{"id":21675,"date":"2022-10-12T01:57:25","date_gmt":"2022-10-12T01:57:25","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=21675"},"modified":"2026-04-17T18:07:43","modified_gmt":"2026-04-17T18:07:43","slug":"harry-potters-invisibility-cloak-and-moodys-eye-software-defined-perimeter-sdp","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/harry-potters-invisibility-cloak-and-moodys-eye-software-defined-perimeter-sdp\/","title":{"rendered":"Harry Potter’s Invisibility Cloak and Moody’s Eye: Software Defined Perimeter (SDP)"},"content":{"rendered":"\n

<\/p>\n\n\n\n

In the last series of popular science, we talked about Zero Trust Network Access (ZTNA)<\/a> and learned the three critical technologies of zero trust—SDP, IAM and MSG. In this article, we will continue to introduce a security capability of NSFOCUS SASE – the SDP, one of the three major technologies.<\/p>\n\n\n\n

What is SDP?<\/h2>\n\n\n\n

The SDP stands for Software Defined Perimeter, a new generation of network security technology architecture based on the concept of Zero Trust proposed by the International Cloud Security Alliance (CSA) in 2013.<\/p>\n\n\n\n

In 1993, the famous American cartoonist Peter Steiner published a world-famous cartoon dubbed “On the internet, nobody knows you’re a dog.”<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

To solve the problem of verifying whether the remote connection is a human or a dog when you are sitting at the computer, the zero-trust concept of ​​”never trust, always verify” came into being. How to achieve stealth on the Internet, trusted control, and minimal on-demand authorization? Those are what the SDP can do. So how does it do these things?<\/p>\n\n\n\n

SDP Implementation Principle<\/h2>\n\n\n\n

The function of SDP won’t be <\/a>realized without the three core components: SDP control center, SDP client and SDP gateway.<\/p>\n\n\n\n

The SDP control center is responsible for policy configuration, identity or device-based refined application authorization based on identity or device, log auditing, and docking authentication services;<\/p>\n\n\n\n

The SDP client is responsible for uniquely identifying the terminal, reporting status information, and initiating single packet authorization (SPA) and authentication requests. It also provides private DNS, and cooperates with business traffic proxy to automatically address application traffic to the corresponding gateway;<\/p>\n\n\n\n

The SDP gateway is responsible for service hiding. After the SPA knocking, it opens the dynamic TCP port to the authenticated terminal and implements the specific SDP control center policy after the user passes the authentication.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Three core components of SDP<\/p>\n\n\n\n

Before the client accesses data, it establishes an authentication and authorization channel through the control plane, the SDP controller and the application server. After the authentication is passed and the access authorization is obtained, the SDP controller determines a list of hosts that the client can be authorized to communicate with. Then the client can establish a data access channel with the application server on the data plane, allowing intended traffic to pass through.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

SDP access flow<\/p>\n\n\n\n

Once the user can be authenticated, we can be sure who the user is (could be a liar or a dog), and SDP creates a secure encrypted tunnel to protect communications between the user and the requested resource.<\/p>\n\n\n\n

Advantages of SDP<\/h2>\n\n\n\n

So what benefits does it bring to safe deployment? Through the separation of the control layer and the service layer, continuous monitoring and evaluation of the context, it provides on-demand minimum authorization and mutual TLS communication encryption to ensure the security of the link. SDP can effectively deal with many network security threats, including:<\/p>\n\n\n\n