Method and system for realizing cross-network monitoring through bidirectional NAT (Network Address Translation)

Abstract

The invention belongs to the technical field of enterprise networks and network security, and discloses a method and a system for realizing cross-network monitoring through bidirectional NAT (Network Address Translation). The method comprises the following steps: two mutually isolated networks cannot sense the existence of each other; through firewall quintuple-level access control, the security granularity of mutual access is accurate to a specified port; a session table item needs to be established in the firewall for each mutual access, and the firewall performs security detection on an interactive data message through deep analysis on a data message of the session table item. According to the invention, the security of the secret network is greatly enhanced.

Description

Technical Field

[0001] The present invention belongs to the technical field of enterprise network and network security, and in particular relates to a method and system for realizing cross-network monitoring through bidirectional NAT. Background Art

[0002] With the rapid development of computer technology, information networks have become an important guarantee for social development. There is a lot of sensitive information, even confidential information. Therefore, it is inevitable to attract illegal attacks (such as information leakage, information theft, data tampering, data deletion, computer viruses, etc.). In the existing technology, bidirectional NAT requires knowledge of routing and NAT, and has high requirements for operation and maintenance personnel.

[0003] Through the above analysis, the problems and defects of the existing technology are: the existing technology has a low security protection level, and the security and confidentiality of the network are poor. Summary of the invention

[0004] To overcome the problems existing in the related art, the disclosed embodiments of the present invention provide a method and system for implementing cross-network monitoring through bidirectional NAT, specifically relating to a security technology for managing and controlling interactive data between logically isolated networks.

[0005] The technical solution is as follows: a method for implementing cross-network monitoring through bidirectional NAT, using bidirectional NAT technology to allow two isolated networks to access each other on demand and achieve a five-tuple level security protection level; specifically, the following steps are included:

[0006] S1: Two isolated networks cannot perceive each other's existence. NAT technology converts the source address to hide the real address. The firewall's regional division function is used to divide the entire network into regions with different priorities, and protection strategies are used to prevent access between regions.

[0007] S2, relying on the access control at the firewall five-tuple level, writes a security access policy with granularity as fine as TCP / UDP protocol, and accurately specifies the mutual access security to the specified port; the firewall five-tuple is source address, destination address, source port, destination port, and protocol;

[0008] S3, when the data traffic passes through the firewall, the firewall compares each security access policy in sequence according to the five-tuple information of the data traffic, and discards the traffic if none of them meets the conditions.

[0009] In step S3, the firewall performs deep analysis on the session table entry data message by using bidirectional NAT conversion.

[0010] Furthermore, bidirectional NAT translation includes:

[0011] (1) Request traffic: The PC accesses the DNS domain name of the FTP server. The PC sends the request to the primary DNS domain name server. The primary DNS domain name server checks the local record. If the local record does not contain the domain name, it continues to request the primary domain name server. Otherwise, it resolves the domain name into an IP address and sends the resolved public network address of the FTP server to the PC.

[0012] (2) Response traffic: The source address of the response traffic is the private network address of the FTP server, and the destination address is the private network address of the PC. When the traffic reaches the switch, it will search for a route and forward it directly to the PC.

[0013] In step (1), the public network address of the FTP Server is the NAt Server mapping address of the firewall.

[0014] In step (2), the source address NAT is intra-domain NAT.

[0015] Another object of the present invention is to provide a cross-network monitoring system implemented by bidirectional NAT, the system is implemented by the method for implementing cross-network monitoring by bidirectional NAT, and the system comprises:

[0016] Network isolation module, used to make two isolated networks unaware of each other's existence;

[0017] The firewall five-tuple level access module is used to control the access at the firewall five-tuple level and precisely control the security granularity of mutual access to the specified port.

[0018] The session table entry data message deep analysis module is used to establish a session table entry in the firewall for each mutual visit. The firewall performs security detection on the interactive data message through deep analysis of the session table entry data message.

[0019] Furthermore, the system is mounted on a computer device, which includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor. When the processor executes the computer program, the functions of the cross-network monitoring system implemented through bidirectional NAT are realized.

[0020] Furthermore, the system is mounted on a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it can realize the functions of the cross-network monitoring system through bidirectional NAT.

[0021] Furthermore, the system is mounted on a server, and the server is used to provide a user input interface to implement the functions of the cross-network monitoring system through bidirectional NAT as described above when executed on an electronic device.

[0022] Combined with all the above technical solutions, the beneficial effects of the present invention are: using bidirectional NAT technology to achieve on-demand mutual access between two isolated networks, and achieving a five-tuple level of security protection. First, the two isolated networks cannot perceive the existence of each other. Secondly, through the five-tuple level access control of the firewall, the security granularity of the mutual access is accurately determined to the specified port. Finally, each mutual access must establish a session table entry in the firewall, and the firewall performs security detection on the interactive data message through in-depth analysis of the session table entry data message. The security of the confidential network is greatly enhanced. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings herein are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description, serve to explain the principles of the present disclosure;

[0024] Figure 1 It is a flow chart of a method for implementing cross-network monitoring through bidirectional NAT provided by an embodiment of the present invention;

[0025] Figure 2 This is a schematic diagram of the flow of a PC accessing an FTP Server via a domain name provided by an embodiment of the present invention;

[0026] Figure 3 It is a schematic diagram of a cross-network monitoring system implemented by bidirectional NAT provided by an embodiment of the present invention;

[0027] Figure 4 This is a diagram showing the configuration source NAT interface provided by an embodiment of the present invention;

[0028] Figure 5 This is a diagram of a destination NAT configuration interface provided by an embodiment of the present invention;

[0029] Figure 6 It is a strategy interface diagram from the departure network to the departure external field network provided by an embodiment of the present invention;

[0030] Figure 7 It is a strategy interface diagram from the departure external field network to the departure network direction provided by an embodiment of the present invention;

[0031] Figure 8 This is a diagram of a NAT policy interface provided by an embodiment of the present invention;

[0032] Fig. 9 This is an interface diagram of the wide area network device status that can be monitored by Zabbix in an intranet environment after the network is adjusted according to an embodiment of the present invention;

[0033] In the figure: 1. Network isolation module; 2. Firewall five-tuple level access module; 3. Session table data packet deep analysis module. DETAILED DESCRIPTION

[0034] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention can be implemented in many other ways different from those described herein, and those skilled in the art can make similar improvements without violating the connotation of the present invention, so the present invention is not limited by the specific implementation disclosed below.

[0035] The method and system for implementing cross-network monitoring through bidirectional NAT provided by the embodiment of the present invention are innovative in that bidirectional NAT (Network Address Translation) technology is used to enable on-demand mutual access between two isolated networks and to achieve a five-tuple level security protection level.

[0036] Embodiment 1, as Figure 1 As shown, the method for implementing cross-network monitoring through bidirectional NAT provided by an embodiment of the present invention includes:

[0037] S1: Two isolated networks cannot perceive each other's existence. NAT technology converts the source address to hide the real address. The firewall's regional division function is used to divide the entire network into regions with different priorities, and access between regions is blocked through protection strategies.

[0038] S2, relying on the access control at the firewall five-tuple level, writes a security access policy with granularity as fine as TCP / UDP protocol, and accurately specifies the mutual access security to the specified port; the firewall five-tuple is source address, destination address, source port, destination port, and protocol;

[0039] S3, when data traffic passes through the firewall, the firewall compares each security access policy in order according to the five-tuple information of the data traffic. If no conditions are met, the traffic is discarded, and the security protection policy directly jumps out of the comparison and establishes a channel at the same time. This channel is the session table entry. Each access establishes a session table entry in the firewall, which includes the source IP address, source port, destination IP address, destination port, protocol number, application, user, instance number, source and destination virtual wall, source and destination area, life cycle, remaining time, outbound interface, next hop IP / MAC, message direction / byte count statistics, etc. The firewall performs security detection on the interactive data packets of the data traffic through in-depth analysis of the session table data packets.

[0040] Example 2, bidirectional NAT conversion:

[0041] Bidirectional NAT is not a separate function, it is just a combination of source NAT and NAT Server. Here, "combination" means that for the same flow (for example, the flow of external hosts accessing internal servers), the source address and destination address of the message are converted at the same time when it passes through the firewall. "Configuring both source NAT and NAT Server on the firewall is not bidirectional NAT" because source NAT and NAT Server may be configured for different flows and can convert the source IP, destination IP, source port, and destination port of the data packet at the same time.

[0042] For industries with a higher security level, internal server addresses cannot be directly accessed by external units and need to be converted into external network addresses. In addition, it is not desired to introduce the routes of external units into the internal network to avoid overlapping addresses of external units. Therefore, source address conversion of external units needs to be implemented.

[0043] For example, the FTP server and PC both belong to the trust zone, and the PC wants to access the FTP server through the domain name. Figure 2 As shown in the figure, traffic trends include:

[0044] (1) Request traffic: The PC accesses the DNS domain name of the FTP server. The PC sends the request to the primary DNS domain name server. The primary DNS domain name server checks the local record. If the local record does not contain the domain name, it continues to request the primary domain name server. Otherwise, it resolves the domain name into an IP address and sends the resolved public network address of the FTP server to the PC.

[0045] When the traffic from the PC reaches the firewall, the firewall first matches the corresponding security protection policy and NAT policy mapping entry based on the five-tuple of the traffic, and then finds the corresponding converted source address and destination address based on the source address and destination address in the NAT policy mapping entry, and replaces the destination address with the mapped address. This converted destination address is the private network address of the FTP Server. After converting it to the private network address of the FTP Server (where the NAT server mapping is the first match), the switch's routing table is searched based on the longest match principle to find the route to the FTP Server, and the data is forwarded to the FTP Server based on the next-hop interface specified on the route;

[0046] (2) Response traffic: The source address of the response traffic is the private network address of the FTP server, and the destination address is the private network address of the PC. When the traffic reaches the switch, it will search for a route and forward it directly to the PC. It will not pass through the firewall and will not perform NAT conversion. As a result, the source address of the response message received by the PC is different from the destination address of the request message it sent, and it is discarded.

[0047] Therefore, the role of intra-domain NAT is to make the response message also pass through the firewall, which requires that the destination address of the response message is an address on the firewall. Therefore, the request message must first pass through the NAT Server to complete the conversion of the destination address. The firewall then hits the corresponding security protection policy and NAT policy mapping entry based on the five-tuple of the traffic, and then finds the corresponding converted source address and destination address based on the source address and destination address in the NAT policy mapping entry, and converts the source address into the mapped source address, that is, a source address NAT (that is, intra-domain NAT) converts the PC's address into an address on the firewall.

[0048] Embodiment 2, as Figure 3 As shown in the figure, a cross-network monitoring system is implemented through bidirectional NAT, including:

[0049] Network isolation module 1, used for two isolated networks to be unaware of each other's existence;

[0050] The firewall five-tuple level access module 2 is used to control the access at the firewall five-tuple level and precisely control the security granularity of mutual access to the designated port;

[0051] The session table entry data message deep analysis module 3 is used to establish a session table entry in the firewall for each mutual visit. The firewall performs security detection on the interactive data message through deep analysis of the session table entry data message.

[0052] The departure network and departure external network of an international airport use bidirectional NAT to manage and control the business terminals deployed in the external network. The departure system is an important business component of the airport, which is related to important functions such as passenger check-in, boarding, baggage handling, and data synchronization. The security of the departure system is also an important part of security work. However, friendly companies such as Asia VIP, which are external units of the airport, are excluded from the airport network, but departure business terminals need to be deployed. At this time, it is most appropriate to use bidirectional NAT. First, it ensures that the friendly network cannot perceive the airport departure network (there is no departure network routing), secondly, it realizes port-level data interaction, and finally, it realizes the inspection of interactive data packets. The specific implementation steps are as follows:

[0053] Configuration example: Use bidirectional NAT to implement management and control of seat 19 deployed in the departure field network.

[0054] Step 1: Configure source NAT to meet the needs of seat 19# to actively access the airport departure network. When seat 19# actively accesses the departure network, the address of seat 19# is converted to the address of the departure network. Figure 4 As shown in the figure, the source address is the external network address of seat 19#; the source address translation address pool is the address after translation of seat 19#. The outbound interface of the destination type is the interface on the airport departure network side of the firewall.

[0055] Step 2: Configure the destination NAT to meet the airport network's need to access seat 19#. When the airport network user needs to access seat 19#, the direct access address is the address of seat 19# mapped in the departure network. Figure 5 As shown, the private network address is the external network address of seat 19#; the public network address conversion address pool is the address after the destination address of seat 19# is converted.

[0056] Step 3: In the firewall security policy, the mutual access policy from the outbound network to the outbound external network and from the outbound external network to the outbound network is allowed. The source address and destination address indicate the direction of data mutual access; the service limits the specific ports that can be accessed in the five-tuple; content security enables the firewall to filter the data traffic in the session. Figure 6 The strategy from the departure network to the departure field network is shown in the figure. Figure 7 , NAT policy such as Figure 8 The above two-way NAT configuration enables two-way communication between WANs without intranet routing. After the network is connected, you can monitor the status of WAN devices through Zabbix in the intranet environment, such as Fig. 9 .

[0057] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principles of the present invention should be covered within the protection scope of the present invention.

Claims

1. A method for implementing cross-network monitoring through bidirectional NAT, characterized in that: The method uses bidirectional NAT technology to allow two isolated networks to access each other on demand and achieve a five-tuple level of security protection. Specifically, the method includes the following steps: S1: Two isolated networks cannot perceive each other's existence. NAT technology converts the source address to hide the real address. The firewall's regional division function is used to divide the entire network into regions with different priorities, and protection strategies are used to prevent access between regions. S2, relying on the access control at the firewall five-tuple level, writes a security access policy with granularity as fine as TCP / UDP protocol, and accurately specifies the mutual access security to the specified port; the firewall five-tuple is source address, destination address, source port, destination port, and protocol; S3, when the data traffic passes through the firewall, the firewall compares each security access policy in sequence according to the five-tuple information of the data traffic, and discards the traffic if none of them meets the conditions.

2. The method for implementing cross-network monitoring through bidirectional NAT according to claim 1, characterized in that: In step S3, the firewall performs deep analysis on the session table entry data message by using bidirectional NAT conversion.

3. The method for implementing cross-network monitoring through bidirectional NAT according to claim 2, characterized in that: Bidirectional NAT translation, including: (1) Request traffic: The PC accesses the DNS domain name of the FTP server. The PC sends the request to the primary DNS domain name server. The primary DNS domain name server checks the local record. If the local record does not contain the domain name, it continues to request the primary domain name server. Otherwise, it resolves the domain name into an IP address and sends the resolved public network address of the FTP server to the PC. (2) Response traffic: The source address of the response traffic is the private network address of the FTP server, and the destination address is the private network address of the PC. When the traffic reaches the switch, it will search for a route and forward it directly to the PC.

4. The method for implementing cross-network monitoring through bidirectional NAT according to claim 3, characterized in that: In step (1), the public network address of the FTP Server is the NAt Server mapping address of the firewall.

5. The method for implementing cross-network monitoring through bidirectional NAT according to claim 3, characterized in that: In step (2), the source address NAT is intra-domain NAT.

6. A cross-network monitoring system implemented by bidirectional NAT, characterized in that: The system is implemented by the method for realizing cross-network monitoring through bidirectional NAT as described in any one of claims 1 to 5, and the system includes: Network isolation module (1), used for two isolated networks to be unaware of each other's existence; A firewall five-tuple level access module (2) is used to precisely control the security granularity of mutual access to a designated port through firewall five-tuple level access control; The session table entry data message deep analysis module (3) is used to establish a session table entry in the firewall for each mutual visit. The firewall performs security detection on the interactive data message by deeply analyzing the session table entry data message.

7. The cross-network monitoring system implemented by bidirectional NAT according to claim 6, characterized in that: The system is mounted on a computer device, which includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor. When the processor executes the computer program, the functions of the cross-network monitoring system implemented through bidirectional NAT are realized.

8. The cross-network monitoring system implemented by bidirectional NAT according to claim 6, characterized in that: The system is mounted on a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the functions of the cross-network monitoring system can be realized through bidirectional NAT.

9. The cross-network monitoring system implemented by bidirectional NAT according to claim 6, characterized in that: The system is mounted on a server, and the server is used to provide a user input interface to implement the functions of the cross-network monitoring system through bidirectional NAT when it is executed on an electronic device.

Images