A network traffic isolation method, system, device, and medium

Abstract

The application discloses a network flow isolation method, system, device and medium, and the application obtains to-be-transmitted data corresponding to a received network flow isolation request, and inputs the to-be-transmitted data into a preset target DHT network by responding to the network flow isolation request; time domain information corresponding to the to-be-transmitted data is read through the target DHT network; a path selection function of the target DHT network is constructed by using node data and the time domain information corresponding to the target DHT network; the to-be-transmitted data is transmitted according to a transmission path queue corresponding to the path selection function; the to-be-transmitted data is encrypted and decrypted by using a key pair of a node corresponding to the transmission path queue, target decrypted transmission data is generated; and the target decrypted transmission data is transmitted to a receiving end. The application solves the problem of limited bandwidth of a traditional horizontal isolation and vertical isolation device. The application realizes network self-organization of flow isolation, enhances effective bandwidth of the flow isolation network, and avoids man-in-the-middle attacks.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network traffic isolation method, system, device, and medium. Background Technology

[0002] Computer networks are the most important information infrastructure in today's society. With the rapid development of society, people's requirements for computer network security are also increasing. However, network attack methods are also emerging one after another, resulting in frequent attacks on computer networks.

[0003] However, network traffic isolation technology is typically used to ensure network communication security. The goal of network isolation technology is to ensure the isolation of harmful attacks, guaranteeing secure data exchange between the sender and receiver while ensuring that information within the trusted network is not leaked. However, existing network isolation technologies rely on strategies such as MAC, RBAC, and ABAC to physically isolate the network and define relevant constraints and rules to ensure network security strength. This presents a zero-day vulnerability problem, where compromising even one traffic isolation device can lead to data theft, posing a significant threat to network security. Summary of the Invention

[0004] This invention provides a network traffic isolation method, system, device, and medium, which solves the technical problem that existing network isolation technologies, which rely on strategies such as MAC, RBAC, and ABAC to physically isolate networks and define relevant constraints and rules to ensure network security, suffer from zero-day vulnerabilities. This vulnerability allows data to be stolen by compromising one of the traffic isolation devices, posing a significant threat to network security.

[0005] The first aspect of this invention provides a network traffic isolation method, comprising:

[0006] In response to a received network traffic isolation request, the system obtains the data to be transmitted corresponding to the network traffic isolation request and inputs the data to be transmitted into a preset target DHT network.

[0007] The time-domain information corresponding to the data to be transmitted is read through the target DHT network;

[0008] The path selection function of the target DHT network is constructed using the node data corresponding to the target DHT network and the time-domain information;

[0009] The data to be transmitted is transmitted according to the transmission path queue corresponding to the path selection function;

[0010] The data to be transmitted is encrypted and decrypted using the key pair of the node corresponding to the transmission path queue to generate the target decrypted transmission data;

[0011] The target decrypted transmission data is sent to the receiving end.

[0012] Optionally, the step of responding to a received network traffic isolation request, obtaining the data to be transmitted corresponding to the network traffic isolation request, and inputting the data to be transmitted into a preset target DHT network includes:

[0013] In response to a received network traffic isolation request, obtain the data to be transmitted corresponding to the network traffic isolation request;

[0014] The initial DHT network nodes are compiled according to the network traffic isolation request;

[0015] Multiple key pairs are set using a preset algorithm, and each key pair is input into each of the initial DHT network nodes to generate an update node;

[0016] Initialize each of the update nodes and generate nodes to be started;

[0017] Start each of the nodes to be started to generate the target node;

[0018] Connect two adjacent target nodes to generate an initial DHT network;

[0019] The public keys of the key pairs corresponding to each target node of the initial DHT network are transmitted to the neighboring nodes to generate the target DHT network;

[0020] The data to be transmitted is input into the target DHT network.

[0021] Optionally, the step of reading the time-domain information corresponding to the data to be transmitted through the target DHT network includes:

[0022] The data to be transmitted is filtered by network filters installed on the nodes of the target DHT network to generate target data to be transmitted;

[0023] The target DHT network node reads the time-domain information corresponding to the target data to be transmitted and obtains the ID data of the time-domain information.

[0024] Optionally, the step of constructing the path selection function of the target DHT network using the node data corresponding to the target DHT network and the time-domain information includes:

[0025] Using the node data corresponding to the target DHT network and the ID data of the time-domain information, a state vector corresponding to each node is generated;

[0026] The path selection function of the target DHT network is constructed using the state vector corresponding to each node, the data of each node, the data of the nodes adjacent to each node, and the state transition function corresponding to the state vector.

[0027] Optionally, the step of encrypting and decrypting the data to be transmitted using the key pair of the node corresponding to the transmission path queue to generate target decrypted transmission data includes:

[0028] In the I-th node of the transmission path queue, the data to be transmitted is encrypted using the public key corresponding to the key of the (I+1)-th node, generating encrypted transmission data, which is then input into the (I+1)-th node; where I is a positive integer.

[0029] The encrypted transmission data is decrypted using the private key corresponding to the key pair of the (I+1)th node to generate decrypted transmission data;

[0030] Determine whether the (I+1)th node is the last node of the transmission path queue;

[0031] If so, the decrypted transmission data is determined as the target decrypted transmission data;

[0032] If not, then proceed to the step of encrypting the data to be transmitted using the public key corresponding to the key pair of the (I+1)th node in the transmission path queue, generating encrypted transmission data and inputting it into the (I+1)th node; where I is a positive integer.

[0033] Optionally, it also includes:

[0034] A hash code is generated by using the network layer information of the target decrypted transmission data, the transmission path queue, and the hash function corresponding to the last node of the target DHT network.

[0035] The hash code is stored in the blockchain.

[0036] Optionally, it also includes:

[0037] By editing each node of the target DHT network using a preset language, the data to be transmitted to the node is organized and transformed.

[0038] A network traffic isolation system provided by a second aspect of the present invention includes:

[0039] The target DHT network module is used to respond to a received network traffic isolation request, obtain the data to be transmitted corresponding to the network traffic isolation request, and input the data to be transmitted into a preset target DHT network.

[0040] The time-domain information module is used to read the time-domain information corresponding to the data to be transmitted through the target DHT network;

[0041] The path selection function module is used to construct the path selection function of the target DHT network using the node data corresponding to the target DHT network and the time domain information;

[0042] A data transmission module is used to transmit the data to be transmitted according to the transmission path queue corresponding to the path selection function.

[0043] The target decryption transmission data module is used to encrypt and decrypt the data to be transmitted using the key pair of the node corresponding to the transmission path queue, and generate target decryption transmission data;

[0044] The module for transmitting data to the receiving end is used to transmit the target decrypted transmission data to the receiving end.

[0045] A third aspect of the present invention provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the network traffic isolation method as described in any of the preceding claims.

[0046] The fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed, implements the network traffic isolation method as described in any of the preceding claims.

[0047] As can be seen from the above technical solutions, the present invention has the following advantages:

[0048] This invention addresses the problem of existing network isolation technologies, which rely on strategies like MAC, RBAC, and ABAC to physically isolate networks and define constraints and rules to ensure network security. These technologies often suffer from zero-day vulnerabilities, where compromised devices can steal data, posing a significant threat to network security. This vulnerability allows for the exploitation of zero-day vulnerabilities, where compromised devices can lead to data theft.

[0049] This invention enables a self-organizing network for traffic isolation, enhancing the effective bandwidth of the network and preventing man-in-the-middle attacks (MITMA), thus protecting data validity and transmission privacy. It also addresses the limited bandwidth limitations of traditional horizontal and vertical isolation devices by employing a consensus protocol based on cellular automata to store data transmission evidence within blocks of the DHT network. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is a flowchart illustrating the steps of a network traffic isolation method provided in Embodiment 1 of the present invention;

[0052] Figure 2 This is a flowchart illustrating the steps of a network traffic isolation method provided in Embodiment 2 of the present invention;

[0053] Figure 3 This is a structural block diagram of a decentralized network based on DHT provided in Embodiment 2 of the present invention;

[0054] Figure 4 This is a structural block diagram of a communication step between a sending end and a receiving end provided in Embodiment 2 of the present invention;

[0055] Figure 5 This is a structural block diagram of a network traffic isolation system provided in Embodiment 3 of the present invention. Detailed Implementation

[0056] This invention provides a network traffic isolation method, system, device, and medium to address the technical problem that existing network isolation technologies, which rely on strategies such as MAC, RBAC, and ABAC to physically isolate networks and define relevant constraints and rules to ensure network security, suffer from zero-day vulnerabilities. This vulnerability allows data to be stolen by compromising even one traffic isolation device, posing a significant threat to network security.

[0057] To make the objectives, features, and advantages of this invention more apparent and understandable, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described below are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0058] Please see Figure 1 , Figure 1 This is a flowchart illustrating the steps of a network traffic isolation method provided in Embodiment 1 of the present invention.

[0059] The present invention provides a network traffic isolation method, comprising the following steps:

[0060] Step 101: Respond to the received network traffic isolation request, obtain the data to be transmitted corresponding to the network traffic isolation request, and input the data to be transmitted into the preset target DHT network.

[0061] It should be noted that a network traffic isolation request refers to a request to create network traffic isolation.

[0062] The data to be transmitted refers to the TCP or UDP data packets that need to be transmitted to the receiving end. The data packets include five elements: source IP, source port, protocol, destination IP, and destination port.

[0063] The target DHT network refers to a network transmission platform based on a customizable Linux traffic isolation method, which is a completely decentralized network transmission platform that enables private and secure "no central server" communication.

[0064] In this embodiment of the invention, when a network traffic isolation request is received, the data to be transmitted that needs to be transmitted in the network traffic isolation request is obtained, and the data to be transmitted is input into a preset target DHT network for transmission.

[0065] Step 102: Read the time domain information corresponding to the data to be transmitted through the target DHT network.

[0066] It should be noted that time-domain information refers to the session information of the data to be transmitted.

[0067] In this embodiment of the invention, when any node of the target DHT network receives the data to be transmitted, it reads the session information of the data to be transmitted.

[0068] Step 103: Construct the path selection function of the target DHT network using the node data and time-domain information corresponding to the target DHT network.

[0069] It should be noted that node data refers to the state vector of each node in the target DHT network, the number of nodes in the target DHT network, the neighboring nodes of the current node, and the node's state transition function, etc.

[0070] Temporal information refers to information such as session ID.

[0071] The session ID is part of the state vector parameters.

[0072] The path selection function refers to the function that transmits data according to the transmission path of the target DHT network.

[0073] In this embodiment of the invention, when the current node of the target DHT network receives the data to be transmitted, the path selection function of the target DHT network is constructed by combining the state vectors of each node in the target DHT network, the number of nodes in the target DHT network, the neighboring nodes of the current node, and the state transition function of the node.

[0074] Step 104: Transmit the data to be transmitted according to the transmission path queue corresponding to the path selection function.

[0075] It should be noted that the transmission path queue refers to the transmission queue composed of all nodes in the target DHT network.

[0076] In this embodiment of the invention, the data to be transmitted is transmitted according to the transmission order of the transmission path queue corresponding to the path selection function.

[0077] Step 105: Use the key of the node corresponding to the transmission path queue to encrypt and decrypt the data to be transmitted, and generate the target decrypted transmission data.

[0078] It should be noted that a key pair refers to a key pair generated by the administrator using an open-source algorithm or a national cryptographic algorithm. The administrator copies the public key and the port number applied for within the organization to each node in the target DHT network and sets a list of public keys that can be accepted for connection (if not set, any node with a public key will be accepted for connection by default).

[0079] In this embodiment of the invention, when the data to be transmitted is transmitted to the current node of the path queue, if the current node is the first node, the public key of the next node is used to encrypt the data to be transmitted, generate encrypted transmission data, and transmit it to the next node. The private key of the next node is used to decrypt the encrypted transmission data to obtain the target decrypted transmission data.

[0080] Step 106: Decrypt the target data and transmit it to the receiving end.

[0081] It should be noted that the receiving end refers to the device that receives data.

[0082] In this embodiment of the invention, the target decrypted transmission data is sent to the receiving end.

[0083] This invention addresses the problem of existing network isolation technologies, which rely on strategies like MAC, RBAC, and ABAC to physically isolate networks and define constraints and rules to ensure network security. These technologies often suffer from zero-day vulnerabilities, where compromised devices can steal data, posing a significant threat to network security. This vulnerability allows for the exploitation of zero-day vulnerabilities, where compromised devices can lead to data theft.

[0084] This invention enables a self-organizing network for traffic isolation, enhancing the effective bandwidth of the network and preventing man-in-the-middle attacks (MITMA), thus protecting data validity and transmission privacy. It also addresses the limited bandwidth limitations of traditional horizontal and vertical isolation devices by employing a consensus protocol based on cellular automata to store data transmission evidence within blocks of the DHT network.

[0085] Please see Figure 2-4 , Figure 2 This is a flowchart illustrating the steps of a network traffic isolation method provided in Embodiment 2 of the present invention.

[0086] The present invention provides a network traffic isolation method, comprising the following steps:

[0087] Step 201: Respond to the received network traffic isolation request, obtain the data to be transmitted corresponding to the network traffic isolation request, and input the data to be transmitted into the preset target DHT network.

[0088] Optionally, step 201 includes the following steps S11-S18:

[0089] S11. Respond to the received network traffic isolation request and obtain the data to be transmitted corresponding to the network traffic isolation request;

[0090] S12. Compile the initial DHT network nodes according to the network traffic isolation request;

[0091] S13. Use a preset algorithm to set up multiple key pairs, and input each key pair into each initial DHT network node to generate an update node;

[0092] S14. Initialize each update node and generate nodes to be started;

[0093] S15. Start each node to be started and generate the target node;

[0094] S16. Connect two adjacent target nodes to generate the initial DHT network;

[0095] S17. Transmit the public keys of the key pairs corresponding to each target node of the initial DHT network to the neighboring nodes to generate the target DHT network.

[0096] S18. Input the data to be transmitted into the target DHT network.

[0097] It should be noted that, as Figure 3 As shown, the initial DHT network refers to the operating system of all DHT network nodes customized by the administrator through the installation of dedicated encryption hardware modules or the development of dedicated software encryption modules in C language. The software encryption method is implemented using a customized Linux userspace program.

[0098] The initial DHT network node refers to the initial node that has been customized but has not yet had any other settings entered.

[0099] The preset algorithm refers to either an open-source algorithm or a national cryptographic algorithm. Administrators can choose the appropriate algorithm based on the actual situation.

[0100] An update node refers to a DHT network node that has been added to the key pair.

[0101] A node to be started refers to a DHT network node that is initialized based on an update node.

[0102] The target node refers to the node that has been started but is yet to be started.

[0103] In this embodiment of the invention, when a network traffic isolation request is received, while acquiring the data to be transmitted corresponding to the network traffic isolation request, such as... Figure 4As shown, the first node of the initial DHT network is constructed according to the network traffic isolation request. The administrator copies the public key from the key pair generated by the open-source algorithm or the national cryptographic algorithm and the port applied for within the organization to the first node of the initial DHT network. Then, the first node of the initial DHT network is initialized and started, generating the target node. The steps of constructing the nodes of the initial DHT network are repeated to obtain multiple initial DHT network nodes. A key pair is applied for for the remaining initial DHT network nodes. If the system does not provide one, it will be automatically generated by default. Then, according to the port specified by the administrator or a randomly selected port, each key pair and port are input into each initial DHT network node to generate an update node. The update node is initialized to obtain the node to be started, and the node to be started is started to generate the target node. Each target node is connected to the first node of the initial DHT network. After successful connection, the target DHT network is generated. Each node in the target DHT network transmits its public key to its neighboring nodes. Communication between any two nodes is encrypted separately using the other party's public key before transmission. The data to be transmitted is input into the target DHT network, and the public key of the neighboring node of any node in the DHT network is used to encrypt the data before transmission.

[0104] Step 202: Filter the data to be transmitted using the network filters installed on the nodes of the target DHT network to generate the target data to be transmitted.

[0105] It should be noted that network filters refer to the ability to filter and discard content or information containing sensitive words in data to be transmitted.

[0106] In this embodiment of the invention, network filters installed on nodes of the target DHT network filter the content or information involving sensitive words in the data to be transmitted, or invalid data packets are sent according to the five elements of source IP, source port, protocol, target IP and target port, thereby avoiding DDoS attacks and preventing network probing and penetration by hackers.

[0107] Step 203: Read the time domain information corresponding to the target data to be transmitted through the nodes of the target DHT network, and obtain the ID data of the time domain information.

[0108] In this embodiment of the invention, when a node of the target DHT network reads the time-domain information corresponding to the target data to be transmitted, it extracts the ID data of the time-domain information.

[0109] Step 204: Construct the path selection function of the target DHT network using the node data and time-domain information corresponding to the target DHT network.

[0110] Optionally, step 204 includes the following steps S21-S22:

[0111] S21. Using the ID data of the node data and time-domain information corresponding to the target DHT network, generate the state vector corresponding to each node;

[0112] S22. Using the state vectors corresponding to each node, the data of each node, the data of the nodes adjacent to each node, and the state transition function corresponding to the state vectors, construct the path selection function of the target DHT network.

[0113] It should be noted that the state vector refers to the value of the state variable at a certain moment, which is called the state of the system at that moment.

[0114] In this embodiment of the invention, the path selection function is DHTPathFunc = (State, NodeNum, NeighborSet, StateFunc), where State represents the state vector of each node in the target DHT network, NodeNum represents the number of nodes in the target DHT network, NeighborSet represents the neighboring nodes of the current node, and StateFunc represents the state transition function of the node.

[0115] Specifically, the ID data of the time-domain information, which is the session ID, is part of the State parameter in the path selection function DHTPathFunc. Therefore, by combining the node data and session ID of the target DHT network, the state vector corresponding to each node can be generated.

[0116] Specifically, in this invention, after each target DHT network node joins the DHT network, it uses consistent hashing as the hash algorithm according to the Chord protocol (the default algorithm is SHA-1). The hash algorithm generates a 2^160 space, with each item being a 16-byte (160-bit) large integer. These integers can be considered to form a ring, called the Chord ring. The integers are arranged clockwise on the Chord ring, and both the Node (IP address and Port on the machine) and the Key (resource identifier) ​​are hashed and mapped onto the Chord ring. The entire P2P network is a virtual ring. During the query process, the querying node sends the request to the node closest to the key value on the Chord ring. The node receiving the query request, if it finds that it has stored the queried information, can directly respond to the querying node (exactly the same as consistent hashing); if the queried information is not local, it forwards the request to the node closest to the key value according to the lookup table. This process continues until the corresponding node is found.

[0117] Step 205: Transmit the data to be transmitted according to the transmission path queue corresponding to the path selection function.

[0118] In this embodiment of the invention, the specific implementation process of step 205 is similar to that of step 104, and will not be repeated here.

[0119] Step 206: Use the key of the node corresponding to the transmission path queue to encrypt and decrypt the data to be transmitted, and generate the target decrypted transmission data.

[0120] Optionally, step 206 includes the following steps S31-S35:

[0121] S31. In the I-th node of the transmission path queue, the public key corresponding to the data to be transmitted is encrypted using the key of the (I+1)-th node to generate encrypted transmission data and input to the (I+1)-th node; where I is a positive integer;

[0122] S32. Decrypt the encrypted transmission data using the private key corresponding to the key of the (I+1)th node to generate decrypted transmission data;

[0123] S33. Determine whether the (I+1)th node is the last node of the transmission path queue;

[0124] S34. If so, then the decrypted transmission data is determined as the target decrypted transmission data;

[0125] S35. If not, then proceed to the step in the I-th node of the transmission path queue, where the public key corresponding to the data to be transmitted is encrypted using the key of the (I+1)-th node, generating encrypted transmission data and inputting it into the (I+1)-th node; where I is a positive integer.

[0126] It should be noted that if the I-th node is the current node, then the (I+1)-th node is the next node after the current node.

[0127] Encrypted data transmission refers to encrypting the data to be transmitted using the public key of the next node in the current node.

[0128] Decrypting transmitted data refers to data that is decrypted using the private key of the next node when it is transmitted.

[0129] In this embodiment of the invention, in the first node of the transmission path queue, the public key corresponding to the key of the adjacent node of the first node, that is, the next node, is used to encrypt the data to be transmitted, generate encrypted transmission data, and input it to the adjacent node of the first node, that is, the next node.

[0130] When the next node receives encrypted transmission data, it decrypts it using its private key to generate decrypted transmission data. It then determines whether the current node is the last node in the transmission path queue. If not, it repeatedly encrypts the decrypted transmission data using the public key of the next node's key pair to generate updated encrypted transmission data, and then transmits it to the next node. This process of decrypting encrypted transmission data using the next node's private key and generating decrypted transmission data is repeated until the data reaches the last node.

[0131] If the current node is the last node in the transmission path queue, the decrypted transmission data will be identified as the target decrypted transmission data.

[0132] Step 207: Decrypt the target data and transmit it to the receiving end.

[0133] Optionally, this method further includes the following steps S41-S42:

[0134] S41. Generate a hash code by using the network layer information of the target decryption transmission data, the transmission path queue, and the hash function corresponding to the last node of the target DHT network;

[0135] S42. Store the hash code in the blockchain.

[0136] It should be noted that network layer information includes source IP, source port, protocol, destination IP, destination port, and data hash.

[0137] In this embodiment of the invention, after removing the valid data of the target decrypted transmission data, the network layer information of the target decrypted transmission data (i.e., source IP, source port, protocol, target IP, target port, and data hash) and the transmission path queue are used. A hash code is generated by the hash function of the last node of the transmission path queue, and the hash code is recorded in the blockchain through a consensus function as proof that the data transmission is non-repudiable.

[0138] Optionally, this method further includes the following step S51:

[0139] S51. Edit each node of the target DHT network using a preset language to organize and transform the data to be transmitted to the node.

[0140] It should be noted that the default language refers to using languages ​​such as C, Go, and Lua to write the various nodes, which are used to organize and transform the transmitted data, such as filtering and discarding data containing sensitive words.

[0141] In this embodiment of the invention, any node in the target DHT network can leave or join the target DHT network at any time, and the data to be transmitted to each node in the target DHT network can be processed by the node. After the payload content of the target decrypted transmission data is removed, a transmission certificate is generated by using the public keys of the sender and receiver and the hash function result of the data itself, and then through the built-in hash function of the DHT network node. This certificate is stored in the blockchain data of the DHT network to prove that the target decrypted transmission data was transmitted through this DHT network.

[0142] This invention addresses the problem of existing network isolation technologies, which rely on strategies like MAC, RBAC, and ABAC to physically isolate networks and define constraints and rules to ensure network security. These technologies often suffer from zero-day vulnerabilities, where compromised devices can steal data, posing a significant threat to network security. This vulnerability allows for the exploitation of zero-day vulnerabilities, where compromised devices can lead to data theft.

[0143] This invention enables a self-organizing network for traffic isolation, enhancing the effective bandwidth of the network and preventing man-in-the-middle attacks (MITMA), thus protecting data validity and transmission privacy. It also addresses the limited bandwidth limitations of traditional horizontal and vertical isolation devices by employing a consensus protocol based on cellular automata to store data transmission evidence within blocks of the DHT network.

[0144] Please see Figure 5 , Figure 5 This is a structural block diagram of a network traffic isolation system provided in Embodiment 3 of the present invention.

[0145] This invention provides a network traffic isolation system, comprising:

[0146] The target DHT network module 501 is used to respond to the received network traffic isolation request, obtain the data to be transmitted corresponding to the network traffic isolation request, and input the data to be transmitted into the preset target DHT network.

[0147] The time domain information module 502 is used to read the time domain information corresponding to the data to be transmitted through the target DHT network;

[0148] The path selection function module 503 is used to construct the path selection function of the target DHT network using the node data and time-domain information corresponding to the target DHT network;

[0149] The data transmission module 504 is used to transmit the data to be transmitted according to the transmission path queue corresponding to the path selection function.

[0150] The target decryption transmission data module 505 is used to encrypt and decrypt the data to be transmitted using the key of the node corresponding to the transmission path queue, and generate target decryption transmission data;

[0151] The receiving module 506 is used to transmit the target decrypted transmission data to the receiving end.

[0152] Optionally, the target DHT network module 501 includes:

[0153] The data to be transmitted submodule is used to respond to the received network traffic isolation request and obtain the data to be transmitted corresponding to the network traffic isolation request.

[0154] The initial DHT network node submodule is used to compile initial DHT network nodes according to network traffic isolation requests;

[0155] The update node submodule is used to set up multiple key pairs using a preset algorithm, input each key pair into each initial DHT network node, and generate update nodes.

[0156] The node to be started submodule is used to initialize each update node and generate nodes to be started;

[0157] The target node submodule is used to start each node to be started and generate the target node.

[0158] The initial DHT network submodule is used to connect two adjacent target nodes to generate the initial DHT network;

[0159] The target DHT network submodule is used to transmit the public keys of the key pairs corresponding to each target node of the initial DHT network to the neighboring nodes to generate the target DHT network.

[0160] The input target DHT network submodule is used to input the data to be transmitted into the target DHT network.

[0161] Optionally, the time-domain information module 502 includes:

[0162] The target data to be transmitted submodule is used to filter the data to be transmitted through the network filters set on the nodes of the target DHT network, and generate the target data to be transmitted.

[0163] The ID data submodule is used to read the time domain information corresponding to the target data to be transmitted through the nodes of the target DHT network, and obtain the ID data of the time domain information.

[0164] Optionally, the path selection function module 503 includes:

[0165] The state vector submodule is used to generate state vectors for each node by using the node data and time-domain information ID data corresponding to the target DHT network.

[0166] The path selection function submodule is used to construct the path selection function of the target DHT network using the state vector corresponding to each node, the data of each node, the data of the nodes adjacent to each node, and the state transition function corresponding to the state vector.

[0167] Optionally, the target decryption transmission data module 505 includes:

[0168] The encrypted data transmission submodule is used to encrypt the data to be transmitted in the I-th node of the transmission path queue using the key of the (I+1)-th node, thereby generating encrypted transmission data and inputting it into the (I+1)-th node; where I is a positive integer;

[0169] The decryption transmission data submodule is used to decrypt the encrypted transmission data using the key pair of the (I+1)th node and the corresponding private key to generate decrypted transmission data.

[0170] The judgment submodule is used to determine whether the (I+1)th node is the last node of the transmission path queue;

[0171] The target decryption transmission data determination submodule is used to determine the decryption transmission data as the target decryption transmission data if it is true.

[0172] The jump-rotor module is used to, if not, jump to execute the step in the I-th node of the transmission path queue, encrypt the data to be transmitted using the key of the (I+1)-th node, generate encrypted transmission data, and input it into the (I+1)-th node; where I is a positive integer.

[0173] Optionally, this system also includes:

[0174] The hash code submodule is used to generate hash codes by using the network layer information of the target decrypted data, the transmission path queue, and the hash function corresponding to the last node of the target DHT network.

[0175] The storage submodule is used to store hash codes to the blockchain.

[0176] Optionally, this system also includes:

[0177] The sorting submodule is used to sort and transform the data to be transmitted to the nodes of the target DHT network by editing the nodes in a preset language.

[0178] Embodiment 4 of the present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program; when the computer program is executed by the processor, the processor performs a network traffic isolation method as described in any of the above embodiments.

[0179] Embodiment 5 of the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed, implements the network traffic isolation method as described in any of the above embodiments.

[0180] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0181] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0182] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0183] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0184] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0185] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network traffic isolation method, characterized in that, include: In response to a received network traffic isolation request, the system obtains the data to be transmitted corresponding to the network traffic isolation request and inputs the data to be transmitted into a preset target DHT network. The time-domain information corresponding to the data to be transmitted is read through the target DHT network; The path selection function of the target DHT network is constructed using the node data corresponding to the target DHT network and the time-domain information; The data to be transmitted is transmitted according to the transmission path queue corresponding to the path selection function; The data to be transmitted is encrypted and decrypted using the key pair of the node corresponding to the transmission path queue to generate the target decrypted transmission data; The target decrypted transmission data is sent to the receiving end; The step of constructing the path selection function of the target DHT network using the node data corresponding to the target DHT network and the time-domain information includes: Using the node data corresponding to the target DHT network and the ID data of the time-domain information, a state vector corresponding to each node is generated; the node data includes the state vector of each node in the target DHT network, the number of nodes in the target DHT network, the neighboring nodes of the current node, and the node's state transition function. The path selection function of the target DHT network is constructed by using the state vector corresponding to each node, the data of each node, the data of the nodes adjacent to each node, and the state transition function corresponding to the state vector. The path selection function is DHTPathFunc = (State, NodeNum, NeighborSet, StateFunc), where State represents the state vector of each node in the target DHT network, NodeNum represents the number of nodes in the target DHT network, NeighborSet represents the neighboring nodes of the current node, and StateFunc represents the state transition function of the node. The ID data of the time domain information is a part of State. The step of encrypting and decrypting the data to be transmitted using the key pair of the node corresponding to the transmission path queue to generate target decrypted transmission data includes: In the I-th node of the transmission path queue, the data to be transmitted is encrypted using the public key corresponding to the key of the (I+1)-th node, generating encrypted transmission data, which is then input into the (I+1)-th node; where I is a positive integer. The encrypted transmission data is decrypted using the private key corresponding to the key pair of the (I+1)th node to generate decrypted transmission data. Determine whether the (I+1)th node is the last node of the transmission path queue; If so, the decrypted transmission data is identified as the target decrypted transmission data; If not, then proceed to the step of encrypting the data to be transmitted using the public key corresponding to the key pair of the (I+1)th node in the transmission path queue, generating encrypted transmission data and inputting it into the (I+1)th node; where I is a positive integer.

2. The network traffic isolation method according to claim 1, characterized in that, The steps of responding to a received network traffic isolation request, obtaining the data to be transmitted corresponding to the network traffic isolation request, and inputting the data to be transmitted into a preset target DHT network include: In response to a received network traffic isolation request, obtain the data to be transmitted corresponding to the network traffic isolation request; The initial DHT network nodes are compiled according to the network traffic isolation request; Multiple key pairs are set using a preset algorithm, and each key pair is input into each of the initial DHT network nodes to generate an update node; Initialize each of the update nodes and generate nodes to be started; Start each of the nodes to be started to generate the target node; Connect two adjacent target nodes to generate an initial DHT network; The public keys of the key pairs corresponding to each target node of the initial DHT network are transmitted to the neighboring nodes to generate the target DHT network; The data to be transmitted is input into the target DHT network.

3. The network traffic isolation method according to claim 1, characterized in that, The step of reading the time-domain information corresponding to the data to be transmitted through the target DHT network includes: The data to be transmitted is filtered by network filters installed on the nodes of the target DHT network to generate target data to be transmitted; The target DHT network node reads the time-domain information corresponding to the target data to be transmitted and obtains the ID data of the time-domain information.

4. The network traffic isolation method according to claim 1, characterized in that, Also includes: A hash code is generated by using the network layer information of the target decrypted data transmission data, the transmission path queue, and the hash function corresponding to the last node of the target DHT network. The hash code is stored in the blockchain.

5. The network traffic isolation method according to claim 1, characterized in that, Also includes: By editing each node of the target DHT network using a preset language, the data to be transmitted to the node is organized and transformed.

6. A network traffic isolation system, characterized in that, include: The target DHT network module is used to respond to a received network traffic isolation request, obtain the data to be transmitted corresponding to the network traffic isolation request, and input the data to be transmitted into a preset target DHT network. The time-domain information module is used to read the time-domain information corresponding to the data to be transmitted through the target DHT network; The path selection function module is used to construct the path selection function of the target DHT network using the node data corresponding to the target DHT network and the time domain information; A data transmission module is used to transmit the data to be transmitted according to the transmission path queue corresponding to the path selection function. The target decryption transmission data module is used to encrypt and decrypt the data to be transmitted using the key pair of the node corresponding to the transmission path queue, and generate target decryption transmission data; The module for transmitting data to the receiving end is used to transmit the target decrypted transmission data to the receiving end; The path selection function module is used to generate a state vector corresponding to each node using the node data corresponding to the target DHT network and the ID data of the time-domain information; and to construct a path selection function for the target DHT network using the state vectors corresponding to each node, the node data, the node data adjacent to each node data, and the state transition function corresponding to the state vectors. The path selection function is DHTPathFunc = (State, NodeNum, NeighborSet, StateFunc), where State represents the state vector of each node in the target DHT network, NodeNum represents the number of nodes in the target DHT network, NeighborSet represents the neighboring nodes of the current node, and StateFunc represents the state transition function of the node. The ID data of the time domain information is a part of State. The step of encrypting and decrypting the data to be transmitted using the key pair of the node corresponding to the transmission path queue to generate target decrypted transmission data includes: In the I-th node of the transmission path queue, the data to be transmitted is encrypted using the public key corresponding to the key of the (I+1)-th node, generating encrypted transmission data, which is then input into the (I+1)-th node; where I is a positive integer. The encrypted transmission data is decrypted using the private key corresponding to the key pair of the (I+1)th node to generate decrypted transmission data. Determine whether the (I+1)th node is the last node of the transmission path queue; If so, the decrypted transmission data is identified as the target decrypted transmission data; If not, then proceed to the step of encrypting the data to be transmitted using the public key corresponding to the key pair of the (I+1)th node in the transmission path queue, generating encrypted transmission data and inputting it into the (I+1)th node; where I is a positive integer.

7. An electronic device, characterized in that, The device includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor causes the processor to perform the steps of the network traffic isolation method as described in any one of claims 1-5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed, it implements the network traffic isolation method as described in any one of claims 1-5.

Images