CN114039750A

CN114039750A - Method for protecting SDP controller

Info

Publication number: CN114039750A
Application number: CN202111247584.9A
Authority: CN
Inventors: 奚阳; 陈郑; 胡晓坤
Original assignee: Clp Hongxin Information Technology Co ltd
Current assignee: Clp Hongxin Information Technology Co ltd
Priority date: 2021-10-26
Filing date: 2021-10-26
Publication date: 2022-02-11
Anticipated expiration: 2041-10-26
Also published as: CN114039750B

Abstract

The invention discloses a method for protecting an SDP controller, which comprises the following steps: s01, the SDP client generates IP and port information of the access target controller; s02, the SDP client initiates SPA single packet authentication to the target controller; s03, the network control admission system presets a plurality of IP POOL address POOLs, and a controller schedules to temporarily activate or release the IP to a client for access in a certain time period; s04, the controller calculates IP and access port needing to be put through at a certain moment, and the controller and the network control access system put through the IP and port access strategy; s05, after the client side can normally send the SPA authentication message to the controller system, the controller checks the information of the SPA message; and S06, after receiving the target gateway information, the client initiates resource access to the SDP gateway system. The invention better realizes the network stealth characteristic of the SDP system and greatly enhances the architecture security and the robustness of the SDP system.

Description

Method for protecting SDP controller

Technical Field

The invention relates to a realization method for protecting an SDP controller, belonging to the technical field of network security.

Background

The english abbreviation of sdp (software Defined perimeter) software Defined boundary is a completely new concept of network boundary. Defined by CSA international cloud security alliance, the core idea is that core network assets and facilities can be hidden through an SDP framework so as not to be exposed to the internet, and various attack behaviors and security threats are prevented to the greatest extent. The SDP makes up the defects of a TCP/IP framework, avoids important network assets from being directly exposed to the internet, can directly deploy applications on the Internet to achieve efficient and safe access as intranet applications, realizes the hiding and zero trust of the key assets, avoids network safety risks and achieves thorough safety protection on the framework.

SDP mainly contains three parts: SDP Controller (Controller), SDP Gateway (Gateway), and SDP Client (Client).

All types of network attacks, including DDos, man-in-the-middle attacks, server queries (OWASP ten threats) and advanced persistent threats (ATP), are thwarted by using a new SDP security model, incorporating security components such as device authentication, identity-based access, and dynamic configuration connections.

At present, the conventional SDP security architecture has the following problems:

(1) according to the traditional SDP architecture, through the technical scheme of SPA single-packet authentication of authentication first and connection second, even if an illegal connection or an attacker scans the SDP controller through a network and sniffs a port, any network exposed surface cannot be sensed, and the network stealth function is realized. However, the client still needs to know the IP address and the port of the connected controller, otherwise, data communication cannot be carried out, so that an attacker or hacker can easily initiate subsequent network attack or the IP address and the port of the controller;

(2) although a hacker or an attacker cannot scan the IP and the port of the SDP controller, if the hacker or the attacker is familiar with or knows about the SDP principle or protocol, DDOS attack can be initiated to the IP address and the port of the SDP controller, and the controller cannot provide service capability due to denial-of-service attack on the SDP controller caused by blocking a communication channel, so that the SDP system cannot continue to work at this time.

Disclosure of Invention

In order to overcome and avoid the technical defects, the invention provides the implementation method for protecting the SDP controller, which strengthens the safety of the SDP controller, dynamically loads the IP and the port randomness generation algorithm on the controller and the client, greatly improves the attack and flow cost of hackers or attackers, reduces the possibility of being attacked, and greatly improves the service continuity and the safety of the SDP system.

The technical scheme adopted by the invention is as follows: an implementation method for protecting an SDP controller comprises the following steps:

s01, the SDP client dynamically generates IP and port information of the access target controller based on a time algorithm;

s02, the SDP client end automatically initiates SPA single packet authentication to the target controller, the SPA authentication message contains MFA user identification information;

s03, the network control admission system presets a plurality of IP POOL address POOLs, and a controller schedules to temporarily activate or release the IP to a client for access in a certain time period;

s04, the controller calculates IP and access port needing to be opened at a certain moment based on consistency of time algorithm and client generation algorithm by adopting a non-contact mode, and the controller and the network control access system open IP and port access strategy;

s05, after the client side can normally send an SPA authentication message to the controller system, the controller checks the information of the SPA message, if the check of the SPA message fails, the message is directly discarded, and if the check is successful, the SDP client side is dynamically informed to access a certain gateway system and inform the gateway of releasing the client side resource access authority;

and S06, after receiving the target gateway information, the client initiates resource access to the SDP gateway system.

Further, in step S02, the client initiates SPA single packet authentication to the controller based on the calculated controller target IP and port and carrying the static or MFA multi-factor authentication information filled by the user.

Further, the controller schedules and manages to temporarily enable or activate a certain IP and a port for the SDP client to access and use, and the generated IP address is consistent with the IP address generated by the client based on the time algorithm, so that the network communication is guaranteed to be accessible.

Furthermore, an SPA authentication packet initiated by the client can normally reach the controller through the network access control equipment, the controller checks the SPA authentication information of the user, the check information comprises the equipment fingerprint, the static password, the OTP and the code scanning multi-factor authentication information of the user, and any authentication information error can directly lead the DROP to the data packet.

Further, after verifying that the user SPA authentication information is accurate, the controller simultaneously returns related authentication and access policy information to the client and the gateway, informs the client of the corresponding access relationship between the target resource to be accessed and the gateway, and simultaneously informs the gateway of accessing the client to secure access policies.

The invention has the beneficial effects that: the IP and port information to be accessed is dynamically generated at the client and the controller through a time and random algorithm, and the network access control strategy is dynamically generated at the same time, so that a hacker or an attacker can hardly find the IP and port information of the controller through guessing or packet capturing, and meanwhile, based on the SPA single-packet authentication characteristic of the controller, the hidden protection capability of the network can be better realized, the hacker and the attacker can more difficultly acquire the controller information, the attack cost and the cost are also sharply increased, and the safety of the SDP controller and the whole SDP framework can be better protected.

Drawings

FIG. 1 is a schematic flow diagram of the present invention;

FIG. 2 is a schematic diagram of the data and signal flow of the modules of the present invention.

Detailed Description

The invention is described in detail below with reference to the figures and specific embodiments.

As shown in fig. 1 and 2, this embodiment discloses an implementation method for protecting an SDP controller, which includes the following specific steps:

(1) firstly, a client side calculates a target controller and an IP port which need to be accessed at a certain time based on a time dynamic generation algorithm;

(2) the client initiates SPA single-packet authentication to the controller based on the calculated controller target IP and port and carrying the static or MFA multi-factor authentication information filled by the user;

(3) the network control access system can preset a plurality of sections of IP POOL, routing and other information, and temporarily start or activate a certain IP and a port for the access of an SDP client by scheduling management of a controller, so that the generated IP address is consistent with the IP address generated by the client based on a time algorithm, and the network communication can be ensured to be accessible; at this time, other illegal access or hacker attackers cannot perceive the dynamically generated IP address, so that network attack cannot be initiated to the controller, and the controller is prevented from being attacked from the outside;

(4) the controller can also generate or open an IP and a port for the access of the client based on a time algorithm, and simultaneously inform a network control access system to ensure that the strategies are consistent;

(5) an SPA authentication packet initiated by a client can normally reach a controller through network access control equipment, the controller checks SPA authentication information of a user, the check information comprises multi-factor authentication information such as equipment fingerprint, static password, OTP (one time password) and scanning code of the user, and any authentication information error can directly lead to the DROP data packet;

(6) after verifying that the SPA authentication information of the user is accurate, the controller simultaneously returns related authentication and access strategy information to the client and the gateway, informs the client of the corresponding access relation between the target resource to be accessed and the gateway, and informs the gateway of accessing the client to a safe access strategy;

(7) the client can normally initiate a data connection request to the gateway and access the target application resource after being checked and verified by the gateway security policy.

In summary, the implementation method for protecting the SDP controller disclosed in this embodiment changes the defect that the IP address and the access port of the traditional SDP architecture controller are always unchanged and can continuously launch DOS attack once being known by a hacker, reduces the attack risk of the SDP system controller being captured or guessed, randomly increases the attack cost of the hacker or attacker through the IP and the port, better implements the network stealth feature of the SDP system, greatly enhances the architecture security and robustness of the SDP system, further optimizes the security architecture capability of the SDP system, and avoids some design defects of the system.

The foregoing illustrates and describes the principles, general features, and advantages of the present invention. It should be understood by those skilled in the art that the above embodiments do not limit the scope of the present invention in any way, and all technical solutions obtained by using equivalent substitution methods fall within the scope of the present invention.

The parts not involved in the present invention are the same as or can be implemented using the prior art.

Claims

1. An implementation method for protecting an SDP controller is characterized by comprising the following steps:

2. The method as claimed in claim 1, wherein in step S02, the client initiates SPA single packet authentication to the controller based on the calculated target IP and port of the controller and carrying the static or MFA multi-factor authentication information filled by the user.

3. The method as claimed in claim 1, wherein in step S03, the controller schedules and manages to temporarily enable or activate an IP and a port for the SDP client to access, and the generated IP address is consistent with the IP address generated by the client based on the time algorithm, so as to ensure that network communication is accessible.

4. The method of claim 1, wherein in step S05, the SPA authentication packet initiated by the client normally reaches the controller through the network admission control device, and the controller checks the SPA authentication information of the user, where the check information includes the device fingerprint, static password, OTP, and scan code multi-factor authentication information of the user, and any authentication information error will directly DROP the data packet.

5. The method as claimed in claim 4, wherein the controller returns the authentication and access policy information to the client and the gateway after verifying that the user SPA authentication information is accurate, informs the client of the access relationship between the target resource to be accessed and the gateway, and informs the gateway of accessing the client to the security access policy.