A method and system for preventing IP reverse query

Abstract

The present invention relates to the field of information security, and discloses a method and system for preventing IP reverse lookup. The system kernel adopts a virtualization component, and is provided with a HOST space and a VM space; the HOST space is used for access user verification; and the VM space is used for binding the verified user to an intranet address. The present invention has the beneficial effect that: through the authentication component, policy component, and address component set in the HOST space, user groups are classified and managed, so that different user groups can obtain different IP exits, and the technical effect of preventing IP from being reversed is achieved.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method and system for preventing IP reverse lookup. Background Art

[0002] IP reverse lookup, that is, reverse query of IP address, is a technology that tracks the real identity of users through IP addresses. It can help us understand the geographical location, network service provider and other information of an IP address.

[0003] As a network technology, IP reverse lookup plays an important role in ensuring network security and safeguarding corporate interests. The rational and legal use of IP reverse lookup technology will help improve work efficiency and service quality.

[0004] However, for some special industries, such as finance and military, or for the purpose of protecting personal privacy and preventing network attacks, it is particularly important to prevent IP reverse lookup.

[0005] At present, there are two technologies to prevent IP reverse lookup, as follows:

[0006] Solution 1: Proxy Server Solution

[0007] A proxy server is a server that can communicate with the Internet on behalf of other computers or devices. By using a proxy server, users can hide their IP address behind the IP address of the proxy server, thereby protecting their privacy.

[0008] Defects:

[0009] 1) Unauthorized access: If the proxy server is controlled by other users, they may use their permissions to gain unauthorized access, such as viewing or modifying other users' network traffic.

[0010] 2) Data insecurity risk Proxy servers may pose a risk of data insecurity because they can view network traffic. If the proxy server is controlled by other users, they may steal sensitive data or personal information.

[0011] Option 2: Use the Tor network

[0012] Tor is a free software based on Onion Routing technology, which can provide highly anonymous communication on the public network. By using the Tor browser, users can hide their IP addresses and protect their privacy.

[0013] Defects:

[0014] 1) Tor does not effectively protect users. Tor is not safe for attackers who can observe the traffic flowing in and out of users. There are simple and effective technologies that can associate these traffics in different places through pattern recognition.

[0015] 2) Tor hidden services are hosted and run on a server in the network. These fixed servers are like sitting ducks. The server will first receive all request traffic and then process it through the server. Summary of the invention

[0016] In view of this, the purpose of the present invention is to propose a method and system for preventing IP reverse query, so as to solve the technical problem that the prior art cannot truly effectively and comprehensively prevent IP from being reversed.

[0017] A system for preventing IP reverse lookup, comprising:

[0018] The system kernel uses virtualization components, and is equipped with HOST space and VM space;

[0019] The HOST space is used for access user authentication; the VM space is used to bind the authenticated user to the intranet address.

[0020] Furthermore, the HOST space also includes: an authentication component, an API component, a dialing component, a policy component, a management component and an address component.

[0021] A method for preventing IP reverse lookup comprises the following steps:

[0022] The method comprises the following steps:

[0023] S1. The user performs identity authentication through the authentication component;

[0024] S2. After authentication, the policy component is called. The policy component selects different VM spaces according to the user's own set policy and performs PPPOE network access.

[0025] S3. Call the dial-up component, which controls the user's dial-in account;

[0026] S4. The policy component calls the address component, and binds the PPPOE IP address to the obtained intranet address through the address component.

[0027] The management component is used for WEB management.

[0028] The API component is used to call a third-party ISP.

[0029] The beneficial effect provided by the present invention is: through the authentication component, policy component and address component set in the HOST space, the user groups are classified and managed, so that different user groups can obtain different IP exits, achieving the technical effect of preventing IP from being reversed. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a schematic diagram of the system structure of the present invention;

[0031] Figure 2 It is a processing schematic diagram of the method of the present invention. DETAILED DESCRIPTION

[0032] To make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be further described below with reference to the accompanying drawings.

[0033] Before formally describing the present invention, the scheme of the present invention is first generally described for easy understanding.

[0034] Please refer to Figure 1 , Figure 1 It is a schematic diagram of the system structure of the present invention;

[0035] The system kernel uses virtualization components, and is equipped with HOST space and VM space;

[0036] The HOST space is used for access user authentication; the VM space is used to bind the authenticated user to the intranet address.

[0037] It should be noted that virtualization components refer to software, hardware, or a combination of the two that implement resource virtualization. Virtualization is a resource management technology that allows the abstraction and conversion of various physical resources of a computer (such as processors, memory, disk space, network adapters, etc.) so that these resources can be divided and combined to form one or more computer configuration environments. Virtualization technology can virtualize multiple virtual machines on a physical server or a set of hardware resources, allowing different application services to run on different virtual machines, thereby improving hardware utilization and reducing the application's dependence on the hardware platform.

[0038] In the present invention, the HOST space represents a local computer that can access other machines, which adopts a virtualized manner, and wherein the HOST space also includes: an authentication component, an API component, a dialing component, a policy component, a management component and an address component.

[0039] Please refer to Figure 2 , Figure 2 It is a processing schematic diagram of the method of the present invention.

[0040] A method for preventing IP reverse lookup, the method comprising the following steps:

[0041] S1. The user performs identity authentication through the authentication component;

[0042] It should be noted that during authentication, account and password authentication can be used, or more factors other than account and password can be used to uniquely identify the user;

[0043] S2. After authentication, the policy component is called. The policy component selects different VM spaces according to the user's own set policy and performs PPPOE network access.

[0044] It should be noted that the PPPoE network (English: Point-to-Point Protocol Over Ethernet) implements the point-to-point protocol on Ethernet. It is a network tunneling protocol that encapsulates the point-to-point protocol (PPP) in the Ethernet framework. Since the PPP protocol is integrated into the protocol, it implements functions such as identity authentication, encryption, and compression that traditional Ethernet cannot provide. It can also be used in protocol systems such as cable modems and digital subscriber lines (DSL) that provide access services to users using the Ethernet protocol.

[0045] S3. Call the dial-up component, which controls the user's dial-in account;

[0046] It should be noted that control specifically refers to: control of dial-up behavior, such as the survival / failure / reconnection operations of dial-in connections. Control can be based on time periods, such as hours / minutes / seconds, etc.

[0047] S4, the policy component calls the address component, and binds the PPPOE IP address with the obtained intranet address through the address component;

[0048] It should be noted that after the dial-up behavior occurs, the address will be bound. As long as the dial-in connection is alive, it will remain unchanged; the purpose of binding is to uniformly manage and audit the behavior of users who obtain different intranet addresses).

[0049] The management component is used for WEB management.

[0050] It should be noted that the web management here provides an entry for all component configurations, such as providing a GUI interface.

[0051] The API component is used to call a third-party ISP.

[0052] The present invention can perform internal policy configuration through the system's policy configuration component, and the API component is used to receive third-party linkage processing calls, such as when an ISP issues a redail instruction, the system will trigger redialing when it receives it) (Internet Service Provider), which is linked to external policies.

[0053] As an embodiment, the working principle of the present invention is described by way of example.

[0054] The present invention mainly manages user groups by classification. For example, the requesting users include two groups, namely user group 1 and user group 2.

[0055] After both user groups 1 and 2 are authenticated by the authentication component, the policy component is called, in which the pre-set user classification rules are saved.

[0056] The rules are as follows: If the user belongs to user group 1, he dials up to the Internet through the VM1 unit; if the user belongs to user group 2, he dials up to the Internet through the VM2 unit.

[0057] During the dial-up Internet access process, the policy component also calls the address component, and the address component binds the dial-up IP with the intranet address according to the user's classification (ie, whether the user belongs to user group 1 or user group 2).

[0058] The intranet is the communication network between the system of the present invention and the WEB server.

[0059] The present invention can enable different user groups to obtain different IP exits by classifying and managing user groups; in addition, it can be linked with external policies through third-party ISP calls. Through the above settings, it can be achieved to prevent IP from being reversed. If someone wants to reversely check the IP, what is actually found is a floating public network address, not a real IP address.

[0060] The beneficial effect of the present invention is that: through the authentication component, policy component and address component set in the HOST space, the user groups are classified and managed, so that different user groups can obtain different IP exits, achieving the technical effect of preventing IP from being reversed.

[0061] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A system for preventing IP reverse lookup, comprising: The hardware bottom layer and the system kernel are characterized in that: the system kernel adopts virtualization components and is provided with HOST space and VM space; The HOST space is used for access user authentication; the VM space is used to bind the authenticated user to the intranet address; The HOST space also includes: an authentication component, an API component, a dialing component, a policy component, a management component and an address component; The user performs identity authentication through the authentication component; After authentication, the policy component is called, which selects different VM spaces according to the user's own set policies and performs PPPOE network access; Call the dial-up component, which controls the user's dial-in account; The policy component calls the address component, and binds the PPPOE IP address with the obtained intranet address through the address component; The policy component is called, in which the pre-set user classification rules are saved; during the dial-up Internet access process, the policy component also calls the address component, and the address component binds the dial-up IP with the intranet address according to the user classification.

2. A method for preventing IP reverse lookup, applied to a system for preventing IP reverse lookup as claimed in claim 1, characterized in that: The method comprises the following steps: S1. The user performs identity authentication through the authentication component; S2. After authentication, the policy component is called. The policy component selects different VM spaces according to the user's own set policy and performs PPPOE network access. S3. Call the dial-up component, which controls the user's dial-in account; S4. The policy component calls the address component, and binds the PPPOE IP address to the obtained intranet address through the address component.

3. A method for preventing IP reverse lookup as claimed in claim 2, characterized in that: The management component is used for WEB management.

4. A method for preventing IP reverse lookup as claimed in claim 2, characterized in that: The API component is used to call a third-party ISP.

Images