Method for detecting whether client uses VPN (Virtual Private Network) based on routing tracking

Abstract

The invention discloses a method for detecting whether a client uses a VPN (Virtual Private Network) based on route tracking, which comprises the following steps of: acquiring the delay of the client for sending a data packet to a server and recording the delay as Relay1, and acquiring the delay of the server to the client (VPN or proxy) and recording the delay as Relay2; when the client uses the VPN or the proxy, the VPN or the proxy can hide a real client IP address, the client public network address acquired by the server is the address of the VPN server or the proxy server, and the network path passed by the steps S1-S3 is longer than the network path passed by the step S6, so that the value of the Relay1 is far greater than that of the Relay2, and the value of the Relay2 is far greater than that of the Relay2. Whether the client uses the VPN or the agent can be distinguished by comparing the Relay1 value and the Relay2 value. According to the method, whether the VPN or the agent is used by the client can be distinguished by comparing the Relay1 value and the Relay2 value.

Description

Technical Field

[0001] The present invention relates to the technical field of remote control, and in particular to a method for detecting whether a client uses a VPN based on route tracking. Background Art

[0002] At present, in the use scenario of remote software, people usually work remotely from their company computers at home or solve problems remotely on other people's computers. However, there are a small number of overseas fraud gangs that use remote software to connect to domestic victims' computers or mobile phones and remotely operate transfers to achieve the purpose of fraud. In order to prevent such cases from happening, remote software generally restricts the master control device located abroad from connecting to domestic devices. Due to the restrictions on the client, criminals will use VPN, proxy, etc. to disguise the source address of the client as a domestic IP address, and then use remote software to bypass the restrictions.

[0003] The current common way to detect whether a client has started VPN or proxy is to detect whether the client's network card name contains specific keywords (for example, "VPN, Tunnel", etc.), whether the process name contains specific keywords, etc. This method has the disadvantages of being easily misjudged, easily modified network card names, and process names bypassing detection. In addition, this method cannot detect VPNs that are not started locally (for example, VPNs running on routers and gateways).

[0004] Therefore, the prior art has defects and needs to be improved. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a method for detecting whether a client uses a VPN based on route tracking, which can detect whether a VPN or proxy is turned on in the client network and reduce the probability of being defrauded.

[0006] The technical solution of the present invention is as follows: a method for detecting whether a client uses a VPN based on route tracking is provided, comprising the following steps.

[0007] S1: When the client is running, the client uses the normal communication channel with the server to send a data packet containing the local time to the server.

[0008] S2: When the server receives the data packet from the client, it sends the data packet back to the client as it is.

[0009] S3: The client receives the data packet of the server's response, takes out the time in the data packet, and subtracts the time in the data packet from the current time. The difference is the delay of the complete communication between the client and the server, which is recorded as Relay1.

[0010] S4: The client sends a request to the server to detect the delay using the normal communication channel with the server.

[0011] S5: After receiving the request, the server obtains the public network address of the client.

[0012] S6: The server starts to detect the routing node of the client's public network address, the steps are as follows.

[0013] S61: The server sends a data packet to a random port (eg, port number > 30000) of the client using a transport protocol, and sets an initial TTL value of the data packet, eg, to 1.

[0014] S62: When the next network device receives the data packet, it will send an ICMP data packet to the source address and mark it as a destination unreachable flag.

[0015] S63: The server receives the ICMP data packet and calculates the difference between the sent data packet and the received ICMP data packet, which is recorded as Relay2.

[0016] S64: Repeat steps S61-S63, each time setting the initial value of TTL + K (such as 1) (for example, setting TTL to 1 when executing step S61 for the first time, and setting TTL to 2 when executing step S61 for the second time), and the maximum TTL is N (such as 30); where N is not less than 5.

[0017] S65: The saved difference value Relay2 is updated each time step S63 is executed until an ICMP packet of the public network address IP of the client is received or the TTL value exceeds N (eg, 30).

[0018] S7: Through the above steps, the delay from the client to the server and the delay of the server actively detecting the client's public network address can be obtained.

[0019] When the client does not use VPN or proxy, the client public network address obtained by the server is the real client public network address. At this time, the network paths tested in steps S1-S3 and step S6 are basically the same, so Relay1≈Relay2.

[0020] When the client uses a VPN or a proxy, since the VPN or the proxy will hide the real client IP address, the client public network address obtained by the server is the address of the VPN server or the proxy server. Since the network path passed by steps S1-S3 is longer than the network path passed by step S6, the value of Relay1 will be much larger than Relay2. By comparing the two values ​​of Relay1 and Relay2, it can be distinguished whether the client uses a VPN or a proxy.

[0021] Furthermore, in step S3, in order to reduce the influence of errors and network jitter, steps S1-S3 are repeated multiple times and the average value of Relay1 is calculated.

[0022] Furthermore, steps S61-S65 can obtain the delay information from the server to the client or from the server to the routing node closest to the client. This value may be slightly smaller than the actual client-to-server delay (occurs when the public network address IP of the target client does not return an ICMP data packet). In order to reduce the impact of errors and network jitter, step S6 is repeated multiple times to obtain the average value of Relay2.

[0023] Further, in step S61, the transmission protocol is TCP transmission protocol or UDP transmission protocol.

[0024] Furthermore, in step S1, the communication channel between the client and the server adopts TCP or UDP.

[0025] By adopting the above scheme, the present invention provides a method for detecting whether a client uses a VPN based on route tracking, and by comparing the two values ​​of Relay1 and Relay2, it is possible to distinguish whether the client uses a VPN or a proxy.

[0026] The present invention can detect whether VPN or proxy is enabled in the client network; since the international Internet exits in China are only in Beijing, Shanghai and Guangzhou, even data packets from other countries adjacent to China need to be routed to the above areas before entering China, so the solution can also correctly distinguish domestic and foreign clients with similar physical distances (for example, Myanmar and Yunnan); the higher the delay between the client and the VPN server, the higher the accuracy of the solution, and the solution also has the following characteristics:

[0027] (1) High detection success rate;

[0028] (2) It can detect whether any node has VPN or proxy enabled;

[0029] (3) Does not require client operating environment, supports PC, mobile, and web terminals;

[0030] (4) Difficult to bypass detection BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a schematic diagram of Relay1 without using a VPN server;

[0032] Figure 2 This is a diagram of Relay1 using a VPN server. DETAILED DESCRIPTION

[0033] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0034] See also Figure 1 and Figure 2The present invention provides a method for detecting whether a client uses a VPN based on route tracking, comprising the following steps.

[0035] S1: When the client is running, the client uses the normal communication channel with the server to send a data packet containing the local time to the server.

[0036] S2: When the server receives the data packet from the client, it sends the data packet back to the client as it is.

[0037] S3: The client receives the data packet of the server's response, takes out the time in the data packet, and subtracts the time in the data packet from the current time. The difference is the delay of the complete communication between the client and the server, which is recorded as Relay1.

[0038] S4: The client sends a request to the server to detect the delay using the normal communication channel with the server.

[0039] S5: After receiving the request, the server obtains the public network address of the client.

[0040] S6: The server starts to detect the routing node of the client's public network address, the steps are as follows.

[0041] S61: The server uses a transport protocol to send a data packet to a random port (eg, port number > 30000) of the client, and sets an initial TTL value of the data packet, eg, to 1.

[0042] S62: When the next network device receives the data packet, it will send an ICMP data packet to the source address and mark it as a destination unreachable flag.

[0043] S63: The server receives the ICMP data packet and calculates the difference between the sent data packet and the received ICMP data packet, which is recorded as Relay2.

[0044] S64: Repeat steps S61-S63, each time setting the initial value of TTL + K (such as 1) (for example, setting TTL to 1 when executing step S61 for the first time, and setting TTL to 2 when executing step S61 for the second time), and the maximum TTL is N (such as 30); where N is not less than 5.

[0045] S65: The saved difference value Relay2 is updated each time step S63 is executed until an ICMP packet of the public network address IP of the client is received or the TTL value exceeds N (eg, 30).

[0046] S7: Through the above steps, the delay from the client to the server and the delay of the server actively detecting the client's public network address can be obtained.

[0047] When the client does not use VPN or proxy, the client public network address obtained by the server is the real client public network address. At this time, the network paths tested in steps S1-S3 and step S6 are basically the same, so Relay1≈Relay2.

[0048] When the client uses a VPN or proxy, since the VPN or proxy will hide the real client IP address, the client public network address obtained by the server is the address of the VPN server or proxy server. Since the network path of steps S1-S3 is longer than the network path of step S6 (the value of Relay1 in steps S1-S3 is Relay2_1+Relay2_2, and the value of Relay2 in step S6 is Relay2_2, such as Figure 2 ), so the value of Relay1 will be much larger than Relay2. By comparing the values ​​of Relay1 and Relay2, it is possible to distinguish whether the client uses VPN or proxy.

[0049] In this embodiment, in step S3, in order to reduce the influence of errors and network jitter, steps S1-S3 are repeated multiple times and the average value of Relay1 is calculated.

[0050] In this embodiment, steps S61-S65 can obtain the delay information from the server to the client or from the server to the routing node closest to the client. This value may be slightly smaller than the actual client-to-server delay (occurs when the public network address IP of the target client does not return an ICMP data packet). In order to reduce the impact of errors and network jitter, step S6 is repeated multiple times to obtain the average value of Relay2.

[0051] In this embodiment, in step S61, the transmission protocol is the TCP transmission protocol or the UDP transmission protocol.

[0052] In this embodiment, in step S1, the communication channel between the client and the server adopts TCP or UDP.

[0053] In summary, the present invention provides a method for detecting whether a client uses a VPN based on route tracking. By comparing the two values ​​of Relay1 and Relay2, it is possible to distinguish whether the client uses a VPN or a proxy.

[0054] The present invention can detect whether VPN or proxy is enabled in the client network; since the international Internet exits in China are only in Beijing, Shanghai and Guangzhou, even data packets from other countries adjacent to China need to be routed to the above areas before entering China, so the solution can also correctly distinguish domestic and foreign clients with similar physical distances (for example, Myanmar and Yunnan); the higher the delay between the client and the VPN server, the higher the accuracy of the solution, and the solution also has the following characteristics:

[0055] (1) High detection success rate;

[0056] (2) It can detect whether any node has VPN or proxy enabled;

[0057] (3) Does not require client operating environment, supports PC, mobile, and web terminals;

[0058] (4) It is difficult to bypass detection.

[0059] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting whether a client uses a VPN based on route tracking, characterized in that: The following steps are involved: S1: When the client is running, the client uses the normal communication channel with the server to send a data packet containing the local time to the server; S2: When the server receives the data packet from the client, it sends the data packet back to the client as is; S3: The client receives the data packet of the server's response, takes out the time in the data packet, and subtracts the time in the data packet from the current time. The difference is the delay of the complete communication between the client and the server, which is recorded as Relay1. S4: The client sends a request to the server to detect the delay using the normal communication channel with the server; S5: After receiving the request, the server obtains the public network address of the client; S6: The server starts to detect the routing node of the client's public network address. The steps are as follows: S61: The server sends a data packet to a random port of the client using a transport protocol and sets an initial TTL value of the data packet; S62: When the next network device receives the data packet, it will send an ICMP data packet to the source address and mark it as a target unreachable flag; S63: The server receives the ICMP data packet and calculates the difference between the sent data packet and the received ICMP data packet, which is recorded as Relay2; S64: repeat steps S61-S63, each time increasing the initial value of TTL by K, and the maximum TTL is N; where N is not less than 5, and K is a natural number; S65: updating the saved difference value Relay2 each time step S63 is executed until an ICMP packet of the public network address IP of the client is received or the TTL value exceeds N; S7: Through the above steps, the delay from the client to the server and the delay from the server actively detecting the client's public network address can be obtained; When the client does not use VPN or proxy, the client public network address obtained by the server is the real client public network address. At this time, the network paths tested in steps S1-S3 and step S6 are basically the same, so Relay1≈Relay2; When the client uses a VPN or a proxy, since the VPN or the proxy will hide the real client IP address, the client public network address obtained by the server is the address of the VPN server or the proxy server. Since the network path passed by steps S1-S3 is longer than the network path passed by step S6, the value of Relay1 will be much larger than Relay2. By comparing the two values ​​of Relay1 and Relay2, it can be distinguished whether the client uses a VPN or a proxy.

2. A method for detecting whether a client uses a VPN based on route tracking according to claim 1, characterized in that: In step S3, to reduce the influence of errors and network jitter, steps S1-S3 are repeated multiple times and the average value of Relay1 is calculated.

3. The method for detecting whether a client uses a VPN based on route tracking according to claim 1, characterized in that: Steps S61-S65 can obtain the delay information from the server to the client or from the server to the routing node closest to the client. This value may be slightly smaller than the actual client-to-server delay. To reduce the impact of errors and network jitter, step S6 is repeated multiple times to obtain the average value of Relay2.

4. The method for detecting whether a client uses a VPN based on route tracking according to claim 1, characterized in that: In step S61, the transmission protocol is the TCP transmission protocol or the UDP transmission protocol.

5. The method for detecting whether a client uses a VPN based on route tracking according to claim 1, characterized in that: In step S1, the communication channel between the client and the server adopts TCP or UDP.

Images