Firewall protection method, system, device and storage medium based on enhanced content analysis and two-way authentication

Abstract

The present invention discloses a firewall protection method, system and device based on enhanced content analysis and two-way authentication. The method includes performing a rule review based on the packet header information on the original data packet from the request end; after passing the rule review, performing a content review on the original data packet based on a pre-established legal business content recognition model to determine whether the content of the original data packet is a legal business request; after determining that the content of the original data packet is a legal business request, calculating the original summary value of the original data packet; based on the original summary value, performing signature verification on the request end; based on the original summary value, performing signature verification on the service end. The present invention detects and blocks data packets flowing through the system by matching according to the built-in rule base; at the same time, the content analysis function is enhanced, and a two-way security authentication method is adopted to further enhance the protection capability of the firewall.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a firewall protection method, system and device based on enhanced content analysis and two-way authentication. Background Art

[0002] With the increasing complexity of current enterprise infrastructure, the increasing number of business types, and the increasing variety of communication protocols, coupled with increasingly covert attack methods and inevitable vulnerabilities, the traditional firewall protection method based on packet filtering judgment rules has become difficult to adapt to the security protection requirements of modern enterprise network infrastructure. New enhancement methods are urgently needed to improve the protection capabilities of firewalls to cope with the increasingly severe threat situation.

[0003] The existing mainstream firewall technology is developed on the basis of packet filtering firewall technology, including dynamic packet filtering technology, application layer firewall technology and state monitoring firewall technology. Among them, the application layer firewall is deployed between the trusted network and the untrusted network, replacing various network clients to perform application layer connections, that is, providing proxy services, and all its access is controlled at the application layer; the state monitoring firewall has higher intelligence and security than the packet filtering firewall. After the session successfully establishes a connection, it records the state information and updates it in real time. All session data must match the state table information, otherwise the session will be blocked.

[0004] These technologies have improved the protection capabilities of firewalls to a certain extent, but the essence of their protection is still a single protection method based on rules. They are powerless against attacks launched by internal personnel and are limited by the lag in rule updates. They are difficult to guard against constantly updated attack methods and can only work against known network threats.

[0005] Based on this, a new solution is needed. Summary of the invention

[0006] The main purpose of the present invention is to provide a firewall protection method, system and device based on enhanced content analysis and two-way authentication.

[0007] To achieve the above object, the present invention provides a firewall protection method based on enhanced content analysis and two-way authentication, comprising the following steps:

[0008] Conduct rule review based on packet header information on the original data packet from the requesting end;

[0009] After passing the rule review, the original data packet is subject to content review based on a pre-established legal business content recognition model to determine whether the content of the original data packet is a legal business request;

[0010] After determining that the content of the original data packet is a legitimate service request, calculating the original summary value of the original data packet;

[0011] Based on the original digest value, performing signature verification on the requesting end;

[0012] Based on the original digest value, the signature of the server is verified.

[0013] In the firewall protection method based on enhanced content analysis and two-way authentication provided by the present invention, the step of performing rule review based on packet header information on the original data packet from the request end includes:

[0014] Obtaining packet header information of the original data packet;

[0015] The access control list is queried based on the packet header information and compared with a preset policy. If the packet header information conforms to the preset policy, the rule verification is passed.

[0016] In the firewall protection method based on enhanced content analysis and two-way authentication provided by the present invention, the step of performing signature verification on the requesting end based on the original digest value includes:

[0017] Receiving, via a server-side security agent, an original data packet from a firewall and first signature information of the requesting end on the original digest value, wherein the first signature information is generated by performing signature calculation on the original digest value using a private key of the requesting end;

[0018] Performing hash calculation on the actual data packet received by the server-side security agent to obtain an actual digest value;

[0019] Using the requester public key to perform signature verification on the first signature information to obtain the original summary value of the original data packet, wherein the requester public key is obtained by the server security agent calling the PKI system;

[0020] When the original digest value is equal to the actual digest value, it is determined that the requesting end passes the signature verification.

[0021] In the firewall protection method based on enhanced content analysis and two-way authentication provided by the present invention, the step of performing signature verification on the server based on the original digest value includes:

[0022] Receiving, via the requester security agent, second signature information of the actual digest value by the server, wherein the second signature information is generated by performing signature calculation on the actual digest value by the server private key;

[0023] Using the server public key to verify the signature of the second signature information line to obtain a summary value of the server feedback data packet, wherein the server public key is obtained by the requesting end security agent calling the PKI system;

[0024] When the digest value of the data packet fed back by the server is equal to the original digest value, it is determined that the server passes the signature verification.

[0025] The present invention also provides a firewall protection system based on enhanced content analysis and two-way authentication, including a request-side security agent, a server-side security agent, a PKI system, a content analysis packet filtering protection wall module, a server-side signature verification module and a request-side signature verification module, wherein the request-side security agent is connected between the request-side and the content analysis packet filtering protection wall module, the server-side security agent is connected between the server and the content analysis packet filtering protection wall module, the content analysis packet filtering protection wall module is also connected to the PKI system, the server-side signature verification module is connected to the request-side security agent, and the request-side signature verification module is connected to the server-side security agent.

[0026] The content analysis packet filtering protection wall module includes a rule review unit for performing a rule review on the original data packet from the request end based on the packet header information, a content review unit for performing a content review on the original data packet based on a pre-established legal business content recognition model after passing the rule review to determine whether the content of the original data packet is a legal business request, and a calculation unit for calculating the original summary value of the original data packet after determining that the content of the original data packet is a legal business request;

[0027] The server-side signature verification module is used to perform signature verification on the requester based on the original digest value;

[0028] The requester signature verification module is used to perform signature verification on the server based on the original digest value.

[0029] In the firewall protection system based on enhanced content analysis and two-way authentication provided by the present invention, the rule review unit is used to obtain the header information of the original data packet, and query the access control list based on the header information and compare it with the preset policy. If the header information complies with the preset policy, the rule verification is passed.

[0030] In the firewall protection system based on enhanced content analysis and two-way authentication provided by the present invention, the server-side signature verification module includes:

[0031] A server-side data receiving unit, configured to receive, via a server-side security agent, an original data packet from a firewall and first signature information of the requesting end on the original digest value, wherein the first signature information is generated by performing signature calculation on the original digest value using a private key of the requesting end;

[0032] A server-side computing unit, configured to perform a hash calculation on the actual data packet received by the server-side security agent to obtain an actual digest value, and perform signature verification on the first signature information using the requester public key to obtain the original digest value of the original data packet, wherein the requester public key is obtained by the server-side security agent calling the PKI system;

[0033] The server-side determination unit is used to determine that the requesting end passes the signature verification when the original digest value is equal to the actual digest value.

[0034] In the firewall protection system based on enhanced content analysis and two-way authentication provided by the present invention, the requester signature verification module includes:

[0035] A requester data receiving unit, configured to receive, via the requester security agent, second signature information of the actual digest value from the server, wherein the second signature information is generated by performing signature calculation on the actual digest value using a server private key;

[0036] A requester computing unit, configured to use a server public key to verify the signature of the second signature information row, and obtain a summary value of a server feedback data packet, wherein the server public key is obtained by the requester security agent calling a PKI system;

[0037] The request end determination unit is used to determine that the server has passed the signature verification when the summary value of the data packet fed back by the server is equal to the original summary value.

[0038] The present invention also provides a firewall protection device based on enhanced content analysis and two-way authentication, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the firewall protection method based on enhanced content analysis and two-way authentication as described above are implemented.

[0039] The present invention also provides a storage medium storing one or more programs, which can be executed by one or more processors to implement the steps of the firewall protection method based on enhanced content analysis and two-way authentication as described above.

[0040] The firewall protection system and method based on enhanced content analysis and two-way authentication provided by the present invention have the following beneficial effects: the firewall protection method based on enhanced content analysis and two-way authentication provided by the present invention, based on the rule-based filtering function of the traditional packet filtering firewall, builds a recognition model based on deep learning for the domain knowledge of the specific application environment, and realizes the recognition and filtering function based on the content information of the legitimate request service data packet; through the analysis and judgment based on the payload content of the data packet, it copes with the threats brought by the current hidden and diverse malicious traffic and constantly updated network attack methods; adds signature verification of the request data packet from the request subject end and the service object end respectively, realizes the inspection of data integrity through the hash algorithm, and effectively prevents the data packet from being infected by viruses or malicious codes; through the signature and verification of the data packet by the request end, it ensures that the data packet has not been tampered with; through the reverse verification of the data packet by the service end, it ensures that the provided service resources are indeed the resources applied for by the request subject, and prevents network attacks initiated by internal personnel of the protected network. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below. Obviously, the drawings in the following description are only embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on the provided drawings without creative work:

[0042] Figure 1 Shown is a flow chart of a firewall protection method based on enhanced content analysis and two-way authentication provided by an embodiment of the present invention;

[0043] Figure 2 Shown is a framework diagram of a firewall protection system based on enhanced content analysis and two-way authentication provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to facilitate understanding of the present invention, the present invention will be described more fully below with reference to the relevant drawings. Typical embodiments of the present invention are given in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive.

[0045] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0046] Figure 1FIG. 1 is a flowchart of a firewall protection method based on enhanced content analysis and two-way authentication provided by an embodiment of the present invention. Figure 1 As shown, the firewall protection method based on enhanced content analysis and two-way authentication includes the following steps:

[0047] Step S1, performing rule review based on packet header information on the original data packet from the requesting end;

[0048] Specifically, in one embodiment of the present invention, the requesting end is the active initiator of the request, which usually includes types such as users, devices, and business applications, and is located in an untrusted external network environment outside the firewall; the service end is the target accessed by the requesting subject, which usually includes resource types such as services, applications, interfaces, and data, and is located inside the firewall system. When the firewall receives a data packet that needs to be forwarded from the requesting end, it first obtains the packet header information (including but not limited to the source address, destination address, source port, destination port, TCP flag, ICMP protocol message type, message code, etc.); then it queries the access control list (ACL) and compares it with the set policy (group). If it is inconsistent with the policy (group), it is directly discarded or blocked. If it complies with the policy (group), it enters the next step of verification processing. Therefore, step S1 includes:

[0049] Obtaining packet header information of the original data packet;

[0050] The access control list is queried based on the packet header information and compared with a preset policy. If the packet header information conforms to the preset policy, the rule verification is passed.

[0051] In this embodiment, by performing preliminary screening based on rule review of packet header information, traffic can be accurately filtered and controlled without increasing excessive resource consumption.

[0052] Step S2: after passing the rule review, the original data packet is subject to content review based on a pre-established legal business content recognition model to determine whether the content of the original data packet is a legal business request;

[0053] Specifically, in one embodiment of the present invention, a deep learning-based technology is used to learn the features of normal request service data packets of various legitimate requesters in advance, and establish a corresponding legitimate service content recognition model. The deep learning model can recognize more complex data patterns and has a strong detection capability for hidden features in malicious requests (such as advanced persistent threats (APT), zero-day attacks, etc.). Its training process can improve the generalization ability of the model and maintain a high accuracy in the face of ever-changing malicious attacks. By analyzing different types of legitimate service requests, key features in the data packet (such as request method, parameter format, data traffic pattern, etc.) are extracted to establish the input feature set of the model. These features can be information such as the network layer (such as IP address, port number) and the transport layer (such as protocol, data packet size), or they can go deep into the application layer (such as the URL of the HTTP request, field content, etc.). Then, these extracted features are trained using deep learning methods (such as convolutional neural network (CNN), long short-term memory network (LSTM), etc.). The features learned by the model can automatically identify the difference between normal service traffic and malicious traffic. In this way, various attack methods such as SQL injection, cross-site scripting (XSS), malicious file upload, etc. can be effectively detected.

[0054] Specifically, in one embodiment of the present invention, a data packet that has passed the rule review will be input into a trained legal business content recognition model. The model determines whether the data packet is a legal request based on the content and characteristics of the business data packet. If the content of the data packet matches the normal business request characteristics learned by the model, the data packet will be regarded as a legal business request and enter the next step of processing. If the content of the data packet does not match the characteristics of the normal request, it will be judged as an illegal request. At this time, you can choose to discard or block the data packet to prevent it from causing potential harm to the system.

[0055] In this embodiment, the legitimate business content recognition model established based on deep learning has a powerful pattern recognition capability and can identify attack features hidden in data packets. For example, some attackers may use encryption, obfuscation or segmented transmission to hide their malicious traffic. The legitimate business content recognition model can effectively identify such hidden attacks by learning the complex features of different attacks. At the same time, with the continuous development of network attack technology, new attack methods and malicious traffic forms continue to emerge. Through deep learning, the model can adapt to new attack patterns in the constantly updated training data. Whenever a new malicious request is identified and labeled, the model can be optimized through incremental learning and continuous training to make it more adaptable and defensive. Traditional packet filtering systems may face a certain false alarm rate or missed alarm rate, especially when facing complex attack forms. The deep learning model can effectively reduce the false alarm rate and improve the recognition ability of new malicious requests by learning a large amount of normal traffic.

[0056] This embodiment adds a deep learning recognition function to the firewall's rule filtering function, providing a stronger defense capability for the network security system. Even if an attacker circumvents conventional rule filtering, the deep learning model can still perform in-depth analysis based on the content and traffic pattern of the data packet, providing an additional layer of protection.

[0057] By combining rule review and deep learning-based identification of legitimate business content, the firewall's security and ability to respond to complex attacks have been significantly improved. The introduction of deep learning enables the firewall to not only identify known attacks, but also adapt to new malicious traffic patterns, effectively improving the level of protection. As a result, the system can more intelligently identify and block malicious traffic, reduce false positives and false negatives, and provide more accurate and dynamic security protection for the network environment.

[0058] Step S3, after determining that the content of the original data packet is a legitimate service request, calculating the original summary value of the original data packet;

[0059] Specifically, in one embodiment of the present invention, a specific digest algorithm (including but not limited to SM3 algorithm, md5, SHA-1 algorithm, etc.) is used to perform hash calculation on the data packets that pass the above rules and content review to generate the corresponding data packet original digest value MD1.

[0060] Step S4: Based on the original digest value, perform signature verification on the requesting end;

[0061] Specifically, in one embodiment of the present invention, the firewall calls the PKI system to implement the request end to sign the digest value of the data packet that meets the review, so that the service end can determine whether the request data packet is sent by the request end and whether it has been tampered with during the transmission process. The specific steps are as follows:

[0062] Step S41: receiving, via a server-side security agent, an original data packet from a firewall and first signature information of the requesting end on the original digest value, wherein the first signature information is generated by performing signature calculation on the original digest value using a private key of the requesting end;

[0063] In this embodiment, the firewall uses the request-side security agent to obtain the private key Rpri-key of the request subject, uses this private key to calculate the signature of the data packet digest value MD1, generates the signature information DS-req of the requester on the data packet digest value, and sends the original data packet together with the digest signature information to the server-side security agent for caching;

[0064] Step S42, performing hash calculation on the actual data packet received by the server security agent to obtain an actual digest value;

[0065] In this embodiment, after receiving the data packet and the digest signature information DS-req, the server-side security agent first selects the same digest algorithm to perform hash calculation on the received data packet to obtain the actual digest value MD2 of the received data packet;

[0066] Step S43: Use the requester public key to perform signature verification on the first signature information to obtain the original summary value of the original data packet, wherein the requester public key is obtained by the server security agent calling the PKI system;

[0067] In this embodiment, the server-side security agent uses the firewall to call the PKI system to obtain the public key Rpub-key of the request subject to perform signature verification on the summary signature information DS1, and obtain the original summary value MD1 of the received data packet;

[0068] Step S44: When the original digest value is equal to the actual digest value, it is determined that the requesting end passes the signature verification.

[0069] In this embodiment, MD1 is compared with MD2; if MD1≠MD2, it means that the access request data packet of the subject to the object has been tampered with and the data packet will be discarded; if MD1=MD2, it proves that it is indeed the data packet sent by the requesting end and has not been tampered with during the transmission process, and the next reverse verification stage can be entered.

[0070] Step S5: Based on the original digest value, perform signature verification on the server.

[0071] Specifically, in one embodiment of the present invention, after completing the subject verification, the firewall calls the PKI system to implement the reverse verification function of the server to the subject, so that the requesting subject can confirm that the service object is indeed the access object requested by the subject and has not been impersonated. The specific steps are as follows:

[0072] Step S51: receiving, via the requesting end security agent, second signature information of the actual digest value from the server, wherein the second signature information is generated by performing signature calculation on the actual digest value using a server private key;

[0073] In this embodiment, the service object sends its own private key Spri-key to the firewall through the service-side security agent, and uses the PKI system to sign the digest value MD2 of the actual data packet received with this private key, obtains the signature information DS-ser of the service party on the digest value of the data packet, and sends it to the requester security agent;

[0074] Step S52: Verify the signature of the second signature information row using the server public key to obtain a summary value of the server feedback data packet, wherein the server public key is obtained by the requesting end security agent calling the PKI system;

[0075] In this embodiment, after receiving the signature information DS-ser from the server through the security agent, the requester calls the PKI system to obtain the public key Spub-key of the service object to perform signature verification on the summary signature information DS-ser, and obtains the summary value MD3 of the data packet fed back by the server;

[0076] Step S53: When the digest value of the data packet fed back by the server is equal to the original digest value, it is determined that the server passes the signature verification.

[0077] In this embodiment, MD3 is compared with the original data packet digest value MD1 originally existing in the requesting end. If MD3≠MD1, it means that the data packet fed back by the service object is inconsistent with the data packet sent by the requesting party, and there may be internal service fraud, and the firewall will terminate the access of the data packet; if MD3=MD1, it proves that it is indeed the data packet fed back by the server and has not been tampered with during the transmission process, then the firewall will notify the server security agent to release the cached data and allow it to access the server resources.

[0078] This embodiment adds signature verification functions in both the request subject and service object directions. The firewall system can not only improve the integrity check of the request data packet, but also strengthen the two-way non-repudiation, thereby effectively improving the firewall's defense capabilities against various complex network attacks (including internal attacks, tampering, replay, etc.). The introduction of this measure can make the firewall more intelligent and efficient in dealing with the increasingly severe security threats in the modern network environment and meet the increasingly stringent network security requirements.

[0079] The firewall protection method based on enhanced content analysis and two-way authentication provided by the present invention has the following advantages:

[0080] 1. On the basis of the rule-based filtering function of traditional packet filtering firewalls, a recognition model based on deep learning is built for the domain knowledge of specific application environments to realize the recognition and filtering function based on the content information of legitimate request business data packets. Through the analysis and judgment based on the content of data packet payload, it can deal with the threats brought by the current hidden and diverse malicious traffic and constantly updated network attack methods;

[0081] 2. Add signature verification of the request data packet from the request subject and service object respectively, implement data integrity verification through hash algorithm, and effectively prevent the data packet from being infected by viruses or malicious codes; ensure that the data packet has not been tampered with by signing and verifying the data packet on the request side; ensure that the service resources provided are indeed the resources requested by the request subject through reverse verification of the data packet on the server side, and prevent network attacks initiated by internal personnel of the protected network.

[0082] Figure 2 FIG. 1 is a framework diagram of a firewall protection system based on enhanced content analysis and two-way authentication provided by the present invention. Figure 2 As shown, the firewall protection system based on enhanced content analysis and two-way authentication includes:

[0083] Requester security agent 210: This module is responsible for classifying, managing, maintaining and updating the private keys corresponding to the access requesting subjects (including but not limited to users, devices, systems, applications, etc.), and is responsible for caching the data to be authenticated;

[0084] Server security agent 220: This module is responsible for class management, maintenance and updating of private keys corresponding to service objects (including but not limited to various services, applications, interfaces and data resources, etc.) in the application business environment, and is responsible for caching the data to be authenticated;

[0085] Content analysis packet filtering firewall module 230: As the most important component of the two-way authentication firewall system, the content analysis packet filtering firewall has not only the rule-based access control function of the traditional firewall, but also adds the content analysis and identification judgment function based on the deep learning recognition model; in addition, the module also includes the conventional packet filtering firewall functions such as configuration management, log management, flow control, network address translation, etc.

[0086] Brain-like computing power support platform module 240: responsible for providing computing power support for content-based filtering analysis for firewalls. The platform simulates the thinking mode of the human brain and adopts a parallel computing framework that integrates computing, storage, and communication. It provides powerful computing power for the firewall to use deep learning to train, modify, and execute recognition models when performing content analysis. It also supports elastic scaling of computing nodes and flexible assembly of distributed clusters, and efficiently adapts to the operating environment of the firewall system.

[0087] PKI system 250: This system is responsible for providing basic support functions for two-way authentication of the firewall system. Its main functions cover identity authentication, data confidentiality, data integrity, non-repudiation of behavior, certificate management, key management, cross-platform and compatibility, etc.

[0088] Specifically, in one embodiment of the present invention, the content analysis packet filtering firewall module includes a rule review unit that performs rule review on the original data packet from the request end based on packet header information, a content review unit that performs content review on the original data packet based on a pre-established legal business content recognition model after passing the rule review to determine whether the content of the original data packet is a legal business request, and a calculation unit that calculates the original summary value of the original data packet after determining that the content of the original data packet is a legal business request.

[0089] Specifically, in one embodiment of the present invention, the server-side signature verification module is provided at the server 260 for performing signature verification on the requesting end based on the original digest value. Specifically, it includes: a server-side data receiving unit, which is used to receive the original data packet from the firewall and the first signature information of the requesting end on the original digest value via the server-side security agent, wherein the first signature information is generated by the signature calculation of the original digest value by the private key of the requesting end; a server-side calculation unit, which is used to perform hash calculation on the actual data packet received by the server-side security agent to obtain the actual digest value, and perform signature verification on the first signature information using the public key of the requesting end to obtain the original digest value of the original data packet, wherein the public key of the requesting end is obtained by the server-side security agent calling the PKI system; a server-side determination unit, which is used to determine that the requesting end has passed the signature verification when the original digest value is equal to the actual digest value.

[0090] Specifically, in one embodiment of the present invention, the request end 270 is provided with the request end signature verification module for performing signature verification on the server based on the original summary value. Specifically, it includes: a request end data receiving unit, for receiving the second signature information of the server on the actual summary value via the request end security agent, wherein the second signature information is generated by the server end private key performing signature calculation on the actual summary value; a request end calculation unit, for performing signature verification on the second signature information using the server end public key to obtain the summary value of the server end feedback data packet, wherein the server end public key is obtained by the request end security agent calling the PKI system; a request end determination unit, for determining that the server end has passed the signature verification when the summary value of the server end feedback data packet is equal to the original summary value.

[0091] In the firewall protection system based on enhanced content analysis and two-way authentication provided by the present invention, component modules are coupled together to work together, and the integrity verification and two-way signature authentication of the transmitted information are realized through the security agent in conjunction with the PKI support system. The analysis and identification of the data packet content are realized through the brain-like computing support platform in conjunction with the content analysis packet filtering firewall module, thereby avoiding the problems of hardware energy efficiency limitations and cost surges caused by a single firewall device realizing all functions, and realizing the requirements of efficient and reliable dynamic isolation control of the firewall system in a flexible and low-cost manner.

[0092] The embodiment of the present invention further provides a firewall protection device based on enhanced content analysis and two-way authentication, which may include:

[0093] Memory for storing computer programs;

[0094] The processor can implement the following steps when executing the computer program stored in the above memory:

[0095] Performing a rule review based on the packet header information on the original data packet from the requesting end; after passing the rule review, performing a content review on the original data packet based on a pre-established legal business content identification model to determine whether the content of the original data packet is a legal business request; after determining that the content of the original data packet is a legal business request, calculating the original summary value of the original data packet; performing signature verification on the requesting end based on the original summary value; performing signature verification on the service end based on the original summary value.

[0096] The embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps can be implemented;

[0097] Performing a rule review based on the packet header information on the original data packet from the requesting end; after passing the rule review, performing a content review on the original data packet based on a pre-established legal business content identification model to determine whether the content of the original data packet is a legal business request; after determining that the content of the original data packet is a legal business request, calculating the original summary value of the original data packet; performing signature verification on the requesting end based on the original summary value; performing signature verification on the service end based on the original summary value.

[0098] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM) > a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0099] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0100] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0101] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0102] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

Claims

1. A firewall protection method based on enhanced content analysis and two-way authentication, characterized in that: The following steps are involved: Conduct rule review based on packet header information on the original data packet from the requesting end; After passing the rule review, the original data packet is subject to content review based on a pre-established legal business content recognition model to determine whether the content of the original data packet is a legal business request; After determining that the content of the original data packet is a legitimate service request, calculating the original summary value of the original data packet; Based on the original digest value, performing signature verification on the requesting end; Based on the original digest value, the server performs signature verification; The step of performing signature verification on the requesting end based on the original digest value includes: Receiving, via a server-side security agent, an original data packet from a firewall and first signature information of the requesting end on the original digest value, wherein the first signature information is generated by performing signature calculation on the original digest value using a private key of the requesting end; Performing hash calculation on the actual data packet received by the server-side security agent to obtain an actual digest value; Using the requester public key to perform signature verification on the first signature information to obtain the original summary value of the original data packet, wherein the requester public key is obtained by the server security agent calling the PKI system; When the original digest value is equal to the actual digest value, determining that the requesting end passes the signature verification; Based on the original digest value, the steps of performing signature verification on the server include: Receiving, via the requester security agent, second signature information of the actual digest value by the server, wherein the second signature information is generated by performing signature calculation on the actual digest value by the server private key; Using the server public key to verify the signature of the second signature information line to obtain a summary value of the server feedback data packet, wherein the server public key is obtained by the requesting end security agent calling the PKI system; When the digest value of the data packet fed back by the server is equal to the original digest value, it is determined that the server passes the signature verification.

2. The firewall protection method based on enhanced content analysis and two-way authentication as claimed in claim 1, characterized in that: The steps of checking the rules based on the packet header information of the original data packet from the requesting end include: Obtaining packet header information of the original data packet; The access control list is queried based on the packet header information and compared with a preset policy. If the packet header information conforms to the preset policy, the rule verification is passed.

3. A firewall protection system based on enhanced content analysis and two-way authentication, characterized in that: It includes a request-side security agent, a server-side security agent, a PKI system, a content analysis packet filtering protection wall module, a server-side signature verification module and a request-side signature verification module, wherein the request-side security agent is connected between the request-side and the content analysis packet filtering protection wall module, the server-side security agent is connected between the server and the content analysis packet filtering protection wall module, the content analysis packet filtering protection wall module is also connected to the PKI system, the server-side signature verification module is connected to the request-side security agent, and the request-side signature verification module is connected to the server-side security agent. The content analysis packet filtering protection wall module includes a rule review unit for performing a rule review on the original data packet from the request end based on the packet header information, a content review unit for performing a content review on the original data packet based on a pre-established legal business content recognition model after passing the rule review to determine whether the content of the original data packet is a legal business request, and a calculation unit for calculating the original summary value of the original data packet after determining that the content of the original data packet is a legal business request; The server-side signature verification module is used to perform signature verification on the requester based on the original digest value; The requester signature verification module is used to perform signature verification on the server based on the original digest value; The server-side signature verification module includes: A server-side data receiving unit, configured to receive, via a server-side security agent, an original data packet from a firewall and first signature information of the requesting end on the original digest value, wherein the first signature information is generated by performing signature calculation on the original digest value using a private key of the requesting end; A server-side computing unit, configured to perform a hash calculation on the actual data packet received by the server-side security agent to obtain an actual digest value, and perform signature verification on the first signature information using the requester public key to obtain the original digest value of the original data packet, wherein the requester public key is obtained by the server-side security agent calling the PKI system; A server-side determination unit, configured to determine that the requesting end passes the signature verification when the original digest value is equal to the actual digest value; The requester signature verification module includes: A requester data receiving unit, configured to receive, via the requester security agent, second signature information of the actual digest value from the server, wherein the second signature information is generated by performing signature calculation on the actual digest value using a server private key; A requester computing unit, configured to use a server public key to verify the signature of the second signature information row, and obtain a summary value of a server feedback data packet, wherein the server public key is obtained by the requester security agent calling a PKI system; The request end determination unit is used to determine that the server has passed the signature verification when the summary value of the data packet fed back by the server is equal to the original summary value.

4. The firewall protection system based on enhanced content analysis and two-way authentication as claimed in claim 3, characterized in that: The rule review unit is used to obtain the header information of the original data packet, and query the access control list based on the header information and compare it with the preset policy. If the header information conforms to the preset policy, the rule verification is passed.

5. A firewall protection device based on enhanced content analysis and two-way authentication, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the firewall protection method based on enhanced content analysis and two-way authentication as described in any one of claims 1 to 2 are implemented.

6. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the firewall protection method based on enhanced content analysis and two-way authentication as described in any one of claims 1 to 2.

Images