Communication method, apparatus and device based on anonymous gateway and medium

Abstract

This invention provides a communication method, apparatus, device, and medium based on a covert gateway, applied to a first covert gateway. The method includes: upon receiving a first initial data packet from a first network device via the intranet interface card (NIC) of the first covert gateway, parsing first information in the first initial data packet; transforming the first information into second information in the first initial data packet based on a pre-set network topology transformation algorithm to obtain a first intermediate data packet; determining a first security parameter entry for transmitting the first intermediate data packet in a pre-set policy entry based on the second information; covertly encapsulating the first intermediate data packet into a first transmission data packet based on the first security parameter entry; and sending the first transmission data packet to a second network device via the extranet interface card of the first covert gateway and a second covert gateway. Compared to VPN gateways in related technologies, the covert gateway provided by this invention effectively improves the security of network communication.

Description

Technical Field

[0001] This invention relates to the field of security gateway technology, and in particular to a communication method, apparatus, device and medium based on a covert gateway. Background Technology

[0002] Virtual Private Network (VPN) technology provides a secure solution for organizations' branches, members, or partners to securely access or interconnect into a virtual intranet for communication over an Internet Protocol (IP) network. The technology primarily employs protocols such as Multi-Protocol Label Switching (MPLS), Secure Sockets Layer (SSL), and Internet Protocol Security (IPsec). Implementation typically requires deploying secure gateway hardware and software devices with VPN functionality at the intranet-to-external network exit point, and may even integrate them with firewalls and routers.

[0003] Currently, network attack techniques are evolving rapidly, and VPN gateways have become a target of intensive attacks and a breakthrough point for VPN penetration. The security of the devices themselves needs to be strengthened. In addition, traffic analysis methods are constantly developing, and the application of encrypted detection and analysis technology is accelerating. The design and implementation of various VPN protocols have not paid attention to countermeasures in this regard, and their security needs to be improved for organizations sensitive to communication behavior. In summary, the security of VPN gateways is currently low. Summary of the Invention

[0004] This invention provides a communication method, apparatus, device, and medium based on a covert gateway to solve the problem of low security in existing VPN gateways.

[0005] This invention provides a communication method based on a stealth gateway, applied to a first stealth gateway. The internal network interface card (NIC) of the first stealth gateway is connected to a first network device for transmitting data with the first network device. The external network interface card (NIC) of the first stealth gateway is used to transmit data with a second network device through a second stealth gateway. The method includes:

[0006] Upon receiving a first initial data packet from the first network device via the intranet network card, the first information in the first initial data packet is parsed.

[0007] Based on a pre-set network topology transformation algorithm, the first information in the first initial data packet is transformed into second information to obtain a first intermediate data packet; wherein, the network topology transformation algorithm includes the correspondence between the first information and the second information;

[0008] Based on the second information, a first security parameter entry for transmitting the first intermediate data packet is determined in a pre-set policy entry;

[0009] Based on the first security parameter table entry, the first intermediate data packet is concealed and encapsulated into a first transmission data packet;

[0010] The first data packet is sent to the second network device via the external network card and the second covert gateway.

[0011] According to a communication method based on a covert gateway provided by the present invention, the method further includes:

[0012] Upon receiving a second transmission data packet from the external network card, the third information in the second transmission data packet is parsed.

[0013] If, based on the third information, it is determined that the third information belongs to a pre-set secure transmission concealment format, then, based on the third information, a second security parameter entry corresponding to the third information is determined in the policy entry;

[0014] Based on the second security parameter table entry, the second transmission data packet is de-anonymized and encapsulated into a second intermediate data packet;

[0015] Based on the network topology transformation algorithm, the third information is inversely transformed into the fourth information in the second intermediate data packet to obtain the second initial data packet; wherein, the network topology transformation algorithm includes the correspondence between the third information and the fourth information;

[0016] The second initial data packet is sent to the first network device.

[0017] According to a communication method based on a covert gateway provided by the present invention, after parsing the third information in the second transmission data packet received from the external network interface card, the method further includes:

[0018] If, based on the third information, it is determined that the third information does not belong to a pre-set secure transmission concealment format, the corresponding processing action is determined in the policy entry based on the third information.

[0019] When the processing action is bypassed, the second transmission data packet is used as the second intermediate data packet;

[0020] If the processing action is to discard, the second transmission data packet is discarded;

[0021] If no processing action is performed corresponding to the third information, the second transmission data packet is discarded.

[0022] According to the communication method based on a covert gateway provided by the present invention, the first covert gateway further includes N heterogeneous data covert encapsulation modules, where N is an integer greater than 1;

[0023] Before determining the first security parameter entry for transmitting the first intermediate data packet in a pre-set policy entry based on the second information, the method further includes:

[0024] Based on a pre-set distribution control strategy, at least one target data concealment and encapsulation module is selected from N heterogeneous data concealment and encapsulation modules;

[0025] The step of determining a first security parameter entry for transmitting the first intermediate data packet from a pre-set policy entry based on the second information includes:

[0026] Based on the second information, in the target policy entry corresponding to the target data concealment and encapsulation module, a target security parameter entry for transmitting the first intermediate data packet is determined as the first security parameter entry.

[0027] According to a communication method based on a covert gateway provided by the present invention, the method further includes:

[0028] Each of the data concealment and encapsulation modules is cleaned and replaced at a pre-set cycle.

[0029] According to a communication method based on a covert gateway provided by the present invention, the step of covertly encapsulating the first intermediate data packet into a first transmission data packet based on the first security parameter table entry includes:

[0030] Based on the first security parameter table entry, a pre-defined segment in the first intermediate data packet is concealed, and the concealed data packet is encapsulated into the first transmission data packet.

[0031] The present invention also provides a communication device based on a covert gateway, applied to a first covert gateway, wherein the internal network interface card of the first covert gateway is connected to a first network device for transmitting data with the first network device, and the external network interface card of the first covert gateway is used for transmitting data with a second network device through a second covert gateway, the device comprising:

[0032] The parsing module is used to parse the first information in the first initial data packet when it receives the first initial data packet from the first network device from the intranet network card;

[0033] A transformation module is used to transform the first information into second information in the first initial data packet based on a pre-set network topology transformation algorithm to obtain a first intermediate data packet; wherein, the network topology transformation algorithm includes the correspondence between the first information and the second information;

[0034] The determining module is configured to determine, based on the second information, a first security parameter entry for transmitting the first intermediate data packet from a pre-set policy entry;

[0035] The concealment encapsulation module is used to conceal and encapsulate the first intermediate data packet into a first transmission data packet based on the first security parameter table entry;

[0036] The sending module is used to send the first transmission data packet to the second network device through the external network card and the second covert gateway.

[0037] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the communication method based on the covert gateway as described above.

[0038] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the communication method based on a covert gateway as described above.

[0039] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the communication method based on a covert gateway as described above.

[0040] The communication method, apparatus, device, and medium based on a covert gateway provided by this invention can receive a first initial data packet from a first network device from the intranet card of a first covert gateway, parse the first information in the first initial data packet, and transform the first information in the first initial data packet into second information based on a network topology transformation algorithm to obtain a first intermediate data packet. Then, based on the second information, a first security parameter entry corresponding to the first intermediate data packet is determined in the policy entry. Based on the first security parameter entry, the first intermediate data packet is covertly encapsulated into a first transmission data packet. The first transmission data packet is then sent to the second network device through the extranet card of the first covert gateway and the second covert gateway to achieve secure communication between the first network device and the second network device. Compared with VPN gateways in related technologies, this invention can effectively improve the security of network communication. In addition, the covert technology of this invention is low in cost and simple to implement. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0042] Figure 1 This is a schematic diagram of the network structure upon which the communication method based on a hidden gateway provided by this invention is based;

[0043] Figure 2 This is one of the flowcharts illustrating the communication method based on a hidden gateway provided by the present invention;

[0044] Figure 3 This is a schematic diagram of the structure of the first covert gateway provided by the present invention;

[0045] Figure 4 This is a schematic diagram of the structure of a virtual private network based on a covert gateway provided by the present invention;

[0046] Figure 5 This is the second flowchart of the communication method based on a hidden gateway provided by the present invention;

[0047] Figure 6 This is a schematic diagram of the structure of the communication device based on a covert gateway provided by the present invention;

[0048] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0050] The following description, in conjunction with the accompanying drawings, describes the communication method, apparatus, device, and medium based on a covert gateway according to the present invention.

[0051] Figure 1 This is a schematic diagram of the network structure upon which the communication method based on the hidden gateway provided by this invention is based, as shown below. Figure 1 As shown, the internal network card of the first covert gateway 100 is connected to the first network device 200 and is used to transmit data with the first network device 200. The external network card of the first covert gateway 100 is used to transmit data with the second network device 400 through the second covert gateway 300.

[0052] Optionally, the internal network card of the second covert gateway 300 is connected to the second network device 400, and the external network card of the second covert gateway 300 is used to transmit data with other network devices;

[0053] It should be noted that the first covert gateway 100 is used to process the data to be transmitted by the first network device 200 to ensure secure communication between the first network device 200 and other network devices; the second covert gateway 300 is used to process the data to be transmitted by the second network device 400 to ensure secure communication between the second network device 400 and other network devices.

[0054] Figure 2 This is one of the flowcharts illustrating the communication method based on a hidden gateway provided by the present invention, such as... Figure 2 As shown, this method can be applied to the first covert gateway 100, and the method includes steps 201 to 205; wherein:

[0055] Step 201: Upon receiving a first initial data packet from the first network device via the intranet network card, parse the first information in the first initial data packet;

[0056] Step 202: Based on a pre-set network topology transformation algorithm, the first information in the first initial data packet is transformed into second information to obtain a first intermediate data packet; wherein, the network topology transformation algorithm includes the correspondence between the first information and the second information;

[0057] Step 203: Based on the second information, determine the first security parameter entry for transmitting the first intermediate data packet in the pre-set policy entries;

[0058] Step 204: Based on the first security parameter table entry, the first intermediate data packet is concealed and encapsulated into a first transmission data packet;

[0059] Step 205: Send the first transmission data packet to the second network device through the external network card and the second covert gateway.

[0060] Specifically, in related technologies, network attack techniques are constantly evolving, and VPN gateways have become a target of intensive attacks and a breakthrough point for VPN penetration, requiring the security of the devices themselves to be strengthened; in addition, traffic analysis methods are constantly developing, and the application of encrypted detection and analysis technology is accelerating, but the design and implementation of various VPN protocols have not paid attention to countermeasures in this regard, and their security needs to be improved for organizations sensitive to communication behavior; in summary, the security of VPN gateways is currently low.

[0061] To address the aforementioned issues, this invention provides a stealthy gateway device and a secure communication method for mimicking secure network data transmission. The internal network interface cards (NICs) of two stealthy gateway devices are connected to the internal network exits of two local area networks (LANs), respectively. External network interface cards (NICs) of the two stealthy gateway devices are then used to securely communicate with the network across external networks, thereby achieving the goal of constructing a single virtual internal network.

[0062] In this embodiment of the invention, the first stealth gateway can receive the first initial data packet from the first network device through the internal network card of the first stealth gateway, and parse the first information in the first initial data packet;

[0063] Optionally, the first information may be, for example, a network information 5-tuple in a first initial data packet. The network information 5-tuple may include, for example, the source IP address, destination IP address, source port, destination port, and communication protocol.

[0064] After parsing the first information, a pre-set network topology transformation algorithm can be used to determine the second information corresponding to the first information, so as to transform the first information into the second information in the first initial data packet and obtain the first intermediate data packet.

[0065] Optionally, a network topology transformation algorithm can be used to transform the network information quintuple in the first initial data packet into a new quintuple, which can then be used as the first intermediate data packet.

[0066] After obtaining the first intermediate data packet, based on the second information, a first security parameter entry for transmitting the first intermediate data packet can be determined in the pre-set policy entries. Based on the first security parameter entry, the first intermediate data packet is concealed and encapsulated into a first transmission data packet. The first transmission data packet is then output through the external network card of the first concealment gateway, so that the first transmission data packet is sent to the second network device through the second concealment gateway.

[0067] It should also be noted that VPN gateways in related technologies require hardware and software support, which need to be purchased and are relatively expensive; while the covert gateway in this embodiment of the invention adopts a software approach, which can replace or be used in conjunction with existing VPN gateways to enhance communication security.

[0068] In the communication method based on a covert gateway provided in this embodiment of the invention, a first initial data packet from a first network device can be received from the intranet card of a first covert gateway. The first information in the first initial data packet is parsed, and the first information in the first initial data packet is transformed into second information based on a network topology transformation algorithm to obtain a first intermediate data packet. Based on the second information, a first security parameter entry corresponding to the first intermediate data packet is determined in the policy entry. Based on the first security parameter entry, the first intermediate data packet is covertly encapsulated into a first transmission data packet. Then, the first transmission data packet is sent to the second network device through the extranet card of the first covert gateway and the second covert gateway to achieve secure communication between the first network device and the second network device. Compared with VPN gateways in related technologies, this method can effectively improve the security of network communication. In addition, the covert technology in this embodiment of the invention is low in cost and simple to implement.

[0069] Optionally, embodiments of the present invention provide a process for a first covert gateway to receive and process transmission data packets, the specific steps of which are as follows:

[0070] The third information in the second transmission data packet can be parsed when the second transmission data packet is received from the external network card;

[0071] If, based on the third information, it is determined that the third information belongs to a pre-set secure transmission concealment format, then, based on the third information, a second security parameter entry corresponding to the third information is determined in the policy entry;

[0072] Based on the second security parameter table entry, the second transmission data packet is de-anonymized and encapsulated into a second intermediate data packet;

[0073] Based on the network topology transformation algorithm, the third information is inversely transformed into the fourth information in the second intermediate data packet to obtain the second initial data packet; wherein, the network topology transformation algorithm includes the correspondence between the third information and the fourth information;

[0074] The second initial data packet is sent to the first network device.

[0075] Specifically, when the first covert gateway receives the second transmission data packet from its external network card, it first parses the third information in the second transmission data packet to determine whether the third information belongs to a pre-set secure transmission covert format. This can be understood as determining whether the received second transmission data packet is a transmission data packet sent by the pre-set second network device that conforms to the common negotiation format. If so, further processing can be performed.

[0076] Specifically, if it is determined that the third information belongs to a pre-set secure transmission concealment format, a second security parameter entry corresponding to the third information can be determined in the policy entry based on the third information. Based on the second security parameter entry, the second transmission data packet is de-concealed and encapsulated into a second intermediate data packet. Then, based on the network topology transformation algorithm, specifically based on the correspondence between the third and fourth information in the network topology transformation algorithm, the third information is inversely transformed into the fourth information in the second intermediate data packet to obtain the second initial data packet. The second initial data packet is then sent to the first network device, which can ensure the security of the received initial data packet.

[0077] Optionally, when receiving a second transmission data packet from the external network card, after parsing the third information in the second transmission data packet, if it is determined based on the third information that the third information does not belong to a pre-set secure transmission concealment format, the corresponding processing action can be determined in the policy entry based on the third information.

[0078] When the processing action is bypassed, the second transmission data packet is used as the second intermediate data packet;

[0079] If the processing action is to discard, the second transmission data packet is discarded;

[0080] If no processing action is performed corresponding to the third information, the second transmission data packet is discarded.

[0081] Specifically, after parsing the third information in the second transmission data packet, if it is determined based on the third information that the third information does not belong to the pre-set secure transmission concealment format, then the corresponding processing action can be determined in the policy entry based on the third information to execute the corresponding processing action.

[0082] Specifically, it can be divided into the following three situations:

[0083] 1) When the processing action is bypassed, the second transmission data packet can be used as the second intermediate data packet; that is, the second transmission data packet is not de-encapsulated and is directly used as the second intermediate data packet for subsequent inverse transformation.

[0084] 2) If the processing action is to discard, the second transmitted data packet can be discarded;

[0085] 3) If there is no corresponding processing action for the third information, the second transmission data packet can be discarded.

[0086] Optionally, the first covert gateway may further include N heterogeneous data covert encapsulation modules, where N is an integer greater than 1;

[0087] Before determining the first security parameter entry for transmitting the first intermediate data packet in the pre-set policy entries based on the second information, at least one target data concealment and encapsulation module can be selected from N heterogeneous data concealment and encapsulation modules based on the pre-set distribution control policy.

[0088] The implementation method of determining the first security parameter entry for transmitting the first intermediate data packet in the pre-set policy entries based on the second information may include:

[0089] Based on the second information, in the target policy entry corresponding to the target data concealment and encapsulation module, a target security parameter entry for transmitting the first intermediate data packet is determined as the first security parameter entry.

[0090] Specifically, in addition to internal network cards and external network cards, the first covert gateway may also include N heterogeneous data covert encapsulation modules, where N is an integer greater than 1.

[0091] Optionally, the N heterogeneous data concealment and encapsulation modules may have the same function but different components. The specific data concealment and encapsulation modules may be implemented using container technology, and the policy entries and security parameter entries configured for each data concealment and encapsulation module may be different.

[0092] Before performing covert encapsulation on the first intermediate data packet, at least one target data covert encapsulation module can be selected from N heterogeneous data covert encapsulation modules based on a pre-set distribution control strategy. The first intermediate data packet can be distributed to the target data covert encapsulation module for covert encapsulation. Specifically, based on the second information, a target security parameter entry for transmitting the first intermediate data packet can be determined in the target policy entry corresponding to the target data covert encapsulation module as the first security parameter entry. The first intermediate data packet can then be covertly encapsulated based on the first security parameter entry.

[0093] Optionally, each of the data concealment and encapsulation modules can be cleaned and replaced at a pre-set cycle.

[0094] Specifically, periodically replacing the currently running N heterogeneous data concealment and encapsulation modules can reduce the occurrence of communication insecurity caused by attacks on the data concealment and encapsulation modules, effectively improving the communication security of the first network device.

[0095] Optionally, the implementation method of concealing and encapsulating the first intermediate data packet into a first transmission data packet based on the first security parameter table entry may include:

[0096] Based on the first security parameter table entry, a pre-defined segment in the first intermediate data packet is concealed, and the concealed data packet is encapsulated into the first transmission data packet.

[0097] Specifically, the concealment and encapsulation process for the first intermediate data packet is divided into concealment and encapsulation steps. First, based on the first security parameter table entry, the pre-set specified segments in the first intermediate data packet are concealed. Then, the concealed data packet is encapsulated into a first transmission data packet for output through the external network card of the first concealment gateway.

[0098] Alternatively, the above-mentioned concealment process may include, for example, using Network Address Translation (NAT) of a firewall to conceal IP addresses.

[0099] The following example illustrates the communication method based on a hidden gateway provided in the embodiments of the present invention.

[0100] I. A communication method based on hidden gateways: Specifically, the internal network cards of two hidden gateways are connected to the internal network exits of two local area networks respectively. The external network cards of the two hidden gateways are used to communicate securely through the external network, thereby building a single virtual internal network.

[0101] The first stealth gateway provided in this embodiment of the invention uses a network data stealth encapsulation module to ensure that the internal network hosts of two local area networks can securely transmit network data through the external network. It uses mimicry technology to achieve heterogeneity of the network data stealth encapsulation module and periodically switches and automatically cleans these heterogeneous modules to strengthen the security of the device itself.

[0102] Figure 3 This is a schematic diagram of the structure of the first covert gateway provided by the present invention, as shown below. Figure 3 As shown, the first covert gateway includes: an internal network card, an external network card, a network topology information covert module, a network data covert encapsulation module, a mimicry module, a storage module, a control module, and a management configuration interface.

[0103] 1. Internal network card

[0104] The intranet network card is connected to the network topology information concealment module, and is responsible for receiving data packets from the intranet and transmitting them to the network topology information concealment module, or sending data packets from the network topology information concealment module to the intranet; the intranet network card is also connected to the control module to receive parameter settings for its network card details.

[0105] 2. Network topology information concealment module

[0106] The network topology information concealment module connects the internal network card and the network data concealment and encapsulation module;

[0107] One of its functions is to query the connection tracking table entries, transform and replace the network information fields in the data packets from the intranet with redundant network information from each internal network to conceal the network topology. If no transformation is found, a connection tracking table entry with complete transformation information is added, and the new data packet is sent to the network data concealment and encapsulation module.

[0108] The second function is to query the connection tracking table entries, reverse transform and replace the network information field in the data packet from the network data concealment and encapsulation module with the network information of the internal network, and then transmit the new data packet to the internal network card;

[0109] The network topology information concealment module is also connected to the mimicry module to set the above transformation method and maintain connection tracking entries.

[0110] 3. Network data concealment and encapsulation module

[0111] The network data concealment and encapsulation module connects the network topology information concealment module and the external network interface card;

[0112] One of its functions is to analyze data packets from the network topology information concealment module, extract appropriate information, and query the policy table entry to which the module belongs based on the information to determine whether concealment and encapsulation are required. If so, it continues to query the security parameter table entry to which the module belongs to determine the specific concealment method, and performs concealment processing on the specified segments of the data packet according to the concealment method found. After re-encapsulating the data packet according to the encapsulation method found, it transmits it to the external network card.

[0113] The second function is to analyze data packets from external network cards to extract appropriate information. If the packet is not a hidden packet, it is discarded. Otherwise, based on the extracted information, the security parameter table of the module is queried to determine the specific hiding method. Based on the hidden method found, the specified segments of the data packet are de-hidden. Then, the policy table of the module is queried to determine whether hiding and encapsulation are required. If so, the data packet is decapsulated and then sent to the network topology information hiding module. Otherwise, the data packet is discarded.

[0114] The network data concealment and encapsulation module is also connected to the mimicry module, so that the mimicry module can determine the working status, policy entries, and security parameter entries of the network data concealment and encapsulation module.

[0115] 4. External network card

[0116] The external network card connects to the network data concealment and encapsulation module, and is responsible for receiving data packets from the external network and transmitting them to the network data concealment and encapsulation module, or sending data packets from the network data concealment and encapsulation module to the external network; the external network card also connects to the control module to set its network card details.

[0117] 5. Mimicry Module

[0118] The mimicry module connects the network topology information concealment module, the network data concealment and encapsulation module, the storage module, and the control module;

[0119] One of its functions is to configure the specific transformation methods and connection tracking table parameters of the network topology information concealment module;

[0120] The second function is to retrieve a number of heterogeneous network data concealment and encapsulation modules currently running on the device from the storage module based on the configuration information from the control module, and configure the policy entries and security parameter entries of each network data concealment and encapsulation module.

[0121] The third function is to select a specific network data concealment and encapsulation module for data packets based on the data distribution control function;

[0122] The fourth function is to periodically replace the heterogeneous network data concealment and encapsulation modules currently running on the device based on the configuration information from the parameter configuration module.

[0123] 6. Storage module

[0124] The storage module connects the mimicry module and the control module. It stores the heterogeneous sources of network data hidden by the mimicry module and maintains these heterogeneous sources by adding, deleting, updating and maintaining them through the control module. It also saves all configuration information of the control module.

[0125] 7. Control Module

[0126] The control module connects to the internal network interface card (NIC), external network interface card (NIC), mimicry module, storage module, and management configuration interface. It receives configuration information from external management clients and performs maintenance operations through the management interface. It sets detailed NIC information for both the internal and external NICs; adds, deletes, updates, and maintains heterogeneous data hiding and encapsulation modules in the storage module; sets specific transformation methods and connection tracking table parameters for the network topology information hiding module in the mimicry module; sets policy tables, security parameters, and periodic operation parameters for each network topology information hiding module in the mimicry module; saves all the above information, tables, and parameters in the storage module; and periodically queries the status information of each component and saves it to the log module.

[0127] 8. Management Interface

[0128] The management interface connects to the control module; after the device is started for the first time, it is configured to run through the control module. When the device is started again, it will retrieve various information, entries, parameters and data from the storage module and automatically configure and run the device by hiding and encapsulating the heterogeneous source of the data. It can also be reconfigured and run through the management interface.

[0129] 9. Log module

[0130] The log module connects to the control module and is responsible for querying, displaying, exporting, and deleting logs. The device also stores configurations including routing table entries, ARP (Address Resolution Protocol) entries, and several pre-built heterogeneous sources of network data concealment and encapsulation modules.

[0131] Figure 4 This is a schematic diagram of the structure of a virtual private network based on a covert gateway provided by the present invention, as shown below. Figure 4 As shown, a virtual private network (VPN) based on a covert gateway includes: a local area network (LAN1), a first covert gateway (GW1), a host (HOST1), a local area network (LAN2), a second covert gateway (GW2), and a host (HOST2). When LAN1, composed of hosts or servers such as HOST1, and LAN2, composed of hosts or servers such as HOST2, need to build a VPN via an external network, the specific steps include three parts: connecting the covert gateway, configuring the covert gateway, and secure communication.

[0132] (a) Connecting to the Hidden Gateway

[0133] L1. Determine the local area network pairs to be interconnected.<LAN1,LAN2> ;

[0134] L2. Connect the LAN1 external network egress network card to the hidden gateway GW1 internal network card, and connect the GW1 external network card to the original LAN1 external network egress device.

[0135] L3. Connect the LAN2 external network exit network card to the hidden gateway GW2's internal network card, and connect the GW2 external network card to the original LAN2 external network exit device.

[0136] (II) Configuring a Hidden Gateway

[0137] S1. Start the stealth gateway, connect to the management interface and log in to the management client;

[0138] S2. Configure the internal IP address and gateway of the intranet network card, and other detailed network card information;

[0139] S3. Configure the external IP address and gateway of the external network card, and other detailed network card information;

[0140] S4. Configure a redundant internal IP address range that is different from all other internal LAN IP address ranges;

[0141] S5. Set the network topology transformation algorithm;

[0142] S6. Set the number of heterogeneous network data concealment and encapsulation modules to run and the switching cycle;

[0143] S7. Configure the remote hidden gateway IP address and the IP address range within the remote LAN segment; configure policy entries; configure security parameter entries.

[0144] S8. Confirm and save the configuration; confirm and run according to the new configuration;

[0145] S9, Optional configuration: add, delete, and update heterogeneous sources for data hiding and encapsulation modules; the default configuration is a pre-built heterogeneous source for data hiding and encapsulation modules.

[0146] Specifically, for the local area networks to be interconnected<LAN1,LAN2> Both GW1 and GW2 must be configured using the same method as the hidden gateway configuration. "Local" and "remote" are relative terms. When configuring GW1, the local LAN refers to LAN1, the local hidden gateway refers to GW1, and the local host refers to HOST1, etc.; its remote LAN refers to LAN2, the remote hidden gateway refers to GW2, and the remote host refers to HOST2, etc. When configuring GW2, the local LAN refers to LAN2, the local hidden gateway refers to GW2, and the local host refers to HOST2, etc.; its remote LAN refers to LAN1, the remote hidden gateway refers to GW1, and the remote host refers to HOST1, etc.

[0147] Optionally, in S4, "all internal LANs" may include LAN1 and LAN2 as well as other internal LANs interconnected with them, and in S7, the policy entries and security parameter entries are set to be compatible with the settings of GW1 and GW2.

[0148] Local area network to<LAN1,LAN2> After LAN1 and LAN2 are connected and a hidden gateway is configured, any host or server HOST1 in LAN1 can begin bidirectional secure communication with any host or server HOST2 in LAN2.

[0149] (3) Secure communication

[0150] C1, the hidden gateway GW1 negotiates specific security parameters with GW2 and stores them in the storage module, establishing several secure communication connection tunnels;

[0151] C2. Any host or server HOST1 in LAN1 and any host or server HOST2 in LAN2 can conduct bidirectional secure communication. The steps are described as Cij-sequence number; the steps of HOSTi sending packets / HOSTj receiving packets are Cij-sequence number, and the steps of HOSTj sending packets / HOSTi receiving packets are Cji-sequence number.

[0152] Cij, host or server HOSTi sends a packet Packet_raw to host or server HOSTj based on the internal IP address. The packet is routed through the covert gateway GWi to the covert gateway GWj and then arrives at HOSTj.

[0153] Cij-1 and the internal network card of the hidden gateway GW1 receive the data packet Packet_raw and pass it to the network topology information hiding module.

[0154] Cij-2, the network topology information hiding module parses the network information quintuple of Packet_raw, transforms the quintuple into a new quintuple according to the network topology transformation algorithm, replaces the Packet_raw quintuple with it to form the intermediate result data packet Packet_mid, and sends it to a specific module in several heterogeneous network data hiding and encapsulation modules that are currently running according to the new quintuple.

[0155] Cij-3, a specific network data concealment and encapsulation module, parses the packet_mid 5-tuple of the data packet, and queries the policy table entry of the module according to the 5-tuple to give the corresponding processing action;

[0156] Cij-4. If the aforementioned processing action is secure transmission, query the security parameter table entry according to the corresponding index in the policy table entry to determine the specific parameters of this secure transmission, and based on the specific parameters, encapsulate Packet_mid into a new data packet Packet_new and then transmit it to the external network card.

[0157] Cij-5: After receiving Packet_new, the external network card sends it to the external network.

[0158] Cij-6 and the external network card of the hidden gateway GW2 receive the data packet Packet_new routed to this device and pass it to the network data hiding and encapsulation module;

[0159] Cij-7: The network data concealment and encapsulation module parses the network information 5-tuple from the packet Packet_new. If it is not a secure transmission concealment encapsulation format, it queries the policy table of this module according to the 5-tuple to determine its two processing actions: bypass or discard. If no processing action is found, it is determined to be discarded. If the processing action is bypass, the packet Packet_new is passed to the network topology information concealment module. If the processing action is discard, the packet is discarded.

[0160] Cij-8. If the data packet is in a secure transmission concealed encapsulation format, query the security parameter table of this module by the specific index field of the 5-tuple. If a specific security parameter is found, de-encapsulate the data packet according to the parameter and extract a new network information 5-tuple. Then query the policy table of this module by the 5-tuple. If the query result is concealed encapsulation and the field verification is successful, decapsulate the data packet Packet_mid and pass it to the network topology information concealment module. Otherwise, discard the data packet. If no specific security parameter is found, discard the data packet.

[0161] Cij-9, the network topology information hiding module parses the network information five-tuple of the data packet Packet_mid, transforms the five-tuple according to the transformation algorithm, and replaces it to form the final data packet Packet_raw, which is then transmitted to the internal network card.

[0162] Cij-10, the internal network card sends the packet_raw data packet to the internal LAN routing device.

[0163] It should be noted that the above method also includes a renegotiation step for C1. This step is related to limiting parameters such as the time, data volume, sequence number, or specific window of the security parameter table entries. When these parameters exceed a certain threshold during communication, renegotiation is triggered.

[0164] Second, the first concealment gateway for the mimicry system specifically uses a dual-NIC host with CentOS 7 and Docker software installed; the network topology information concealment module uses the NAT (Network Address Translation) module of iptables, and the network topology transformation algorithm is the algorithm implemented by NAT itself; the mimicry module uses various open-source IPsec software and various Linux operating systems as mimicry resource elements, and combines them into various Docker container images as heterogeneous sources for the network data concealment encapsulation module, and saves them in the local Docker library as the storage module; the control module can manually configure the net2net scenario configuration files of various open-source IPsec.

[0165] Figure 5 This is the second flowchart illustrating the communication method based on a hidden gateway provided by the present invention, as shown below. Figure 5As shown, when the mimicry and concealment gateway is running, the internal network card IP address is set to the local area network gateway address, and the external network card IP address is set to the local area network's outbound internet IP address; the local area network segment is randomly translated to several redundant private addresses through iptables NAT source addresses; Docker is entered, and several HOST mode containers are created by pulling different images from the local Docker library; the remote area network private address segment is divided into a set of communication address pairs equal to the number of containers according to the redundant private addresses, each set matches one container, the IPsec software in the container is configured to net2net scenario mode according to the set, and each configuration file is saved; the IPsec software in each container is started.

[0166] Mimicking and concealing gateway switching can be implemented using a scheduled service script; when a container's runtime cycle is reached, a new container running the net2net scenario mode IPsec service is automatically created according to the configuration file saved in that container, the new container is run, and the replaced container is stopped and deleted.

[0167] The embodiments of the present invention can ensure the communication security of virtual private network traffic when traversing untrusted networks, effectively prevent external network side from detecting and analyzing data flow between internal networks in plain / ciphertext form, and strengthen the security of the gateway device itself.

[0168] The communication device based on a covert gateway provided by the present invention will be described below. The communication device based on a covert gateway described below and the communication method based on a covert gateway described above can be referred to and correspond to each other.

[0169] The communication device based on a stealth gateway according to the present invention can be applied to a first stealth gateway. The internal network card of the first stealth gateway is connected to a first network device for transmitting data with the first network device. The external network card of the first stealth gateway is used to transmit data with a second network device through a second stealth gateway.

[0170] Figure 6 This is a schematic diagram of the communication device based on a covert gateway provided by the present invention, as shown below. Figure 6 As shown, the communication device 600 based on a covert gateway includes:

[0171] The parsing module 601 is used to parse the first information in the first initial data packet when it receives the first initial data packet from the first network device from the intranet network card;

[0172] The transformation module 602 is used to transform the first information into second information in the first initial data packet based on a pre-set network topology transformation algorithm to obtain a first intermediate data packet; wherein, the network topology transformation algorithm includes the correspondence between the first information and the second information;

[0173] The determining module 603 is configured to determine, based on the second information, a first security parameter entry for transmitting the first intermediate data packet from a pre-set policy entry;

[0174] The concealment and encapsulation module 604 is used to conceal and encapsulate the first intermediate data packet into a first transmission data packet based on the first security parameter table entry;

[0175] The sending module 605 is used to send the first transmission data packet to the second network device through the external network card and the second covert gateway.

[0176] In the communication device based on a covert gateway provided in this embodiment of the invention, the parsing module can receive a first initial data packet from the first network device from the intranet card of the first covert gateway, and parse the first information in the first initial data packet. The transformation module transforms the first information in the first initial data packet into second information based on a network topology transformation algorithm to obtain a first intermediate data packet. Then, the determination module determines the first security parameter entry corresponding to the first intermediate data packet in the policy entry based on the second information. The covert encapsulation module then covertly encapsulates the first intermediate data packet into a first transmission data packet based on the first security parameter entry. Finally, the sending module sends the first transmission data packet to the second network device through the extranet card of the first covert gateway and the second covert gateway to achieve secure communication between the first network device and the second network device. Compared with VPN gateways in related technologies, this can effectively improve the security of network communication. In addition, the covert technology of this embodiment of the invention is low in cost and simple to implement.

[0177] Optionally, the communication device 600 based on the covert gateway further includes a processing module for:

[0178] Upon receiving a second transmission data packet from the external network card, the third information in the second transmission data packet is parsed.

[0179] If, based on the third information, it is determined that the third information belongs to a pre-set secure transmission concealment format, then, based on the third information, a second security parameter entry corresponding to the third information is determined in the policy entry;

[0180] Based on the second security parameter table entry, the second transmission data packet is de-anonymized and encapsulated into a second intermediate data packet;

[0181] Based on the network topology transformation algorithm, the third information is inversely transformed into the fourth information in the second intermediate data packet to obtain the second initial data packet; wherein, the network topology transformation algorithm includes the correspondence between the third information and the fourth information;

[0182] The second initial data packet is sent to the first network device.

[0183] Optionally, the processing module is also used for:

[0184] If, based on the third information, it is determined that the third information does not belong to a pre-set secure transmission concealment format, the corresponding processing action is determined in the policy entry based on the third information.

[0185] When the processing action is bypassed, the second transmission data packet is used as the second intermediate data packet;

[0186] If the processing action is to discard, the second transmission data packet is discarded;

[0187] If no processing action is performed corresponding to the third information, the second transmission data packet is discarded.

[0188] Optionally, the first concealment gateway further includes N heterogeneous data concealment encapsulation modules, where N is an integer greater than 1;

[0189] The processing module is also used to: select at least one target data concealment and encapsulation module from among N heterogeneous data concealment and encapsulation modules based on a pre-set distribution control strategy;

[0190] The determining module 603 is specifically used to: based on the second information, determine a target security parameter entry for transmitting the first intermediate data packet in the target policy entry corresponding to the target data concealment and encapsulation module, and use it as the first security parameter entry.

[0191] Optionally, the processing module is also used to: clean and replace each of the data concealment and encapsulation modules at a pre-set cycle.

[0192] Optionally, the concealment and encapsulation module 604 is specifically used to: based on the first security parameter table entry, perform concealment processing on a pre-set specified segment in the first intermediate data packet, and encapsulate the concealed data packet into the first transmission data packet.

[0193] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 7As shown, the electronic device 700 may include: a processor 710, a communication interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 communicate with each other through the communication bus 740. The processor 710 can call logical instructions in the memory 730 to execute a communication method based on a covert gateway, applied to a first covert gateway. The intranet card of the first covert gateway is connected to a first network device for transmitting data with the first network device. The extranet card of the first covert gateway is used to transmit data with a second network device through a second covert gateway. The method includes:

[0194] Upon receiving a first initial data packet from the first network device via the intranet network card, the first information in the first initial data packet is parsed.

[0195] Based on a pre-set network topology transformation algorithm, the first information in the first initial data packet is transformed into second information to obtain a first intermediate data packet; wherein, the network topology transformation algorithm includes the correspondence between the first information and the second information;

[0196] Based on the second information, a first security parameter entry for transmitting the first intermediate data packet is determined in a pre-set policy entry;

[0197] Based on the first security parameter table entry, the first intermediate data packet is concealed and encapsulated into a first transmission data packet;

[0198] The first data packet is sent to the second network device via the external network card and the second covert gateway.

[0199] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0200] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the communication method based on the covert gateway provided by the above methods, applied to a first covert gateway. The internal network card of the first covert gateway is connected to a first network device for transmitting data with the first network device. The external network card of the first covert gateway is used for transmitting data with a second network device through a second covert gateway. The method includes:

[0201] Upon receiving a first initial data packet from the first network device via the intranet network card, the first information in the first initial data packet is parsed.

[0202] Based on a pre-set network topology transformation algorithm, the first information in the first initial data packet is transformed into second information to obtain a first intermediate data packet; wherein, the network topology transformation algorithm includes the correspondence between the first information and the second information;

[0203] Based on the second information, a first security parameter entry for transmitting the first intermediate data packet is determined in a pre-set policy entry;

[0204] Based on the first security parameter table entry, the first intermediate data packet is concealed and encapsulated into a first transmission data packet;

[0205] The first data packet is sent to the second network device via the external network card and the second covert gateway.

[0206] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program is implemented to perform the communication methods based on covert gateways provided by the aforementioned methods. The methods are applied to a first covert gateway, the intranet card of which is connected to a first network device for transmitting data with the first network device. The extranet card of the first covert gateway is used to transmit data with a second network device through a second covert gateway. The method includes:

[0207] Upon receiving a first initial data packet from the first network device via the intranet network card, the first information in the first initial data packet is parsed.

[0208] Based on a pre-set network topology transformation algorithm, the first information in the first initial data packet is transformed into second information to obtain a first intermediate data packet; wherein, the network topology transformation algorithm includes the correspondence between the first information and the second information;

[0209] Based on the second information, a first security parameter entry for transmitting the first intermediate data packet is determined in a pre-set policy entry;

[0210] Based on the first security parameter table entry, the first intermediate data packet is concealed and encapsulated into a first transmission data packet;

[0211] The first data packet is sent to the second network device via the external network card and the second covert gateway.

[0212] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0213] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0214] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A communication method based on a covert gateway, characterized in that, The method is applied to a first covert gateway, wherein the internal network interface card (NIC) of the first covert gateway is connected to a first network device for transmitting data with the first network device, and the external network interface card (NIC) of the first covert gateway is used for transmitting data with a second network device through a second covert gateway. The method includes: Upon receiving a first initial data packet from the first network device via the intranet network card, the first information in the first initial data packet is parsed. Based on a pre-set network topology transformation algorithm, the first information in the first initial data packet is transformed into second information to obtain a first intermediate data packet; wherein, the network topology transformation algorithm includes the correspondence between the first information and the second information; Based on the second information, a first security parameter entry for transmitting the first intermediate data packet is determined in a pre-set policy entry; Based on the first security parameter table entry, the first intermediate data packet is concealed and encapsulated into a first transmission data packet; The first data packet is sent to the second network device via the external network card and the second covert gateway; The first covert gateway also includes N heterogeneous data covert encapsulation modules, where N is an integer greater than 1; Before determining the first security parameter entry for transmitting the first intermediate data packet in a pre-set policy entry based on the second information, the method further includes: Based on a pre-set distribution control strategy, at least one target data concealment and encapsulation module is selected from N heterogeneous data concealment and encapsulation modules; The step of determining a first security parameter entry for transmitting the first intermediate data packet from a pre-set policy entry based on the second information includes: Based on the second information, in the target policy entry corresponding to the target data concealment and encapsulation module, a target security parameter entry for transmitting the first intermediate data packet is determined as the first security parameter entry.

2. The communication method based on a covert gateway according to claim 1, characterized in that, The method further includes: Upon receiving a second transmission data packet from the external network card, the third information in the second transmission data packet is parsed. If, based on the third information, it is determined that the third information belongs to a pre-set secure transmission concealment format, then, based on the third information, a second security parameter entry corresponding to the third information is determined in the policy entry; Based on the second security parameter table entry, the second transmission data packet is de-anonymized and encapsulated into a second intermediate data packet; Based on the network topology transformation algorithm, the third information is inversely transformed into the fourth information in the second intermediate data packet to obtain the second initial data packet; wherein, the network topology transformation algorithm includes the correspondence between the third information and the fourth information; The second initial data packet is sent to the first network device.

3. The communication method based on a covert gateway according to claim 2, characterized in that, After parsing the third information in the second transmission data packet received from the external network card, the method further includes: If, based on the third information, it is determined that the third information does not belong to a pre-set secure transmission concealment format, the corresponding processing action is determined in the policy entry based on the third information. When the processing action is bypassed, the second transmission data packet is used as the second intermediate data packet; If the processing action is to discard, the second transmission data packet is discarded; If no processing action is performed corresponding to the third information, the second transmission data packet is discarded.

4. The communication method based on a covert gateway according to claim 1, characterized in that, The method further includes: Each of the data concealment and encapsulation modules is cleaned and replaced at a pre-set cycle.

5. The communication method based on a covert gateway according to any one of claims 1 to 4, characterized in that, The step of concealing and encapsulating the first intermediate data packet into a first transmission data packet based on the first security parameter table entry includes: Based on the first security parameter table entry, a pre-defined segment in the first intermediate data packet is concealed, and the concealed data packet is encapsulated into the first transmission data packet.

6. A communication device based on a covert gateway, characterized in that, An apparatus is applied to a first covert gateway, wherein the internal network interface card (NIC) of the first covert gateway is connected to a first network device for transmitting data with the first network device, and the external network interface card (NIC) of the first covert gateway is used for transmitting data with a second network device through a second covert gateway. The apparatus includes: The parsing module is used to parse the first information in the first initial data packet when it receives the first initial data packet from the first network device from the intranet network card; A transformation module is used to transform the first information into second information in the first initial data packet based on a pre-set network topology transformation algorithm to obtain a first intermediate data packet; wherein, the network topology transformation algorithm includes the correspondence between the first information and the second information; The determining module is configured to determine, based on the second information, a first security parameter entry for transmitting the first intermediate data packet from a pre-set policy entry; The concealment encapsulation module is used to conceal and encapsulate the first intermediate data packet into a first transmission data packet based on the first security parameter table entry; The sending module is used to send the first transmission data packet to the second network device through the external network card and the second covert gateway; The first covert gateway also includes N heterogeneous data covert encapsulation modules, where N is an integer greater than 1; The processing module is used to: select at least one target data concealment and encapsulation module from N heterogeneous data concealment and encapsulation modules based on a pre-set distribution control strategy; The determining module is specifically used to: based on the second information, determine a target security parameter entry for transmitting the first intermediate data packet in the target policy entry corresponding to the target data concealment and encapsulation module, and use it as the first security parameter entry.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the communication method based on a covert gateway as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the communication method based on a covert gateway as described in any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the communication method based on a covert gateway as described in any one of claims 1 to 5.

Images