Dynamic deployment network stealth method and device, electronic equipment and storage medium

Abstract

The invention provides a dynamic deployment network stealth method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining request information, and hiding a user identity in the request information; performing transfer encryption on the request information to form a first data packet, and adding header information in the first data packet; confusing the first data packet by using XOR operation to form a second data packet; determining an anonymous network, determining a transmission path of the request information according to the header information and the anonymous network, performing end-to-end encryption on the second data packet to form a third data packet, and transmitting the third data packet along the transmission path; wherein the transmission path comprises a preset deletion strategy. The method comprises the following steps: firstly hiding a user identity through transfer, encrypting and hiding a real data source through transfer, and meanwhile, encrypting and confusing request information and performing anonymous network transmission, so that the security and confidentiality of the request information in a transmission process are ensured, and meanwhile, the privacy of user information is ensured.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device and storage medium for dynamically deploying network stealth. Background Art

[0002] Network security is an important technology. Network security technology can effectively protect the security of data during transmission and storage, prevent data from being accessed, stolen or tampered with without authorization, and ensure the confidentiality and integrity of data. With the frequent occurrence of large-scale data leakage incidents and the continuous evolution of network attack methods, traditional network security protection methods have gradually revealed their limitations. Traditional static defense mechanisms are often difficult to cope with the ever-changing forms of attacks. Traditional dynamic deployment of network stealth control methods, during the dynamic deployment process, the system may be subject to malicious attacks or unauthorized access, resulting in system data leakage or other security threats. In addition, the flexibility of the dynamically deployed system may also be exploited by attackers, increasing the security challenges faced by the system. Summary of the invention

[0003] In view of this, the purpose of the present application is to propose a method, device, electronic device and storage medium for dynamically deploying network stealth that overcomes the above-mentioned problems or at least partially solves the above-mentioned problems.

[0004] Based on the above purpose, the first aspect of the present application provides a method for dynamically deploying network stealth, which is characterized by comprising:

[0005] Obtaining request information and hiding the user identity in the request information;

[0006] The request information is transit-encrypted to form a first data packet, and header information is added to the first data packet; the header information includes a transit address and a destination address;

[0007] Obfuscating the first data packet by using an XOR operation to form a second data packet;

[0008] Determine an anonymous network, determine a transmission path for the request information according to the header information and the anonymous network, perform end-to-end encryption on the second data packet to form a third data packet, and transmit the third data packet along the transmission path; wherein the transmission path includes a preset deletion policy.

[0009] Optionally, hiding the user identity in the request information includes:

[0010] Determining a proxy server or a virtual private network according to a source of the request information;

[0011] Generate a new IP address using the proxy server or virtual private network;

[0012] Replacing the original IP address of the request information with the new IP address;

[0013] A mapping strategy between the new IP address and the original IP address is established, and the mapping strategy is hidden in the proxy server or virtual private network.

[0014] Optionally, the request information is transit-encrypted to form a first data packet, and header information is added to the first data packet, including:

[0015] Using the proxy server or virtual private network to transfer the request information;

[0016] Encrypting the request information using a preset encryption algorithm to form a ciphertext;

[0017] The ciphertext is packaged to form a first data packet, and a transit address and a destination address are added to the first data packet; wherein the transit address is a transit end address of the proxy server or virtual private network.

[0018] Optionally, the request information is encrypted using a preset encryption algorithm to form a ciphertext, including:

[0019] Determine two random prime numbers, and the lengths of the two random prime numbers are equal;

[0020] According to the prime number, determine the modulus and the value of the Euler function;

[0021] Determine a number coprime to the Euler function value as a public key exponent;

[0022] Determine a private key exponent according to the public key exponent and the Euler function value;

[0023] Generate a private key according to the private key exponent and the modulus;

[0024] A public key is generated according to the public key exponent and the modulus, and the request information is encrypted using the public key to form a ciphertext.

[0025] Optionally, the Euler function value is expressed as:

[0026] α(N)=(P-1)(Q-1),

[0027] The private key exponent is expressed as:

[0028] (d*e)modα(N)=1,

[0029] The ciphertext is represented as:

[0030] c=m emodN ,

[0031] Wherein, N=P*Q, P and Q represent two random prime numbers respectively, d represents the private key exponent, e represents the public key exponent, and m represents the request information.

[0032] Optionally, obfuscating the first data packet by using an XOR operation to form a second data packet includes:

[0033] Dividing the first data packet into blocks according to a fixed length to form a plurality of data blocks;

[0034] Determining an obfuscation key, wherein the length of the obfuscation key is the same as the length of the data block, and the number of the obfuscation keys is the same as the number of the data blocks;

[0035] Performing an XOR operation on the obfuscated key and the data block to obtain an operation result;

[0036] The operation results are reorganized according to the positions of the data blocks in the first data packet to form a second data packet.

[0037] Optionally, determining an anonymous network, determining a transmission path of the request information according to the header information and the anonymous network, performing end-to-end encryption on the second data packet to form a third data packet, and transmitting the third data packet along the transmission path, wherein the transmission path includes a preset deletion policy, comprises:

[0038] Determine the transfer end and the destination end according to the header information;

[0039] Determine an anonymous network, and determine the transmission path according to the anonymous network, the transfer end, and the destination end;

[0040] Determine a transmission node according to the transmission path, wherein the transmission node includes an anonymous route;

[0041] According to the transfer end and the destination end, end-to-end encrypt the second data packet to form a third data packet;

[0042] In response to the third data packet passing through the current transmission node, the transmission node is deleted.

[0043] In a second aspect of the present application, a dynamically deployed network stealth device is provided, comprising:

[0044] A hiding module, used to obtain request information and hide the user identity in the request information;

[0045] A transit encryption module, used for transit encryption of the request information to form a first data packet, and adding header information to the first data packet;

[0046] An obfuscation module, configured to obfuscate the first data packet by using an XOR operation to form a second data packet;

[0047] A transmission module is used to determine an anonymous network, determine a transmission path for the request information according to the header information and the anonymous network, perform end-to-end encryption on the second data packet to form a third data packet, and transmit the third data packet along the transmission path; wherein the third transmission path includes a preset deletion strategy.

[0048] Optionally, hiding the user identity in the request information includes:

[0049] Determining a proxy server or a virtual private network according to a source of the request information;

[0050] Generate a new IP address using the proxy server or virtual private network;

[0051] Replacing the original IP address of the request information with the new IP address;

[0052] A mapping strategy between the new IP address and the original IP address is established, and the mapping strategy is hidden in the proxy server or virtual private network.

[0053] Optionally, the request information is transit-encrypted to form a first data packet, and header information is added to the first data packet, including:

[0054] Using the proxy server or virtual private network to transfer the request information;

[0055] Encrypting the request information using a preset encryption algorithm to form a ciphertext;

[0056] The ciphertext is packaged to form a first data packet, and a transit address and a destination address are added to the first data packet; wherein the transit address is a transit end address of the proxy server or virtual private network.

[0057] Optionally, the request information is encrypted using a preset encryption algorithm to form a ciphertext, including:

[0058] Determine two random prime numbers, and the lengths of the two random prime numbers are equal;

[0059] According to the prime number, determine the modulus and the value of the Euler function;

[0060] Determine a number coprime to the Euler function value as a public key exponent;

[0061] Determine a private key exponent according to the public key exponent and the Euler function value;

[0062] Generate a private key according to the private key exponent and the modulus;

[0063] A public key is generated according to the public key exponent and the modulus, and the request information is encrypted using the public key to form a ciphertext.

[0064] Optionally, the Euler function value is expressed as:

[0065] α(N)=(P-1)(Q-1),

[0066] The private key exponent is expressed as:

[0067] (d*e)modα(N)=1,

[0068] The ciphertext is represented as:

[0069] c=m emodN ,

[0070] Wherein, N=P*Q, P and Q represent two random prime numbers respectively, d represents the private key exponent, e represents the public key exponent, and m represents the request information.

[0071] Optionally, obfuscating the first data packet by using an XOR operation to form a second data packet includes:

[0072] Dividing the first data packet into blocks according to a fixed length to form a plurality of data blocks;

[0073] Determining an obfuscation key, wherein the length of the obfuscation key is the same as the length of the data block, and the number of the obfuscation keys is the same as the number of the data blocks;

[0074] Performing an XOR operation on the obfuscated key and the data block to obtain an operation result;

[0075] The operation results are reorganized according to the positions of the data blocks in the first data packet to form a second data packet.

[0076] Optionally, determining an anonymous network, determining a transmission path of the request information according to the header information and the anonymous network, performing end-to-end encryption on the second data packet to form a third data packet, and transmitting the third data packet along the transmission path, wherein the transmission path includes a preset deletion policy, comprises:

[0077] Determine the transfer end and the destination end according to the header information;

[0078] Determine an anonymous network, and determine the transmission path according to the anonymous network, the transfer end, and the destination end;

[0079] Determine a transmission node according to the transmission path, wherein the transmission node includes an anonymous route;

[0080] According to the transfer end and the destination end, end-to-end encrypt the second data packet to form a third data packet;

[0081] In response to the third data packet passing through the current transmission node, the transmission node is deleted.

[0082] According to a third aspect of the present application, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method described in the first aspect is implemented.

[0083] According to a fourth aspect of the present application, a non-transitory computer-readable storage medium is provided, wherein the non-transitory computer-readable storage medium stores computer instructions, wherein the computer instructions are used to enable a computer to execute the method described in the first aspect.

[0084] From the above description, it can be seen that the dynamically deployed network stealth method, device, electronic device and storage medium provided by the present application first hide the user identity through transit, and then use transit encryption to hide the real data source. At the same time, by encrypting, obfuscating and anonymously transmitting the request information over the network, the security and confidentiality of the request information during transmission are guaranteed, while the privacy of user information is guaranteed to prevent it from being stolen or monitored by malicious third-party attackers.

[0085] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0087] Figure 1 This is a flow chart of a method for dynamically deploying network stealth according to an embodiment of the present application;

[0088] Figure 2 This is a transit encryption flow chart of an embodiment of the present application;

[0089] Figure 3 This is a flow chart of the transmission method from the transit end to the destination segment in an embodiment of the present application;

[0090] Figure 4 A schematic diagram of an obfuscation method according to an embodiment of the present application;

[0091] Figure 5 A schematic diagram of a dynamically deployed network stealth device according to an embodiment of the present application;

[0092] Figure 6 A schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0093] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0094] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be the usual meanings understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0095] Figure 1 The flowchart of the method 100 for dynamically deploying network stealth in an embodiment of the present application is shown. The purpose of the method 100 is to first hide the user identity, then use transit encryption to hide the real data source, and at the same time, encrypt the request data, obfuscate and anonymously transmit it over the network to ensure the security and confidentiality of the request information during the transmission process, and prevent it from being stolen or monitored by a third-party malicious attacker. The method 100 starts with step 101. In step 101, the request information is obtained, and the user identity in the request information is hidden.

[0096] In this embodiment, if a user wants to obtain the required information, he directly sends the request information to the server with the user's location as the sending end. The attacker can obtain the request information during the transmission process and can also obtain the user's information based on the IP address in the request information, which cannot guarantee the security of the user's identity information. Therefore, the embodiment of the present application first hides the user's identity so that the attacker cannot determine the user's identity information.

[0097] Specifically, determining a proxy server or a virtual private network based on a source of the request information;

[0098] Generate a new IP address using a proxy server or a virtual private network;

[0099] Replace the original IP address of the request information with the new IP address;

[0100] Establish a mapping strategy between the new IP address and the original IP address, and hide the mapping strategy in a proxy server or virtual private network.

[0101] It should be noted that a source of request information does not correspond to only one proxy server or virtual private network, but may correspond to multiple ones. Similarly, a proxy server or virtual private network does not correspond to only one source of request information, but may correspond to multiple ones.

[0102] In this embodiment, if the proxy server or virtual private network is too far from the source of the request information, it will cause a delay in the transmission of the request information. Therefore, the most suitable proxy server or virtual private network is determined according to the source of the request information. The proxy server with the smallest current throughput can be selected as the proxy server corresponding to the source of the request information according to the current throughput of the proxy server.

[0103] The new IP address generated by the proxy server or virtual private network can be the IP address of the proxy server itself or an address in the address pool allowed by the proxy server and the virtual private network. The original IP address of the request information is used to uniquely identify the user's location on the Internet. The original IP address is replaced by a new IP address. Both the destination receiving the request information and the attacker will think that the request information comes from the new IP address rather than the user's real device, thereby improving the security of the user's identity information.

[0104] A mapping strategy between the new IP address and the original IP address is established. When the destination responds to the request information and returns data to the new IP address, the proxy server or virtual private network returns data to the original IP address according to the mapping strategy.

[0105] It is understandable that if the attacker does not know which specific proxy server or virtual private network it is, he cannot effectively attack the proxy server or virtual private network. Furthermore, the mapping strategy hides the proxy server or virtual private network and is not transmitted to the destination along with the request information. Even if the attacker obtains the request information transmitted to the destination, he cannot obtain the mapping strategy, nor can he obtain the original IP address and obtain the user's identity information.

[0106] In some optional embodiments, the proxy server or virtual private network also replaces the browser identifier and operating system information of the request information to hide the identity of the user.

[0107] Afterwards, in step 102, the request information is transit-encrypted to form a first data packet, and header information is added to the first data packet; the header information includes a transit address and a destination address.

[0108] Specifically, a proxy server or a virtual private network is used to relay the request information;

[0109] Encrypt the request information using a preset encryption algorithm to form a ciphertext;

[0110] The ciphertext is packaged to form a first data packet, and a transit address and a destination address are added to the first data packet; wherein the transit address is a transit end address of a proxy server or a virtual private network.

[0111] In this embodiment, in addition to using a proxy server or a virtual private network to hide the identity of the user in the request information, the request information is further transferred to hide the true source of the request information. Furthermore, through transit encryption, the user end does not need to preset one or more encryption algorithms, and each encryption algorithm requires corresponding key management, occupying the computing resources and memory resources of the user end. By using transit encryption of a proxy server or a virtual private network, powerful computing resources are suitable for different encryption algorithms, and a large amount of storage space facilitates key management.

[0112] While using the relay to hide the user identity of the request information, the real source of the request information is hidden, and then the request information is encrypted to further ensure the security of the request information. Header information is added to the first data packet to prepare for the subsequent transmission path from the relay end to the destination end.

[0113] In some embodiments, reference Figure 2 As shown, the request information is encrypted using a preset encryption algorithm to form a ciphertext, including:

[0114] S201. Determine two random prime numbers, and the lengths of the two random prime numbers are equal.

[0115] In this embodiment, the number of bits of the two prime numbers is 2048 bits.

[0116] S202. Determine the modulus and the value of the Euler function according to the prime number.

[0117] The modulus is: N = P * Q,

[0118] The value of the Euler function is: α(N)=(P-1)(Q-1).

[0119] S203. Determine a number that is coprime with the Euler function value as a public key exponent.

[0120] (d*e)modα(N)=1, where the public key exponent is coprime with the Euler function value and is an integer satisfying 1<e<α(N).

[0121] S204. Determine the private key exponent according to the public key exponent and the Euler function value.

[0122] The private key exponent is expressed as: (d*e)modα(N)=1, where d represents the private key exponent and mod represents the modular operation.

[0123] S205. Generate a private key according to the public key exponent and modulus.

[0124] The generated private key is (N,d).

[0125] S206. Generate a public key according to the public key exponent and the modulus, and use the public key to encrypt the request information to form a ciphertext.

[0126] The generated public key is (N, e). The user's request information is converted into an integer format, which is m. The public key is used to encrypt the data to generate the ciphertext c=m. emodN It is understandable that the private key is stored at the transfer end to decrypt the data sent back to the destination end.

[0127] Then, in step 103, the first data packet is obfuscated using an XOR operation to form a second data packet.

[0128] Specifically, the first data packet is divided into blocks according to a fixed length to form a plurality of data blocks.

[0129] An obfuscation key is determined, wherein a length of the obfuscation key is the same as a length of the data block, and a number of the obfuscation keys is the same as a number of the data blocks.

[0130] An XOR operation is performed on the obfuscated key and the data block to obtain an operation result.

[0131] The operation results are reorganized according to the positions of the data blocks in the first data packet to form a second data packet.

[0132] In this embodiment, the first data packet is divided into blocks according to a fixed length to form a plurality of data blocks. Then, an obfuscation key having the same number and length as the data blocks is formed. The data block is subjected to an XOR operation with the obfuscation key to obtain an operation result. By dividing the first data packet into blocks and performing an XOR operation with the obfuscation key, the amount of operation for each operation is reduced and the operation process is accelerated. Furthermore, by performing an XOR operation with different obfuscation keys and different data blocks, in the case where any obfuscation key is maliciously intercepted, the complete data of the first data packet cannot be obtained. If the first data packet is obfuscated as a whole with an obfuscation key, then in the case where the obfuscation key is maliciously intercepted, the data security of the first data packet cannot be most effectively guaranteed.

[0133] Finally, the calculation results are reorganized according to the position of the data blocks in the first data packet to form a second data packet, without affecting the integrity and order of the request information, making it convenient for subsequent decryption after reaching the destination, and obtaining complete and accurate data of the request information.

[0134] Exemplary, reference Figure 4 As shown, this is a process of performing a puzzle operation on one of the data blocks {b0, b1, b2, b3, b4, b5} and an obfuscation key {a0, a1, a2, a3, a4, a5} to obtain an operation result, wherein each bit in the data block is XORed with the bit at the corresponding position in the obfuscation key, if the two bits are the same, the result is 0, if the two bits are different, the result is 1, and finally the second data packet {s0, s1, s2, s3, s4, s5} is formed.

[0135] Then in step 104, an anonymous network is determined, a transmission path of the request information is determined based on the header information and the anonymous network, the second data packet is end-to-end encrypted to form a third data packet, and the third data packet is transmitted along the transmission path; wherein the transmission path includes a preset deletion strategy.

[0136] In some embodiments, reference Figure 3 As shown, step 104 includes:

[0137] S301. Determine the transfer end and the destination end according to the header information.

[0138] In this embodiment, the request information is not transmitted directly from the user end to the destination end, but is transmitted to the destination end after being transit-encrypted at the transit end. By adding header information, the transit end and the destination end are determined based on the source address and destination address in the header information.

[0139] S302: Determine an anonymous network, and determine a transmission path according to the anonymous network, the transfer end, and the destination end.

[0140] In an anonymous network, through a transfer end and a destination end, a transmission path from the transfer end to the destination end can be determined in the anonymous network. The transmission path can be the nearest transmission path, or multiple transmission paths can be provided as alternatives.

[0141] S303: Determine a transmission node according to the transmission path, where the transmission node includes an anonymous route.

[0142] The transmission path is determined, and the transmission nodes on the transmission path are determined accordingly. The transmission nodes are composed of anonymous routes. The transmitted data passes through each transmission node (anonymous route) on the transmission path, and is transmitted from the current transmission node to the next transmission node until it reaches the destination.

[0143] S304: Perform end-to-end encryption on the second data packet according to the transfer end and the destination end to form a third data packet.

[0144] Through end-to-end encryption, during the transmission from the transit end to the destination end, only the transit end and the destination end can decrypt and read the third data packet. The intermediate transmission node can only perform corresponding transmission but cannot decrypt and read it.

[0145] S305: In response to the third data packet passing through the current transmission node, the transmission node is deleted.

[0146] In this embodiment, the transmission nodes formed by anonymous routing further form a transmission path. After the transmission node completes the transmission, the transmission node is directly deleted, and the transmission path from the transfer end to the transmission node does not exist. The attacker cannot effectively attack the transmission path to maliciously intercept the third data packet. The anonymous network itself can effectively prevent attackers from intercepting the request information. By deleting the transmission node that has completed the transmission, the security of the request information is further guaranteed.

[0147] It should be noted that after the third data packet arrives at the destination, the destination is also preset with a decryption method corresponding to the encryption method and a deobfuscation method corresponding to the obfuscation method, and effectively decrypts the third data packet to obtain the request information.

[0148] The dynamically deployed network stealth method provided in the embodiment of the present application first hides the user identity through transit, and then uses transit encryption to hide the real data source. At the same time, by encrypting, obfuscating and anonymously transmitting the request data over the network, the security and confidentiality of the request information during the transmission process are guaranteed, while the privacy of the user information is guaranteed to prevent it from being stolen or monitored by malicious third-party attackers.

[0149] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0150] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0151] Based on the same technical concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a dynamically deployed network stealth device.

[0152] refer to Figure 5 , the dynamically deployed network stealth device comprises:

[0153] Hiding module 501, used to obtain request information and hide the user identity in the request information;

[0154] The transit encryption module 502 is used to transit encrypt the request information to form a first data packet, and add header information to the first data packet;

[0155] The obfuscation module 503 is used to obfuscate the first data packet by using an XOR operation to form a second data packet;

[0156] The transmission module 504 is used to determine an anonymous network, determine a transmission path for the request information according to the header information and the anonymous network, perform end-to-end encryption on the second data packet to form a third data packet, and transmit the third data packet along the transmission path; wherein the third transmission path includes a preset deletion policy.

[0157] In some embodiments, the hidden module 501 is specifically used to determine a proxy server or a virtual private network according to the source of the request information;

[0158] Generate a new IP address using the proxy server or virtual private network;

[0159] Replacing the original IP address of the request information with the new IP address;

[0160] A mapping strategy between the new IP address and the original IP address is established, and the mapping strategy is hidden in the proxy server or virtual private network.

[0161] In some embodiments, the transit encryption module 502 is specifically used to transit the request information using the proxy server or virtual private network;

[0162] Encrypting the request information using a preset encryption algorithm to form a ciphertext;

[0163] The ciphertext is packaged to form a first data packet, and a transit address and a destination address are added to the first data packet; wherein the transit address is a transit end address of the proxy server or virtual private network.

[0164] In some embodiments, the transit encryption module 502 is further used to determine two random prime numbers, and the lengths of the two random prime numbers are equal;

[0165] According to the prime number, determine the modulus and the value of the Euler function;

[0166] Determine a number coprime to the Euler function value as a public key exponent;

[0167] Determine a private key exponent according to the public key exponent and the Euler function value;

[0168] Generate a private key according to the private key exponent and the modulus;

[0169] A public key is generated according to the public key exponent and the modulus, and the request information is encrypted using the public key to form a ciphertext.

[0170] In some embodiments, the Euler function value is expressed as:

[0171] α(N)=(P-1)(Q-1),

[0172] The private key exponent is expressed as:

[0173] (d*e)modα(N)=1,

[0174] The ciphertext is represented as:

[0175] c=m emodN ,

[0176] Wherein, N=P*Q, P and Q represent two random prime numbers respectively, d represents the private key exponent, e represents the public key exponent, and m represents the request information.

[0177] In some embodiments, the obfuscation module 503 is specifically used to divide the first data packet into blocks according to a fixed length to form a plurality of data blocks;

[0178] Determining an obfuscation key, wherein the length of the obfuscation key is the same as the length of the data block, and the number of the obfuscation keys is the same as the number of the data blocks;

[0179] Performing an XOR operation on the obfuscated key and the data block to obtain an operation result;

[0180] The operation results are reorganized according to the positions of the data blocks in the first data packet to form a second data packet.

[0181] In some embodiments, the transmission module 504 is specifically used to determine the transfer end and the destination end according to the header information;

[0182] Determine an anonymous network, and determine the transmission path according to the anonymous network, the transfer end, and the destination end;

[0183] Determine a transmission node according to the transmission path, wherein the transmission node includes an anonymous route;

[0184] According to the transfer end and the destination end, end-to-end encrypt the second data packet to form a third data packet;

[0185] In response to the third data packet passing through the current transmission node, the transmission node is deleted.

[0186] For the convenience of description, the above device is described in terms of functions divided into various modules. Of course, when implementing the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0187] The device of the above embodiment is used to implement the corresponding dynamic deployment network stealth method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0188] Based on the same technical concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for dynamically deploying network stealth as described in any of the above embodiments is implemented.

[0189] Figure 6 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0190] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0191] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0192] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0193] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0194] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0195] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0196] The electronic device of the above embodiment is used to implement the corresponding dynamic deployment network stealth method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0197] Based on the same technical concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the dynamic deployment network stealth method as described in any of the above embodiments.

[0198] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0199] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the dynamic deployment network stealth method as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0200] Based on the same inventive concept, corresponding to the method for dynamically deploying network stealth described in any of the above embodiments, the present disclosure also provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer so that the computer and / or the processor execute the method for dynamically deploying network stealth. Corresponding to the execution subject corresponding to each step in each embodiment of the method for dynamically deploying network stealth, the processor that executes the corresponding step can belong to the corresponding execution subject.

[0201] The computer program product of the above embodiment is used to enable the computer and / or the processor to execute the method for dynamically deploying network stealth as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0202] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0203] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power supply / ground connection with the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented in the embodiments of the present application (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuits) to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0204] Although the present application has been described in conjunction with specific embodiments of the present application, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0205] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A method for dynamically deploying network stealth, characterized in that: include: Obtaining request information and hiding the user identity in the request information; Transit-encrypting the request information to form a first data packet, and adding header information to the first data packet; The header information includes a transit address and a destination address; Obfuscating the first data packet by using an XOR operation to form a second data packet; Determine an anonymous network, determine a transmission path for the request information according to the header information and the anonymous network, perform end-to-end encryption on the second data packet to form a third data packet, and transmit the third data packet along the transmission path; The transmission path includes a preset deletion strategy.

2. The method according to claim 1, characterized in that Hiding the user identity in the request information includes: Determining a proxy server or a virtual private network according to a source of the request information; Generate a new IP address using the proxy server or virtual private network; Replacing the original IP address of the request information with the new IP address; A mapping strategy between the new IP address and the original IP address is established, and the mapping strategy is hidden in the proxy server or virtual private network.

3. The method according to claim 2, characterized in that The request information is transit-encrypted to form a first data packet, and header information is added to the first data packet, including: Using the proxy server or virtual private network to transfer the request information; Encrypting the request information using a preset encryption algorithm to form a ciphertext; The ciphertext is packaged to form a first data packet, and a transit address and a destination address are added to the first data packet; wherein the transit address is a transit end address of the proxy server or virtual private network.

4. The method according to claim 3, characterized in that The request information is encrypted using a preset encryption algorithm to form a ciphertext, including: Determine two random prime numbers, and the lengths of the two random prime numbers are equal; According to the prime number, determine the modulus and the value of the Euler function; Determine a number coprime to the Euler function value as a public key exponent; Determine a private key exponent according to the public key exponent and the Euler function value; Generate a private key according to the private key exponent and the modulus; A public key is generated according to the public key exponent and the modulus, and the request information is encrypted using the public key to form a ciphertext.

5. The method according to claim 4, characterized in that The Euler function value is expressed as: α(N)=(P-1)(Q-1), The private key exponent is expressed as: (d*e)modα(N)=1, The ciphertext is represented as: c=m emodN , Wherein, N=P*Q, P and Q represent two random prime numbers respectively, d represents the private key exponent, e represents the public key exponent, and m represents the request information.

6. The method according to claim 1, characterized in that Obfuscating the first data packet by using an XOR operation to form a second data packet, including: Dividing the first data packet into blocks according to a fixed length to form a plurality of data blocks; Determining an obfuscation key, wherein the length of the obfuscation key is the same as the length of the data block, and the number of the obfuscation keys is the same as the number of the data blocks; Performing an XOR operation on the obfuscated key and the data block to obtain an operation result; The operation results are reorganized according to the positions of the data blocks in the first data packet to form a second data packet.

7. The method according to claim 1, characterized in that Determining an anonymous network, determining a transmission path of the request information according to the header information and the anonymous network, performing end-to-end encryption on the second data packet to form a third data packet, and transmitting the third data packet along the transmission path, wherein the transmission path includes a preset deletion strategy, including: Determine the transfer end and the destination end according to the header information; Determine an anonymous network, and determine the transmission path according to the anonymous network, the transfer end, and the destination end; Determine a transmission node according to the transmission path, wherein the transmission node includes an anonymous route; According to the transfer end and the destination end, end-to-end encrypt the second data packet to form a third data packet; In response to the third data packet passing through the current transmission node, the transmission node is deleted.

8. A dynamically deployed network stealth device, characterized in that: include: A hiding module, used to obtain request information and hide the user identity in the request information; A transit encryption module, used for transit encryption of the request information to form a first data packet, and adding header information to the first data packet; An obfuscation module, configured to obfuscate the first data packet by using an XOR operation to form a second data packet; A transmission module, used to determine an anonymous network, determine a transmission path of the request information according to the header information and the anonymous network, perform end-to-end encryption on the second data packet to form a third data packet, and transmit the third data packet along the transmission path; The third transmission path includes a preset deletion strategy.

9. The device according to claim 8, characterized in that Hiding the user identity in the request information includes: Determining a proxy server or a virtual private network according to a source of the request information; Generate a new IP address using the proxy server or virtual private network; Replacing the original IP address of the request information with the new IP address; A mapping strategy between the new IP address and the original IP address is established, and the mapping strategy is hidden in the proxy server or virtual private network.

10. The device according to claim 9, characterized in that The request information is transit-encrypted to form a first data packet, and header information is added to the first data packet, including: Using the proxy server or virtual private network to transfer the request information; Encrypting the request information using a preset encryption algorithm to form a ciphertext; The ciphertext is packaged to form a first data packet, and a transit address and a destination address are added to the first data packet; wherein the transit address is a transit end address of the proxy server or virtual private network.

11. The device according to claim 10, characterized in that The request information is encrypted using a preset encryption algorithm to form a ciphertext, including: Determine two random prime numbers, and the lengths of the two random prime numbers are equal; According to the prime number, determine the modulus and the value of the Euler function; Determine a number coprime to the Euler function value as a public key exponent; Determine a private key exponent according to the public key exponent and the Euler function value; Generate a private key according to the private key exponent and the modulus; A public key is generated according to the public key exponent and the modulus, and the request information is encrypted using the public key to form a ciphertext.

12. The device according to claim 11, characterized in that The Euler function value is expressed as: α(N)=(P-1)(Q-1), The private key exponent is expressed as: (d*e)modα(N)=1, The ciphertext is represented as: c=m emodN , Wherein, N=P*Q, P and Q represent two random prime numbers respectively, d represents the private key exponent, e represents the public key exponent, and m represents the request information.

13. The device according to claim 8, characterized in that Obfuscating the first data packet by using an XOR operation to form a second data packet, including: Dividing the first data packet into blocks according to a fixed length to form a plurality of data blocks; Determining an obfuscation key, wherein the length of the obfuscation key is the same as the length of the data block, and the number of the obfuscation keys is the same as the number of the data blocks; Performing an XOR operation on the obfuscated key and the data block to obtain an operation result; The operation results are reorganized according to the positions of the data blocks in the first data packet to form a second data packet.

14. The device according to claim 8, characterized in that Determining an anonymous network, determining a transmission path of the request information according to the header information and the anonymous network, performing end-to-end encryption on the second data packet to form a third data packet, and transmitting the third data packet along the transmission path, wherein the transmission path includes a preset deletion strategy, including: Determine the transfer end and the destination end according to the header information; Determine an anonymous network, and determine the transmission path according to the anonymous network, the transfer end, and the destination end; Determine a transmission node according to the transmission path, wherein the transmission node includes an anonymous route; According to the transfer end and the destination end, end-to-end encrypt the second data packet to form a third data packet; In response to the third data packet passing through the current transmission node, the transmission node is deleted.

15. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

16. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 7.

Images