Cross-protocol port knocking network service providing method and system

Abstract

The present application provides a network service provision method and system for cross-protocol port knocking, the method comprising: executing a monitoring operation on a network knocking port, the port comprising a TCP port and a UDP port; obtaining a user's first dynamic knocking data packet; decrypting and verifying the first dynamic knocking data packet; if the verification passes, opening and accessing another network knocking port; if accessible, obtaining, decrypting and verifying a second dynamic knocking data packet; if the verification passes, increasing the current dynamic knocking times by one; comparing the current dynamic knocking times with the maximum dynamic knocking times; if not less than, opening the dynamic network service port. The present application utilizes both the TCP protocol and the UDP protocol to dynamically knock on the network knocking port. After the user accesses the network knocking port according to the agreed rules, the dynamic network service port is only opened to the user IP, and the dynamic network service port is mapped to the real network service port, effectively avoiding attacks on network traffic.

Description

Technical Field

[0001] The present application relates to the field of network application technology, and in particular to a method and system for providing a network service through cross-protocol port knocking. Background Art

[0002] Network services usually listen for requests on fixed ports, which provides users with network access but also makes it easy for attackers to discover and attack these services.

[0003] In order to ensure the security of services, key ports and services need to be protected. Port stealth is a network security technology used to hide and protect network services. It achieves stealth by discarding all arriving data packets. When users need to access ports and services that are invisible to the outside world, port knocking technology can be used to implement access control to network services. Since the existence of network service ports is hidden, it is not perceptible to attackers whether the network service is online. Therefore, attackers cannot confirm whether the server is alive through scanners, effectively reducing malicious traffic and attack attempts. Even if network services such as remote desktop have vulnerabilities, attackers cannot exploit them without obtaining port access rights.

[0004] However, the flaw of port stealth network security technology is that when network traffic is monitored, attackers may be able to infer the correct knocking sequence and gain access rights to carry out network attacks. Summary of the invention

[0005] The present application provides a network service providing method and system for cross-protocol port knocking, which can solve the technical problem in the prior art of port stealth network security technology that when network traffic is monitored, attackers may infer the correct knocking sequence to obtain access rights and then launch network attacks.

[0006] In a first aspect, the present application provides a method for providing a network service by cross-protocol port knocking, comprising the following steps:

[0007] Step S0, performing the initialization operation of the hidden network port, including:

[0008] Initially set the network knock port number;

[0009] Initially setting a first knocking rule, wherein the first knocking rule includes a dynamic knocking number, a dynamic knocking protocol sequence, a first dynamic knocking data packet, and a method for generating a check character of the first dynamic knocking data packet;

[0010] Initially setting a second knocking rule, wherein the second knocking rule includes a dynamic knocking number, a dynamic knocking protocol sequence, a second dynamic knocking data packet, and a method for generating a check character of the second dynamic knocking data packet;

[0011] Step S1, executing a monitoring operation on a network knocking port, wherein the network knocking port includes at least a TCP port and a UDP port;

[0012] Step S2, obtaining a first dynamic knocking data packet of a user accessing a network knocking port according to a first knocking rule;

[0013] Step S3, decrypt and verify the first dynamic knocking data packet, if the verification passes, proceed to step S4, if the verification fails, then end;

[0014] Step S4, reset the current dynamic knocking times to zero, obtain and open another network knocking port according to the dynamic knocking protocol sequence, and access another network knocking port;

[0015] Step S5: if accessible, obtaining a second dynamic knocking data packet of the user accessing another network knocking port according to a second knocking rule, wherein the protocol sequence of the dynamic knocking is to access at least one TCP port and one UDP port;

[0016] Step S6, decrypt and verify the second dynamic knocking data packet, if the verification passes, proceed to step S7;

[0017] Step S7, increasing the current dynamic knocking times by one;

[0018] Step S8, comparing the current dynamic knocking times with the maximum dynamic knocking times;

[0019] Step S9: If the current number of dynamic knocking times is not less than the maximum number of dynamic knocking times, the dynamic network service port is opened.

[0020] In combination with the first aspect, in one implementation, before the step S1, performing a monitoring operation on a network knocking port, wherein the network knocking port includes at least one TCP port and one UDP port, further includes the following steps:

[0021] Step S0, initially setting the network knocking port number, the first knocking rule and the second knocking rule, the first knocking rule includes the dynamic knocking number, the dynamic knocking protocol sequence, the first dynamic knocking data packet and the check character generation method of the first dynamic knocking data packet, the second knocking rule includes the dynamic knocking number, the dynamic knocking protocol sequence, the second dynamic knocking data packet and the check character generation method of the second dynamic knocking data packet.

[0022] In combination with the first aspect, in one implementation, the step S2 obtains a first dynamic knocking data packet in which the user accesses the network knocking port according to the first knocking rule, wherein the first dynamic knocking data packet includes the current time, the maximum number of dynamic knocking times, the dynamic knocking protocol sequence, and the first verification string, and uses a public key to perform data encryption processing.

[0023] In combination with the first aspect, in one implementation, the step of setting the current dynamic knocking times to zero, acquiring and opening another network knocking port according to the dynamic knocking protocol sequence, and accessing another network knocking port further includes the following steps:

[0024] If the other network knocking port is inaccessible, the process returns to step S2 and obtains a first dynamic knocking data packet of the user accessing the network knocking port according to the first knocking rule.

[0025] In combination with the first aspect, in one implementation, in step S5, if accessible, obtaining a second dynamic knocking data packet of the user accessing another network knocking port according to a second knocking rule.

[0026] In combination with the first aspect, in one implementation, the protocol sequence of the dynamic knocking is a step of accessing a TCP port and a UDP port at least once, and the second dynamic knocking data packet includes the current time and a second verification string.

[0027] In combination with the first aspect, in one implementation, after the step of comparing the current dynamic knocking times with the maximum dynamic knocking times, the following steps are further included:

[0028] If the current number of dynamic knocking times is less than the maximum number of dynamic knocking times, return to the protocol sequence of dynamic knocking to obtain and open another network knocking port and access another network knocking port.

[0029] In combination with the first aspect, in one implementation, the step S9, if the current dynamic knocking number is not less than the maximum dynamic knocking number, after opening the dynamic network service port, further includes the following steps:

[0030] Periodically obtain the access connection status of dynamic network service ports;

[0031] If no access connection to the dynamic network service port is obtained within the period, the dynamic network service port is closed.

[0032] In combination with the first aspect, in one implementation, after the step of comparing the current dynamic knocking times with the maximum dynamic knocking times, the following steps are further included:

[0033] If the current dynamic knocking number is less than the maximum dynamic knocking number, return to repeatedly obtain the second dynamic knocking data packet of the user accessing another network knocking port according to the second knocking rule.

[0034] In a second aspect, the present application provides a network service providing system for cross-protocol port knocking, including:

[0035] A port monitoring execution module, used to perform a monitoring operation on a network knocking port, wherein the network knocking port includes at least one TCP port and one UDP port;

[0036] A first data packet acquisition module, used for acquiring a first dynamic knocking data packet of a user accessing a network knocking port according to a first knocking rule;

[0037] A first verification result acquisition module is in communication with the first dynamic knocking data packet acquisition module, and is used to decrypt and verify the first dynamic knocking data packet. If the verification passes, the process proceeds to step S4;

[0038] Another network port opening module is connected to the first verification result acquisition module for resetting the current dynamic knocking times to zero, acquiring and opening another network knocking port according to the dynamic knocking protocol sequence, and accessing another network knocking port.

[0039] A second data packet acquisition module is in communication with the another network port opening module, and is used to acquire, if accessible, a second dynamic knocking data packet of a user accessing another network knocking port according to a second knocking rule, wherein the protocol sequence of the dynamic knocking is to access a TCP port and a UDP port at least once;

[0040] A second verification result acquisition module, which is in communication with the second data packet acquisition module and is used to decrypt and verify the second dynamic knocking data packet;

[0041] A dynamic knocking times updating module, which is in communication with the second verification result obtaining module and is used to increase the current dynamic knocking times by one;

[0042] A comparison result acquisition module, which is in communication with the dynamic knocking times updating module and is used to compare the current dynamic knocking times with the maximum dynamic knocking times;

[0043] The dynamic network service port opening module is communicatively connected with the comparison result acquisition module, and is used to open the dynamic network service port if the current dynamic knocking number is not less than the maximum dynamic knocking number.

[0044] In a third aspect, the present application provides a computer-readable storage medium, on which a network service provider for cross-protocol port knocking is stored, wherein when the network service provider for cross-protocol port knocking is executed by a processor, the steps of the network service providing method for cross-protocol port knocking as described above are implemented. The beneficial effects brought about by the technical solution provided in the embodiment of the present application include at least:

[0045] The cross-protocol port knocking network service providing method provided by the present application utilizes both the TCP protocol and the UDP protocol to dynamically knock on the network knocking port. After the user accesses the network knocking port according to the agreed rules, the dynamic network service port is opened to enable authorized users to access the dynamic network service port, which can effectively avoid attacks on network traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A method flow chart of a network service providing method for cross-protocol port knocking provided in an embodiment of the present application;

[0047] Figure 2 A functional module block diagram of a system for providing a network service method for cross-protocol port knocking provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] The terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.

[0050] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0051] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0052] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0053] First, some technical terms in the present application are explained to facilitate those skilled in the art to understand the present application.

[0054] TCP: Transmission Control Protocol, transmission control protocol;

[0055] TCP port is the port set by the Transmission Control Protocol;

[0056] UDP: User Datagram Protocol, user-controlled protocol.

[0057] The UDP port is the port set according to the user control protocol.

[0058] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0059] First, please refer to Figure 1 , a network service providing method for cross-protocol port knocking provided by an embodiment of the present application includes the following steps:

[0060] Step S0, performing initialization operation on the network service port of the network service access system, making initial operation preparation for hiding the network service port, specifically including:

[0061] A. Initially set the network knock port number;

[0062] B. Initially setting a first knocking rule, wherein the first knocking rule includes a dynamic knocking number, a dynamic knocking protocol sequence, a first dynamic knocking data packet, and a method for generating a check character of the first dynamic knocking data packet.

[0063] C. Initially setting a second knocking rule, wherein the second knocking rule includes a dynamic knocking number, a dynamic knocking protocol sequence, a second dynamic knocking data packet, and a method for generating a check character of the second dynamic knocking data packet;

[0064] Step S1, executing a monitoring operation on a network knocking port, wherein the network knocking port includes at least a TCP port and a UDP port;

[0065] Step S2, obtaining a first dynamic knocking data packet of a user accessing a network knocking port according to a first knocking rule;

[0066] Step S3, identifying and obtaining the request IP address of the first dynamic knocking data packet, decrypting and verifying the first dynamic knocking data packet, if the verification passes, proceeding to step S4; if not, ending;

[0067] Step S4, reset the current dynamic knocking times to zero, obtain and open another network knocking port according to the dynamic knocking protocol sequence, and access another network knocking port; if accessible, proceed to step S5; if not accessible, return to step S2;

[0068] Step S5, obtaining a second dynamic knocking data packet of the user accessing another network knocking port according to the second knocking rule;

[0069] Step S6, decrypt and verify the second dynamic knocking data packet, if the verification passes, proceed to step S7, if the verification fails, then end;

[0070] Step S7, increasing the current dynamic knocking times by one;

[0071] Step S8, compare the current dynamic knocking number with the maximum dynamic knocking number, if it is not less than, proceed to step S9, if it is less than, return to step S5, and repeat the acquisition operation of the second dynamic knocking data packet;

[0072] Step S9: If the current number of dynamic knocking times is not less than the maximum number of dynamic knocking times, the dynamic network service port is opened.

[0073] The cross-protocol port knocking network service provision method provided by the present application hides the existence of the network service port. The network service port is not open to the public by default, so even if there is a vulnerability in the open network service, the attacker cannot exploit it. Whether the network service is online is not perceptible to the attacker, so the attacker cannot confirm whether the server is alive through the scanner, effectively reducing malicious traffic and attack attempts. Even if there is a vulnerability in the network service, the attacker cannot exploit it without obtaining port access rights.

[0074] Port knocking rules are known only to trusted users. Therefore, to some extent, it is also a user identity authentication mechanism. Only after the user correctly executes the network knocking port according to the rules will he be allowed to access the corresponding network service, that is, a layer of user identity authentication protection is added before the network service is accessed.

[0075] Since the network listening port of the network service access system does not respond to any data packets during the entire knock and knock authentication process, combined with the setting of the cross-protocol dynamic knock port, even if data is captured during the communication process, it is difficult for attackers to use it to carry out further attacks, thereby achieving authorized users' access to the network service port and avoiding attacks on network traffic;

[0076] The method is flexible in setting and does not require modification of the original network service program. It only requires additional knocking rules to enhance the security of the network service. It has a wide range of applications and strong operability.

[0077] The final network service port is also dynamically generated and mapped to the real network service port through port mapping to prevent data packets from being captured and replayed. In addition, if there are multiple real network service ports, there is no need to modify the real network service port, and it can be easily responded and processed according to the method provided in this application.

[0078] In one embodiment, the step S0, executing the initialization operation of the hidden network port, further includes the following steps:

[0079] D. Initial setting of dynamic port algorithm, which is an algorithm for calculating the next dynamic knocking port number according to the protocol sequence of dynamic knocking;

[0080] E. Initially set the service idle timeout time T;

[0081] F. Initially set the public key;

[0082] G. Initially set the private key.

[0083] In one embodiment, the first dynamic knocking data packet in step S2 at least includes the current time, the maximum number of dynamic knocking times, the protocol sequence of the dynamic knocking, the first verification string, etc., wherein the first verification string is generated according to the current time, the user IP address, the number of dynamic knocking times, the protocol sequence of the dynamic knocking, the first verification string, etc. in the first dynamic knocking data packet according to the rules. The first dynamic knocking data packet is encrypted using the public key.

[0084] In one embodiment, the step S4, setting the current dynamic knocking times to zero, acquiring and opening another network knocking port according to the dynamic knocking protocol sequence, and accessing another network knocking port, further includes the following steps:

[0085] If the other network knocking port is inaccessible, return to step S2 again, obtain the first dynamic knocking data packet of the user accessing the network knocking port according to the first knocking rule, until the first dynamic knocking data packet is obtained and decrypted and verified.

[0086] In one embodiment, in step S5, if accessible, obtaining a second dynamic knocking data packet in which the user accesses another network knocking port according to a second knocking rule, wherein the protocol sequence of the dynamic knocking is to access at least one TCP port and one UDP port. The second dynamic knocking data packet includes the current time and a second verification string, etc., wherein the second verification string is generated according to the rules based on the user's IP address and the current time in the data packet, and the second dynamic knocking data packet is encrypted using a private key.

[0087] In one embodiment, after the step S8, comparing the current dynamic knocking times with the maximum dynamic knocking times, the following steps are further included:

[0088] If the current dynamic knocking number is less than the maximum dynamic knocking number, return to repeatedly obtain the second dynamic knocking data packet of the user accessing another network knocking port according to the second knocking rule.

[0089] In one embodiment, after the step S8, comparing the current dynamic knocking times with the maximum dynamic knocking times, the following steps are further included:

[0090] If the current number of dynamic knocking times is less than the maximum number of dynamic knocking times, it is determined that the number of knocking times for another network knocking port in the current round has not reached the agreed maximum number of dynamic knocking times, and the process returns to the dynamic knocking protocol sequence to obtain and open another network knocking port and access the other network knocking port.

[0091] In one embodiment, the step S9, if the current dynamic knocking number is not less than the maximum dynamic knocking number, opening the dynamic network service port, specifically includes the following steps:

[0092] Step S91: if the current dynamic knocking number is not less than the maximum dynamic knocking number, calculate the dynamic network service port according to the dynamic knocking port algorithm, open the dynamic network service port and map it to the real service port of the network service, and set the user IP address to access the dynamic network service port;

[0093] Step S92: The user calculates the dynamic network service port according to the dynamic port algorithm and attempts to access the dynamic network service port of the system. If the dynamic network service port is accessible, the process proceeds to step S93; otherwise, the process jumps to step S2.

[0094] Step S93: The user accesses the network service normally through the dynamic network service port of the network access system from the IP address.

[0095] In one embodiment, the step S9, if the current dynamic knocking number is not less than the maximum dynamic knocking number, after opening the dynamic network service port, further includes the following steps:

[0096] Periodically obtain the access connection status of the dynamic network service port at interval T. The interval time can be set in seconds, minutes, hours or days according to the actual situation of the application system;

[0097] If no access connection to the dynamic network service port is obtained within the period, the dynamic network service port is closed.

[0098] Second, as Figure 2 As shown, the present application provides a network service providing system for cross-protocol port knocking, including a port monitoring execution module 100, a first data packet acquisition module 200, a first verification result acquisition module 300, another network port opening module 400, a second data packet acquisition module 500, a second verification result acquisition module 600, a dynamic knocking times update module 700, a comparison result acquisition module 800, and a dynamic network service port opening module 900. The port monitoring execution module 100 is used to perform a monitoring operation on a network knocking port, and the network knocking port includes at least one TCP port and one UDP port;

[0099] The first data packet acquisition module 200 is used to acquire a first dynamic knocking data packet of a user accessing a network knocking port according to a first knocking rule; the first verification result acquisition module 300 is connected in communication with the first dynamic knocking data packet acquisition module 200, and is used to decrypt and verify the first dynamic knocking data packet; another network port opening module 400 is connected in communication with the first verification result acquisition module 300, and is used to reset the current dynamic knocking times to zero, acquire and open another network knocking port according to the protocol sequence of the dynamic knocking, and access another network knocking port; the second data packet acquisition module 500 is connected in communication with the another network port opening module 400, and is used to acquire a second dynamic knocking data packet of a user accessing another network knocking port according to the second knocking rule if accessible, and the protocol sequence of the dynamic knocking is to access at least one TCP port and one UDP port; the second verification result acquisition module 600 is connected in communication with the second data packet acquisition module 500, and is used to decrypt and verify the second dynamic knocking data packet; the dynamic knocking times updating module 700 is connected in communication with the second verification result acquisition module 600, and is used to increase the current dynamic knocking times by one;

[0100] The comparison result acquisition module 800 is communicated with the dynamic knocking number update module 700, and is used to compare the current dynamic knocking number with the maximum dynamic knocking number; the dynamic network service port opening module 900 is communicated with the comparison result acquisition module 800, and is used to open the dynamic network service port if the current dynamic knocking number is not less than the maximum dynamic knocking number.

[0101] Among them, the functional implementation of each module in the above-mentioned cross-protocol port knocking network service providing system corresponds to the various steps in the above-mentioned cross-protocol port knocking network service providing method embodiment, and its functions and implementation processes will not be repeated here one by one.

[0102] On the third aspect, an embodiment of the present application provides a network service providing device for cross-protocol port knocking. The network service providing device for cross-protocol port knocking can be a personal computer (PC), a laptop computer, a server, or other device with data processing capabilities.

[0103] In an embodiment of the present application, a network service providing device for cross-protocol port knocking may include a processor, a memory, a communication interface, and a communication bus.

[0104] The communication bus may be of any type and is used to interconnect the processor, the memory, and the communication interface.

[0105] The communication interface includes input / output (I / O) interfaces, physical interfaces, and logical interfaces, which are used to interconnect devices within the network service provider for cross-protocol port knocking, and interfaces used to interconnect the network service provider for cross-protocol port knocking with other devices (such as other computing devices or user devices). The physical interface can be an Ethernet interface, a fiber optic interface, an ATM interface, etc.; the user device can be a display, a keyboard, etc.

[0106] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0107] The processor may be a general-purpose processor, and the general-purpose processor may call the network service provider for cross-protocol port knocking stored in the memory, and execute the network service providing method and system for cross-protocol port knocking provided by the embodiment of the present application. For example, the general-purpose processor may be a central processing unit (CPU). Among them, the method executed when the network service provider for cross-protocol port knocking is called may refer to the various embodiments of the network service providing method and system for cross-protocol port knocking of the present application, which will not be repeated here.

[0108] In a fourth aspect, an embodiment of the present application also provides a readable storage medium.

[0109] The readable storage medium of the present application stores a network service provider for cross-protocol port knocking, wherein when the network service provider for cross-protocol port knocking is executed by a processor, the steps of the network service providing method and system for cross-protocol port knocking as described above are implemented.

[0110] Among them, the method implemented when the cross-protocol port knocking network service provider is executed can refer to the various embodiments of the cross-protocol port knocking network service providing method and system of the present application, and will not be repeated here.

[0111] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0112] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0113] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for providing a network service by cross-protocol port knocking, characterized in that: The following steps are involved: Step S1, executing a monitoring operation on a network knocking port, wherein the network knocking port includes at least a TCP port and a UDP port; The step S1, performing a monitoring operation on a network knocking port, wherein the network knocking port includes at least one TCP port and one UDP port, further includes the following steps: Step S0, performing initialization operation on the network service port of the network service access system, making initial operation preparation for hiding the network service port, specifically including: A. Initially set the network knock port number; B. Initially setting a first knocking rule, wherein the first knocking rule includes a dynamic knocking number, a dynamic knocking protocol sequence, a first dynamic knocking data packet, and a method for generating a check character of the first dynamic knocking data packet, C. Initially setting a second knocking rule, wherein the second knocking rule includes a dynamic knocking number, a dynamic knocking protocol sequence, a second dynamic knocking data packet, and a method for generating a check character of the second dynamic knocking data packet; D. Initial setting of dynamic port algorithm, which is an algorithm for calculating the next dynamic knocking port number according to the protocol sequence of dynamic knocking; E. Initially set the service idle timeout; F. Initially set the public key; G. Initial setting of private key; Step S2, obtaining a first dynamic knocking data packet of a user accessing a network knocking port according to a first knocking rule; The step S2, obtaining a first dynamic knocking data packet of a user accessing a network knocking port according to a first knocking rule, wherein the first dynamic knocking data packet includes a current time, a maximum number of dynamic knocking times, a dynamic knocking protocol sequence, and a first check string, and encrypting the data using a public key; Step S3, decrypt and verify the first dynamic knocking data packet, if the verification passes, proceed to step S4; Step S4, reset the current dynamic knocking times to zero, obtain and open another network knocking port according to the dynamic knocking protocol sequence, and access another network knocking port; Step S5: if accessible, obtaining a second dynamic knocking data packet of the user accessing another network knocking port according to a second knocking rule, wherein the protocol sequence of the dynamic knocking is to access a TCP port and a UDP port at least once; Step S6, decrypt and verify the second dynamic knocking data packet, if the verification passes, proceed to step S7; Step S7, increasing the current dynamic knocking times by one; Step S8, comparing the current dynamic knocking times with the maximum dynamic knocking times; Step S9: If the current number of dynamic knocking times is not less than the maximum number of dynamic knocking times, the dynamic network service port is opened; The step S9, if the current dynamic knocking number is not less than the maximum dynamic knocking number, opening the dynamic network service port, specifically includes the following steps: Step S91: if the current dynamic knocking number is not less than the maximum dynamic knocking number, calculate the dynamic network service port according to the dynamic knocking port algorithm, open the dynamic network service port and map it to the real service port of the network service, and set the user IP address to access the dynamic network service port; Step S92: The user calculates the dynamic network service port according to the dynamic port algorithm and attempts to access the dynamic network service port of the system. If the dynamic network service port is accessible, the process proceeds to step S93; otherwise, the process jumps to step S2. Step S93: The user accesses the network service normally through the dynamic network service port of the network access system from the IP address.

2. The network service providing method of cross-protocol port knocking according to claim 1, characterized in that: The method of setting the current dynamic knocking times to zero, acquiring and opening another network knocking port according to the dynamic knocking protocol sequence, and accessing another network knocking port further includes the following steps: If the other network knocking port is inaccessible, the process returns to step S2 and obtains a first dynamic knocking data packet of the user accessing the network knocking port according to the first knocking rule.

3. The network service providing method of cross-protocol port knocking according to claim 1, characterized in that: In step S5, if accessible, obtain a second dynamic knocking data packet of the user accessing another network knocking port according to the second knocking rule, wherein the protocol sequence of the dynamic knocking is to access at least one TCP port and one UDP port, and the second dynamic knocking data packet includes the current time and a second verification string.

4. The network service providing method of cross-protocol port knocking according to claim 1, characterized in that: After the step of comparing the current dynamic knocking times with the maximum dynamic knocking times, the following steps are also included: If the current number of dynamic knocking times is less than the maximum number of dynamic knocking times, return to the protocol sequence of dynamic knocking to obtain and open another network knocking port and access another network knocking port.

5. The network service providing method of cross-protocol port knocking according to claim 1, characterized in that: The step S9, if the current dynamic knocking number is not less than the maximum dynamic knocking number, after opening the dynamic network service port, further includes the following steps: Periodically obtain the access connection status of dynamic network service ports; If no access connection to the dynamic network service port is obtained within the period, the dynamic network service port is closed.

6. The network service providing method of cross-protocol port knocking according to claim 1, characterized in that: After the step of comparing the current dynamic knocking times with the maximum dynamic knocking times, the following steps are also included: If the current dynamic knocking number is less than the maximum dynamic knocking number, return to repeatedly obtain the second dynamic knocking data packet of the user accessing another network knocking port according to the second knocking rule.

7. A network service providing system for cross-protocol port knocking, characterized in that: include: A port monitoring execution module, used to perform a monitoring operation on a network knocking port, wherein the network knocking port includes at least one TCP port and one UDP port; The performing of the monitoring operation on the network knocking port, wherein the network knocking port includes at least one TCP port and one UDP port, further includes: Perform initialization operations on the network service port of the network service access system to prepare for the initial operation of hiding the network service port, including: A. Initially set the network knock port number; B. Initially setting a first knocking rule, wherein the first knocking rule includes a dynamic knocking number, a dynamic knocking protocol sequence, a first dynamic knocking data packet, and a method for generating a check character of the first dynamic knocking data packet, C. Initially setting a second knocking rule, wherein the second knocking rule includes a dynamic knocking number, a dynamic knocking protocol sequence, a second dynamic knocking data packet, and a method for generating a check character of the second dynamic knocking data packet; D. Initial setting of dynamic port algorithm, which is an algorithm for calculating the next dynamic knocking port number according to the protocol sequence of dynamic knocking; E. Initially set the service idle timeout; F. Initially set the public key; G. Initial setting of private key; A first data packet acquisition module, used for acquiring a first dynamic knocking data packet of a user accessing a network knocking port according to a first knocking rule; The first dynamic knocking data packet obtained by the user accessing the network knocking port according to the first knocking rule includes the current time, the maximum number of dynamic knocking times, the protocol sequence of the dynamic knocking and the first verification string, and uses the public key to perform data encryption processing; A first verification result acquisition module is in communication with the first dynamic knocking data packet acquisition module, and is used to decrypt and verify the first dynamic knocking data packet. If the verification passes, the operation of "setting the current dynamic knocking times to zero, obtaining and opening another network knocking port according to the dynamic knocking protocol sequence, and accessing another network knocking port" is performed; Another network port opening module is connected to the first verification result acquisition module for resetting the current dynamic knocking times to zero, acquiring and opening another network knocking port according to the dynamic knocking protocol sequence, and accessing another network knocking port; A second data packet acquisition module is in communication with the another network port opening module, and is used to acquire, if accessible, a second dynamic knocking data packet of a user accessing another network knocking port according to a second knocking rule, wherein the protocol sequence of the dynamic knocking is to access a TCP port and a UDP port at least once; A second verification result acquisition module is in communication with the second data packet acquisition module and is used to decrypt and verify the second dynamic knocking data packet. If the verification passes, the operation of "increase the current dynamic knocking times by one" is entered; A dynamic knocking times updating module, which is in communication with the second verification result obtaining module and is used to increase the current dynamic knocking times by one; A comparison result acquisition module, which is in communication connection with the dynamic knocking number updating module and is used for comparing the current dynamic knocking number with the maximum dynamic knocking number; A dynamic network service port opening module, which is in communication with the comparison result acquisition module and is used to open the dynamic network service port if the current dynamic knocking number is not less than the maximum dynamic knocking number; If the current number of dynamic knocking times is not less than the maximum number of dynamic knocking times, the dynamic network service port is opened, specifically including: If the current dynamic knocking count is not less than the maximum dynamic knocking count, the dynamic network service port is calculated according to the dynamic knocking port algorithm, the dynamic network service port is opened and mapped to the real service port of the network service, and the user IP address is allowed to access the dynamic network service port; The user calculates the dynamic network service port according to the dynamic port algorithm and tries to access the dynamic network service port of the system. If the dynamic network service port is accessible, the operation "user accesses the dynamic network service port of the system through the network from the IP address to access the network service normally" will be entered. Otherwise, the operation "obtain the first dynamic knocking data packet of the user accessing the network knocking port according to the first knocking rule" will be jumped to. Users can access network services normally through the dynamic network service port of the network access system from the IP address.

Images