A method and system for enhancing network security based on single packet authorization technology

Abstract

The application discloses a method and system for enhancing network security based on single packet authorization technology, wherein the method comprises the following steps: registering the relevant information of a service end at a single packet authentication control center; a single packet authentication service end module initiates a single packet authentication request to the single packet authentication control center and registers service information, and the single packet authentication control center verifies the single packet authentication request; a single packet authentication client module initiates a single packet authentication request to the single packet authentication control center and inquires the service information, and the single packet authentication control center verifies the single packet authentication request; the single packet authentication service end module receives a client authentication result message, generates a temporary firewall rule and enables the temporary firewall rule to allow the client to access the service; the single packet authentication client module receives a single packet authentication request response message, and parses the service information from the message after verification; and a client application and a service end business system establish a secure encrypted channel through the single packet authentication client module and the service end module to interact. The application can realize message transmission encryption protection.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for enhancing network security based on single-packet authorization technology. Background Technology

[0002] The client, as the primary terminal for information collection, cannot directly trust the data it transmits to the server. It requires validity and authorization verification before use, and this data is considered merely the user's intention, not the current state of the data. Furthermore, unencrypted network transmission can lead to data leaks, seriously threatening user privacy and security. In the era of big data and ever-increasing informatization, data needs to be processed using network services, transmission protocols, and encryption technologies, and can only be securely transmitted over the network after passing security assessments by network firewalls. Gateways, operating above the network layer, enable network interconnection. They can be used for both wide area network (WAN) and local area network (LAN) interconnection and are the most complex network interconnection devices, acting as a crucial conversion tool for computer systems or devices. However, traditional network interconnection systems typically employ a passive defense model, accepting all detected data packets before inspection. When the server has not implemented any data concealment measures, it faces numerous network attacks as soon as it provides services. Virus detection not only consumes significant network resources but also poses serious security risks.

[0003] The zero-trust mechanism based on Single Packet Authorization (SPA) overcomes the open and insecure nature of traditional Internet transmission protocols, achieving the zero-trust security concept through a "certify first, connect later" approach. SPA protects resources by configuring a default drop policy, thereby achieving service stealth. However, in related technologies, SPA services directly obtain data packets from the network interface card (NIC). All data packets passing through the NIC, regardless of whether they are SPA-authenticated packets, are parsed by the SPA service. This leads to a waste of service resources and can easily cause network congestion under high NIC traffic. Summary of the Invention

[0004] To address the aforementioned issues, this invention proposes a method and system for enhancing network security based on single-packet authorization technology. This method requires no modification to business systems or terminals. By conducting trust assessments on clients through a control center, client trust is maintained. This not only enables business concealment but also establishes an mTLS secure channel, providing encrypted protection for message transmission and reducing the risk of network attacks.

[0005] The technical solution adopted in this invention is as follows:

[0006] A method for enhancing network security based on single-packet authorization technology includes the following steps:

[0007] Step 1: Register the relevant information of the server in the single package authentication control center. The relevant information includes the service identifier ID, service name, and description.

[0008] Step 2: The single-packet authentication server module constructs a single-packet authentication request message, initiates a single-packet authentication request to the single-packet authentication control center, and registers service information, including service IP address and port;

[0009] Step 3: The single-packet authentication control center verifies the single-packet authentication request from the single-packet authentication server module;

[0010] Step 4: The single-packet authentication client module constructs a single-packet authentication request message, initiates a single-packet authentication request to the single-packet authentication control center, and queries the service information;

[0011] Step 5: The single-packet authentication control center verifies the single-packet authentication request from the single-packet authentication client module;

[0012] Step 6: The single-packet authentication server module receives the client authentication result message from the single-packet authentication control center, generates a temporary firewall rule and enables it, allowing the client to access the service;

[0013] Step 7: The single-packet authentication client module receives the single-packet authentication request response message issued by the single-packet authentication control center. First, it verifies the validity of the message. After successful verification, it parses the service information from the message.

[0014] Step 8: The client application and the server-side business system interact by establishing a secure encrypted channel between the single-packet authentication client module and the single-packet authentication server module.

[0015] Furthermore, step 3 includes the following sub-steps:

[0016] Step 3.1: The single packet authentication control center detects the message sent by the single packet authentication server module, and parses and verifies the message;

[0017] Step 3.2: If the single packet authentication control center successfully parses the message, it records the service information of the single packet authentication server module, then constructs a response message and sends it to the single packet authentication server module.

[0018] Step 3.3: If parsing the message fails, do not respond and end the process.

[0019] Furthermore, step 5 includes the following sub-steps:

[0020] Step 5.1: The single packet authentication control center detects the message sent by the single packet authentication client module, parses and verifies the message, and evaluates the trust level of the client;

[0021] Step 5.2: If the trust level of the single packet authentication client module exceeds the trust threshold, the single packet authentication control center will send the authentication result of the single packet authentication client module to the single packet authentication server module, and notify the single packet authentication server module to enable the client's access policy. Then, a single packet response message will be constructed and sent to the single packet authentication client module.

[0022] Step 5.3: If the trust level is not up to standard, construct a message to alert the client to perform a self-check, and notify the single packet authentication server module to clear the client access policy and close the client's relevant access ports.

[0023] Furthermore, step 7 includes the following sub-steps:

[0024] Step 7.1: The single-packet authentication client module receives and parses the request-response message sent by the single-packet authentication control center;

[0025] Step 7.2: If the single-packet authentication client module successfully parses the message, it verifies the integrity of its content and then parses the service information from the message.

[0026] Furthermore, step 8 includes the following sub-steps:

[0027] Step 8.1: Based on the service IP and port information obtained from the message, the client application sends a connection request to the server through the single-packet authentication client module;

[0028] Step 8.2: The server parses and verifies the request message through the single-packet authentication server module;

[0029] Step 8.3: After successful verification, establish a secure encrypted channel between the single-packet authentication client module and the single-packet authentication server module for interaction.

[0030] A system for enhancing network security based on single-packet authorization technology includes a single-packet authentication client module, a single-packet authentication server module, and a single-packet authentication control center, wherein:

[0031] The single-packet authentication client module is used to support initiating single-packet authentication with the single-packet authentication control center and periodically reporting the real-time status information of the terminal to the single-packet authentication control center. After the single-packet authentication is successful, the client and the server establish a secure encrypted channel, and secure data transmission is carried out between the client application and the server business system.

[0032] The single-packet authentication server module is used to support initiating single-packet authentication with the single-packet authentication control center; and to implement a dynamic firewall, which by default denies all network service access, and automatically adds, deletes or updates access rules only based on the client single-packet authentication results issued by the single-packet authentication control center and the dynamic assessment results of the client's trust level, and establishes a secure encrypted channel with clients allowed by the firewall.

[0033] The single-packet authentication control center receives single-packet authentication requests from the single-packet authentication server module. Upon successful authentication, it records the IP address and port information of the server-side business system to achieve service registration and online status. It then generates an authentication response message and replies to the single-packet authentication server module. It also receives single-packet authentication requests from the single-packet authentication client module. Upon successful authentication, it sends the client's IP address information to the single-packet authentication server module, which generates and enables temporary access rules, then generates an authentication response message and replies to the single-packet authentication client module. Furthermore, it continuously receives real-time terminal status information reported by the single-packet authentication client module, dynamically assesses the terminal's trustworthiness, and notifies the single-packet authentication server module to disable and delete the terminal's access rules when the terminal's trustworthiness falls below a set threshold.

[0034] Furthermore, the authentication request message of the single-packet authentication server module includes: protocol version number, service identifier ID, service IP address, service port, signature value, and server certificate.

[0035] Furthermore, the authentication response message sent by the single-packet authentication control center to the single-packet authentication server module includes: protocol version number, service identifier ID, authentication expiration time, signature value, and authentication center certificate.

[0036] Furthermore, the authentication request message of the single-packet authentication client module includes: protocol version number, terminal identifier ID, service identifier ID, terminal IP address, signature value, and client certificate.

[0037] Furthermore, the authentication response message sent by the single-packet authentication control center to the single-packet authentication client module includes: protocol version number, terminal identifier ID, service IP address, service port, authentication expiration time, signature value, and control center certificate.

[0038] The beneficial effects of this invention are as follows:

[0039] In this invention, the single-packet authentication server module hides and closes all ports by default. When the single-packet authentication server module is needed, the single-packet authentication client module first sends an authorization request message to the single-packet authentication control center. After the single-packet authentication control center verifies the message, it sends a single-packet authorization request to the single-packet authentication server module and issues the client access policy. The single-packet authentication server module verifies the single-packet authorization sent by the single-packet authentication control center. After successful verification, it opens the client access channel. The single-packet authentication client module sends a connection request to the single-packet authentication server module to establish a bidirectional TLS secure transmission channel. The ports of the single-packet authentication server module are completely hidden with the help of the single-packet authentication control center, avoiding most network attacks. Furthermore, the establishment of a bidirectional TLS secure transmission channel not only solves the problem of server port exposure in existing technologies but also further ensures the security of transmitted data. Attached Figure Description

[0040] Figure 1 The overall scheme flowchart of Embodiment 1 of the present invention.

[0041] Figure 2 The server-side single-packet authentication flowchart of Embodiment 1 of the present invention.

[0042] Figure 3 The client single-packet authentication flowchart of Embodiment 1 of the present invention.

[0043] Figure 4 A schematic diagram of the system architecture of Embodiment 2 of the present invention. Detailed Implementation

[0044] To provide a clearer understanding of the technical features, objectives, and effects of the present invention, specific embodiments are now described. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention; that is, the described embodiments are only a part of the embodiments of the invention, not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0045] Example 1

[0046] This embodiment provides a method for enhancing network security based on single-packet authorization technology, including service registration and online deployment of the single-packet authentication server module (SPA-SM) to the single-packet authentication control center (SPA-CC), dynamic trust assessment and single-packet authorization authentication of the single-packet authentication client module (SPA-CM) to the single-packet authentication control center, access policy distribution, and secure channel establishment. Figure 1 As shown, the specific steps include:

[0047] Step 1: Register the relevant information of the server in the single package authentication control center, including the service identifier ID, service name, and description;

[0048] Step 2: The single packet authentication server module constructs a single packet authentication request message, sends a single packet authentication request to the single packet authentication control center, and registers service information, including the service IP address and port;

[0049] Step 3: The single-packet authentication control center verifies the single-packet authentication request from the single-packet authentication server module;

[0050] Step 4: The single-packet authentication client module constructs a single-packet authentication request message, initiates a single-packet authentication request to the single-packet authentication control center, and queries service information;

[0051] Step 5: The single-packet authentication control center verifies the single-packet authentication request from the single-packet authentication client module;

[0052] Step 6: The single-packet authentication server module receives the client authentication result message from the single-packet authentication control center, generates a temporary firewall rule and enables it, allowing the client to access the service;

[0053] Step 7: The single-packet authentication client module receives the single-packet authentication request response message issued by the single-packet authentication control center. First, it verifies the validity of the message. After successful verification, it parses the service information from the message.

[0054] Step 8: The client application and the server-side business system interact by establishing a secure encrypted channel between the single-packet authentication client module and the single-packet authentication server module.

[0055] Steps 1 through 3 involve the single-package authentication server module registering and going live with the single-package authentication control center, such as... Figure 2 As shown; steps 4 and 5 involve the single-package authentication client module dynamically assessing trust and performing single-package authorization authentication at the single-package authentication control center, as follows: Figure 3 As shown; Steps 6 to 8 are for issuing access policies and establishing secure channels.

[0056] Preferably, step 2 includes the following sub-steps:

[0057] Step 2.1: The single-packet authentication server module uses the server's private key to perform a signature operation on information such as service ID, service IP, service port, random number, and timestamp;

[0058] Step 2.2: The single-packet authentication server module constructs an authentication request message using fields such as protocol version number, service identifier ID, service IP address, service port, signature value, and service certificate, and sends it to the single-packet authentication control center.

[0059] Preferably, step 3 includes the following sub-steps:

[0060] Step 3.1: The single-packet authentication control center detects the authentication request message and parses it;

[0061] Step 3.2: After successful parsing, the single packet authentication control center performs identity authentication on the server. If the identity authentication is successful, the business server information is registered; otherwise, the packet is discarded.

[0062] Step 3.3: The single-packet authentication control center constructs a registration response message and sends it to the single-packet authentication server module;

[0063] Step 3.4: The single-packet authentication server module receives and parses the response message, and performs integrity verification on the message. The integrity verification is performed by verifying the signature value using the public key of the central certificate. The single-packet authentication server module needs to re-initiate single-packet authentication after the authentication expires. At this point, the service registration and online launch are completed.

[0064] More preferably, step 3.2 includes the following sub-steps:

[0065] Step 3.2.1: The single-packet authentication control center obtains the server information, information signature value, and service certificate from the parsed message;

[0066] Step 3.2.2: The single-packet authentication control center verifies the signature value of the server information based on the public key in the service certificate;

[0067] Step 3.2.3: If the signature verification passes, the single-packet authentication control center will register the service identifier ID, service IP address, service port, service name, and description of the business server.

[0068] Step 3.2.4: If the verification fails, do not respond and end the process.

[0069] More preferably, step 3.3 includes the following sub-steps:

[0070] Step 3.3.1: The single-packet authentication control center uses the public key of the service certificate to encrypt the session key;

[0071] Step 3.3.2: The single-packet authentication control center performs a signature operation on the service ID, session key ciphertext, expiration time, timestamp, etc., based on the private key of the center certificate;

[0072] Step 3.3.3: The single-package authentication control center constructs a response message based on the protocol version number, service identifier ID, authentication expiration time, signature value, and authentication center certificate, and sends it to the single-package authentication server module.

[0073] Preferably, step 4 includes the following sub-steps:

[0074] Step 4.1: The single-packet authentication client module uses the terminal's private key to digitally sign the protocol version number, terminal identifier ID, source IP, random number, timestamp, service identifier ID, terminal IP address and other fields.

[0075] Step 4.2: The single-packet authentication client module constructs an authentication request message using the field information from Step 4.1, the digital signature value, and the client certificate, and sends the message to the single-packet authentication control center.

[0076] Preferably, step 5 includes the following sub-steps:

[0077] Step 5.1: The single packet authentication control center detects the message sent by the single packet authentication client module, parses and verifies the message, and evaluates the trust level of the client;

[0078] Step 5.2: If the trust level of the single-packet authentication client module exceeds the trust limit, the single-packet authentication control center will use the public key signature value of the terminal certificate to verify the integrity of the received message.

[0079] Step 5.3: If the terminal message passes verification, generate response messages and send them to the single packet authentication client module and the single packet authentication server module respectively; otherwise, do not respond and end the process.

[0080] Step 5.4: If the trust level is not up to standard, construct a response message to alert the client to perform a self-check; and notify the single packet authentication server module to clear the client access policy and close the client's relevant access ports.

[0081] More preferably, step 5.1 includes the following sub-steps:

[0082] Step 5.1.1: The single-packet authentication client module establishes a connection with the single-packet authentication control center using a three-way handshake protocol and shares the key K;

[0083] Step 5.1.2: The single-packet authentication client module uses the shared key K to calculate the message verification code using information such as the client ID, client type, whether the firewall is enabled, and timestamp.

[0084] Step 5.1.3: The single-packet authentication client module sends the field information and the message verification code construction status report message to the single-packet authentication control center;

[0085] Step 5.1.4: The single-package authentication control center detects the status reporting message and performs parsing and authentication.

[0086] More preferably, step 5.1.4 includes the following sub-steps:

[0087] Step 5.1.4.1: If the status message is successfully parsed, then use the shared key K to calculate the received message;

[0088] Step 5.1.4.2: If the calculated message authentication code matches the received message authentication code, the client is considered trustworthy, and step 5.2 is executed; otherwise, it is considered untrustworthy, and step 5.3 is executed.

[0089] More preferably, step 5.3 includes the following sub-steps:

[0090] Step 5.3.1: The single-packet authentication control center generates a terminal policy for the client and calculates the message authentication code based on fields such as client ID, terminal policy, and timestamp.

[0091] Step 5.3.2: The single-packet authentication control center uses its private key to calculate a digital signature value for fields such as protocol version number, terminal identifier ID, server ID, service IP address, service port, authentication expiration time, and timestamp. Then, it constructs an authentication response message with the field information, signature value, control center certificate, and other information, and sends it to the single-packet authentication client module.

[0092] Step 5.3.3: The single-packet authentication control center uses the shared key to calculate the message authentication code based on the protocol version number, service ID, client ID, terminal IP access policy, timestamp, and other field information. Then, it constructs a policy based on the field information and message authentication code, sends a message to the single-packet authentication server module, and notifies the single-packet authentication server module to enable the terminal's access policy.

[0093] Preferably, step 6 includes the following sub-steps:

[0094] Step 6.1: The single-packet authentication server module detects and parses the message sent by the single-packet authentication control center;

[0095] Step 6.2: The single-packet authentication server module parses the message to obtain the client ID, generates a temporary firewall rule for this client ID and enables it, so as to receive access services from the client.

[0096] Preferably, step 7 includes the following sub-steps:

[0097] Step 7.1: The single-packet authentication client module receives and parses the request-response message sent by the single-packet authentication control center;

[0098] Step 7.2: The single-packet authentication client module first uses the public key of the central certificate to verify the integrity of the signature value, thereby verifying the validity of the message;

[0099] Step 7.3: If the message verification is successful, the single-packet authentication client module parses the message and extracts the server's service IP and port information from it; otherwise, it does not respond and ends the process.

[0100] Preferably, step 8 includes the following sub-steps:

[0101] Step 8.1: Based on the service IP and port information obtained from the message, the client application sends an encrypted service request to the server through the single-packet authentication client module;

[0102] Step 8.2: The server parses and verifies the request message through the single-packet authentication server module;

[0103] Step 8.3: After successful verification, the single-packet authentication server module processes the business and constructs a business encrypted response message;

[0104] Step 8.4: The single-packet authentication server module sends the encrypted response message to the single-packet authentication client module, thus establishing a secure encrypted channel between the single-packet authentication client module and the single-packet authentication server module to ensure data transmission security.

[0105] Example 2

[0106] This embodiment is based on embodiment 1:

[0107] like Figure 4 As shown, this embodiment provides a system for enhancing network security based on single-packet authorization technology, including a single-packet authentication client module (SPA-CM), a single-packet authentication server module (SPA-SM), and a single-packet authentication control center (SPA-CC), wherein:

[0108] The single-packet authentication client module is used to support initiating single-packet authentication with the single-packet authentication control center and periodically reporting the real-time status information of the terminal to the single-packet authentication control center. After the single-packet authentication is successful, the client and the server establish a secure encrypted channel, and secure data transmission is carried out between the client application and the server business system.

[0109] The single-packet authentication server module is used to support initiating single-packet authentication with the single-packet authentication control center; and to implement a dynamic firewall, which by default denies all network service access, and automatically adds, deletes or updates access rules only based on the client single-packet authentication results issued by the single-packet authentication control center and the dynamic assessment results of the client's trust level, and establishes a secure encrypted channel with clients allowed by the firewall.

[0110] The single-packet authentication control center receives single-packet authentication requests from the single-packet authentication server module. Upon successful authentication, it records the IP address and port information of the server-side business system to achieve service registration and online status. It then generates an authentication response message and replies to the single-packet authentication server module. It also receives single-packet authentication requests from the single-packet authentication client module. Upon successful authentication, it sends the client's IP address information to the single-packet authentication server module, which generates and enables temporary access rules, then generates an authentication response message and replies to the single-packet authentication client module. Furthermore, it continuously receives real-time terminal status information reported by the single-packet authentication client module, dynamically assesses the terminal's trustworthiness, and notifies the single-packet authentication server module to disable and delete the terminal's access rules when the terminal's trustworthiness falls below a set threshold.

[0111] Preferably, the authentication request message of the single-packet authentication server module includes: protocol version number, service identifier ID, service IP address, service port, signature value, and server certificate.

[0112] Preferably, the authentication response message sent by the single-package authentication control center to the single-package authentication server module includes: protocol version number, service identifier ID, authentication expiration time, signature value, and authentication center certificate.

[0113] Preferably, the authentication request message of the single-packet authentication client module includes: protocol version number, terminal identifier ID, service identifier ID, terminal IP address, signature value, and client certificate.

[0114] Preferably, the authentication response message sent by the single-packet authentication control center to the single-packet authentication client module includes: protocol version number, terminal identifier ID, service IP address, service port, authentication expiration time, signature value, and control center certificate.

[0115] As can be seen from Embodiments 1 and 2 above, the method and system for enhancing network security based on single-packet authorization technology provided by the present invention have the following innovations and advantages: The single-packet authentication server module uses a hardware encryption device to provide cryptographic operation capabilities, realizing high-performance data encryption and decryption on the server side; the server side hides and closes all ports by default, the single-packet authentication client module collects the real-time status information of the client and reports it to the single-packet authentication control center periodically, the single-packet authentication control center performs trust assessment on the client to ensure the client's trustworthiness; the client performs single-packet authentication with the single-packet authentication control center through the single-packet authentication client module. The single-packet authentication client module first sends an authorization request message to the single-packet authentication control center. After the single-packet authentication control center verifies the message, it sends a single-packet authorization request to the single-packet authentication server module, notifying the single-packet authentication server module to open the client's access policy, thereby achieving business service hiding and reducing the risk of network attacks; the single-packet authentication client module and the single-packet authentication server module establish an mTLS secure channel to achieve encrypted protection of message transmission; the system deployment can be attached to the original system without requiring modification of the business system and terminal. The Single Packet Authentication Control Center helps to completely hide the port of the Single Packet Authentication Server Module, avoiding the vast majority of network attacks and establishing a two-way TLS secure transmission channel. This not only solves the problem of server port exposure in existing technologies, but also further ensures the security of transmitted data and the availability of the original system.

[0116] It should be noted that, for the sake of simplicity, the foregoing method embodiments are described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

Claims

1. A method for enhancing network security based on single-packet authorization technology, characterized in that, Includes the following steps: Step 1: Register the relevant information of the server in the single package authentication control center. The relevant information includes the service identifier ID, service name, and description. Step 2: The single-packet authentication server module constructs a single-packet authentication request message, initiates a single-packet authentication request to the single-packet authentication control center, and registers service information, including service IP address and port; Step 3: The single-packet authentication control center verifies the single-packet authentication request from the single-packet authentication server module; Step 4: The single-packet authentication client module constructs a single-packet authentication request message, initiates a single-packet authentication request to the single-packet authentication control center, and queries the service information; Step 5: The single-packet authentication control center verifies the single-packet authentication request from the single-packet authentication client module; Step 6: The single-packet authentication server module receives the client authentication result message from the single-packet authentication control center, generates a temporary firewall rule and enables it, allowing the client to access the service; Step 7: The single-packet authentication client module receives the single-packet authentication request response message issued by the single-packet authentication control center. First, it verifies the validity of the message. After successful verification, it parses the service information from the message. Step 8: The client application and the server-side business system interact by establishing a secure encrypted channel between the single-packet authentication client module and the single-packet authentication server module; Step 5 includes the following sub-steps: Step 5.1: The single packet authentication control center detects the message sent by the single packet authentication client module, parses and verifies the message, and evaluates the trust level of the client; Step 5.2: If the trust level of the single packet authentication client module exceeds the trust threshold, the single packet authentication control center will send the authentication result of the single packet authentication client module to the single packet authentication server module, and notify the single packet authentication server module to enable the client's access policy. Then, a single packet response message will be constructed and sent to the single packet authentication client module. Step 5.3: If the trust level is not up to standard, construct a message to alert the client to perform a self-check, and notify the single packet authentication server module to clear the client access policy and close the client's relevant access ports; Step 7 includes the following sub-steps: Step 7.1: The single-packet authentication client module receives and parses the request-response message sent by the single-packet authentication control center; Step 7.2: If the single-packet authentication client module successfully parses the message, it verifies the integrity of its content and then parses the service information from the message; Step 8 includes the following sub-steps: Step 8.1: Based on the service IP and port information obtained from the message, the client application sends a connection request to the server through the single-packet authentication client module; Step 8.2: The server parses and verifies the request message through the single-packet authentication server module; Step 8.3: After successful verification, establish a secure encrypted channel between the single-packet authentication client module and the single-packet authentication server module for interaction.

2. The method for enhancing network security based on single-packet authorization technology according to claim 1, characterized in that, Step 3 includes the following sub-steps: Step 3.1: The single packet authentication control center detects the message sent by the single packet authentication server module, and parses and verifies the message; Step 3.2: If the single packet authentication control center successfully parses the message, it records the service information of the single packet authentication server module, then constructs a response message and sends it to the single packet authentication server module. Step 3.3: If parsing the message fails, do not respond and end the process.

3. A system for enhancing network security based on single-packet authorization technology, employing the method described in claim 1, characterized in that, It includes a single-packet authentication client module, a single-packet authentication server module, and a single-packet authentication control center, among which: The single-packet authentication client module is used to support initiating single-packet authentication with the single-packet authentication control center and periodically reporting the real-time status information of the terminal to the single-packet authentication control center; after the single-packet authentication is successful, the client and the server establish a secure encrypted channel, and secure data transmission is carried out between the client application and the server business system. The single packet authentication server module is used to support initiating single packet authentication with the single packet authentication control center; and to implement a dynamic firewall, which by default denies all network service access, and automatically adds, deletes or updates access rules only based on the client single packet authentication results issued by the single packet authentication control center and the dynamic evaluation results of the client's trust level, and establishes a secure encrypted channel with clients allowed by the firewall; The single-packet authentication control center receives single-packet authentication requests from the single-packet authentication server module. Upon successful authentication, it records the IP address and port information of the server-side business system to achieve service registration and online status. It then generates an authentication response message and replies to the single-packet authentication server module. It also receives single-packet authentication requests from the single-packet authentication client module. Upon successful authentication, it sends the client's IP address information to the single-packet authentication server module, which generates and enables temporary access rules, then generates an authentication response message and replies to the single-packet authentication client module. Furthermore, it continuously receives real-time terminal status information reported by the single-packet authentication client module, dynamically assesses the terminal's trustworthiness, and notifies the single-packet authentication server module to disable and delete the terminal's access rules when the terminal's trustworthiness falls below a set threshold.

4. The system for enhancing network security based on single-packet authorization technology according to claim 3, characterized in that, The authentication request message of the single-packet authentication server module includes: protocol version number, service identifier ID, service IP address, service port, signature value, and server certificate.

5. The system for enhancing network security based on single-packet authorization technology according to claim 3, characterized in that, The authentication response message sent by the single-package authentication control center to the single-package authentication server module includes: protocol version number, service identifier ID, authentication expiration time, signature value, and authentication center certificate.

6. The system for enhancing network security based on single-packet authorization technology according to claim 3, characterized in that, The authentication request message of the single-packet authentication client module includes: protocol version number, terminal identifier ID, service identifier ID, terminal IP address, signature value, and client certificate.

7. The system for enhancing network security based on single-packet authorization technology according to claim 3, characterized in that, The authentication response message sent by the single-packet authentication control center to the single-packet authentication client module includes: protocol version number, terminal identifier ID, service IP address, service port, authentication expiration time, signature value, and control center certificate.

Images