Network equipment end hopping access system and method based on situation awareness

Abstract

The invention relates to a situation awareness-based network equipment end hopping access system, which can comprise a service gateway, the service gateway can be configured to generate port knocking information so that a client can perform service communication with the service gateway based on the port knocking information, and the service gateway can be further configured to monitor comprehensive situation awareness so that the client can perform service communication with the service gateway based on the port knocking information. The port knock information at least comprises a service IP address, a port knock sequence and a service port, the end information at least comprises a service IP address, a port knock sequence and a service port, and the execution end information hopping strategy comprises change end information and change end information. And the changed end information is sent to the client, so that the client uses the changed end information to switch communication with the service gateway.

Description

Technical Field

[0001] The present invention relates to the field of network security access, and more specifically, to a network device end hopping access system and method based on situation awareness. Background Art

[0002] Network security is a very important branch of information technology, which aims to protect the confidentiality, integrity and availability of data transmission. With the rapid development and widespread application of the Internet, the challenges faced by network security are also increasing. Traditional encryption algorithms, such as symmetric encryption (such as AES) and asymmetric encryption (such as RSA), play an important role in protecting data. However, with the improvement of computing power and the emergence of new attack methods, traditional encryption algorithms are also facing new threats.

[0003] Endpoint information hopping is a network security technology that aims to prevent attackers from tracking and intrusion by dynamically changing endpoint information. This method is similar to the application of frequency hopping in wireless communications. By constantly changing the communication port, IP address or other key network parameters, it increases the difficulty for attackers to locate and attack targets, thereby enhancing the security of the system.

[0004] In today's complex and ever-changing network environment, situational awareness technology has become a core means of ensuring network security. With the rapid development of the Internet and information technology, the scale and complexity of the networks of enterprises and organizations are constantly increasing, and the security threats they face are also becoming increasingly severe. New network attack methods such as advanced persistent threats (APT), zero-day attacks, and distributed denial of service (DDoS) attacks are emerging in an endless stream, and traditional static defense measures are no longer able to cope with them. Situational awareness technology can effectively improve the overall defense capabilities of the network through real-time monitoring, dynamic analysis, and intelligent early warning.

[0005] The prior art provides some methods related to terminal information jump and situational awareness, but there are still some problems, for example: the jump port needs to be pre-set and has poor security, and is easily intercepted and infiltrated; although it is proposed to use the spatial uniqueness and temporal variability of the wireless random channel to improve the randomness of the key, it does not take into account the defense measures during man-in-the-middle attacks, and thus cannot prevent infiltration. Summary of the invention

[0006] Based on the problems existing in the prior art, the present invention provides a network device end hopping access system and method based on situation awareness.

[0007] According to an embodiment of the present invention, a network device terminal hopping access system based on situational awareness is disclosed. The system may include a service gateway. The service gateway may be configured to generate port knocking information for a client to perform service communications with the service gateway based on the port knocking information. The service gateway may be further configured to monitor comprehensive situational awareness and determine whether to execute a terminal information hopping strategy based on a score of the comprehensive situational awareness, wherein the port knocking information includes at least a service IP address, a port knocking sequence, and a service port, and the terminal information includes at least a service IP address, a port knocking sequence, and a service port. Executing the terminal information hopping strategy includes changing the terminal information and sending the changed terminal information to the client, so that the client can use the changed terminal information to switch communication with the service gateway.

[0008] Furthermore, comprehensive situational awareness may include one or more of user behavior detection, network topology changes, time period security analysis, and abnormal interaction determination.

[0009] Furthermore, sending the changed end information to the client so that the client can use the changed end information to switch communication with the service gateway can include: encrypting the changed end information with a key and sending it to the client so that the client can use the changed end information to switch communication with the service gateway, wherein the key is obtained by exchanging keys based on a chaotic sequence when the client and the service gateway conduct service communication.

[0010] Further, determining whether to execute the end information jump strategy based on the comprehensive situational awareness score may include: when the comprehensive situational awareness score is higher than a first threshold, not executing the end information jump strategy; when the comprehensive situational awareness score is lower than the first threshold but higher than a second threshold, when the level of business communication is lower than a predetermined level, executing the end information jump strategy; when the comprehensive situational awareness score is lower than the second threshold, executing the end information jump strategy.

[0011] According to an embodiment of the present invention, a network device end-hopping access system based on situational awareness is disclosed. The system may include a client, and the client may be configured to use port knocking information generated by the service gateway to communicate with the service gateway for business. The client is further configured to perform end hopping when receiving changed end information from the service gateway, wherein the port knocking information includes at least a service IP address, a port knocking sequence, and a service port, and the end information includes at least a service IP address, a port knocking sequence, and a service port. The changed end information is generated by the service gateway based on the comprehensive situational awareness score meeting a predetermined condition, and performing end information hopping includes using the changed end information to switch communication with the service gateway.

[0012] Furthermore, comprehensive situational awareness may include one or more of user behavior detection, network topology changes, time period security analysis, and abnormal interaction determination.

[0013] Further, performing end hopping when receiving changed end information from the service gateway may include: performing end hopping when receiving changed end information encrypted and sent using a key from the service gateway, wherein the key is obtained by exchanging keys based on a chaotic sequence when the client communicates with the service gateway for service.

[0014] Further, the predetermined condition may include: the score of the comprehensive situation awareness is lower than the first threshold but higher than the second threshold, and the level of the business communication is lower than the predetermined level; or the score of the comprehensive situation awareness is lower than the second threshold.

[0015] According to an embodiment of the present invention, a network device terminal hopping access method based on situational awareness is disclosed, which is applied to a service gateway. The method may include: generating port knocking information for a client to perform service communications with the service gateway based on the port knocking information; and monitoring comprehensive situational awareness, and determining whether to execute a terminal information hopping strategy based on a score of the comprehensive situational awareness, wherein the port knocking information includes at least a service IP address, a port knocking sequence, and a service port, and the terminal information includes at least a service IP address, a port knocking sequence, and a service port, and executing the terminal information hopping strategy includes changing the terminal information, and sending the changed terminal information to the client, so that the client can use the changed terminal information to switch communication with the service gateway.

[0016] According to an embodiment of the present invention, a network device end-hopping access method based on situational awareness is disclosed, which is applied to a client. The method may include: using port knocking information generated by a service gateway to communicate with a service gateway; and performing end-hopping when receiving changed end information from the service gateway, wherein the port knocking information includes at least a service IP address, a port knocking sequence, and a service port, and the end information includes at least a service IP address, a port knocking sequence, and a service port. The changed end information is generated by the service gateway based on the comprehensive situational awareness score meeting a predetermined condition, and performing end information hopping includes using the changed end information to switch communication with the service gateway.

[0017] According to the present invention, a specific process, topology, modules and other information of a network knocking are provided to realize a secure network knocking from a network client to a service gateway.

[0018] According to the present invention, a method for exchanging keys by using a chaotic sequence method and encrypting and transmitting transition information based on the exchange key is provided, thereby solving the problem of leakage of transition information.

[0019] According to the present invention, a multi-dimensional situational awareness mechanism is provided, which initiates terminal jumps based on situational awareness to reduce the impact of frequent jumps on network services. A specific calculation method for multi-dimensional situational awareness is given. At the same time, a dual threshold mechanism is used to achieve non-essential jumps, balance the impact of system security and service interruption, and further reduce the impact on network services. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 is a schematic diagram showing the structure of a network device end hopping access system based on situation awareness according to an embodiment of the present invention; Figure 2 It is a schematic diagram showing a flow chart of a method for hopping access of a network device terminal based on situation awareness according to an embodiment of the present invention; Figure 3 is a schematic diagram showing the structure of a network device end hopping access system based on situation awareness according to an embodiment of the present invention; Figure 4 is a schematic diagram showing the structure of a network device end hopping access system based on situation awareness according to another embodiment of the present invention; Figure 5 is a flow chart showing a method for hopping access of a network device terminal based on situation awareness according to another embodiment of the present invention; Figure 6 The figure shows the process of a network device-side hopping access method based on situation awareness according to another embodiment of the present invention. DETAILED DESCRIPTION

[0021] Examples or embodiments of the present invention will be described below with reference to the accompanying drawings, in which specific examples or embodiments that can be implemented are shown by way of illustration, and in the accompanying drawings, even if the same reference numerals and symbols are shown in different drawings from each other, they can also be used to represent the same or similar parts. Further, in the following description of examples or embodiments of the present invention, when it is determined that the detailed description of well-known functions and components incorporated herein may obscure the subject matter in some embodiments of the present invention, these detailed descriptions will be omitted. Terms such as "including", "having", "comprising", "constituting", "composing", "forming", etc. used herein are generally intended to allow the addition of other components unless used with the term "only". As used herein, the singular form is intended to include the plural form unless the context clearly indicates otherwise.

[0022] Terms such as "first", "second", "A", "B", "(A)" or "(B)" may be used herein to describe elements of the present invention. Each of these terms is not used to define an element, sequence, order, quantity, etc., but is only used to distinguish the corresponding element from other elements.

[0023] When it is mentioned that a first element is “connected or coupled”, “contacted or overlapped” with a second element, it should be understood that not only the first element can be “directly connected or coupled” or “directly contacted or overlapped” with the second element, but also a third element can be “inserted” between the first element and the second element, or the first element and the second element can be “connected or coupled”, “contacted or overlapped” with each other through a fourth element, etc. Here, the second element can be included in at least one of the two or more elements that are “connected or coupled”, “contacted or overlapped”, etc. with each other.

[0024] When time relative terms such as "after", "after...", "next", "before" and the like are used to describe a process or operation of an element or configuration, or a flow or step in an operation, process, or manufacturing method, unless these terms are used with the terms "directly" or "immediately", these terms may be used to describe non-continuous or non-sequential processes or operations.

[0025] In addition, when any dimension, relative dimension, etc. is mentioned, even if no relevant description is specified, it should be considered that the numerical value or corresponding information (e.g., level, range, etc.) of the element or feature includes a tolerance or error range that may be caused by various factors (e.g., process factors, internal or external influences, noise, etc.). Further, the term "may" fully encompasses all meanings of the term "can".

[0026] In this article, NTP protocol can refer to Network Time Protocol network event protocol.

[0027] In this article, chaotic sequence can refer to a highly complex sequence generated by a chaotic system that appears random but actually has determinism and internal structure.

[0028] In this article, end hopping, also known as end information hopping, refers to the process in which both parties of network communication change the network parameters used for communication simultaneously and synchronously with certain regular strategies during computer network communication. These network parameters mainly include: IP address, port, protocol, etc.

[0029] In this article, situational awareness can refer to the ability to understand security risks in a dynamic and holistic manner based on the environment. It is a way to improve the ability to discover, identify, understand, analyze, respond and deal with security threats from a global perspective based on security big data. Ultimately, it is for decision-making and action, and is the implementation of security capabilities.

[0030] In this context, port knocking can refer to a method of opening ports on a firewall from the outside by generating connection attempts on a set of pre-specified closed ports. Once the correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host sending the connection to attempt to connect through the specific port. The firewall closes all ports by default before the connection is made.

[0031] Figure 1 It is a structural schematic diagram showing a network device-side hopping access system based on situational awareness according to an embodiment of the present invention.

[0032] Reference Figure 1 The network device-side hopping access system based on situational awareness of the present invention includes three entities: a controller, multiple clients and one or more service gateways.

[0033] (1.1) Solution topology Controller: Deployed in the extranet environment, and pre-establishes a secure encrypted channel with the business gateway. The controller can perform security authentication on the client. The controller can obtain the end jump information of the gateway and send it to the client.

[0034] Client: Deployed in an extranet environment, it is pre-configured with the network address information of the controller and can use common network protocols to perform identity authentication and information exchange with the controller. This article does not place special restrictions on authentication and interaction methods.

[0035] Business Gateway: Deployed at the boundary of the intranet and intranet. The client can connect to the business gateway based on the network knocking information provided by the controller, and then access the business services in the intranet. The relevant information of the business gateway (such as service name, jump information, effective time, etc.) will be transmitted and stored in the controller through a pre-established persistent encrypted channel (the specific implementation method of the encryption channel is not particularly limited). The client and the business gateway can exchange keys based on the chaotic sequence according to the information in steps 4 to 6 of this article, and use the exchanged keys for encrypted transmission.

[0036] In this solution, there is only one controller globally, which supports several service gateways and multiple clients. (1.2) Main modules in the controller Gateway connection information storage module: This module is used to receive the terminal information and necessary attachment information sent by the service gateway and perform storage management. Specifically includes: (1) For the information format, refer to the gateway initialization phase and step 4.3.

[0037] (2) Supports storage of end information sent from multiple gateways.

[0038] (2.1) The module maintains 1-2 pieces of end information for each gateway.

[0039] At least it includes the currently effective end hopping strategy, which is called running information.

[0040] There may also be end jump information that will take effect at some time in the future. This information is transmitted to the controller by step 4.3 and is called candidate information. Whether this information exists is determined by steps 3 (situation detection) and 4 (situation transmission).

[0041] The module can maintain the running and candidate information and perform state switching according to the description method in step 4.3.

[0042] User authentication module: This module is used to perform security authentication on the client when the client initiates a connection to the service gateway. The authentication includes the client's identity information and security certificate authentication information.

[0043] (1.3) Main modules in the business gateway Situation awareness module: used to monitor network topology situation values ​​and determine risks. For details, see Section 1.6.

[0044] Key exchange module: This module works in the gateway and the client, and generates encryption keys according to the process described below. It uses the chaotic sequence generator to generate a random sequence using the high randomness and unpredictability of the nonlinear dynamic system for processing encryption keys.

[0045] Transition module: generates end transition strategy and implements transition.

[0046] Port knocking connection module: This module is used when the client uses the port knocking method to connect to the service gateway. The service gateway identifies the knocking strategy and opens the corresponding port to the client.

[0047] (1.4) Main modules in the client Key exchange module: has the same function as the module of the same name in 1.3.

[0048] Jump module: implements jump according to the end jump strategy passed in by the server.

[0049] (1.5) Situation Awareness Module and Situation Value Calculation Method The situation awareness module is a situation calculation module that collects (perceives) multi-dimensional security indicators. This module provides accurate security situation values ​​through multi-dimensional data collection and analysis, providing strong support for security decision-making and risk management. The situation awareness module contains the following sub-modules.

[0050] (1.5.1.1) User behavior detection submodule The user behavior detection submodule identifies abnormal behavior by monitoring, analyzing and evaluating the user's operation behavior in the network and system. This module manually sets a short detection cycle, and the submodule performs periodic detection according to the cycle. When the situation calculation submodule initiates a calculation request, the module has performed N detections and obtained N groups of detection results. The specific output results are as follows: is the total number of detections in the detection cycle. (i∈N in the subsequent notation).

[0051] : The number of abnormal behaviors detected in the i-th detection.

[0052] : The number of failed attempts detected in the i-th detection.

[0053] : The number of temporal anomalies in the i-th detection.

[0054] (1.5.1.2) Abnormal interaction detection submodule The abnormal interaction detection submodule monitors and analyzes the interactive behaviors in the network and system, identifies and evaluates abnormal interactions, and thus promptly discovers and responds to potential security threats.

[0055] This module manually sets a shorter detection cycle, and the submodule performs periodic detection according to the cycle. When the situation calculation submodule initiates a calculation request, the module has performed N detections and obtained N groups of detection results. The specific output results are as follows: : The total number of detections within the detection cycle. The start and end times of the detection cycle are given by the situation calculation module when it initiates a request. (i∈N in the subsequent symbols).

[0056] : No. The abnormal traffic detected in the detection, j represents the type of abnormal traffic, that is, the data volume of abnormal traffic is counted by type.

[0057] : No. Statistics of the number of time anomalies in the detection (such as abnormal interactions during non-working hours), network topology change module.

[0058] (1.5.1.3) Network topology change detection submodule The network topology change detection submodule monitors and analyzes the dynamic changes of client connections in the network, timely identifies and evaluates changes in the network structure, and thus prevents potential security risks.

[0059] This module manually sets a shorter detection cycle, and the submodule performs periodic detection according to the cycle. When the situation calculation submodule initiates a calculation request, the module has performed N detections and obtained N groups of detection results. The specific output results are as follows: is the total number of detections in the detection cycle (subsequent i∈N).

[0060] It is The number of new nodes detected in this detection.

[0061] It is The number of lost nodes detected in this test.

[0062] It is The number of connection changes detected in this detection.

[0063] (1.5.1.4) Timer submodule When the situation calculation module initiates a request, the following results are output: : The length of time since the last time step 6 (section 1.6.7) was performed.

[0064] (1.5.1.5) Situation calculation submodule (1) According to the preset timer, the situation collection and calculation are initiated. After the scheduled time, a situation collection request is sent to each sub-module, and the start time and end time (reference time and current time) are sent at the same time. Each sub-module determines the parameter N based on the start time and end time, and summarizes and sends the detection information within the specified time period.

[0065] The workflow is as follows: 1. A timing cycle N2 is set manually, N2 is much larger than N, and the timing is cyclically performed according to N2. 2. After reaching the N2 cycle, each submodule of the desktop operator module sends the current N2 time range (the last time the calculation was initiated to the current time), and each submodule sends the output data to this module for subsequent calculation. 3. First, calculate the situation value of each sub-item, as shown in the following "(1)-(4)" method. 4. Then calculate the overall situation value according to step "(5)".

[0066] (1) User behavior situation calculation Considering different types of abnormal behaviors, the following formula can be used for calculation:

[0067] S U It is the output situation score of the user behavior detection module.

[0068] N. , , Input by the user behavior detection submodule.

[0069] , , is the weight value, which is an manually determined empirical value.

[0070] (2) Abnormal interaction situation calculation Combined with different types of abnormal network interactions, the following formula is used for calculation:

[0071] : Output situation score of abnormal interaction determination module.

[0072] , and :Input from the abnormal interaction detection submodule.

[0073] The following are the empirical value parameters manually determined during the calculation: : The severity of the type of abnormal interaction detected.

[0074] : are the weights of flow volume, time factor and severity respectively.

[0075] : Exponential factor of flow volume, used to amplify or reduce the impact of flow volume.

[0076] : No. The special situation correction factor in the sub-detection is used to adjust the weight of abnormal situations.

[0077] (3) Calculation of network topology change trends

[0078] : Output situation score of the network topology change detection module.

[0079] , , , : Network topology change detection submodule output results.

[0080] The following are the empirical value parameters manually determined during the calculation: : They are the weights of newly added nodes, lost nodes and connection changes respectively.

[0081] :Influencing factors of topological changes.

[0082] : Total number of topology changes in the current detection period.

[0083] : Maximum expected topology change.

[0084] (4) Time cycle situation calculation

[0085] : Time period situation score.

[0086] : Timer submodule output.

[0087] The following are the empirical value parameters manually determined during the calculation: : Maximum risk value, indicating that as time goes by, the risk gradually approaches this value.

[0088] : Time impact factor, indicating the rate at which time increases risk.

[0089] (5) Calculation of comprehensive situation change score By combining the scores of each sub-module, the comprehensive situation change score is obtained:

[0090] : Comprehensive situation score.

[0091] : Rating of user behavior detection module.

[0092] : The score of the abnormal interaction determination module.

[0093] : Scoring of network topology change detection modules.

[0094] : The score of the time period situation detection module.

[0095] : The weight of each frequency score.

[0096] (6) After the calculation is completed Send the current comprehensive situation change degree to the situation judgment module.

[0097] Reset timing cycle N2.

[0098] (1.5.1.6) Situation maintenance submodule This module is responsible for maintaining the overall situation value, completing the threshold trigger notification login operation according to the subsequent step 3 (1.6.4), and completing the situation value reset according to step 6 (1.6.8).

[0099] The situation module periodically senses the situation value and calculates the situation difference: current situation value - comprehensive situation change degree.

[0100] The situation awareness module indicates the current topology security risk form through scoring. When the situation value drops to threshold_1 and threshold_2, it sends a jump request to the jump controller respectively, see steps 3-5.

[0101] Figure 2 It is a flow chart showing a method for hopping access at a network device end based on situation awareness according to an embodiment of the present invention.

[0102] Reference Figure 2 ,The network device-side hopping access method based on situational awareness can be described as follows: (1.6.1) Initialization phase First, the controller, service gateway, and client use NTP and other methods to maintain time synchronization.

[0103] Business Gateway: (1) Generate initial parameters: A globally unique service name GN is pre-assigned.

[0104] Generate the initial state value State_0.

[0105] Set two situation thresholds: threshold_1 and threshold_2.

[0106] Set a chaos initial value chaos_0 (unique for each gateway and does not change over time).

[0107] Generate an initial hopping strategy, same as step 4.1.

[0108] Determine the initial end information: Gate_Info, the information format is: (service IP address, port knock sequence, service port, effective time t), the effective time t is the current time.

[0109] (2) A secure encrypted channel is maintained between the controller and the service gateway, which will not perform end hopping. After the service gateway is started, it establishes contact with the controller and sends the initial Gate_Info to the controller. The sending format is: (GN, Gate_Info, chaos_0). The controller stores and manages the received information through the hopping information storage module. And sets it as running information. It supports retrieving the corresponding information sent by different gateways according to GN.

[0110] (3) The service gateway provides port knocking access service based on the determined initial end information.

[0111] The service gateway keeps the port hidden when there is no client connection and will not respond to any connection request unless the client connects to the gateway's service IP address and follows the preset port knocking sequence and connects to the service port. At this time, the service gateway will provide access services through the service port.

[0112] (4) After the service gateway is started, it monitors the status value in the manner of step 5.

[0113] Client: 1. Pre-store the network address of the controller, and support communication and contact using the public network channel. 2. Pre-obtain the gateway service name GN to be connected. 3. Determine its own client name CN. Controller: 1. Pre-establish a secure encrypted channel with the service gateway, which will not perform end hopping. Support the use of secure encrypted channels to exchange gateway end hopping information and store it. See the gateway initialization process and step 4.3. 2. Pre-store client authentication information, and support client access and authentication from the public network.

[0114] (1.6.2) Step 1: Client communicates with controller When the client connects to the service gateway for the first time, it first needs to access the controller for identity authentication and establish an encrypted channel. (The specific authentication process of the client sending an identity authentication request to the controller is not described here.) After the authentication is passed, the client sends the service name GN to be connected to the controller. The controller will send the end information corresponding to GN to the client: if both running and candidate information exist, they will be sent at the same time. If only running information exists, running information will be sent.

[0115] The format of running and candidate information is consistent, and the same as the description content in the initialization phase (GN, Gate_Info, chaos_0). The format of Gate_Info is: (service IP address, port knock sequence, service port, effective time t). The difference is that the effective time in running must be before the current time, and the effective time in candidate must be after the current time. This consistency is maintained by the controller, see step 4.

[0116] (1.6.3) Step 2: The client connects to the service gateway through network knocking and performs key exchange.

[0117] (1) The client initiates a connection to the "service IP address" of the business gateway through network knocking, uses the "port knocking sequence" to connect to the knocking port of the business gateway in sequence, performs network knocking, and finally contacts the service port for business communication.

[0118] (2) If the service IP address is correct and the port knocking sequence is correct, the service gateway recognizes the knocking strategy and opens the "service port" to prepare for communication.

[0119] (3) The service gateway initiates the key exchange process: (a) The service gateway sends two random numbers, r1 and r2.

[0120] (4) The client uses the previously received chaos_0 and the same chaos calculation formula (the calculation method is the general method) to calculate r1 times, and the result is the encryption and decryption key key1 for secure communication.

[0121] (5) The client uses key1 to encrypt the following data: (r2, current timestamp, GN, client name CN), and sends it back to the service gateway.

[0122] (6) The server also uses chaos_0 and the same chaos calculation formula to calculate r1 times to obtain key1', and uses key1' to decrypt the data sent by the client and verify: (a) verify whether r2 is correct; (b) verify whether the timestamp is fresh (whether it is too far away from the current time); (c) verify whether the GN name is the name of this service; (d) obtain the client name CN.

[0123] (7) The server encrypts the following data (CN, GN, current timestamp) with key1 and sends it back to the client.

[0124] (8) The client uses key1 to decrypt and verify whether the CN is correct and the timestamp is fresh.

[0125] (9) If passed, use key0+n1 to encrypt a message (key1 (one for each pair of connections), timestamp, service name, client name).

[0126] (10) The client decrypts key1 and saves it.

[0127] After the authentication is completed, the client is allowed to communicate normally through the service port. The client can also perform business-level authentication with the gateway in other ways, such as user name and password authentication, digital certificate authentication, etc., which has no impact on this article.

[0128] (1.6.4) Step 3: Situation Detection (1) According to the preset timer, the situation collection and calculation are initiated. After the scheduled time, a situation collection request is sent to each sub-module, and the start time and end time (reference time and current time) are sent at the same time. Each sub-module determines the parameter N based on the start time and end time, and summarizes and sends the detection information within the specified time period.

[0129] The workflow is as follows: 1. A timing cycle N2 is set manually, N2 is much larger than N, and the timing is cyclically performed according to N2. 2. After reaching the N2 cycle, each submodule of the desktop operator module sends the current N2 time range (the last time the calculation was initiated to the current time), and each submodule sends the output data to this module for subsequent calculation. 3. First, calculate the situation value of each sub-item, as shown in the following "(1)-(4)" method. 4. Then calculate the overall situation value according to step "(5)".

[0130] (1) User behavior situation calculation Considering different types of abnormal behaviors, the following formula can be used for calculation:

[0131] S U It is the output situation score of the user behavior detection module.

[0132] N. , , Input by the user behavior detection submodule.

[0133] is the weight value, which is an manually determined empirical value.

[0134] (2) Abnormal interaction situation calculation Combined with different types of abnormal network interactions, the following formula is used for calculation:

[0135] : Output situation score of abnormal interaction determination module.

[0136] , and :Input from the abnormal interaction detection submodule.

[0137] The following are the empirical value parameters manually determined during the calculation: : The severity of the type of abnormal interaction detected.

[0138] : are the weights of flow volume, time factor and severity respectively.

[0139] : Exponential factor of flow volume, used to amplify or reduce the impact of flow volume.

[0140] : No. The special situation correction factor in the sub-detection is used to adjust the weight of abnormal situations.

[0141] (3) Calculation of network topology change trends

[0142] : Output situation score of the network topology change detection module.

[0143] , , , : Network topology transformation detection submodule output results.

[0144] The following are the empirical value parameters manually determined during the calculation: : They are the weights of newly added nodes, lost nodes and connection changes respectively.

[0145] :Influencing factors of topological changes.

[0146] : Total number of topology changes in the current detection period.

[0147] : Maximum expected topology change.

[0148] (4) Time cycle situation calculation

[0149] : Time period situation score.

[0150] : Timer submodule output.

[0151] The following are the empirical value parameters manually determined during the calculation: : Maximum risk value, indicating that as time goes by, the risk gradually approaches this value.

[0152] : Time impact factor, indicating the rate at which time increases risk.

[0153] (5) Calculation of comprehensive situation change score By combining the scores of each sub-module, the comprehensive situation change score is obtained:

[0154] : Comprehensive situation score.

[0155] : Rating of user behavior detection module.

[0156] : The score of the abnormal interaction determination module.

[0157] : Scoring of network topology change detection modules.

[0158] : The score of the time period situation detection module.

[0159] : The weight of each frequency score.

[0160] (6) After the calculation is completed Send the current comprehensive situation change degree to the situation judgment module.

[0161] Reset timing cycle N2.

[0162] (1.6.5) Step 3: Business Gateway (Situation Awareness Module) monitors the jump threshold After the service gateway is started, it will monitor the network security status value according to this step. The process of calculating the status is shown in Section 1.5.

[0163] The situation awareness module evaluates the current jump situation value through network topology changes, time period security analysis, user behavior detection, abnormal interaction judgment, and vulnerability management log analysis. The situation value gradually decreases as the network topology security decreases.

[0164] The situation module records the situation at the reference time, and different service gateways compare the changes in the current time and the initial situation value within a period T according to the two set thresholds.

[0165] When the situation value is reduced to threshold_1 and threshold_2, a jump request is sent to the jump controller in a time-sharing manner.

[0166] The security threshold drops to the first threshold threshold_1: The business gateway judges the existing connections, and each connection sets the interruption threshold according to the importance of the business. If it cannot be interrupted, the situation awareness module continues to monitor. If the business gateway responds that the jump can be made, the jump process is entered.

[0167] The security threshold drops to threshold_2: The service gateway interrupts all information transmission and starts the port hopping function. At this time, the controller stops sending corresponding end information to the client until the hopping is completed.

[0168] Taking into account normalization, intranet target service, importance index, number of connected customers, and maximum value, we can design the following formula:

[0169] in: is the business importance score. is the number of intranet target services. It is The identification value of a service (based on IP+port). It is The importance index of a service. It is The number of connected clients for a service. It is the sum of the identification values ​​of all intranet target services and is used for normalization. Indicates taking the maximum value.

[0170] The calculated business importance score S B With the preset business threshold T B Compare to decide whether to perform port hopping.

[0171] (1.6.6) Step 4: Port hopping process (1.6.6.1) Step 4.1 Generate a hopping strategy The gateway generates a hopping strategy: (GN, Gate_Info, effective time T1, chaos_0), (gateway name N1, terminal hopping information, effective time T1, key2, key0), where T1 is a certain time point in the future, that is, the time point when the strategy takes effect and the old strategy becomes invalid.

[0172] The gateway uses chaos_0 and the same chaos calculation formula to calculate r2 times to get key2. The records corresponding to the clients are stored in the gateway, and multiple clients are different.

[0173] (1.6.6.2) Step 4.2: The service gateway securely sends the end-to-end information to the client The service gateway encrypts the key with key1 and sends it to the client.

[0174] Includes a random number and encrypted hopping strategy.

[0175] Encryption method: Chaotic sequence key1 calculates random numbers times.

[0176] Store the random number, and when it changes next time, calculate the difference between the new and old random numbers to get the new key.

[0177] Includes random number, encryption policy, timestamp, service name, and client name.

[0178] The client decrypts and records it.

[0179] key1 becomes invalid and key2 becomes valid.

[0180] (1.6.6.3) Step 4.3: The service gateway sends a jump message to the controller The service gateway transmits the jump information to the controller using a secure channel.

[0181] The service gateway records this information and subsequently sends two end-hop information to the new client: running and candidate.

[0182] The information includes: (gateway name N1, end jump information, effective time T1, chaos_0).

[0183] Controller storage end information: If the effective time has not arrived, set it as candidate and set the timer. If the candidate time has arrived, delete running, set the candidate as running, and wait for client authentication (as in step 2).

[0184] (1.6.7) Step 5: Perform synchronous jump When the T1 time point in step 4.1 is reached, the service gateway will switch its own end information, and the client will switch the network connection according to the new end hopping information determined in step 4.1. The specific switching method is not particularly limited in this document.

[0185] If a client loses connection with the gateway or cannot connect for any reason, you need to repeat the connection process from step 1 to step 3.

[0186] The controller processes the synchronization information. If the time set by the candidate is reached, the running information is deleted, and the current candidate information is set to running, and the candidate is cleared.

[0187] (1.6.8) Step 6: Reset the status value Both the client and the service gateway clear kk1 and record kk2.

[0188] Situation module in the service gateway: reset the baseline value to the initial value, and reset the time node of each module. Update and rebuild the baseline model of the network topology to ensure the accuracy of topology change detection. Reset the parameters and status of each submodule and initialize the detection environment. Verify the reset system to ensure that it is in normal working condition.

[0189] Figure 3 It is a structural diagram showing a network device-side hopping access system 100 based on situational awareness according to an embodiment of the present invention.

[0190] Reference Figure 3 The network device end-hopping access system 100 based on situational awareness may include a service gateway 110, which may be configured to generate port knocking information for the client 120 to perform service communications with the service gateway 110 based on the port knocking information. The service gateway 110 may be further configured to monitor the comprehensive situational awareness and determine whether to execute the end information hopping strategy based on the score of the comprehensive situational awareness, wherein the port knocking information at least includes a service IP address, a port knocking sequence, and a service port, and the end information at least includes a service IP address, a port knocking sequence, and a service port. Executing the end information hopping strategy includes changing the end information and sending the changed end information to the client 120, so that the client 120 can use the changed end information to switch communication with the service gateway 110.

[0191] As described above, comprehensive situational awareness may include one or more of user behavior detection, network topology changes, time period security analysis, and abnormal interaction determination.

[0192] As described above, sending the changed end information to the client 120 so that the client 120 can switch the communication with the service gateway 110 using the changed end information can include: encrypting the changed end information with a key and sending it to the client 120 so that the client 120 can switch the communication with the service gateway 110 using the changed end information, wherein the key is obtained by exchanging keys based on a chaotic sequence when the client 120 conducts service communications with the service gateway 110.

[0193] As described above, determining whether to execute the end information jump strategy based on the comprehensive situational awareness score may include: when the comprehensive situational awareness score is higher than a first threshold, not executing the end information jump strategy; when the comprehensive situational awareness score is lower than the first threshold but higher than the second threshold, when the level of business communication is lower than a predetermined level, executing the end information jump strategy; when the comprehensive situational awareness score is lower than the second threshold, executing the end information jump strategy.

[0194] Figure 4 It is a schematic diagram showing the structure of a network device-side hopping access system 100 based on situation awareness according to another embodiment of the present invention.

[0195] Reference Figure 4 The network device end-hopping access system 100 based on situational awareness may include a client 120, and the client 120 may be configured to use the port knocking information generated by the service gateway 110 to perform business communications with the service gateway 110. The client 120 is further configured to perform end-hopping when receiving the changed end information from the service gateway 110, wherein the port knocking information at least includes the service IP address, the port knocking sequence, and the service port, and the end information at least includes the service IP address, the port knocking sequence, and the service port. The changed end information is generated by the service gateway 110 based on the comprehensive situational awareness score meeting the predetermined condition, and executing the end information hopping includes switching the communication with the service gateway 110 using the changed end information.

[0196] As described above, comprehensive situational awareness may include one or more of user behavior detection, network topology changes, time period security analysis, and abnormal interaction determination.

[0197] As described above, performing end hopping when receiving changed end information from the service gateway 110 may include: performing end hopping when receiving changed end information encrypted and sent using a key from the service gateway 110, wherein the key is obtained by exchanging keys based on a chaotic sequence when the client 120 conducts service communication with the service gateway 110.

[0198] As described above, the predetermined condition may include: the score of the comprehensive situational awareness is lower than the first threshold but higher than the second threshold, and the level of business communication is lower than the predetermined level; or the score of the comprehensive situational awareness is lower than the second threshold.

[0199] Figure 5 It is a flow chart showing a network device end hopping access method based on situation awareness according to another embodiment of the present invention.

[0200] Reference Figure 5, a network device end-hopping access method based on situational awareness is provided, which is applied to the service gateway 110. The method may include: generating port knocking information for the client 120 to perform service communication with the service gateway 110 based on the port knocking information (S510); and monitoring the comprehensive situational awareness, and determining whether to execute the end information hopping strategy based on the score of the comprehensive situational awareness (S530), wherein the port knocking information at least includes the service IP address, the port knocking sequence, and the service port, and the end information at least includes the service IP address, the port knocking sequence, and the service port, and executing the end information hopping strategy includes changing the end information, and sending the changed end information to the client 120, so that the client 120 can use the changed end information to switch the communication with the service gateway 110.

[0201] Figure 6 The figure shows the process of a network device-side hopping access method based on situation awareness according to another embodiment of the present invention.

[0202] Reference Figure 6 , a network device end-hopping access method based on situational awareness is provided, which is applied to a client 120. The method may include: using the port knocking information generated by the service gateway 110 to perform business communications with the service gateway 110 (S610); and performing end-hopping when receiving the changed end information from the service gateway 110 (S630), wherein the port knocking information at least includes a service IP address, a port knocking sequence, and a service port, and the end information at least includes a service IP address, a port knocking sequence, and a service port. The changed end information is generated by the service gateway 110 based on the comprehensive situational awareness score meeting a predetermined condition, and performing end information hopping includes using the changed end information to switch the communication with the service gateway 110.

[0203] According to the present invention, the perception directions of various subsystems of situational awareness are optimized, and user behavior detection and network topology detection are innovatively added, thereby improving the perception of the highly secretive and difficult-to-detect characteristics of intelligent body attacks. Through the dual-threshold situational awareness strategy, the business overhead caused by jumps and the impact of business interruptions are reduced.

[0204] According to the present invention, an optimized chaotic sequence is used as the information transmission mechanism of the entire hopping process, and the randomness of the key is enhanced by the chaotic sequence, making it more difficult for an attacker to crack.

[0205] According to the present invention, a situation-based security access strategy is provided, which controls the jump of the service gateway and the client through a situation awareness module, a cloud security service, and a jump control module, thereby solving the problem that the jump information is intercepted during the jump, making the defense measures ineffective.

[0206] Although various embodiments of the present invention have been described with specific details and varying details for illustrative purposes, it will be understood by those skilled in the art that various modifications, additions and substitutions may be made based on the contents disclosed or described in the present invention without departing from the spirit and scope of the present invention as defined by the appended claims. In addition, embodiments may be combined to form additional embodiments.

Claims

1. A network device end hopping access system based on situational awareness, comprising a service gateway, characterized in that: The service gateway is configured to generate port knocking information so that the client can perform service communication with the service gateway based on the port knocking information. The service gateway is further configured to monitor the comprehensive situational awareness and determine whether to execute the terminal information jump strategy based on the score of the comprehensive situational awareness. Among them, the port knocking information includes at least a service IP address, a port knocking sequence, and a service port, the end information includes at least a service IP address, a port knocking sequence, and a service port, and executing the end information jump strategy includes changing the end information and sending the changed end information to the client, so that the client can use the changed end information to switch communication with the service gateway.

2. The network device end hopping access system based on situational awareness according to claim 1 is characterized in that: The comprehensive situational awareness includes one or more of user behavior detection, network topology changes, time period security analysis, and abnormal interaction determination.

3. The network device end hopping access system based on situational awareness according to claim 1 is characterized in that: Sending the changed end information to the client so that the client can use the changed end information to switch communication with the service gateway includes: encrypting the changed end information with a key and sending it to the client so that the client can use the changed end information to switch communication with the service gateway, wherein the key is obtained by exchanging keys based on a chaotic sequence when the client and the service gateway perform service communications.

4. The network device terminal hopping access system based on situational awareness according to claim 1 is characterized in that: Determining whether to execute the end information jump strategy jump based on the score of the comprehensive situation awareness includes: when the score of the comprehensive situation awareness is higher than a first threshold, not executing the end information jump strategy; when the score of the comprehensive situation awareness is lower than the first threshold but higher than a second threshold, when the level of the business communication is lower than a predetermined level, executing the end information jump strategy; when the score of the comprehensive situation awareness is lower than the second threshold, executing the end information jump strategy.

5. A network device end hopping access system based on situational awareness, comprising a client, characterized in that: The client is configured to perform service communication with the service gateway using the port knocking information generated by the service gateway, The client is further configured to perform end hopping upon receiving the changed end information from the service gateway, Among them, the port knocking information includes at least a service IP address, a port knocking sequence, and a service port, the end information includes at least a service IP address, a port knocking sequence, and a service port, the changed end information is generated by the service gateway based on the comprehensive situational awareness score meeting a predetermined condition, and executing the end information jump includes switching communication with the service gateway using the changed end information.

6. The network device end hopping access system based on situational awareness according to claim 5 is characterized in that: The comprehensive situational awareness includes one or more of user behavior detection, network topology changes, time period security analysis, and abnormal interaction determination.

7. The network device end hopping access system based on situational awareness according to claim 5 is characterized in that: Executing end hopping when receiving changed end information from the service gateway includes: executing end hopping when receiving changed end information encrypted and sent using a key from the service gateway, wherein the key is obtained by exchanging keys based on a chaotic sequence when the client communicates with the service gateway for service.

8. The network device end hopping access system based on situational awareness according to claim 5 is characterized in that: The predetermined condition includes: the score of the comprehensive situation awareness is lower than a first threshold but higher than a second threshold, and the level of the business communication is lower than a predetermined level; or the score of the comprehensive situation awareness is lower than the second threshold.

9. A network device end hopping access method based on situational awareness, applied to a service gateway, characterized in that: The method comprises: generating port knocking information so that the client can perform service communication with the service gateway based on the port knocking information; and monitoring the comprehensive situational awareness, and determining whether to execute the terminal information jump strategy based on the score of the comprehensive situational awareness, Among them, the port knocking information includes at least a service IP address, a port knocking sequence, and a service port, the end information includes at least a service IP address, a port knocking sequence, and a service port, and executing the end information jump strategy includes changing the end information and sending the changed end information to the client, so that the client can use the changed end information to switch communication with the service gateway.

10. A network device end hopping access method based on situation awareness, applied to a client, characterized in that: The method comprises: Performing business communications with the business gateway using the port knocking information generated by the business gateway; and When receiving the changed end information from the service gateway, performing end hopping, Among them, the port knocking information includes at least a service IP address, a port knocking sequence, and a service port, the end information includes at least a service IP address, a port knocking sequence, and a service port, the changed end information is generated by the service gateway based on the comprehensive situational awareness score meeting a predetermined condition, and executing the end information jump includes switching communication with the service gateway using the changed end information.

Images