Data transmission method and system based on virtualized network and network security equipment

Abstract

The invention provides a data transmission method and system based on a virtualized network and network security equipment. The method comprises the following steps: a plurality of data messages sent from a plurality of first end communication equipment is hijacked by first security equipment; the first security equipment determines a mapping relationship between real network information and virtual network information of the first end communication equipment and the opposite end communication equipment based on a predetermined compiling strategy, and creates a virtualized network on a physical line established between each first end communication equipment and the opposite end communication equipment based on the mapping relationship; a data message is sent to an opposite-end communication equipment based on the created virtualized network; the first safety equipment receives a data message which is sent by second safety equipment on the opposite-end communication equipment side and comes from the opposite-end communication equipment, and analyzes and restores a virtual network address of the opposite-end communication equipment based on a pre-stored compiling strategy; and after successful restoration, the restored data message of the real network address of the opposite-end communication equipment is transmitted to the corresponding first-end communication equipment.

Description

technical field [0001] The present invention relates to the technical field of data security, in particular to a virtualized network-based data transmission method, device and system. Background technique [0002] In recent years in our country, with the development of network technology and the popularization and enrichment of network applications, the problem of network security has become increasingly serious. High-tech crimes using information technology have shown an increasing trend. Therefore, building a safe communication environment is an inevitable trend. [0003] Due to the diversity of connection forms, the uneven distribution of terminals, and the openness and interconnectivity of the network, it is possible for attackers to detect and scan asset devices in the network, eavesdrop on information on the network, and steal user information. Passwords, database information; it is also possible to tamper with the contents of the database, forge user identities, and d...

AI Technical Summary

Problems solved by technology

Among them, the risks at the software level are mainly reflected in: (1) The traditional network security defense method is to passively detect virus samples, intrusion signature samples and other mechanisms. What can be released and what can be blocked, but in actual network communication, hackers are often simulated as ordinary users who can be released to access, and are directly released by the network security gateway to enter the user's intranet, which causes uncontrollable risks; (2) The traditional network security is a tower defense. Various security software products are stacked and accumulated, and various static passive defenses are superimposed on each other. It is impossible to defend in a fundamentally effective way. Dynamic + unknown automatic defense; (3) Traditional application software, network equipment, and network security equipment are all marked with clear IP identifiers, such as IP addresses or MAC addresses, which will create opportunities for hackers to scan and detect network IP with hacking tools. Address or MAC address and then find the risk of corresponding vulnerabilities to attack; (4) In addition, common application software or system software often expands and borders infinitely due to system vulnerabilities or patches, etc. If hackers exploit software vulnerabilities, they will The risk of launching an intrusion attack, thus bringing new risks and hidden dangers

[0005] In terms of hardware-level risks, traditional network security devices operate in an inline mode for network operation and maintenance, so that it is convenient to connect and debug their own devices remotely. At this time, there will be a potential risk of , the network security protection device is exposed in the network, that is to say, any node in the network can connect to this device as long as the network route is reachable. At that time, hackers can use brute force password cracking to continuously Try the user name, password, or log in to the browser vulnerability of this security device or find the back door to carry out intrusion attacks; at the same time, the network security device itself also has crystal oscillator attacks on the CPU and side-channel attacks on memory resources through physical attacks. The attack method can directly bypass any security protection and directly take over the core control unit, achieving the risk of arbitrary manipulation of equipment

In addition, there is another problem that if you want to disconnect the client's access to a certain resource of the server, you need to disconnect the actual physical link to really prevent the client from accessing, and the disconnection of the actual physical line will affect the client's access to the server. Access to other business resources

Images