Implementing Continuous Authentication in Network Connection Based on Improved SPA

Compared with traditional network boundary defense based on dedicated firewalls, Software Defined Perimeter (SDP) brings new security features and decreases cyberattacks caused by network exposure by hiding the infrastructure, applications and access controls. Single Packet Authorization (SPA) is the first step in SDP authentication. After the verification of SPA, there are some security issues still need to be improved or addressed. The primary issue is how to ensure the security of connection and timeliness of disconnection while both communication sides will stay connected until the session is finished in SDP. As the most widely used way to maintain a long-term connection between two communication parties, heartbeat mechanism can maintain the connection state with few resource consumption. However, continuous identity authentication cannot be performed during the keepalive phase since heartbeat packets are usually empty or containing fixed content. In this paper, a new scheme is proposed, where SPA is no longer only used once in the authentication phase before initial connection establishment, but also plays the role of continuous authentication in the form of heartbeat packets during the keepalive phase in sessions. Besides, the authentication information generation method in SPA module has been improved by optimizing One Time Password (OTP), in which the count of heartbeat packets is considered. Analysis shows that the proposed scheme can achieve better connection security.