Dynamic multi-port knock method and system for network service access

Abstract

The application provides a dynamic multi-port knocking network service access method and system, which comprises the following steps: when a user accesses a knocking network port, uploading a knocking data packet according to a preset knocking rule; performing a first check on the knocking data packet, and if the first check is passed, calculating a knocking authentication port according to a preset authentication port algorithm; the user calculates the knocking authentication port according to the preset authentication port algorithm, and attempts to access the knocking authentication port, and if the access is successful, sends a knocking authentication data packet to the port according to a preset knocking authentication rule; performing a second check and information authentication on the knocking authentication data packet, and if the second check and information authentication are passed, calculating a network service port according to a preset network service mapping port algorithm; the user calculates the port number, attempts to access the network service port of the system, and if the access is successful, accesses the network service according to the port number. The application can improve the security of the service and avoid targeted network traffic attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network application, and particularly relates to a dynamic multi-port knocking network service access method and system. BACKGROUND

[0002] Network services usually listen for requests on fixed ports, while providing network access for users, it also makes it easy for attackers to find and attack these services. Attackers can scan the ports of the target network to detect whether there are open services, and then attempt to attack and maliciously destroy the services.

[0003] Port knocking technology is a network security technology used to hide and protect network services, achieve access control of network services, and provide network ports of services in a closed state by default. Only after a specific knocking sequence is triggered, the service port will be opened. In this way, only authorized users can access the network service, improving the security of the service. Since port knocking technology hides the existence of services, malicious traffic and attack attempts will be greatly reduced. Attackers cannot directly discover and attack services, thereby reducing the risk of network attacks. However, attackers can monitor the network traffic of the client to the outside world, guess the correct knocking sequence and thus obtain access rights. SUMMARY

[0004] The purpose of the present application is to provide a dynamic multi-port knocking network service access method and system, which aims to solve the problem of low network security caused by the fact that attackers can obtain access rights by monitoring the network traffic of the client to the outside world and guessing the correct knocking sequence.

[0005] In a first aspect, the present application provides a dynamic multi-port knocking network service access method, which comprises:

[0006] When a user USER i accesses a knocking network port P q , within a first predetermined time, a predetermined knocking rule R q is followed to upload a knocking data packet D q_i , wherein the knocking data packet D q_i includes the current time T q , the user IP address IP user_i , and the verification string TOKEN q_i ;

[0007] The knocking data packet D q_i is subjected to a first verification, and if the first verification passes, a knocking authentication port P r is calculated according to a predetermined authentication port algorithm A r_i , the knocking authentication service is started, and the user IP address IP is set to be allowed.user_i Access the knock authentication port P r _ i ;

[0008] User i According to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , and try to access the knock authentication port P r_i If the access is successful, the knock authentication rule R r To port P r_i Send knock authentication packet D r_i , the knock authentication data packet D r_i Include username USERNAME i , current time T r 、User IP address IP user_i , verification string TOKEN r_i ;

[0009] The knock authentication data packet D r_i Perform the second checksum information authentication. If the second checksum information authentication passes, the preset network service mapping port algorithm A is used. y Calculate the network service port P y_i , open the service port P y_i And mapped to the service port P of the network service SERVER s , set the user's IP address to allow user_i Access network service port P y_i ;

[0010] User i According to the preset network service mapping port algorithm A y Calculate the port number P y_i , and try to access the system's network service port P y_i If the access is successful, then according to the port number P y_i Access the network service SERVER.

[0011] In summary, according to the dynamic multi-port knocking network service access method, the targeted network traffic attack can be avoided by combining the port knocking technology, dynamic multi-port setting and knocking identity authentication. In the initial state, the network service port of the system is opened for listening but not open to the outside for access. The system can initially listen to a knocking listening port for knocking. When the user accesses the knocking port according to the agreed rules, the system opens a knocking authentication port for the IP address of the user, wherein the knocking authentication port is dynamically set by the agreed algorithm. The user accesses the knocking authentication port for identity authentication. When the system authenticates the user, the network service mapping port is opened for the IP address of the user, and the network service is mapped to the external service port, wherein the network service mapping port is dynamically set in the process of authenticating the user by the system. In the whole knocking process, the system providing the service does not respond to any data packet. The knocking authentication port and the network service mapping port are only opened to the IP of the user, which enhances the security. In addition, the dynamic setting of the knocking authentication port and the network service mapping port avoids the replay attack, and further improves the security of the service.

[0012] Further, X user information lists are set, the user information list includes a username USERNAME i and a key KEY i corresponding to the username USERNAME i , wherein each username USERNAME i is unique, X≥i≥1.

[0013] Further, the check string TOKEN q_i is obtained by hashing the current time T q and the user IP address IP user_i ;

[0014] The check string TOKEN r_i is obtained by hashing KEY i , current time T r , and user IP address IP user_i .

[0015] Further, the preset authentication port algorithm A r is: set port 20000>P r ≥10000, port P r_i =10000+(TimeToInt(T q )+IPToInt(IP user_i ))%10000, wherein TimeToInt(T q ) represents converting time T q to an integer, and IPToInt(IP user_i) represents converting IP address IP user_i into integer, %10000 represents remainder.

[0016] Further, the preset network service mapping port algorithm A y is: setting mapping port 30000>P y ≥20000, port P y_i =20000+(TimeToInt(T r )+IPToInt(IP user_i ))%10000, wherein, TimeToInt(T r ) represents converting time T r into integer, IPToInt(IP user_i ) represents converting IP address IP user_i into integer.

[0017] Further, the step of accessing network service SERVER according to port number P y_i still includes:

[0018] detecting whether network service mapping port P y_i has access connection every second preset time, if not, closing port P y_i .

[0019] Further, the step of performing first check on the knock data packet D q_i includes:

[0020] checking check string TOKEN q_i to determine whether its hash value is correct;

[0021] if the hash value is correct, the check passes; if the hash value is incorrect, the check fails, at this time, directly ending this access.

[0022] The step of performing second check and information authentication on the knock authentication data packet D r_i includes:

[0023] checking check string TOKEN r_i to determine whether its hash value is correct;

[0024] if the hash value is correct, the check passes; if the hash value is incorrect, the check fails, at this time, directly ending this access.

[0025] Secondly, the application provides a dynamic multi-port knock network service access system, which includes:

[0026] access request module, used for when user USERi accessing the knocking network port P q , in the first preset time according to the preset knocking rule R q uploading the knocking data packet D q_i , the knocking data packet D q_i includes the current time T q , the user IP address IP user_i , the check string TOKEN q_i ;

[0027] a first check module, configured to perform a first check on the knocking data packet D q_i , if the first check passes, calculate the knocking authentication port P r according to the preset authentication port algorithm A r_i , start the knocking authentication service, and set the allowed user IP address IP user_i to access the knocking authentication port P r ; i ;

[0028] an authentication module, configured to calculate the knocking authentication port P i according to the preset authentication port algorithm A r by the user USER r_i , and attempt to access the knocking authentication port P r_i , if the access is successful, send the knocking authentication data packet D r to the port P r_i according to the preset knocking authentication rule R r_i , the knocking authentication data packet D r_i includes the username USERNAME i , the current time T r , the user IP address IP user_i , and the check string TOKEN r_i ;

[0029] a second check module, configured to perform a second check and information authentication on the knocking authentication data packet D r_i , if the second check and information authentication pass, calculate the network service port P y according to the preset network service mapping port algorithm A y_i , start the service port P y_i mapped to the service port P s of the network service SERVER, and set the allowed user IP address IP user_i to access the network service port P y_i ;

[0030] an access connection module, configured to calculate the network service port P i according to the preset network service mapping port algorithm A yCalculate the port number P y_i and try to access the network service port P of the system y_i If the access is successful, access the network service SERVER according to the port number P y_i .

[0031] In a third aspect, the present application provides a storage medium, which stores one or more programs, and the program is executed by a processor to implement the dynamic multi-port knocking network service access method described above.

[0032] In a fourth aspect, the present application provides an electronic device, which comprises a memory and a processor, wherein:

[0033] The memory is used to store a computer program;

[0034] The processor is used to execute the computer program stored on the memory to implement the dynamic multi-port knocking network service access method described above.

[0035] Compared with the prior art, the present application also has the following advantages:

[0036] (1) The present application can be in the state that the network service port is closed by default, and after the user accesses multiple ports of the system and passes the data verification and authentication, the corresponding user and IP address are opened to the service port. In this way, only authorized users and IP addresses can access the network service, and the security of the service is improved. At the same time, during the entire knocking and knocking authentication process, the system does not respond to any data packet, and the knocking authentication port and the network service port are dynamically set, which avoids replay attacks and further improves the security of the service. This method is flexible to set, widely applicable, does not need to modify the original network service, and is easy to operate.

[0037] (2) The present application does not need to modify the original network service program, only needs to pass the additional knocking rule, has a wide range of applications, and can adapt to various different needs by adjusting the network service mapping port.

[0038] (3) The network service port is not opened by default, only the knocking port is opened, and the network service mapping port is opened to authorized users and IP addresses only after the user successfully accesses multiple ports of the system according to the rules, which effectively improves the security of the network service. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 The flow chart of the dynamic multi-port knocking network service access method for an embodiment of the present application;

[0040] Figure 2This is a schematic diagram of the structure of a dynamic multi-port knocking network service access system proposed in one embodiment of the present invention.

[0041] The following specific embodiments will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0043] like Figure 1 As shown, an embodiment of the present invention provides a dynamic multi-port knocking network service access method, which includes steps S101 to S105, wherein:

[0044] Step S101: When user USER i Access Knock Network Port P q , according to the preset knocking rule R within the first preset time q Upload knock data packet D q_i , the knock packet D q_i Including the current time T q 、User IP address IP user_i , verification string TOKEN q_i ;

[0045] In this embodiment, the remote control service of dynamic multi-port knocking is taken as an example. The remote control service can be the remote desktop service in the Windows system or the SSH service in the Linux system. desk For example, the remote desktop service monitors P s The port is restricted to allow only local access, the default remote desktop service port is P s It is 3389.

[0046] It should be noted that the network service system involved in this embodiment is composed of a knock listening port P for knocking. q , Knock authentication port P r , Network service mapping port P y, network service port P S , and knocking rule R q , knocking authentication rule R r , authentication port algorithm A r , network service mapping port algorithm A y , and the main elements such as original network service SERVER and user USER.

[0047] In addition, the system also sets X user information lists before the user accesses, which include username USERNAME i and the key KEY i corresponding to the username USERNAME i , wherein each username USERNAME i is unique, X≥i≥1. In addition, the system also initially sets the network port P q for knocking, knocking rule R q、 , knocking authentication rule R r , and initially sets the network service SERVER service port P s to allow only local access. Wherein P q is the knocking listening port number agreed with the user, R q is the knocking rule agreed with the user: including knocking data field structure (string TOKEN q_i ) and knocking authentication port algorithm (A r ), R r is the knocking authentication rule agreed with the user: including knocking authentication data field structure (check string TOKEN r_i ) and network service port algorithm (A y ).

[0048] Step S102: First check the knocking data packet D q_i , if the first check passes, calculate the knocking authentication port P r according to the preset authentication port algorithm A r_i , start the knocking authentication service, and set the user IP address IP user_i to allow access to the knocking authentication port P r _ i ;

[0049] It should be noted that the check string TOKEN q_i in the knocking data packet D q_i is generated by the current time T q and the user IP address IP user_i ​The hash value is obtained. In the first verification process, the hash value needs to be verified to determine whether it is correct. If the hash value is correct, the verification passes; if the hash value is incorrect, the verification fails and the access is terminated directly. For example, the hash algorithm can be MD5, SHA265, etc.

[0050] Furthermore, in some embodiments, corresponding to Algorithm A r , the algorithm is used to calculate and generate the port number P for subsequent knock authentication r_i The algorithm here can be more flexible, mainly to achieve the data packet D q_i A dynamic port number can be generated in the default authentication port algorithm A. r To: Set port 20000>P r ≥10000, port P r_i =10000+(TimeToInt(T q )+IPToInt(IP user_i ))% 10000, where TimeToInt(T q ) represents the time T q Convert to integer, IPToInt(IP user_i ) means to set the IP address IP user_i Convert to an integer.

[0051] Step S103: User USER i According to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , and try to access the knock authentication port P r_i If the access is successful, the knock authentication rule R r To port P r_i Send knock authentication packet D r_i , the knock authentication data packet D r_i Include username USERNAME i , current time T r 、User IP address IP user_i , verification string TOKEN r_i ;

[0052] It should be noted that during the knocking process, in order to improve security, the server will not respond to any data or information. The user can only send data to the system. r_i It is dynamically generated and both parties need to calculate it separately according to the agreed algorithm.

[0053] In addition, the verification string TOKEN r_i By KEY i , current time Tr , user IP address IP user_i is obtained.

[0054] It should be noted that if the access to the knock authentication port P r_i is unsuccessful, then jump to step S101.

[0055] Step S104: second checksum information authentication is performed on the knock authentication data packet D r_i , and if the second checksum information authentication passes, then the network service port P y is calculated according to a preset network service mapping port algorithm A y_i , the service port P y_i is opened and mapped to the service port P s of the network service SERVER, the user IP address IP user_i is set to be allowed to access the network service port P y_i ;

[0056] Similarly, the second verification in this step is to verify the verification string TOKEN r_i in the knock authentication data packet D r_i to determine whether the hash value is correct; if the hash value is correct, then the verification passes; if the hash value is incorrect, then the verification does not pass, at which point the current access is directly ended.

[0057] In addition, the preset network service mapping port algorithm A y is used to calculate and generate the network service port P y_i for subsequent network access, and the algorithm can be relatively flexible, mainly being able to generate a dynamic port from the data packet D r_i . Specifically, the preset network service mapping port algorithm A y is: set the mapping port 30000>P y ≥20000, the port P y_i =20000+(TimeToInt(T r )+IPToInt(IP user_i ))%10000, wherein TimeToInt(T r ) represents converting the time T r to an integer, and IPToInt(IP user_i ) represents converting the IP address IP user_i to an integer.

[0058] In summary, in the state of default closing of the network service port, the user accesses the system through multiple ports, and after the data verification and authentication, the corresponding user and IP address are opened to the service port. In this way, only authorized users and IP addresses can access the network service, and the security of the service is improved. At the same time, during the entire knocking and knocking authentication process, the system does not respond to any data packet, and the dynamic setting of the knocking authentication port and the network service port avoids replay attacks and further improves the security of the service. This method is flexible to set, widely applicable, does not need to modify the original network service, and has strong operability.

[0059] Step S105: the user USER i According to the preset network service mapping port algorithm A y Calculate the port number P y_i , and try to access the network service port P of the system y_i , if the access is successful, access the network service SERVER according to the port number P y_i .

[0060] In this step, if the network service port P of the system cannot be accessed y_i , jump to step S101.

[0061] Specifically, if the port P y_i is accessible, the user USER i accesses the network service SERVER from the IP address IP user_i by accessing the P y_i port of the system.

[0062] In some embodiments, after the user realizes the access of the network service SERVER, the user also detects whether the network service mapping port P y_i has access connection every second preset time, and if there is no access connection, the port P y_i is closed.

[0063] It should be noted that the first preset time is set to respond to the user's access in time, and the second preset time is set to periodically detect whether the network service mapping port P y_i has access connection. Since the first preset time and the second preset time are related to the specific application environment, they are not limited in detail in this embodiment.

[0064] In summary, according to the above dynamic multi-port knocking network service access method, the user USER i accesses the knocking port P q and sends the knocking data packet D q according to the knocking rule R q . The system processes the knocking data packet D qPerform rule verification. After the verification passes, the system will use the authentication port algorithm A r Calculate the knock authentication port P r And open the knock authentication service, set the user's IP address to allow user_i Access the knock authentication port P r USER i According to the agreed authentication port algorithm A r Calculate P r Then access the knock authentication port and follow the knock authentication rule R r Send knock authentication packet D r The system verifies and authenticates the data. After verification and authentication, the system uses the network service port algorithm A y Calculate the network service mapping port P y And open the port mapping to the network service port P s Port 3389, set the user's IP address to allow user_i Access network service port P y USER i According to the agreed network service mapping port algorithm A y Calculate the port number P y Then you can get the IP address user_i By accessing port P y Normal access to Remote Desktop Services desk The entire process does not require any modification of the original remote desktop service. During the knocking process, no information is output from each port. The user only needs to complete the knocking action according to the agreed rules. After accessing multiple dynamic ports, the remote desktop service can be safely accessed. desk In addition, the combination of knock authentication port, dynamic setting of network service mapping port and IP limitation makes it difficult for attackers to use data captured during communication to carry out further attacks.

[0065] like Figure 2 As shown, an embodiment of the present invention further provides a dynamic multi-port knocking network service access system, the system comprising:

[0066] Access request module 10, used to be a user USER i Access Knock Network Port P q , according to the preset knocking rule R within the first preset time q Upload knock data packet D q_i , the knock packet D q_i Including the current time T q 、User IP address IP user_i , verification string TOKEN q_i ;

[0067] The first verification module 20 is used to verify the knock data packet D q_i Perform the first check. If the first check passes, then according to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , open the knock authentication service, and set the user's IP address to allow user_i Access the knock authentication port P r _ i ;

[0068] Authentication module 30, for user USER i According to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , and try to access the knock authentication port P r_i If the access is successful, the knock authentication rule R r To port P r_i Send knock authentication packet D r_i , the knock authentication data packet D r_i Include username USERNAME i , current time T r 、User IP address IP user_i , verification string TOKEN r_i ;

[0069] The second verification module 40 is used to verify the knock authentication data packet D r_i Perform the second checksum information authentication. If the second checksum information authentication passes, the preset network service mapping port algorithm A is used. y Calculate the network service port P y_i , open the service port P y_i And mapped to the service port P of the network service SERVER s , set the user's IP address to allow user_i Access network service port P y_i ;

[0070] Access connection module 50 for user USER i According to the preset network service mapping port algorithm A y Calculate the port number P y_i , and try to access the system's network service port P y_i If the access is successful, then according to the port number P y_i Access the network service SERVER.

[0071] On the other hand, the present invention further provides a storage medium storing one or more programs, which, when executed by a processor, implement the above-mentioned dynamic multi-port knocking network service access method.

[0072] Another aspect of the present application also provides an electronic device comprising a memory and a processor, wherein the memory is configured to store a computer program, and the processor is configured to execute the computer program stored in the memory to implement the above-mentioned dynamic multi-port knocking network service access method.

[0073] Those skilled in the art can understand that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a list of executable instructions for implementing the logic function, which can be embodied in any computer readable medium for use by or in connection with an instruction execution system, apparatus or device, such as a computer-based system, a system including a processor or other system that can fetch the instructions from the instruction execution system, apparatus or device and execute the instructions, or in conjunction with these instructions execution system, apparatus or device. For the purpose of the present description, the "computer readable medium" can be any device that can contain, store, communicate, propagate or transport programs for use by or in connection with an instruction execution system, apparatus or device, or in conjunction with these instructions execution system, apparatus or device.

[0074] More specific examples (a non-exhaustive list) of the computer readable medium include the following: an electrical connection having one or more wires (electrical devices), a portable computer diskette (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). In addition, the computer readable medium can even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, for example, by optically scanning the paper or other suitable medium, then electronically converted into a form that is suitable for use in a computer system, stored, and / or otherwise processed.

[0075] It should be understood that parts of the present application can be implemented in hardware, software, firmware or a combination thereof. In the above-described embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, and as in another embodiment, it can be implemented by any one or a combination of the following technologies known in the art: discrete logic circuit with logic gate circuit for implementing logic functions on data signals, application specific integrated circuit with suitable combination logic gate circuit, programmable gate array (PGA), field programmable gate array (FPGA), etc.

[0076] While the embodiments of the application have been illustrated and described in detail, it will be readily apparent to those skilled in the art that various modifications and changes can be made to the embodiments without departing from the scope and spirit of the application, as described in the claims. Moreover, the application described is not limited in its application to the details set forth in the description or illustrated in the drawings. The application is capable of other embodiments and of being practiced or carried out in various ways.

Claims

1. A method for dynamic multi-ported knock-on network service access, the method comprising: The method comprises: When the user USER i accesses the door knocking network port P q , in the first preset time according to the preset door knocking rule R q upload the door knocking data packet D q_i , the door knocking data packet D q_i includes the current time T q , the user IP address IP user_i , the check string TOKEN q_i ; The knock data packet D q_i A first check is performed, and if the first check passes, a preset authentication port algorithm A r is calculated according to the knock authentication port P r_i , the knock authentication service is started, and the user IP address IP user_i is set to allow access to the knock authentication port P r_i ; User i According to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , and try to access the knock authentication port P r_i If the access is successful, the knock authentication rule R r To port P r_i Send knock authentication packet D r_i , the knock authentication data packet D r_i Include username USERNAME i , current time T r 、User IP address IP user_i , verification string TOKEN r_i ; to the door authentication data packet D r_i second check sum information authentication is passed, according to the preset network service mapping port algorithm A y network service port P y_i , open service port P y_i and mapping to the network service SERVER service port P s , set the user IP address IP user_i access to the network service port P y_i ; User USER i According to the preset network service mapping port algorithm A y Calculate the port number P y_i , and try to access the network service port P of the system y_i , if the access is successful, access the network service SERVER according to the port number P y_i .

2. The dynamic multi-ported knock-and-announce network service access method of claim 1, wherein, The method further comprises: Set X user information lists, the user information lists include the user name USERNAME i and the username USERNAME i Corresponding key KEY i , wherein each of the user names USERNAME i are all unique, X≥i≥1.

3. The dynamic multi-ported knock-and-announce network service access method of claim 2, wherein, The check string TOKEN q_i is obtained by hashing the current time T q and the user IP address IP user_i . The check string TOKEN r_i is obtained by hashing i the KEY r , the current time T user_i , and the user IP address IP.

4. The dynamic multi-ported knock-and-announce network service access method of claim 1, wherein, The preset authentication port algorithm A r is: setting port 20000>P r ≥10000, port P r_i =10000+(TimeToInt(T q )+IPToInt(IP user_i ))%10000, wherein, TimeToInt(T q ) represents converting time T q into an integer, IPToInt(IP user_i ) represents converting IP address IP user_i into an integer, and the remainder of %10000 represents taking the remainder.

5. The dynamic multi-ported knock-and-announce network service access method of claim 1, wherein, The preset network service mapping port algorithm A y is: setting a mapping port 30000>P y ≥20000, port P y_i =20000+(TimeToInt(T r )+IPToInt(IP user_i ))%10000, wherein TimeToInt(T r ) represents converting time T r into an integer, and IPToInt(IP user_i ) represents converting IP address IP user_i into an integer.

6. The dynamic multi-ported knock-and-announce network service access method of claim 1, wherein, Said according to the port number P y_i The step of accessing the network service SERVER also comprises: detecting the network service mapping port P every second preset time y_i whether there is an access connection, and if not, closing the port P y_i .

7. The dynamic multi-ported knock-and-announce network service access method of claim 3, wherein, said door knocking data packet D q_i The step of performing a first check comprises: To check the string TOKEN q_i is correct or not. If the hash value is correct, the verification passes; if the hash value is incorrect, the verification fails, and the current access is directly ended; said door knocking authentication data packet D r_i The step of performing a second checksum information authentication comprises: To check the string TOKEN r_i is checked to determine if its hash value is correct; If the hash value is correct, the verification passes; if the hash value is incorrect, the verification fails, and the current access is directly ended.

8. A dynamic multi-portal knock-on network service access system, characterized by, The system comprises: The access request module is configured to, when a user USER i accesses a door knocking network port P q , upload a door knocking data packet D q within a first preset time according to a preset door knocking rule R q_i . The door knocking data packet D q_i includes a current time T q , a user IP address IP user_i , and a verification string TOKEN q_i . The first checking module is configured to perform a first check on the knocking data packet D q_i If the first check passes, a knocking authentication port P r is calculated according to a preset authentication port algorithm A r_i , a knocking authentication service is started, and an IP address IP user_i of a user allowed to access the knocking authentication port P r_i is set. Authentication module for user USER i According to the preset authentication port algorithm A r Calculate the knock authentication port P r_i , and try to access the knock authentication port P r_i If the access is successful, the knock authentication rule R r To port P r_i Send knock authentication packet D r_i , the knock authentication data packet D r_i Include username USERNAME i , current time T r 、User IP address IP user_i , verification string TOKEN r_i ; a second verification module, configured to perform second verification and information authentication on the door knocking authentication data packet D r_i If the second verification and information authentication is passed, a preset network service mapping port algorithm A y is used to calculate a network service port P y_i , open the service port P y_i , and map the service port P s to a service port P user_i of the network service SERVER, and set an IP address IP y_i of a user allowed to access the network service port P y_i ; The access connection module is used for the user USER i According to the preset network service mapping port algorithm A y The port number P is calculated y_i And try to access the network service port P of the system y_i If the access is successful, the network service SERVER is accessed according to the port number P y_i .

9. A storage medium, characterized by The storage medium stores one or more programs, which are executed by the processor to implement the dynamic multi-port knock network service access method according to any one of claims 1-7. 10.An electronic device, comprising a memory and a processor, wherein: The memory is configured to store a computer program; The processor is configured to execute the computer program stored on the memory to implement the dynamic multi-port knock network service access method according to any one of claims 1-7.

Images