Network equipment invisible protection method based on data packet

Abstract

The invention relates to the technical field of network security, and discloses a network equipment invisibility protection method based on a data packet. The invisible service shields all IP data packets from the network through Iptables, and captures the data packets through AFPACKET; when a user has an access demand, sending an activation data packet of a custom protocol type to the corresponding network equipment through a specific activation tool; the invisible service carries out protocol identification on a data packet captured through AFPACKET, if the data packet is identified to be a self-defined activation data packet type, the content is decrypted and content verification is carried out, and after verification succeeds, the IP of a user sending the activation data packet is added into a filtering white list through Iptables; and during regular checking, the users who do not send the activation packets again after the preset time are regarded as invalid users, and the IPs of the users are removed from the filtered white list. Through a strict security authentication mechanism, various network scanning detection and tracking can be effectively prevented, the security and privacy of network equipment are improved, and the method is a powerful supplement to the existing network security technology.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network device invisible protection method based on data packets. Background Art

[0002] With the rapid development of information technology and the popularization of smart devices, network security has become increasingly important, and the challenges it faces have become increasingly complex.

[0003] In a complex and ever-changing network environment, hacker attacks are becoming more and more frequent. Some key protection devices have extremely high security and privacy requirements, but the current network security protection technology has various problems and cannot guarantee the security and privacy of the network 100%. Therefore, it is necessary to combine the existing network security protection technology with more updated network security protection technology to enhance the security and privacy of the network.

[0004] New viruses and vulnerabilities continue to emerge, and various types of network attacks occur in an endless stream. How to effectively carry out network security protection has become an issue that the network security industry needs to constantly think about.

[0005] However, no matter hacker attacks or unauthorized access, at the bottom layer of the network, commands and data are ultimately transmitted in the form of data packets. If data packets can be filtered at key nodes of network transmission, problematic data packets can be identified and blocked from transmission, this will greatly improve network security. However, in the face of massive transmission of data packets, how to effectively identify and filter them to avoid misinterception is the key point.

[0006] In the past, network security protection strategies generally include but are not limited to the following methods: (1) Ordinary firewall: By properly configuring firewall rules (IP, protocol or port, etc.), you can allow (or block) external access to network devices and block other unnecessary traffic from entering or leaving the network.

[0007] (2) Intrusion Detection and Prevention System (IDS / IPS): monitors all traffic in and out of the network, detects attacks and anomalies in the network by analyzing network behavior patterns and matching feature rules, and can issue alerts or even block threatening traffic.

[0008] (3) Port hiding: Set the ports that need to be opened to the outside world as uncommon ports to reduce the risk of being scanned and attacked (for example, the default port of the SSH service is 22. If it is changed to another port, it can prevent the scanning tool from directly finding the SSH service).

[0009] (4) IP masquerading: VPN, proxy service, or NAT address translation can be used to effectively hide the real IP address of the device and reduce the risk of being attacked.

[0010] In the past, network security protection strategies have combined a series of network security technologies to protect network devices to a certain extent in many scenarios and reduce the risk of attacks. However, these measures cannot guarantee the security of devices 100%. Especially in network environments where important data is stored or key services exist, more stringent protection mechanisms are required. If only existing technologies are used, the following disadvantages will occur: (1) Ordinary firewall: In a common firewall, firewall rules need to be set to allow (or block) access to specific IPs, protocols or ports. However, screening rules requires a certain amount of work and there will be a delay in time. At the same time, setting rules generally requires a dedicated administrator to operate.

[0011] (2) Intrusion Detection and Prevention System (IDS / IPS): The shortcomings of intrusion detection and prevention systems (IDS / IPS) are similar to those of ordinary firewalls. Rules also need to be set. At the same time, network behavior patterns and feature rule detection have certain requirements for the number of rules. A large number of rule detections will inevitably have a certain impact on network latency. Faced with the continuous emergence of new viruses and vulnerabilities, there is a large delay in the screening of rules and it is impossible to defend against new attacks. Missed reports, false positives and impact on network latency are problems that intrusion detection and prevention systems (IDS / IPS) cannot avoid.

[0012] (3) Port hiding: Port hiding is mainly used in combination with other protection methods. Although it can reduce the risk of being scanned and attacked, it does not provide much protection as long as enough time is spent scanning one by one.

[0013] (4) IP spoofing: IP spoofing is mainly used in combination with other protection methods to protect privacy and reduce the risk of attacks. Although the real IP is not exposed, the mapped virtual IP is still exposed on the network. Summary of the invention

[0014] In view of the above problems, the present invention aims to provide a network device invisible protection method based on data packets. Through a strict security authentication mechanism, it can effectively prevent various types of network scanning detection and tracking, improve the security and privacy of network devices, and is a powerful supplement to existing network security technologies. The technical solution is as follows: A network device invisible protection method based on data packets comprises the following steps: Step 1: The invisible service blocks all packets containing IP from the network through Iptables, and listens and captures all packets before the kernel protocol stack through AF_PACKET; Step 2: When the user has access requirements, the user sends an activation data packet of a custom protocol type to the network device to be accessed through a specific activation tool; Step 3: The invisible service will perform protocol identification on the data packets captured by AF_PACKET. If it is identified as a custom protocol type, it will decrypt the activation data packet content and perform content verification. After the verification is successful, the user IP that sends the activation data packet will be added to the filtering whitelist through Iptables, so that the user can access the network device normally. Step 4: The invisible service performs regular checks and regards users who have not sent activation packages again within the specified time as invalid users, and removes the IP addresses of the invalid users from the filtering whitelist, so that they can no longer discover and access network devices.

[0015] Furthermore, in step 1, capturing data packets through AF_PACKET is specifically as follows: in the Linux system, the AF_PACKET socket is used to bypass the kernel protocol stack and directly access the data packets of the link layer; in step 3, if a custom protocol type is identified, the data content is decrypted by the private key, and finally the validity of the data is verified based on the decrypted content; if a non-custom protocol type is identified, no processing is performed; the verification method is: since the encrypted content of the activation data packet is a string composed of the IP and port of the data packet itself, when performing validity verification, the invisible service compares the decrypted content with the IP and port of the data packet itself, and the verification is passed if they are equal.

[0016] Furthermore, in step 2, when the user has access needs, authentication and activation are performed through a specific activation tool. The activation tool sends an activation data packet of a custom protocol type to the network device. The activation data packet of the custom protocol type is based on the IP layer and is sent in the Linux system using a raw socket. The sent data content is encrypted using a public key, and the network device decrypts the activation data packet using the corresponding private key after receiving the activation data packet.

[0017] Furthermore, the Iptables packets used include: In step 1, after starting the invisible service, the network device configures the Linux kernel's Netfilter firewall through the Iptables command to block all IP packets when the packets enter the Linux kernel protocol stack. The command is: iptables -t mangle -A PREROUTING -p ip -j DROP; In step 3, after the activation data packet captured by AF_PACKET is successfully verified, the user IP sending the activation packet is added to the filtering whitelist through Iptables. The command is: iptables -t mangle -IPREROUTING-s <ip>-j ACCEPT; In step 4, when performing a scheduled check, the user IP that has not sent an activation packet again within the specified time will be removed from the filtering whitelist. The command is: iptables -t mangle -D PREROUTING-s <ip>-j ACCEPT.

[0018] The beneficial effects of the present invention are: 1) The present invention shields all IP layer data packets through a firewall at the bottom layer of the network, and uses AF_PACKET to monitor all data packets before the kernel protocol stack, so as to achieve invisible network devices, which cannot be discovered and accessed by all unauthenticated and activated users.

[0019] 2) The present invention has only a very small number of authorized users, and there is no need for administrator operation. When the user uses a specific activation tool to send an activation data packet to the network device, the invisible service will capture the activation data packet through AF_PACKET, identify and verify it. After successful verification, the user's IP will be added to the filtering whitelist through the firewall, allowing the user to access the network device.

[0020] 3) The present invention restricts the ingress and egress of network traffic at the source through the method of making network devices invisible, thereby achieving strict protection of network devices and being a powerful supplement to existing network security protection technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 Figure 2 is a schematic diagram of activating a data packet.

[0022] Figure 2 Diagram of capturing packets for AF_PACKET and filtering packets with Iptables.

[0023] Figure 3 The present invention is a flow chart of the invisible protection method for network devices based on data packets. DETAILED DESCRIPTION

[0024] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0025] The present invention discloses a network device invisible protection method based on data packets, which is mainly used in network environments with extremely high security and privacy requirements. Through a strict security authentication mechanism, the security and privacy of network devices are guaranteed as much as possible. At the same time, the simple operation mechanism takes into account the requirements of flexibility, which is a powerful supplement to the existing network security protection technology. The technology is mainly composed of three technical points: one is to activate the data packet, one is to capture the data packet by AF_PACKET, and the last one is to filter the data packet by Iptables.

[0026] Among them, Iptables is a firewall tool used to configure and manage network traffic. AF_PACKET is a network protocol interface that allows user space programs to directly access network data packets.

[0027] (1) Activation data package: like Figure 1 As shown, when a user has access requirements, he must authenticate and activate through a specific activation tool. The activation tool will send an activation data packet of a custom protocol type to the network device. The custom protocol data is based on the IP layer and can be sent in the Linux system using a raw socket (create a raw socket: socket (AF_INET, SOCK_RAW, IPPROTO_RAW)). Since the sent protocol data is encrypted using a public key (asymmetric encryption algorithm), the corresponding private key should be used to decrypt the data packet after receiving it.

[0028] (2) AF_PACKET captures data packets: like Figure 2 As shown in the figure, since the data packets received by the network device will be filtered after entering the kernel protocol stack, AF_PACKET needs to be used to capture the data packets before they enter the kernel protocol stack. In the Linux system, AF_PACKET socket can be used to bypass the kernel protocol stack and directly access the link layer data packets. After capturing the data packet, first identify whether it is a custom data type, then decrypt the data content through the private key (asymmetric encryption algorithm), and finally verify the data validity.

[0029] (3) Iptables filters data packets: After the network device starts the invisible service, it first configures the Linux kernel's Netfilter firewall through the Iptables command to block all IP packets when the packets enter the Linux kernel protocol stack (command: iptables -t mangle-A PREROUTING -p ip -j DROP); then, if the activation packet is captured through AF_PACKET and the content is successfully verified, the user IP that sent the activation packet is added to the filtering whitelist (command: iptables -t mangle -IPREROUTING -s <ip>-j ACCEPT); Finally, perform a scheduled check to remove users who have not sent activation packets again within the specified time from the filtering whitelist (command: iptables -t mangle -D PREROUTING -s <ip>-j ACCEPT).

[0030] Through the above introduction, we can understand the general information of each component of the present invention, and the specific application process is as follows: Figure 3 As shown, it is divided into two parallel branch sub-processes: one is the activation verification process, and the other is the timeout check process.

[0031] 1) Activation verification process: The invisible service shields all IP packets from the network through Iptables, and monitors all packets before the kernel protocol stack through AF_PACKET; after capturing the packet, it performs protocol identification, and if it is a custom activation packet type, it decrypts the content and performs content verification; after the verification is successful, the user IP that sent the activation packet is added to the filtering whitelist through Iptables. At this time, the user can access the network device normally.

[0032] 2) Timeout check process: The invisible service will periodically check whether the users in the whitelist have timed out. Users who have not sent activation packages again after a certain period of time will be regarded as invalid users; invalid user IPs will be removed from the filtering whitelist through Iptables. At this time, the user will no longer be able to access the network device.

[0033] The present invention discloses a network device invisible protection method based on data packets, which shields all IP data packets at the bottom layer of the network, realizes the invisible network device, and makes it impossible for all users who have not been authenticated and activated to discover and access it. Only a very small number of authorized users can discover and access the corresponding network device without the need for administrator operation, as long as they hold an activation tool and authenticate and activate it through the activation tool. Through this network device invisible method, the ingress and egress of network traffic is restricted at the source, and strict protection of network devices is achieved. Therefore, the network device invisible protection method based on data packets is a powerful supplement to the existing network security protection technology.< / ip> < / ip> < / ip> < / ip>

Claims

1. A network device invisible protection method based on data packets, characterized in that: The following steps are involved: Step 1: The invisible service blocks all packets containing IP from the network through Iptables, and listens and captures all packets before the kernel protocol stack through AF_PACKET; Step 2: When the user has access requirements, the user sends an activation data packet of a custom protocol type to the network device to be accessed through a specific activation tool; Step 3: The invisible service will perform protocol identification on the data packets captured by AF_PACKET. If it is identified as a custom protocol type, it will decrypt the activation data packet content and perform content verification. After the verification is successful, the user IP that sends the activation data packet will be added to the filtering whitelist through Iptables, so that the user can access the network device normally. Step 4: The invisible service performs regular checks and regards users who have not sent activation packages again within the specified time as invalid users, and removes the IP addresses of the invalid users from the filtering whitelist, so that they can no longer discover and access network devices.

2. A network device invisible protection method based on data packets according to claim 1, characterized in that: In the step 1, capturing data packets through AF_PACKET is specifically as follows: in the Linux system, the AF_PACKET socket is used to bypass the kernel protocol stack and directly access the data packets of the link layer; in step 3, if a custom protocol type is identified, the data content is decrypted by the private key, and finally the validity of the data is verified according to the decrypted content; if a non-custom protocol type is identified, no processing is performed; the verification method is: since the encrypted content of the activation data packet is a string composed of the IP and port of the data packet itself, when performing validity verification, the invisible service compares the decrypted content with the IP and port of the data packet itself, and the verification is passed if they are equal.

3. The method for stealth protection of network devices based on data packets according to claim 1, characterized in that: In step 2, when the user has access requirements, authentication and activation are performed through a specific activation tool. The activation tool sends an activation data packet of a custom protocol type to the network device. The activation data packet of the custom protocol type is based on the IP layer and is sent in the Linux system using a raw socket. The sent data content is encrypted using a public key, and the network device decrypts the activation data packet using the corresponding private key after receiving it.

4. A network device invisible protection method based on data packets according to claim 3, characterized in that: The Iptables packets used include: In step 1, after starting the invisible service, the network device configures the Linux kernel's Netfilter firewall through the Iptables command to block all IP packets when the packets enter the Linux kernel protocol stack. The command is: iptables -t mangle -A PREROUTING -p ip -j DROP; In step 3, after the activation data packet captured by AF_PACKET is successfully verified, the user IP sending the activation packet is added to the filtering whitelist through Iptables. The command is: iptables -t mangle -I PREROUTING -s <ip> -j ACCEPT;< / ip> In step 4, when performing a scheduled check, the user IP that has not sent an activation packet again within the specified time will be removed from the filtering whitelist. The command is: iptables -t mangle -D PREROUTING -s <ip> -j ACCEPT.< / ip>

Images