A method and system for monitoring random number security based on network protocol

Abstract

The present invention discloses a method and system for random number security monitoring based on network protocol (patent name: shall not exceed 25 characters, and the following includes method and system, system shall be written), which relates to the field of random number detection, and the detection method comprises: obtaining the interactive random number generated by the host through the network protocol handshake; obtaining the previous random number of the host IP stored in the database; calculating the similarity between the interactive random number and the previous random number through the similarity algorithm; storing the interactive random number in the database; performing randomness detection on the interactive random number; performing weighted average calculation on the randomness of the interactive random number to obtain the mean; packaging the interactive random number and sending it to the router to end the detection; packaging the interactive random number and sending it to the router and sending a notification to the user. The beneficial effect achieved by the present invention is: solving the problem of network security environment detection.

Description

Technical Field

[0001] The invention relates to the field of random number detection, and in particular to a method and system for random number security monitoring based on network protocols. Background Art

[0002] The use of random numbers in network protocols is very critical, especially in ensuring communication security. Here are some network protocols that use random numbers and their importance:

[0003] TLS / SSL (Secure Sockets Layer): TLS / SSL is a widely used secure communication protocol for securely transmitting data between a client and a server. During the TLS / SSL handshake process, random numbers are used to generate session keys, which is a critical step in ensuring the security of subsequent communications. The client and server each generate a random number and exchange it with each other, which is then combined with the pre-shared key (if any) and the public key in the server certificate to jointly generate a session key. The use of random numbers prevents the prediction and reuse of session keys, thereby enhancing the security of communications.

[0004] IPsec (Internet Protocol Security): IPsec is a set of network protocols that provide encryption and authentication services at the IP layer. In IPsec, random numbers may be used to generate and manage keys, as well as to authenticate the authenticity of messages.

[0005] IKE (Internet Key Exchange): IKE is a protocol used for key management in IPsec. In the IKE protocol, the two parties negotiate security parameters, including encryption algorithms, key lengths, etc., by exchanging information such as random numbers, and generate a shared key.

[0006] HTTPS communication: During HTTPS communication, the client and server establish secure communication by exchanging random numbers. These random numbers are used to generate a random password string called the Pre-master secret, which is then used to generate the master secret, which in turn derives the key used to encrypt HTTP communication.

[0007] SSL, the full name of "Secure Sockets Layer", is a network security protocol that is widely used to protect network communication security and provide encryption and identity authentication for websites and applications. Its main principle is to establish a secure channel on the transport layer to ensure the secure transmission of data through encryption, authentication and integrity protection mechanisms.

[0008] At present, patents for network protocols are mainly based on the security implementation of protocol algorithms. They do not conduct security risk assessment and detection on the security of random numbers and issue risk warnings based on the assessment and detection results. The security of random numbers is mainly determined by the randomness of random numbers. Insufficient randomness can lead to the following three problems: (1) Session keys are easy to crack: Insufficient random numbers may result in the generated session keys being not complex enough, and the keys can be directly obtained through brute force, thereby stealing user data; (2) Encryption algorithms are easy to attack: Using random numbers with insufficient randomness to initialize encryption algorithms will make the encryption algorithms less resistant to attacks and more vulnerable to attacks; (3) Authentication failure: When using random numbers with insufficient randomness for identity authentication, forged random numbers can bypass the identity authentication mechanism and impersonate legitimate users.

[0009] Therefore, the present invention proposes a method and system for random number security monitoring based on network protocol. Summary of the invention

[0010] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a method and system for random number security monitoring based on network protocols, which solves the problem of detecting network environment security and risk notification under network protocols.

[0011] A method for random number security monitoring based on network protocol,

[0012] Step S1, obtaining the interactive random number of the host network protocol handshake;

[0013] Step S2, obtaining the previous random number of the host IP stored in the database;

[0014] Step S3, calculating the similarity between the interactive random number and the previous random number by using a similarity algorithm;

[0015] If the similarity does not exceed the first preset threshold, proceed to step S8;

[0016] If the similarity exceeds the first preset threshold, proceed to step S4;

[0017] Step S4, storing the interactive random number in a database;

[0018] Step S5, performing randomness detection on the interactive random number;

[0019] If the randomness test fails, proceed to step S8;

[0020] If the randomness test passes, proceed to step S6;

[0021] Step S6, performing weighted average calculation on the randomness of the interactive random numbers to obtain a mean value;

[0022] If the mean value exceeds the second preset threshold, proceed to step S8;

[0023] If the mean value does not exceed the second preset threshold, proceed to step S7;

[0024] Step S7, packing the interactive random number and sending it to the router, and ending the detection;

[0025] Step S8: Pack the interactive random number and send it to the router and notify the user.

[0026] Furthermore, the step S2 specifically includes:

[0027] Retrieve previous random numbers stored in the database through the host IP address;

[0028] If there is no previous random number in the retrieved database, proceed to step S4;

[0029] If the previous random numbers are obtained, the previous random numbers are traversed and obtained, and step S3 is performed in sequence.

[0030] Further, the calculating the similarity between the interactive random number and the previous random number by using a similarity algorithm includes: calculating the similarity between the interactive random number and the previous random number by using a Jaccard coefficient algorithm, a cosine similarity algorithm, and a Smith-Waterman algorithm respectively;

[0031] Jaccard coefficient algorithm, obtains the character set of the interactive random number and the character set of the previous random number, calculates the ratio of the intersection and union of the two character sets, that is, Jaccard coefficient, and uses Jaccard coefficient as an indicator of the similarity of the string attributes of the interactive random number and the previous random number;

[0032] Cosine similarity algorithm, obtain the first vector of the interactive random number and the second vector of the previous random number, and measure the angle between the two vectors through cosine similarity. If the angle is smaller, the cosine similarity is greater, and the first vector and the second vector are more similar;

[0033] Smith-Waterman algorithm, finds similar substrings in the interactive random number and the previous random number, and calculates the sum of the scores of the matching substrings. The higher the score, the higher the similarity between the interactive random number and the previous random number;

[0034] If any one of the Jaccard coefficient, the cosine similarity and the sum of the substring scores exceeds the first preset threshold, proceed to step S8;

[0035] If the Jaccard coefficient, the cosine similarity and the sum of the substring scores are not exceeded, the process proceeds to step S4.

[0036] Furthermore, the randomness detection includes at least one of the following detection methods: bit frequency detection, intra-block frequency detection, poker detection, overlapping subsequence detection, total run detection, run distribution detection, maximum run detection within a block, binary derivation detection, autocorrelation detection, matrix order detection, cumulative sum detection, approximate entropy detection, linear complexity detection, Maurer general statistics detection and discrete Fourier detection.

[0037] Furthermore, the weighted average calculation of the randomness of the interactive random number to obtain the mean value includes:

[0038] The moving average weighted method is used to calculate the mean of the randomness of the interactive random numbers.

[0039] Furthermore, the moving average weighting obtains the weighted weight of the interactive random number through a Kalman filter.

[0040] Furthermore, the step S8 specifically includes:

[0041] When the similarity exceeds the first preset threshold, the randomness test fails, or the weighted average exceeds the second preset threshold, the interactive random number is packaged and sent to the router and a warning is sent to the user;

[0042] If the similarity exceeds the first preset threshold and exceeds the first interception threshold or the weighted average exceeds the second preset threshold and exceeds the second interception threshold, an alarm is returned to the user and an interception command is triggered;

[0043] The interception command includes discarding the current interaction random number and notifying the user that the interception has occurred.

[0044] Further, sending a warning to the user or sending an interception notification to the user includes:

[0045] Email notification, by traversing the email addresses in turn to send warnings or interception notifications to the email addresses;

[0046] WeChat notification, by traversing WeChat OpenID in turn, sends warnings or interception notifications to WeChat OpenID.

[0047] The present invention also provides a random number security monitoring system based on network protocol, comprising: an interactive random number module, a similarity detection module, a randomness detection module, a weighted average detection module, a packaging module and a notification module;

[0048] The interactive random number module is used to obtain the interactive random number generated by the host network protocol handshake;

[0049] The similarity detection module is used to obtain the similarity between the interactive random number and the previous random number. If the similarity value exceeds a first preset threshold, the detection fails;

[0050] The randomness detection module is used to detect the randomness of the interactive random number;

[0051] The weighted average detection module is used to perform weighted average calculation on the randomness of the interactive random number to obtain a mean value, and determine whether the mean value exceeds a second preset threshold value;

[0052] The packaging module is used to package the interactive random number and send it to the router;

[0053] The notification module is used to issue a warning or interception command to the user.

[0054] The present invention has the following advantages:

[0055] The present invention can obtain complete network protocol handshake interaction random numbers by being deployed to the network layer of a router or core switch and the layers above it; therefore, when in use, the network administrator does not need to modify any network connection mode and topology structure; it can be conveniently used in an environment where network security is effectively ensured;

[0056] The present invention evaluates whether the average value of random numbers generated by the network host during the entire network life cycle meets the security requirements of the network by calculating the weighted average value of historical interactive random numbers, thereby reflecting whether the network host has a long-term risk of insufficient random numbers;

[0057] The present invention can inform the user in time through various ways. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 It is a diagram of the method steps of the present invention. DETAILED DESCRIPTION

[0059] The present invention is further described below in conjunction with the accompanying drawings, but the protection scope of the present invention is not limited to the following description.

[0060] It should be noted that the directions or positional relationships indicated by "left", "right", etc. are based on the directions or positional relationships shown in the accompanying drawings, or are the directions or positional relationships in which the inventive product is usually placed when in use, or are the directions or positional relationships commonly understood by those skilled in the art. Such terms are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as a limitation on the present invention.

[0061] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features and technical solutions in the embodiments may be combined with each other.

[0062] Embodiment 1

[0063] like Figure 1 As shown, the present invention proposes a method for random number security monitoring based on network protocol.

[0064] Step S1, obtaining the interactive random number generated by the host through the network protocol handshake;

[0065] Step S2, obtaining the previous random number of the host IP stored in the database;

[0066] Step S3, calculating the similarity between the interactive random number and the previous random number by using a similarity algorithm;

[0067] If the similarity does not exceed the first preset threshold, proceed to step S8;

[0068] If the similarity exceeds the first preset threshold, proceed to step S4;

[0069] Step S4, storing the interactive random number in a database;

[0070] Step S5, performing randomness detection on the interactive random number;

[0071] If the randomness test fails, proceed to step S8;

[0072] If the randomness test passes, proceed to step S6;

[0073] Step S6, performing weighted average calculation on the randomness of the interactive random numbers to obtain a mean value;

[0074] If the mean value exceeds the second preset threshold, proceed to step S8;

[0075] If the mean value does not exceed the second preset threshold, proceed to step S7;

[0076] Step S7, packing the interactive random number and sending it to the router, and ending the detection;

[0077] Step S8: Pack the interactive random number and send it to the router and notify the user.

[0078] When working, the network protocol is used to ensure the security of data transmission, ensuring that user data is not stolen, tampered with or forged during the transmission process; for this, the present invention is used to sequentially detect the interactive random numbers generated in the network protocol; perform similarity detection on the interactive random numbers and the previous random numbers stored in the database, perform randomness detection on the interactive random numbers, and perform weighted average detection on the historical interactive random numbers for randomness detection, the purpose of which is to determine whether the randomness of the currently generated interactive random numbers is insufficient;

[0079] The present invention will be deployed at the network layer of a router or switch and at the layers above it. Users can monitor and protect the network environment without modifying the network interception method or the network topology. The present invention detects the validity of interactive random numbers through three dimensions of similarity, randomness and weighted average, and promptly informs the user through threshold judgment to protect network security. The present invention can be applied to monitoring TLS / SSL network protocols, IPsec network protocols and HTTPS network communication protocols, and the method of the present invention has universal applicability.

[0080] Furthermore, the step S2 specifically includes:

[0081] Retrieve previous random numbers stored in the database through the host IP address;

[0082] If there is no previous random number in the retrieved database, proceed to step S4;

[0083] If the previous random numbers are obtained, the previous random numbers are traversed and obtained, and step S3 is performed in sequence.

[0084] Further, the calculating the similarity between the interactive random number and the previous random number by using a similarity algorithm includes: calculating the similarity between the interactive random number and the previous random number by using a Jaccard coefficient algorithm, a cosine similarity algorithm, and a Smith-Waterman algorithm respectively;

[0085] Jaccard coefficient algorithm, obtains the character set of the interactive random number and the character set of the previous random number, calculates the ratio of the intersection and union of the two character sets, that is, Jaccard coefficient, and uses Jaccard coefficient as an indicator of the similarity of the string attributes of the interactive random number and the previous random number;

[0086] Cosine similarity algorithm, obtain the first vector of the interactive random number and the second vector of the previous random number, and measure the angle between the two vectors through cosine similarity. If the angle is smaller, the cosine similarity is greater, and the first vector and the second vector are more similar;

[0087] Smith-Waterman algorithm, finds similar substrings in the interactive random number and the previous random number, and calculates the sum of the scores of the matching substrings. The higher the score, the higher the similarity between the interactive random number and the previous random number;

[0088] If any one of the Jaccard coefficient, the cosine similarity and the sum of the substring scores exceeds the first preset threshold, proceed to step S8;

[0089] If the Jaccard coefficient, the cosine similarity or the sum of the substring scores does not exceed the first preset threshold, the process proceeds to step S4.

[0090] Further, the randomness detection includes at least one of the following detection methods: bit frequency detection, intra-block frequency detection, poker detection, overlapping subsequence detection, total run detection, run distribution detection, maximum run detection within a block, binary derivation detection, autocorrelation detection, matrix order detection, cumulative sum detection, approximate entropy detection, linear complexity detection, Maurer general statistics detection and discrete Fourier detection;

[0091] When the interactive random number passes any one of the fifteen tests including bit frequency detection, intra-block frequency detection, poker detection, overlapping subsequence detection, total run detection, run distribution detection, maximum run detection within a fast, binary derivation detection, autocorrelation detection, matrix order detection, cumulative sum detection, approximate entropy detection, linear complexity detection, Maurer general statistics detection and discrete Fourier detection, the number passes. The present invention also supports the extended use of other random number related detection methods.

[0092] Furthermore, the weighted average includes: using moving average weighting to calculate the mean of the randomness of the interactive random number, and the moving average weighting obtains the weighted weight of the interactive random number through a Kalman filter.

[0093] Moving weighted average calculation is used to obtain multiple groups of historical interactive random numbers in the database. The weight of each interactive random number is determined according to the position of the data point equivalent to the current time point. Newer interactive random numbers are given larger weights, and newer interactive random numbers better reflect the current actual situation. Interactive random numbers with later time points are given smaller weights, and the reference value of interactive random numbers decreases over time.

[0094] In the specific implementation, a fixed time window is first set, which includes N interactive random numbers. Then, the weight of each interactive random number relative to the latest time is determined, and the weighted average of the interactive random numbers in the window is calculated. When a new interactive random number arrives, the time window will move a certain position according to the preset time period, exclude the latest interactive random number, and accommodate the latest interactive random number, and recalculate the weighted average. The weighted average obtained from each calculation is counted, and the mean of the interactive random number is reflected by the weighted average.

[0095] The Kalman recorder predicts the state of the time window after the preset time in the next moment through the state of the initial time window; when the latest interactive random number arrives, that is, when the time window completes the movement, the Kalman filter obtains the Kalman gain based on the prediction covariance and the observation noise covariance, and the Kalman gain is a weight value;

[0096] Now if the uncertainty of the prediction is high (i.e. the prediction covariance is large), the Kalman gain will be biased towards the observed value; conversely, if the uncertainty of the observation is high (i.e. the observation noise covariance is large), the Kalman gain will be biased towards the predicted value; after determining the current Kalman gain, the Kalman filter uses the Kalman gain and the observed value to update the predicted state;

[0097] In the moving weighted average calculation, a weight is assigned to each data point based on the reliability of the data or other criteria; in the Kalman filter, the Kalman gain is calculated based on the uncertainty of the prediction and observation, and the Kalman gain is used as the weight of the data point;

[0098] The Kalman filter achieves an effect similar to weighted averaging by calculating the Kalman gain, thereby estimating the state of the system in noisy observation data; the calculation of the Kalman gain is based on the uncertainty of the prediction and observation, ensuring that the contribution of the predicted value and the observed value can be reasonably weighed during the update process; this weighted averaging idea enables the Kalman filter to obtain accurate state estimation results in a variety of application scenarios.

[0099] Furthermore, the step S8 comprises:

[0100] When the similarity exceeds the first preset threshold, the randomness test fails, or the weighted average exceeds the second preset threshold, the interactive random number is packaged and sent to the router and a warning is sent to the user;

[0101] If the similarity exceeds the first preset threshold and exceeds the first interception threshold or the weighted average exceeds the second preset threshold and exceeds the second interception threshold, an alarm is returned to the user and an interception command is triggered;

[0102] The interception command includes discarding the current interaction random number and notifying the user that the interception has occurred.

[0103] Further, sending a warning to the user or sending an interception notification to the user includes:

[0104] Email notification, by traversing the email addresses in turn to send warnings or interception notifications to the email addresses;

[0105] Sending warnings or blocking notifications to users can also be done through: WeChat notifications;

[0106] By traversing the WeChat OpenID, a warning or interception notification is sent to the WeChat OpenID in turn.

[0107] Embodiment 2

[0108] The present invention also provides a random number security monitoring system based on network protocol, comprising: an interactive random number module, a similarity detection module, a randomness detection module, a weighted average detection module, a packaging module and a notification module;

[0109] The interactive random number module is used to obtain the interactive random number generated by the host network protocol handshake;

[0110] The similarity detection module is used to obtain the similarity between the interactive random number and the previous random number. If the similarity value exceeds a first preset threshold, the detection fails;

[0111] The randomness detection module is used to detect the randomness of the interactive random number;

[0112] The weighted average detection module is used to perform weighted average calculation on the randomness of the interactive random number to obtain a mean value, and determine whether the mean value exceeds a second preset threshold value;

[0113] The packaging module is used to package the interactive random number and send it to the router;

[0114] The notification module is used to issue a warning or interception command to the user.

[0115] The above embodiments only express preferred implementation modes, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present invention. It should be pointed out that, for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention.

Claims

1. A method for random number security monitoring based on a network protocol, characterized in that the method comprises the following steps: Step S1, obtaining the interactive random number generated by the host through the network protocol handshake; Step S2, obtaining the previous random number of the host IP stored in the database; Step S3, calculating the similarity between the interactive random number and the previous random number by using a similarity algorithm; If the similarity does not exceed the first preset threshold, proceed to step S8; If the similarity exceeds the first preset threshold, proceed to step S4; Step S4, storing the interactive random number in a database; Step S5, performing randomness detection on the interactive random number; If the randomness test fails, proceed to step S8; If the randomness test passes, proceed to step S6; Step S6, performing weighted average calculation on the randomness of the interactive random numbers to obtain a mean value; If the mean value exceeds the second preset threshold, proceed to step S8; If the mean value does not exceed the second preset threshold, proceed to step S7; Step S7, packing the interactive random number and sending it to the router, and ending the detection; Step S8, packaging the interactive random number and sending it to the router and sending a notification to the user; The S8 specifically includes: When the similarity exceeds the first preset threshold, the randomness test fails, or the weighted average exceeds the second preset threshold, the interactive random number is packaged and sent to the router and a warning is sent to the user; If the similarity exceeds the first preset threshold and exceeds the first interception threshold or the weighted average exceeds the second preset threshold and exceeds the second interception threshold, an alarm is returned to the user and an interception command is triggered; The interception command includes discarding the current interaction random number and notifying the user that the interception has occurred.

2. The method for random number security monitoring based on network protocol according to claim 1, characterized in that: The step S2 specifically includes: Retrieve previous random numbers stored in the database through the host IP address; If there is no previous random number in the retrieved database, proceed to step S4; If the previous random numbers are obtained, the previous random numbers are traversed and obtained, and step S3 is performed in sequence.

3. The method for random number security monitoring based on network protocol according to claim 1, characterized in that: The similarity between the interactive random number and the previous random number is calculated by using a similarity algorithm, including: using a Jaccard coefficient algorithm, a cosine similarity algorithm, and a Smith-Waterman algorithm to calculate the similarity between the interactive random number and the previous random number; Jaccard coefficient algorithm, obtains the character set of the interactive random number and the character set of the previous random number, calculates the ratio of the intersection and union of the two character sets, that is, Jaccard coefficient, and uses Jaccard coefficient as an indicator of the similarity of the string attributes of the interactive random number and the previous random number; Cosine similarity algorithm, obtain the first vector of the interactive random number and the second vector of the previous random number, and measure the angle between the two vectors through cosine similarity. If the angle is smaller, the cosine similarity is greater, and the first vector and the second vector are more similar; Smith-Waterman algorithm, finds similar substrings in the interactive random number and the previous random number, and calculates the sum of the scores of the matching substrings. The higher the score, the higher the similarity between the interactive random number and the previous random number; If any one of the Jaccard coefficient, the cosine similarity and the sum of the substring scores exceeds the first preset threshold, proceed to step S8; If the Jaccard coefficient, the cosine similarity and the sum of the substring scores do not exceed the first preset threshold, the process proceeds to step S4.

4. The method for random number security monitoring based on network protocol according to claim 1, characterized in that: The randomness detection includes at least one of the following detection methods: Bit frequency detection, intra-block frequency detection, poker detection, overlapping subsequence detection, total number of runs detection, run distribution detection, maximum intra-block run detection, binary derivation detection, autocorrelation detection, matrix order detection, cumulative sum detection, approximate entropy detection, linear complexity detection, Maurer general statistics test and discrete Fourier test.

5. The method for random number security monitoring based on network protocol according to claim 1, characterized in that: The step of performing weighted average calculation on the randomness of the interactive random numbers to obtain the mean value comprises: The moving average weighted method is used to calculate the mean of the randomness of the interactive random numbers.

6. The method for random number security monitoring based on network protocol according to claim 5, characterized in that: The moving average weighting obtains the weighted weight of the interactive random number through a Kalman filter.

7. The method for random number security monitoring based on network protocol according to claim 1, characterized in that: The sending of a warning to the user or the sending of an interception notification to the user includes: Email notification: send warnings or interception notifications to each email address in turn by traversing the email addresses.

8. The method for random number security monitoring based on network protocol according to claim 1, characterized in that: The sending of a warning to the user or the sending of an interception notification to the user includes: WeChat notification, by traversing WeChat OpenID in turn, sends warnings or interception notifications to WeChat OpenID.

Images