

[0090] (3) After the IAM passes the identity authentication, it will inform the Controller. Only users who pass the identity authentication will receive the SPA response message. Before passing the single packet authentication (SPA), the controller will not respond to any request, so as to achieve the hiding of the controller and prevent illegal users from connecting and attacking.

[0091] (4) After the client passes the authentication, the Controller will inform the client of the gateway and resources to be connected through the encrypted channel. At the same time, after the SPA authentication with the gateway, the Controller will dynamically inform the client of the access user and the accessed resource information;

[0092] (5) After receiving the response from the controller, the Client initiates a TLS tunnel connection request to the secure gateway and simultaneously makes a SPA identity authentication request again;

[0093] (6) When the security gateway receives the client's TLS tunnel connection request, it verifies the client's identity and the information about the client sent by the controller. After the verification is passed, the client establishes a secure TLS tunnel connection with the security gateway;

[0094] (7) The security gateway controls the connection between the client and the backend resources based on the control policy information.

[0095] Single-Packet Authorization (SPA) is a lightweight authentication protocol that complies with RFC4226. SPA is a core component of SDP. SPA is used for authentication between the client, controller, gateway, and client, gateway. It has the following advantages:

[0096] 1. Hiding services and assets. By combining with the dynamic firewall function, unauthenticated users, hackers, or attackers cannot discover the controller's IP and service ports through port scanning, thus making services and assets invisible. Traditional VPN servers inevitably expose server IP and port information, making it impossible to avoid malicious scanning, exposure, and penetration attacks.

[0097] 2. Zero-trust security protection: Message responses are only made to users who have passed identity authentication, and no response is made if authentication fails;

[0098] 3. Resist DDos attacks. By hiding services and assets, it can effectively resist DDos attacks on controllers and gateways.

[0099] 4. SPA supports OTP one-time password and MFA multi-factor authentication to enhance authentication security.

[0100] Identity and Access Manager (IAM) technology centrally integrates the account, authentication, access control, and audit functions for resources such as application systems, databases, hosts, network devices, and security equipment within an enterprise network environment. Through account synchronization, strong authentication, authorization, access control, and single sign-on, it brings resource users and accounts on various resources under unified management. IAM provides enterprises with a unified account management perspective, centralizing and managing all account-based management, authentication, authorization, and auditing. This improves account management security, helps system administrators increase work efficiency, and reduces management burdens. It also improves the repetitive and tedious process of ordinary users logging in and authenticating across different resources, providing greater security for daily work.

[0101] In the new network environment, applications and services are constantly iterating and updating, and security boundary protection is no longer fixed. Only by accelerating the deployment and adjustment of strategies at different levels (network, host, application, data) can we truly achieve boundary security defense and demand review and testing.

[0102] The old protection architecture has the following problems:

[0103] Different users have different needs: Different users, such as internet users, internal employees, partners, and outsourced personnel, have different needs due to their different roles. This diversity of user roles leads to complex security defense strategies.

[0104] Different application systems have different requirements: Different types of systems, such as core business systems, production systems, and external service systems, require different levels of security defense mechanisms to ensure stable system operation and protect system data from tampering and theft.

[0105] Different levels of protection for different data: Different types of data with different security and confidentiality levels also require different levels of security defense strategies to meet different protection requirements in terms of data integrity, availability and confidentiality.

[0106] Dynamic firewall technology can solve the above problems. According to the differentiated needs of different users, different data, different application systems, etc., dynamic firewall technology can be used to quickly establish security defense strategies and access strategies, thereby improving the security protection availability of the overall network environment.

[0107] In order to achieve secure data transmission between the client, control end and server end, real-time protection of data transmission is achieved through secure transmission tunnel technology, which builds a trusted and controllable channel between the user and the server to safeguard information security.

[0108] New large-scale network construction often involves multiple branches across multiple regions, along with cloud resources. These branches need to be securely and reliably connected to form a multi-regional enterprise intranet. VPN-HUB technology effectively addresses this requirement.

[0109] The application scenarios of the embodiments of the present invention are very diverse and are widely applicable to various application scenarios such as the Internet of Things (IoT), network security access, remote secure connection, secure APP, and secure access:

[0110] IoT Security:

[0111] Block malicious control such as APT, protect cloud security (invisibility), and filter illegal protocols.

[0112] Application APP security:

[0113] Professional apps can have built-in SDKs and dynamically access secure networks after authentication, ensuring data and network security.

[0114] Secure access to office systems:

[0115] SDP Client, PC, BYOD remote secure access, flexible permission control of users, ports, and IP addresses, and secure Internet access (anti-phishing and anti-virus).

[0116] API secure access:

[0117] Hide the real server IP, fine-tune permission control, and prevent data leakage.

[0118] Application security access control (replace VPN):

[0119] Traditional VPNs rely on network and IP-centric access control. This means they isolate networks through IP networks, making simple network policies manageable but difficult to maintain in complex networks (firewalls often have tens of thousands of policies). Verification often requires specialized policy management tools, and policy omissions often lead to serious vulnerabilities. Once a VPN accesses a network, it is considered trusted, and access scopes are not precisely isolated, creating risks of penetration and viruses (such as EternalBlue). Uncontrolled intranet user access can lead to security threats, resulting in uncontrollable damage. With the deployment of hybrid public and private clouds and the demand for elastic scalability, VPN access control cannot respond quickly, impacting application delivery.

[0120] The embodiments of the present invention replace VPNs, which has the following advantages:

[0121] User-rights-centered security access control, zero-trust security model, hidden core network assets, BYOD device cost savings, operation and behavior auditing, simple and convenient management model, and excellent user experience.

[0122] Secure browser access: By embedding this embodiment of the present invention, any location and any device can securely access the internet and corporate offices through a browser. This embodiment of the present invention establishes a trusted secure authentication tunnel between the client and server, eliminating network environment concerns.

[0123] This application can provide professional client software across multiple platforms. The client software can implement mobile security management functions, implement multiple functional modules and components such as unified portal, operation and maintenance audit, cloud desktop, data leakage prevention, etc., realize unified management of enterprise mobile security EMM, and provide enterprise users with a better access experience under the premise of ensuring secure access.

[0124] In the field of Internet of Things and Internet of Vehicles, information related to IoT and Internet of Vehicles sensors will be transmitted to the cloud platform via the Internet. At the same time, the client performs remote access control through APP. There is a risk of exposure of key assets in the cloud, and the security of client APP cannot be fully guaranteed. Based on the SDP architecture, end-to-end security protection of the cloud-pipe-end of IoT and Internet of Vehicles can be achieved to ensure the overall security of IoT infrastructure and architecture.

[0125] The solution proposed in this application can help users achieve network asset invisibility while ensuring secure communication connections between devices on both sides on the Internet, and strictly control network access permissions, prohibiting services and ports outside the permission range.

[0126] API data interface protection:

[0127] Many services and applications interact with data by accessing it through APIs on the internet. When servers are open to different business systems, various middlewares contain numerous vulnerabilities. Once the host hosting the middleware is infected, the middleware's calls to the business system databases can expose data to malicious hijacking and other threats. This embodiment of the present invention effectively hides and controls access to backend assets, opening only the appropriate access ports and implementing dynamic access control. Once data calls are complete, all open ports are closed, preventing malicious file transfers.

[0128] Remote security operation and maintenance:

[0129] During operation and maintenance, the network security strategy is network-centric, allowing remote operation and maintenance personnel to access the network. This presents the following problems:

[0130] 1. Open security policies centered on the network, with extensive policies that threaten intranet devices;

[0131] 2. After third-party operation and maintenance personnel enter the intranet through VPN, they cannot perform refined permission control;

[0132] 3. The remote desktop access port is open and unsafe, making it vulnerable to attacks;

[0133] 4. Some important system services are exposed to the Internet.

[0134] By deploying the SDP system proposed in the embodiments of the present invention, dynamic access control based on identity permissions is implemented to ensure the security of remote operation and maintenance access. At the same time, application-level access and secure encrypted tunnels are used to ensure the security of remote access data.

[0135] SDP follows a zero-trust security architecture. Through architectural adjustments, it implements user- and permission-centric access control, avoids TCP / IP protocol flaws, and better implements enterprise security protection. Its advantages and value are as follows:

[0136] 1) Asset Hiding

[0137] Combined with dynamic firewalls and SPA single-packet authentication, it hides important services and assets, reduces attack exposure, and ensures overall architecture security through authentication before connection.

[0138] 2) Defending against cyberattacks

[0139] The default Drop firewall policy denies any access IP addresses and ports to unauthorized users, hackers, and other illegal users. This prevents hackers from attacking invisible network assets and targets, thereby preventing typical attacks such as illegal port scanning, SQL injection, brute force cracking, DDOS attacks, and APT infiltration.

[0140] 3) User-centered

[0141] Traditional network access and control are network-centric. By default, the external network (i.e., outside the firewall) is untrusted access, while the internal network (i.e., the intranet) is trusted access. However, 70% of network attacks and data leaks originate from the intranet. The Zero Trust architecture believes that even users on the intranet should not have access to all network assets or services. Instead, the Zero Trust architecture focuses on user permissions. Identity and permissions must be verified before accessing both the intranet and the external network to achieve minimal user access control.

[0142] 4) Enhancement of existing security solutions

[0143] SDP is an enhancement to existing security solutions, not an exclusive solution. It can be deployed on traditional security devices in a software-defined manner to flexibly form an SDP architecture, thereby collaborating with traditional security devices to enhance enterprise network security.

[0144] 5) Simplify security operations and maintenance

[0145] SDP centrally manages network-wide gateways and access policies through a centralized controller, reducing the maintenance of existing firewall ACL policies and greatly simplifying the daily work of security operations personnel.

[0146] 6) Adapt to multi-cloud environment management

[0147] Enterprise applications are gradually migrating to the cloud, and assets in traditional DMZs are gradually being moved to private or public clouds. Enterprise IT managers face severe challenges in traditional maintenance and management models when faced with complex multi-cloud and hybrid cloud IT environments. Different cloud providers offer different security and O&M solutions, and enterprise IT personnel expect to manage multi-cloud environments simultaneously with a consistent access experience. SDP precisely meets the management needs of enterprise IT personnel. By deploying software-based boundaries, it can be quickly extended to every cloud, providing a convenient, fast, and secure solution to enterprise multi-cloud access issues.

[0148] 7) Meet the security requirements

[0149] With the implementation of the Cybersecurity Law, regulatory authorities are increasingly stringent in their compliance requirements for enterprises, including those related to security protection. Enterprises need to spend a lot of manpower and material resources to purchase various expensive security protection equipment to meet these requirements. The SDP solution can meet these requirements from multiple dimensions, such as secure access control, operation and maintenance security audits, and defense against various network attacks, thereby quickly meeting compliance requirements at the lowest cost.

[0150] 8) Better user experience

[0151] SDP provides customers with a better access experience, enabling access across different platforms and terminals. It can also be integrated with the company's existing APP and quickly open through the SDK security suite, further strengthening security without changing user access habits.

[0152] Although the present invention has been described in detail above using general descriptions and specific embodiments, it will be apparent to those skilled in the art that modifications and improvements may be made thereto. Therefore, such modifications and improvements, without departing from the spirit of the present invention, are intended to be within the scope of protection claimed herein.

Claims

1. A method for transmitting data via SDP gateway access authentication based on multi-link aggregation, characterized in that: The method comprises: S1. Obtain user requirements and verify the identities of the terminal and the SDP gateway according to the two-way authentication protocol and the user requirements, and simultaneously report the terminal's available link information and link quality score during the authentication process; S2, the SDP controller dynamically binds the primary link and the backup link based on the link quality score and service requirements, and generates a dynamic token bound to the link; S3: The sender fragments the data according to the link bandwidth ratio. After fragmentation, the data is encrypted and transmitted in parallel through multiple links. The sender dynamically adjusts the fragmentation ratio based on the real-time bandwidth of each link. The receiver reassembles the data based on the redundancy check code. S4. Real-time monitoring of link status. When a link anomaly or security threat is detected, the link switching process is triggered to adjust to the backup link and update the dynamic token and encryption key; The link quality score is calculated by weighting the latency, packet loss rate, historical security records, and encryption strength. The SDP controller dynamically binds the primary and backup links based on link quality scores and service requirements, and generates dynamic tokens bound to the links, including: The dynamic token contains a link identifier, an encryption key, and a validity period, and is used to verify data transmission authority and link legitimacy; When the standby link is switched, the SDP controller synchronously updates the link identifier and encryption key of the dynamic token and notifies the terminal to rebind the link.

2. The SDP gateway access authentication data transmission method based on multi-link aggregation according to claim 1, characterized in that: The two-way authentication protocol is TLS 1.3, and the terminal and the SDP gateway complete two-way identity authentication through digital certificates.

3. The SDP gateway access authentication data transmission method based on multi-link aggregation according to claim 1, characterized in that: The encrypted transmission of the data after fragmentation adopts the IPSec protocol or the MACsec protocol, and each fragment is transmitted through an independent encrypted channel.

4. The SDP gateway access authentication data transmission method based on multi-link aggregation according to claim 1, characterized in that: The receiving end reconstructs the data based on the redundancy check code, including: The redundant check code adopts forward error correction coding, and a cross-link retransmission request is triggered when the receiving end detects that a fragment is lost.

5. The SDP gateway access authentication data transmission method based on multi-link aggregation according to claim 1, characterized in that: The link abnormality includes a link quality score lower than a preset threshold, a DDoS attack being detected, or a packet loss rate exceeding a service tolerance threshold.

6. The SDP gateway access authentication data transmission method based on multi-link aggregation according to claim 1, characterized in that: The encryption key is dynamically rotated according to a preset time threshold or data transmission volume threshold, and the maximum rotation period is 24 hours.

7. The SDP gateway access authentication data transmission method based on multi-link aggregation according to claim 1, characterized in that: The business requirements include real-time performance, bandwidth requirements, and data sensitivity, and high-security links are given priority in allocating sensitive data transmission tasks.

8. The SDP gateway access authentication data transmission method based on multi-link aggregation according to claim 1, characterized in that: The method further includes acquiring the current network topology structure and the binding strategy of each link, and dynamically optimizing the network topology according to the current network topology structure and the binding strategy.

Images