I. Overview

%%{init: { 'theme': 'base', 'themeVariables': { 'edgeLabelBackground': '#fff' }}}%%
flowchart LR
    A["Visible\nattack surface"] -- "Cloaking (Black Cloud)" --> B["Trust-based\nconnection (Drop-all)"]
    style A fill:#f9f9f9,stroke:#333,stroke-width:3px
    style B fill:#e1f5fe,stroke:#01579b,stroke-width:3px

Definition: A software-defined security architecture that cloaks infrastructure from the outside world ( Black Cloud ) until device authentication and user trust have been verified.

Features:
( Trust-Based ) A core technology for implementing Zero Trust, applying an authenticate-first, connect-second mechanism.
( Concealment ) Implements a “Black Cloud” that exposes no resources to unauthenticated users.
( Minimized Attack Surface ) Blocks unauthenticated traffic at the source, defending against scanning and distributed denial-of-service ( DDoS ) attacks.

II. Mechanism & Components

SDP Logical Architecture

flowchart LR
    CL["SDP Client\nUser Device"] -->|"① SPA authentication request"| CT["SDP Controller\nAuthentication / Policy Decision"]
    CT -->|"② Verifies device posture\nand location info"| CT
    CT -->|"③ Command to open gateway"| GW["SDP Gateway\nResource Gateway"]
    CL -->|"④ Authorized connection"| GW
    GW -->|"⑤ Access"| RS["Protected Resource\nApp / Server"]

    UN["⚠ Unauthenticated User"] -. "Blocked\n(Black Cloud)" .-> GW

Key Point: A structure in which authentication is completed in the control plane before the data plane’s pathway is opened.

Key Components and Security Technologies

ComponentPrimary RoleCore Security Technology
SDP ControllerAuthentication and policy decisionSPA (Single Packet Authorization): authentication attempted with a single packet
SDP GatewayResource access gatewayBlack Cloud: blocks scanning by unauthenticated users (concealment)
SDP ClientUser device softwareTransmits device posture and location information

III. Advanced Topics & Comparison

SDP vs. Traditional VPN (Virtual Private Network)

ComparisonVPN (Traditional)SDP (Next Generation)
Authentication MethodAuthenticate after connecting (ID/password-centric)Authenticate before connecting (multi-factor device/user verification)
VisibilityAll resources exposed upon network connectionOnly authorized resources exposed, on a least-privilege basis
Security ModelPerimeter security (a trusted zone exists)Zero Trust (nothing is trusted)
Connection MethodNetwork layer (L3/L4) connectionFine-grained control centered on the application layer (L7)

Last updated 18 Aug 2026, 00:00 UTC. history