Intranet penetration system based on virtual tunnel technology and implementation method thereof

Abstract

The invention provides an internal network penetration system based on a virtual tunnel technology and an implementation method thereof, and the implementation method comprises the following steps: monitoring internal network data, and converting the internal network data into a transmittable data packet; establishing a virtual tunnel through a virtual technology to connect an external network and an internal network; wherein the construction process of the virtual tunnel comprises a first construction method and a second construction method, and a safety protection module is arranged in the virtual tunnel; and receiving a request of the external network, and forwarding the request of the external network to the internal network through the virtual tunnel. The method has the beneficial effects that the internal network penetration is realized through the virtual tunnel technology, the transformation of the existing network architecture and equipment is avoided, and the implementation cost and the implementation difficulty are reduced; meanwhile, through a security control technology, secure transmission of intranet data is ensured, and efficient intranet and extranet data interaction service can be provided on the premise of ensuring data security.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to an intranet penetration system based on virtual tunnel technology and an implementation method thereof. Background Art

[0002] During software development and testing, data interaction and testing are usually required in different environments. For example, during the development process, it is necessary to test the performance of data on different platforms and in different network environments, or it is necessary to connect to a remote service to obtain data during local debugging.

[0003] However, due to network restrictions and security policies, it is sometimes difficult to directly interact and test data. If local intranet debugging requires a large number of developers to travel, it will significantly increase the company's operating costs. Summary of the invention

[0004] In view of this, the present invention aims to propose an intranet penetration system based on virtual tunnel technology and an implementation method thereof, in order to solve at least one of the above-mentioned technical problems.

[0005] To achieve the above object, the technical solution of the present invention is achieved as follows:

[0006] An intranet penetration system based on virtual tunnel technology and an implementation method thereof, comprising the following steps:

[0007] Monitoring internal network data and converting the internal network data into transmittable data packets;

[0008] Establishing a virtual tunnel through virtual technology to connect the external network and the internal network; wherein the process of establishing the connection between the external network and the internal network through the virtual tunnel includes a first penetration strategy and a second penetration strategy, and a security protection module is provided inside the virtual tunnel;

[0009] Receive requests from the external network and forward them to the internal network through a virtual tunnel.

[0010] Furthermore, the first penetration strategy includes the following steps:

[0011] Install the ngrok server and configure the server's port number and authentication information;

[0012] Configure the local service port number, ngrok server address and authorization code for the internal network;

[0013] Start the required services in the internal network and bind the local service port to the ngrok server through the ngrok client command;

[0014] The external network accesses the internal network through the ngrok server.

[0015] Furthermore, the second penetration strategy includes the following steps:

[0016] Configure IPsec ports of internal and external networks, and set up key exchange and management mechanisms; wherein the key exchange and management mechanisms include a first stage and a second stage;

[0017] The data of the internal network is encapsulated into an IPsec packet and encrypted, and then transmitted to the external network through the public network. The external network verifies and decrypts the received IPsec packet to restore the internal network data.

[0018] Furthermore, the working process of the first stage is:

[0019] A secure communication channel is established between the IPsec port of the internal network and the IPsec port of the external network according to a protocol negotiation strategy; wherein the protocol negotiation strategy includes a main mode and a quick mode. In the main mode, a secure communication channel is established between the internal and external networks through multiple communications; in the quick mode, a secure communication channel is established between the internal and external networks through one communication.

[0020] Furthermore, the working process of the second stage is:

[0021] The internal and external networks execute the encryption exchange strategy in the secure communication channel established in the first phase. After the execution of the encryption exchange strategy, both the internal and external networks obtain the hash encryption algorithm used to encrypt data and the key used for decryption.

[0022] Compared with the prior art, the intranet penetration system based on virtual tunnel technology and its implementation method described in the present invention have the following beneficial effects:

[0023] The virtual tunnel technology is used to achieve intranet penetration, avoiding the modification of the existing network architecture and equipment, and reducing the implementation cost and difficulty;

[0024] Through security control technology, the secure transmission of intranet data is guaranteed, and efficient intranet and extranet data interaction services can be provided under the premise of ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

[0026] Figure 1 The present invention is a flowchart of an intranet penetration system based on virtual tunnel technology and its implementation method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0028] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0029] An intranet penetration system based on virtual tunnel technology and an implementation method thereof, comprising the following steps:

[0030] S1. monitoring internal network data and converting the internal network data into transmittable data packets;

[0031] S2, establish a virtual tunnel to connect the external network and the internal network through virtual technology;

[0032] The construction process of the virtual tunnel includes a first construction method and a second construction method, and a security protection module is provided inside the virtual tunnel;

[0033] S3. Receive the request from the external network and forward the request from the external network to the internal network through the virtual tunnel.

[0034] The first construction method in step S2 comprises the following steps:

[0035] S2A1. Install the ngrok server and configure the server's port number and authentication information.

[0036] S2A2, configure the local service port number, ngrok server address and authorization code for the internal network;

[0037] S2A3. Start the required service in the internal network, bind the local service port to the ngrok server through the ngrok client command, access the local service using the public network address, and verify whether the intranet penetration function is successfully implemented.

[0038] Preferably, a specific execution process of the first construction method includes:

[0039] Download and install the ngrok server. The ngrok official website provides installation packages for various operating systems. Users can download and install them according to their own operating system versions;

[0040] After the installation is complete, set the port number, authorization code and other information of the ngrok server. This information can be registered and obtained on the ngrok official website, or by purchasing the premium version of ngrok.

[0041] Download and install the ngrok client. The ngrok client is a tool used to bind the local service port to the ngrok server to achieve intranet penetration.

[0042] After the installation is complete, configure the local service port number, ngrok server address, ngrok server authorization code and other information. This information can be viewed and set on the ngrok official website;

[0043] After configuring the ngrok client, start the local server and bind the service port to the ngrok client, including:

[0044] a. Start a local server, such as a web server, and listen to a local port number;

[0045] b. Execute the command in the ngrok client to bind the local service port to the ngrok server;

[0046] After completing the ngrok client configuration and starting the local server, you can access the address provided by the ngrok server to achieve intranet data transmission and interaction.

[0047] The second penetration strategy in step S2 includes the following steps:

[0048] S2B1. Configure the IPsec ports of the internal and external networks, and set up a key exchange and management mechanism; wherein the key exchange and management mechanism includes a first stage and a second stage;

[0049] S2B2. Encapsulate the internal network data into an IPsec packet and encrypt it, then transmit it to the external network through the public network. The external network verifies and decrypts the received IPsec packet to recover the internal network data.

[0050] The working process of the first stage in step S2B1 is as follows:

[0051] A secure communication channel is established between the IPsec port of the internal network and the IPsec port of the external network according to a protocol negotiation strategy; wherein the protocol negotiation strategy includes a main mode and a quick mode. In the main mode, a secure communication channel is established between the internal and external networks through multiple communications; in the quick mode, a secure communication channel is established between the internal and external networks through one communication.

[0052] Preferably, the specific execution process of the main mode in the protocol negotiation strategy is as follows:

[0053] The main mode is used to establish a security association between two IPsec ports on the internal and external networks. The main mode provides authentication and key exchange functions to ensure that both parties can safely negotiate encryption and authentication parameters before starting to exchange data. In the main mode, the internal network and the external network interact through six messages, specifically:

[0054] 1) The initiator sends a message containing the following: the initiator's Cookie, supported IKE versions, supported encryption algorithms, supported hash algorithms, supported authentication methods, supported DiffieHellman (DH) groups, and temporary random numbers (for subsequent key generation);

[0055] 2) The responder replies with a message containing the following: the responder's Cookie, the IKE version selected, the encryption algorithm selected, the hash algorithm selected, the authentication method selected, the DH group selected, and the responder's temporary random number;

[0056] 3) The initiator sends a message containing the following: the initiator's DH public value (based on the selected DH group), identity information (which can be an IP address or certificate), and authentication data (such as a pre-shared key or certificate signature);

[0057] 4) The responder replies with a message containing the following: the responder's DH public value, identity information, and authentication data;

[0058] 5) The initiator sends a message containing the following: the generated master key (calculated through DH exchange), confirmation of the encryption and hashing algorithms, the ID and SPI (SecurityParametersIndex) of the generated new SA;

[0059] 6) The responder replies with a message containing the following content to confirm the establishment of the SA: the ID and SPI of the new SA, and any necessary additional configuration information.

[0060] The main mode generates keys using DH exchange, ensuring the security of keys during transmission. It supports multiple authentication methods, such as pre-shared keys and digital certificates. The main mode allows both parties to negotiate parameters such as encryption, hashing, and DH groups to adapt to different security requirements and network environments. The main mode is carried out in steps, and each step provides a basis for the next step of security parameter negotiation and key generation.

[0061] Because it involves multiple steps and DH calculations, the main mode is slower than the quick mode (AggressiveMode) and requires more parameters to be configured.

[0062] The specific execution process of the quick mode in the protocol negotiation strategy is as follows:

[0063] Quick mode allows two IPsec gateways to quickly establish security associations. Compared with main mode, quick mode reduces the number of negotiation steps, but sacrifices some security because it sends more information in one exchange. In quick mode, the internal network and the external network interact through two messages, specifically:

[0064] 1) The initiator sends a message containing the following: the initiator's Cookie, supported IKE versions, supported encryption algorithms, supported hash algorithms, supported authentication methods, supported DiffieHellman (DH) groups, the initiator's DH public value (based on the selected DH group), the initiator's identity information (which can be an IP address or certificate), and authentication data (such as a pre-shared key or certificate signature);

[0065] 2) The responder replies with a message containing the following: the responder's cookie, the IKE version selected, the encryption algorithm selected, the hash algorithm selected, the authentication method selected, the DH group selected, the responder's DH public value, the responder's identity information, and the authentication data.

[0066] Quick mode completes negotiation in one exchange, which is faster than main mode. Since the number of steps is reduced, configuration and management are relatively simple.

[0067] Because more information is sent in a single exchange, Quick Mode is more susceptible to man-in-the-middle attacks than Main Mode.

[0068] The working process of the second stage in step S2B1 is as follows:

[0069] The internal and external networks execute the encryption exchange strategy in the secure communication channel established in the first phase. After the execution of the encryption exchange strategy, both the internal and external networks obtain the hash encryption algorithm used to encrypt data and the key used for decryption.

[0070] Preferably, the specific implementation process of the encrypted exchange strategy is as follows:

[0071] The encryption exchange strategy is carried out on the secure channel established in the first phase to negotiate specific encryption and authentication parameters and generate keys for protecting data streams. In fast mode, the internal network and the external network interact through five messages, specifically:

[0072] 1) The initiator sends a message containing the following: SPI (Security Parameters Index) identifier to identify the new SA, encryption algorithm and key length, authentication algorithm, DH group (if a new key needs to be generated);

[0073] 2) The responder replies with a message containing the following content to confirm the encryption and authentication parameters: SPI identifier, encryption algorithm and key length, authentication algorithm, DH group;

[0074] 3) If a new key needs to be generated, the initiator sends a message containing its DH public value, and the responder replies with a message containing its DH public value;

[0075] 4) The initiator sends a message containing the following: the generated new key (if DH exchange is used), confirmation of the encryption and hashing algorithm, the ID and SPI of the new SA;

[0076] 5) The responder replies with a confirmation message to confirm the establishment of the SA.

[0077] The encryption exchange strategy is performed on the established secure channel, ensuring the security of the negotiation process. The encryption exchange strategy is a key process in IPsec for establishing security associations for data transmission, which ensures the confidentiality and integrity of data during transmission.

[0078] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0079] In the several embodiments provided in the present application, it should be understood that the disclosed methods and systems can be implemented in other ways. For example, the division of the units described above is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. The above-mentioned units may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention.

[0080] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

[0081] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An intranet penetration system based on virtual tunnel technology and its implementation method, characterized in that: The steps include: Monitoring internal network data and converting the internal network data into transmittable data packets; Establishing a virtual tunnel through virtual technology to connect the external network and the internal network; wherein the process of establishing the connection between the external network and the internal network through the virtual tunnel includes a first penetration strategy and a second penetration strategy, and a security protection module is provided inside the virtual tunnel; Receive requests from the external network and forward them to the internal network through a virtual tunnel.

2. According to claim 1, an intranet penetration system based on virtual tunnel technology and its implementation method, characterized in that: The first penetration strategy includes the following steps: Install the ngrok server and configure the server's port number and authentication information; Configure the local service port number, ngrok server address and authorization code for the internal network; Start the required services in the internal network and bind the local service port to the ngrok server through the ngrok client command; The external network accesses the internal network through the ngrok server.

3. According to claim 1, the intranet penetration system based on virtual tunnel technology and its implementation method are characterized in that: The second penetration strategy includes the following steps: Configure IPsec ports of internal and external networks, and set up key exchange and management mechanisms; wherein the key exchange and management mechanisms include a first stage and a second stage; The data of the internal network is encapsulated into an IPsec packet and encrypted, and then transmitted to the external network through the public network. The external network verifies and decrypts the received IPsec packet to restore the internal network data.

4. According to claim 3, an intranet penetration system based on virtual tunnel technology and its implementation method, characterized in that: The working process of the first stage is as follows: Establishing a secure communication channel between the IPsec port of the internal network and the IPsec port of the external network according to the protocol negotiation strategy; The protocol negotiation strategy includes a main mode and a quick mode. In the main mode, a secure communication channel is established between the internal and external networks through multiple communications. In the quick mode, a secure communication channel is established between the internal and external networks through one communication. If the security requirement is lower, use the quick mode; otherwise use the main mode.

5. According to claim 4, an intranet penetration system based on virtual tunnel technology and its implementation method, characterized in that: The working process of the second stage is as follows: The internal and external networks execute the encryption exchange strategy in the secure communication channel established in the first phase. After the execution of the encryption exchange strategy, both the internal and external networks obtain the hash encryption algorithm used to encrypt data and the key used for decryption.

Images