Network situation security prevention and control system based on ipv4-ipv6 interconnection

Abstract

The application provides a network situation security prevention and control system based on IPv4-IPv6 interconnection and intercommunication, comprising: obtaining a request message of an IPv6 client and inputting the request message to a security protection module; searching whether attack data exists in the request message; if the attack data does not exist, sending the request message to an IPv4 source station; obtaining a response message of the IPv4 source station and inputting the response message to the security protection module; searching whether attack data exists in the response message; and if the attack data does not exist, sending the response message to the IPv6 client. In the IPv4 upgrading to the IPv6 website, the network attack of the IPv6 network or the IPv4 source station attack penetrating the IPv4-IPv6 interconnection and intercommunication system on the IPv4 source station website or the IPv6 client can be prevented, and the application is also applicable to the application scene of the IPv4 client accessing the IPv6 website, so that the security of the IPv4-IPv6 website interconnection and intercommunication application is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of security protection, in particular to a network situation security protection system based on IPv4-IPv6 interconnection. BACKGROUND

[0002] At present, after the IPv6(Internet Protocol version 6) upgrading website platform upgrades the website of the IPv4(Internet Protocol version 4) network to the website of the IPv6 network, the IPv6 upgrading website may receive attacks from the Web(World Wide Web) layer in the network, and if no security protection is applied, the IPv6 upgrading website may be attacked by the Web layer, and the attack can pass through the IPv4-IPv6 interconnection system and further attack the IPv4 source station, and if the IPv4 source station also does not apply security protection, the Web attack will be successful, thereby causing a security accident of the website; and if the IPv4 source station itself has a network vulnerability and is attacked by attacks from the IPv4 network, the IPv4 source station may respond to the IPv6 website upgrading platform with illegal and attack data, and further respond to the IPv6 client, thereby causing a security accident of the IPv6 client.

[0003] However, the existing IPv4-IPv6 conversion security protection system mostly adopts synchronous protection processing, and the security protection and conversion are linear process logic, and in this processing condition, a certain delay is caused. And the existing security protection mostly only performs security protection detection before conversion, and does not perform security protection detection on the converted message, and there may be a security risk. SUMMARY

[0004] Therefore, the present application aims to provide a network situation security protection system based on IPv4-IPv6 interconnection, which can quickly realize IPv4 website upgrading supporting the IPv6 protocol, and IPv6 website backward compatible with the IPv4 protocol, and simultaneously protect the IPv4 and IPv6 protocols in the process. In the IPv4 upgrading to the IPv6 website, the IPv6 network is prevented from attacking the IPv4 source station website through the IPv6 upgrading conversion system, and the IPv4 source station is prevented from attacking the IPv6 client through the IPv4-IPv6 interconnection system, thereby improving the security of website upgrading.

[0005] In a first aspect, the embodiments of the present application provide a network situation security prevention and control system based on IPv4-IPv6 interconnection and intercommunication, which is used to execute a network situation security prevention and control method based on IPv4-IPv6 interconnection and intercommunication. The method comprises the following steps: obtaining a request message of an IPv6 client, and inputting the request message into a security protection module; searching whether attack data exists in the request message through the security protection module; if the attack data does not exist, sending the request message to an IPv4 source station; wherein the attack data comprises network layer attack data or application layer attack data; obtaining a response message of the IPv4 source station, and inputting the response message into the security protection module; searching whether attack data exists in the response message through the security protection module; if the attack data does not exist, sending the response message to the IPv6 client.

[0006] In optional embodiments of the present application, after the step of searching whether attack data exists in the request message through the security protection module, the method further comprises the following steps: if the attack data exists, intercepting the request message, and sending an interruption response to the IPv6 client; after the step of searching whether attack data exists in the response message through the security protection module, the method further comprises the following steps: if the attack data exists, intercepting the response message, and sending an interruption response to the IPv6 client.

[0007] In optional embodiments of the present application, the IPv6 client accesses an IPv6 upgraded website through a security protection system suitable for IPv4-IPv6 interconnection and intercommunication; the IPv4 source station is upgraded to support IPv6 through the security protection system suitable for IPv4-IPv6 interconnection and intercommunication; the step of obtaining the request message of the IPv6 client comprises the following step: obtaining the request message of the IPv6 client when the IPv6 client accesses the IPv6 upgraded website; the request message comprises a network layer message, a transport layer message and an application layer message.

[0008] In optional embodiments of the present application, the security protection module comprises a transport layer security protection module and an application layer security protection module; the step of inputting the request message into the security protection module comprises the following step: mirroring and copying the request message to the transport layer security protection module and the application layer security protection module; the step of searching whether attack data exists in the request message through the security protection module comprises the following steps: searching whether attack data exists in the transport layer message through the transport layer security protection module; if the attack data does not exist in the transport layer message, searching whether attack data exists in the application layer message through the application layer security protection module.

[0009] In an optional embodiment of the present application, the security protection module further comprises an IPv4 network layer security protection module; the step of inputting the request message into the security protection module further comprises: converting the request message from an IPv6 request message to an IPv4 request message by an IPv6-IPv4 conversion module, and inputting the IPv4 request message into the IPv4 network layer security protection module; the step of searching the request message for attack data by the security protection module further comprises: searching the IPv4 request message for network layer attack data by the IPv4 network layer security protection module.

[0010] In an optional embodiment of the present application, the step of sending the request message to the IPv4 source station if no attack data exists comprises: sending detection results of whether attack data exists to the request message sending module by the transport layer security protection module, the application layer security protection module and the IPv4 network layer security protection module respectively; if the detection results of the transport layer security protection module, the application layer security protection module and the IPv4 network layer security protection module all indicate that no attack data exists, sending the request message to the IPv4 source station by the request message sending module.

[0011] In an optional embodiment of the present application, the response message comprises a network layer message, a transport layer message and an application layer message; the step of inputting the response message into the security protection module comprises: mirroring and copying the response message to the transport layer security protection module and the application layer security protection module; the step of searching the response message for attack data by the security protection module comprises: searching the transport layer message for attack data by the transport layer security protection module; if no attack data exists in the transport layer message, searching the application layer message for attack data by the application layer security protection module.

[0012] In an optional embodiment of the present application, the security protection module further comprises an IPv6 network layer security protection module; the step of inputting the response message into the security protection module further comprises: converting the response message from an IPv4 response message to an IPv6 response message by an IPv4-IPv6 conversion module, and inputting the IPv6 response message into the IPv6 network layer security protection module; the step of searching the response message for attack data by the security protection module further comprises: searching the IPv6 response message for network layer attack data by the IPv6 network layer security protection module.

[0013] In the optional embodiment of the present application, if the attack data does not exist, the step of sending the response message to the IPv6 client comprises: the transport layer security protection module, the application layer security protection module and the IPv6 network layer security protection module respectively send the detection result of whether the attack data exists to the response message sending module; if the detection result of the transport layer security protection module, the application layer security protection module and the IPv6 network layer security protection module all indicate that the attack data does not exist, the response message is sent to the IPv6 client through the response message sending module.

[0014] In the optional embodiment of the present application, when the message reaches the network layer security protection module or the transport layer security protection module, the network layer security protection module or the transport layer security protection module is used for analyzing the protocol, the source address, the source port, the target address and the target port field of the message, and performing the mode matching of the payload data based on the feature library.

[0015] In the optional embodiment of the present application, when the message reaches the application layer security protection module, the application layer security protection module is used for performing the protocol specification anomaly detection, the attack detection and protection, the data leakage protection and the security audit on the message.

[0016] In the optional embodiment of the present application, the method is suitable for the application scenario that the IPv4 client accesses the IPv6 website, and the IPv6 website is backward compatible with the IPv4 protocol.

[0017] In the second aspect, the embodiment of the present application further provides a security protection system suitable for IPv4-IPv6 interconnection and intercommunication, which is used for executing the security protection method suitable for IPv4-IPv6 interconnection and intercommunication.

[0018] The embodiment of the present application brings the following beneficial effects:

[0019] The embodiment of the present application provides a network situation security prevention and control system based on IPv4-IPv6 interconnection and intercommunication, acquires a request message of an IPv6 client, inputs the request message into a security protection module, searches whether attack data exist in the request message through the security protection module, if not, sends the request message to an IPv4 source station, wherein the attack data comprises network layer attack data or application layer attack data, acquires a response message of the IPv4 source station, inputs the response message into the security protection module, searches whether attack data exist in the response message through the security protection module, if not, sends the response message to the IPv6 client. In the mode, in the IPv4 upgrading to the IPv6 website, the IPv6 network can be prevented from carrying out network attack on the IPv4 source station website through the IPv4-IPv6 interconnection and intercommunication system, and the IPv4 source station can be prevented from carrying out network attack on the IPv6 client through the IPv4-IPv6 interconnection and intercommunication system, so that the security of website upgrading is improved. Moreover, the IPv4-IPv6 interconnection and intercommunication system supports the application scene that the IPv6 website is backward compatible with the IPv4 protocol, therefore, the embodiment of the present application provides a security protection method suitable for IPv4-IPv6 interconnection and intercommunication, and the security of the application scene can be improved.

[0020] Other features and advantages of the present disclosure will be described in the following description, or can be inferred from the description, or can be determined without doubt, or can be known by implementing the above-mentioned technologies of the present disclosure.

[0021] In order to make the above-mentioned purposes, features and advantages of the present disclosure more obvious and easy to understand, the following preferred embodiments are specifically described, and the accompanying drawings are described in detail as follows. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings needed to be used in the specific embodiments or the prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0023] Figure 1 A structure schematic diagram of an IPv4-IPv6 interconnection and intercommunication system provided by the embodiment of the present application is shown in the figure.

[0024] Figure 2 A structure schematic diagram of a security protection module provided by the embodiment of the present application is shown in the figure.

[0025] Figure 3 A flowchart of a security protection method suitable for IPv4-IPv6 interconnection and intercommunication provided by the embodiment of the present application is shown in the figure.

[0026] Figure 4 A schematic diagram of an IPv4 website upgrade to an IPv6 website upgrade conversion process provided by an embodiment of the present application is shown in the figure;

[0027] Figure 5 A flowchart of a process of processing request and response messages by an IPv4-IPv6 interconnection and intercommunication system provided by an embodiment of the present application is shown in the figure;

[0028] Figure 6 A flowchart of a process of processing request messages by a security protection module provided by an embodiment of the present application is shown in the figure;

[0029] Figure 7 A flowchart of a process of processing response messages by a security protection module provided by an embodiment of the present application is shown in the figure;

[0030] Figure 8 A structural schematic diagram of an electronic device provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0031] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions of the present application will be described below in detail with reference to the accompanying drawings. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0032] At present, most of the existing IPv4-IPv6 conversion security protection systems adopt synchronous protection processing, and the security protection and conversion are linear process logic, which will cause a certain delay in this processing. Moreover, the existing security protection is mostly only performed before conversion, and no security protection detection is performed on the converted messages, which may have security risks.

[0033] Based on this, the embodiment of the present application provides a network situation security protection and control system based on IPv4-IPv6 interconnection and intercommunication. The system is deployed between an IPv6 client and an IPv4 source station, can quickly realize IPv4 website upgrade supporting IPv6 protocol, and IPv6 website backward compatible with IPv4 protocol, and simultaneously protects the security of IPv4 and IPv6 protocols in this process.

[0034] To facilitate the understanding of the present embodiment, first, a security protection method suitable for IPv4-IPv6 interconnection and intercommunication is introduced in detail.

[0035] Embodiment one:

[0036] The embodiment of the present application provides a network situation security prevention and control system based on IPv4-IPv6 interconnection and intercommunication, which can be referred to as an IPv4-IPv6 interconnection and intercommunication system, and is used for executing a network situation security prevention and control method based on IPv4-IPv6 interconnection and intercommunication. An IPv6 upgraded website is a website authorized by the IPv4-IPv6 interconnection and intercommunication system, and the IPv6 client can access the IPv6 upgraded website through the IPv4-IPv6 interconnection and intercommunication system. The embodiment can be applied to implement website IPv4-IPv6 interconnection and intercommunication, and the system is deployed between the IPv6 client and the IPv4 source station, and can quickly realize IPv4 website upgrade supporting the IPv6 protocol, IPv6 website backward compatible with the IPv4 protocol, and simultaneously protecting the IPv4 and IPv6 protocol security in the process.

[0037] Referring to Figure 1 A structure diagram of an IPv4-IPv6 interconnection and intercommunication upgraded website platform is shown, the IPv4-IPv6 interconnection and intercommunication system can comprise a security protection module, a response message sending module, an IPv4-IPv6 response message conversion module, a response message receiving module, a request message sending module, an IPv6-IPv4 request message conversion module, and a request message receiving module.

[0038] Referring to Figure 2 A structure diagram of a security protection module is shown, the security protection module can comprise an interception and blocking module, a response message security protection module, an IPv4 network layer security protection module, an application layer message security protection module, a UDP (User Datagram Protocol) message security protection module, a TCP (Transmission Control Protocol) message security protection module, an IPv6 network layer security protection module, and a request message protection module.

[0039] Based on the above description, referring to Figure 3 A flow chart of a security protection method suitable for IPv4-IPv6 interconnection and intercommunication is shown, the security protection method suitable for IPv4-IPv6 interconnection and intercommunication comprises the following steps:

[0040] In step S302, the request message of the IPv6 client is acquired, and the request message is input to the security protection module; whether the attack data exists in the request message is searched through the security protection module; if the attack data does not exist, the request message is sent to the IPv4 source station; wherein the attack data comprises network layer attack data or application layer attack data.

[0041] The request message of the IPv6 client can be acquired in the embodiment, and the request message is input to the security protection module. Each parameter of the message is detected by the security protection module to exclude abnormal messages such as messages with excessively large length, and different behaviors are performed according to different configurations, such as disabling ping messages. Whether the received message has a tendency of forgery is detected, such as whether the source address and the destination address are the same. The payload data is subjected to high-speed and intelligent pattern matching based on a national-level feature library to search whether attack data exists in the request message. If the attack data does not exist, the request message is sent to the IPv4 source station. The attack data includes network layer attack data or application layer attack data.

[0042] The IPv4-IPv6 interconnection and intercommunication system of the embodiment can input the request message of the IPv6 client to the security protection module. The security protection module searches whether network layer attack data or application layer attack data exists in the request message. If the attack data does not exist, the IPv4-IPv6 interconnection and intercommunication system can send the request message to the IPv4 source station.

[0043] In some embodiments, if the attack data exists, the request message is intercepted, and an interruption response is sent to the IPv6 client.

[0044] If the attack data exists, the IPv4-IPv6 interconnection and intercommunication system can intercept the request message and send an interruption response to the IPv6 client.

[0045] In step S304, the response message of the IPv4 source station is acquired, and the response message is input to the security protection module. Whether attack data exists in the response message is searched by the security protection module. If the attack data does not exist, the response message is sent to the IPv6 client.

[0046] The response message of the IPv4 source station can be acquired in the embodiment, and the response message is input to the security protection module. The payload data is subjected to high-speed and intelligent pattern matching based on a national-level feature library by the security protection module to search whether attack data exists in the response message. If the attack data does not exist, the response message is sent to the IPv6 client.

[0047] The IPv4-IPv6 interconnection and intercommunication system of the embodiment can input the response message of the IPv4 source station to the security protection module. The security protection module searches whether network layer attack data or application layer attack data exists in the response message. If the attack data does not exist, the IPv4-IPv6 interconnection and intercommunication system can send the response message to the IPv6 client.

[0048] In some embodiments, if the attack data exists, the response message is intercepted, and an interruption response is sent to the IPv6 client.

[0049] If the attack data exists, the IPv4-IPv6 interconnection and intercommunication system can intercept the response message and perform an interruption response to the IPv6 client.

[0050] In some embodiments, the above method is applicable to the application scenario that IPv4 clients access IPv6 websites which are backward compatible with IPv4 protocols.

[0051] The method provided in the embodiment is also applicable to the application scenario that IPv4 clients access IPv6 websites which are backward compatible with IPv4 protocols, and can improve the security of the application scenario.

[0052] The embodiment of the application provides a security protection method suitable for IPv4-IPv6 interconnection and intercommunication, acquires a request message of an IPv6 client, and inputs the request message into a security protection module; whether attack data exists in the request message is searched through the security protection module; if the attack data does not exist, the request message is sent to an IPv4 source station; wherein the attack data comprises network layer attack data or application layer attack data; a response message of the IPv4 source station is acquired, and the response message is input into the security protection module; whether attack data exists in the response message is searched through the security protection module; if the attack data does not exist, the response message is sent to the IPv6 client. In the method, in the IPv4 upgrading to an IPv6 website, the IPv6 network can be prevented from performing network attacks on the IPv4 source station website through an IPv6 upgrading conversion system, and the IPv4 source station can be prevented from performing network attacks on the IPv6 client through an IPv4-IPv6 interconnection and intercommunication system, so that the security of website upgrading is improved. Moreover, the IPv4-IPv6 interconnection and intercommunication system supports the application scenario that the IPv6 website is backward compatible with the IPv4 protocol, and therefore the security protection method suitable for IPv4-IPv6 interconnection and intercommunication can improve the security of the application scenario.

[0053] Embodiment two:

[0054] The embodiment provides another security protection method suitable for IPv4-IPv6 interconnection and intercommunication, which is implemented on the basis of the above embodiment, and mainly describes a security protection method of a request message. In some embodiments, an IPv6 client accesses an IPv6 upgraded website through a security protection system suitable for IPv4-IPv6 interconnection and intercommunication. An IPv4 source station is upgraded to support IPv6 through the security protection system suitable for IPv4-IPv6 interconnection and intercommunication (which can also be referred to as an IPv6 upgraded website). When the IPv6 client accesses the IPv6 upgraded website, a request message of the IPv6 client is acquired; the request message comprises a network layer message, a transport layer message and an application layer message.

[0055] It can be seen from Figure 4Fig. 1 shows a schematic diagram of an upgrade conversion process of an IPv4 website upgraded to an IPv6 website. When an IPv6 client user accesses the IPv6 upgraded website, a request message reaches the IPv6 website upgrade platform. The request message includes a network layer message, a transport layer message, and an application layer message.

[0056] In some embodiments, the security protection module includes a transport layer security protection module and an application layer security protection module. The request message can be mirrored and copied to the transport layer security protection module and the application layer security protection module. Whether attack data exists in the transport layer message is searched through the transport layer security protection module. If no attack data exists in the transport layer message, whether attack data exists in the application layer message is searched through the application layer security protection module.

[0057] Referring to Fig. 2, Figure 5 Fig. 3 shows a schematic diagram of a process of processing request and response messages of an IPv6 website upgrade platform. The IPv6 website upgrade platform can mirror and copy the request message to the transport layer security protection module and the application layer security protection module.

[0058] Referring to Fig. 4, Figure 6 Fig. 5 shows a schematic diagram of a process of processing a request message of a security protection module. The transport layer security protection module determines whether the transport layer message header contains illegal and attack data. If attack exists, the request is intercepted. Otherwise, the application layer security protection module continues to determine whether the application layer message contains illegal and attack data. If the application layer message contains illegal and attack data, the request is intercepted. If no attack data exists in the application layer message, the request message is released.

[0059] In some embodiments, the security protection module further includes an IPv4 network layer security protection module. The request message is converted from an IPv6 request message to an IPv4 request message through an IPv6-IPv4 conversion module. The IPv4 request message is input to the IPv4 network layer security protection module. Whether attack data exists in the network layer message in the IPv4 request message is searched through the IPv4 network layer security protection module.

[0060] As shown in Figs. 6 and 7, Figure 5 and Figure 6 As shown in Figs. 6 and 7, the converted IPv4 request message is input to the IPv4 network layer security protection module through the IPv6-IPv4 conversion module. The IPv4 network layer security protection module first determines whether the IPv4 network layer message in the request message contains illegal and attack data. If attack exists, the request is intercepted. Otherwise, the message is input to a request message sending module.

[0061] In some embodiments, the transport layer security protection module, the application layer security protection module and the IPv4 network layer security protection module respectively send the detection result of whether the attack data exists to the request message sending module; if the detection results of the transport layer security protection module, the application layer security protection module and the IPv4 network layer security protection module all represent that the attack data does not exist, the request message is sent to the IPv4 source station through the request message sending module.

[0062] As shown in Figure 5 , the request message sending module judges whether the notification of intercepting the request message is received, if yes, the request message is intercepted, otherwise the request message is sent to the IPv4 source station.

[0063] Embodiment three:

[0064] This embodiment provides another security protection method suitable for IPv4-IPv6 interconnection, which is realized on the basis of the above-mentioned embodiments, and focuses on the security protection mode of the response message. In some embodiments, the response message includes a network layer message, a transport layer message and an application layer message.

[0065] As shown in Figure 5 , when the IPv4 source station response message arrives at the IPv4-IPv6 interconnection system, the response message includes a network layer message, a transport layer message and an application layer message, and the response message can be mirrored and copied to the transport layer security protection module and the application layer security protection module.

[0066] In some embodiments, the response message is mirrored and copied to the transport layer security protection module and the application layer security protection module; whether the attack data exists in the transport layer message is searched through the transport layer security protection module; if the attack data does not exist in the transport layer message, whether the attack data exists in the application layer message is searched through the application layer security protection module.

[0067] As shown in Figure 7 , a flowchart of a security protection module processing a response message, the transport layer security protection module judges whether the transport layer message header contains illegal and attack data, if the attack data exists, the response is intercepted; otherwise, the application layer security protection module continues to judge whether the application layer message contains illegal and attack data, if the application layer message contains illegal and attack data, the response is intercepted, if there is no attack data in the application layer message, the response message is notified to pass.

[0068] In some embodiments, the security protection module further comprises: an IPv6 network layer security protection module; converting the response message from an IPv4 response message to an IPv6 response message by the IPv6-IPv4 conversion module, and inputting the IPv6 response message into the IPv6 network layer security protection module; and searching the network layer message in the IPv6 response message for attack data by the IPv6 network layer security protection module.

[0069] As shown in Figure 5 and Figure 7 the IPv4-IPv6 conversion module inputs the converted IPv6 response message into the IPv6 network layer security protection module, and the IPv6 network layer security protection module first judges whether the IPv6 network layer message in the response message contains illegal attack data, and if there is an attack, intercepts the response; otherwise, inputs the message into the response message sending module.

[0070] In some embodiments, the transport layer security protection module, the application layer security protection module and the IPv6 network layer security protection module respectively send the detection results of whether there is attack data to the response message sending module; if the detection results of the transport layer security protection module, the application layer security protection module and the IPv6 network layer security protection module all represent that there is no attack data, the response message is sent to the IPv6 client by the response message sending module.

[0071] As shown in Figure 5 the response message sending module judges whether the notification of intercepting the response message is received, and if so, intercepts the response message, otherwise sends the response message to the IPv6 client.

[0072] Embodiment four:

[0073] This embodiment provides another security protection method suitable for IPv4-IPv6 interconnection and interworking, which is implemented on the basis of the above-mentioned embodiments, and focuses on describing the specific way of identifying attack data by the network layer security protection module, the transport layer security protection module and the application layer security protection module.

[0074] In some embodiments, when the message arrives at the network layer security protection module or the transport layer security protection module, the network layer security protection module or the transport layer security protection module is used to analyze the protocol, source address, source port, target address and target port fields of the message, and to perform pattern matching on the payload data based on the feature library.

[0075] The steps of the network layer security protection module and the transport layer security protection module identifying attack data can be: when the message reaches the network layer security protection module and the transport layer security protection module, the protocol, the source address and the source port, the target address and the target port field are analyzed, the payload data is subjected to high-speed and intelligent pattern matching based on the national feature library, the characteristics of various known attacks can be accurately identified, including viruses, zombies, trojans, worms, vulnerabilities, backdoors, web impersonation, Internet malicious codes, etc., and important attack behaviors can be monitored in the first time by continuously upgrading the attack characteristics from the security cloud.

[0076] In some embodiments, when the message reaches the application layer security protection module, the application layer security protection module is used for protocol specification anomaly detection, attack detection and protection, data leakage protection and security audit of the message.

[0077] The steps of the application layer security protection module identifying attack data and targeted protection can be: application layer protocol specification anomaly detection, attack detection and protection, data leakage protection, security audit, etc.; the protocol specification anomaly detection can detect the illegal behavior of the application protocol, analyze the abnormal request method and the request format that does not conform to the specification, and ensure the normal analysis of the protocol by the back-end server; the attack detection and protection provides comprehensive attack type detection, analyzes and protects the behaviors such as SQL injection attack, cross-site scripting (XSS) attack, remote code execution, local file inclusion, vulnerability exploitation, etc.; the data leakage protection detects and prevents the leakage of sensitive data, and the security audit records the above anomalies, attacks and protection data in detail, including the occurrence time, the source IP address, the attack type, the protection method, etc.; the application layer security protection module analyzes the request from the IPv6 / IPv4 client, converts and translates it into a safe IPv4 / IPv6 request, and then sends it to the source site server; similarly, the response content is protected.

[0078] Embodiment five:

[0079] The embodiment provides an IPv4-IPv6 interconnection and intercommunication system, which is implemented based on the above-mentioned embodiment, and is used for executing the security protection method suitable for IPv4-IPv6 interconnection and intercommunication provided in the above-mentioned embodiment.

[0080] The IPv4-IPv6 interconnection system in the embodiment mainly comprises a request message receiving module, a request message sending module, a response message receiving module, a response message sending module, a request message IPv6-IPv4 conversion module, a response message IPv4-IPv6 conversion module, and a security protection module. The security protection module further comprises a network layer header security analysis submodule (IPv4, IPv6), a transmission layer security analysis submodule (TCP, UDP, ICMP, etc.), and an application layer security analysis submodule (protocols such as HTTP, TLS, etc., analysis including message header and message body content).

[0081] The process of the IPv4-IPv6 interconnection system in the embodiment for processing a request message can be as follows: the request message receiving module receives a request message from an IPv6 client, mirrors the request message flow to the transmission layer security protection module and the application layer security protection module, and delivers the original message to the request message IPv6-IPv4 conversion module. The transmission layer security protection module identifies whether there is an attack in the request message, and if there is, notifies the request message sending module that the request has an attack, otherwise, delivers the request message to the application layer security protection module. The application layer security protection module identifies whether there is an attack in the request message, and if there is, notifies the request message sending module that the request has an attack. The request message IPv6-IPv4 conversion module converts the request message into an IPv4 message, inputs the request message to the IPv4 network layer security protection module, and the IPv4 network layer security protection module identifies whether there is an attack in the request message, and if there is, intercepts the request, otherwise, inputs the request message to the request message sending module. The request message sending module judges whether a notification of intercepting the request is received, and if yes, intercepts the request, and if not, sends the IPv4 request message to an IPv4 source station.

[0082] The flow of processing the response message in the IPv4-IPv6 interconnection and intercommunication system in the embodiment can be: the response message receiving module receives the response message from the IPv4 source station, and mirrors the response message flow to the transport layer security protection module and the application layer security protection module, and the original message is transmitted to the response message IPv4-IPv6 conversion module. The transport layer security protection module identifies whether there is an attack in the response message, and if there is, the response message sending module is notified that the response has an attack, otherwise the response message is applied to the application layer security protection module. The application layer security protection module identifies whether there is an attack in the response message, and if there is, the response message sending module is notified that the response has an attack. The response message IPv4-IPv6 conversion module converts the response message into an IPv6 message, and then inputs the response message to the IPv6 network layer security protection module. The IPv6 network layer security protection module identifies whether there is an attack in the response message, and if there is, the response is intercepted, otherwise the response message is input to the response message sending module; the response message sending module determines whether to receive the notification of intercepting the response, and if it is received, the response is intercepted, and if it is not received, the IPv6 response message is sent to the IPv6 client.

[0083] In addition, the security protection module in the embodiment includes a network layer header security analysis submodule (IPv4, IPv6), a transport layer security analysis submodule (TCP, UDP, etc.), an application layer security analysis submodule (protocols such as HTTP, TLS, etc., analysis including message header and message body content), and a security filtering and interception submodule.

[0084] The network layer header security analysis submodule in the embodiment can analyze the IPv4 and IPv6 message headers to determine whether there is attack data. The transport layer security analysis submodule in the embodiment can analyze the transport layer message (such as TCP and UDP messages) header to determine whether there is attack data. The application layer security analysis submodule in the embodiment can analyze the message header and message body of the application layer message (such as HTTP and TLS protocols) to determine whether there is attack data.

[0085] The request message receiving module and the response message sending module in the embodiment both have the function of flow mirroring, and can mirror and copy the message to the transport layer security analysis submodule and the application layer security analysis submodule. The request message sending module in the embodiment has the function of intercepting the request, and the response message sending module also has the function of intercepting the response.

[0086] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the IPv4-IPv6 interconnection and intercommunication system described above can refer to the corresponding process in the foregoing embodiment of the security protection method applicable to IPv4-IPv6 interconnection and intercommunication, which will not be described here.

[0087] Embodiment six:

[0088] The embodiment provides an application layer security protection module, which is based on the above-mentioned embodiments.

[0089] The application layer security protection module in the embodiment divides source station protocols into HTTP, TLS and other protocols. In the application layer protocol specification anomaly detection step, if the source station uses the HTTP protocol, the HTTP request header is parsed according to the HTTP protocol standard, the HTTP request characteristics are recorded, including the request method, the request target, the HTTP version and the remaining HTTP header. If data that does not conform to the HTTP protocol is encountered in the parsing process, it is considered that there is attack data, the attack data is recorded and the connection is disconnected. If the source station uses the TLS protocol, a TLS Client Hello packet sent by the client is parsed according to the TLS protocol standard, the TLS Client Hello packet characteristics are recorded, including the client version, the cipher suite, the compression method and the remaining TLS extension field. If the parsing process encounters a situation that does not conform to the TLS protocol standard, it is considered that there is attack data, the attack data is recorded and the connection is disconnected. If the source station uses other protocols, the step is skipped.

[0090] In the attack detection and protection step, the protocol header attack detection is performed first. If the source station uses the HTTP protocol, the HTTP request characteristics recorded in the above step are matched with a plurality of configurable rules, a single rule can perform "existence" and "conform to regular expression" operations on a plurality of fields, and the plurality of fields are connected through logical symbols. For example, the rule "the field 'User-Agent' exists and the field 'Path' does not conform to the regular expression '\.php$'" contains two operations: operation 1, the field "User-Agent" exists; operation 2, the field "Path" matches the regular expression "\.php$". The complete rule is obtained by connecting operation 1 "and" "not" operation 2 using the logical symbol.

[0091] If the source station uses TLS protocol, the TLS Client Hello packet feature recorded in the last step is matched with a plurality of configurable rules, a single rule can perform "existence", "list contains", "regular expression matching" operation on multiple fields, and the fields are connected by logical symbols. For example, the rule "field 'Cipher Suites' list contains 'TLS_CHACHA20_POLY1305_SHA256(0x1303)' and field 'ALPN' list does not contain 'h2'" contains two operations: operation 1. Field "Cipher Suites" list contains "TLS_CHACHA20_POLY1305_SHA256(0x1303)"; operation 2. Field "ALPN" list contains "h2". Then connect operation 1 "and" "not" operation 2 to get the complete rule.

[0092] If the above header feature successfully matches one of the above plurality of rules, it is considered that there is attack data, and the attack data is recorded and the connection is disconnected.

[0093] If the source station uses other protocols, this step is skipped. After the protocol header attack detection is completed, the request data attack detection is continued, a series of request data attack detection rules are used to match the subsequent request data except the protocol header, a single rule is a regular expression rule, and if one of them is successfully matched, it is considered that there is attack data, the attack data is recorded and the connection is disconnected.

[0094] In the data leakage protection step, a series of data leakage protection detection rules are used to match the response data of the server, a single rule is a regular expression rule, and if one of them is successfully matched, it is considered that there is data leakage, the data leakage is recorded and the connection is disconnected.

[0095] The record attack data and record data leakage operation in the above steps record the occurrence time, client IP address, target server, type (attack data or data leakage), successfully matched rule information, and successfully matched rule data content into the audit log.

[0096] Embodiment seven:

[0097] The embodiment of the application also provides an electronic device for running the above-mentioned security protection method suitable for IPv4-IPv6 interconnection; see Figure 8A structural schematic diagram of an electronic device is shown, which comprises a memory 100 and a processor 101, wherein the memory 100 is configured to store one or more computer instructions, and the one or more computer instructions are executed by the processor 101 to implement the above-mentioned security protection method applicable to IPv4-IPv6 interconnection and intercommunication.

[0098] Further, Figure 8 The electronic device shown further comprises a bus 102 and a communication interface 103, and the processor 101, the communication interface 103 and the memory 100 are connected through the bus 102.

[0099] The memory 100 can contain a high-speed random access memory (RAM, Random Access Memory), and can also include a non-volatile memory (Non-volatile Memory), such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 103 (which can be wired or wireless), and the Internet, a wide area network, a local area network, a metropolitan area network, etc. can be used. The bus 102 can be an ISA bus, a PCI bus or an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0100] The processor 101 can be an integrated circuit chip having a processing capability of signals. In the implementation process, each step of the above method can be completed by the integrated logic circuit of hardware in the processor 101 or the instruction in the form of software. The processor 101 described above can be a general processor, including a central processing unit (CPU), a network processor (NP), etc.; can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. Each method, step and logic block diagram disclosed in the embodiment of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the embodiment of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a random access memory, a flash memory, a read only memory, a programmable read only memory or an electrically erasable programmable memory, a register, etc. The storage medium in the art. The storage medium is located in the memory 100, and the processor 101 reads the information in the memory 100, and combines the hardware to complete the steps of the method of the above embodiment.

[0101] The embodiment of the present application also provides a computer readable storage medium, the computer readable storage medium stores computer executable instructions, when the processor calls and executes the computer executable instructions, the computer executable instructions cause the processor to implement the above-mentioned security protection method suitable for IPv4-IPv6 interconnection and interworking. For specific implementation, please refer to the method embodiment, which will not be repeated here.

[0102] The embodiment of the present application also provides a computer readable storage medium, the computer readable storage medium stores computer executable instructions, when the processor calls and executes the computer executable instructions, the computer executable instructions cause the processor to implement the above-mentioned security protection method suitable for IPv4-IPv6 interconnection and interworking. For specific implementation, please refer to the method embodiment, which will not be repeated here.

[0103] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system and / or device described above can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

[0104] In addition, in the description of the embodiments of the present application, unless otherwise explicitly specified and limited, the terms "mounting", "connection", "connecting" should be understood in a broad sense, for example, can be fixedly connected, can be detachably connected, or integrally connected; can be mechanically connected, can be electrically connected; can be directly connected, can be indirectly connected through an intermediate medium, or can be the communication inside two elements. For those skilled in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances.

[0105] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application or the part of the present application that essentially contributes to the prior art or the part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0106] In the description of the present application, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer" and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the devices or elements referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation on the present application. In addition, the terms "first", "second", "third" are only for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0107] Finally, it should be noted that: the above embodiments are only specific embodiments of the present application, used to illustrate the technical solutions of the present application, and are not limiting, the protection scope of the present application is not limited thereto, although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art within the technical scope disclosed by the present application can modify or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to part of the technical features; and these modifications, changes or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A network situational security control system based on IPv4-IPv6 interconnection, characterized in that, A method for implementing network situational security control based on IPv4-IPv6 interconnection, the method comprising: The system obtains a request message from an IPv6 client and inputs the request message into a security protection module. The security protection module then searches the request message for any attack data. If no attack data is found, the system sends the request message to the IPv4 origin server. The attack data includes network layer attack data or application layer attack data. Obtain the response message from the IPv4 source server and input the response message into the security protection module; use the security protection module to search for whether there is attack data in the response message; if there is no attack data, send the response message to the IPv6 client; The IPv6 client accesses the IPv6 upgrade website through a security protection system suitable for IPv4-IPv6 interconnection; the IPv4 source station upgrades to support IPv6 through the security protection system suitable for IPv4-IPv6 interconnection; the step of obtaining the request message of the IPv6 client includes: when the IPv6 client accesses the IPv6 upgrade website, obtaining the request message of the IPv6 client; the request message includes network layer messages, transport layer messages and application layer messages; The security protection module includes a transport layer security protection module and an application layer security protection module. The step of inputting the request message into the security protection module includes: mirroring the request message to the transport layer security protection module and the application layer security protection module. The step of retrieving whether attack data exists in the request message through the security protection module includes: retrieving whether attack data exists in the transport layer message through the transport layer security protection module; if no attack data exists in the transport layer message, retrieving whether attack data exists in the application layer message through the application layer security protection module. The security protection module further includes an IPv4 network layer security protection module; the step of inputting the request message into the security protection module further includes: converting the request message from an IPv6 request message to an IPv4 request message through an IPv6-IPv4 conversion module, and inputting the IPv4 request message into the IPv4 network layer security protection module; the step of searching for whether there is attack data in the request message through the security protection module further includes: searching for whether there is attack data in the network layer message of the IPv4 request message through the IPv4 network layer security protection module.

2. The network situational awareness and security control system based on IPv4-IPv6 interconnection as described in claim 1, characterized in that, After the step of retrieving whether attack data exists in the request message through the security protection module, the method further includes: if attack data exists, intercepting the request message and sending an interrupt response to the IPv6 client; After the step of retrieving whether attack data exists in the response message through the security protection module, the method further includes: if attack data exists, intercepting the response message and sending an interrupt response to the IPv6 client.

3. The network situational awareness and security control system based on IPv4-IPv6 interconnection as described in claim 1, characterized in that, If no attack data exists, the step of sending the request message to the IPv4 source server includes: The transport layer security protection module, the application layer security protection module, and the IPv4 network layer security protection module each send the detection results of whether attack data exists to the request message sending module; If the detection results of the transport layer security protection module, the application layer security protection module, and the IPv4 network layer security protection module all indicate that there is no attack data, the request message is sent to the IPv4 source station through the request message sending module.

4. The network situational awareness and security control system based on IPv4-IPv6 interconnection as described in claim 1, characterized in that, The response message includes network layer messages, transport layer messages, and application layer messages; The step of inputting the response message into the security protection module includes: mirroring the response message to the transport layer security protection module and the application layer security protection module; The step of retrieving whether attack data exists in the response message through the security protection module includes: retrieving whether attack data exists in the transport layer message through the transport layer security protection module; if no attack data exists in the transport layer message, retrieving whether attack data exists in the application layer message through the application layer security protection module.

5. The network situational awareness and security control system based on IPv4-IPv6 interconnection as described in claim 4, characterized in that, The security protection module further includes an IPv6 network layer security protection module; the step of inputting the response message into the security protection module further includes: converting the response message from an IPv4 response message to an IPv6 response message through an IPv4-IPv6 conversion module, and inputting the IPv6 response message into the IPv6 network layer security protection module; The step of retrieving whether attack data exists in the response message through the security protection module further includes: retrieving whether attack data exists in the network layer message of the IPv6 response message through the IPv6 network layer security protection module.

6. The network situational awareness and security control system based on IPv4-IPv6 interconnection as described in claim 5, characterized in that, If no attack data is found, the step of sending the response message to the IPv6 client includes: The transport layer security protection module, the application layer security protection module, and the IPv6 network layer security protection module each send the detection results of whether attack data exists to the response message sending module; If the detection results of the transport layer security protection module, the application layer security protection module, and the IPv6 network layer security protection module all indicate that there is no attack data, the response message is sent to the IPv6 client through the response message sending module.

7. The network situational awareness and security control system based on IPv4-IPv6 interconnection as described in claim 1, characterized in that, When a message arrives at the network layer security protection module or the transport layer security protection module, the network layer security protection module or the transport layer security protection module parses the protocol, source address, source port, destination address and destination port fields of the message, and performs pattern matching based on the feature library on the payload data.

8. The network situational awareness and security control system based on IPv4-IPv6 interconnection as described in claim 1, characterized in that, When a message arrives at the application layer security protection module, the application layer security protection module is used to perform protocol specification anomaly detection, attack detection and protection, data leakage protection, and security auditing on the message.

9. The network situational awareness and control system based on IPv4-IPv6 interconnection as described in any one of claims 1-8, characterized in that, The method is applicable to scenarios where IPv4 clients access IPv6 websites, and IPv6 websites are backward compatible with the IPv4 protocol.

Images