SDP (Software Defined Perimeter)
A security architecture that cloaks infrastructure from the outside world until device authentication and user trust are verified.
I. Overview
%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
A["Visible\nattack surface"] -- "Cloaking (Black Cloud)" --> B["Trust-based\nconnection (Drop-all)"]
style A fill:#f9f9f9,stroke:#333,stroke-width:3px
style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px
Definition: A software-defined security architecture that cloaks infrastructure from the outside world ( Black Cloud ) until device authentication and user trust have been verified.
Features:
( Trust-Based ) A core technology for implementing Zero Trust, applying an authenticate-first, connect-second mechanism.
( Concealment ) Implements a “Black Cloud” that exposes no resources to unauthenticated users.
( Minimized Attack Surface ) Blocks unauthenticated traffic at the source, defending against scanning and distributed denial-of-service ( DDoS ) attacks.
II. Mechanism & Components
SDP Logical Architecture
flowchart LR
CL["SDP Client\nUser Device"] -->|"① SPA authentication request"| CT["SDP Controller\nAuthentication / Policy Decision"]
CT -->|"② Verifies device posture\nand location info"| CT
CT -->|"③ Command to open gateway"| GW["SDP Gateway\nResource Gateway"]
CL -->|"④ Authorized connection"| GW
GW -->|"⑤ Access"| RS["Protected Resource\nApp / Server"]
UN["⚠ Unauthenticated User"] -. "Blocked\n(Black Cloud)" .-> GW
Key Point: A structure in which authentication is completed in the control plane before the data plane’s pathway is opened.
Key Components and Security Technologies
| Component | Primary Role | Core Security Technology |
|---|---|---|
| SDP Controller | Authentication and policy decision | SPA (Single Packet Authorization): authentication attempted with a single packet |
| SDP Gateway | Resource access gateway | Black Cloud: blocks scanning by unauthenticated users (concealment) |
| SDP Client | User device software | Transmits device posture and location information |
III. Advanced Topics & Comparison
SDP vs. Traditional VPN (Virtual Private Network)
| Comparison | VPN (Traditional) | SDP (Next Generation) |
|---|---|---|
| Authentication Method | Authenticate after connecting (ID/password-centric) | Authenticate before connecting (multi-factor device/user verification) |
| Visibility | All resources exposed upon network connection | Only authorized resources exposed, on a least-privilege basis |
| Security Model | Perimeter security (a trusted zone exists) | Zero Trust (nothing is trusted) |
| Connection Method | Network layer (L3/L4) connection | Fine-grained control centered on the application layer (L7) |
Last updated 18 Aug 2026, 00:00 UTC.