A firewall design method and system for network hiding

Abstract

The application discloses a kind of network hidden-oriented firewall design method and system.For the environment needing network hiding function (such as software-defined boundary), first, registration center carries out the identity authentication and element notification of communication parties in advance, time synchronization, for the further development of communication is guided;Then, registration center is in network traffic client and server deployment port negotiation module, reduces the network attack risk such as traffic sniffing, port attack;Finally, the data structure of the firewall management rule of the system is converted into an extensible counting bloom filter, realizes the high-speed processing of message, solves the problem that the original firewall fails due to low efficiency under a large number of rule operations, and the system has the advantages of high security and efficient data processing.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and is a firewall method and system suitable for large-flow and high-concurrency networks and meeting network hiding requirements. BACKGROUND

[0002] A firewall is a system composed of computer hardware and software, deployed at the network boundary, and is a network security system located between the internal network and the external network. It is designed based on the application security technology based on network technology and information security technology, and allows or restricts the transmission of data according to specific rules, and plays a role in security filtering and security isolation of harmful network security information and behavior such as external network attacks and intrusions.

[0003] In order to meet the dynamic implementation of data filtering and security isolation functions, various system designs have been proposed. For example, Netfilter / IPtables. Among them, IPtables works in the user space (user space) and designs a set of pre-set rules when operating the IP information packet strategy, which are stored in a special packet filtering table. The rules in these tables are grouped into chains, IPtables plays a control role, and the rules can be added, deleted, modified and interacted by users. While Netfilter works in the Linux kernel space (kernel space), which is composed of packet filtering tables (HOOK points), and rules are inserted at the corresponding HOOK points, so that logical control can be realized at each link of packet filtering.

[0004] In environments requiring network hiding functions such as software-defined boundaries, the data flow at the network boundary has the characteristics of large flow and high concurrency, and the processing of the server on the data flow needs to be verified, which further reduces the processing speed. In network usage scenarios such as software-defined boundaries, the data packet receiving process of the traditional firewall is vulnerable to security problems such as information sniffing and port attacks, in addition, the rule operation based on the chain data structure in IPtables will cause the system to malfunction due to the low efficiency of rule operation under the above large flow and high concurrency data.

[0005] In order to meet the needs of efficient operation of data under a large amount of data, many improvements to the data structure have been proposed, such as the traditional Bloom filter, which designs a binary vector as a storage container and a series of random mapping functions. When adding data, the data is mapped according to the above series of random mapping functions, and when querying data, the data is mapped and each bit of the above binary vector is queried. If the above mapping does not hit all, it is judged that the data does not exist.

[0006] Currently, the application scenarios of Bloom filter mainly use its advantages of fast duplication judgment, efficient deduplication and low memory occupation to improve system performance and security. For example, servers use Bloom filter-based cache to avoid direct request storage in the database, which can quickly query whether the request is legal, and allow the request if it is legal, and prohibit access if it is not legal, thereby avoiding the situation that the overall business is affected by the low efficiency of database management operations. In big data analysis and database systems, Bloom filter is used to quickly determine whether the data already exists, reduce repeated insertion and update operations, and improve system performance.

[0007] The patent with publication (announcement) number CN104601557A, "Malicious website protection method and system based on software-defined network", can detect whether the domain name information of DNS request data exists in the Bloom filter generated by the white list and the black list. For suspicious DNS request data, the hostname is extracted to determine whether the hostname is trustworthy. However, the goal of this invention is to determine whether the host is trustworthy, and the use of Bloom filter optimizes the hostname query efficiency process, but does not really improve the performance of firewall traffic rule management.

[0008] The patent with publication (announcement) number CN101567815, "Effective detection and resistance method for domain name server DNS amplification attack", uses an algorithm based on Bloom filter to record the four-tuple information of DNS request packets, including source IP, destination IP, source port, and DNS ID, and uses it to determine whether the DNS response packet is an attack packet. However, the goal of this invention is to use Bloom filter to quickly check the contents of the DNS request packet. When in a high-traffic, high-concurrency network environment, as the number of data packets rises, this invention only optimizes the data packet checking process, but does not optimize the firewall traffic rule management part.

[0009] The patent with publication (announcement) number CN111404916, "System and method for active defense against network attacks", provides a method for active defense against network attacks, which uses specific message communication between the client installed on the user's computer and the server for double-end authentication. When the user's computer is attacked by a network attack, the user's computer is notified, and the system firewall is used to block the attacked port to achieve the effect of active defense. However, the goal of this invention is to block the attacked port through an information notification behavior. In the face of attacks such as DDoS, the information notification process is difficult to implement and lacks sufficient security. Moreover, the method of blocking port information affects normal business operations to some extent, and can only be applied to certain specific service environments, lacking sufficient applicability.

[0010] The above patent is essentially a message judgment using the search operation of the Bloom filter, and does not involve the addition and deletion of data, cannot meet the requirements of the data structure of the firewall rule storage, and does not have the function of expanding the capacity to ensure the reliability of the query operation according to the feedback of the false positive rate in the set in real time. The prior art has the following problems: (1) poor security performance, no port security optimization suitable for network hiding, and unable to effectively cope with diverse network attacks; (2) low rule processing efficiency, no efficient system for managing firewall rules in a network hiding environment; (3) lack of applicability, the optimized firewall has no parallel working feature with the traditional firewall, and is only suitable for a specific field. SUMMARY

[0011] To solve the above problems, the application discloses a network hiding-oriented firewall design method and system. Under the premise of ensuring the equivalent function of Netfilter / IPtables implementation, a security-enhancing algorithm is added to the communication port in the network hiding environment, the data structure of rule management is improved, the efficiency of firewall rule operation is improved, and the robustness of the system is improved.

[0012] To solve the above problems, the application discloses a network hiding-oriented firewall design method and system. Under the premise of ensuring the equivalent function of Netfilter / IPtables implementation, a security-enhancing algorithm is added to the communication port in the network hiding environment, the data structure of rule management is improved, the efficiency of firewall rule operation is improved, and the robustness of the system is improved.

[0013] Specifically, a network hiding-oriented firewall design system comprises:

[0014] A registration center, a trusted third-party host, before the system starts running, the registration center sends information required in the subsequent process to the client and the server;

[0015] A client, a communication host used by a user in the system, can send a request message to the server to apply for the qualification of communication with the server;

[0016] A server, a host that authenticates the request message sent by the client in the system and decides whether to provide further communication services to the client according to the result.

[0017] The client internally comprises the port negotiation algorithm, the server internally comprises the firewall and the port negotiation algorithm, and the firewall internally comprises the rule registration module and the expandable counting Bloom filter.

[0018] The port negotiation algorithm is used in the client and the server, and uses a static fixed password and dynamic time synchronization information to generate a password and select a communication port according to the password.

[0019] The scalable counting Bloom filter is located in the firewall of the server, and is a storage medium for improving the rule management performance.

[0020] The rule registration module is located in the firewall of the server, and is used to control the communication rules of the kernel firewall to control the communication between the server and the outside world.

[0021] A firewall design method for network hiding, the specific steps are as follows:

[0022] S1, network environment deployment: deploy the registration center, and perform identity authentication, element notification, and time synchronization on the client and the server, and other preprocessing;

[0023] S2, server deployment: deploy the scalable counting Bloom filter and the rule registration module to the firewall of the server;

[0024] S3, construct and send traffic: the client generates a sending port through the time synchronization information provided by the registration center and the port negotiation algorithm, and sends a large amount of data packets to the specified port of the server;

[0025] S4, server sniffing process: the server continuously uses the port negotiation algorithm to continuously sniff the specified port, and performs port discrimination on the data packets sent, and if the data packets are not sent to the specified port, the data packets are discarded by default, and the sniffing process is continued;

[0026] S5, server rule processing and communication process: if the server successfully receives the data packets, a rule is established and stored in the scalable counting Bloom filter, communication with the client is established according to the data packet content and the source IP address, and after the establishment is successful, the rule registration module is used to delete the rule for connecting the client in the kernel firewall, if the client actively disconnects, the corresponding rule in the scalable counting Bloom filter is deleted first, and due to the rule deletion, if the client attempts to continue to communicate with the server, step S4 needs to be returned, if the client sends a second communication request to the server during the communication, the scalable counting Bloom filter is queried, and if the rule exists, the request is discarded, in addition, the link lifetime exists in the double-end communication, and the communication link is automatically disconnected after timeout.

[0027] The registration center is a trusted third party, and the function is to pre-allocate authentication information to the client and the server, perform time synchronization, and guide the communication process.

[0028] The client is a communication host used by a user in the system, and can send a request message to the server to apply for a communication qualification with the server;

[0029] The server authenticates the request message sent by the client in the system, and decides whether to provide further communication service to the client according to the result.

[0030] The client internally comprises the port negotiation algorithm, the server internally comprises the firewall and the port negotiation algorithm, and the firewall internally comprises the rule registration module and the scalable counting Bloom filter.

[0031] The port negotiation algorithm uses a static password distributed by the registration center, a dynamic timestamp obtained through time synchronization, and a seed value generated in real time to select one of the ports in the white list of the sending port list as a destination port for data sending, and the server uses the same algorithm to generate a port for sniffing and verifying whether the current data packet is sent to the correct port.

[0032] The rule registration module reads the command written by the user in the terminal command line, filters the source IP address, destination port, and protocol used of the data packet according to a given rule list matching algorithm, converts the filtering rules into codes with corresponding logic, writes the codes into the hook configuration of Netfilter, inserts the function into the corresponding hook point, and forms the control of the firewall rules.

[0033] As a further improvement of the present application, the scalable counting Bloom filter is a binary vector and a series of random mapping functions, and each time a data is inserted, a series of random mapping functions are calculated, and the binary vector is randomly hit multiple times. When querying whether a data is in the Bloom filter, it is determined whether the data is not in the Bloom filter by querying whether the mapped bits of the data hit all at once. Wherein the scalability means that if the false positive rate of the query operation is about to exceed the critical value, a new memory is allocated to expand the capacity. Wherein the counting means that several bits are additionally allocated for each bit of the traditional Bloom filter storage structure to store the hit number. When the increase operation is performed, the hit number is incremented by one. When the delete operation is performed, the hit number at the corresponding position is decremented by one, so as to realize the function of deleting on the Bloom filter. In addition, due to the writing of a large amount of data, the number of bits hit by the data through the mapping function also increases. If the element not in the Bloom filter is judged to exist, a false positive is formed. The false positive rate is the ratio of the number of false positives to the total number of query operations. The false positive rate is negatively correlated with the total capacity of the Bloom filter, and is positively correlated with the number of data stored and the number of mapping functions. When the false positive rate is low enough, it does not affect the normal operation of the business, and is considered reasonable.

[0034] The present application provides a firewall system design based on Bloom filter, and the specific advantages are as follows:

[0035] (1) High data operation efficiency

[0036] Compared with the current data structure of firewall rule management, such as linked list, the time complexity of deletion and query is O(n), wherein n is the number of entries of all data in the linked list. The time complexity of deletion and query of the scalable counting Bloom filter provided by the present application is O(1). Under the operation of a large number of data entries, the operation efficiency of the data structure of the present application has a significant advantage.

[0037] (2) High security performance

[0038] Compared with the current firewall design in the environment requiring network hiding (such as software-defined border), the present application has a port negotiation algorithm, which effectively reduces the attack risks such as flow sniffing and port attack, and the algorithm is lightweight and does not affect the communication process, and has no additional impact on the running performance of the system.

[0039] (3) Only effective for specified services

[0040] The data structure of the application exists separately from IPtables, only interacts with Netfilter in the kernel space, can be used in parallel with IPtables, and thus when some specified services (such as a software-defined border system) need to utilize the characteristics of the application, the specified services can be controlled by using a separate policy, and when conventional services are used, the control right can be returned to a traditional firewall such as IPtables, thereby increasing the flexibility of the system. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 A system structure schematic diagram for the network-hidden firewall designed by the application;

[0042] Figure 2 A system service flow schematic diagram for the application of the embodiment of the application in a software-defined border scenario;

[0043] Figure 3 A query function schematic diagram of the scalable counting Bloom filter of the application;

[0044] Figure 4 A judgment expansion function and increment operation schematic diagram of the scalable counting Bloom filter of the application;

[0045] Figure 5 A deletion function schematic diagram of the scalable counting Bloom filter of the application. DETAILED DESCRIPTION

[0046] The application will be further clarified below in conjunction with the accompanying drawings and specific embodiments, and it should be understood that the following specific embodiments are only used to illustrate the application and not to limit the scope of the application. It should be noted that the words "front", "back", "left", "right", "up" and "down" used in the following description refer to the directions in the drawings, and the words "in" and "out" refer to the directions towards or away from the geometric center of a particular component.

[0047] In the application, the above-mentioned network-hidden firewall design system is used for rule management in a software-defined border application scenario. The main part of the network-hidden firewall design method and system is shown in Figure 1 The main part is mainly divided into a registration center, a client, a server, a scalable counting Bloom filter (SCBF for short, Scalable Counting Bloom Filter)

[0048] The application will be further clarified below in conjunction with the accompanying drawings and specific embodiments, and it should be understood that the following specific embodiments are only used to illustrate the application and not to limit the scope of the application. It should be noted that the words "front", "back", "left", "right", "up" and "down" used in the following description refer to the directions in the drawings, and the words "in" and "out" refer to the directions towards or away from the geometric center of a particular component.

[0049] Embodiment 1

[0050] The application discloses a network hidden-oriented firewall design system which comprises a registration center, a client and a server.

[0051] The registration center is a trusted third-party host, and an administrator performs operations such as deploying a port negotiation algorithm, calibrating time and generating an identity certificate on the registration center before starting system operation. Before the client and the server communicate, the registration center uses TLS (Transport Layer Security) communication to send the client and the server the description of the port negotiation algorithm, a port white list, time synchronization information and a certificate used for identity authentication.

[0052] The client is a communication host used by a user in the system, and after the TLS communication with the registration center, the client can send a request message to the server to apply for the qualification of communication with the server, and the registration center deploys the port negotiation algorithm on the client to construct a request message with a legal destination port.

[0053] The server is a host which authenticates the request message sent by the client and decides whether to provide further communication service according to the result. The registration center deploys the port negotiation algorithm on the server to determine the legality of the destination port of the request message sent by the client, and the server internally has the extensible counting Bloom filter used for storing firewall rules, and the rule registration module is used for controlling the communication process.

[0054] The firewall is located at the boundary part of the server, controls the in-out rules of network flow, and internally deploys the port negotiation algorithm, the extensible counting Bloom filter and the rule registration module.

[0055] The port negotiation algorithm is used in the client and the server, generates a string of passwords using static fixed passwords and dynamic time synchronization information, the password is used as the position information in the port white list obtained by the client and the server from the registration center, and points to a legal port as the destination port of the request message sent by the client to the server.

[0056] The extensible counting Bloom filter is located in the firewall of the server, is an extensible and countable Bloom filter and is used as a storage medium for improving the rule management performance.

[0057] The rule registration module is located in the firewall of the server, controls the code script of the server firewall kernel and is used for controlling the communication rules of the kernel firewall to control the communication between the server and the outside world.

[0058] The system realizes two optimizations according to the above steps, one is that the port negotiation algorithm based on dynamic password is used to optimize the port security in the network hidden environment, and the other is that the extensible counting Bloom filter is used to optimize the rule management performance in the network hidden environment.

[0059] Embodiment 2

[0060] (1) First, the registration center is deployed, and then the registration center and the client and the server are pre-authenticated and informed of the elements and time synchronization and other preprocessing.

[0061] (1.1) Identity authentication and element notification include assigning key pairs, fixed passwords, port white lists and other information to the client and the server.

[0062] (1.2) Time synchronization refers to synchronizing the local time of the client and the server with the registration center to ensure the correctness of the port negotiation algorithm.

[0063] (2) The extensible counting Bloom filter and the rule registration module are deployed to the software-defined border server.

[0064] (3) The client generates a sending port through the time synchronization information provided by the registration center and the port negotiation algorithm, and sends a large amount of data packets to the specified port of the above server.

[0065] (3.1) Algorithm 1 shows the process of the port negotiation algorithm, wherein in the identity authentication and element notification and time synchronization stage of step (1), the registration center sends the fixed password K and the port white list L agreed by each end as the input of the port negotiation algorithm. T0 is a time stamp updated every certain period of time, T1 is a time stamp updated in real time only at runtime, C is the difference between T1 and T0, which is used as a hash algorithm parameter (lines 1-3). An hexadecimal sequence is generated using the HMAC-SHA-1 algorithm and is divided into binary bits, and the divided sequence is converted into decimal and is subjected to modulo operation of 10 Digit power to obtain PWD, which is to convert the hash value into an operable numerical range (lines 4-6). PWD is used as a mapping position to map the corresponding port Port in the port white list as the algorithm return result (lines 7-8).

[0066]

[0067]

[0068] (3.2) The data packet sent by the client has the following encryption method, wherein all the following key pairs are assigned by the registration center when the identity authentication and elements are informed in step (1). The client has an elliptic encryption algorithm (ECC) generated user key pair (PK1, SK1), wherein PK1 is the public key of the client, and SK1 is the key of the client; the server has an elliptic encryption algorithm (ECC) generated server key pair (PK2, SK2), wherein PK2 is the public key of the server, and SK2 is the key of the server; the client generates plaintext data in the format of [(K, client information to be transmitted, sign(K, client information to be transmitted)], wherein PID is a fixed password agreed by the client and the server, sign() is an algorithm for generating a digital signature, K is used as a digital signature generation parameter, and the generated digital signature is denoted as sign(K); wherein the key used to generate the digital signature is the public key SK1 of the client generated in advance; then the client encrypts the plaintext data packet using the public key PK2 of the server, and the generated encrypted data packet is denoted as P.

[0069] (4) The server continues to sniff the specified port using the port negotiation algorithm, and performs port discrimination on the data packet sent, and if the above data packet is not sent to the specified port, the data packet is discarded by default, and the sniffing process continues.

[0070] (5) Algorithm 2 shows the rule management method after successful sniffing. If the above server successfully receives the data packet, the source IP address is obtained by using the server key pair (PK2, SK2) to decrypt the data packet P, and a rule Rule is generated, and a timer T is set for the rule, which is 30 seconds in the experimental example, that is, the timeout limit (lines 1-3). When T is not timed out, it is judged whether the rule exists in the scalable counting Bloom filter (SCBF), if it exists, the rule is directly discarded, the current T is discarded and the loop is jumped out. If there is no rule, it is first judged whether the SCBF needs to be expanded, if it needs to be expanded, the expansion operation is first performed, then Rule is written into SCBF, and Rule is registered into the Linux kernel firewall Netfilter using the Hook function, at this time the server actively opens a bidirectional communication link to the client, and the communication continues until before T is timed out (lines 4-12); in the above case, if T reaches the timeout limit, Rule is removed from Netfilter using the Hook function, the bidirectional communication between the client and the server is disconnected, and Rule is removed from SCBF.

[0071]

[0072]

[0073] (5.1) For the algorithm of the 7th and 14th lines in the kernel space, the working principle is as follows: first, a hook function is inserted in the kernel module before running in the user space. Second, the direction (entering or issuing), protocol (TCP or UDP), IP address (source address and destination address), and port are extracted from the rule. If the rule is added, the command function will release the data packets from or to the IP and port. If the rule is deleted or the rule expires, the command function will prevent the data packets from being sent from or to the IP and port. Finally, according to the direction in the rule, the hook function will select to work on the hook PRE_ROUTING and the hook LOCAL_OUT.

[0074] (5.2) For the query operation of the 5th line in the algorithm 2, as shown in Figure 3 , the rule is first generated by a hash mapping function to correspond to multiple values, corresponding to multiple locations in the storage space (the counting space does not need to be considered in the query). If all the locations corresponding to the generated multiple values are hit in the storage space, theoretically, this rule does not necessarily exist, but the present application sets a very small upper limit of false positive rate (such as 1x10^-6%), and in the system, we consider that this rule exists. If the locations corresponding to the generated multiple values are not all hit in the storage space, then this rule does not exist, and the judgment of whether to need to expand is performed. Among them, the false positive rate means that once false positive occurs every n operations, that is, the rule that does not exist in the filter is also considered to exist, and in the real-time scalable system, since exceeding the upper limit of the false positive rate will expand the memory space, the default is to return all hits, that is, the rule exists. In this embodiment, the entering rule rule is mapped to three bits of the storage space by the hash mapping functions hash1(), hash2(), and hash3(), respectively. After the judgment, if the three bits are not all hit, it is judged that this rule does not exist in the storage space.

[0075] (5.3) For the judgment of whether the storage space needs to be expanded and the increment operation of the 6th line in the algorithm 2, as shown in Figure 4As shown, before the rule insertion, the false positive rate is determined, if the predicted false positive rate is greater than the limit set by the administrator, a storage space is opened and the new memory with all zero count space is inserted.If the false positive rate is not out of bounds, the hash mapping function is inserted in the corresponding position of the storage space, and the insertion operation in the count space becomes the plus one operation.In this embodiment, the query operation part, that is, the false positive rate before the insertion rule is lower than 1x10^-6%, is regarded as no need to expand the memory space.The increase operation part, when the hash mapping function is calculated, after hash1() calculation, the second bit of the storage space is set to 1, and the second column of the count space is changed from 0000 to 0001; after hash2() calculation, the fifth bit of the storage space is set to 1, and the fifth column of the count space is changed from 0000 to 0001; after hash3() calculation, the third bit from the end of the storage space is set to 1, and the third column from the end of the count space is changed from 0000 to 0001.

[0076] (5.4) For the deletion operation of the rule of algorithm 2, line 15, as shown in Figure 5 As shown, in this embodiment, the second column of the count space before deletion is initially 0010, the fifth column is 0001, and the third column from the end is 0001; the rule to be deleted is calculated by the hash mapping function, and each bit of the count space is reduced by one, such as the second column is changed to 0001, the fifth column is changed to 0000, and the third column from the end is changed to 0000; the storage space is judged, if the column in the count space is not all 0, the corresponding position of the storage space is set to 1, if the column in the count space is all 0, the corresponding position of the storage space is set to 0, according to this rule, the storage space corresponding to the second column is finally recorded as 1, and the storage space corresponding to the fifth column and the third column from the end is recorded as 0.

[0077] The present application improves the security of the system by adding the port negotiation algorithm to the port sniffing without affecting the normal operation of the software-defined boundary service; the data structure of the rule management part is improved, the efficiency of the rule operation is increased, and the robustness of the system is improved.

[0078] The technical means disclosed in the scheme of the present application is not limited to the technical means disclosed in the above-mentioned embodiments, and also includes the technical scheme composed of any combination of the above technical features.

Claims

1. A method for designing a network-hidden firewall, characterized by: A firewall system designed for network hiding includes: The registry center is a trusted third-party host. Before the system starts running, the registry center sends the information needed for subsequent processes to the client and server. The client, the communication host used by users in the system, can send request messages to the server to apply for communication rights with the server; On the server side, the system authenticates the request messages sent by the client and determines whether to provide further communication services to the client based on the result. The client-side implementation includes a port negotiation algorithm, while the server-side implementation includes a firewall and a port negotiation algorithm. The firewall contains a rule registration module and a scalable counting Bloom filter. The port negotiation algorithm is used within both the client and server, generating a password using a static fixed password and dynamic time synchronization information, and selecting a communication port based on the password. The scalable counting Bloom filter, located within the server-side firewall, is a storage medium used to improve rule management performance. The rule registration module, also located within the server-side firewall, controls the kernel firewall's communication rules to manage communication between the server and the outside world. The specific steps are as follows: S1, Network Environment Deployment: Deploy the registration center to perform pre-authentication, element notification, and time synchronization preprocessing for the client and server; S2, Server-side deployment: Deploy the scalable counting Bloom filter and rule registration module inside the server-side firewall; S3, Constructing the sending traffic: The client generates a sending port through the time synchronization information provided by the registration center and the port negotiation algorithm, and sends a large amount of data packets to the designated port of the server; S4, Server-side sniffing process: The server continuously sniffs the specified port using the port negotiation algorithm, performs port discrimination on the sent data packets, and discards the data packets by default if the data packets are not sent to the specified port, and continues the sniffing process. S5, Server-side rule processing and communication process: If the server successfully receives the data packet, it establishes a rule and stores it in the scalable counting Bloom filter. It establishes communication with the client based on the data packet content and source IP address. After successful establishment, it uses the rule registration module to delete the rule in the kernel firewall that connects with the client. If the client actively disconnects, it first deletes the corresponding rule in the scalable counting Bloom filter. Due to the rule deletion, if the client tries to continue communicating with the server, it needs to return to step S4. If the client sends a second communication request to the server during the communication process, it queries the scalable counting Bloom filter. If the rule exists, the request is discarded. In addition, there is a link lifespan for two-way communication, and the communication link is automatically disconnected after the timeout.

2. The network-facing hidden firewall design method of claim 1, wherein, The registration center in step S1 is a trusted third party whose function is to pre-assign authentication information to the aforementioned clients and servers, synchronize time, and guide the communication process.

3. The network-facing hidden firewall design method of claim 1, wherein, The Bloom filter in the step S2 is a binary vector and a series of random mapping functions, and each time a data is inserted, a series of random mapping functions are calculated, and the binary vector is hit randomly multiple times.

4. The network-facing, concealment-oriented firewall design method of claim 1, wherein, The rule registration module in the step S2 is to read the command written by a user under a terminal command line, to filter the source IP address, destination port and protocol of a data packet according to a given rule list matching algorithm, to convert the filtering rule into a code with corresponding logic, to write the code into a hook configuration of the Netfilter, and to insert a mapping function into a corresponding hook point to form a control of the firewall rule.

5. The network-facing, concealment-oriented firewall design method of claim 1, wherein, The port negotiation algorithm in the step S3 uses a static password distributed by the registration center and a dynamic timestamp obtained by time synchronization to generate a seed value in real time, selects one port in a white list of a sending port list as a destination port of data sending, and uses the same algorithm to generate a port for sniffing and verifying whether a current data packet is sent to a correct port.

6. The network-facing, concealment-oriented firewall design method of claim 1, wherein, The counting Bloom filter refers to several bits for storing a hit number in addition to each bit of a storage structure of a traditional Bloom filter, and the hit number is increased by one when an increase operation is performed, and the hit number is decreased by one when a deletion operation is performed, so that the function of deleting on the Bloom filter is realized; when the search operation is performed, the hit number is not considered, and the bit is considered as a hit as long as it is hit at least once; when the deletion operation is performed, the deletion number is not considered, and the bit is considered as not filled in as long as the counting bit is zero after the deletion.

7. The network-facing, concealment-oriented firewall design method of claim 1, wherein, The scalable Bloom filter refers to that, compared with the traditional Bloom filter, a new memory is developed to expand the capacity when the false positive rate of the search operation is about to exceed a critical value with the addition of data.

8. The network-facing, concealment-oriented firewall design method of claim 7, wherein: The false positive rate of the search operation is increased due to the writing of a large amount of data, and the number of bits hit by the data through the mapping function is also increased, and the false positive is caused if an element not in the Bloom filter is judged as existing; the false positive rate is a ratio of the false positive number of the search operation to the total number of the search operation, and the false positive rate is negatively correlated with the total capacity of the Bloom filter, and is positively correlated with the number of data stored and the number of mapping functions; when the false positive rate is low enough, the normal operation of the business is not affected, and the false positive rate is considered as reasonable.

Images