Intranet penetration method and device of Internet of Things equipment, equipment and storage medium

Abstract

The invention provides an intranet penetration method and device for Internet of Things equipment, equipment and a storage medium, and the method comprises the steps: firstly obtaining an authentication request of a user, generating an Frpc configuration file based on Internet of Things equipment information and network configuration after the authentication request passes, transmitting the Frpc configuration file to the Internet of Things equipment, and then transmitting the Frpc configuration file to the Internet of Things equipment; and receiving an intranet penetration request initiated by the Internet of Things equipment according to the Frpc configuration file, verifying a dynamic key of the Internet of Things equipment according to the intranet penetration request, and establishing connection between the Internet of Things equipment and an extranet after the verification is passed, thereby solving the problem that when the Internet of Things equipment located behind the firewall or the NAT performs intranet penetration, the intranet penetration request cannot be transmitted to the Internet of Things equipment. Security risks may occur.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things, and in particular to an intranet penetration method, device, equipment and storage medium for Internet of Things devices. Background Art

[0002] Edge computing has become a key part of the Internet of Things system and is widely used in smart cities, smart homes, industrial automation and other fields, taking on the tasks of data collection, processing and transmission. However, edge devices are usually located behind firewalls or network address translation (NAT), making external management and access to these devices a huge challenge, especially when it comes to remote management of devices, security and flexibility issues are more prominent.

[0003] Although existing intranet penetration technologies, such as reverse proxy and dynamic DNS (DDNS), have solved the access problem of intranet devices to a certain extent, they still face the problems of insufficient security and dynamic defense, especially the risk of replay attacks brought by fixed key authentication methods.

[0004] In view of this, this application is filed. Summary of the invention

[0005] The present invention discloses an intranet penetration method, device, equipment and storage medium for an Internet of Things device, aiming to solve the security risks that may occur when an Internet of Things device located behind a firewall or NAT performs intranet penetration.

[0006] The first embodiment of the present invention provides an intranet penetration method for an Internet of Things device, comprising:

[0007] Obtain the user's authentication request, and after the authentication request is passed, generate a Frpc configuration file based on the IoT device information and network configuration, and send the Frpc configuration file to the IoT device, wherein the Frpc configuration file includes a dynamic key, a defined port, a penetration server IP and its connection parameters;

[0008] Receive an intranet penetration request initiated by the IoT device according to the Frpc configuration file, verify the dynamic key of the IoT device according to the intranet penetration request, and establish a connection between the IoT device and the external network after the verification is passed.

[0009] Preferably, the Frpc configuration file is configured to be updated after each authentication request is passed, and re-sent to the Internet of Things device to update the Frpc configuration, wherein the dynamic key of the Frpc configuration file is unique for each connection.

[0010] Preferably, after establishing the connection between the IoT device and the external network after the verification is passed, the method further includes:

[0011] The user's authentication request is redirected to the exclusive access domain name of the IoT device, and the exclusive access domain name is parsed and directed to the load balancer, wherein the load balancer can distribute the traffic to the Ngi nx reverse proxy server based on preset distribution rules, and then access the Frp port of the IoT device.

[0012] Preferably, the allocation rule includes one or more of round-robin, weighted and minimum number of connections.

[0013] Preferably, the exclusive access domain name performs encrypted communication via SSL / TLS protocol.

[0014] Preferably, it also includes:

[0015] When abnormal behavior of the IoT device is detected, the IoT device connection is disconnected and the device is kicked out of the network.

[0016] A second embodiment of the present invention provides an intranet penetration device for an Internet of Things device, comprising:

[0017] A Frpc configuration file generation unit is used to obtain the user's authentication request, and after the authentication request is passed, generate a Frpc configuration file based on the IoT device information and network configuration, and send the Frpc configuration file to the IoT device, wherein the Frpc configuration file includes a dynamic key, a defined port, a penetration server IP and its connection parameters;

[0018] The verification unit is used to receive the intranet penetration request initiated by the Internet of Things device according to the Frpc configuration file, verify the dynamic key of the Internet of Things device according to the intranet penetration request, and establish a connection between the Internet of Things device and the external network after the verification is passed.

[0019] A third embodiment of the present invention provides an intranet penetration device for an Internet of Things device, including a memory and a processor, wherein a computer program is stored in the memory, and the computer program can be executed by the processor to implement an intranet penetration method for an Internet of Things device as described in any one of the above.

[0020] The fourth embodiment of the present invention provides a computer-readable storage medium, characterized in that a computer program is stored, and the computer program can be executed by a processor of the device where the computer-readable storage medium is located to implement an intranet penetration method of an Internet of Things device as described in any one of the above items.

[0021] Based on the intranet penetration method, device, equipment and storage medium of an Internet of Things device provided by the present invention, a user's authentication request is first obtained, and a Frpc configuration file is generated based on the Internet of Things device information and network configuration after the authentication request is passed, and the Frpc configuration file is sent to the Internet of Things device. Then, an intranet penetration request initiated by the Internet of Things device according to the Frpc configuration file is received, and the dynamic key of the Internet of Things device is verified according to the intranet penetration request. After the verification is passed, a connection between the Internet of Things device and the external network is established, thereby solving the security risks that may occur when the Internet of Things device located behind a firewall or NAT performs intranet penetration. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a flowchart of an intranet penetration method of an Internet of Things device provided by the first embodiment of the present invention;

[0023] Figure 2 It is a schematic diagram of the overall process of intranet penetration provided by the present invention;

[0024] Figure 3 It is a schematic diagram of redirection and traffic distribution provided by the present invention;

[0025] Figure 4 It is a module schematic diagram of an intranet penetration device for an Internet of Things device provided by the second embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] In order to better understand the technical solution of the present invention, the embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0028] It should be clear that the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0030] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0031] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0032] The "first\second" mentioned in the embodiments is only to distinguish similar objects, and does not represent a specific order for the objects. It is understandable that the "first\second" can be interchanged with the specific order or sequence where permitted. It should be understood that the objects distinguished by "first\second" can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than those illustrated or described herein.

[0033] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0034] The present invention discloses an intranet penetration method, device, equipment and storage medium for an Internet of Things device, aiming to solve the security risks that may occur when an Internet of Things device located behind a firewall or NAT performs intranet penetration.

[0035] See also Figure 1 and 2 The first embodiment of the present invention provides an intranet penetration method of an Internet of Things device, which can be executed by an intranet penetration device of the Internet of Things device (hereinafter referred to as the penetration device), and in particular, is executed by one or more processors in the penetration device to at least implement the following steps:

[0036] S101, obtaining the user's authentication request, and generating a Frpc configuration file based on the IoT device information and network configuration after the authentication request is passed, and sending the Frpc configuration file to the IoT device, wherein the Frpc configuration file includes a dynamic key, a defined port, a penetration server IP and its connection parameters;

[0037] In this embodiment, the penetration device can be a terminal with data processing capabilities such as a server, workstation, desktop computer, etc., which can communicate with IoT devices and the external network. The penetration device can be installed with a corresponding operating system and application software, and the functions required by this embodiment can be realized through the combination of the operating system and application software.

[0038] Specifically, in this embodiment, the penetration device needs to receive the user's authentication request, which is usually initiated by the user through a management platform or application, including the user's identity information and relevant device access rights (the user is accessing a shared address at this time). The penetration device verifies the authentication request to ensure the legitimacy of the user and the validity of the request. Once the authentication is passed, jump to the exclusive access domain name, and record the domain name and the IP, port, token and device-related information of the penetration server into the database. By querying the database, the latest device information and related network configuration are obtained, and a Frpc configuration file is generated and sent to the IoT device, and reconnected based on the Frpc configuration file, where the configuration file contains the following: 1. Dynamically updated token to ensure communication security; 2. Assign defined port numbers to avoid port conflicts; 3. The IP address and other connection parameters of the penetration server.

[0039] In the process of generating the Frpc configuration file, the dynamic key is generated in real time by the penetration device, and its uniqueness and timeliness are guaranteed for identity authentication in subsequent communication processes. The dynamic key effectively prevents the security risks of replay attacks or forged authentication, thereby significantly improving the security of device management. At the same time, the penetration device also allocates an independent port to the device, and adds the IP address of the penetration server and other necessary connection parameters to the configuration file, ensuring that the IoT device can accurately establish a connection and communicate securely with the external network.

[0040] S102, receiving an intranet penetration request initiated by the IoT device according to the Frpc configuration file, verifying the dynamic key of the IoT device according to the intranet penetration request, and establishing a connection between the IoT device and the external network after the verification is passed.

[0041] It should be noted that the generated Frpc configuration file will be securely sent to the target IoT device. After receiving the sent Frpc configuration file, the IoT device will automatically start its internal Frpc client based on the dynamic key, penetration server IP address, defined port and other connection parameters contained in the file, and initiate an intranet penetration request to the penetration device according to the parameters in the configuration file, ensuring that the IoT device can accurately use the latest configuration information to complete the initial steps of the penetration connection, avoiding connection failures caused by delayed or incorrect configuration of the device.

[0042] After receiving the penetration request from the IoT device, the dynamic key in the request will be verified immediately. The dynamic key uploaded by the device is matched with the corresponding key generated in real time by the penetration device to ensure the authenticity and validity of the device. This can effectively prevent attackers from posing security threats to the system through forged keys or replay attacks. Once the dynamic key verification is passed, the penetration device will immediately establish a communication connection with the IoT device, allowing external users to connect to the device through a dedicated domain name. The establishment of this connection not only ensures that the device can communicate smoothly with the external network, but also realizes the independence of device access through dedicated port and path configuration. It can prevent access conflicts between multiple devices.

[0043] In a possible implementation of the present invention, the Frpc configuration file is configured to be updated after each authentication request is passed, and is re-sent to the IoT device to update the Frpc configuration, wherein the dynamic key of the Frpc configuration file is unique for each connection.

[0044] It should be noted that every time a user initiates an authentication request and passes the verification, the penetration device will regenerate a new Frpc configuration file based on the current authentication information and the specific status of the IoT device. This configuration file not only includes the IP address, port number and other connection parameters of the penetration server, but also generates a new dynamic key. The generation of dynamic keys is based on specific algorithms and security policies to ensure that each generated key is unique and valid only in this session. Even if an attacker steals the previous configuration file, he cannot use it to establish a valid connection because the dynamic key will become invalid after each connection.

[0045] See also Figure 3 In a possible implementation of the present invention, after establishing the connection between the IoT device and the external network after the verification is passed, the method further includes:

[0046] The user's authentication request is redirected to the exclusive access domain name of the IoT device, and the exclusive access domain name is parsed and directed to the load balancer, wherein the load balancer can distribute the traffic to the Ngi nx reverse proxy server based on preset distribution rules, and then access the Frp port of the IoT device.

[0047] It should be noted that when the IoT device completes dynamic key verification and successfully establishes a communication connection with the external network, the system will redirect the user's authentication request to the device's exclusive access domain name. Each device is assigned a unique domain name in the system, which is not only unique but also associated with the device's specific identification information, such as the device's ID or MAC address. This allows the device to interact with the user through a clear access path, while avoiding address conflicts or access confusion that may occur between different devices, greatly improving the independence of device management.

[0048] After the user request is redirected to the exclusive domain name, the request operation traffic for the IoT device will be intelligently distributed through the load balancer. The load balancer presets a variety of distribution rules during design, such as polling, weighted or minimum number of connections, so as to flexibly adjust the traffic distribution strategy according to the actual load of the current system. This enables the load balancer to effectively balance the load of different nodes in the system and avoid performance bottlenecks caused by excessive traffic on a single device or server. The traffic distributed by the load balancer will be forwarded to the Ngi nx reverse proxy server. As the traffic proxy layer of the system, the Ngi nx server accurately maps the received requests to the Frp port of the device through the Hosts file or other configurations, thereby realizing remote access to the device.

[0049] In a possible implementation of the present invention, the exclusive access domain name performs encrypted communication via the SSL / TLS protocol.

[0050] In the specific implementation of the present invention, in order to ensure that the remote management process of the IoT device is highly secure, the penetration device configures the exclusive access domain name to perform encrypted communication through the SSL / TLS protocol. When a user accesses the exclusive domain name of the IoT device through a browser or a management platform, the SSL / TLS protocol immediately activates the encryption mechanism to ensure that all data between the user and the device is transmitted in ciphertext. This can effectively prevent man-in-the-middle attacks, data theft or information tampering, and significantly improve the security of the system.

[0051] In a possible implementation of the present invention, the present invention further includes:

[0052] When abnormal behavior of the IoT device is detected, the IoT device connection is disconnected and the device is kicked out of the network.

[0053] It should be noted that in order to ensure the overall security and stability of the system, when an IoT device exhibits abnormal behavior during operation, the penetration device will monitor in real time and take prompt measures to disconnect the device from the network and kick it out of the system. The detection of abnormal behavior includes but is not limited to frequent device online and offline, unauthorized access attempts, transmission of a large number of abnormal data packets, and other operations that do not meet expectations. When the system recognizes these abnormal behaviors, it will immediately trigger a response mechanism to prevent the further spread of potential threats by interrupting the device connection. The key to this response mechanism is to quickly and accurately detect abnormal behavior and synchronize the processing results to other modules of the system. For example, when the device's Frpc client initiates an abnormal connection request, it will immediately take measures to disconnect the device from the network, including stopping the device's Frp connection and terminating the traffic forwarding of the Ngi nx proxy to ensure that the device cannot continue to be remotely accessed or operated. And remove it from the current session through the kick mechanism.

[0054] See also Figure 4 The second embodiment of the present invention provides an intranet penetration device for an Internet of Things device, comprising:

[0055] The Frpc configuration file generation unit 201 is used to obtain the user's authentication request, and after the authentication request is passed, generate a Frpc configuration file based on the IoT device information and network configuration, and send the Frpc configuration file to the IoT device, wherein the Frpc configuration file includes a dynamic key, a defined port, a penetration server IP and its connection parameters;

[0056] The verification unit 202 is used to receive the intranet penetration request initiated by the IoT device according to the Frpc configuration file, verify the dynamic key of the IoT device according to the intranet penetration request, and establish a connection between the IoT device and the external network after the verification is passed.

[0057] A third embodiment of the present invention provides an intranet penetration device for an Internet of Things device, including a memory and a processor, wherein a computer program is stored in the memory, and the computer program can be executed by the processor to implement an intranet penetration method for an Internet of Things device as described in any one of the above.

[0058] The fourth embodiment of the present invention provides a computer-readable storage medium, characterized in that a computer program is stored, and the computer program can be executed by a processor of the device where the computer-readable storage medium is located to implement an intranet penetration method of an Internet of Things device as described in any one of the above items.

[0059] Based on the intranet penetration method, device, equipment and storage medium of an Internet of Things device provided by the present invention, a user's authentication request is first obtained, and a Frpc configuration file is generated based on the Internet of Things device information and network configuration after the authentication request is passed, and the Frpc configuration file is sent to the Internet of Things device. Then, an intranet penetration request initiated by the Internet of Things device according to the Frpc configuration file is received, and the dynamic key of the Internet of Things device is verified according to the intranet penetration request. After the verification is passed, a connection between the Internet of Things device and the external network is established, thereby solving the security risks that may occur when the Internet of Things device located behind a firewall or NAT performs intranet penetration.

[0060] Exemplarily, the computer program described in the third and fourth embodiments of the present invention may be divided into one or more modules, and the one or more modules are stored in the memory and executed by the processor to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the intranet penetration device for implementing an Internet of Things device. For example, the device described in the second embodiment of the present invention.

[0061] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the intranet penetration method of an Internet of Things device, and uses various interfaces and lines to connect the various parts of the method for implementing the intranet penetration of an Internet of Things device.

[0062] The memory can be used to store the computer program and / or module, and the processor realizes various functions of an intranet penetration method of an Internet of Things device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, a text conversion function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, text message data, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Med ia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0063] Wherein, if the implemented module is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0064] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0065] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for penetrating an intranet of an Internet of Things device, characterized in that: include: Obtain the user's authentication request, and after the authentication request is passed, generate a Frpc configuration file based on the IoT device information and network configuration, and send the Frpc configuration file to the IoT device, wherein the Frpc configuration file includes a dynamic key, a defined port, a penetration server IP and its connection parameters; Receive an intranet penetration request initiated by the IoT device according to the Frpc configuration file, verify the dynamic key of the IoT device according to the intranet penetration request, and establish a connection between the IoT device and the external network after the verification is passed.

2. According to claim 1, the method for penetrating an intranet of an Internet of Things device is characterized in that: The Frpc configuration file is configured to be updated after each authentication request is passed, and is re-sent to the IoT device to update the Frpc configuration, wherein the dynamic key of the Frpc configuration file is unique for each connection.

3. According to claim 1, the method for penetrating an intranet of an Internet of Things device is characterized in that: After the verification is passed, the connection between the IoT device and the external network is established, and the following is also included: The user's authentication request is redirected to the exclusive access domain name of the IoT device, and the exclusive access domain name is parsed and directed to the load balancer, wherein the load balancer can distribute traffic to the Nginx reverse proxy server based on preset distribution rules, thereby accessing the Frp port of the IoT device.

4. According to claim 3, the method for penetrating an intranet of an Internet of Things device is characterized in that: The allocation rule includes one or more of round-robin, weighted, and minimum number of connections.

5. According to claim 3, the method for penetrating an intranet of an Internet of Things device is characterized in that: The exclusive access domain name is encrypted via the SSL / TLS protocol.

6. The method for penetrating an intranet of an Internet of Things device according to claim 3, characterized in that: Also includes: When abnormal behavior of the IoT device is detected, the IoT device connection is disconnected and the device is kicked out of the network.

7. An intranet penetration device for an Internet of Things device, characterized in that: include: A Frpc configuration file generation unit is used to obtain the user's authentication request, and after the authentication request is passed, generate a Frpc configuration file based on the IoT device information and network configuration, and send the Frpc configuration file to the IoT device, wherein the Frpc configuration file includes a dynamic key, a defined port, a penetration server IP and its connection parameters; The verification unit is used to receive the intranet penetration request initiated by the Internet of Things device according to the Frpc configuration file, verify the dynamic key of the Internet of Things device according to the intranet penetration request, and establish a connection between the Internet of Things device and the external network after the verification is passed.

8. An intranet penetration device for an Internet of Things device, characterized in that: It includes a memory and a processor, wherein the memory stores a computer program, and the computer program can be executed by the processor to implement an intranet penetration method for an Internet of Things device as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: A computer program is stored, and the computer program can be executed by a processor of the device where the computer-readable storage medium is located to implement an intranet penetration method for an Internet of Things device as described in any one of claims 1 to 6.

Images