A network range scene isolation access method and system based on dynamic domain name

Abstract

The present invention discloses a method and system for isolating and accessing a network range scenario based on a dynamic domain name. When a user requests to open a range scenario or view a target machine address interface in a scenario through a browser, the method records the user's request address. When the range scenario is started, a globally unique string is dynamically generated for the target machine accessed in the scenario and used as a third-level or higher domain name in the target machine access domain name address. The corresponding relationship between the domain name and the target machine's real address is also recorded. When a user requests to access the target machine through a domain name address, an address consistency check is performed. After the check passes, the target machine's real address is obtained and reverse proxy is performed. The present invention does not require the use of a dedicated client or the occupation of a public network IP address, and has the advantages of simple configuration, easy scalability, support for high concurrency, low operation and maintenance costs, and high security.

Description

Technical Field

[0001] The present invention relates to a network range scene isolation access method and system based on dynamic domain names, belonging to the technical field of network security. Background Art

[0002] A cyber range uses virtualization technology to simulate a realistic cyberspace attack and defense environment, serving as a test platform for combat capability research and weapon equipment verification. To achieve these goals, during actual training or verification, it's necessary to provide isolated environments for different scenarios and unified access for different users.

[0003] like Figure 1 As shown, a typical user access system includes at least the following components: client VPN, VPN server, target machine scene, VLAN switch, and range dispatch center. The functions of each component are as follows: VPN client: The client is installed by the access user and must be installed and run on the access user system. After running, the user accesses the scene network. VPN server: The server provides different clients with access to different scenes through network configuration, including flow control, scene isolation and other functions, which takes up a lot of resources. VLAN switch: Build different network isolation environments. Target machine scene: The target environment to be accessed, different target machine scenes should provide corresponding isolation, and enable users assigned to the scene to access. Range dispatch center: Start the target machine in the range, build the network environment in the switch, and assign the target machine to different scenes.

[0004] Figure 1 The access system steps shown include: 1. The range dispatch center activates the target drone, establishes a network isolation environment using a VLAN switch, and connects different target drones to different scenarios. 2. The server VPN enables service access based on predefined rules and assigns users to different network environments when clients access the system. 3. Users activate their clients and access different network isolation environments through the VPN server.

[0005] The existing user access system has the following problems: 1. Users are required to install a VPN client, and the client must match the user's system environment. Uncommon operating systems may not be able to access it. 2. The VPN server carries too much traffic, and when there are a large number of concurrent users, there will be delays and slow access to users. 3. The VPN server needs to perform network configuration for different network target range scenarios, which is a heavy task, complex operation, and low flexibility. 4. If you directly use port mapping to access, a small number of public IPs will cause port scanning, and different users will access different scenarios, posing a security risk. 5. The VPN client cannot perform anti-cheating restrictions on the network target range. Different users only need to exchange VPN client configuration files to access other scenarios. Summary of the Invention

[0006] Purpose of the invention: The purpose of the present invention is to provide a network target range scenario isolation access method and system based on dynamic domain names, which allows users to dynamically access the scenarios by assigning them to different third-level or higher domain names. This method does not require the use of a VPN client and does not occupy a public network IP. It has the advantages of simple configuration, easy scalability, support for high concurrency, low operation and maintenance costs, and high security.

[0007] Technical solution: To achieve the above-mentioned purpose, the present invention adopts the following technical solution:

[0008] A network range scenario isolation access method based on dynamic domain names, comprising:

[0009] When a user requests to open a shooting range scene or view the scene target machine address interface through a browser, the request address used by the user is recorded;

[0010] When the shooting range scenario is started, a globally unique string is dynamically generated for the target machine in the scenario and used as the third-level or higher domain name in the target machine's access domain name address; at the same time, the correspondence between the third-level or higher domain name and the target machine's real address is recorded;

[0011] Feedback the target machine's access domain name address to the user, receive the user's request to access the target machine through the domain name address, obtain the request address of the user's access request, and after consistency verification with the recorded request address, obtain the target machine's real address based on the third-level or above domain name in the domain name address, bind the requested domain name address with the target machine's real address, and proxy forward the access request of the domain name address.

[0012] Preferably, for a situation where multiple users access multiple target machines in a scenario, one or more domain names are dynamically generated for each target machine in the scenario.

[0013] Preferably, when the user views the scene target machine address page, the address requested by the user is written into the target machine's allowed access address pool; when the user accesses the target machine through the domain name, it is queried whether the requested address is in the address pool. If it does not exist, access is denied. If it does exist, a reverse proxy is performed for the target machine's real address.

[0014] Preferably, for the case where the target machine in the access scenario is accessed in groups, the domain name generated for the target machine includes identification information of the group to which the user belongs.

[0015] Preferably, the dynamically generated third-level or higher domain name uses a UUID character string, or a character string containing a UUID.

[0016] A network range scenario isolation access system based on dynamic domain names, comprising:

[0017] The request address recording module is used to record the request address used when the user opens the shooting range scene or views the scene target machine address interface;

[0018] The dynamic domain name generation module is used to dynamically generate a globally unique string for the target machine in the scene when the shooting range scene is started, and use it as the third-level or higher domain name in the target machine's access domain name address; at the same time, it records the corresponding relationship between the third-level or higher domain name and the target machine's real address;

[0019] The access proxy module is used to receive a user's request to access the target machine through the domain name address, obtain the request address of the user's access request, and after consistency verification with the recorded request address, obtain the real address of the target machine based on the third-level or above domain name in the domain name address, bind the requested domain name address with the real address of the target machine, and forward the access request of the domain name address through the proxy.

[0020] A computer system includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded into the processor, the steps of the network range scenario isolation access method based on dynamic domain names are implemented.

[0021] Beneficial effects: Compared with the existing technology, the present invention has the following advantages: 1. There is no need to install additional VPN client programs, and it is easier for users to access the shooting range scene. 2. The access service configuration is simple and unified management can be used to quickly expand functions. Equipment can be quickly added in high-concurrency scenarios, and operation and maintenance costs are reduced. 3. The real target address of the shooting range scene is hidden to prevent users from performing destructive operations on the platform and improve risk resistance. 4. The user request address is recorded and combined with the domain name verification. Different users / teams cannot access the target machine through the same domain name address, effectively preventing users from cheating. 5. The domain name is dynamically generated and highly random. Users cannot brute-force access to the platform by scanning. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a structural diagram of the existing access system.

[0023] Figure 2 Schematic diagram of a method flow in an embodiment of the present invention.

[0024] Figure 3 This is an example diagram of dynamic domain name access in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings and specific embodiments.

[0026] like Figure 2As shown, an embodiment of the present invention discloses a network target range scenario isolation access method based on dynamic domain names. When a user requests to open a target range scenario or view a target machine address interface of a scenario through a browser, the request address used by the user is recorded; when the target range scenario is started, a globally unique string is dynamically generated for the access target machine in the scenario, and used as a third-level or above domain name in the target machine access domain name address; at the same time, the correspondence between the third-level or above domain name and the real address of the target machine is recorded; the access domain name address of the target machine is fed back to the user, the user's request to access the target machine through the domain name address is received, the request address of the user's access request is obtained, and after consistency verification with the recorded request address is passed, the real address of the target machine is obtained according to the third-level or above domain name in the domain name address, the requested domain name address is bound to the real address of the target machine, and the access request of the domain name address is forwarded by the proxy.

[0027] This solution allows users to dynamically access the target machines in the network range by assigning them to different third-level or higher-level domain names. This eliminates the need to install a VPN client; users can simply access the target machines using standard access methods specific to each scenario. This solution allows for flexible configuration in different application scenarios. For example, if multiple users access multiple target machines in a scenario, one or more domain names can be dynamically generated for each target machine in the scenario for user access. User / user group identification information can also be added to the domain name for easier identification.

[0028] Based on the same inventive concept, an embodiment of the present invention discloses a network target range scenario isolation access system based on dynamic domain names, including: a request address recording module, used to record the request address used when the user opens the target range scene or views the scene target machine address interface; a dynamic domain name generation module, used to dynamically generate a globally unique string for the access target machine in the scene when the target range scene is started, and use it as the third-level or above domain name in the target machine access domain name address; at the same time, record the correspondence between the third-level or above domain name and the real address of the target machine; an access proxy module, used to receive a user's request to access the target machine through a domain name address, obtain the request address of the user's access request, and after consistency verification with the recorded request address, obtain the real address of the target machine according to the third-level or above domain name in the domain name address, bind the requested domain name address to the real address of the target machine, and proxy forward the access request of the domain name address.

[0029] Based on the same inventive concept, an embodiment of the present invention discloses a computer system, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded into the processor, the steps of the network target range scenario isolation access method based on dynamic domain names are implemented.

[0030] The following combination Figure 3 This example illustrates the specific process of dynamic domain name access.

[0031] 1. When a user accesses a platform (such as a competition platform or a competitive platform) through a browser and launches a range scenario, the request address used to launch the range scenario is recorded. For small-scale problem-solving or experimental scenarios, where the user can launch the scenario themselves, the request IP address can be recorded when the user launches the scenario. This can be used to compare and determine access permissions (users can access their own scenarios but not others'). For large-scale competitive scenarios, the scenario is pre-launched, and the platform can record the IP address used by the user when logging in to view the scenario target machine address interface (user access permissions are managed by the platform). This IP address is added to the scene's accessible address pool. When the user accesses a platform scenario, the accessed scenario address is compared to see if it is in the address pool to determine whether the user has access permissions for that scenario.

[0032] 2. After the shooting range dispatch center starts the scene, it dynamically generates a domain name and assigns it to the target machine for access. The dynamically generated random third-level domain name can be in the form of UUID+special identifier.

[0033] In a typical online scenario, after the shooting range generates the scenario, it assigns an intranet address to the target machine within the scenario. The competition platform records the intranet target machine address and generates a random string. This random string is combined with the platform domain name to generate the domain name, which is then bound to the target machine's intranet address and stored in the database. Users can access the domain name through this domain name.

[0034] In large-scale scenarios with multiple groups of confrontations, the platform assigns random strings to a large number of target machines in the scenarios, and jointly queries the random strings with the target machine's intranet address. In large-scale scenarios, there will be multiple different domain names pointing to different target machine intranet addresses in the same scenario. The network is isolated within the target machine and is not affected by the domain name address. When users use different domain name addresses to access, they only access the target machine pointed to by the domain name. The network between the target machines is only perceived in the scenario, and the user is not affected.

[0035] When the platform connects the target machine in the form of a team, there may be cases where different users access the same domain name. In this case, all users of the team must click on the interface to view the target machine address. The platform then records the address used by the user when clicking on the interface to view the target machine address, and writes it into the address pool allowed for target machine access. When accessing the target machine, the platform queries the address pool to see if the address exists, and determines that the user is a user of the team in the corresponding scenario.

[0036] 3. Users access the platform directly through domain names.

[0037] 4. The platform verifies the target machine domain name based on the user's access request address to prevent users from accessing the target machine through different request addresses.

[0038] For scenarios enabled by users, the platform compares the enable request address with the target machine address for access. If they are the same, the access is run and the reverse proxy is enabled. For large-scale scenarios, when users view the target machine address, the network address used is recorded by the platform and written into the accessible address pool of the target machine domain name. When users access the target machine through the target machine domain name, the network address used will be matched with the accessible address pool of the target machine domain name. If it does not exist, the connection will be rejected. If it exists, access is allowed and the reverse proxy for the intranet target machine is enabled.

[0039] 5. After verification, the platform directly proxies the backend address bound to the domain name. Specifically, reverse proxy and load balancing can be achieved through the Nginx+Lua tool (OpenResty).

[0040] 6. The user successfully accesses the target machine.

[0041] When access is performed by groups, such as in a team competition, multiple users may access the same address within a group. The system only performs a two-way match between the domain name and the target machine, which does not affect multi-user access. Furthermore, in a multi-user environment, the domain name can access the address pool, allowing multiple addresses to exist. When any user in the group views the question, they can access it. In team competitions, domain name generation can carry the group name or corresponding identification code. Domain name components carry some user-identifiable information, helping users accurately determine whether it is the target machine address for the desired scenario.

[0042] In this solution, users can directly access the target machine using standard service access methods, without requiring a dedicated client. Different users or teams cannot access the target machine using the same domain name. Because the domain name is dynamically generated, users cannot brute-force access to the platform by scanning the domain name.

Claims

1. A network range scenario isolation access method based on dynamic domain name, characterized in that: include: When a user requests to open a shooting range scene or view the scene target machine address interface through a browser, the request address used by the user is recorded; When the shooting range scenario is started, a globally unique string is dynamically generated for the target machine in the scenario and used as the third-level or higher domain name in the target machine's access domain name address; at the same time, the correspondence between the third-level or higher domain name and the target machine's real address is recorded; Feedback the target machine's access domain name address to the user, receive the user's request to access the target machine through the domain name address, obtain the request address of the user's access request, and after consistency verification with the recorded request address, obtain the target machine's real address based on the third-level or above domain name in the domain name address, bind the requested domain name address with the target machine's real address, and proxy forward the access request of the domain name address.

2. The network range scenario isolation access method based on dynamic domain name according to claim 1 is characterized in that: For the case where multiple users access multiple target machines in a scenario, one or more domain names are dynamically generated for each target machine in the scenario.

3. The network range scenario isolation access method based on dynamic domain name according to claim 1 is characterized in that: When the user views the target machine address page of the scenario, the address requested by the user is written into the target machine's allowed access address pool; when the user accesses the target machine through the domain name, it is checked whether the requested address is in the address pool. If it does not exist, access is denied. If it does exist, a reverse proxy is performed for the target machine's real address.

4. The network range scenario isolation access method based on dynamic domain name according to claim 1 is characterized in that: For the case where the target machine is accessed in a group-based scenario, the domain name generated for the target machine contains the identification information of the group to which the user belongs.

5. The network range scenario isolation access method based on dynamic domain name according to claim 1 is characterized in that: Dynamically generated third-level or higher domain names use UUID strings, or strings containing UUIDs.

6. A network range scene isolation access system based on dynamic domain name, characterized in that: include: The request address recording module is used to record the request address used when the user opens the shooting range scene or views the scene target machine address interface; The dynamic domain name generation module is used to dynamically generate a globally unique string for the target machine in the scene when the shooting range scene is started, and use it as the third-level or higher domain name in the target machine's access domain name address; at the same time, it records the corresponding relationship between the third-level or higher domain name and the target machine's real address; The access proxy module is used to receive a user's request to access the target machine through the domain name address, obtain the request address of the user's access request, and after consistency verification with the recorded request address, obtain the real address of the target machine based on the third-level or above domain name in the domain name address, bind the requested domain name address with the real address of the target machine, and forward the access request of the domain name address through the proxy.

7. The network shooting range scenario isolation access system based on dynamic domain name according to claim 6 is characterized in that: For the case where multiple users access multiple target machines in a scenario, one or more domain names are dynamically generated for each target machine in the scenario.

8. The network shooting range scenario isolation access system based on dynamic domain name according to claim 6 is characterized in that: When the user views the target machine address page of the scenario, the address requested by the user is written into the target machine's allowed access address pool; when the user accesses the target machine through the domain name, it is checked whether the requested address is in the address pool. If it does not exist, access is denied. If it does exist, a reverse proxy is performed for the target machine's real address.

9. The network shooting range scenario isolation access system based on dynamic domain name according to claim 6 is characterized in that: For the case where the target machine is accessed in a group-based scenario, the domain name generated for the target machine contains the identification information of the group to which the user belongs.

10. A computer system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the computer program is loaded into the processor, the steps of the network range scenario isolation access method based on dynamic domain name are implemented according to any one of claims 1 to 5.

Images