A security verification method based on ICMP

Abstract

The present invention discloses a security verification method for a door-opening brick based on ICMP, and relates to the field of network access security technology. The security verification method comprises the following steps: a client initialization step, a server verification step, a dynamic port allocation step, a TCP connection establishment step, and a behavior monitoring and analysis step; at the same time, a dynamic port mapping mechanism is applied in the dynamic port allocation step of the server, and the port information of each session is transmitted to the client in an encrypted manner by periodically changing the port or dynamically generating a new port. The present invention realizes the dynamic port generation and allocation function by designing a dynamic port allocation and dynamic port mapping mechanism, solves the problem that static ports are easily detected by port tools and increase the risk of being cracked by force and maliciously accessed, effectively prevents port exposure, increases the difficulty of attack, and improves the system's anti-scanning ability and security.

Description

Technical Field

[0001] The invention relates to the technical field of network access security, in particular to an ICMP-based door-opening security verification method. Background Art

[0002] In the modern network environment, with the increasing openness of information systems, the exposure of network service ports has become a potential security risk. Traditional firewalls and access control mechanisms usually provide services to the outside world through fixed ports. Once these ports are exposed to the public network, they are easily targeted by attackers and used for malicious behaviors such as port scanning, brute force cracking and detection attacks, thereby threatening the overall security of the system.

[0003] To address this problem, the Port Knocking protocol has gradually gained attention. It allows the client to send specific data packets to "knock on the door" to dynamically open specific ports to limit unauthorized access. However, conventional knocking solutions are often implemented using static rules or UDP protocols, which are easily bypassed by advanced attack methods and are difficult to balance flexibility and security in complex network environments.

[0004] Traditional network access control is access first and then authentication. Since the port is exposed to the Internet, it is easy to be attacked, resulting in various security threats. Hackers will use scanning tools to scan the service ports exposed to the Internet. After identifying the open ports, they will use various blasting tools to penetrate. This application proposes a stepping stone security verification method based on ICMP, which uses ICMP protocol + iptables to realize dynamic adjustment of service ports, thereby enhancing the security of the service.

[0005] Patent document CN113630378B discloses an IPv6 network access source address verification deployment measurement method based on ICMP speed limit. The above patent realizes the efficient large-scale measurement of the global access source address verification deployment at a single local measurement point, and has high availability and effectiveness. However, the above patent cannot realize the dynamic port generation and allocation function.

[0006] Patent document CN110213204B discloses an attack protection method and apparatus, equipment and readable storage medium. The above patent realizes effective determination of whether the sending end is an attack end or a normal end, so that non-retransmission messages sent by the attack end can be discarded, and ICMP messages sent by the normal end can be forwarded. While protecting against ICMP FLOOD attacks, it avoids the mistaken killing of normal messages and avoids false alarms that cause business abnormalities. However, the above patent cannot realize the double encryption function of the timestamp.

[0007] Patent document CN102231748B discloses a client verification method and device. The above patent realizes the judgment of the authenticity of the user client and effectively improves the effect of network security protection, but the above patent cannot realize the multi-level verification function for legitimate device requests.

[0008] Patent document CN107046542B discloses a method for implementing consensus verification using hardware at the network level. The above patent implements the consensus protocol on the hardware platform without adding a data center, effectively shortening the time delay and achieving the purpose of hardware-accelerated consensus. However, the above patent cannot achieve the response delay and interference error information return functions.

[0009] In summary, the above patents cannot realize the dynamic port generation and allocation function, the double encryption function of the timestamp, the multi-level verification function of legitimate device requests, and the response delay and interfering error information return function, which leads to the problems of network system ports being exposed, being cracked by brute force, being attacked by detection, and reducing information security;

[0010] To this end, the present application proposes an ICMP-based stepping stone security verification method that can realize dynamic port generation and allocation function, double encryption function of timestamp, multi-level verification function of legitimate device requests, and response delay and interference error information return function. Summary of the invention

[0011] The purpose of the present invention is to provide an ICMP-based stepping stone security verification method to solve the technical problems proposed in the above background technology that the dynamic port generation and allocation function, the double encryption function of the timestamp, the multi-level verification function of the legitimate device request and the response delay and the interfering error information return function cannot be realized, resulting in the network system port being exposed, being cracked by brute force, being attacked by detection and the reduction of information security.

[0012] To achieve the above object, the present invention provides the following technical solution: a security verification method for a stepping stone based on ICMP, the security verification method comprising the following steps:

[0013] Client initialization step: The client generates an ICMP EchoRequest packet containing UUID, timestamp and encrypted hash value for knock request;

[0014] Server verification step: After receiving the data packet generated by the client, the server extracts and verifies the UUID, timestamp, and encrypted hash value from the data packet to confirm the authenticity and timeliness of the data packet;

[0015] Dynamic port allocation step: After the data packet is verified by the server, the server dynamically opens the access port of the client IP in the firewall and replies the service port information and authentication token to the client in an encrypted manner. At the same time, the dynamic port mapping mechanism is applied in the dynamic port allocation step of the server. By periodically changing the port or dynamically generating a new port, the port information of each session is transmitted to the client in an encrypted manner, avoiding the use of static port numbers, and further preventing detection and attacks by port scanning tools.

[0016] TCP connection establishment steps: The client decrypts the service port information in the ICMP Echo Reply packet, attempts to connect to the port through the TCP protocol, and completes subsequent service access;

[0017] Behavior monitoring and analysis steps: The server monitors the frequency, sequence, and pattern of the client's knocking requests to identify abnormal behaviors and prevent illegal replay and brute force cracking.

[0018] Preferably, the content of the ICMP Echo Request data packet generated in the client initialization step includes:

[0019] UUID: used to uniquely identify each knock request to prevent duplication;

[0020] Timestamp: reflects the time when the data packet was generated. The server compares the timestamp with the current time to ensure that the request is within the preset time window to prevent replay attacks.

[0021] Cryptographic hash value: A hash value calculated based on the UUID and timestamp, generated using the SM3 cryptographic hash algorithm to protect data integrity and prevent tampering.

[0022] Preferably, the server verification step includes the following sub-steps:

[0023] UUID verification: The server ensures that the received UUID does not appear in recent requests to avoid replay of duplicate requests;

[0024] Timestamp verification: Compare the timestamp in the ICMP data packet with the current time to ensure that the data packet is valid within the set time window;

[0025] Hash verification: The server recalculates the hash value by combining the UUID and timestamp, and compares it with the hash value in the data packet. If they are consistent, it is determined that the data packet is complete and has not been tampered with.

[0026] Preferably, in the dynamic port allocation step, the server performs the following operations:

[0027] Dynamically generate ports: The server dynamically allocates service ports for each verified client request to avoid exposing the real port;

[0028] Configure firewall rules: The server configures rules in the firewall to allow the client IP to initiate a TCP connection to the assigned service port;

[0029] Encrypted port information: The server packages the assigned port information and authentication token, encrypts them using the SM4 symmetric encryption algorithm, and sends them to the client in an ICMP Echo Reply packet.

[0030] Preferably, in the TCP connection establishment step, after receiving the ICMP Echo Reply data packet, the client performs the following operations:

[0031] Decrypting port information: The client uses the pre-shared key to decrypt the encrypted port information in the ICMP Echo Reply packet and obtains the port number assigned by the server.

[0032] Initiate a TCP connection: The client uses the decrypted port information to connect to the server through the TCP protocol to achieve subsequent data transmission and service access.

[0033] Preferably, the behavior monitoring and analysis step is used to monitor the knocking request behavior of the client, including the following monitoring parameters:

[0034] Request frequency: The server monitors the knock request frequency of the same client IP, and if the frequency is abnormal, it is considered an attack;

[0035] Request order: The client's knocking requests must be completed in the specified order. If the order is wrong, the connection will be blocked;

[0036] Request pattern: Record and analyze the client's knocking pattern, and automatically block the request if the pattern is abnormal.

[0037] Preferably, each knock request of the client includes a device identifier, which includes a device ID and a MAC address. The server distinguishes the legitimacy of different clients by identifying the device ID. When the device ID does not match / a device of unknown origin appears, the server will reject the corresponding knock request to prevent unauthorized device access. Each identity authentication Token generated by the server is one-time use. The server generates a new Token each time the client passes a knock request and binds it to a subsequent TCP session. The server uses a preset session key for encryption during the Token verification process to ensure the security and uniqueness of the verification process.

[0038] Preferably, the server introduces a random delay when responding to the client's ICMP knock request to prevent the attacker from inferring whether the knock is successful based on the response time, and the server can randomly return error information to increase interference to the attacker and prevent the attacker from using the response time information to perform a replay attack.

[0039] Preferably, the client initialization step also introduces a timestamp mechanism with double encryption protection, that is, a hardware encryption module is integrated inside the client device to provide encryption support for the timestamp. The encrypted timestamp is encrypted twice and embedded in the payload part of the data packet after the UUID generated by the client software. The timestamp needs to be decrypted during verification by the server.

[0040] Preferably, an adaptive time window check and deviation tolerance mechanism is introduced in the server verification step, that is, when the server verifies the timestamp of each ICMP Echo Request data packet, it not only compares the difference between the timestamp and the current time, but also takes into account the network delay and system clock deviation factors between the client and the server. The server automatically adjusts the allowed time window length and request based on historical request records to increase the verification time window width.

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] 1. The present invention realizes the dynamic port generation and allocation function by designing a dynamic port allocation and dynamic port mapping mechanism, solves the problem that static ports are easily detected by port tools and increase the risk of brute force cracking and malicious access, effectively prevents port exposure, increases the difficulty of attack, and improves the system's anti-scanning ability and security;

[0043] 2. The present invention implements the double encryption function of the timestamp by designing a timestamp mechanism based on double encryption, solves the problem that the timestamp is easily tampered with and forged during transmission, ensures the integrity and timeliness of the request, resists replay attacks, ensures that the system can identify legitimate requests and reduce the security risks of forged requests;

[0044] 3. The present invention realizes the multi-level verification function of legitimate device requests by designing ICMP Echo Request data packets and multiple verification mechanisms, solves the potential security risks caused by unauthorized devices forging knock requests to try to access the system, ensures that only authorized devices can connect to the system, avoids illegal device access, and enhances the access control security of the system;

[0045] 4. The present invention realizes the response delay and interference error information return functions by designing random delay, time window verification and deviation tolerance mechanism, which solves the problem that attackers can infer whether knocking on the door is successful by analyzing the system response time, and thus carry out replay attacks or further detection. Random delay and error information interference make it difficult for attackers to infer the system response through time analysis, which increases the system's anti-detection and anti-replay capabilities and improves the overall security and concealment. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a front view structural schematic diagram of the present invention. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] See also Figure 1 , an embodiment of the present invention provides: a security verification method based on ICMP, the security verification method comprising the following steps:

[0049] Client initialization step: The client generates an ICMP EchoRequest packet containing UUID, timestamp and encrypted hash value for knock request;

[0050] Server verification step: After receiving the data packet generated by the client, the server extracts and verifies the UUID, timestamp, and encrypted hash value from the data packet to confirm the authenticity and timeliness of the data packet;

[0051] Dynamic port allocation step: After the data packet is verified by the server, the server dynamically opens the access port of the client IP in the firewall and replies the service port information and authentication token to the client in an encrypted manner. At the same time, the dynamic port mapping mechanism is applied in the dynamic port allocation step of the server. By periodically changing the port or dynamically generating a new port, the port information of each session is transmitted to the client in an encrypted manner, avoiding the use of static port numbers, and further preventing detection and attacks by port scanning tools.

[0052] TCP connection establishment steps: The client decrypts the service port information in the ICMP Echo Reply packet, attempts to connect to the port through the TCP protocol, and completes subsequent service access;

[0053] Behavior monitoring and analysis steps: The server monitors the frequency, sequence, and pattern of the client's knocking requests to identify abnormal behaviors and prevent illegal replay and brute force cracking;

[0054] Furthermore, the client needs to prepare and send an ICMP EchoRequest packet containing UUID, timestamp and encrypted hash value as a knock request. The server first extracts the packet information from the received ICMP Echo Request packet and verifies the UUID, timestamp and encrypted hash value. If any of the above verifications fails, the server will directly discard the packet and not respond. If all verifications pass, it will proceed to the next step.

[0055] When the server successfully verifies the ICMP Echo Request packet from the client, it starts to perform dynamic port allocation. The server randomly selects a service port based on internal policies and opens access rights for the client on this port through firewalls such as iptables. The server port can be a different random port for each session to avoid exposing static ports to potential attackers. The server encrypts the assigned port number and an authentication Token and encapsulates them into the payload of the ICMP EchoReply packet. The encryption operation usually uses the symmetric encryption algorithm SM4 and uses a pre-shared key to encrypt the port information. The Token is used to associate subsequent authentication requests to ensure that the Token is only used in valid sessions. The server sends the encrypted ICMP Echo Reply packet to the client to inform the client of the port information that can be used for connection; after the client receives the ICMP Echo Reply packet returned by the server, it decrypts the port information and initiates a TCP connection;

[0056] The server will periodically change the dynamically allocated port or regenerate the port to prevent the same port from being exposed for a long time. The dynamic port mapping mechanism ensures that the port number after each knock request is different, thereby increasing the difficulty of port detection. The server will encrypt the port number and the token together and pass it to the client through the ICMP Echo Reply data packet to ensure that even if the attacker intercepts the data packet, he cannot decrypt and use the port information;

[0057] Once the TCP connection is established, the client can access the service through the port, such as sending requests and receiving responses. After the connection is established, the server monitors and analyzes the client's knocking requests in real time to determine whether there is any abnormal behavior;

[0058] Through timestamp and UUID verification, the timeliness and uniqueness of the request are ensured. Through dynamic port allocation, attacks by port scanning tools are avoided. By encrypting port information and tokens, the communication security between the client and the server is ensured. By real-time monitoring of the client's request frequency, sequence and pattern, brute force cracking, scanning and illegal replay attacks are prevented.

[0059] See also Figure 1 , an embodiment of the present invention provides: a security verification method based on ICMP, wherein the content of the ICMP Echo Request data packet generated in the client initialization step includes:

[0060] UUID: used to uniquely identify each knock request to prevent duplication;

[0061] Timestamp: reflects the time when the data packet was generated. The server compares the timestamp with the current time to ensure that the request is within the preset time window to prevent replay attacks.

[0062] Cryptographic hash value: A hash value calculated based on UUID and timestamp, generated using the SM3 cryptographic hash algorithm to protect data integrity and prevent tampering;

[0063] The client initialization step also introduces a timestamp mechanism with double encryption protection, that is, the client device integrates a hardware encryption module to provide encryption support for the timestamp. The encrypted timestamp is encrypted twice after the UUID generated by the client software and embedded in the payload part of the data packet. The timestamp needs to be decrypted during verification by the server.

[0064] Furthermore, the UUID can be generated in the following ways: Combine the device hardware identifier, such as the MAC address or device ID, with the current timestamp and a random number for hashing to generate a non-repeating UUID; The role of the UUID is to uniquely identify the client's knock request, ensuring that even if the same device initiates multiple requests, there will be no conflict, and prevent replay attacks, because each request will generate a different UUID; The client obtains the current system time and generates a timestamp to reflect the time when the request was sent. The timestamp generation process is as follows: The client obtains the current time through the system's built-in clock, accurate to milliseconds, and forms a timestamp, such as a UNIX timestamp. The server will compare the timestamp with its local time to ensure that the request is issued within a valid time window to prevent it from being used for replay attacks. The server's time window is usually set to a fixed time range, such as 10 seconds or 30 seconds. If the timestamp exceeds this range, the server will regard the request as illegal; After the client generates the UUID and timestamp, the next step is to calculate the encrypted hash value. The client takes the UUID and timestamp as input and calculates the hash value through the SM3 cryptographic hash algorithm. The process is as follows: concatenate the UUID and timestamp into a string, such as UUID + Timestamp, and encrypt the concatenated string using the SM3 cryptographic hash algorithm to generate a 256-bit hash value, which is used to ensure the integrity of the data and prevent tampering during transmission. If the requested UUID or timestamp changes, the hash value will also change, thereby helping the server to verify;

[0065] In order to increase the security protection of timestamp, the client introduces a timestamp mechanism with double encryption protection. The specific process is as follows: The client device integrates a hardware encryption module such as a TPM chip or an HSM hardware security module, which generates an encrypted timestamp. This timestamp is encrypted by the hardware encryption module to ensure that the timestamp cannot be tampered with. After the encrypted timestamp is generated, the client combines it with the generated UUID and performs secondary encryption through the client software. The secondary encryption uses a preset encryption algorithm such as SM4 to encrypt the hardware encrypted timestamp and UUID to generate a doubly encrypted encrypted timestamp. Finally, the encrypted timestamp and UUID together form the payload part of the ICMP Echo Request data packet. When the server receives the data packet, it needs to decrypt the doubly encrypted timestamp before performing subsequent verification;

[0066] The client encapsulates the UUID, timestamp (including the timestamp protected by double encryption), and encrypted hash value into a complete ICMP Echo Request data packet, and sends the ICMP Echo Request data packet to the public IP address of the server. The firewall on the server blocks all ports by default, and the client's knock request is designed to dynamically open a specific port after verification. At this time, the port and identity information requested by the client are not exposed, and through the UUID, timestamp, hash value, and double encrypted timestamp, the client's request is multi-verified on the server to ensure that only legitimate requests can successfully open the port;

[0067] The double encryption protected timestamp mechanism increases the security of the timestamp and prevents it from being forged or tampered with.

[0068] See also Figure 1 , an embodiment of the present invention provides: a security verification method based on ICMP, wherein the server verification step includes the following sub-steps:

[0069] UUID verification: The server ensures that the received UUID does not appear in recent requests to avoid replay of duplicate requests;

[0070] Timestamp verification: Compare the timestamp in the ICMP data packet with the current time to ensure that the data packet is valid within the set time window;

[0071] Hash verification: The server recalculates the hash value by combining the UUID and timestamp, and compares it with the hash value in the data packet. If they are consistent, the data packet is considered complete and has not been tampered with.

[0072] An adaptive time window verification and deviation tolerance mechanism is introduced in the server verification step, that is, when verifying the timestamp of each ICMP Echo Request data packet, the server not only compares the difference between the timestamp and the current time, but also takes into account the network delay and system clock deviation factors between the client and the server. The server automatically adjusts the allowed time window length and request based on the historical request record to increase the verification time window width;

[0073] Furthermore, the server extracts the UUID sent by the client from the ICMP Echo Request data packet. The server checks whether the UUID has appeared in the specified time period by searching the most recent request record in the memory or cache. If the UUID exists, it means that the request may be a repeated, malicious replay request. Therefore, the server will reject the request and not respond. If the UUID is a new request, the server will record it in the cache to ensure that the UUID will not be used again. The records in the cache usually expire in a short time, such as 5 minutes or 10 minutes, to ensure the smooth operation of the system;

[0074] The server extracts the timestamp sent by the client from the ICMP Echo Request data packet. The timestamp represents the moment when the client initiates the request. The server first obtains the current system time and calculates the time difference between the timestamp and the current time. The server compares the time difference with the preset time window. The time window is usually a fixed range, such as 10 seconds or 30 seconds. If the difference between the timestamp and the current time exceeds this time window, the server will determine that the request is illegal, refuse service and discard the data packet. If the request times out, the server will not only discard the data packet, but also record the illegal request behavior and conduct further security analysis on the source IP.

[0075] The server uses the same cryptographic hash algorithm, such as SM3, to hash the received UUID and timestamp to generate a new hash value. The server compares the calculated hash value with the hash value sent in the client data packet. If the two are consistent, it means that the request data has not been tampered with and the data packet is complete. If the hash values ​​do not match, it means that the data packet may have been tampered with or damaged, and the server will discard the data packet. Only when the UUID, timestamp, and hash value are verified, the server will consider the ICMP Echo Request data packet to be valid and allow subsequent port allocation and response operations;

[0076] After receiving the ICMP Echo Request packet, the server calculates the difference between the timestamp sent by the client and the current time. This difference is not just a simple comparison of the two timestamps, but also takes into account other factors, such as network delay, system clock asynchrony, etc. The server automatically adjusts the width of the time window based on historical request records. For clients that are far away, such as cross-regional and cross-national access, the server will increase the allowed time window width considering the possible large network delay. For example, if the client is located in another time zone or geographical area, the server will increase the fault tolerance window by 5-10 seconds. For frequently accessed clients or local networks, the server may shorten the time window to improve security and reduce the risk of replay attacks; the server makes dynamic adjustments based on the delay records of historical requests. For example, the server estimates the common network delay and adjusts the width of the time window by analyzing the requests in the recent period. For requests with large network delays, the server will appropriately extend the allowable range of the time window, and for requests with small delays, the time window will be shortened. When verifying the timestamp, the server uses a deviation tolerance mechanism to allow a certain time error. This allows the server to process legitimate requests even when the network environment fluctuates greatly, avoiding the mistaken rejection of legitimate requests due to slight time deviations;

[0077] If any verification fails, the server will reject the request and discard the data packet. The server can record the failed request and its source IP, and perform subsequent processing according to the security policy, such as triggering an alarm, blocking the IP, etc. The server verification step effectively prevents replay attacks, data tampering and time difference problems through UUID verification, timestamp verification, hash verification and adaptive time window verification and deviation tolerance mechanism. At the same time, these mechanisms ensure the reliability and flexibility of the server in the face of complex network environments, and can provide a good user experience while ensuring security.

[0078] See also Figure 1 , an embodiment of the present invention provides: a security verification method based on ICMP, in which the server performs the following operations in the dynamic port allocation step:

[0079] Dynamically generate ports: The server dynamically allocates service ports for each verified client request to avoid exposing the real port;

[0080] Configure firewall rules: The server configures rules in the firewall to allow the client IP to initiate a TCP connection to the assigned service port;

[0081] Encrypted port information: The server packages the assigned port information and the authentication token, encrypts them using the SM4 symmetric encryption algorithm, and sends them to the client in an ICMP Echo Reply packet.

[0082] Each knock request from the client contains a device identifier, which includes a device ID and a MAC address. The server distinguishes the legitimacy of different clients by identifying the device ID. When the device ID does not match / a device of unknown origin appears, the server will reject the corresponding knock request to prevent unauthorized device access. Each authentication Token generated by the server is a one-time use. The server generates a new Token each time the client passes a knock request and binds it to the subsequent TCP session. The server uses a preset session key for encryption during the Token verification process to ensure the security and uniqueness of the verification process.

[0083] Furthermore, the server selects an available port number based on an internal algorithm, such as a pseudo-random number generator or a secure random function, as the target port for the client request. This port number is only valid for this request for a short period of time to prevent the actual port number of the server from being exposed. The server dynamically adjusts the port allocation strategy based on factors such as network status and request frequency;

[0084] The server adds a new rule in the firewall to allow the specified client IP to initiate a TCP connection to the assigned service port. This rule is temporary and only takes effect in the current session. The server sets a validity period for the newly added firewall rule to ensure that the client is allowed to connect within the specified time. When the client successfully establishes a TCP connection, or exceeds the specified connection time limit, the server will automatically remove the corresponding firewall rule to prevent the port from being exposed without a connection, ensuring the overall security of the system;

[0085] The server generates a unique authentication token for the current connection, which is used to identify the client's subsequent TCP sessions. Token generation is usually based on a secure random number algorithm to ensure the uniqueness and unpredictability of each token. Before generating a token, the server first extracts the device identifier from the client's ICMP knock request, including the device ID and MAC address, and compares it with the authorized device list recorded by the server. If the device identifier does not match the authorized list, or a device of unknown origin appears, the server will reject the request and not assign a token to prevent unauthorized device access. The server combines the assigned dynamic port number with the generated token into a data packet and encrypts the data packet using the SM4 symmetric encryption algorithm. The encryption key is the preset session key to ensure that the encrypted data cannot be decrypted or tampered with during transmission. The server encapsulates the encrypted port information and token into the payload part of the ICMP Echo Reply data packet and sends it to the client. The recipient of this data packet can only be a legitimate client. The client decrypts the data packet using the preset key to obtain the assigned port and token.

[0086] The client uses the preset session key to decrypt the payload of the ICMP Echo Reply packet through the SM4 algorithm to obtain the port number and authentication token assigned by the server. The client confirms the binding relationship between the token and the device identifier to ensure that each connection is limited to legitimate devices and specified tokens to prevent the token from being reused or tampered with by other devices. After the client obtains a valid dynamic port, it initiates a connection through the TCP protocol and connects to the dynamic port specified by the server to enter the subsequent service access process. After the server generates the token, it binds it to the client's device identifier, that is, the device ID and MAC address, and associates it with this TCP session. During the entire session, the token is limited to the client to prevent the token from being replayed and used by other clients. After successfully connecting to the dynamic port, the client sends the token and the device identifier to the server for verification. After receiving the token, the server verifies its uniqueness and legitimacy. If the token matches and has not been reused, the client is allowed to continue accessing. During the token verification process, both the server and the client use the preset session key for encryption protection to ensure that the transmission process of the token is safe and correct. After each session ends, the token becomes invalid. Even if the attacker captures the token, it cannot be used for subsequent connection attempts;

[0087] The dynamic port allocation step effectively improves the security of the system by dynamically generating ports, configuring temporary firewall rules, encrypting transmission port information, and one-time token verification. This step ensures that only authorized devices can access, and prevents replay attacks and port detection through the uniqueness, dynamism, and encryption protection of each request, achieving efficient security protection.

[0088] See also Figure 1 , an embodiment of the present invention provides: a security verification method based on ICMP, in the TCP connection establishment step, after receiving the ICMP Echo Reply data packet, the client performs the following operations:

[0089] Decrypting port information: The client uses the pre-shared key to decrypt the encrypted port information in the ICMP Echo Reply packet and obtains the port number assigned by the server.

[0090] Initiate a TCP connection: The client uses the decrypted port information to connect to the server through the TCP protocol to achieve subsequent data transmission and service access;

[0091] The behavior monitoring and analysis step is used to monitor the knocking request behavior of the client, including the following monitoring parameters:

[0092] Request frequency: The server monitors the knock request frequency of the same client IP, and if the frequency is abnormal, it is considered an attack;

[0093] Request order: The client's knocking requests must be completed in the specified order. If the order is wrong, the connection will be blocked;

[0094] Request mode: record and analyze the client's knocking mode, and automatically block the request if the mode is abnormal;

[0095] The server introduces a random delay when responding to the ICMP knock request of the client to prevent the attacker from inferring whether the knock is successful based on the response time, and the server can randomly return error information to increase interference to the attacker and prevent the attacker from using the response time information to replay the attack; the dynamic port mapping mechanism is applied to the dynamic port allocation of the server, and the port information of each session is transmitted to the client in an encrypted manner by periodically changing the port or dynamically generating a new port, avoiding the use of static port numbers, and further preventing detection and attacks by port scanning tools;

[0096] Furthermore, after the client receives the ICMP Echo Reply data packet returned by the server, it extracts the encrypted content of the payload of the data packet. The encrypted content includes the port number dynamically assigned by the server and a one-time authentication token. The client decrypts the data packet using a pre-shared key such as the SM4 encryption algorithm to obtain the real server port number and token. After the decryption is complete, the client checks whether the format and content of the token and port number meet expectations. If the token or port information is incorrect or the decryption fails, the client will consider the data packet invalid and abandon the connection request. When the port number and token obtained by decryption are successfully verified, the client initiates a TCP connection to the server using the port number obtained by decryption. The client specifies the server IP address and the port number obtained by decryption to connect and enter the next stage of data transmission and service access. After the server receives the client's TCP connection request, it verifies the client's identity through the IP address and token, ensures the uniqueness and legitimacy of the token, and binds it to the current TCP session. After the session is established, the client and server enter the secure data transmission stage;

[0097] The server monitors the frequency of knock requests from the same client IP address. If the same client sends multiple knock requests in succession within a short period of time, the server will record this behavior as abnormal request behavior and may determine it as a signal of a brute force attack. If the request frequency exceeds the preset security threshold, the server will block the client IP and temporarily ban access to the IP address to prevent brute force cracking or detection caused by frequent attempts. When recording the knock requests of each client, the server will preset a series of security verification steps, such as UUID, timestamp, and hash verification sequence. Each knock request from the client needs to be completed in this order to ensure the standardization of the request. The server analyzes the order of client requests in real time. Once it is found that the client does not send the knock request in the preset order, the server will automatically block the request and consider that the behavior may be an unauthorized request or a potential detection attack.

[0098] The server records and analyzes the knocking pattern of each client, including the knocking time interval, data packet size and content characteristics, etc. The server analyzes the client's request pattern to identify normal and abnormal behavior patterns, which helps the server identify abnormal access patterns. If the client's knocking pattern is abnormal, such as too regular knocking intervals, abnormal data packet content, etc., the server will automatically terminate the client's knocking process, regard it as abnormal behavior, and reject subsequent connection requests;

[0099] To increase security, the server introduces a random delay when processing each ICMP knock request from the client. The delay time is randomly generated within a reasonable range, making it difficult for attackers to infer the success or failure of the knock request through the response time. The server can selectively return random error messages to the client, especially when potential abnormal requests are detected. These error messages will cause attackers to mistakenly believe that the knock request has failed, thereby increasing the difficulty of the attack and interfering with the attacker's analysis of the system response time;

[0100] The TCP connection establishment and behavior monitoring and analysis steps provide protection for the legal access of the client through multiple measures such as real-time monitoring, random delay, dynamic port mapping and encrypted transmission, prevent security threats such as replay attacks, brute force cracking, port detection, etc., and effectively improve the overall security of the system.

[0101] Working principle: The client first generates a UUID, current timestamp and hash value, encrypts this information through the hardware encryption module, constructs an ICMP Echo Request data packet, and sends it to the server as a "knock" request. After receiving the data packet, the server confirms the uniqueness, timeliness and integrity of the request through UUID duplication check, timestamp verification and hash verification to ensure that the data packet has not been tampered with;

[0102] When the knock request is verified by the server, the server dynamically allocates a port to the client and passes the port and one-time token to the client through an encrypted ICMP Echo Reply packet. After the client decrypts the packet, it obtains the server's dynamic port number and token and initiates a TCP connection through the port. When the server receives the client's TCP request, it verifies the token and legitimacy, and establishes a secure TCP session after verification.

[0103] The server continuously monitors the client's knocking behavior, including the frequency, order, and pattern of requests, and records and analyzes potential abnormal requests. By introducing random delays and error message interference mechanisms, the server can effectively prevent attackers from inferring whether the knocking is successful by analyzing the response time. In addition, the server periodically changes the port to ensure the system's anti-attack capabilities and prevent port scanning and brute force cracking.

[0104] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A security verification method based on ICMP, characterized in that: The security verification method comprises the following steps: Client initialization step: The client generates an ICMP EchoRequest packet containing UUID, timestamp and encrypted hash value for knock request; Server verification step: After receiving the data packet generated by the client, the server extracts and verifies the UUID, timestamp, and encrypted hash value from the data packet to confirm the authenticity and timeliness of the data packet; Dynamic port allocation step: After the data packet is verified by the server, the server dynamically opens the access port of the client IP in the firewall and replies the service port information and authentication token to the client in an encrypted manner. At the same time, the dynamic port mapping mechanism is applied in the dynamic port allocation step of the server. By periodically changing the port or dynamically generating a new port, the port information of each session is transmitted to the client in an encrypted manner, avoiding the use of static port numbers, and further preventing detection and attacks by port scanning tools. TCP connection establishment steps: The client decrypts the service port information in the ICMP Echo Reply packet, attempts to connect to the port through the TCP protocol, and completes subsequent service access; Behavior monitoring and analysis steps: The server monitors the frequency, sequence, and pattern of the client's knocking requests to identify abnormal behaviors and prevent illegal replay and brute force cracking.

2. According to claim 1, a security verification method based on ICMP, characterized in that: The content of the ICMP Echo Request data packet generated in the client initialization step includes: UUID: used to uniquely identify each knock request to prevent duplication; Timestamp: reflects the time when the data packet was generated. The server compares the timestamp with the current time to ensure that the request is within the preset time window to prevent replay attacks. Cryptographic hash value: A hash value calculated based on the UUID and timestamp, generated using the SM3 cryptographic hash algorithm to protect data integrity and prevent tampering.

3. According to claim 1, a security verification method based on ICMP, characterized in that: The server-side verification step includes the following sub-steps: UUID verification: The server ensures that the received UUID does not appear in recent requests to avoid replay of duplicate requests; Timestamp verification: Compare the timestamp in the ICMP data packet with the current time to ensure that the data packet is valid within the set time window; Hash verification: The server recalculates the hash value by combining the UUID and timestamp, and compares it with the hash value in the data packet. If they are consistent, it is determined that the data packet is complete and has not been tampered with.

4. The ICMP-based security verification method according to claim 1 is characterized in that: In the dynamic port allocation step, the server performs the following operations: Dynamically generate ports: The server dynamically allocates service ports for each verified client request to avoid exposing the real port; Configure firewall rules: The server configures rules in the firewall to allow the client IP to initiate a TCP connection to the assigned service port; Encrypted port information: The server packages the assigned port information and authentication token, encrypts them using the SM4 symmetric encryption algorithm, and sends them to the client in an ICMP Echo Reply packet.

5. According to claim 1, a security verification method based on ICMP, characterized in that: In the TCP connection establishment step, after receiving the ICMP Echo Reply data packet, the client performs the following operations: Decrypting port information: The client uses the pre-shared key to decrypt the encrypted port information in the ICMP Echo Reply packet and obtains the port number assigned by the server. Initiate a TCP connection: The client uses the decrypted port information to connect to the server through the TCP protocol to achieve subsequent data transmission and service access.

6. The ICMP-based security verification method according to claim 1 is characterized in that: The behavior monitoring and analysis step is used to monitor the knocking request behavior of the client, including the following monitoring parameters: Request frequency: The server monitors the knock request frequency of the same client IP, and if the frequency is abnormal, it is considered an attack; Request order: The client's knocking requests must be completed in the specified order. If the order is wrong, the connection will be blocked; Request pattern: Record and analyze the client's knocking pattern, and automatically block the request if the pattern is abnormal.

7. The ICMP-based security verification method according to claim 1 is characterized in that: Each knock request from the client contains a device identifier, which includes a device ID and a MAC address. The server distinguishes the legitimacy of different clients by identifying the device ID. When the device ID does not match / a device of unknown origin appears, the server will reject the corresponding knock request to prevent unauthorized device access. Each authentication Token generated by the server is a one-time use. The server generates a new Token each time the client passes a knock request and binds it to the subsequent TCP session. The server uses a preset session key for encryption during the Token verification process to ensure the security and uniqueness of the verification process.

8. The ICMP-based security verification method according to claim 1 is characterized in that: The server introduces a random delay when responding to the ICMP knock request of the client to prevent the attacker from inferring whether the knock is successful based on the response time. The server can randomly return error information to increase interference to the attacker and prevent the attacker from using the response time information to perform a replay attack.

9. The ICMP-based security verification method according to claim 2 is characterized in that: The client initialization step also introduces a timestamp mechanism with double encryption protection, that is, a hardware encryption module is integrated inside the client device to provide encryption support for the timestamp. The encrypted timestamp is encrypted twice and embedded in the payload part of the data packet after the UUID generated by the client software. The timestamp needs to be decrypted during verification by the server.

10. The ICMP-based security verification method according to claim 9, characterized in that: An adaptive time window check and deviation tolerance mechanism is introduced in the server verification step, that is, when verifying the timestamp of each ICMPEcho Request data packet, the server not only compares the difference between the timestamp and the current time, but also takes into account the network delay and system clock deviation factors between the client and the server. The server automatically adjusts the allowed time window length and request based on historical request records to increase the verification time window width.

Images