A method for hiding source address based on pseudo-fake IP

Abstract

The application provides a source address hiding method based on a fake IP. The method comprises the following steps: hiding the source IP of active access and passive back connection, and hiding the source address in the process of accessing an overseas target and passive back connection by designing a G device, a G+ device, a flow table device and a VPN server. The G device guides the flow to the G+ device according to specific rules. The G+ device is provided with two network cards, one of which is connected with the G device, and the other network card is connected with the flow table device. The flow table device is located between the G+ device and the VPN server, mainly creates a flow table and modifies a data packet. The normally built VPN server is responsible for the access and access of users.

Description

Technical Field

[0001] This invention relates to the field of network security, and more specifically, to a method for hiding source addresses based on spoofed IP addresses. Background Technology

[0002] In recent years, major world powers have attached great importance to cybersecurity, engaging in fierce competition for the right to develop, dominate, and control cyberspace. Specialized cyber operations, as one of our means of ensuring cybersecurity, are particularly vulnerable to attacks and tracing due to their unique operational characteristics, in addition to facing the same security risks as other information systems.

[0003] Currently, the security protection of cyber operations mainly relies on passive defense technologies such as firewalls, antivirus software, and intrusion detection, as well as simple anti-tracing and source tracing techniques such as setting up overseas gateways and using anonymous proxy networks. These methods do not change the determinism, similarity, and static nature of cyber operations, nor can they effectively resist advanced persistent threats. To ensure the stable, continuous, and secure development of special cyber operations, and addressing the high security requirements of anti-tracing and attack resistance for these operations, a source address hiding method based on spoofed IP addresses is proposed. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a source address hiding method based on spoofed IP addresses, which can not only achieve the purpose of network security and anti-tracing communication, and prevent network privacy leakage; but also effectively improve the dynamism and uncertainty of the network, and enhance the network's security protection capabilities.

[0005] Firstly, the G+ device is primarily responsible for forwarding the traffic imported by the G device to the flow table device. This traffic can be mainly divided into the following categories:

[0006] 1. For user traffic connecting to the VPN server, the G+ device directly modifies the destination IP to the VPN server IP and forwards it to the flow table device;

[0007] 2. In the response packet sent by the VPN server to the user, the G+ device directly modifies the source IP to a fake VPN IP and sends it to the G device;

[0008] 3. For traffic destined for a spoofed IP address outside the local network, the G+ device encapsulates the data packets with GRE and sends them to the flow table device;

[0009] 4. When a VPN server accesses traffic destined for a target outside the local network, the G+ device removes the GRE encapsulation from the packet header and forwards the packet to the G device.

[0010] 5. For traffic whose flow table does not match the flow table of the flow table device, the G+ device removes the GRE encapsulation in the packet header and forwards the packet to the G device.

[0011] Secondly, the main function of the flow table device is to forward all traffic received by the G device from destinations outside the local network destined for the VPN to the G+ device. After the G+ device checks the flow table, it resends the traffic to the flow table device, which then forwards it to the VPN server.

[0012] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the following are provided in conjunction with the accompanying drawings. Attached Figure Description

[0013] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 The diagram shows a device composition diagram of a source address hiding method based on spoofed IP provided by the present invention;

[0015] Figure 2 The diagram shows a device composition diagram of a source address hiding method based on spoofed IP provided by the present invention;

[0016] Figure 2A The diagram illustrates a device data packet processing flowchart for a source address hiding method based on spoofed IP addresses provided by this invention.

[0017] Figure 2B The diagram illustrates a flow table device receiving data packets according to a source address hiding method based on spoofed IP provided by the present invention. Figure 3 The diagram shows the overall device and core module composition of a source address hiding method based on spoofed IP provided by the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0019] Example 1

[0020] Reference Figure 1 This invention provides a source address hiding method based on spoofed IP addresses. In this embodiment, G devices and G+ devices are designed and developed based on IP address hiding technology. This achieves source address hiding during access to overseas targets and passive backlinks. In this invention, the G device directs traffic to the G+ device according to specific rules; the G+ device has two network interface cards (NICs). The method specifically includes the following steps:

[0021] Step 101: When a user accesses an overseas target, the access data packet must first pass through the G device.

[0022] Step 102: The G device directs traffic to the G+ device according to specific rules.

[0023] Step 103: The G+ device has two network interface cards (NICs), one connected to the G device and the other connected to the flow table device. The data packets are modified and then sent to the overseas target.

[0024] Step 104: After receiving the request, the overseas target returns the corresponding data packet, first through the G device, then repeating steps 102 and 103, and finally returning the modified data packet to the user.

[0025] Example 2

[0026] join Figure 2 This invention provides a source address hiding method based on spoofed IP addresses. In this invention, based on IP address hiding technology, a G device, a G+ device, a flow table device, and a VPN server are designed and developed to hide the source address during access to overseas targets and passive backlinks. In this invention, the G device directs traffic to the G+ device according to specific rules; the G+ device has two network interface cards (NICs), one connected to the G device and the other connected to the flow table device. The method specifically includes the following steps:

[0027] Steps 201-204: When a user accesses an overseas target, the packet type of the user's packet is <user IP, given overseas IP, port a, port b, GRE (overseas target IP, target port c, data)>. After the packet first arrives at device G, it matches the given overseas IP and is forwarded to device G+, with the packet type remaining <user IP, given overseas IP, port a, port b, GRE (overseas target IP, target port c, data)>.

[0028] Device G+ modifies the packet, Figure 2A as shown, the packet type after modification is <user IP, device G+ IP, port a, port b, GRE (overseas target IP, target port c, data)>. Figure 2B as shown, the flow table device needs to determine whether the packet is sent by the user or is a response packet from the overseas target. The VPN server receives the packet and sends the packet to access the overseas target IP, with the packet type <G+ device IP, overseas target IP, port a1 (allocated by the VPN server), target port c, (data)>. Modify the source port to a constructed port (10 random bits + 6 bits checksum), and send the packet out, with the packet type <G+ device IP, overseas target IP, constructed port a2, target port c, (type 2, spoofed IP, data)>, and create an entry in the flow table device as follows: overseas target IP, target port c, source port a1 || overseas target IP, spoofed IP, destination port c, constructed port a2.

[0029] Device G receives the modified packet, whose current packet type is <G+ device IP, overseas target IP, constructed port a2, target port c, (type 2, spoofed IP, data)>, and forwards it to device G+. Device G+ receives the packet, extracts the spoofed IP and type, modifies the source IP, and sends the packet out, with the packet type <spoofed IP, overseas target IP, constructed port a2, target port c, (data)>. The overseas target IP receives the packet and responds with a packet, whose packet type is <overseas target IP, spoofed IP, port c, constructed port a2, (data)>. Device G receives the packet, matches the spoofed IP, and forwards it to device G+, with the packet type <overseas target IP, spoofed IP, port c, constructed port a2, (data)>.

[0030] The G+ device analyzes the data packet to check whether the destination port complies with the construction rule. If it complies, the data packet is forwarded to the flow table device<overseas target IP, G+ device IP, port c, constructed port a2, (spoofed IP, data)>; if it does not comply, the data packet is forwarded to the spoofed IP<overseas target IP, spoofed IP, port c, port a2, (data)>. The flow table device performs a flow table lookup operation. If the flow table matches, the data platform modifies the data packet and sends it to the VPN server, and the packet type of the data packet is <overseas target IP, proxy subsystem IP, port c, port a1, data>. The VPN server constructs a response packet and sends it to the user IP. If the flow table does not match, the G+ device modifies the data packet and sends it to the G device, and the packet type of the data packet is <G+ device IP, overseas target IP, port c, constructed port a2, (type 3, spoofed IP, data)>. When the data packet reaches the G device, it matches the device IP and is forwarded to the G+ device. According to the type field, a new packet is constructed, and the data type of the new packet is <overseas target IP, spoofed IP, port c, port a2, (type 4 data)>, so as to achieve the purpose of spoofing the source IP.

[0031] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it is still possible to modify the technical solutions recorded in the foregoing embodiments, or equivalently replace some or all of the technical features thereof; and such modifications or replacements do not make the essence of the corresponding technical solutions depart from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A source address hiding method based on masquerading IP, characterized in that, The method comprises: hiding a user IP when a user actively accesses a target server outside a local network or when the target server passively connects back; from the perspective of the target server, the source IP of a data packet sent to itself is a spoofed IP located in the local network, which is not associated with the real user IP at all; even if the target server performs tracing and source tracing, there is no record of any system user activity on the spoofed IP; when a user accesses a target server outside a local network, generating a first data packet, the data packet type of the first data packet is <user IP, given IP, port a, port b, GRE(target IP, target port c, data)>; the target IP is the IP address of the target server outside the local network; the given IP is a given IP outside the local network that enables a G device to match and forward the data packet to a G+ device; port a is the source port corresponding to the user IP, port b is the destination port corresponding to the given IP, and target port c is the destination port corresponding to the target IP; after the first data packet reaches the G device, the G device matches the given IP, and forwards the first data packet to the G+ device, the data packet type of the first data packet is <user IP, given IP, port a, port b, GRE(target IP, target port c, data)>; the G+ device has two network cards, one is connected to the G device, and the other network card is connected to a flow table device; the G+ device modifies the first data packet to obtain a second data packet, the data packet type of the second data packet is <user IP, G+ device IP, port a, port b, GRE(target IP, target port c, data)>; the flow table device determines whether the second data packet is a data packet sent by the user or a response packet from the target IP, a VPN server receives the second data packet, and sends a third data packet to access the target IP, the data packet type of the third data packet is <G+ device IP, target IP, port a1, target port c, data>; port a1 is a source port allocated by the VPN server for accessing the target IP; modifying the source port of the third data packet from port a1 to a constructed port a2, the port value of the constructed port a2 consists of a 10-bit random value and a 6-bit checksum value, and sending a fourth data packet, the data packet type of the fourth data packet is <G+ device IP, target IP, constructed port a2, target port c, (type 2, spoofed IP, data)>, and creating a table on the flow table device, wherein the table entries comprise: target IP, target port c, a combination field composed of port a1 and the target IP, spoofed IP, destination port c, constructed port a2; the G device receives the fourth data packet, the data packet type of the fourth data packet at this time is <G+ device IP, target IP, constructed port a2, target port c, (type 2, spoofed IP, data)>, and forwards the fourth data packet to the G+ device; the G+ device receives the fourth data packet, extracts the spoofed IP and type 2 therein, modifies the source IP of the fourth data packet to the spoofed IP, and then sends out a fifth data packet, the data packet type of the fifth data packet is <spoofed IP, target IP, constructed port a2, target port c, data>; The target IP receives the fifth data packet and responds to generate a sixth data packet, and the data packet type of the sixth data packet is <target IP, spoofed IP, target port c, constructed port a2, data>; Device G receives the sixth data packet, matches the spoofed IP, and forwards it to device G+, and the data packet type of the sixth data packet is <target IP, spoofed IP, target port c, constructed port a2, data>; Device G+ analyzes the sixth data packet, and checks whether the destination port of the sixth data packet, that is the constructed port a2, conforms to the construction rule; if it conforms, the sixth data packet is forwarded to a flow table device, and the data packet type of the seventh data packet after forwarding is <target IP, IP of device G+, target port c, constructed port a2, (spoofed IP, data)>; if it does not conform, the sixth data packet is forwarded to the spoofed IP, and the data packet type of the forwarded data packet is <target IP, spoofed IP, target port c, constructed port a2, data>; The flow table device performs a flow table lookup operation on the seventh data packet. If the flow table matches, the flow table device modifies the seventh data packet and sends it to a VPN server, and the data packet type of the modified eighth data packet is <target IP, IP of proxy subsystem, target port c, port a1, data>, and the VPN server constructs a response packet and sends it to a user IP; if the flow table does not match, device G+ modifies the seventh data packet and sends it to device G, and the data packet type of the modified ninth data packet is <IP of device G+, target IP, target port c, constructed port a2, (type 3, spoofed IP, data)>; The ninth data packet arrives at device G, device G matches the IP of device G+ and forwards it to device G+; device G+ constructs a tenth data packet according to the type field in the ninth data packet, and the data packet type of the tenth data packet is <target IP, spoofed IP, target port c, constructed port a2, (type 4, data)>, so as to achieve the purpose of spoofing the source IP; Device G+ is responsible for processing matched data packets; The custom header comprises a total of 5 bytes, including a 1-byte type field and a 4-byte IP address field; wherein: type 1: response packet sent by the VPN server to the user; type 2: data packet for device G+ to access the target IP; type 3: target response packet outside the local network; type 4: a data packet that has no matching item in the flow table device and needs to be sent to G+;

Images