Dynamic multi-port knocking network service access method and system

Abstract

The invention provides a dynamic multi-port knock network service access method and system, and the method comprises the steps: uploading a knock data package according to a preset knock rule when a user accesses a knock network port; performing first verification on the knock data packet, and if the first verification is passed, calculating a knock authentication port according to a preset authentication port algorithm; the user calculates a knock authentication port according to a preset authentication port algorithm and tries to access the knock authentication port, and if the access is successful, a knock authentication data packet is sent to the port according to a preset knock authentication rule; performing second verification and information authentication on the knocking authentication data packet, and if the second verification and the information authentication are passed, calculating a network service port according to a preset network service mapping port algorithm; and the user calculates the port number and tries to access the network service port of the system, and if the access is successful, the user accesses the network service according to the port number. According to the invention, the security of the service can be improved, and targeted network traffic attacks can be avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of network application, and in particular to a method and system for accessing network services using dynamic multi-port knocking. Background Art

[0002] Network services usually listen for requests on fixed ports. While providing network access to users, it also makes it easy for attackers to discover and attack these services. Attackers can scan the ports of the target network to detect whether there are open services, and then attempt to attack and maliciously damage the services.

[0003] Port knocking is a network security technology used to hide and protect network services and implement access control for network services. The network port that provides the service is closed by default and will only be opened after a specific knocking sequence is triggered. This can limit access to network services to authorized users and improve the security of the service. Since port knocking hides the existence of the service, malicious traffic and attack attempts will be greatly reduced. Attackers cannot directly discover and attack services, thereby reducing the risk of network attacks. However, attackers can monitor the client's external network traffic and infer the correct knocking sequence to obtain access rights. Summary of the invention

[0004] The purpose of the present invention is to provide a dynamic multi-port knocking network service access method and system, aiming to solve the problem of low network security in traditional technology because attackers can monitor the external network traffic of the client, infer the correct knocking sequence and obtain access rights.

[0005] In a first aspect, the present invention provides a method for accessing a network service using dynamic multi-port knocking, the method comprising:

[0006] When user USER i Access Knock Network Port P q , according to the preset knocking rule R within the first preset time q Upload knock packet D q_i , the knock packet D q_i Including the current time T q 、User IP address user_i , Verify string TOKEN q_i ;

[0007] The knock packet D q_i Perform the first check. If the first check passes, then according to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , enable the knock authentication service, and set the user's IP address to allowuser_i Access Knock Authentication Port P r _ i ;

[0008] UserUSER i According to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , and try to access the knock authentication port P r_i If the access is successful, the knock authentication rule R r To port P r_i Send knock authentication packet D r_i , the knock authentication data packet D r_i Include username USERNAME i 、Current time T r 、User IP address user_i , Verify string TOKEN r_i ;

[0009] The knock authentication data packet D r_i Perform a second check and information authentication. If the second check and information authentication pass, the preset network service mapping port algorithm A is used. y Calculate the network service port P y_i , open the service port P y_i And mapped to the service port P of the network service SERVER s , set the IP address allowed by the user user_i Access network service port P y_i ;

[0010] UserUSER i According to the preset network service mapping port algorithm A y Calculate the port number P y_i , and try to access the system's network service port P y_i If the access is successful, then according to the port number P y_i Access the network service SERVER.

[0011] In summary, according to the above-mentioned dynamic multi-port knocking network service access method, by combining port knocking technology, dynamic multi-port setting and knocking identity authentication, targeted network traffic attacks can be avoided. In the initial state, the network service port of the system is opened for listening but not open to the outside world. The system can initially listen to a knocking listening port for knocking. When the user accesses the knocking port according to the agreed rules, the system opens the knocking authentication port for the user's IP address, where the knocking authentication port is dynamically set by the agreed algorithm. The user accesses the knocking authentication port for identity authentication. When the system passes the user authentication, the network service mapping port is opened to the user's IP address, and the network service is mapped to the external service port, where the network service mapping port is dynamically set during the system's user authentication process. During the entire knocking process, the system that provides the service does not respond to any data packets, where the knocking authentication port and the network service mapping port are only open to the user's IP, which enhances security. In addition, combined with the dynamic setting of the knocking authentication port and the network service mapping port, replay attacks are avoided, further improving the security of the service.

[0012] Furthermore, X user information lists are set, wherein the user information lists include user name USERNAME i and the username USERNAME i Corresponding key KEY i , wherein each of the user names USERNAME i are all unique, X≥i≥1.

[0013] Furthermore, the verification string TOKEN q_i The current time T q and the user's IP address user_i Hash obtained;

[0014] The verification string TOKEN r_i By KEY i 、Current time T r 、User IP address user_i Hash obtained.

[0015] Furthermore, the preset authentication port algorithm A r To: Set port 20000>P r ≥10000, port P r_i =10000+(TimeToInt(T q )+IPToInt(IP user_i ))% 10000, where TimeToInt(T q ) represents the time T q Convert to integer, IPToInt(IP user_i) indicates that the IP address IP user_i Convert to an integer, %10000 means the remainder.

[0016] Furthermore, the preset network service mapping port algorithm A y To: Set the mapping port 30000>P y ≥20000, port P y_i =20000+(TimeToInt(T r )+IPToInt(IP user_i ))% 10000, where TimeToInt(T r ) represents the time T r Convert to integer, IPToInt(IP user_i ) indicates that the IP address IP user_i Convert to an integer.

[0017] Further, the port number P y_i The steps to access the network service SERVER also include:

[0018] The network service mapping port P is detected every second preset time. y_i Is there an access connection? If there is no access connection, close port P. y_i .

[0019] Further, the knocking packet D q_i The steps of performing the first check include:

[0020] Verify the string TOKEN q_i Verify to determine whether the hash value is correct;

[0021] If the hash value is correct, the test passes; if the hash value is incorrect, the test fails and the access is terminated directly.

[0022] The knock authentication data packet D r_i The steps of performing the second verification and information authentication include:

[0023] Verify the string TOKEN r_i Verify to determine whether the hash value is correct;

[0024] If the hash value is correct, the test passes; if the hash value is incorrect, the test fails and the access is terminated directly.

[0025] In a second aspect, the present invention provides a dynamic multi-port knocking network service access system, the system comprising:

[0026] Access request module, used to be a user USERi Access Knock Network Port P q , according to the preset knocking rule R within the first preset time q Upload knock packet D q_i , the knock packet D q_i Including the current time T q 、User IP address user_i , Verify string TOKEN q_i ;

[0027] The first verification module is used to verify the knock data packet D q_i Perform the first check. If the first check passes, then according to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , enable the knock authentication service, and set the user's IP address to allow user_i Access Knock Authentication Port P r _ i ;

[0028] Authentication module for user USER i According to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , and try to access the knock authentication port P r_i If the access is successful, the knock authentication rule R r To port P r_i Send knock authentication packet D r_i , the knock authentication data packet D r_i Include username USERNAME i 、Current time T r 、User IP address user_i , Verify string TOKEN r_i ;

[0029] The second verification module is used to verify the knock authentication data packet D r_i Perform a second check and information authentication. If the second check and information authentication pass, the preset network service mapping port algorithm A is used. y Calculate the network service port P y_i , open the service port P y_i And mapped to the service port P of the network service SERVER s , set the IP address allowed by the user user_i Access network service port P y_i ;

[0030] Access connection module for user USER i According to the preset network service mapping port algorithm A yCalculate the port number P y_i , and try to access the system's network service port P y_i If the access is successful, then according to the port number P y_i Access the network service SERVER.

[0031] In a third aspect, the present invention provides a storage medium storing one or more programs, which, when executed by a processor, implement the above-mentioned dynamic multi-port knocking network service access method.

[0032] In a fourth aspect, the present invention provides an electronic device, the electronic device comprising a memory and a processor, wherein:

[0033] The memory is used to store computer programs;

[0034] When the processor is used to execute the computer program stored in the memory, the above-mentioned dynamic multi-port knocking network service access method is implemented.

[0035] Compared with the prior art, the present invention also has the following advantages:

[0036] (1) The present invention can open the service port to the corresponding user and IP address only after the user accesses multiple ports of the system and passes data verification and authentication when the network service port is closed by default. In this way, only authorized users and IP addresses can access the network service, thereby improving the security of the service. At the same time, during the entire knocking and knocking authentication process, the system does not respond to any data packets. Combined with the dynamic setting of the knocking authentication port and the network service port, replay attacks are avoided, further improving the security of the service. This method is flexible in setting, widely applicable, does not require modification of the original network service, and has strong operability.

[0037] (2) The present invention does not require modification of the original network service program, but only requires additional knocking rules. It has a wide range of applications and can adapt to various different needs by adjusting the network service mapping port.

[0038] (3) The network service port is not open to the public by default. Only the knocking port is open. Users need to successfully access multiple ports of the system according to the rules before the network service mapping port is opened to authorized users and IP addresses, which effectively improves the security of network services. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A flowchart of a method for accessing a network service using dynamic multi-port knocking proposed by an embodiment of the present invention;

[0040] Figure 2The figure is a schematic diagram of the structure of a dynamic multi-port knocking network service access system proposed in one embodiment of the present invention.

[0041] The following specific implementation manner will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0043] like Figure 1 As shown, an embodiment of the present invention provides a dynamic multi-port knocking network service access method, the method comprising steps S101 to S105, wherein:

[0044] Step S101: When user USER i Access Knock Network Port P q , according to the preset knocking rule R within the first preset time q Upload knock packet D q_i , the knock packet D q_i Including the current time T q 、User IP address user_i , Verify string TOKEN q_i ;

[0045] In this embodiment, a remote control service of dynamic multi-port knocking is taken as an example. The remote control service may be a remote desktop service in a Windows system or an SSH service in a Linux system. Here, the remote desktop service SSH service is used. desk For example, the remote desktop service monitors P s The default remote desktop service port is P. s It is 3389.

[0046] It should be noted that the network service system involved in this embodiment is composed of a knock listening port P for knocking. q , Knock authentication port P r , Network service mapping port P y, Network service port P S , and knock rule R q , knock authentication rule R r , Authentication port algorithm A r 、Network service mapping port algorithm A y , the original network service SERVER and user USER and other main elements.

[0047] In addition, before the user accesses, the system will also set up X user information lists, which include the user name USERNAME i and the username USERNAME i Corresponding key KEY i , wherein each of the user names USERNAME i are all unique, X≥i≥1. In addition, the system also initially sets the listening network port P used for knocking on the door q , Knock Rules q、 Knock certification rule R r , Initial setting network service SERVER service port P s Only local machine is allowed to access. q is the knock listening port number agreed with the user, R q The knocking rules agreed with the user: including the knocking data field structure (string TOKEN q_i ) and the knock authentication port algorithm (A r ), R r The knock authentication rules agreed with the user include the knock authentication data field structure (verification string TOKEN r_i ) and the network service port algorithm (A y ).

[0048] Step S102: knock on the door data packet D q_i Perform the first check. If the first check passes, then according to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , enable the knock authentication service, and set the user's IP address to allow user_i Access Knock Authentication Port P r _ i ;

[0049] It should be noted that the knock packet D q_i The verification string TOKEN in q_i The current time T q and the user's IP address user_iThe hash value is obtained. In the first verification process, the hash value needs to be verified to determine whether it is correct. If the hash value is correct, the verification passes; if the hash value is incorrect, the verification fails, and the access is terminated directly. For example, the hash algorithm can be MD5, SHA265, etc.

[0050] In addition, in some embodiments, corresponding to Algorithm A r , the algorithm is used to calculate and generate the port number P for subsequent knock authentication r_i The algorithm here can be more flexible, mainly to achieve from the data packet D q_i A dynamic port number can be generated in the system. Specifically, the authentication port algorithm A is preset. r To: Set port 20000>P r ≥10000, port P r_i =10000+(TimeToInt(T q )+IPToInt(IP user_i ))% 10000, where TimeToInt(T q ) represents the time T q Convert to integer, IPToInt(IP user_i ) indicates that the IP address IP user_i Convert to an integer.

[0051] Step S103: User USER i According to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , and try to access the knock authentication port P r_i If the access is successful, the knock authentication rule R r To port P r_i Send knock authentication packet D r_i , the knock authentication data packet D r_i Include username USERNAME i 、Current time T r 、User IP address user_i , Verify string TOKEN r_i ;

[0052] It should be noted that during the knocking process, in order to improve security, the server will not respond to any data or information. Users can only send data to the system. r_i It is dynamically generated, and both parties need to calculate it separately according to the agreed algorithm.

[0053] In addition, the verification string TOKEN r_i By KEY i 、Current time Tr 、User IP address user_i Hash obtained.

[0054] It should also be noted that if you access the knock authentication port P r_i If unsuccessful, jump to step S101.

[0055] Step S104: Authentication packet D for knocking r_i Perform a second check and information authentication. If the second check and information authentication pass, the preset network service mapping port algorithm A is used. y Calculate the network service port P y_i , open the service port P y_i And mapped to the service port P of the network service SERVER s , set the IP address allowed by the user user_i Access network service port P y_i ;

[0056] Similarly, the secondary check in this step is to knock on the authentication data packet D r_i The verification string TOKEN in r_i A check is performed to determine whether the hash value is correct; if the hash value is correct, the check passes; if the hash value is incorrect, the check fails and the access is terminated directly.

[0057] In addition, for the preset network service mapping port algorithm A y , the purpose of which is to calculate and generate the network service port P for subsequent network access y_i The algorithm here can be more flexible, mainly to achieve from the data packet D r_i Specifically, the preset network service mapping port algorithm A y To: Set the mapping port 30000>P y ≥20000, port P y_i =20000+(TimeToInt(T r )+IPToInt(IP user_i ))% 10000, where TimeToInt(T r ) represents the time T r Convert to integer, IPToInt(IP user_i ) indicates that the IP address IP user_i Convert to an integer.

[0058] In summary, when the network service port is closed by default, the service port will be opened to the corresponding user and IP address only after the user accesses multiple ports of the system and passes the data verification and authentication. In this way, only authorized users and IP addresses can access the network service, improving the security of the service. At the same time, during the entire knocking and knocking authentication process, the system does not respond to any data packets. Combined with the dynamic setting of the knocking authentication port and the network service port, replay attacks are avoided, further improving the security of the service. This method is flexible to set up, widely applicable, does not require the original network service to be modified, and has strong operability.

[0059] Step S105: User USER i According to the preset network service mapping port algorithm A y Calculate the port number P y_i , and try to access the system's network service port P y_i If the access is successful, then according to the port number P y_i Access the network service SERVER.

[0060] In this step, if you cannot access the system's network service port P y_i , then jump to step S101.

[0061] Specifically, if port P y_i Accessible by user USER i From IP address user_i By accessing the system's P y_i The port can access the network service SERVER normally.

[0062] In some embodiments, after the user accesses the network service SERVER, the user will also detect the network service mapping port P at a second preset time interval. y_i Is there an access connection? If there is no access connection, close port P. y_i .

[0063] It should be noted that the first preset time is set to respond to the user's access in a timely manner, and the second preset time is set to periodically detect the network service mapping port P y_i Whether there is an access connection. Since the first preset time and the second preset time are related to a specific practical environment, they are not limited in detail in this embodiment.

[0064] In summary, according to the above dynamic multi-port knocking network service access method, user USER i Access Knock Port P q And according to the knock rule R q Send a knock packet D q . System knocks on the door packet D qPerform rule verification. After the verification passes, the system will use the authentication port algorithm A r Calculate the knock authentication port P r And turn on the knock authentication service, set the user's IP address to allow user_i Access Knock Authentication Port P r . USER i According to the agreed authentication port algorithm A r Calculate P r Then access the knock authentication port and follow the knock authentication rule R r Send knock authentication packet D r The system verifies and authenticates the data. After verification and authentication, the system uses the network service port algorithm A y Calculate the network service mapping port P y And open port mapping to network service port P s Port 3389, set the user's IP address to allow user_i Access network service port P y . USER i According to the agreed network service mapping port algorithm A y Calculate the port number P y Then you can get the IP address from user_i By accessing port P y Normal access to Remote Desktop Services desk The whole process does not require modification of the original remote desktop service. During the knocking process, no information is output from each port. Users only need to complete the knocking action according to the agreed rules. After accessing multiple dynamic ports, they can safely access the remote desktop service. desk In addition, the combination of knock authentication port, dynamic setting of network service mapping port and IP limitation makes it difficult for attackers to use data captured during communication to carry out further attacks.

[0065] like Figure 2 As shown, an embodiment of the present invention further provides a dynamic multi-port knocking network service access system, the system comprising:

[0066] Access request module 10, used when user USER i Access Knock Network Port P q , according to the preset knocking rule R within the first preset time q Upload knock packet D q_i , the knock packet D q_i Including the current time T q 、User IP address user_i , Verify string TOKEN q_i ;

[0067] The first verification module 20 is used to verify the knock data packet D q_i Perform the first check. If the first check passes, then according to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , enable the knock authentication service, and set the user's IP address to allow user_i Access Knock Authentication Port P r _ i ;

[0068] Authentication module 30, for user USER i According to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , and try to access the knock authentication port P r_i If the access is successful, the knock authentication rule R r To port P r_i Send knock authentication packet D r_i , the knock authentication data packet D r_i Include username USERNAME i 、Current time T r 、User IP address user_i , Verify string TOKEN r_i ;

[0069] The second verification module 40 is used to verify the knock authentication data packet D r_i Perform a second check and information authentication. If the second check and information authentication pass, the preset network service mapping port algorithm A is used. y Calculate the network service port P y_i , open the service port P y_i And mapped to the service port P of the network service SERVER s , set the IP address allowed by the user user_i Access network service port P y_i ;

[0070] Access connection module 50 for user USER i According to the preset network service mapping port algorithm A y Calculate the port number P y_i , and try to access the system's network service port P y_i If the access is successful, then according to the port number P y_i Access the network service SERVER.

[0071] Another aspect of the present invention further provides a storage medium on which one or more programs are stored, and when the programs are executed by a processor, the above-mentioned dynamic multi-port knocking network service access method is implemented.

[0072] Another aspect of the present invention provides an electronic device, including a memory and a processor, wherein the memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the above-mentioned dynamic multi-port knocking network service access method.

[0073] Those skilled in the art will appreciate that the logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0074] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0075] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0076] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A dynamic multi-port knocking network service access method, characterized in that: The method comprises: When user USER i Access Knock Network Port P q , according to the preset knocking rule R within the first preset time q Upload knock packet D q_i , the knock packet D q_i Including the current time T q 、User IP address user_i , Verify string TOKEN q_i ; The knock packet D q_i Perform the first check. If the first check passes, then according to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , enable the knock authentication service, and set the user's IP address to allow user_i Access Knock Authentication Port P r _ i ; UserUSER i According to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , and try to access the knock authentication port P r_i If the access is successful, the knock authentication rule R r To port P r_i Send knock authentication packet D r_i , the knock authentication data packet D r_i Include username USERNAME i 、Current time T r 、User IP address user_i , Verify string TOKEN r_i ; The knock authentication data packet D r_i Perform a second check and information authentication. If the second check and information authentication pass, the preset network service mapping port algorithm A is used. y Calculate the network service port P y_i , open the service port P y_i And mapped to the service port P of the network service SERVER s , set the IP address allowed by the user user_i Access network service port P y_i ; UserUSER i According to the preset network service mapping port algorithm A y Calculate the port number P y_i , and try to access the system's network service port P y_i If the access is successful, then according to the port number P y_i Access the network service SERVER.

2. The network service access method of dynamic multi-port knocking according to claim 1 is characterized in that: The method further comprises: Set X user information lists, the user information lists include user name USERNAME i and the username USERNAME i Corresponding key KEY i , wherein each of the user names USERNAME i are all unique, X≥i≥1.

3. The method for accessing network services by dynamic multi-port knocking according to claim 2, characterized in that: The verification string TOKEN q_i The current time T q and the user's IP address user_i Hash obtained; The verification string TOKEN r_i By KEY i 、Current time T r 、User IP address user_i Hash obtained.

4. The method for accessing network services by dynamic multi-port knocking according to claim 1, characterized in that: The preset authentication port algorithm A r To: Set port 20000>P r ≥10000, port P r_i =10000+(TimeToInt(T q )+IPToInt(IP user_i ))% 10000, where TimeToInt(T q ) represents the time T q Convert to integer, IPToInt(IP user_i ) indicates that the IP address IP user_i Convert to an integer, %10000 means the remainder.

5. The method for accessing network services by dynamic multi-port knocking according to claim 1, characterized in that: The preset network service mapping port algorithm A y To: Set the mapping port 30000>P y ≥20000, port P y_i =20000+(TimeToInt(T r )+IPToInt(IP user_i ))% 10000, where TimeToInt(T r ) represents the time T r Convert to integer, IPToInt(IP user_i ) indicates that the IP address IP user_i Convert to an integer.

6. The method for accessing network services by dynamic multi-port knocking according to claim 1, characterized in that: The port number P y_i The steps to access the network service SERVER also include: The network service mapping port P is detected every second preset time. y_i Is there an access connection? If there is no access connection, close port P. y_i .

7. The method for accessing network services by dynamic multi-port knocking according to claim 3, characterized in that: The knock packet D q_i The steps of performing the first check include: Verify the string TOKEN q_i Verify to determine whether the hash value is correct; If the hash value is correct, the test passes; if the hash value is incorrect, the test fails and the access is terminated directly. The knock authentication data packet D r_i The steps of performing the second verification and information authentication include: Verify the string TOKEN r_i Verify to determine whether the hash value is correct; If the hash value is correct, the test passes; if the hash value is incorrect, the test fails and the access is terminated directly.

8. A dynamic multi-port knocking network service access system, characterized in that: The system comprises: Access request module, used to be a user USER i Access Knock Network Port P q , according to the preset knocking rule R within the first preset time q Upload knock packet D q_i , the knock packet D q_i Including the current time T q 、User IP address user_i , Verify string TOKEN q_i ; The first verification module is used to verify the knock data packet D q_i Perform the first check. If the first check passes, then according to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , enable the knock authentication service, and set the user's IP address to allow user_i Access Knock Authentication Port P r _ i ; Authentication module for user USER i According to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , and try to access the knock authentication port P r_i If the access is successful, the knock authentication rule R r To port P r_i Send knock authentication packet D r_i , the knock authentication data packet D r_i Include username USERNAME i 、Current time T r 、User IP address user_i , Verify string TOKEN r_i ; The second verification module is used to verify the knock authentication data packet D r_i Perform a second check and information authentication. If the second check and information authentication pass, the preset network service mapping port algorithm A is used. y Calculate the network service port P y_i , open the service port P y_i And mapped to the service port P of the network service SERVER s , set the IP address allowed by the user user_i Access network service port P y_i ; Access connection module for user USER i According to the preset network service mapping port algorithm A y Calculate the port number P y_i , and try to access the system's network service port P y_i If the access is successful, then according to the port number P y_i Access the network service SERVER.

9. A storage medium, characterized in that: The storage medium stores one or more programs, which, when executed by a processor, implement the dynamic multi-port knocking network service access method as described in any one of claims 1 to 7.

10. An electronic device, comprising a memory and a processor, wherein: The memory is used to store computer programs; When the processor is used to execute the computer program stored in the memory, it implements the dynamic multi-port knocking network service access method as described in any one of claims 1-7.

Images