Method for realizing information bypass by using IP Option

Abstract

The invention provides a method for realizing information bypass by using IP Option, the process thereof is: 1. incepting a first message of each network flow at a gateway; 2. encapsulating private information into IP Option before transferring the message and inserting into the head and tail part of the message; 3. adjusting ihl and tot_len at the head part of the message, and re-calculating checksum at the head of the message; 4. transferring the message; and 5. intercepting the message at the central node of the network, analyzing the first message of each network flow to obtain the private information, and deleting the private information in the message and then transferring the message. Only the first message of each network flow needs modifying, so the influence on the transfer performance of message transfer is very small, even if the first message needs slicing, the influence on the transfer performance is not large; the private information and the normal message are transferred out together, thus the reliability is guaranteed, if the normal message is lost, the network application can re-transfer the message, and during the re-transfer, the private information can still be passed by.

Description

technical field [0001] The invention relates to a method for carrying private information on a gateway device, in particular to a method for realizing transparent transmission of information by using an IP Option in the gateway device, and belongs to the technical fields of computer network communication and computer network security. Background technique [0002] With the development of the computer security industry and the advancement of enterprise informatization, small and medium-sized enterprises have increasingly strong demands for network security, but the network security business has high requirements for hardware and high costs. A centralized security solution is derived from this, which provides network security guarantees for a group of small and medium-sized enterprises in the network nodes by deploying security devices at the central node of the network, greatly reducing the equipment procurement costs of small and medium-sized enterprises. [0003] One diffic...

AI Technical Summary

Problems solved by technology

[0009] ②Scheme 2 has very high requirements on the reliability and real-time performance of NAT uploads. In real networks, packet loss and delays are likely to occur, resulting in the situation that the network security device cannot find NAT entries and cannot identify user identities.

Images