Blockchain-based SDP access control method and device

Abstract

In the SDP access control method and apparatus, the SDP connection initiating host submits identity authentication request information to a blockchain system node and feeds back the authentication result after verification to the SDP connection initiating host; the SDP connection initiating host sends a query request for an accessible SDP connection accepting host list to the blockchain system node, the query request includes the blockchain system node's verification result for the SDP connection initiating host; after verifying the query request, the blockchain system node queries the accessible SDP connection accepting host list of the SDP connection initiating host and records it in the blockchain ledger; the SDP connection initiating host initiates a connection request to the SDP connection accepting host, queries the accessible SDP connection accepting host list of the SDP connection initiating host, and provides an access service if the SDP connection accepting host to be accessed exists.

Description

[Technical field]

[0001] (CROSS-REFERENCE TO RELATED APPLICATIONS) This application is filed based on a Chinese patent application having application number 202110001451.7 and filing date of January 4, 2021, and claims priority to the Chinese patent application, the entire contents of which are incorporated herein by reference.

[0002] The present application relates to the technical field of network security, and in particular to a method and apparatus for SDP access control based on blockchain. [Background technology]

[0003] The Software Defined Perimeter (SDP) aims to allow application owners to deploy perimeter security when necessary to isolate their services from insecure networks. Instead of physical devices, SDP uses logical components that are controllable by the application owner, and only after device authentication and identity verification, SDP allows access to the application infrastructure.

[0004] Referring to Figure 1, SDP includes two parts: SDP host and SDP controller. SDP host can create or accept a connection. SDP controller mainly performs host authentication and policy distribution. SDP host and SDP controller interact through one secure control channel. SDP host is further divided into SDP connection initiating host (IH) and SDP connection accepting host (AH).

[0005] SDP changes the traditional way of connecting to websites. In the traditional connection, the client needs to establish a connection with the server, which exposes the server to the public network and may be exploited if there is a loophole at the service end. The user enters the username and password through the login page, which may lead to the username and password being stolen. In addition to the username and password, multi-factor authentication is also available, which can resist the loss of the username and password, but multi-factor authentication is not very user-friendly.

[0006] At present, in the SDP system, the SDP controller controls information such as the accessible service list of the IH, the IP address of the AH, and connection parameters (e.g., port number, protocol, etc.). The SDP controller is a centralized device and is exposed to the network, so it is susceptible to network attacks such as DDoS (Distributed Denial of Service). If the controller receives a network attack and stops its service, the entire system may not operate normally, which may result in the IH being unable to access data. Summary of the Invention [Means for solving the problem]

[0007] The present disclosure provides a method and apparatus for SDP access control based on blockchain, providing SDP services to customers in the manner of blockchain, and solving the problem that the SDP controller is subjected to DDoS attacks and the SDP controller implements incorrect authorization.

[0008] In order to solve the above technical problems, the present disclosure is realized as follows: In a first aspect, a blockchain-based SDP access control method is provided, the blockchain-based SDP access control method includes: The SDP connection accepting host sends information to be verified to the blockchain system node, so that the blockchain system node verifies the information to be verified and records it in the blockchain ledger after passing the verification, where the information to be verified includes host information and supported connection policies of the SDP connection accepting host; The SDP connection accepting host receives a connection request sent by an SDP connection initiating host; The SDP connection accepting host queries an accessible SDP connection accepting host list of the SDP connection initiating host in a block chain ledger, and if the SDP connection accepting host is in the SDP connection accepting host list, provides an access service to the SDP connection initiating host.

[0009] Preferably, the host information of the SDP connection accepting host includes at least one of an IP (Internet Protocol) address, a port, and protocol information, and the supported connection policy includes at least one of an access user's login ID (Identity), an IP address, a geographical location, and a blockchain node's verification or endorsement policy.

[0010] Preferably, the information to be verified further includes host information of the SDP connection accepting host and a signature of a supported connection policy.

[0011] In a second aspect, a blockchain-based SDP access control method is provided, the blockchain-based SDP access control method comprising: A blockchain system node receives verification target information sent by an SDP connection accepting host, the verification target information including host information and a supported connection policy of the SDP connection accepting host; The blockchain system node verifies the verification target information, and records the information in the blockchain ledger after passing the verification; The blockchain system node receives identity authentication request information submitted by an SDP connection initiation host; The blockchain system node verifies the identity authentication request information submitted by the SDP connection initiation host, and after the verification is successful, the blockchain system node receives a query request for an accessible SDP connection acceptance host list sent by the SDP connection initiation host; The blockchain system node verifies the query request, and after the verification is passed, the blockchain system node queries the SDP connection initiating host's accessible SDP connection accepting host list and records the SDP connection accepting host list in a blockchain ledger.

[0012] Preferably, the information to be verified further includes host information of the SDP connection accepting host and a signature of a supported connection policy.

[0013] Preferably, in the identity authentication request, if the SDP connection initiating host signs a timestamp using its private key, The blockchain system node verifying the identity authentication request information includes: The blockchain system node verifies the signature and timestamp submitted by the SDP connection initiating host.

[0014] Preferably, if the identity authentication request includes a KDF or encryption information to a KDF using a public key of the authentication node A1, The blockchain system node verifying the identity authentication request information includes: The blockchain system node verifies whether the KDF is correct.

[0015] Preferably, if the identity authentication request includes a token or encryption information to the token using a public key of the authentication node A2, The blockchain system node verifying the identity authentication request information includes: The blockchain system node verifies whether the token is correct.

[0016] In a third aspect, a method for controlling SDP access based on a blockchain is provided, the method for controlling SDP access based on a blockchain comprising: An SDP connection initiating host submits identity authentication request information to a blockchain system node; The SDP connection initiation host receives from the blockchain system node a verification result for the identity authentication request information submitted by the SDP connection initiation host; The SDP connection initiating host sends a query request for an accessible SDP connection accepting host list to the blockchain system node, where the query request includes a verification result of the blockchain system node against the identity authentication request information of the SDP connection initiating host; the SDP connection initiating host initiating a connection request to an SDP connection accepting host; The SDP connection initiating host receives access services provided by SDP connection accepting hosts in the SDP connection accepting host list.

[0017] Preferably, in the identity authentication request, the SDP connection initiating host signs a timestamp using its own private key.

[0018] Preferably, if the SDP connection initiating host has a username and secret information shared with authentication node A1, the identity authentication request includes a KDF or encrypts information to the KDF using the public key of authentication node A1.

[0019] Preferably, if the SDP connection initiating host has a token provided by authentication node A2, the identity authentication request includes the token or encrypted information to the token using the public key of authentication node A2.

[0020] In a fourth aspect, there is provided a blockchain-based SDP access control device, the blockchain-based SDP access control device comprising: A first information verification module configured to send information to be verified to the blockchain system node, so that the blockchain system node verifies the information to be verified and records it in the blockchain ledger after passing the verification, the information to be verified includes host information of an SDP connection acceptance host and a supported connection policy; and a connection request initiation module configured to receive a connection request sent by an SDP connection initiation host; and a first request response module configured to query, in the blockchain ledger, an accessible SDP connection accepting host list of the SDP connection initiating host, and provide an access service to the SDP connection initiating host if the SDP connection accepting host is in the SDP connection accepting host list.

[0021] Preferably, the host information of the SDP connection accepting host includes at least one of an IP address, a port, and a protocol information, and the supported connection policy includes at least one of an access user's login ID, an IP address, a geographical location, and a blockchain node's verification or endorsement policy.

[0022] Preferably, the information to be verified further includes host information of the SDP connection accepting host and a signature of a supported connection policy.

[0023] In a fifth aspect, there is provided a blockchain-based SDP access controller, the blockchain-based SDP access controller comprising: A second information verification module configured to receive verification information sent by an SDP connection accepting host, verify the verification information, and record the verification information in a blockchain ledger after passing the verification, wherein the verification information includes host information and supported connection policies of the SDP connection accepting host; A first identity authentication request module configured to receive identity authentication request information submitted by an SDP connection initiating host; an identity verification module configured to verify identity authentication request information submitted by the SDP connection initiating host; a first query request module configured to receive a query request for an accessible SDP connection-accepting host list sent by the SDP connection initiating host; and a query verification module configured to verify the query request, and after passing the verification, query an accessible SDP connection accepting host list of the SDP connection initiating host, and record the SDP connection accepting host list in a blockchain ledger.

[0024] Preferably, the information to be verified further includes host information of the SDP connection accepting host and a signature of a supported connection policy.

[0025] Preferably, in the identity authentication request, if the SDP connection initiating host signs a timestamp using its private key, Verifying the identity authentication request information includes verifying a signature and a timestamp submitted by the SDP connection initiating host.

[0026] Preferably, if the identity authentication request includes a KDF or encryption information to a KDF using a public key of the authentication node A1, Verifying the identity authentication request information includes verifying whether the KDF is correct.

[0027] Preferably, if the identity authentication request includes a token or encryption information to the token using a public key of the authentication node A2, Verifying the identity authentication request information includes verifying whether the token is correct.

[0028] In a sixth aspect, there is provided a blockchain-based SDP access control device, the blockchain-based SDP access control device comprising: A second identity authentication request module configured to submit identity authentication request information to a blockchain system node; A verification feedback module configured to receive, from the blockchain system node, a verification result for the identity authentication request information submitted by the SDP connection initiation host; A second query request module configured to send a query request for an accessible SDP connection accepting host list to the blockchain system node, the query request including a verification result of the blockchain system node against the identity authentication request information of the SDP connection initiating host; and a connection request receiving module configured to initiate a connection request to an SDP connection accepting host; and a second request response module configured to receive access services provided by SDP connection-accepting hosts in the SDP connection-accepting host list.

[0029] Preferably, in the identity authentication request, the SDP connection initiating host signs a timestamp using its own private key.

[0030] Preferably, if the SDP connection initiating host has a username and secret information shared with authentication node A1, the identity authentication request includes a KDF or encrypts information to the KDF using the public key of authentication node A1.

[0031] Preferably, if the SDP connection initiating host has a token provided by authentication node A2, the identity authentication request includes the token or encrypted information to the token using the public key of authentication node A2.

[0032] In a seventh aspect, there is provided an SDP connection accepting host comprising a processor, a memory, and a program stored in the memory and executable by the processor, the program, when executed by the processor, causing the processor to implement steps of the blockchain-based SDP access control method of the first aspect or any possible realization thereof.

[0033] In an eighth aspect, there is provided a blockchain system node comprising a processor, a memory, and a program stored in the memory and executable by the processor, the program, when executed by the processor, causing the processor to implement steps of the blockchain-based SDP access control method of the second aspect or any possible realization thereof.

[0034] In a ninth aspect, there is provided an SDP connection initiation host comprising a processor, a memory, and a program stored in the memory and executable by the processor, the program, when executed by the processor, causing the processor to implement steps of the blockchain-based SDP access control method of the third aspect or any possible realization thereof.

[0035] In a tenth aspect, there is provided a computer-readable storage medium having stored thereon a computer program, the computer program, when executed by a processor, causing the processor to perform steps of the blockchain-based SDP access control method of the first aspect or any possible implementation thereof: The computer program, when executed by a processor, causes the processor to perform the steps of the blockchain-based SDP access control method of the second aspect or any possible implementation thereof; The computer program, when executed by a processor, causes the processor to perform the steps of the blockchain-based SDP access control method of the third aspect or any possible implementation thereof.

[0036] In an embodiment of the present disclosure, the SDP connection accepting host sends the host information and supported connection policy of the SDP connection accepting host to the blockchain system node, and the blockchain node verifies and consensuses the host information and supported connection policy of the SDP connection accepting host, and the host information and supported connection policy of the SDP connection accepting host after verification and consensus of the blockchain node are recorded in the blockchain ledger. The SDP connection initiating host submits identity authentication information to the blockchain system node, and the blockchain system node verifies the identity authentication information submitted by the SDP connection initiating host and feeds back the authentication result after verification to the SDP connection initiating host. The SDP connection initiating host sends a query request for an accessible SDP connection accepting host list to the blockchain system node, and the query request includes the authentication result of the blockchain system node for the SDP connection initiating host, and after verifying the query request, the blockchain system node queries the accessible SDP connection accepting host list of the SDP connection initiating host, and records the SDP connection accepting host list in the blockchain ledger. The SDP connection initiating host initiates a connection request to the SDP connection accepting host to be accessed. The SDP connection accepting host to be accessed consults the accessible SDP connection accepting host list of the SDP connection initiating host in the blockchain ledger, and if the SDP connection accepting host to be accessed is in the SDP connection accepting host list, provides an access service to the SDP connection initiating host. According to the embodiment of the present disclosure, the SDP service is provided to the customer in the form of a blockchain, and both the authentication and the request are verified, so that on the one hand, the SDP controller can be prevented from being subjected to DDoS attacks, and on the other hand, the SDP controller can be prevented from implementing incorrect authorization. The present invention provides, for example, the following: (Item 1) A blockchain-based software-defined perimeter (SDP) access control method, comprising: The SDP connection accepting host sends information to be verified to the blockchain system node, so that the blockchain system node verifies the information to be verified and records it in the blockchain ledger after passing the verification, where the information to be verified includes host information and supported connection policies of the SDP connection accepting host; The SDP connection accepting host receives a connection request sent by an SDP connection initiating host; The SDP connection accepting host queries an accessible SDP connection accepting host list of the SDP connection initiating host in a blockchain ledger, and if the SDP connection accepting host is in the SDP connection accepting host list, provides an access service to the SDP connection initiating host. (Item 2) The host information of the SDP connection accepting host includes at least one of an IP address, a port, and a protocol information, and the supported connection policy includes at least one of an access user's login ID (Identity), an IP (Internet Protocol) address, a geographic location, and a blockchain node's verification or endorsement policy; The blockchain-based SDP access control method according to item 1. (Item 3) The verification target information further includes host information of the SDP connection accepting host and a signature of a supported connection policy; The blockchain-based SDP access control method according to item 1. (Item 4) A blockchain-based software-defined perimeter (SDP) access control method, comprising: A blockchain system node receives verification target information sent by an SDP connection accepting host, the verification target information including host information and a supported connection policy of the SDP connection accepting host; The blockchain system node verifies the verification target information, and records the information in the blockchain ledger after passing the verification; The blockchain system node receives identity authentication request information submitted by an SDP connection initiation host; The blockchain system node verifies the identity authentication request information submitted by the SDP connection initiation host, and after the verification is successful, the blockchain system node receives a query request for an accessible SDP connection acceptance host list sent by the SDP connection initiation host; The blockchain system node verifies the query request, and after the verification is passed, the blockchain system node queries the SDP connection initiating host's accessible SDP connection accepting host list and records the SDP connection accepting host list in a blockchain ledger. (Item 5) The verification target information further includes host information of the SDP connection accepting host and a signature of a supported connection policy; Item 4. The blockchain-based SDP access control method. (Item 6) If the SDP connection initiating host signs a timestamp using its private key in the identity authentication request, The blockchain system node verifying the identity authentication request information includes: The blockchain system node verifies a signature and a timestamp submitted by an SDP connection initiating host. Item 4. The blockchain-based SDP access control method. (Item 7) If the identity authentication request includes a KDF or encryption information to the KDF using the public key of the authentication node A1, The blockchain system node verifying the identity authentication request information includes: The blockchain system node verifies whether the KDF is correct. Item 4. The blockchain-based SDP access control method. (Item 8) If the identity authentication request includes a token or encryption information for the token using the public key of the authentication node A2, The blockchain system node verifying the identity authentication request information includes: The blockchain system node verifies whether the token is correct. Item 4. The blockchain-based SDP access control method. (Item 9) A blockchain-based software-defined perimeter (SDP) access control method, comprising: An SDP connection initiating host submits identity authentication request information to a blockchain system node; The SDP connection initiation host receives from the blockchain system node a verification result for the identity authentication request information submitted by the SDP connection initiation host; The SDP connection initiating host sends a query request for an accessible SDP connection accepting host list to the blockchain system node, where the query request includes a verification result of the blockchain system node against the identity authentication request information of the SDP connection initiating host; the SDP connection initiating host initiating a connection request to an SDP connection accepting host; The SDP connection initiating host receives access services provided by SDP connection accepting hosts in the SDP connection accepting host list. (Item 10) In the identity authentication request, the SDP connection initiating host signs a timestamp using its private key; Item 10. The blockchain-based SDP access control method according to item 9. (Item 11) If the SDP connection initiating host has a username and secret information shared with the authentication node A1, the identity authentication request includes a KDF or encryption information to the KDF using the public key of the authentication node A1; Item 10. The blockchain-based SDP access control method according to item 9. (Item 12) If the SDP connection initiating host has a token provided by the authentication node A2, the identity authentication request includes the token or encryption information to the token using the public key of the authentication node A2; Item 10. The blockchain-based SDP access control method according to item 9. (Item 13) A blockchain-based software-defined perimeter (SDP) access control device, comprising: A first information verification module configured to send information to be verified to the blockchain system node, so that the blockchain system node verifies the information to be verified and records it in the blockchain ledger after passing the verification, the information to be verified includes host information of an SDP connection acceptance host and a supported connection policy; and a connection request initiation module configured to receive a connection request sent by an SDP connection initiation host; a first request response module configured to query an accessible SDP connection accepting host list of the SDP connection initiating host in a blockchain ledger, and provide an access service to the SDP connection initiating host if the SDP connection accepting host is in the SDP connection accepting host list. (Item 14) A blockchain-based software-defined perimeter (SDP) access control device, comprising: A second information verification module configured to receive verification information sent by an SDP connection accepting host, verify the verification information, and record the verification information in a blockchain ledger after passing the verification, wherein the verification information includes host information and supported connection policies of the SDP connection accepting host; A first identity authentication request module configured to receive identity authentication request information submitted by an SDP connection initiating host; an identity verification module configured to verify identity authentication request information submitted by the SDP connection initiating host; a first query request module configured to receive a query request for an accessible SDP connection-accepting host list sent by the SDP connection initiating host; A blockchain-based SDP access control device comprising: a query verification module configured to verify the query request, and after passing the verification, query an accessible SDP connection acceptance host list of the SDP connection initiation host, and record the SDP connection acceptance host list in a blockchain ledger. (Item 15) A blockchain-based software-defined perimeter (SDP) access control device, comprising: A second identity authentication request module configured to submit identity authentication request information to a blockchain system node; A verification feedback module configured to receive, from the blockchain system node, a verification result for the identity authentication request information submitted by the SDP connection initiation host; A second query request module configured to send a query request for an accessible SDP connection accepting host list to the blockchain system node, the query request including a verification result of the blockchain system node against the identity authentication request information of the SDP connection initiating host; and a connection request receiving module configured to initiate a connection request to an SDP connection accepting host; and a second request response module configured to receive access services provided by SDP connection-accepting hosts in the SDP connection-accepting host list. (Item 16) A software-defined boundary (SDP) connection accepting host comprising a processor, a memory, and a program stored in the memory and executable by the processor, the program, when executed by the processor, causing the processor to realize steps of a blockchain-based SDP access control method described in any one of items 1 to 3. (Item 17) A blockchain system node comprising a processor, a memory, and a program stored in the memory and executable by the processor, the program causing the processor to realize steps of a blockchain-based SDP access control method described in any one of items 4 to 8 when executed by the processor. (Item 18) A software-defined boundary (SDP) connection initiation host comprising a processor, a memory, and a program stored in the memory and executable by the processor, the program, when executed by the processor, causing the processor to realize steps of a blockchain-based SDP access control method described in any one of items 9 to 12. (Item 19) A computer program that, when executed by a processor, causes the processor to implement steps of the blockchain-based software-defined perimeter (SDP) access control method according to any one of items 1 to 3; Or, a computer program for causing the processor to realize the steps of the blockchain-based SDP access control method according to any one of items 4 to 8, when executed by the processor; Or, a computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to realize the steps of the blockchain-based SDP access control method described in any one of items 9 to 12. [Brief description of the drawings]

[0037] [Figure 1] FIG. 1 is a schematic diagram of SDP control in the prior art. [Diagram 2] 1 is a block chain system node architecture according to an embodiment of the present disclosure. [Diagram 3] FIG. 13 is a block chain based SDP access control thread diagram according to an embodiment of the present disclosure. [Figure 4] 1 is a flowchart of a blockchain-based SDP access control method according to an embodiment of the present disclosure. [Diagram 5] 1 is a flowchart of another blockchain-based SDP access control method according to an embodiment of the present disclosure. [Figure 6] 1 is a flowchart of another blockchain-based SDP access control method according to an embodiment of the present disclosure. [Figure 7] FIG. 1 is a schematic diagram of a blockchain-based SDP access control device according to an embodiment of the present disclosure. [Figure 8] FIG. 1 is a schematic diagram of another blockchain-based SDP access control apparatus according to an embodiment of the present disclosure. [Figure 9] FIG. 1 is a schematic diagram of another blockchain-based SDP access control device according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0038] Various other advantages and merits will become apparent to those skilled in the art upon reading the following detailed description of the preferred embodiments. The drawings are used only to illustrate the preferred embodiments and are not to be construed as limiting the present disclosure. In addition, the same reference numerals represent the same parts throughout the drawings.

[0039] Hereinafter, the technical solutions in the embodiments of the present disclosure will be described clearly and completely with reference to the drawings in the embodiments of the present disclosure, but obviously, the described embodiments are only a part of the embodiments of the present disclosure, and are not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without paying creative labor all belong to the protection scope of the present disclosure.

[0040] With the aid of FIG. 1, FIG. 2 and FIG. 3, and with reference to FIG. 4, a blockchain-based SDP access control method is provided, which includes S11 to S13.

[0041] In S11, the SDP connection accepting host sends information to be verified to the blockchain system node, so that the blockchain system node verifies the information to be verified and records it in the blockchain ledger after passing the verification, and the information to be verified includes host information and supported connection policies of the SDP connection accepting host.

[0042] At S12, the SDP connection accepting host receives a connection request sent by an SDP connection initiating host.

[0043] In S13, the SDP connection accepting host queries the block chain ledger for an accessible SDP connection accepting host list of the SDP connection initiating host, and if the SDP connection accepting host is in the SDP connection accepting host list, it provides an access service to the SDP connection initiating host.

[0044] In this embodiment, the host information of the SDP connection accepting host includes IP address, port and protocol information, and the supported connection policy includes the login ID, IP address, geographic location, and verification and endorsement policy of the access user of the blockchain node. The SDP connection accepting host sends the host information of the SDP connection accepting host (such as IP address, port and protocol information) and the supported connection policy (such as the user login ID, IP address, geographic location, and the validation / endorsement policy of the blockchain node whose access is supported) to the blockchain system node.

[0045] Specifically, the SDP connection accepting host may further send the host information of the SDP connection accepting host and a signature of the supported connection policy of the SDP connection accepting host to a blockchain system node, and the blockchain node verifies the information submitted by the SDP connection accepting host and its signature, and after passing the verification, the blockchain node records the host information of the SDP connection accepting host and the supported connection policy sent by the SDP connection accepting host in the blockchain ledger.

[0046] Assisting with Figure 2, the blockchain system nodes are composed of SDP controllers and authentication nodes connected to each other. Both the SDP controllers and authentication nodes are blockchain nodes, and both the SDP connection accepting host and the SDP connection initiating host can submit transactions to the blockchain and read ledger data from the blockchain.

[0047] Specifically, the manner in which the SDP connection initiating host submits an identity authentication request to the block chain system node is that the SDP connection initiating host uses its private key to sign a timestamp.

[0048] Specifically, the blockchain system node verifies the signature and timestamp of the identity authentication request information submitted by the SDP connection initiating host. The SDP connection initiating host signs the timestamp using its private key. When the SDP connection initiating host signs the timestamp using its private key, the signature and timestamp are verified.

[0049] In this embodiment, if the SDP connection initiating host has a username and secret information shared with the authentication node A1, the identity authentication request includes KDF (timestamp, username, password), and uses the public key of the authentication node A1 to encrypt KDF (timestamp, username, password). In step S4, the blockchain system node verifies whether the KDF (timestamp, username, password) is correct against the identity authentication request information submitted by the SDP connection initiating host.

[0050] Specifically, if the SDP connection initiating host has secret information such as username and user password shared with authentication node A1, the authentication request includes KDF(timestamp, username, password) and encrypts it using the public key of authentication node A1, for example, Epk_A1(KDF(timestamp, username, password)).

[0051] KDF is a method to achieve key stretching, specifically, deriving one or more keys from a master key, password or passphrase, and the derivation process uses a PRF (Pseudo Random Function), which can be a hash algorithm.

[0052] For example, PBKDF2 is an algorithm that derives a key based on a password, and it needs to consume a large amount of computing power to prevent the encryption from being brute-force cracked. Scrypt is a KDF algorithm based on a password, and it needs to consume more resources than PBKDF2, effectively preventing the proprietary hardware ASIC / FPGA from being brute-force cracked. Scrypt uses the PBKDF2 algorithm internally, but it maintains a set of bit data for a long time, and these data can be obtained by repeatedly encrypting (Salsa20, a stream cipher) in the process of generating a complex salt.

[0053] Specifically, if the SDP connection initiating host has a token provided by the authentication node A2, the token Token is included in the identity authentication request, and the token Token is encrypted using the public key of the authentication node A2.

[0054] Specifically, the blockchain system node verifies whether the token Token is correct against the identity authentication request information submitted by the SDP connection initiating host. After the identity authentication is successful, the blockchain node searches for the SDP connection accepting host and policy information in the ledger, and returns the SDP connection initiating host's accessible SDP connection accepting host list as a response result to the SDP connection initiating host, including the blockchain node's signature on the response result, which may be the signature of one or more nodes. If the SDP connection accepting host specifies a verification / endorsement node in the policy, the node specified by the SDP connection accepting host needs to sign the response result.

[0055] Specifically, token means a sign or symbol, and is called a token in the IT field. In computer identity authentication, it means token (temporary) and is generally used as an invitation and login system. Before transmitting some data, encryption verification must be done first, and different encryption is allowed for different data operations. For example, the USB1.1 protocol defines four types of data packets: token packet, data packet, handshake packet, and special packet. Continuous data exchange between a host and a USB device can be divided into three stages: in the first stage, the host sends a token packet, and the contents of different token packets are different (different encryption) and can tell the device to do different jobs; in the second stage, the host sends a data packet, and in the third stage, the device returns one handshake packet.

[0056] In this embodiment, the SDP connection initiating host sends a query request for an accessible SDP connection accepting host list to the blockchain system node, and the blockchain node verifies the query request. If the authentication result is correct, it queries the SDP connection initiating host's accessible SDP connection accepting host list, and records the SDP connection initiating host and its accessible SDP connection accepting host list in the blockchain ledger.

[0057] Specifically, the records of the SDP connection initiating host and its accessible SDP connection accepting host list can be encrypted and then recorded in the blockchain. In this manner, the SDP connection accepting host can avoid querying the access list of the SDP connection initiating host, and the SDP connection accepting host can only know the result of whether it can be accessed.

[0058] Specifically, the host information of the SDP connection initiating host and its accessible SDP connection accepting host is marked as info_IH_AH, and the information is as follows: It can be encrypted as (Epk_IH(K),Ek(info_IH_AH)), where pk_IH is the public key of IH.

[0059] In this embodiment, if the SDP connection accepting host to be accessed is not in the SDP connection accepting host list, the SDP connection accepting host to be accessed does not respond.

[0060] The SDP connection initiating host may submit an access request to the SDP connection accepting host, where the access request may include location information of the SDP connection initiating host's accessible SDP connection accepting host list in a blockchain ledger.

[0061] In addition, when the records of the SDP connection initiation host and the accessible SDP connection acceptance host list are encrypted, the decryption key information, e.g., (Epk_AH(K)), where pk_AH is the public key of AH.

[0062] Specifically, the SDP connection accepting host queries the blockchain ledger, and if the SDP connection accepting host is in the SDP connection initiating host's accessible SDP connection accepting host list, it establishes a connection; otherwise, it does not respond.

[0063] In addition, if the records of the SDP connection initiating host and its accessible SDP connection accepting host list are encrypted, the SDP connection accepting host must further use its private key sk_AH to obtain key K, decrypt using K, and obtain info_IH_AH using DK(Ek(info_IH_AH)).

[0064] From the above, it can be seen that the technical solution according to the embodiment is as follows: The SDP connection accepting host sends the host information and supported connection policy of the SDP connection accepting host to the blockchain system node. The blockchain node verifies and consensuses the host information and supported connection policy of the SDP connection accepting host, and the host information and supported connection policy of the SDP connection accepting host after the blockchain node verification and consensus are recorded in the blockchain ledger. The SDP connection initiating host submits identity authentication information to the blockchain system node. The blockchain system node verifies the identity authentication information submitted by the SDP connection initiating host, and feeds back the authentication result after verification to the SDP connection initiating host. The SDP connection initiating host sends a query request for an accessible SDP connection accepting host list to the blockchain system node, and the query request includes the authentication result of the blockchain system node for the SDP connection initiating host. After verifying the query request, the blockchain system node queries the accessible SDP connection accepting host list of the SDP connection initiating host, and records the SDP connection accepting host list in the blockchain ledger. The SDP connection initiating host initiates a connection request to the SDP connection accepting host to be accessed. The SDP connection accepting host to be accessed consults the SDP connection initiating host's accessible SDP connection accepting host list in the blockchain ledger, and if the SDP connection accepting host to be accessed is in the SDP connection accepting host list, provides an access service to the SDP connection initiating host. In the embodiment of the present disclosure, the SDP service is provided to the customer in the form of a blockchain, and both the authentication and the request are verified, so that on the one hand, the SDP controller can be prevented from being subjected to DDoS attacks, and on the other hand, the SDP controller can be prevented from implementing incorrect authorization.

[0065] With the aid of FIG. 1, FIG. 2 and FIG. 3, and with reference to FIG. 5, a block chain-based SDP access control method is provided, which includes S21 to S25.

[0066] At S21, a blockchain system node receives verification information sent by an SDP connection accepting host, where the verification information includes host information and supported connection policies of the SDP connection accepting host.

[0067] In S22, the blockchain system node verifies the verification target information, and records it in the blockchain ledger after the verification is passed.

[0068] At S23, the blockchain system node receives identity authentication request information submitted by the SDP connection initiating host.

[0069] At S24, the blockchain system node verifies the identity authentication request information submitted by the SDP connection initiating host, and after the verification is successful, the blockchain system node receives a query request for an accessible SDP connection accepting host list sent by the SDP connection initiating host.

[0070] In S25, the blockchain system node verifies the query request, and after the verification is passed, the blockchain system node queries the SDP connection initiating host's accessible SDP connection accepting host list and records the SDP connection accepting host list in the blockchain ledger.

[0071] In this embodiment, the verification target information further includes host information of the SDP connection accepting host and a signature of a supported connection policy.

[0072] Specifically, when the SDP connection initiating host uses its private key to sign a timestamp in the identity authentication request, The blockchain system node verifying the identity authentication request information includes: The blockchain system node verifies the signature and timestamp submitted by the SDP connection initiating host.

[0073] Preferably, if the identity authentication request includes a KDF or encryption information to a KDF using a public key of the authentication node A1, The blockchain system node verifying the identity authentication request information includes: The blockchain system node verifies whether the KDF is correct.

[0074] Specifically, if the identity authentication request includes a token or encryption information for the token using the public key of the authentication node A2, The blockchain system node verifying the identity authentication request information includes: The blockchain system node verifies whether the token is correct.

[0075] The blockchain-based SDP access control method in this embodiment corresponds to the implementation scheme on the blockchain system node side described in the method shown in Figure 4. The specific implementation details are the same as those of the method shown in Figure 4, and will not be described here.

[0076] With the aid of FIG. 1, FIG. 2 and FIG. 3, and with reference to FIG. 6, a blockchain-based SDP access control method is provided, which includes S31 to S34.

[0077] At S31, the SDP connection initiating host submits identity authentication request information to a blockchain system node.

[0078] At S32, the SDP connection initiating host receives from the blockchain system node a verification result for the identity authentication request information submitted by the SDP connection initiating host.

[0079] At S33, the SDP connection initiating host sends a query request for an accessible SDP connection accepting host list to the blockchain system node, and the query request includes the blockchain system node's verification result for the identity authentication request information of the SDP connection initiating host.

[0080] In S34, the SDP connection initiating host initiates a connection request to an SDP connection accepting host, and the SDP connection initiating host receives the access service provided by the SDP connection accepting host in the SDP connection accepting host list.

[0081] Specifically, in the identity authentication request, the SDP connection initiating host signs a timestamp using its private key.

[0082] Specifically, if the SDP connection initiating host has a username and secret information shared with authentication node A1, the identity authentication request includes a KDF or encryption information to the KDF using the public key of authentication node A1.

[0083] Specifically, if the SDP connection initiating host has a token provided by authentication node A2, the identity authentication request includes the token or encryption information for the token using the public key of authentication node A2.

[0084] The blockchain-based SDP access control method in this embodiment corresponds to the implementation scheme of the SDP connection initiating host side described in the method shown in Figure 4. The specific implementation details are the same as those of the method shown in Figure 4, and will not be described here.

[0085] With the aid of FIG. 1, FIG. 2 and FIG. 3, and with reference to FIG. 7, a blockchain-based SDP access control device is provided, the device comprising: A first information verification module 41 configured to send information to be verified to the blockchain system node, so that the blockchain system node verifies the information to be verified and records it in the blockchain ledger after passing the verification, the information to be verified includes host information of an SDP connection acceptance host and a supported connection policy; a connection request initiation module 42 configured to receive a connection request sent by an SDP connection initiation host; and a first request response module 43 configured to query an accessible SDP connection accepting host list of the SDP connection initiating host in the block chain ledger, and provide an access service to the SDP connection initiating host if the SDP connection accepting host is in the SDP connection accepting host list.

[0086] Specifically, the host information of the SDP connection accepting host includes at least one of an IP address, a port, and a protocol information, and the supported connection policy includes at least one of an access user's login ID, an IP address, a geographical location, and a blockchain node's verification or endorsement policy.

[0087] Specifically, the verification target information further includes host information of the SDP connection accepting host and a signature of a supported connection policy.

[0088] The blockchain-based SDP access control device in the embodiment of the present disclosure is a product implementation scheme corresponding to the method shown in FIG. 4, and the specific implementation details are the same as those of the method shown in FIG. 4, and therefore will not be described here.

[0089] With the aid of FIG. 1, FIG. 2 and FIG. 3, and with reference to FIG. 8, a blockchain-based SDP access control device is provided, the device comprising: A second information verification module 51 configured to receive verification information sent by an SDP connection accepting host, verify the verification information, and record the verification information in a blockchain ledger after passing the verification, wherein the verification information includes host information and supported connection policies of the SDP connection accepting host; A first identity authentication request module 52 configured to receive identity authentication request information submitted by an SDP connection initiating host; an identity verification module 53 configured to verify identity authentication request information submitted by the SDP connection initiating host; a first query request module 54 configured to receive a query request for an accessible SDP connection-accepting host list sent by the SDP connection initiating host; and a query verification module 55 configured to verify the query request, and after passing the verification, query the accessible SDP connection accepting host list of the SDP connection initiating host, and record the SDP connection accepting host list in a blockchain ledger.

[0090] Specifically, the verification target information further includes host information of the SDP connection accepting host and a signature of a supported connection policy.

[0091] Specifically, when the SDP connection initiating host uses its private key to sign a timestamp in the identity authentication request, Verifying the identity authentication request information includes verifying a signature and a timestamp submitted by the SDP connection initiating host.

[0092] Specifically, if the identity authentication request includes a KDF or encryption information to the KDF using the public key of the authentication node A1, Verifying the identity authentication request information includes verifying whether the KDF is correct.

[0093] Specifically, if the identity authentication request includes a token or encryption information for the token using the public key of the authentication node A2, Verifying the identity authentication request information includes verifying whether the token is correct.

[0094] The blockchain-based SDP access control device in the embodiment of the present disclosure is a product implementation scheme corresponding to the method shown in FIG. 5, and the specific implementation details are the same as those of the method shown in FIG. 5, and therefore will not be described here.

[0095] With the aid of FIG. 1, FIG. 2 and FIG. 3, and with reference to FIG. 9, a blockchain-based SDP access control device is provided, the device comprising: A second identity authentication request module 61 configured to submit identity authentication request information to a blockchain system node; A verification feedback module 62 configured to receive a verification result for the identity authentication request information submitted to the SDP connection initiation host of the blockchain system node; A second query request module 63 configured to send a query request for an accessible SDP connection accepting host list to the blockchain system node, the query request including a verification result of the blockchain system node against the identity authentication request information of the SDP connection initiating host; a connection request receiving module 64 configured to initiate a connection request to an SDP connection accepting host; and a second request response module 65 configured to receive access services provided by SDP connection-accepting hosts in the SDP connection-accepting host list.

[0096] Specifically, in the identity authentication request, the SDP connection initiating host signs a timestamp using its private key.

[0097] Specifically, if the SDP connection initiating host has a username and secret information shared with authentication node A1, the identity authentication request includes a KDF or encryption information to the KDF using the public key of authentication node A1.

[0098] Specifically, if the SDP connection initiating host has a token provided by authentication node A2, the identity authentication request includes the token or encryption information for the token using the public key of authentication node A2.

[0099] The blockchain-based SDP access control device in the embodiment of the present disclosure is a product implementation scheme corresponding to the method shown in FIG. 6, and the specific implementation details are the same as those of the method shown in FIG. 6, and therefore will not be described here.

[0100] The present disclosure provides an SDP connection accepting host, comprising a processor, a memory, and a program stored in the memory and executable by the processor, the program, when executed by the processor, causing the processor to realize steps of a blockchain-based SDP access control method of the method shown in FIG. 4 or any possible embodiment thereof.

[0101] The present disclosure provides a blockchain system node, comprising a processor, a memory, and a program stored in the memory and executable by the processor, the program, when executed by the processor, causing the processor to realize steps of a blockchain-based SDP access control method of the method shown in FIG. 5 or any possible embodiment thereof.

[0102] The present disclosure provides an SDP connection initiation host, comprising a processor, a memory, and a program stored in the memory and executable by the processor, the program, when executed by the processor, causing the processor to realize steps of a blockchain-based SDP access control method of the method shown in FIG. 6 or any possible embodiment thereof.

[0103] The present disclosure provides a computer-readable storage medium having stored thereon a computer program, the computer program, when executed by a processor, causing the processor to perform steps of a blockchain-based SDP access control method of the method shown in FIG. 4 or any possible embodiment thereof, Or, when the computer program is executed by a processor, the computer program causes the processor to perform the steps of the blockchain-based SDP access control method of the method shown in FIG. 5 or any possible embodiment thereof; Or, when the computer program is executed by a processor, it causes the processor to implement the steps of the blockchain-based SDP access control method of the method shown in FIG. 6 or any possible embodiment thereof.

[0104] Specifically, the computer-readable storage medium may be any available medium that can be accessed by a computer, or may be a data storage device including a server, a data center, etc. integrated with one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)).

[0105] Specifically, the processor may be implemented by hardware or software, and when implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc. When implemented by software, the processor may be a general-purpose processor, and is implemented by reading software code stored in a memory, which may be integrated into the processor, located outside the processor, or exist independently.

[0106] The above embodiments may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented in software, they may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed in a computer, they generate in whole or in part a process or function according to the embodiments of the present disclosure. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or may be transmitted from one computer-readable storage medium to another, for example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wire (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, radio, microwave, etc.) methods.

[0107] Specifically, a central processing unit (CPU) executes various processes based on programs stored in a read-only memory (ROM) or programs loaded from a storage unit into a random access memory (RAM). Data required for the CPU to execute various processes is also stored in the RAM as necessary. The CPU, ROM, and RAM are connected to each other via a bus. An input / output interface is also connected to the bus.

[0108] An input unit (including a keyboard, a mouse, etc.), an output unit (including displays such as a cathode ray tube (CRT) or a liquid crystal display (LCD), and speakers, etc.), a memory unit (including a hard disk, etc.), and a communication unit (including a network interface card such as a LAN card or a modem) are connected to the input / output interface. The communication unit performs communication processing via a network such as the Internet. If necessary, a driver may also be connected to the input / output interface. Removable media such as a magnetic disk, an optical disk, a magneto-optical disk, and a semiconductor memory may be installed in the drive as necessary, so that a computer program read from there is installed in the memory unit as necessary.

[0109] When the above-described series of processes is realized by software, the programs that constitute the software are installed from a network such as the Internet or a storage medium such as a removable medium.

[0110] As should be understood by those skilled in the art, such storage media are not limited to removable media that are distributed separately from the device in which the program is stored to provide the program to the user. Examples of removable media include magnetic disks (including floppy disks), optical disks (including compact disks read only memory (CD-ROM) and digital versatile disks (DVD)), magneto-optical disks (including mini disks (MD)), and semiconductor memories. Alternatively, the storage media may be ROMs, hard disks included in storage units, etc., in which the program is stored and distributed to the user together with the device containing them.

[0111] Obviously, those skilled in the art should understand that each module or each step of the disclosure described above may be implemented by a general-purpose computing device, they may be centralized in a single computing device, or they may be distributed across a network of multiple computing devices, and optionally they may be implemented by a computing device executable program code, whereby they may be stored in a storage device and executed by a computing device, and in some cases, the steps illustrated or described may be implemented in a different order than shown here, or by creating each of them as an integrated circuit module, or by creating multiple of the modules or steps as a single integrated circuit module. In this way, the disclosure is not limited to any particular combination of hardware and software.

[0112] Although the embodiments of the present application have been described above with reference to the drawings, the present application is not limited to the specific embodiments described above, and the specific embodiments described above are merely illustrative and not limiting. A person skilled in the art can make many forms that fall within the scope of protection of the present application under the teachings of the present application without departing from the spirit and scope of the claims of the present application.

Claims

1. A blockchain-based software-defined perimeter (SDP) access control method, comprising: An SDP connection accepting host sends verification information to a blockchain system node, the verification information including host information of the SDP connection accepting host and a connection policy supported by the SDP connection accepting host, and the host information of the SDP connection accepting host and the connection policy supported by the SDP connection accepting host are recorded in a blockchain ledger by the blockchain system node after the verification information passes verification by the blockchain system node; said SDP connection accepting host receiving a connection request sent by an SDP connection initiating host; The SDP connection accepting host queries a list of SDP connection accepting hosts accessible to the SDP connection initiating host in the block chain ledger, and if the SDP connection accepting host is in the list of SDP connection accepting hosts, provides an access service to the SDP connection initiating host. Including, The list of SDP connection accepting hosts is recorded in the blockchain ledger by the blockchain system node when the blockchain system node queries the blockchain ledger for SDP connection accepting hosts accessible by the SDP connection initiating host based on the host information of the SDP connection accepting host and the connection policy supported by the SDP connection accepting host, and the list of the queried SDP connection accepting hosts is recorded in the blockchain ledger; The connection policy supported by the SDP connection acceptance host includes a login ID (Identity) of a user whose access is supported, and a verification or endorsement policy of a blockchain node.

2. The blockchain-based SDP access control method of claim 1, wherein the blockchain system nodes are composed of an SDP controller and an authentication node connected to each other, both of the SDP controller and the authentication node are blockchain nodes, the host information of the SDP connection accepting host includes at least one of an IP address and port and protocol information, and the connection policy supported by the SDP connection accepting host further includes at least one of an IP (Internet Protocol) address and a geographical location.

3. The blockchain-based SDP access control method according to claim 1 , wherein the verification target information further includes the host information of the SDP connection accepting host and a signature of the connection policy supported by the SDP connection accepting host.

4. A blockchain-based software-defined perimeter (SDP) access control method, comprising: A blockchain system node receives verification target information sent by an SDP connection acceptance host, the verification target information including host information of the SDP connection acceptance host and a connection policy supported by the SDP connection acceptance host; The blockchain system node verifies the verification target information, and after passing the verification, records the host information of the SDP connection acceptance host and the connection policy supported by the SDP connection acceptance host in a blockchain ledger; The blockchain system node receives identity authentication request information submitted by an SDP connection initiating host; The blockchain system node verifies the identity authentication request information submitted by the SDP connection initiation host, and after successful verification, the blockchain system node receives a query request for a list of accessible SDP connection acceptance hosts sent by the SDP connection initiation host; The blockchain system node verifies the query request, and after passing the verification, the blockchain system node queries the SDP connection accepting hosts accessible by the SDP connection initiating host in the blockchain ledger according to the host information of the SDP connection accepting host and the connection policy supported by the SDP connection accepting host, and records the list of the queried SDP connection accepting hosts in the blockchain ledger; Including, The connection policy supported by the SDP connection acceptance host includes the login ID (Identity) of the user whose access is supported, and the verification or endorsement policy of the blockchain node.

5. The blockchain-based SDP access control method according to claim 4, wherein the verification target information further includes the host information of the SDP connection accepting host and a signature of the connection policy supported by the SDP connection accepting host.

6. If the SDP connection initiating host signs a timestamp using its private key in the identity authentication request, The blockchain-based SDP access control method of claim 4, wherein the blockchain system node verifying the identity authentication request information includes the blockchain system node verifying a signature and timestamp submitted by the SDP connection initiating host.

7. The blockchain system nodes are composed of an SDP controller and an authentication node that are interconnected, both of the SDP controller and the authentication node being blockchain nodes; If the identity authentication request includes a KDF or encryption information to the KDF using the public key of the authentication node A1, The blockchain-based SDP access control method of claim 4, wherein the blockchain system node verifying the identity authentication request information includes the blockchain system node verifying whether the KDF is correct.

8. If the identity authentication request includes a token or encryption information for the token using the public key of the authentication node A2, The blockchain-based SDP access control method of claim 4, wherein the blockchain system node verifying the identity authentication request information includes the blockchain system node verifying whether the token is correct.

9. A blockchain-based software-defined perimeter (SDP) access control method, comprising: An SDP connection initiating host submits identity authentication request information to a blockchain system node; The SDP connection initiation host receives from the blockchain system node a verification result for the identity authentication request information submitted by the SDP connection initiation host; The SDP connection initiation host sends a query request for a list of accessible SDP connection accepting hosts to the blockchain system node, the query request including a verification result of the blockchain system node for the identity authentication request information of the SDP connection initiation host, the list of the SDP connection accepting hosts is obtained by the blockchain system node querying the SDP connection accepting hosts accessible by the SDP connection initiation host in the blockchain ledger based on the host information of the SDP connection accepting host recorded in the blockchain ledger and the connection policy supported by the SDP connection accepting host, and recording the list of the queried SDP connection accepting hosts in the blockchain ledger, the connection policy supported by the SDP connection accepting host including the login ID (Identity) of a user whose access is supported, and the verification or endorsement policy of the blockchain node; the SDP connection initiating host initiating a connection request to the SDP connection accepting host; the SDP connection initiating host receiving access services provided by the SDP connection accepting hosts in the list of SDP connection accepting hosts; A blockchain-based SDP access control method, comprising:

10. The blockchain-based SDP access control method according to claim 9, wherein in the identity authentication request, the SDP connection initiating host signs a timestamp using its own private key.

11. The blockchain system nodes are composed of an SDP controller and an authentication node that are interconnected, both of the SDP controller and the authentication node being blockchain nodes; 10. The blockchain-based SDP access control method of claim 9, wherein if the SDP connection initiating host has a username and secret information shared with authentication node A1, the identity authentication request includes encryption information to the KDF or the KDF using the public key of authentication node A1.

12. 10. The blockchain-based SDP access control method of claim 9, wherein if the SDP connection initiating host has a token provided by authentication node A2, the identity authentication request includes the token or encrypted information to the token using the public key of authentication node A2.

13. A software defined boundary (SDP) connection accepting host, comprising: The SDP connection accepting host comprises a processor, a memory, and a program stored in the memory and executable by the processor, the program, when executed by the processor, causing the processor to execute the blockchain-based SDP access control method described in any one of claims 1 to 3. An SDP connection accepting host.

14. A blockchain system node, The blockchain system node comprises a processor, a memory, and a program stored in the memory and executable by the processor, the program, when executed by the processor, causing the processor to execute the blockchain-based SDP access control method described in any one of claims 4 to 8. A blockchain system node.

15. 1. A software-defined boundary (SDP) connection initiating host, comprising: The SDP connection initiation host comprises a processor, a memory, and a program stored in the memory and executable by the processor, the program, when executed by the processor, causing the processor to execute the blockchain-based SDP access control method described in any one of claims 9 to 12. An SDP connection initiation host.

Images