Port hiding method and system based on Netfilter and electronic equipment

Abstract

The invention relates to a port hiding method and system based on a Netfilter and electronic equipment. The method comprises the steps that a client initiates application connection to a server; the client and the server respectively generate pseudo-random port sequences according to preset parameters; the client knocks a door according to the pseudo-random port sequence; and the server side judges whether the door knocking is passed or not and forwards a reply to the client side. A port knock mechanism is realized based on a Netfilter component of a Linux system, and the whole mechanism is realized on a routing module of a CPE corresponding to a server and a client. Not only is the cost reduced, but also the security of a port hiding mechanism is effectively improved.

Description

Technical Field

[0001] The present application relates to the technical field of network communication security, and in particular to a method, system and electronic device for hiding ports based on Netfilter. Background Art

[0002] Hiding ports from the Internet is a basic requirement for SD-WAN and its supporting servers. The common method is that before the client connects to a pre-agreed port, the port that actually provides the service is hidden. The above method is implemented through the functions of high-end routers, but purchasing high-end equipment is expensive. For small and medium-sized enterprises using ordinary routers, a low-cost solution is needed. In addition, the pre-agreed ports are easier to be scanned, and it is more troublesome to change the port. Summary of the invention

[0003] In view of this, the present application proposes a method, system and electronic device for hiding ports based on Netfilter, which upgrades the pre-agreed port to the change rule of the pre-agreed port, generates a pseudo-random port sequence based on the port change rule, and the knocking mechanism of multiple pseudo-random port sequences is difficult to crack, so as to enhance security. The entire mechanism is completely transparent to the application programs on the server and client, and no modification is required. By using the Netfilter component of the Linux system, there is no need to purchase expensive high-end routers to implement the knocking mechanism, and low-cost and high-security port hiding can be achieved.

[0004] According to one aspect of the present application, a Netfilter-based port hiding method is provided, comprising: a client initiating an application connection to a server; The client and server each generate a pseudo-random port sequence based on preset parameters; The client knocks on the door in the order of the pseudo-random port sequence; The server determines whether the knock is successful and forwards a response to the client.

[0005] In a possible implementation, the client and the server each generate a pseudo-random port sequence according to the preset parameters in the following manner: Generate a pseudo-random number sequence based on the preset parameters; Taking the modulus of the pseudo-random number sequence and adding the starting port, a pseudo-random port sequence is obtained; The preset parameters are set in the form of source address+destination port+preset key, and the preset key is distributed to the server and the client through a centralized manager.

[0006] In a possible implementation, the client knocks on the door in the order of the pseudo-random port sequence; the server regards the clients that access the door in sequence as passed, otherwise as failed.

[0007] In a possible implementation, the server determines whether the knock is successful, and when forwarding a reply to the client, allows the client to access after verification, and forwards a pass reply to the client.

[0008] In a possible implementation, when generating a pseudo-random number sequence based on the preset parameters, the client and the server remember the rules at the same time and generate sequences respectively.

[0009] In a possible implementation, the server determines whether the knock is successful and forwards a response to the client, further comprising: denying the client access if the verification fails and forwarding a failed response to the client.

[0010] In a possible implementation, the pseudo-random port sequence used by the server to determine whether the knock is successful is discarded until the preset key is modified or the source address is modified.

[0011] According to another aspect of the present application, there is provided a hidden port system based on Netfilter, comprising: a port sequence generation module, a knock module, and a result response module; The port sequence generation module is configured so that the client initiates an application connection to the server; the client and the server each generate a pseudo-random port sequence according to preset parameters; The knocking module is configured so that the client knocks on the door in the order of the pseudo-random port sequence; The result response module is configured to determine whether the knock on the door is successful at the server side and forward a reply to the client side.

[0012] According to another aspect of the present application, a hidden port device based on Netfilter is provided, comprising: a processor; a memory for storing processor executable instructions; wherein the processor is configured to execute the above method.

[0013] According to another aspect of the present application, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, wherein the computer program instructions implement the above method when executed by a processor.

[0014] Effects of the present invention: Based on the method of "source address + target port + preset key", a pseudo-random multi-port knocking sequence is used to replace single-port and fixed multi-port knocking. The pre-agreed port is upgraded to the change rule of the pre-agreed port, and a centralized pseudo-random number generation key distribution is adopted to enhance security. The entire mechanism is implemented in the routing module of the CPE corresponding to the server and the client, and the application is completely transparent and does not need to be modified. The knocking mechanism based on the free Netfilter component of the Linux system replaces the expensive high-end router to achieve low-cost and high-security port hiding.

[0015] Other features and aspects of the present application will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the present application and, together with the description, serve to explain the principles of the present application.

[0017] Figure 1 A flowchart showing a Netfilter-based port hiding method according to an embodiment of the present application is shown; Figure 2 A schematic diagram showing a generation mechanism of a pseudo-random port sequence according to an embodiment of the present application is shown; Figure 3 A knocking sequence flow chart of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0018] Various exemplary embodiments, features and aspects of the present application will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0019] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0020] In addition, in order to better illustrate the present application, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present application can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present application.

[0021] This application is suitable for low-cost, high-security port hiding. A pseudo-random port sequence is generated based on the port change rule. The pseudo-random multiple port sequence knocking mechanism is difficult to crack to enhance security. The entire mechanism is completely transparent to the server and client applications and does not require modification. By using the Netfilter component of the Linux system, there is no need to purchase expensive high-end routers to implement the knocking mechanism.

[0022] Example 1 Figure 1 A flow chart of a method for hiding ports based on Netfilter according to an embodiment of the present application is shown. Figure 1 As shown, the method includes: Step S100, the client initiates an application connection to the server. The client and the server each generate a pseudo-random port sequence according to preset parameters. The client refers to a program corresponding to the server that provides local services to clients. The server refers to a targeted service program that serves the client. The preset parameters refer to the rule-making method of "source address + target port + preset key" used in this application. A pseudo-random number sequence is generated according to the rules formulated by this method, and then a pseudo-random port sequence is obtained. For the same set of preset parameters, the pseudo-random port sequences generated simultaneously by the client and the server are consistent.

[0023] Step S200, the client knocks on the door in the order of the pseudo-random port sequence. The knocking mechanism is integrated by the routing module of the CPE. The CPE is a terminal access device that receives signals, and refers to a router based on the Linux system. It includes client CPE and server CPE. It is used to calculate the pseudo-random port sequence and forward messages between client applications and server applications. Netfilter, as a standard component of the Linux system, is also a standard component of the CPE software. Therefore, CPE seamlessly integrates the knocking and being knocked processes at the operating system level based on Netfilter. In this embodiment, after the client generates a pseudo-random port sequence according to preset parameters, it knocks on the server in the order of the pseudo-random port sequence.

[0024] Step S300, the server determines whether the knock is successful and forwards a reply to the client. The server CPE determines whether the knock is successful and forwards the application connection request initiated by the client to the server application; after receiving the request, the server application replies to the connection request and forwards the reply to the client application. In this embodiment, the server determines whether the knock is successful by detecting the correct port sequence. In one possible implementation, the client initiates an application connection to the server, and the client and the server each generate a pseudo-random number sequence according to preset parameters; the pseudo-random number sequence is modulo and added to the starting port to obtain a pseudo-random port sequence. The client and the server remember the rules at the same time and generate sequences respectively. For the same set of preset parameters, the pseudo-random port sequences generated by the client and the server at the same time are consistent.

[0025] The preset parameters are set in the form of source address + target port + preset key. The pseudo-random number generation rule is formulated according to the above method. The source address is the client source address; the target port is the server target port; the preset key is the preset key string. And the preset key is distributed to the server and the client through a centralized manager.

[0026] Specifically, the knocking mechanism is implemented based on the Netfilter component of the Linux system. A knocker (knockers) group is defined in the system. Only the visiting IP whose source address is in the knockers group can access the target (443) port. The prerequisite for joining the knockers group is to have visited the pre-agreed port 33321 within 300 seconds. This application optimizes the pre-agreed port 33321 into four pseudo-random port sequences, and port 443 can only be accessed after visiting them in sequence. The pseudo-random number generator PRG (Pseudo Random Generator) uses the ChaCha20 algorithm to generate a pseudo-random number sequence according to preset parameters, and reserves a port area on the server specifically for knocking (such as 33300-33399, a total of 100 ports). Based on the generated pseudo-random number sequence, 100 is taken modulo and the starting port 33300 is added to generate a pseudo-random port sequence of 33300-33399. Figure 2 The port sequence generation mechanism of an embodiment of the present application shown generates a pseudo-random number sequence of 10, 21, 36, 12, 41, 27, 16, 25, 87..., plus the starting port, the corresponding pseudo-random port sequence is 33310, 33321, 33336, 33312, 443. The client needs to knock on the door in order according to the pseudo-random port sequence generated above.

[0027] It should be noted that the algorithm for generating random numbers and the reserved ports in the above process can be modified according to actual conditions and are not specifically limited in this application.

[0028] The server will consider the clients that access in order as passed, otherwise it will be considered as failed. After the verification is passed, the client is allowed to access the target port and the pass reply is forwarded to the client. If the verification fails, the client is denied access and the fail reply is forwarded to the client. The pseudo-random port sequence used when the client knocks on the door is discarded until the preset key is modified or the source address is modified If the access sequence is wrong, the target port cannot be accessed normally. Too frequent attempts will temporarily block access to any port, effectively preventing brute force cracking and improving the security of the mechanism.

[0029] Furthermore, Netfilter is a standard component of the Linux system and also a standard component of the CPE software. Therefore, CPE can seamlessly integrate the knocking and being knocked processes at the operating system level based on Netfilter. The process sequence diagram is as follows: Figure 3As shown, it includes a client application, a client CPE, a server CPE, a server application and a centralized manager. The centralized manager sends a preset key to the client CPE and the server CPE. When the client application initiates an application connection, the client CPE initiates a knock to the server CPE, and the client CPE and the client CPE each calculate a pseudo-random port sequence. The server CPE determines whether the knock is successful, and will not display the notification to the client CPE regardless of whether the result is successful. Furthermore, the client forwards the application connection request, which is then forwarded to the server application through the server CPE. After receiving the connection request initiated by the client application, the server application replies to the connection request based on the knock verification result, and forwards the reply to the client application through the server CPE and the client CPE to complete the access to the hidden port. The entire mechanism is implemented on the routing module of the CPE corresponding to the server and the client. The above knocking mechanism is transparent to all applications, and the server and client applications do not need to be modified.

[0030] According to the above method, the present application provides a hidden port system based on Netfilter, including: a port sequence generation module, a knocking module, and a result response module. The port sequence generation module is configured for the client to initiate an application connection to the server; the client and the server each generate a pseudo-random port sequence according to preset parameters; the knocking module is configured for the client to knock in the order of the pseudo-random port sequence; the result response module is configured for the server to determine whether the knocking is successful and forward a reply to the client.

[0031] Furthermore, according to another aspect of the present application, a hidden port device based on Netfilter is also provided, comprising a processor and a memory for storing processor executable instructions. The processor is configured to implement any of the above-mentioned hidden port methods based on Netfilter when executing the executable instructions. It should be noted here that the number of processors can be one or more.

[0032] The memory, as a computer-readable storage medium, can be used to store software programs, computer executable programs and various modules, such as the program or module corresponding to the method for hiding ports based on Netfilter in the embodiment of the present application. The processor executes various functional applications and data processing of the hidden port device based on Netfilter by running the software program or module stored in the memory.

[0033] According to another aspect of the present application, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, any of the above-mentioned Netfilter-based hidden port methods is implemented.

[0034] The embodiments of the present application have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for hiding ports based on Netfilter, characterized in that: include: The client initiates an application connection to the server; The client and server each generate a pseudo-random port sequence based on preset parameters; The client knocks on the door in the order of the pseudo-random port sequence; The server determines whether the knock is successful and forwards a response to the client.

2. According to the method for hiding ports based on Netfilter described in claim 1, it is characterized in that: The client and the server each generate a pseudo-random port sequence according to the preset parameters in the following manner: Generate a pseudo-random number sequence based on the preset parameters; Taking the modulus of the pseudo-random number sequence and adding the starting port, a pseudo-random port sequence is obtained; The preset parameters are set in the form of source address+destination port+preset key, and the preset key is distributed to the server and the client through a centralized manager.

3. According to the hidden port method based on Netfilter in claim 1, it is characterized in that: The client knocks on the door in the order of the pseudo-random port sequence; the server regards the clients that access in sequence as passed, otherwise it is rejected.

4. According to the method for hiding ports based on Netfilter described in claim 1, it is characterized in that: The server determines whether the knock is successful and forwards a reply to the client. After verification, the server allows the client to access and forwards the pass reply to the client.

5. According to the method for hiding ports based on Netfilter described in claim 2, it is characterized in that: When generating a pseudo-random number sequence based on the preset parameters, the client and the server remember the rules at the same time and generate sequences respectively.

6. The method for hiding ports based on Netfilter according to claim 4, characterized in that: The server determines whether the knock is successful and forwards a reply to the client, which also includes: if the verification fails, the client is denied access and the failure reply is forwarded to the client.

7. The Netfilter-based port hiding method according to claim 4, characterized in that: The pseudo-random port sequence used by the server to determine whether the knock is successful is discarded until the preset key is modified or the source address is modified.

8. A hidden port system based on Netfilter, characterized in that: include: Port sequence generation module, knock module, result response module; The port sequence generation module is configured to initiate an application connection from the client to the server; The client and server each generate a pseudo-random port sequence based on preset parameters; The knocking module is configured so that the client knocks on the door in the order of the pseudo-random port sequence; The result response module is configured to determine whether the knock on the door is successful at the server side and forward a reply to the client side.

9. A hidden port device based on Netfilter, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to implement the method described in any one of claims 1 to 7 when executing the executable instructions.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images