Remote service access method based on single packet authorization and reverse connection

Abstract

The invention relates to the field of network security, in particular to a remote service access method based on single packet authorization and reverse connection. A server sends an SPA data packet to an intermediate server through a first port, a server firewall maps a new port to send the SPA data packet according to the first port, the intermediate server carries out decryption verification on the SPA data packet, and after verification succeeds, the address and the port of the corresponding server are updated; the invention provides a remote service access method based on single packet authorization and reverse connection, which not only realizes complete port hiding of a server side so as to enhance the security of a system, but also is suitable for a high-security demand scene in which a server is positioned behind a firewall and the port cannot be or is not suitable for being directly exposed.

Description

Technical Field

[0001] The invention relates to the field of network security, and in particular to a remote service access method based on single-packet authorization and reverse connection. Background Art

[0002] In existing network communications, it is usually the client that actively initiates a connection request with the server. In this mode, the server needs to listen to a fixed port and wait for the client's connection. However, this method is vulnerable to various forms of network attacks such as vulnerability scanning and distributed denial of service (DDoS) attacks. In addition, in some cases, due to the existence of network firewalls, it becomes difficult to directly access internal resources from the outside. In an intranet environment, a reverse connection method is generally used, that is, the server and the client simultaneously connect to a server on the public network that they can access together. The client sends a request to the intermediate server, and the intermediate server uses the reverse connection established by the application server to forward the request to the server. However, once the reverse connection is established, a corresponding relationship is established between the port of the intermediate server and the port of the application server. Accessing the port of the intermediate server can directly access the corresponding port of the application server, which also reduces security.

[0003] At present, in order to solve the above problems, the existing technology mainly adopts port knocking technology based on port sequence and single packet authorization technology to solve them. The port knocking technology based on port sequence requires the client to initiate a request to a port sequence pre-defined by both parties before connecting to the real server port. After detecting that a client has requested these ports in a pre-defined order, the server determines that the client is a client that should be authorized, and the server will open the corresponding service port to the IP address of the client for service; in the single packet authorization technology, the client sends a single data packet to the specific port of the server for access application, and the client integrates all necessary information in a single data packet to simplify the knocking process. The server will verify the device and user identity before opening the port, so as to achieve "network invisibility" and make it impossible for attackers to open the port.

[0004] However, in both solutions, the client actively connects to the server. After successful verification, the server still needs to expose the port to the client. When multiple clients use one IP address, there is still a possibility of malicious attacks. In addition, when the server does not have a public IP, it is difficult to expose the port. Summary of the invention

[0005] In response to the problems mentioned in the prior art, the present invention proposes a remote service access method based on single-packet authorization and reverse connection, which can solve the problem of how to establish a trusted connection between the client and the server through single-packet authorization when the server is unwilling to expose the port or the server is behind a firewall and cannot expose the port.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: The present invention discloses a remote service access method based on single-packet authorization and reverse connection, and the method relates to a remote service access system based on single-packet authorization and reverse connection, wherein the system comprises a client, an intermediate server and a server, wherein the client and the server are located in an intranet, and the intermediate server is located in an extranet, and the method comprises the following steps: S1. The server sends a SPA data packet to the intermediate server through the first port. The server firewall maps a new port according to the first port to send the SPA data packet. The intermediate server decrypts and verifies the SPA data packet. After successful verification, the address and port of the corresponding server are updated. S2. The client sends a SPA data packet to the intermediate server through the second port. The client firewall maps a new port according to the second port to send the SPA data packet. The intermediate server decrypts and verifies the SPA data packet from the client. After successful verification, it updates the address and port of the corresponding client and forwards the SPA data packet to the server. S3. The server decrypts and verifies the SPA data packet from the client. After the verification is passed, the server resends the SPA data packet to the intermediate server through the third port. The server firewall maps a new port based on the third port to send the SPA data packet. S4, the intermediate server forwards the SPA data packet from the server to the client, and the client decrypts and verifies the SPA data packet. After the verification is passed, the client sends a service request to the intermediate server through the fourth port, and the client firewall maps a new designated port according to the fourth port to send the service request; S5. The intermediate server forwards the business request from the client to the server. The server obtains the application data through the third specific port and sends a response to the intermediate server. The intermediate server forwards the response to the client, thereby establishing a trusted connection between the client and the server.

[0007] As a further improvement of the present invention, the SPA data packet is sent encrypted, wherein the SPA data includes one or more of a version number, a request type, a user identity information, a client ID, a server ID, a timestamp, and a signature.

[0008] As a further improvement of the present invention, the user identity information includes a user name or ID of the user.

[0009] As a further improvement of the present invention, the signature is generated by a pre-shared key and a random number.

[0010] As a further improvement of the present invention, in step S3, the server firewall will map a new port according to the first port to receive the SPA data packet and forward it to the server through the first port.

[0011] As a further improvement of the present invention, in step S4, the client firewall maps a new port according to the second port to receive the SPA data packet from the intermediate server and forwards it to the client through the second port. As a further improvement of the present invention, in step S5, the server firewall maps a new port according to the third port and receives the service request from the client and forwards it to the server through the third port; The intermediate server forwards the response to the client firewall, and the client firewall forwards it to the client based on a new designated port mapped by the fourth port.

[0012] As a further improvement of the present invention, a connection is established between the third port of the server and the fourth port of the client.

[0013] As a further improvement of the present invention, the intermediate server in step S1 will establish a server list, which will record the server firewall address, the server firewall mapping a new port according to the first port and the address and the first port of the corresponding server ID.

[0014] As a further improvement of the present invention, the intermediate server in step S3 will establish a server list, which will record the client firewall address, the client firewall mapping a new port according to the second port and the address and the second port corresponding to the client ID.

[0015] Compared with the prior art, the present invention has achieved the following technical effects: The present invention proposes a remote service access method based on single-packet authorization and reverse connection, which not only realizes complete port hiding on the server side, thereby enhancing the security of the system, but also is suitable for high-security demand scenarios where the server is located behind a firewall and it is impossible or inappropriate to directly expose the port.

[0016] Under the protection of a firewall, this method allows the server to securely establish a reverse connection without opening any ports to the external network, effectively avoiding potential network attacks and unauthorized access risks. It not only improves the security of reverse connection server access, but also further expands the server's concealment and flexibility in complex network environments, providing support for application scenarios that require highly confidential and stable communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of the overall structure of the present invention. DETAILED DESCRIPTION

[0018] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0019] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", "axial", "radial", "circumferential" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the present invention.

[0020] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0021] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection, an electrical connection, or a communication; it can be a direct connection, or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0022] In the present invention, unless otherwise clearly specified and limited, a first feature being "above" or "below" a second feature may include that the first and second features are in direct contact, or may include that the first and second features are not in direct contact but are in contact through another feature between them. Moreover, a first feature being "above", "above" and "above" a second feature includes that the first feature is directly above and obliquely above the second feature, or simply indicates that the first feature is higher in level than the second feature. A first feature being "below", "below" and "below" a second feature includes that the first feature is directly above and obliquely above the second feature, or simply indicates that the first feature is lower in level than the second feature.

[0023] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0024] It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0025] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0026] Various structural schematic diagrams of the embodiments disclosed in the present invention are shown in the accompanying drawings. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0027] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0028] Example 1 like Figure 1 As shown, the present invention provides a remote service access method based on single packet authorization and reverse connection, characterized in that the method relates to a remote service access system based on single packet authorization and reverse connection, the system includes a client, an intermediate server and a server, wherein the client and the server are located in an intranet, and the intermediate server is located in an extranet, and the method includes the following steps: S1. The server sends a SPA data packet to the intermediate server through the first port. The server firewall maps a new port according to the first port to send the SPA data packet. The intermediate server decrypts and verifies the SPA data packet. After successful verification, the address and port of the corresponding server are updated. S2. The client sends a SPA data packet to the intermediate server through the second port. The client firewall maps a new port according to the second port to send the SPA data packet. The intermediate server decrypts and verifies the SPA data packet from the client. After successful verification, it updates the address and port of the corresponding client and forwards the SPA data packet to the server. S3. The server decrypts and verifies the SPA data packet from the client. After the verification is passed, the server resends the SPA data packet to the intermediate server through the third port. The server firewall maps a new port based on the third port to send the SPA data packet. S4, the intermediate server forwards the SPA data packet from the server to the client, and the client decrypts and verifies the SPA data packet. After the verification is passed, the client sends a service request to the intermediate server through the fourth port, and the client firewall maps a new designated port according to the fourth port to send the service request; S5. The intermediate server forwards the business request from the client to the server. The server obtains the application data through the third specific port and sends a response to the intermediate server. The intermediate server forwards the response to the client, thereby establishing a trusted connection between the client and the server.

[0029] The specific implementation is as follows: Figure 1 As shown, the client is located in intranet 1, the server is located in intranet 2, and the intermediate server is located in the public network.

[0030] The present invention includes the following software parts: single package authorization client software SPA_Client, single package authorization server software SPA_Server and intermediate server software SPA_Proxy. SPA_Client is deployed on clients A and B, SPA_Proxy is deployed on intermediate server M, and SPA_Server is deployed on server S. The targets to be protected by this scheme are business client Client and business server Server, which are deployed on clients A and B and server S respectively. The above SPA_Client is responsible for the generation, verification, and startup of the SPA data packet. The SPA_Server is responsible for the sending, verification, and establishment of reverse connections of SPA data packets, receiving service requests from the intermediate server, initiating requests to the service server Server through the local address, and returning service responses through the reverse connection. The SPA_Proxy is responsible for the establishment of the connection between the client and the server.

[0031] Before starting, the server and client should pre-share the keys used for SPA encryption, decryption and digital signature. The entire service communication proceeds as follows: 1. Server 192.168.100.10 sends SPA packets to the specific port of the intermediate server M (address 218.0.0.1) through the random port Psa at fixed intervals (format see Table 1). When server S sends data to the intermediate server M through firewall F2, firewall F2 will map an external port for the combination of the server's intranet address + port number. Without loss of generality, assume that server S uses port 10 to send information, and the intranet address 192.168.100.10:10 is mapped to 217.0.0.1:50010 on the external network of firewall F2. At this time, 217.0.0.1:50010 can receive data from the intermediate server M and forward it to 192.168.100.10:10. The intermediate server maintains a server list, which records information such as server ID, source address and source port number of the SPA packet (actually the external network address and port of firewall F2). The intermediate server decrypts and verifies the SPA data packet. After successful verification, it will use the source address and source port of the SPA packet (the external network address and port on firewall F2) to update the address and port of the corresponding server ID.

[0032] 2. The client A1 (address 10.0.0.10) in the intranet sends a SPA data packet (format see Table 1) to the intermediate server M. At this time, the firewall F1 will map the port for the client on the external network port. Without loss of generality, assuming that the port used is 20, the intranet 10.0.0.10:20 is mapped to the external network 219.0.0.1:50020 on the firewall F1. 219.0.0.1:50020 can receive the data from the intermediate server and forward it to 10.0.0.10:20.

[0033] 3. The intermediate server decrypts and verifies the SPA data packet received from client A. Based on the server ID and other information, and using the server list stored in the intermediate server, the intermediate server forwards the SPA data packet to the external network address 217.0.0.1:50010 on firewall F2. At this time, firewall F2 forwards the data packet to server 192.168.100.10:10.

[0034] 4. After receiving the SPA data packet, the server 192.168.100.10:10 first decrypts and verifies it. When the verification is successful, it is confirmed that the access is legal. The server's SPA_Server sends a SPA packet to the intermediate server M. The packet contains the identity information of the application server and uses another random port 11 to initiate a connection to the intermediate server M. This port is mapped to 217.0.0.1:50011 on the external network interface of firewall F2.

[0035] 5. The intermediate server forwards the SPA data packet sent by server S to the external network port 219.0.0.1:50020 of firewall F1, and firewall F1 forwards it to the intranet client 10.0.0.10:20. The SPA_Client on the intranet client verifies the SPA packet. When the verification passes, the client initiates a connection to the intermediate server through the new port 21 and sends a service request. Port 21 is mapped to 219.0.0.1:50021 on firewall F1.

[0036] 6. The intermediate server receives the service request from the client and forwards it to the intranet server 192.168.100.10:11 through the firewall F2 address 217.0.0.1:50011. The SPA_Server program on the server obtains the application data through the local port and returns it to the intermediate server M through 192.168.100.10:11. The intermediate server forwards the response to the firewall F1 address 219.0.0.1:50021. The data received at the firewall F1 address 219.0.0.1:50021 is forwarded to the intranet 10.0.0.1:21.

[0037] At this point, without exposing the ports, a connection is established between port 21 of client A and port 11 of server S through the intermediate server. At the same time, when the server authorizes client A, client B cannot use the authorization to communicate with server S.

[0038] The SPA data packet used in this embodiment should be sent in an encrypted manner, and the SPA data packet contains at least the following information:

[0039] Table 1 Example 2 This embodiment is basically the same as the first embodiment, except that the present invention provides a new solution. When the network satisfies the full cone NAT, address restricted NAT or port restricted NAT, NAT hole punching can also be used. The details are as follows: When SPA_Proxy receives the SPA data packet sent by SPA_Client, it returns the server's address and port to SPA_Client. After SPA_Client receives the server's address and port number, it uses port CC to send a data packet to the server's address and port number. Because no connection was established before, the firewall on the server will discard the data packet, but the data packet sent from the server to the client's CC port will be received by the client firewall.

[0040] SPA_Proxy forwards the SPA data packet received from SPA_Client to the server. SPA_Server on the server resolves the client address and port number and uses port SC to send a data packet to the address. After that, the SC port can receive the message sent by the client.

[0041] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is defined by the attached claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any figure mark in the claims should not be regarded as limiting the claims involved.

[0042] In addition, it should be understood that although this specification is described in accordance with the implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation modes that can be understood by those skilled in the art. The above content is only to illustrate the technical idea of ​​the present invention, and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution according to the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A remote service access method based on single packet authorization and reverse connection, characterized in that: The method relates to a remote service access system based on single-packet authorization and reverse connection, the system includes a client, an intermediate server and a server, wherein the client and the server are located in an intranet, and the intermediate server is located in an extranet, and the method includes the following steps: S1. The server sends a SPA data packet to the intermediate server through the first port. The server firewall maps a new port according to the first port to send the SPA data packet. The intermediate server decrypts and verifies the SPA data packet. After successful verification, the address and port of the corresponding server are updated. S2. The client sends a SPA data packet to the intermediate server through the second port. The client firewall maps a new port according to the second port to send the SPA data packet. The intermediate server decrypts and verifies the SPA data packet from the client. After successful verification, it updates the address and port of the corresponding client and forwards the SPA data packet to the server. S3. The server decrypts and verifies the SPA data packet from the client. After the verification is passed, the server resends the SPA data packet to the intermediate server through the third port. The server firewall maps a new port based on the third port to send the SPA data packet. S4, the intermediate server forwards the SPA data packet from the server to the client, and the client decrypts and verifies the SPA data packet. After the verification is passed, the client sends a service request to the intermediate server through the fourth port, and the client firewall maps a new designated port according to the fourth port to send the service request; S5. The intermediate server forwards the business request from the client to the server. The server obtains the application data through the third specific port and sends a response to the intermediate server. The intermediate server forwards the response to the client, thereby establishing a trusted connection between the client and the server.

2. According to claim 1, a remote service access method based on single packet authorization and reverse connection is characterized in that: The SPA data packet is sent encrypted, wherein the SPA data includes one or more of a version number, a request type, user identity information, a client ID, a server ID, a timestamp, and a signature.

3. According to claim 2, a remote service access method based on single packet authorization and reverse connection is characterized in that: The user identity information includes the user's username or ID.

4. According to claim 2, a remote service access method based on single packet authorization and reverse connection is characterized in that: The signature is generated by a pre-shared key and a random number.

5. According to claim 1, a remote service access method based on single packet authorization and reverse connection is characterized in that: In step S3, the server firewall will map a new port according to the first port to receive the SPA data packet and forward it to the server through the first port.

6. According to claim 1, a remote service access method based on single packet authorization and reverse connection is characterized in that: In step S4, the client firewall maps a new port according to the second port, receives the SPA data packet from the intermediate server, and forwards it to the client through the second port.

7. According to claim 1, a remote service access method based on single packet authorization and reverse connection is characterized in that: In step S5, the server firewall maps a new port according to the third port to receive the service request from the client and forwards it to the server through the third port; The intermediate server forwards the response to the client firewall, and the client firewall forwards it to the client based on a new designated port mapped by the fourth port.

8. According to claim 1, a remote service access method based on single packet authorization and reverse connection is characterized in that: The third port of the server establishes a connection with the fourth port of the client.

9. According to claim 1, a remote service access method based on single packet authorization and reverse connection is characterized in that: The intermediate server in step S1 will create a server list, which will record the server firewall address, the server firewall mapping a new port according to the first port, and the address and the first port of the corresponding server ID.

10. A remote service access method based on single packet authorization and reverse connection according to claim 1, characterized in that: The intermediate server in step S3 will create a server list, which will record the client firewall address, the client firewall mapping a new port according to the second port, and the address and the second port corresponding to the client ID.

Images