Data transmission method, system and network security device based on virtualized network

Abstract

The present invention provides a virtualized network-based data transmission method, system, and network security device, the method comprising: hijacking multiple data packets sent from multiple first-end communication devices by a first security device; The security device determines the mapping relationship between the real network information and the virtual network information of the first-end communication device and the opposite-end communication device based on a predetermined compiling policy, and based on the mapping relationship, the first-end communication device and the opposite-end communication device have established Create a virtualized network on the physical line; send data packets to the peer communication device based on the created virtual network; the first security device receives data from the peer communication device sent by the second security device on the peer communication device side In the message, the virtual network address of the peer communication device is analyzed and restored based on the pre-stored compilation strategy, and after the restoration is successful, a data message with the restored real network address of the peer communication device is sent to the corresponding first-end communication device.

Description

technical field [0001] The present invention relates to the technical field of data security, in particular to a virtualized network-based data transmission method, device and system. Background technique [0002] In recent years in our country, with the development of network technology and the popularization and enrichment of network applications, the problem of network security has become increasingly serious. High-tech crimes using information technology have shown an increasing trend. Therefore, building a secure communication environment is an inevitable trend. [0003] Due to the diversity of connection forms, the uneven distribution of terminals, and the openness and interconnectivity of the network, it is possible for attackers to detect and scan asset devices in the network, eavesdrop on information on the network, and steal user information. Passwords, database information; it is also possible to tamper with the contents of the database, forge user identities, and...

AI Technical Summary

Problems solved by technology

Among them, the risks at the software level are mainly reflected in: (1) The traditional network security defense method is to passively detect virus samples, intrusion signature samples and other mechanisms. What can be released and what can be blocked, but in actual network communication, hackers are often simulated as ordinary users who can be released to access, and are directly released by the network security gateway to enter the user's intranet, which causes uncontrollable risks; (2) The traditional network security is a tower defense. Various security software products are stacked and accumulated, and various static passive defenses are superimposed on each other. It is impossible to defend in a fundamentally effective way. Dynamic + unknown automatic defense; (3) Traditional application software, network equipment, and network security equipment are all marked with clear IP identifiers, such as IP addresses or MAC addresses, which will create opportunities for hackers to scan and detect network IP with hacking tools. Address or MAC address and then find the risk of corresponding vulnerabilities to attack; (4) In addition, common application software or system software often expands and borders infinitely due to system vulnerabilities or patches, etc. If hackers exploit software vulnerabilities, they will The risk of launching an intrusion attack, thus bringing new risks and hidden dangers

[0005] In terms of hardware-level risks, traditional network security devices operate in an inline mode for network operation and maintenance, so that it is convenient to connect and debug their own devices remotely. At this time, there will be a potential risk of , the network security protection device is exposed in the network, that is to say, any node in the network can connect to this device as long as the network route is reachable. At that time, hackers can use brute force password cracking to continuously Try the user name, password, or log in to the browser vulnerability of this security device or find the back door to carry out intrusion attacks; at the same time, the network security device itself also has crystal oscillator attacks on the CPU and side-channel attacks on memory resources through physical attacks. The attack method can directly bypass any security protection and directly take over the core control unit, achieving the risk of arbitrary manipulation of equipment

In addition, there is another problem that if you want to disconnect the client's access to a certain resource of the server, you need to disconnect the actual physical link to really prevent the client from accessing, and the disconnection of the actual physical line will affect the client's access to the server. Access to other business resources

Images