SDP terminal traffic proxy method and device, equipment and storage medium

Abstract

The invention discloses an SDP terminal traffic proxy method and device, equipment and a storage medium. The method comprises the following steps: sending a knock request to an SDP controller through an SDP terminal proxy, receiving a knock result obtained after the SDP controller accesses a target gateway according to the knock request, and then configuring a routing table of a terminal according to the knock result; acquiring an application access request of a user for a target application through a physical network card, and sending the application access request to an HTTP tunnel client according to the routing table, so that a data packet corresponding to the application access request is modified through the HTTP tunnel client, and the modified data packet contains equipment identification information corresponding to a local terminal; and sending the modified data packet to an HTTP tunnel server of the target gateway through the HTTP tunnel client, so that the target gateway performs authority control on the user according to the equipment identification information in the modified data packet. The authentication management and control of the four-layer traffic can be realized.

Description

technical field [0001] The present invention relates to the field of computer technology, in particular to an SDP terminal traffic proxy method, device, equipment and storage medium. Background technique [0002] At present, SDP (Software Defined Perimeter, software-defined boundary) is one of the important technical directions of zero trust. Its main purpose is to reduce the exposure of application gateway ports. The main logic is to gradually release the client IP to the application gateway by knocking on the door. The access policy of the TCP (Transmission Control Protocol, Transmission Control Protocol) port (generally controlled by iptables), but in reality, the egress IP of the traffic of multiple terminals may be the same, which will cause the problem of port policy amplification. Moreover, for the zero-trust application gateway, it can only obtain the IP address of the last network node through which the traffic passes. For multiple terminals using the same egress IP...

AI Technical Summary

Problems solved by technology

[0003] In view of this, the purpose of the present invention is to provide a SDP terminal traffic proxy method, device, equipment and medium, which can realize the authentication control of the four-layer traffic of the terminal, and solve the knock-on amplification and four-way traffic of the traditional zero-trust SDP. The problem that layer traffic cannot be controlled

Images