Working method of cluster-based SDP gateway

Abstract

The invention discloses a working method of an SDP gateway based on a cluster. The working method comprises the following implementation steps: an SDP client sends an SPA data packet to an SDP controller; the SDP controller receives and verifies the authentication information in the SPA data packet; after the verification is passed, the SDP controller determines an SDP gateway list which can be accessed by the SDP client according to the load indexes of the SDP gateways, notifies the SDP gateways in the list to accept the connection request of the SDP client, and sends the SDP gateway list to the SDP client; the load indexes comprise a CPU utilization rate, a memory utilization rate, response time of health examination and a tunnel establishment failure rate; and the SDP client sends an SPA data packet to the SDP gateways in the list, and after verification is passed, bidirectional encryption connection is established. According to the invention, a plurality of SDP gateways can be promoted to work coordinately, load balancing is promoted, comprehensive system toughness is improved, and the risk of a single point of failure (SPoF) is relieved.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and specifically relates to a working method of a cluster-based SDP gateway. Background Technology

[0002] Software Defined Perimeter (SDP) is a network security architecture based on the zero-trust principle. It creates a logically dynamic security boundary based on policies to isolate services from insecure networks. Users and devices are authenticated before authorized access, enabling them to securely connect to isolated services. Unauthorized users and devices cannot connect to protected resources. The core idea of ​​SDP is to hide core network assets and infrastructure from direct exposure to the internet, thus protecting them from external security threats.

[0003] SDP consists of three main components: SDP client, SDP gateway, and SDP controller. The SDP controller is the brain of SDP, primarily handling host authentication and policy distribution. It can also authenticate and authorize SDP clients and configure connections to the SDP gateway. The SDP gateway features network stealth; it will not respond to any connection requests before authentication, effectively reducing the network exposure surface.

[0004] However, when an SDP gateway faces a sudden surge in requests, the SDP system may experience performance degradation and even system crashes. To address this issue, multiple SDP gateways are often deployed in applications to handle the requests. However, deploying multiple SDP gateways raises the question of how to coordinate their operation.

[0005] Furthermore, the core idea of ​​the SDP zero-trust security architecture is "never trust, always verify," meaning that regardless of whether the visitor comes from the internal or external network, they must undergo strict verification to obtain access with the least privilege. This improves security, but it also leads to the high technical complexity of SDP systems, which affects their operational efficiency. Summary of the Invention

[0006] In order to overcome the shortcomings of the prior art, the present invention aims to provide a working method for a cluster-based SDP gateway, which enables multiple SDP gateways to work in coordination, promotes load balancing, enhances overall system resilience, and mitigates the risk of single point of failure (SPoF).

[0007] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A method for operating a cluster-based SDP gateway, the implementation steps of which are as follows: S1: The SDP client sends an SPA data packet to the SDP controller; S2: The SDP controller receives and verifies the authentication information in the SPA data packet; S3: After successful verification, the SDP controller determines the list of SDP gateways that the SDP client can access based on the load metrics of the SDP gateways, notifies the SDP gateways in the list to accept the connection request from the SDP client, and sends the list of SDP gateways to the SDP client; the load metrics include CPU utilization, memory utilization, health check response time, and tunnel establishment failure rate; S4: The SDP client sends SPA data packets to the SDP gateway in the list. After successful verification, a two-way encrypted connection is established.

[0008] In one embodiment, in step S3, the SDP controller determines the list of SDP gateways that the SDP client can access based on the load metrics of the SDP gateways, as follows: Set thresholds for CPU utilization, memory utilization, health check response time, and tunnel establishment failure rate. SDP gateways that are below all thresholds are allowed access.

[0009] In one embodiment, the threshold for CPU utilization is set to be greater than or equal to 90% for a continuous period of time; the threshold for memory utilization is set to be greater than or equal to 90% for a continuous period of time; the response time for health checks is greater than or equal to 500ms for a continuous period of time; and the tunnel establishment failure rate is greater than or equal to 5% for a continuous period of time.

[0010] In one embodiment, the load metric is obtained through a load balancer, which can be a software device or a hardware device. When it is a software device, it is an application installed and running on the SDP controller or SDP gateway; when it is a hardware device, it is a separate hardware device running load balancing software.

[0011] In one embodiment, the load balancer periodically checks the CPU utilization, memory utilization, health check response time, and tunnel establishment failure rate of the SDP gateway, and judges the health status of the SDP gateway based on these indicators. If the SDP gateway is overloaded or faulty, the load balancer temporarily removes the SDP gateway from the list of available SDP gateways to prevent requests from being sent to the overloaded or faulty SDP gateway.

[0012] In one embodiment, if the SDP gateway is overloaded, the overload is determined based on the threshold; the fault is determined using the following method: The load balancer periodically sends detection requests to the SDP gateway. If an SDP gateway fails to respond multiple times (e.g., 3 times) or its response time exceeds a preset time, it is marked as faulty. After the faulty gateway recovers or the overload is relieved, it needs to pass N (e.g., 3) health checks consecutively. The load balancer will then add the gateway back to the list of available SDP gateways and gradually restore traffic forwarding.

[0013] In one embodiment, multiple SDP gateways are connected to multiple resource servers.

[0014] In one embodiment, the load balancing algorithm used by the cluster is the weighted least connections algorithm.

[0015] In one embodiment, the SDP client sends SPA data packets to each authorized SDP gateway. After the SDP gateway verifies the data, the SDP client directly establishes a bidirectional encrypted connection with the corresponding SDP gateway.

[0016] In one embodiment, different authentication strategies are set for different user groups to avoid indiscriminately enforcing complex verification.

[0017] In one embodiment, a timeout retransmission mechanism is set for the SDP client. A timer and a time threshold are set in the SDP client. The SDP system uses Single Packet Authorization and Authentication (SPA) technology. After the SDP client sends an SPA data packet, it starts its timer. When the timer value equals the time threshold, and the SDP client has not received the SDP gateway list sent by the SDP controller, the SDP client retransmits the SPA data packet to the SDP controller until it is successfully sent.

[0018] Common SDP gateway deployment modes include master-slave cluster deployment and distributed cluster deployment. In master-slave cluster deployment, the standby SDP gateway is always in standby mode, resulting in wasted resources. Furthermore, master-slave cluster deployment is unsuitable for high-concurrency, large-scale distributed scenarios. Distributed cluster deployment has disadvantages such as complex system design, high operation and maintenance costs, and high security risks. This invention offers high availability. The load balancer monitors the health status of each gateway node in real time. When an SDP gateway fails, the load balancer automatically forwards traffic to healthy SDP gateway nodes without manual intervention, ensuring business continuity.

[0019] Compared to existing technologies, this invention optimizes resource utilization and improves SDP system performance. The load balancer evenly distributes traffic to each SDP gateway node, avoiding resource waste caused by some SDP gateway nodes being overloaded and others idle. The load balancer distributes user requests evenly across all SDP gateway nodes, enabling parallel processing and improving SDP system performance. This cluster mode can linearly increase throughput, concurrent connections, and data processing capabilities by adding nodes, thus enhancing SDP system performance. Furthermore, in traditional server cluster modes, where the load balancer forwards both client request packets to the target server and server response packets to the client, there is a risk of a single point of failure for the load balancer. In this invention's cluster mode, the load balancer only forwards SDP client access requests to the appropriate SDP gateway; server response packets are not forwarded to the SDP client via the load balancer but are sent directly to the SDP client via the SDP gateway. This reduces the risk of a single point of failure for the load balancer and improves data transmission efficiency. Compared to distributed cluster deployments, this invention's cluster mode offers advantages such as low maintenance costs and high security. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the working architecture of a cluster-based SDP gateway. Detailed Implementation

[0021] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings and examples.

[0022] like Figure 1 As shown, when using an SDP gateway cluster, multiple SDP gateways connect to multiple resource servers simultaneously. The core functions of an SDP gateway are authentication, traffic encryption, access control, and boundary isolation. Resource servers are located behind the SDP gateways, thus hiding them and preventing network attacks. The SDP client sends an access request (i.e., an SPA packet) to the SDP controller, which receives and verifies the authentication information in the SPA packet. After successful verification, the SDP controller determines a list of SDP gateways that the SDP client can access based on the SDP gateway's load metrics, notifies the SDP gateways in the list to accept the client's connection request, and sends the SDP gateway list back to the client. The SDP client sends an SPA packet to one of the SDP gateways in the list; after successful verification, a bidirectional encrypted connection is established. When an SDP gateway faces a large number of connection requests, a single SDP gateway is at risk of a single point of failure. Therefore, multiple SDP gateways are often deployed in applications to handle requests. However, deploying multiple SDP gateways raises the issue of coordinating their operation.

[0023] Therefore, this invention provides a working method for a cluster-based SDP gateway, the main steps of which are as follows: S1: The SDP client sends an access request data packet, i.e., an SPA data packet, to the SDP controller.

[0024] S2: The SDP controller receives and verifies the authentication information in the SPA data packet. Only when the authentication is successful will it proceed to the next step; otherwise, the access request will be rejected directly.

[0025] S3: After successful authentication, determine the availability of the SDP gateway.

[0026] This step is a key design feature of this invention. To make the above judgment, it is necessary to determine whether the SDP gateway is overloaded based on certain load indicators. In this invention, the load indicators are CPU utilization, memory utilization, health check response time, and tunnel establishment failure rate. Thresholds are set for each of these indicators, and only SDP gateways that are simultaneously below these thresholds are designated as accessible SDP gateways.

[0027] For example, the CPU utilization threshold is set to be greater than or equal to 90% for a sustained period (which can be set to more than 3 minutes to balance efficiency and effectiveness). The memory utilization threshold is set to be greater than or equal to 90% for a sustained period (which can be set to more than 5 minutes to balance efficiency and effectiveness), and frequent use of the swap partition, such as a swap partition usage rate exceeding 10%, will cause a sharp drop in the SDP gateway's response time because disk read / write speeds are much lower than memory speeds. The health check response time is set to be greater than or equal to 500ms for a sustained period (which can be set to more than 5 minutes to balance efficiency and effectiveness); the tunnel establishment failure rate is set to be greater than or equal to 5% for a sustained period (which can be set to more than 3 minutes to balance efficiency and effectiveness).

[0028] The load metrics of the system during operation can be obtained through a load balancer. The load balancer can be a software device or a hardware device. When it is a software device, it is an application installed and running on the SDP controller or SDP gateway; when it is a hardware device, it is a separate piece of hardware running load balancing software. Through the load balancer, user requests can be distributed to multiple SDP gateways to achieve load balancing, thereby improving the high-concurrency processing capability, availability, and response speed of the SDP system. Specifically, this is reflected in: High-concurrency processing: Improve the overall throughput of the cluster by evenly distributing requests.

[0029] High Availability: Monitor server status and automatically skip unavailable SDP gateways to ensure uninterrupted service.

[0030] Scalability: Supports dynamic addition or removal of SDP gateways to adapt to traffic changes.

[0031] Load balancing software can include Nginx, LVS (Linux Virtual Server), HAProxy, gobetween, etc.

[0032] Furthermore, this invention utilizes a load balancer to periodically check the CPU utilization, memory utilization, health check response time, and tunnel establishment failure rate of the SDP gateway. Based on these indicators, the load status of the SDP gateway is determined. If these parameters exceed the aforementioned thresholds for CPU utilization, memory utilization, health check response time, and tunnel establishment failure rate, the SDP gateway is considered overloaded. Simultaneously, fault diagnosis is also performed. The load balancer's automatic detection and isolation function primarily relies on a health check mechanism. The load balancer periodically sends probe requests (such as HTTP requests and TCP connections) to the backend SDP gateways to check their health status. Once an SDP gateway is detected as unresponsive or experiencing excessively long response times, the load balancer automatically marks it as unavailable and stops distributing new requests to it. This mechanism ensures that user requests are always routed to healthy SDP gateways, thereby avoiding service interruptions due to single points of failure.

[0033] When an SDP gateway is determined to be overloaded or faulty, the load balancer directly or by notifying the SDP controller to temporarily remove the SDP gateway from the list of available SDP gateways to prevent requests from being sent to the already overloaded or faulty SDP gateway.

[0034] Through the above judgment process, the SDP controller determines the list of SDP gateways that the SDP client can access. Then, it sends the list of SDP gateways to the SDP client and notifies the SDP gateways in the list to accept the connection request from the SDP client.

[0035] S4: The SDP client sends an access request packet (i.e., SPA packet) to each authorized SDP gateway. After the SDP gateway verifies the request, the SDP client directly establishes a two-way encrypted connection (two-way TLS authentication) with the corresponding SDP gateway.

[0036] Furthermore, different authentication policies are set for different user groups to avoid indiscriminately enforcing complex verification. For example, for employees with low privileges, who can only access files of low importance, the SDP controller performs simple authentication. For employees with higher privileges, who can access files of higher importance, the SDP controller performs stricter authentication. This ensures both system security and improves the efficiency of the SDP system.

[0037] In this step, a timeout retransmission mechanism can be set for the SDP client. A timer and time threshold are set in the SDP client. The SDP system uses Single Packet Authorization and Authentication (SPA) technology. After the SDP client sends an SPA data packet, it starts its timer. When the timer value equals the time threshold, and the SDP client has not received the SDP gateway list sent by the SDP controller, the SDP client retransmits the SPA data packet to the SDP controller until it is successfully sent.

Claims

1. A method for operating a cluster-based SDP gateway, characterized in that, The implementation steps are as follows: S1: The SDP client sends an SPA data packet to the SDP controller; S2: The SDP controller receives and verifies the authentication information in the SPA data packet; S3: After successful verification, the SDP controller determines the list of SDP gateways that the SDP client can access based on the load metrics of the SDP gateways, notifies the SDP gateways in the list to accept the connection request from the SDP client, and sends the list of SDP gateways to the SDP client; the load metrics include CPU utilization, memory utilization, health check response time, and tunnel establishment failure rate; S4: The SDP client sends SPA data packets to the SDP gateway in the list. After successful verification, a two-way encrypted connection is established.

2. The working method of the cluster-based SDP gateway according to claim 1, characterized in that, In step S3, the SDP controller determines the list of SDP gateways that the SDP client can access based on the load indicators of the SDP gateways, as follows: Set thresholds for CPU utilization, memory utilization, health check response time, and tunnel establishment failure rate. SDP gateways that are below all thresholds are allowed access.

3. The working method of the cluster-based SDP gateway according to claim 1, characterized in that, The threshold for CPU utilization is set to be greater than or equal to 90% for a continuous period of time; the threshold for memory utilization is set to be greater than or equal to 90% for a continuous period of time; the response time for health checks is greater than or equal to 500ms for a continuous period of time; and the tunnel establishment failure rate is greater than or equal to 5% for a continuous period of time.

4. The method for operating a cluster-based SDP gateway according to claim 1, 2, or 3, characterized in that, The load metrics are obtained through a load balancer, which can be a software device or a hardware device. When it is a software device, it is an application installed and running on the SDP controller or SDP gateway; when it is a hardware device, it is a separate hardware that runs load balancing software.

5. The working method of the cluster-based SDP gateway according to claim 4, characterized in that, The load balancer periodically checks the CPU utilization, memory utilization, health check response time, and tunnel establishment failure rate of the SDP gateway, and judges the health status of the SDP gateway based on these indicators. If the SDP gateway is overloaded or faulty, the load balancer temporarily removes the SDP gateway from the list of available SDP gateways to prevent requests from being sent to the overloaded or faulty SDP gateway.

6. The working method of the cluster-based SDP gateway according to claim 5, characterized in that, The SDP gateway is overloaded, as determined by the threshold; the fault is determined using the following method: The load balancer periodically sends detection requests to the SDP gateway. If an SDP gateway fails to respond multiple times or its response time exceeds a preset time, it is marked as a fault. After the faulty gateway recovers or the overload is relieved, the load balancer needs to perform N consecutive health checks before adding the gateway back to the list of available SDP gateways and gradually restoring traffic forwarding.

7. The working method of the cluster-based SDP gateway according to claim 1, characterized in that, The multiple SDP gateways are connected to multiple resource servers.

8. The working method of the cluster-based SDP gateway according to claim 1, characterized in that, The load balancing algorithm used by the cluster is the weighted least connections algorithm.

9. The working method of the cluster-based SDP gateway according to claim 1, characterized in that, The SDP client sends SPA data packets to each authorized SDP gateway. After the SDP gateway verifies the data, the SDP client directly establishes a two-way encrypted connection with the corresponding SDP gateway.

10. The working method of the cluster-based SDP gateway according to claim 1, characterized in that, Set different identity authentication strategies for different user groups to avoid indiscriminately forcing complex verification.

Images