Network access control method and system based on domestic server

Abstract

The invention relates to the technical field of network access control, and discloses a network access control method and system based on a localized server, and the method comprises the steps: obtaining first data of a first object; performing state detection on the first data to generate a first result; and obtaining an access control strategy table, and comparing the access control strategy table with the first data to form a second result. According to the method, network access control is carried out on the host side, so that the fine-grained network box control capability can be realized; network control is achieved through network driving monitoring, and the control intensity is high; the method does not depend on iptable, firewall and other host protection wall modules, and the autonomous controllability is high; c / S architecture application can realize unified display of network alarms and unified management and control of network strategies; and traffic visualization supports display of traffic details, including destination terminal information, source terminal information, network traffic types, handling modes and times, and recent access time.

Description

Technical Field

[0001] The present invention relates to the technical field of network access control, and in particular to a network access control method and system based on a domestic server. Background Art

[0002] At present, domestic substitution is an unstoppable step in the development of national information technology. However, in the current domestic server operating systems, the existing network control methods are either controlled through network layer devices, which has a coarse control granularity and low control intensity, and it is difficult to control network access between devices in the same network segment.

[0003] The other is host-layer network access control based on the operating system firewall. This network access control has a finer granularity and greater control. It can effectively control access based on a single host, but this method relies on the iptable firewall or firewalld firewall component, has a strong dependence on third parties, and is difficult to achieve unified management and unified policies. It is difficult to effectively manage and configure in a large-scale network.

[0004] Currently, the existing domestic server operating system firewall configuration is often carried out through command mode, without a graphical operation interface, which has high technical requirements for the configurator and is difficult to operate and maintain. Summary of the invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the technical problem solved by the present invention is that the existing network control methods have the problems of coarse control granularity, low control strength, strong dependence on third parties, and difficulty in achieving unified management and control and unified strategy.

[0007] To solve the above technical problems, the present invention provides the following technical solutions: a network access control method based on a domestic server, comprising: obtaining first data of a first object; performing status detection on the first data to generate a first result; obtaining an access control policy table, and comparing it with the first data to form a second result.

[0008] As a preferred solution of the network access control method based on a domestic server described in the present invention, before obtaining the first data of the first object, it also includes obtaining a data packet of the first object and extracting characteristic data from the data packet as the first data.

[0009] As a preferred solution of the network access control method based on a domestic server described in the present invention, wherein: the state detection of the first data includes obtaining a first state of the first data through state detection, and generating a first result according to the first state.

[0010] As a preferred solution of the network access control method based on a domestic server described in the present invention, wherein: after the status detection of the first data is performed to generate the first result, it also includes: evaluating according to the first result; presetting the first interval and the second interval to compare with the first result to determine the triggering of the action; the action includes the first action and the second action; the triggering includes, when the first result belongs to the first interval, executing the first action; when the first result belongs to the second interval, executing the second action.

[0011] As a preferred solution of the network access control method based on a domestic server described in the present invention, before obtaining the policy table, it also includes: the management system formulates a network access control policy, generates an access control policy table according to the network access control policy, and synchronizes the access control policy table to the first object.

[0012] As a preferred solution of the network access control method based on a domestic server described in the present invention, wherein: the first data includes but is not limited to obtaining data packets through a hook of the Netfilter architecture, and extracting five-tuple information from the data packets as feature data; the status detection includes but is not limited to HASH calculation, and judging whether the message belongs to an existing connection through status detection to generate a first result.

[0013] As a preferred solution of the network access control method based on a domestic server described in the present invention, wherein: the generating of the first result includes directly releasing the message when it belongs to an existing connection; when the message does not belong to an existing connection, matching the five-tuple information of the message with the rules stored in the access control policy table one by one to determine whether it can pass; if the message is allowed to pass, a new connection information is created in the connection chain and the HASH table for subsequent detection.

[0014] A network access control system based on a domestic server adopting any method described in the present invention, wherein: a data acquisition module, a detection module and a control module; the data acquisition module is used to collect data packets of a first object and extract characteristic data from the data packets as first data; the detection module is used to detect whether the message belongs to an existing connection based on the first data and generate a first result; the control module is used to compare the first data with an access control policy table to form a second result.

[0015] A computer device comprises: a memory and a processor; the memory stores a computer program, comprising: the steps of implementing any one of the methods of the present invention when the processor executes the computer program.

[0016] A computer-readable storage medium stores a computer program, comprising: when the computer program is executed by a processor, the steps of implementing any one of the methods of the present invention are implemented.

[0017] The beneficial effects of the present invention are as follows: the method of the present invention performs network access control on the host side, and can realize fine-grained network box control capability; realizes network control through network driver monitoring, and has strong control strength; does not rely on host protection wall modules such as iptable and firewalld, and has high autonomous controllability; C / S architecture application can realize unified display of network alarms and unified management and control of network policies; traffic visualization supports display of traffic details, including destination terminal information, source terminal information, network traffic type, disposal method and number of times, and most recent access time. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0019] Figure 1 An overall flow chart of a network access control method based on a domestic server provided by an embodiment of the present invention;

[0020] Figure 2 A Netfilter framework structure diagram of a network access control method based on a domestic server provided by an embodiment of the present invention;

[0021] Figure 3 An access control strategy flow chart of a network access control method based on a domestic server provided by an embodiment of the present invention;

[0022] Figure 4 A message filtering flow chart of a network access control method based on a domestic server provided by an embodiment of the present invention;

[0023] Figure 5 A schematic diagram of rules of a network access control method based on a domestic server provided for one embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0025] Example 1, reference Figure 1-5, as an embodiment of the present invention, provides a network access control method based on a domestic server, comprising:

[0026] S1: Acquire first data of a first object.

[0027] Further, in this application, the first object is the client software deployed on the domestic server operating system. Specifically, the client intercepts the data packet flow through the hook of the Netfilter architecture. The client sets the required hook as the interception point through the registration function in its driver layer. When the data packet passes, the hook call is automatically triggered. After the data packet is intercepted by the hook, the client network driver extracts the five-tuple information from the data packet header: source IP, destination IP, source port, destination port and protocol number.

[0028] The first data includes but is not limited to five-tuple information, user identity or device information, and deep inspection information of data packet content.

[0029] The Netfilter framework has various hook points at each layer of the network protocol, such as Figure 2 As shown in the figure, Netfilter is the main implementation framework for packet filtering, connection tracking (Connect Track), network address translation (NAT) and other functions in the kernel of the domestic operating system; this framework defines a series of hook points (Hook points) in the key process of processing packets in the network protocol stack, and registers a series of functions in these hook points to process the packets. These functions registered in the hook points are the packet passage policies set in the network protocol stack, which means that these functions can determine whether the kernel accepts or discards a certain packet. In other words, the processing results of these functions determine the "fate" of these network packets.

[0030] It should be noted that character devices refer to devices that can only read and write byte by byte. Data in the device cannot be read randomly and must be read in sequence. Character devices are stream-oriented devices. Common character devices include mouse, keyboard, serial port, console, and LED.

[0031] Character devices can be accessed through file nodes, such as / dev / tty1 and / dev / lp0. The only difference between these device files and ordinary files is that the access position can be moved forward and backward when accessing ordinary files, while most character devices are a data channel that can only be accessed sequentially. However, there are also character devices with data area characteristics, and the access position can be moved forward and backward when accessing them.

[0032] In the localized kernel code:

[0033] Use the struct cdev structure to abstract a character device;

[0034] The uniqueness of a character device is determined by a device number of type dev_t (divided into major and minor device numbers);

[0035] The interface functions provided by the character device to each VFS are defined through the operation method set of the struct file_operations type.

[0036] In an optional embodiment, the first object may also be a user identity or device information. In an environment using dynamic IP addresses, the IP may change frequently, resulting in failure of the control based on the quintuple. In this case, the device identifier (such as MAC address) or user identity (such as user ID) can ensure that the control rules are still applicable even if the IP address changes.

[0037] Furthermore, when user identity or device information is used as the first data, the extracted feature data is identification information such as MAC address, device ID or user identity ID. In the policy formulation of the management center, policies based on device identification or user ID are generated for different devices or user identities, and the matching mechanism is based on the uniqueness of the device or user identification. For example, the MAC address can uniquely identify the device, while the user identity information (such as user ID, account name) corresponds to a specific user.

[0038] S2: Perform status detection on the first data to generate a first result.

[0039] Furthermore, message filtering is a function that the network control method needs to implement. In this application, hook_in and hook_out functions are set for the two hook points NF_INET_PRE_ROUTING and NF_INET_POST_ROUTING respectively. Both hook functions actually call a function named check_pkg to determine whether the message passing through the hook point is allowed to pass.

[0040] like Figure 4 As shown in the figure, in the check_pkg function, the five-tuple information of the message is first extracted to determine whether it belongs to an existing connection (state detection). If it belongs to an existing connection, it is directly released, otherwise the five-tuple information of the message is matched with the rules stored in the rule table one by one to determine whether it can pass. If the message is allowed to pass, a new connection information is created in the connection chain and HASH table for subsequent detection.

[0041] Furthermore, the state detection includes but is not limited to HASH calculation, and whether the message belongs to an existing connection is determined through the state detection to generate a first result.

[0042] In this application, the stateful inspection firewall mainly determines whether to allow a message to pass based on the connection.

[0043] In order to establish a mapping between messages and connections, the five-tuple of the message (source IP, destination IP, source port, destination port, protocol number) is hashed together as the keyword of the HASH function. The calculated HASH value is the position of the connection corresponding to the current message in the HASH table.

[0044] The HASH table records the remaining survival time of the current connection. If the remaining survival time is 0, it means that the current message has not created a connection or the connection has timed out. The kernel module will decide whether to create a connection for it according to the rule table; if the remaining time is not 0, it means that a connection has been created for the current message, and the message will be released directly and the remaining time will be updated.

[0045] Furthermore, in order to prevent resources from being occupied, it is necessary to delete the connections in the connection chain that have no data flow for a long time. The Linux kernel provides a timer function for processing periodic work, and this function is used to implement the time control function.

[0046] Specifically, create a struct timer_list timer and bind it to the time_out function. When the timer times out, the time_out function will be called.

[0047] In the time_out function, the entire connection chain is traversed, and the remaining time of all connections is reduced by 1. When the remaining time of a connection is reduced to 0, it indicates that the link has timed out, and the connection node will be released and traversal will continue.

[0048] The timer timeout is 1 second; the initial remaining time when the connection is created is 60. Therefore, if a connection has no data transmission for more than 1 minute, it will be disconnected.

[0049] In an optional embodiment, the state detection can also be a red-black tree or a balanced binary tree. By using the red-black tree or the balanced binary tree, the balanced state of insertion, search and deletion is maintained through the structure of the balanced tree, so that fast connection state management can be achieved in scenarios with large amounts of data.

[0050] The specific steps are:

[0051] When a data packet arrives at the client, the system searches the red-black tree based on the five-tuple information of the data packet;

[0052] If the node corresponding to the five-tuple exists in the tree, it means that the data packet belongs to an existing connection and can be released directly. If the corresponding node is not found in the tree, the data packet belongs to a new connection and it is necessary to determine whether to allow the creation of a new connection node according to the rules;

[0053] If the data packet belongs to a new connection and complies with the rules (access control policy table), a new node is inserted into the tree. The key of the node is the five-tuple information of the data packet, and the value of the node can store the remaining survival time of the connection and other status information;

[0054] For data packets with existing connections, after finding the corresponding node in the red-black tree, the connection survival time will be updated. When updating, only the value of the node needs to be adjusted without changing the structure of the tree.

[0055] When the timer detects that a connection has timed out, the system finds the corresponding five-tuple node in the red-black tree and deletes it.

[0056] It should be noted that after each insertion, deletion or replacement, the red-black tree can provide near-logarithmic time efficiency in search, insertion and deletion operations by automatically balancing the structure. Red-black trees are particularly effective in large-scale connection state management and are suitable for network environments that require frequent additions and deletions and fast searches.

[0057] S3: Obtain an access control policy table, and compare it with the first data to form a second result.

[0058] Further, such as Figure 3 As shown in the figure, the specific steps of the access control policy are:

[0059] Formulate network access control policies in the management center, including five-tuple information and execution actions (allow or deny);

[0060] Generate an access control policy table based on the formulated policy, synchronize the policy table to the client and store it;

[0061] Match the five-tuple information obtained by the client network driver hook with the policy list one by one. If they match, determine whether the policy action is allowed. If yes, release the data packet. If not, discard the data packet. If not, discard it.

[0062] The lost data packet information will be reported to the management center and a blocking alarm record will be generated.

[0063] Specifically, the data structures obtained through the kernel hook include but are not limited to the rule table, the log table, the connection chain and the HASH table.

[0064] The policy data structure includes but is not limited to Rule class, Log class, Connection class and other functional functions.

[0065] Furthermore, Figure 5As shown, the policy management module is implemented in Java and Python, and is mainly used to uniformly manage the network access control policies of multiple domestic server operating systems to realize the formulation and issuance of network management and control policies.

[0066] a. Add, delete, check and modify rules

[0067] The most important function of the policy management module is rule maintenance, including outputting rules, creating new rules, and deleting rules.

[0068] Unlike log information and connection information which are mainly maintained by the kernel module, rule information adopts the mode of "local storage + remote push", that is, the storage, addition, query and deletion of rules are all operated in the local database, and the kernel module can only accept rules submitted by the user module in a unidirectional manner, but cannot output rule information to the user module. This can ensure that the previously created rule table can be saved every time the machine is restarted, and reduce the frequent data transmission between the kernel module and the user module, thereby increasing the execution efficiency of the system.

[0069] For new rules, the program will create a new Rule type object based on the user input information and save it in the local database through file read and write operations; for deleted rules, the program will delete the corresponding rule information in the local database according to the index value; for query rules, the program will add the rules stored in the local database to the rule table maintained by the user module.

[0070] After the local rules are maintained, the user can use the -c / --commit parameter to submit the rules to the kernel module. At this time, the policy management module first loads all the rule information in the local database into the rule table maintained by the user module. After that, the policy management module inputs the OP_WRITE_RULR operator to the character device created by the kernel module, and inputs all the rule tables stored in the policy management module into the character device; when the kernel module receives the OP_WRITE_RULR operator, it will begin to accept the rule table in the character device, realizing the flow of the rule table from the policy management module to the rule module.

[0071] b.Log information printing

[0072] When the -pl / log command is used, the program will print the currently stored log information.

[0073] When the -pl / log command is used, the policy management module will input the OP_GET_LOG operator to the character device created by the kernel module. When the kernel module receives the operator, it will output the log information it maintains to the character device. The policy management module then reads the log information obtained from the character device, loads it into the log table it maintains, and uploads it to the management center for alarm.

[0074] Embodiment 2, in an exemplary embodiment, a network access control method based on a domestic server is provided, comprising:

[0075] The data design of this application includes two parts: obtaining data structure through kernel hook and formulating policy data structure.

[0076] Specifically, the data structures obtained through the kernel hook include but are not limited to the rule table, the log table, the connection chain and the HASH table.

[0077] The rule table is an array of struct rule structures. The size of the rule table is maintained by the static int type rule_num variable. The structrule structure definition is shown in Table 1.

[0078] Table 1struct rule structure definition table

[0079] type variable describe unsigned src_ip Source IP unsigned dst_ip Destination IP unsigned src_mask Source IP mask unsigned dst_mask Destination IP mask int src_port Source Port int dst_port Destination Port int protocol Protocol Number int action Action (0 discard, 1 pass)

[0080] The log table is an array of structlog structures. The size of the log table is maintained by the static int type log_num variable. The structlog structure definition is shown in Table 2.

[0081] Table 2 Structlog structure definition table

[0082]

[0083]

[0084] The connection chain is a linked list of struct connection structures, and the header node is an empty node conHead. Each node includes the basic five-tuple information of the connection and an index field for locating the HASH table. The definition of the structconnection structure is shown in Table 3.

[0085] Table 3struct connection structure definition table

[0086] type variable describe unsigned src_ip Source IP unsigned dst_ip Destination IP int src_port Source Port int dst_port Destination Port int protocol Protocol Number int index HASH index structconnection* next Next connection point

[0087] Specifically, the policy data structure includes but is not limited to Rule class, Log class, Connection class and other functional functions.

[0088] The Rule class corresponds to the rule table of the kernel module and provides multiple interfaces for extracting and manipulating rule information, as shown in Table 4 and Table 5.

[0089] Table 4 Rule class data table 1

[0090]

[0091]

[0092] Table 5 Rule class data table 2

[0093]

[0094] The Log class corresponds to the log table of the kernel module and provides multiple interfaces for extracting and manipulating log information, as shown in Table 6 and Table 7.

[0095] Table 6 Log class data table 1

[0096] variable type describe src_ip unsigned Source IP dst_ip unsigned Destination IP src_port int Source Port dst_port int Destination Port protocol int Protocol Number action int Passed

[0097] Table 7 Log class data table 2

[0098]

[0099] The Connection class corresponds to the connection table of the kernel module and provides multiple interfaces for extracting and manipulating connection information, as shown in Table 8 and Table 9.

[0100] Table 8 Connection class data table 1

[0101] variable type describe src_ip unsigned Source IP dst_ip unsigned Destination IP src_port int Source Port dst_port int Destination Port protocol int Protocol Number time int Remaining survival time

[0102] Table 8 Connection class data table 2

[0103]

[0104] In addition to the above three types of data, other functional functions are also included, as shown in Table 10.

[0105] Table 10 Other function tables

[0106]

[0107]

[0108] Embodiment 3, in an exemplary embodiment, a network access control system based on a domestic server is also provided, including a data acquisition module, a detection module and a control module; the data acquisition module is used to collect data packets of a first object, and extract characteristic data from the data packets as first data; the detection module is used to detect whether the message belongs to an existing connection according to the first data, and generate a first result; the control module is used to compare the first data with the access control policy table to form a second result.

[0109] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0110] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0111] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0112] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0113] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network access control method based on a domestic server, characterized in that: include: Acquire first data of a first object; Performing status detection on the first data to generate a first result; An access control policy table is obtained, and compared with the first data to form a second result.

2. The network access control method based on a domestic server as claimed in claim 1, characterized in that: Before acquiring the first data of the first object, the method further includes: A data packet of a first object is acquired, and feature data is extracted from the data packet as first data.

3. The network access control method based on a domestic server as claimed in claim 2, characterized in that: The performing state detection on the first data includes acquiring a first state of the first data through state detection, and generating a first result according to the first state.

4. The network access control method based on a domestic server as claimed in claim 3, characterized in that: After the state detection is performed on the first data and the first result is generated, the method further includes: Performing an evaluation based on the first result; The preset first interval and the second interval are compared with the first result to determine the triggering of the action; The action includes a first action and a second action; The trigger includes: When the first result belongs to the first interval, performing a first action; When the first result belongs to the second interval, a second action is performed.

5. The network access control method based on a domestic server as claimed in claim 4, characterized in that: Before obtaining the strategy table, the method further includes: The management system formulates a network access control policy, generates an access control policy table according to the network access control policy, and synchronizes the access control policy table to the first object.

6. The network access control method based on a domestic server as claimed in claim 1, characterized in that: The first data includes but is not limited to obtaining a data packet through a hook of a Netfilter architecture, and extracting five-tuple information from the data packet as feature data; The state detection includes but is not limited to HASH calculation, and determines whether the message belongs to an existing connection through the state detection to generate a first result.

7. The network access control method based on a domestic server as claimed in claim 6, characterized in that: Generating the first result includes directly releasing the message when the message belongs to an existing connection; When a message does not belong to an existing connection, the five-tuple information of the message is matched against the rules stored in the access control policy table one by one to determine whether it can pass; If the message is allowed to pass, a new connection information is created in the connection chain and HASH table for subsequent detection.

8. A network access control system based on a domestic server using any of the methods of claims 1 to 7, characterized in that: include, Data acquisition module, detection module and control module; The data acquisition module is used to collect data packets of the first object and extract characteristic data from the data packets as first data; The detection module is used to detect whether the message belongs to an existing connection according to the first data, and generate a first result; The control module is used to compare the first data with the access control policy table to form a second result.

9. A computer device comprising: Memory and processor; The memory stores a computer program, which is characterized in that when the processor executes the computer program, the steps of the network access control method based on the domestic server as described in any one of claims 1-7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, the steps of the network access control method based on the domestic server as described in any one of claims 1 to 7 are implemented.

Images