Solution for potential safety hazards in VPN (virtual private network)

Abstract

The invention discloses a solution for potential safety hazards in a VPN (virtual private network), which comprises the following steps that: A, a firewall server detects that whether a ciphertext of packet header information of an encryption part of a data packet in a VPN tunnel is in a black and white list corresponding to a destination IP address in plaintext packet header information thereof; B, if the obtained result in the step A is that the ciphertext is not in the black and white list, the firewall server inquires firewalls according to the destination IP (internet protocol) address so as to obtain eligible FDD (firewall decision diagram) branches; C, the firewall server converts the inquiring results obtained in the step B into an OBDD (ordered binary decision diagram), and saves the OBDD and corresponding inquiring conditions; D, the firewall server encrypts and confuses each node of the OBDD obtained in the step C, and sending the OBDD to a VPN server; E, the VPN server decrypts the received OBDD so as to obtain destination node information, and the ciphertext of an exclusive-or data packet of the information is sent to the firewall server; and F, the firewall server executes a firewall strategy, and adds the ciphertext in the step A into the black and white list corresponding to the destination IP address. The firewall securely executes the firewall strategy for a data stream in the VPN tunnel, and the encrypted data is not leaked.

Description

Technical field [0001] The present invention relates to the technical field of network security, and in particular to a solution to hidden dangers in a virtual private network (VPN, Virtual Private Network). Background technique [0002] Virtual private network VPN (hereinafter referred to as VPN) is a remote access technology, that is, a private network is set up using public network links. Security and privacy are the two main technical goals in VPNs. In the current VPN technical solution, the VPN terminal mainly relies on the tunnel technology, that is, the encryption method is used to ensure the security and privacy of communication. However, because the encryption method is used, the firewall of the external network where the roaming user in the VPN is located cannot effectively inspect and manage the communication data in the tunnel. In this way, these tunnels that cannot be inspected and managed by the firewall become the entrance of malicious attacks. This vulnerability...

AI Technical Summary

Problems solved by technology

Method (2) fixes this security hole and improves efficiency, but method (2) has to introduce a trusted third party to prevent privacy leakage during the calculation process

On the one hand, the trusted third party introduced in method (2) strengthens the security in the calculation process, but on the other hand, it also makes the security of the VPN passive and restricted by the third party.

Images