A network dynamic defense method and system

Abstract

The present application relates to a network dynamic defense method and system, which belongs to the field of network security technology. The method is applied in a local area network, including: determining a verification strategy according to a downlink instruction, which is one of a trigger instruction and a verification instruction; using a verification strategy to verify the attribute information of the local area network, the attribute information includes the number of terminal devices and the initial number and authentication number corresponding to the terminal device; if the verification passes, the authentication number is output and the destination terminal device is controlled to enter a communication state, and the destination terminal device is a terminal device used to receive data during cross-network communication; otherwise, the terminal device that fails the verification is marked as an abnormal terminal device. The present application has the effect of improving the security of multiple local area networks when conducting cross-network communication.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network dynamic defense method and system. Background Art

[0002] In the current network environment, there are huge challenges in achieving cross-network communication between multiple local area networks. Specifically, static network isolation methods are often used between multiple local area networks to ensure secure cross-network communication, such as using virtual private networks or subnet division to achieve secure isolation. However, traditional static network isolation methods can no longer meet the increasingly complex and changeable network attacks, leaving local area networks in a passive situation. Moreover, static network security defense technology is a lagging passive defense. The defense performance mainly depends on the effectiveness and completeness of the feature library and policy library. Its successful prevention of attacks requires two prerequisites: the first is that the attack has occurred or is in progress; the second is that the attack must be a known method or means, and the attack feature extraction and the generation and deployment of corresponding prevention strategies have been completed.

[0003] It can be seen from this that the current multi-LAN security defense has a lag when conducting cross-network communications, and the security of cross-network communications cannot be guaranteed. Therefore, a dynamic and timely defense method is needed to ensure the security of cross-network communications. Summary of the invention

[0004] In order to solve the problem of low security when information is exchanged between multiple local area networks, the present application provides a network dynamic defense method and system.

[0005] In a first aspect of the present application, a network dynamic defense method is provided, which is applied in a local area network and includes:

[0006] Determine a verification strategy according to a downlink instruction, wherein the downlink instruction is one of a trigger instruction and a verification instruction;

[0007] Using the verification strategy to verify the attribute information of the local area network, the attribute information includes the number of terminal devices and the initial number and authentication number corresponding to the terminal devices;

[0008] If the verification is successful, the authentication number is output and the destination terminal device is controlled to enter the communication state. The destination terminal device is a terminal device used to receive data during cross-network communication;

[0009] Otherwise, the terminal device that fails the verification is marked as an abnormal terminal device.

[0010] By adopting the above technical solution, the local area network can determine different verification strategies based on the downlink instructions, and then use the verification strategy to perform security verification on the local area network. Only when the verification passes will the destination terminal device be controlled to enter the communication state, otherwise the terminal device that fails the verification will be marked as an abnormal terminal device. Since the security verification of the terminal devices in the local area network is performed before cross-network communication, the security defense of the local area network is forward-looking, and the local area network can also select corresponding verification strategies for different downlink instructions, thereby providing technical guarantees for improving the security of multiple local area networks when conducting cross-network communications.

[0011] In a possible implementation manner: the verification strategy includes a first strategy, and the first strategy corresponds to the trigger instruction;

[0012] The adopting the verification strategy to verify the attribute information of the local area network includes:

[0013] Receive the initial number uploaded by the terminal device;

[0014] Determine whether the number of initial numbers is equal to the number of terminal devices;

[0015] If yes, then update the access control list to obtain the secondary number corresponding to the terminal device, verify the authentication number according to the secondary number, the authentication number is the number obtained after the secondary number is encrypted by the encryption model, and the access control list stores multiple terminal devices located in the same local area network and the initial numbers corresponding to the terminal devices;

[0016] If not, the initial number of the terminal device in the access control list is compared with the initial number uploaded by the terminal device to determine the abnormal terminal device.

[0017] In a possible implementation manner, the updating of the access control list to obtain a secondary number corresponding to the terminal device includes:

[0018] Adjusting the order of the destination terminal devices in the access control list to obtain a numbered list;

[0019] The number list is updated to obtain a secondary number corresponding to the terminal device.

[0020] In a possible implementation manner, the updating the number list to obtain a secondary number corresponding to the terminal device includes:

[0021] Select a random number and add the initial number of the terminal device to the random number to obtain a secondary number; or

[0022] According to the order of the terminal devices in the number list, the value added to the initial number of the terminal device is increased in sequence, and the initial number of the terminal device and the value are added to obtain a secondary number; or

[0023] According to the order of the terminal devices in the number list, the initial numbers corresponding to the terminal devices are shifted clockwise or counterclockwise to obtain the secondary numbers of the terminal devices.

[0024] In a possible implementation, the verifying the authentication number according to the secondary number includes:

[0025] Determine whether the number of authentication numbers is equal to the number of destination terminal devices;

[0026] If yes, the authentication number is verified and locked;

[0027] If not, the abnormal terminal device is determined by comparing the authentication number of the destination terminal device in the number list with the authentication number uploaded by the destination terminal device.

[0028] By adopting the above technical solution, the first strategy needs to be verified twice. The first verification is to determine whether the terminal device will return the initial number. The authentication number verified for the second time is obtained by encrypting the secondary number, and the secondary number is obtained after updating the access control list. Therefore, the authentication number obtained after dynamically updating the access control list and encrypting the secondary number using the encryption model has double confidentiality. It is difficult for abnormal terminal devices to crack the authentication number, thereby achieving the purpose of improving the security of multiple local area networks when communicating across networks.

[0029] In a possible implementation manner: when the downlink instruction is a verification instruction, the method further includes:

[0030] Determine whether the interaction request is satisfied:

[0031] n>N∪p>P, where n is the number of destination terminal devices in the interaction request, N is the threshold value of the number of destination terminal devices, p is the ratio of the number of destination terminal devices in the local area network containing the largest number of destination terminal devices to the number of destination terminal devices in the interaction request, and P is the ratio threshold;

[0032] If yes, the verification instruction is outputted by broadcasting;

[0033] If not, the verification instruction is outputted in unicast or multicast mode;

[0034] The interaction request is an instruction used by the source terminal device to request information interaction with the destination terminal device.

[0035] In a possible implementation: the verification strategy includes a second strategy, and the second strategy corresponds to the verification instruction output in a broadcast manner;

[0036] The adopting the verification strategy to verify the attribute information of the local area network includes:

[0037] Receive the initial number uploaded by the terminal device;

[0038] Determine whether the number of initial numbers is equal to the number of terminal devices;

[0039] If yes, encrypt the initial number using the encryption model to obtain the authentication number and verify the authentication number;

[0040] If not, the abnormal terminal device is determined by comparing the initial number of the terminal device in the access control list with the initial number uploaded by the terminal device. The access control list stores multiple terminal devices located in the same local area network and the initial numbers corresponding to the terminal devices.

[0041] In a possible implementation, the step of using an encryption model to encrypt the initial number to obtain the authentication number includes:

[0042] Extract the number of the source terminal device and the initial number of the destination terminal device, and add the number of the source terminal device to the initial number to obtain the authentication number; or

[0043] The number of the source terminal device and the initial number of the destination terminal device are extracted, and the number of the source terminal device is multiplied by the initial number to obtain the authentication number.

[0044] By adopting the above technical solution, the second strategy is also verified twice. The first verification is to determine whether the terminal device will return the initial number. The authentication number verified for the second time is the initial number after encryption. It is difficult for abnormal terminal devices to crack the authentication number, thereby achieving the purpose of improving the security of multiple local area networks when communicating across networks.

[0045] In a possible implementation manner: the verification strategy includes a third strategy, and the third strategy corresponds to the verification instruction output in a unicast manner or a multicast manner;

[0046] The adopting the verification strategy to verify the attribute information of the local area network includes:

[0047] Receiving the authentication number uploaded by the destination terminal device, wherein the authentication number is a number obtained by encrypting the initial number using an encryption model;

[0048] Determine whether the number of authentication numbers is equal to the number of destination terminal devices;

[0049] If yes, the authentication number is verified and locked;

[0050] If not, the abnormal terminal device is determined by comparing the authentication number of the destination terminal device in the access control list with the authentication number uploaded by the destination terminal device.

[0051] By adopting the above technical solution, the third strategy corresponds to outputting the verification instruction in unicast mode or multicast mode, which means that the information that the source terminal device communicates or interacts with the destination terminal device for the first time is used for the first time. At the same time, the number of destination terminal devices interacted by the source terminal device is small and relatively scattered, so it is difficult for the invading terminal device to find the interaction rules of the local area network and crack the correct authentication number. Therefore, there is no need to update the access control list or verify all terminal devices in the local area network at this time. Instead, it is only necessary to verify the authentication number of the destination terminal device, so that the security verification can be completed quickly. While ensuring the verification efficiency, it also improves the security of the local area network during cross-network communication.

[0052] In a second aspect of the present application, a network dynamic defense system is provided. The system comprises:

[0053] A data determination module, used to determine a verification strategy according to a downlink instruction, wherein the downlink instruction is one of a trigger instruction and a verification instruction;

[0054] A data verification module, used to verify the attribute information of the local area network using the verification strategy, wherein the attribute information includes the number of terminal devices and the initial number and authentication number corresponding to the terminal devices;

[0055] The first processing module is used to output the authentication number and control the destination terminal device to enter the communication state when the attribute information of the terminal device is verified. The destination terminal device is a terminal device used to receive data during cross-network communication.

[0056] The second processing module is used to mark the terminal device that has failed the verification as an abnormal terminal device when the attribute information of the terminal device fails the verification.

[0057] In summary, the present application includes the following beneficial technical effects:

[0058] When the local area network receives a trigger instruction, it performs double authentication on the terminal devices in the local area network, and the difficulty of the two authentications increases successively. The authentication number verified for the second time is obtained after the secondary number is encrypted, and the secondary number is obtained after updating the access control list. Therefore, the authentication number obtained after dynamically updating the access control list and encrypting the secondary number using the encryption model has double confidentiality performance, and it is difficult for abnormal terminal devices to crack the authentication number. When the local area network receives a verification instruction output by broadcast, it also performs double authentication on the terminal device, but there is no need to update the access control list. The returned authentication number is obtained after the initial number is encrypted by the encryption model, which can also achieve the purpose of secure cross-network communication. When the local area network receives a verification instruction output by unicast or multicast, the authentication number of the destination terminal device is verified. It can be seen from this that the local area network of the present application can dynamically adjust the corresponding verification strategy according to the different interaction needs of the source terminal device, and the verification process is completed before the source terminal device interacts with the destination terminal device. The verification is forward-looking and can prevent the source terminal device from communicating with abnormal terminal devices. At the same time, it can also promptly detect abnormal terminal devices in the local area network, thereby achieving the purpose of improving the security of multiple local area networks when conducting cross-network communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is a schematic diagram of an exemplary operating environment of an embodiment of the present application.

[0060] Figure 2 It is a flow chart of a network dynamic defense method according to an embodiment of the present application.

[0061] Figure 3 It is a block diagram of a network dynamic defense system according to an embodiment of the present application.

[0062] Explanation of the accompanying drawings: 1. Data determination module; 2. Data verification module; 3. First processing module; 4. Second processing module. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0064] Figure 1A schematic diagram of an exemplary operating environment in which the embodiments of the present application can be implemented is shown, the operating environment includes an interaction center and multiple local area networks, the interaction center is set between the multiple local area networks, and is mainly composed of network devices such as routers, firewalls, and switches, and is used to achieve secure cross-network communication between the multiple local area networks. The local area network includes multiple terminal devices and a gateway for managing communication tasks of the multiple terminal devices, such as a switch.

[0065] The terminal device used to initiate an interaction request in a local area network is called a source terminal device, and the terminal device that is not in the same local area network as the source terminal device and is used to receive data sent by the source terminal device is called a destination terminal device. The terminal device can be one or more of a mobile phone, a tablet, and a computer.

[0066] It should be noted that Figure 1 The operating environment shown is only illustrative and is not intended to limit the application or use of the embodiments of the present application. For example, the operating environment may include multiple interaction centers, and multiple local area networks may achieve secure cross-network communication through different interaction centers.

[0067] Figure 2 A flow chart of a network dynamic defense method according to an embodiment of the present application is shown, and the method is applied in a local area network, specifically in a local area network where a target terminal device is located. The following is the main process of the network dynamic defense method of the present application.

[0068] Step S1, determining a verification strategy according to a downlink instruction.

[0069] The downlink instruction is the instruction output by the interaction center after receiving the interaction request uploaded by the source terminal device, and the interaction request is the instruction sent by the source terminal device for information interaction with the destination terminal device. The request instructions sent by different source terminal devices are different. In this example, each terminal device has a unique corresponding number. When the source terminal device needs to communicate with the destination terminal device across the network, the source terminal device needs to send its corresponding number and the corresponding number of the destination terminal device to the interaction center, that is, the interaction center receives the interaction request.

[0070] Since the interaction request contains not only the number of the source terminal device but also the number of the destination terminal device, and the number of the destination terminal device may be more than one, in order to avoid the interaction center confusing the number of the source terminal device with the number of the destination terminal device, the format of the interaction request is set to A-B1,…, B n , A represents the number of the source terminal device, and B1, ..., B n All are the numbers of the destination terminal devices, n≥1.

[0071] In order to improve the security of the source terminal device during cross-network communication, when the source terminal device interacts with the same destination terminal device over the same data, the source terminal device will be configured with an identifier in the uploaded interaction request. The identifier can reflect the same number of interactions. For example, in A3-B1, B1, A3 indicates that the source terminal device A interacted with the destination terminal devices B1 and B2 over the same data three times. Of course, the identifier may not reflect the same number of interactions. For example, in A0-B1, B1, the identifier in A0 is the subscript "0". When the source terminal device number has the subscript "0", it indicates that the source terminal device A interacted with the destination terminal devices B1 and B2 over the same data.

[0072] In order to distinguish different interaction requests, when the interaction center recognizes that the interaction request contains an identifier, the downlink instruction sent is a trigger instruction, and when the interaction request does not contain an identifier, the downlink instruction sent is a verification instruction. In other words, the downlink instruction is one of the trigger instruction and the verification instruction. In addition, when the interaction request does not contain an identifier, the interaction center determines whether the interaction request meets:

[0073] n>N∪p>P, where n is the number of destination terminal devices in the interaction request, N is the threshold value of the number of destination terminal devices, which is a preset value, and p is the ratio of the number of destination terminal devices in the local area network containing the most destination terminal devices to the number of destination terminal devices in the interaction request, and P is the ratio threshold, which is also a preset value.

[0074] When the interaction request meets the above conditions, the verification instruction is output in a broadcasting manner so that all the terminal devices in the local area network where the target terminal device is located receive the verification instruction. Otherwise, the interaction center sends the verification instruction to the target terminal device in a unicast or multicast manner.

[0075] In this example, corresponding verification strategies are configured for different types of downlink instructions. Specifically, the verification strategy corresponding to the trigger instruction is called the first strategy, the verification strategy corresponding to the verification instruction sent by broadcasting is called the second strategy, and the verification strategy corresponding to the verification instruction not sent by broadcasting is called the third strategy. The verification processes corresponding to different verification strategies are not the same. The specific verification process is shown in step S2.

[0076] Step S2: Use a verification strategy to verify the attribute information of the local area network.

[0077] The gateway in the local area network stores an access control list, which stores multiple terminal devices located in the same local area network and the numbers corresponding to the terminal devices. Specifically, the gateway only stores the access control list of the local area network in which it is located. In this example, the number corresponding to the terminal device before updating the access control list is marked as the initial number, and the encrypted number returned to the interaction center by the destination terminal device is marked as the authentication number.

[0078] The attribute information of the local area network includes the number of terminal devices in the local area network and the initial number and authentication number corresponding to the terminal devices. It should be noted that what is verified here is the terminal device in the local area network where the target terminal device is located.

[0079] When the verification strategy is the first strategy, the gateway sends a retrieval request to the terminal device in the same local area network. The present application sets an interactive logic in each terminal device in advance. When the terminal device receives the retrieval request, it will return the corresponding initial number to the gateway. After the gateway receives the initial number, it determines whether the number of initial numbers is equal to the number of terminal devices. This design is because the invading terminal device may not understand the above-mentioned interactive logic, so it may not return the initial number after receiving the retrieval request, resulting in the number of initial numbers being unequal to the number of terminal devices. Therefore, when the number of initial numbers is different from the number of terminal devices, in order to accurately locate the invading terminal device, the initial number of the terminal device in the access control list is compared with the initial number returned by the terminal device one by one, and the terminal device that does not have the corresponding initial number in the access control list is determined as an abnormal number, and the terminal device that sends the abnormal number is marked as an abnormal terminal device.

[0080] In addition, when the number of initial numbers is equal to the number of terminal devices, the order of the destination terminal devices in the access control list is adjusted to obtain a number list, for example, the destination terminal devices are inserted into different orders using an insertion method. Then, the initial number of the terminal device in the number list is updated to obtain a secondary number. The present application provides three methods for updating the number list. The first is to select a random number, and then add the random number to the initial number to obtain a new number; the second is to increase the added value in sequence based on the initial number according to the order of the terminal devices in the number list, that is, the value added by the terminal device on the basis of the initial number is an arithmetic progression; the third is to shift the corresponding numbers clockwise or counterclockwise according to the order of the terminal devices in the number list. For example, there are three terminal devices stored in the number list, represented by A, B, and C respectively. Before the update, A, B, and C are ranked first, second, and third in the number list and their corresponding numbers are 001, 010, and 100 respectively. After the clockwise update, A, B, and C correspond to 100, 001, and 010 respectively, and after the counterclockwise update, A, B, and C correspond to 010, 100, and 001 respectively.

[0081] In order to distinguish the numbers before and after replacement, the number after replacement is called the secondary number, that is, after updating the data list, the secondary number corresponding to the terminal device is obtained. The destination terminal device then encrypts the secondary number based on the obtained secondary number using a pre-set encryption model to obtain an authentication number. In a specific example, the encryption process of the encryption model is: extracting the number of the source terminal device and the secondary number of the destination terminal device, adding the number of the source terminal device to the secondary number to obtain the authentication number. In other examples, the encryption process of the encryption model can also be: extracting the number of the source terminal device and the secondary number of the destination terminal device, and multiplying the number of the source terminal device by the secondary number to obtain the authentication number.

[0082] Finally, the destination terminal device sends the authentication number to the gateway. Based on the received authentication number, the gateway will still determine whether the number of authentication numbers is equal to the number of destination terminal devices contained in the local area network where the gateway is located. If they are not equal, the secondary number of the destination terminal device in the number list is used to calculate the authentication number corresponding to each destination terminal device using the same encryption method. When the destination terminal device does not upload the authentication number or the uploaded authentication number is incorrect, the destination terminal device is marked as an abnormal terminal device. If they are equal, the authentication number is locked and the next step is entered.

[0083] In general, the first strategy is to first determine whether the terminal device can return the initial number. If it cannot return to the initial number, it is necessary to locate the abnormal terminal device by comparing the initial number in the access control list and the initial number uploaded by the terminal device; if it can return to the initial number, then continue to determine whether the target terminal device can return the authentication number. If it cannot return to the authentication number, it is necessary to locate the abnormal terminal device by comparing the authentication number in the number list and the authentication number uploaded by the terminal device. If it can return to the authentication number, proceed to the next step. It can be seen that the first strategy needs to be verified twice. Only when both verifications are passed can the next step be entered, and the difficulty of the two authentications increases successively, because the authentication number verified for the second time is obtained after the secondary number is encrypted, and the secondary number is obtained after updating the access control list. Therefore, the authentication number obtained after dynamically updating the access control list and encrypting the secondary number using the encryption model has double confidentiality performance, and it is difficult for abnormal terminal devices to crack the authentication number.

[0084] When the verification strategy is the second strategy, the gateway also sends a retrieval request to the terminal device in the same local area network. When the terminal device receives the retrieval request, it returns the corresponding initial number to the gateway. After receiving the initial number, the gateway determines whether the number of initial numbers is equal to the number of terminal devices. When the number of initial numbers is different from the number of terminal devices, in order to accurately locate the intruding terminal device, the initial number of the terminal device stored in the gateway is compared with the initial number returned by the terminal device one by one, and the terminal device that does not have the corresponding initial number in the access control list is determined as an abnormal number, and the terminal device that sends the abnormal number is marked as an abnormal terminal device. When the number of initial numbers is equal to the number of terminal devices, the initial number is encrypted using a pre-set encryption model to obtain an authentication number. In a specific example, the encryption process of the encryption model here is: extract the number of the source terminal device and the initial number of the destination terminal device, and add the number of the source terminal device to the initial number to obtain the authentication number. In other examples, the encryption process of the encryption model here may also be: extracting the number of the source terminal device and the initial number of the destination terminal device, and multiplying the number of the source terminal device by the initial number to obtain the authentication number.

[0085] Finally, the destination terminal device sends the authentication number to the gateway. Based on the received authentication number, the gateway will still determine whether the number of authentication numbers is equal to the number of destination terminal devices contained in the local area network where the gateway is located. If they are not equal, the initial number of the destination terminal device in the access control list is used to calculate the authentication number corresponding to each destination terminal device using the same encryption method. When the destination terminal device does not upload the authentication number or the uploaded authentication number is incorrect, the destination terminal device is marked as an abnormal terminal device. If they are equal, the authentication number is locked and the next step is entered.

[0086] In general, when the interactive center outputs the verification instruction by broadcasting, the information representing that the source terminal device is communicating or interacting with the destination terminal device for the first time is used for the first time, so it is difficult for the intruding terminal device to find the interaction rules of the local area network and crack the correct authentication number, so there is no need to update the access control list at this time. Therefore, the second strategy is similar to the first strategy, the only difference is that the access control list is not updated in the second strategy, and the authentication number obtained is the initial number encrypted by the encryption model.

[0087] When the verification strategy is the third strategy, the gateway directly forwards the verification instruction to the destination terminal device, and the destination terminal device sends the authentication number to the gateway when receiving the verification instruction. Based on the received authentication number, the gateway will determine whether the number of authentication numbers is equal to the number of destination terminal devices contained in the local area network where the gateway is located. If they are not equal, the initial number of the destination terminal device in the access control list is used to calculate the authentication number corresponding to each destination terminal device using the same encryption method. When the destination terminal device does not upload the authentication number or the uploaded authentication number is incorrect, the destination terminal device is marked as an abnormal terminal device. If they are equal, the authentication number is locked and the next step is entered.

[0088] In general, the verification process of the third strategy is similar to part of the verification process of the second strategy. Since the third strategy corresponds to the output of verification instructions in unicast mode or multicast mode, it also means that the source terminal device is communicating with the destination terminal device for the first time or the information interacting is used for the first time. At the same time, the number of destination terminal devices interacted by the source terminal device is small and relatively scattered, so it is difficult for the invading terminal device to find the interaction rules of the local area network and crack the correct authentication number. Therefore, there is no need to update the access control list or verify all terminal devices in the local area network at this time, but only to verify the authentication number of the destination terminal device.

[0089] Step S3: If the verification is passed, the authentication number is output and the destination terminal device is controlled to enter the communication state.

[0090] After the gateway obtains the authentication number through step S2, it returns the authentication number to the interaction center and controls the destination terminal device to enter the communication state. This is because after the interaction center obtains the authentication number, the authentication number is verified. The verification process is similar to the process of verifying the authentication number of the destination terminal device in the gateway, so it will not be repeated here. If the interaction center verifies the authentication number, a communication link is established between the source terminal device and the destination terminal device. Therefore, the destination terminal device enters the communication state before the interaction center verifies the authentication number, so that the communication link can be established between the source terminal device and the destination terminal device after the interaction center verifies it, so that the source terminal device and the destination terminal device can quickly realize information exchange.

[0091] Step S4: Otherwise, the terminal device that fails the verification is marked as an abnormal terminal device.

[0092] It can be seen from step S2 that the first strategy and the second strategy will verify the terminal device twice, and the third strategy will verify the destination terminal device once. No matter which verification strategy is adopted, if the terminal device (including the destination terminal device) fails the verification, the terminal device that fails the verification will be marked as an abnormal terminal device, so as to facilitate maintenance personnel to carry out targeted maintenance on the abnormal terminal devices, eliminate the security risks brought by the abnormal terminal devices to the local area network, and improve the security of multiple local area networks when communicating across networks.

[0093] In summary, the implementation principle of a network dynamic defense method in the embodiment of the present application is as follows: when the source terminal device interacts with the same target terminal device over the same data, the source terminal device sends an interaction request with an identifier to the interaction center, and the downlink instruction output by the interaction center is a trigger instruction; when the source terminal device interacts with the target terminal device for the first time or the interactive data is used for the first time, the method of issuing the verification instruction is determined according to the number of target terminal devices requested to interact by the source terminal device or the degree of concentration of the target terminal devices. When the number of target terminal devices requesting interaction is greater or the target terminal devices are more concentrated in a local area network, the verification instruction is output in a broadcasting manner, otherwise the verification instruction is output in a unicast or multicast manner. When the gateway in the local area network receives the trigger instruction, it performs a double verification on the terminal devices in the local area network, and the difficulty of the two authentications increases successively. The authentication number verified for the second time is obtained after the secondary number is encrypted, and the secondary number is obtained after updating the access control list. Therefore, the authentication number obtained after dynamically updating the access control list and encrypting the secondary number using the encryption model has a double confidentiality performance, and it is difficult for abnormal terminal devices to crack the authentication number. When the gateway in the local area network receives the verification instruction output by broadcasting, it also performs dual authentication on the terminal device, but there is no need to update the access control list. The returned authentication number is the initial number obtained after being encrypted by the encryption model. When the gateway in the local area network receives the verification instruction output by unicast or multicast, it only verifies the authentication number of the destination terminal device. It can be seen that the local area network of the present application can dynamically adjust the corresponding verification strategy according to the different interaction requirements of the source terminal device, and the verification process is completed before the source terminal device interacts with the destination terminal device. The verification is forward-looking and can avoid the source terminal device from communicating with abnormal terminal devices. At the same time, it can also promptly detect abnormal terminal devices in the local area network, thereby achieving the purpose of improving the security of multiple local area networks when communicating across networks.

[0094] Figure 3 A block diagram of a network dynamic defense system according to an embodiment of the present application is shown. The system includes a data determination module 1, a data verification module 2, a first processing module 3 and a second processing module 4.

[0095] The data determination module 1 is used to determine the verification strategy according to the downlink instruction, where the downlink instruction is one of a trigger instruction and a verification instruction.

[0096] The data verification module 2 is used to verify the attribute information of the terminal device using a verification strategy, where the attribute information includes the number of the terminal devices and the initial number and authentication number corresponding to the terminal devices.

[0097] The first processing module 3 is used to output the authentication number and control the destination terminal device to enter the communication state when the attribute information of the terminal device is verified. The destination terminal device is a terminal device used to receive data during cross-network communication.

[0098] The second processing module 4 is configured to mark the terminal device that has failed the verification as an abnormal terminal device when the attribute information of the terminal device fails the verification.

[0099] The modules involved in the embodiments described in the present application may be implemented by software or hardware. The modules described may also be set in a processor, for example, it may be described as: a processor includes a data determination module 1, a data verification module 2, a first processing module 3 and a second processing module 4. The names of these modules do not constitute a limitation on the modules themselves in some cases, for example, the data determination module 1 may also be described as a "module for determining a verification strategy according to a downlink instruction".

[0100] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0101] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present application (but not limited to) by each other to form a technical solution.

Claims

1. A network dynamic defense method, applied in a local area network, characterized in that: include: Determine a verification strategy according to a downlink instruction, wherein the downlink instruction is one of a trigger instruction and a verification instruction; The verification strategy is adopted to verify the attribute information of the local area network, wherein the attribute information includes the number of terminal devices and the initial number and authentication number corresponding to the terminal devices; when the local area network receives the trigger instruction, the number and number of the terminal devices in the local area network are double-verified, and the verified authentication number is obtained after the secondary number is encrypted, and the secondary number is obtained after updating the access control list. When the local area network receives the verification instruction output by broadcasting, the terminal device is also double-authenticated, but there is no need to update the access control list, wherein the authentication number is obtained after the initial number is encrypted by the encryption model, and when the local area network receives the verification instruction output by unicast or multicast, the authentication number of the destination terminal device is verified; If the verification is successful, the authentication number is output and the destination terminal device is controlled to enter the communication state. The destination terminal device is a terminal device used to receive data during cross-network communication; Otherwise, the terminal device that fails the verification is marked as an abnormal terminal device.

2. The network dynamic defense method according to claim 1, characterized in that: The verification strategy includes a first strategy, and the first strategy corresponds to the trigger instruction; The adopting the verification strategy to verify the attribute information of the local area network includes: Receive the initial number uploaded by the terminal device; Determine whether the number of initial numbers is equal to the number of terminal devices; If yes, then update the access control list to obtain the secondary number corresponding to the terminal device, verify the authentication number according to the secondary number, the authentication number is the number obtained after the secondary number is encrypted by the encryption model, and the access control list stores multiple terminal devices located in the same local area network and the initial numbers corresponding to the terminal devices; If not, the initial number of the terminal device in the access control list is compared with the initial number uploaded by the terminal device to determine the abnormal terminal device.

3. The network dynamic defense method according to claim 2, characterized in that: The updating of the access control list to obtain a secondary number corresponding to the terminal device includes: Adjusting the order of the destination terminal devices in the access control list to obtain a numbered list; The number list is updated to obtain a secondary number corresponding to the terminal device.

4. The network dynamic defense method according to claim 3, characterized in that: The updating of the number list to obtain a secondary number corresponding to the terminal device includes: Select a random number and add the initial number of the terminal device to the random number to obtain a secondary number; or According to the order of the terminal devices in the number list, the value added to the initial number of the terminal device is increased in sequence, and the initial number of the terminal device and the value are added to obtain a secondary number; or According to the order of the terminal devices in the number list, the initial numbers corresponding to the terminal devices are shifted clockwise or counterclockwise to obtain the secondary numbers of the terminal devices.

5. The network dynamic defense method according to claim 3, characterized in that: The verifying the authentication number according to the secondary number includes: Determine whether the number of authentication numbers is equal to the number of destination terminal devices; If yes, the authentication number is verified and locked; If not, the abnormal terminal device is determined by comparing the authentication number of the destination terminal device in the number list with the authentication number uploaded by the destination terminal device.

6. The network dynamic defense method according to claim 1, characterized in that: When the downlink instruction is a verification instruction, the method further includes: Determine whether the interaction request is satisfied: n>N or p>P, where n is the number of destination terminal devices in the interaction request, N is the threshold value of the number of destination terminal devices, p is the ratio of the number of destination terminal devices in the local area network containing the largest number of destination terminal devices to the number of destination terminal devices in the interaction request, and P is the ratio threshold; If yes, the verification instruction is outputted by broadcasting; If not, the verification instruction is outputted in unicast or multicast mode; The interaction request is an instruction used by the source terminal device to request information interaction with the destination terminal device.

7. The network dynamic defense method according to claim 6, characterized in that: The verification strategy includes a second strategy, and the second strategy corresponds to the verification instruction output in a broadcast manner; The adopting the verification strategy to verify the attribute information of the local area network includes: Receive the initial number uploaded by the terminal device; Determine whether the number of initial numbers is equal to the number of terminal devices; If yes, encrypt the initial number using the encryption model to obtain the authentication number and verify the authentication number; If not, the abnormal terminal device is determined by comparing the initial number of the terminal device in the access control list with the initial number uploaded by the terminal device. The access control list stores multiple terminal devices located in the same local area network and the initial numbers corresponding to the terminal devices.

8. The network dynamic defense method according to claim 7, characterized in that: The method of using an encryption model to encrypt the initial number to obtain the authentication number includes: Extract the number of the source terminal device and the initial number of the destination terminal device, and add the number of the source terminal device to the initial number to obtain the authentication number; or The number of the source terminal device and the initial number of the destination terminal device are extracted, and the number of the source terminal device is multiplied by the initial number to obtain the authentication number.

9. The network dynamic defense method according to claim 6, characterized in that: The verification strategy includes a third strategy, and the third strategy corresponds to the verification instruction output in a unicast manner or a multicast manner; The adopting the verification strategy to verify the attribute information of the local area network includes: Receiving the authentication number uploaded by the destination terminal device, wherein the authentication number is a number obtained by encrypting the initial number using an encryption model; Determine whether the number of authentication numbers is equal to the number of destination terminal devices; If yes, the authentication number is verified and locked; If not, the abnormal terminal device is determined by comparing the authentication number of the destination terminal device in the access control list with the authentication number uploaded by the destination terminal device.

10. A network dynamic defense system, applied in a local area network, characterized in that: include: A data determination module (1) is used to determine a verification strategy according to a downlink instruction, wherein the downlink instruction is one of a trigger instruction and a verification instruction; A data verification module (2) is used to verify the attribute information of the local area network using the verification strategy, wherein the attribute information includes the number of terminal devices and the initial number and authentication number corresponding to the terminal devices; when the local area network receives a trigger instruction, the number and number of the terminal devices in the local area network are double-verified, the authentication number to be verified is obtained by encrypting the secondary number, and the secondary number is obtained by updating the access control list, and when the local area network receives a verification instruction output by broadcasting, the terminal device is also double-authenticated, but there is no need to update the access control list, wherein the authentication number is obtained by encrypting the initial number by an encryption model, and when the local area network receives a verification instruction output by unicast or multicast, the authentication number of the destination terminal device is verified; A first processing module (3) is used to output an authentication number and control a destination terminal device to enter a communication state when the attribute information of the terminal device passes the verification, wherein the destination terminal device is a terminal device used to receive data during cross-network communication; The second processing module (4) is used to mark the terminal device that has failed the verification as an abnormal terminal device when the attribute information verification of the terminal device fails.

Images