A remote service access method based on single packet authorization and reverse connection

Abstract

The application relates to the field of network security, in particular to a remote service access method based on single packet authorization and reverse connection; a server sends an SPA data packet to an intermediate server through a first port, a server firewall maps a new port according to the first port to send the SPA data packet, the intermediate server decrypts and verifies the SPA data packet, and after successful verification, the address and the port of the corresponding server are updated; the application provides a remote service access method based on single packet authorization and reverse connection, which not only realizes complete port hiding of the server end, thereby enhancing the security of the system, but also is suitable for a high-security demand scene in which a server is located behind a firewall and cannot or is not suitable for directly exposing a port.

Description

Technical Field

[0001] This invention relates to the field of network security, and specifically to a method for remote service access based on single-packet authorization and reverse connection. Background Technology

[0002] In existing network communication, clients typically initiate connection requests to servers. In this model, the server listens on a fixed port, waiting for client connections. However, this method is vulnerable to various forms of network attacks, such as vulnerability scanning and distributed denial-of-service (DDoS) attacks. Furthermore, in some cases, the presence of network firewalls makes direct external access to internal resources difficult. In intranet environments, reverse connections are generally used. This involves the server and client simultaneously connecting to a publicly accessible server. The client sends a request to an intermediary server, which uses the reverse connection established by the application server to relay the request to the server. However, once the reverse connection is established, a mapping is created between the intermediate server's port and the application server's port. Accessing the intermediate server's port directly accesses the corresponding port on the application server, thus reducing security.

[0003] Currently, to address the aforementioned issues, existing technologies primarily employ port sequence-based port knocking and single-packet authorization techniques. Port sequence-based port knocking requires the client to request a pre-defined sequence of ports before connecting to the actual server port. Once the server detects a client requesting these ports in the pre-defined order, it determines that the client is worthy of authorization and opens the corresponding service port to the client's IP address. In single-packet authorization, the client sends a single data packet to a specific server port to request access. The client integrates all necessary information into a single packet, simplifying the knocking process. The server verifies the device and user identity before opening the port, thus achieving "network stealth" and preventing attackers from accessing the port.

[0004] However, in both of these approaches, the client actively connects to the server. Even after successful verification, the server still needs to expose its port to the client. When multiple clients use the same IP address, the possibility of malicious attacks remains. Furthermore, exposing the port presents certain difficulties when the server does not have a public IP address. Summary of the Invention

[0005] To address the problems mentioned in the prior art, this invention proposes a remote service access method based on single-packet authorization and reverse connection, which can solve the problem of how to establish a trusted connection between the client and the server through single-packet authorization when the server is unwilling to expose its port or the server is behind a firewall and cannot expose its port.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] This invention discloses a remote service access method based on single-packet authorization and reverse connection. The method relates to a remote service access system based on single-packet authorization and reverse connection, the system comprising a client, an intermediate server, and a server, wherein the client and server are located on an intranet, and the intermediate server is located on an extranet. The method includes the following steps:

[0008] S1. The server sends an SPA data packet to the intermediate server through the first port. The server firewall will map a new port based on the first port to send the SPA data packet. The intermediate server decrypts and verifies the SPA data packet. After successful verification, it updates the address and port of the corresponding server.

[0009] S2. The client sends an SPA packet to the intermediate server through the second port. The client firewall maps a new port based on the second port and sends the SPA packet. The intermediate server decrypts and verifies the SPA packet from the client. After successful verification, it updates the address and port of the corresponding client and forwards the SPA packet to the server.

[0010] S3. The server decrypts and verifies the SPA data packet from the client. After successful verification, the server resends the SPA data packet to the intermediate server through the third port. The server firewall will map a new port based on the third port to send out the SPA data packet.

[0011] S4. The intermediate server forwards the SPA data packets from the server to the client. The client decrypts and verifies the SPA data packets. After successful verification, the client sends a business request to the intermediate server through port 4. The client firewall will map a new specified port based on port 4 to send the business request.

[0012] S5. The intermediate server forwards the business requests from the client to the server. After the server obtains the application data through a third specific port, it sends a response to the intermediate server. The intermediate server then forwards the response to the client, thus establishing a trusted connection between the client and the server.

[0013] As a further improvement of the present invention, the SPA data packet is sent in encrypted form, wherein the SPA data includes one or more of the following: version number, request type, user identity information, client ID, server ID, timestamp, and signature.

[0014] As a further improvement of the present invention, the user identity information includes the user's username or ID.

[0015] As a further improvement of the present invention, the signature is generated by a pre-shared key and a random number.

[0016] As a further improvement of the present invention, in step S3, the server firewall will map a new port according to the first port to receive SPA data packets and forward them to the server through the first port.

[0017] As a further improvement of the present invention, in step S4, the client firewall receives SPA packets from the intermediate server by mapping a new port according to the second port and forwards them to the client through the second port.

[0018] As a further improvement of the present invention, in step S5, the server firewall receives service requests from the client and forwards them to the server through the third port by mapping a new port based on the third port.

[0019] The intermediate server forwards the response to the client firewall, and the client firewall forwards it to the client by mapping a new specified port based on the fourth port.

[0020] As a further improvement of the present invention, a connection is established between the third port of the server and the fourth port of the client.

[0021] As a further improvement of the present invention, the intermediate server in step S1 will establish a server list, and the server list will record the server firewall address, the server firewall will map a new port to the address of the corresponding server ID and the first port according to the first port.

[0022] As a further improvement of the present invention, the intermediate server in step S3 will establish a server list, which will record the client firewall address, the client firewall will map a new port to the address and second port corresponding to the client ID based on the second port.

[0023] Compared with the prior art, the present invention achieves the following technical effects:

[0024] This invention proposes a remote service access method based on single-packet authorization and reverse connection, which not only achieves complete port hiding on the server side, thereby enhancing system security, but is also suitable for high-security scenarios where the server is behind a firewall and the port cannot or should not be directly exposed.

[0025] This method allows servers to securely establish reverse connections even under firewall protection, without opening any ports to the external network. It effectively avoids potential network attacks and unauthorized access risks, not only improving the security of reverse connection server access but also further expanding the server's stealth and flexibility in complex network environments, providing support for application scenarios that require highly confidential and stable communication. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the overall structure of the present invention. Detailed Implementation

[0027] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0028] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0029] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0030] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection, an electrical connection, or a communication connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0031] In this invention, unless otherwise explicitly specified and limited, "above" or "below" the second feature can include direct contact between the first and second features, or contact between the first and second features through another feature between them. Furthermore, "above," "over," and "on top" of the second feature includes the first feature being directly above or diagonally above the second feature, or simply indicates that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature includes the first feature being directly above or diagonally above the second feature, or simply indicates that the first feature is at a lower horizontal level than the second feature.

[0032] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0033] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0034] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0035] The accompanying drawings illustrate various structural schematic diagrams according to embodiments disclosed in this invention. These drawings are not to scale, and some details have been enlarged for clarity, and some details may have been omitted. The shapes of the various regions and layers shown in the drawings, as well as their relative sizes and positional relationships, are merely exemplary and may deviate from reality due to manufacturing tolerances or technical limitations. Furthermore, those skilled in the art can design regions / layers with different shapes, sizes, and relative positions as needed.

[0036] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0037] Example 1

[0038] like Figure 1As shown, this invention provides a remote service access method based on single-packet authorization and reverse connection. The method involves a remote service access system based on single-packet authorization and reverse connection. The system includes a client, an intermediate server, and a server, wherein the client and server are located on an intranet, and the intermediate server is located on an extranet. The method includes the following steps:

[0039] S1. The server sends an SPA data packet to the intermediate server through the first port. The server firewall will map a new port based on the first port to send the SPA data packet. The intermediate server decrypts and verifies the SPA data packet. After successful verification, it updates the address and port of the corresponding server.

[0040] S2. The client sends an SPA packet to the intermediate server through the second port. The client firewall maps a new port based on the second port and sends the SPA packet. The intermediate server decrypts and verifies the SPA packet from the client. After successful verification, it updates the address and port of the corresponding client and forwards the SPA packet to the server.

[0041] S3. The server decrypts and verifies the SPA data packet from the client. After successful verification, the server resends the SPA data packet to the intermediate server through the third port. The server firewall will map a new port based on the third port to send out the SPA data packet.

[0042] S4. The intermediate server forwards the SPA data packets from the server to the client. The client decrypts and verifies the SPA data packets. After successful verification, the client sends a business request to the intermediate server through port 4. The client firewall will map a new specified port based on port 4 to send the business request.

[0043] S5. The intermediate server forwards the business requests from the client to the server. After the server obtains the application data through a third specific port, it sends a response to the intermediate server. The intermediate server then forwards the response to the client, thus establishing a trusted connection between the client and the server.

[0044] The specific implementation method is as follows: Figure 1 As shown, the client is located on intranet 1, the server is located on intranet 2, and the intermediate server is located on the public network.

[0045] This invention comprises the following software components: a single-package authorization client software SPA_Client, a single-package authorization server software SPA_Server, and an intermediate server software SPA_Proxy. SPA_Client is deployed on clients A and B, SPA_Proxy is deployed on intermediate server M, and SPA_Server is deployed on server S. The targets of this solution are the business client (Client) and the business server (Server), which are deployed on clients A and B and server S, respectively.

[0046] The SPA_Client is responsible for generating and validating SPA data packets, and starting the business client. The SPA_Server is responsible for sending and validating SPA data packets, establishing reverse connections, receiving business requests from intermediate servers, initiating requests to the business server (Server) via the local address, and returning business responses via the reverse connection. The SPA_Proxy is responsible for establishing the connection between the client and the server.

[0047] Before starting, the server and client should pre-share the keys used for SPA encryption / decryption and digital signatures. The entire service communication proceeds as follows:

[0048] 1. Server 192.168.100.10 sends SPA packets (format shown in Table 1) to a specific port of intermediate server M (address 218.0.0.1) at fixed intervals via a random port Psa. When server S sends data to intermediate server M through firewall F2, firewall F2 maps the server's internal network address + port number to an external network port. Without loss of generality, assume server S uses port 10 to send information; its internal network address 192.168.100.10:10 is mapped to 217.0.0.1:50010 on the external network of firewall F2. At this time, 217.0.0.1:50010 can receive data from intermediate server M and forward it to 192.168.100.10:10. The intermediate server maintains a server list, which records information such as server ID, source address and source port number of the SPA packet (actually the external network address and port of firewall F2). The intermediate server decrypts and verifies the SPA data packet. If the verification is successful, it will update the address and port of the corresponding server ID with the source address and source port of the SPA packet (the external address and port on firewall F2).

[0049] 2. Client A1 (address 10.0.0.10) on the internal network sends an SPA data packet (format shown in Table 1) to the intermediate server M. At this time, firewall F1 will map a port for the client on the external network port. Without loss of generality, assuming that the port used is 20, the internal network 10.0.0.10:20 is mapped on firewall F1 to the external network 219.0.0.1:50020. 219.0.0.1:50020 can receive data from the intermediate server and forward it to 10.0.0.10:20.

[0050] 3. The intermediate server decrypts and verifies the SPA data packet sent by client A. Based on the server ID and other information in the packet, and using the server list stored in the intermediate server, it forwards the SPA data packet to the external network address 217.0.0.1:50010 on firewall F2. At this time, firewall F2 forwards the data packet to server 192.168.100.10:10.

[0051] 4. After receiving the SPA data packet, server 192.168.100.10:10 first decrypts and verifies it. If the verification is successful, it confirms that the access is legitimate. The server's SPA_Server sends an SPA packet to the intermediate server M. The data packet contains the application server's identity information. At the same time, it initiates a connection to the intermediate server M using another random port 11. This port is mapped to 217.0.0.1:50011 on the external network interface of firewall F2.

[0052] 5. The intermediate server forwards the SPA data packet sent by server S to the external port 219.0.0.1:50020 of firewall F1. Firewall F1 forwards it to the internal client 10.0.0.10:20. The SPA_Client on the internal client verifies the SPA packet. When the verification is successful, the client initiates a connection to the intermediate server through the new port 21 and sends a business request. Port 21 is mapped to 219.0.0.1:50021 on firewall F1.

[0053] 6. The intermediate server receives the business request from the client and forwards it to the internal network server 192.168.100.10:11 through firewall F2 address 217.0.0.1:50011. The SPA_Server program on the server obtains application data through the local port and returns it to the intermediate server M through 192.168.100.10:11. The intermediate server forwards the response to firewall F1 address 219.0.0.1:50021. The data received by firewall F1 address 219.0.0.1:50021 is forwarded to the internal network 10.0.0.1:21.

[0054] Thus, without exposing the ports, a connection is established between client A's port 21 and server S's port 11 through an intermediate server. At the same time, when the server authorizes client A, client B cannot use that authorization to communicate with server S.

[0055] In this embodiment, the SPA data packets used should be sent in encrypted form, and the SPA data packets should contain at least the following information:

[0056]

[0057] Table 1

[0058] Example 2

[0059] This embodiment is basically the same as Embodiment 1, except that the present invention provides a new solution that can also be implemented using NAT hole punching when the network meets the requirements of full cone NAT, address-restricted NAT, or port-restricted NAT. Details are as follows:

[0060] When SPA_Proxy receives the SPA data packet from SPA_Client, it returns the server's address and port to SPA_Client. After receiving the server's address and port number, SPA_Client uses port CC to send a data packet to that server's address and port number. Because no connection has been established before, the firewall on the server will drop the data packet. However, subsequent data packets sent from the server to the client's CC port will be received by the client's firewall.

[0061] SPA_Proxy forwards the SPA packets received from SPA_Client to the server. SPA_Server on the server parses the client's address and port number, and sends a packet to that address using port SC. Afterward, port SC can receive messages from the client.

[0062] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the scope of the invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0063] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can be appropriately combined to form other embodiments that can be understood by those skilled in the art. The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention.

Claims

1. A remote service access method based on single-packet authorization and reverse connection, characterized in that, This method relates to a remote service access system based on single-packet authorization and reverse connection. The system includes a client, an intermediate server, and a server, wherein the client and server are located on an intranet, and the intermediate server is located on an extranet. The method includes the following steps: S1. The server sends an SPA data packet to the intermediate server through the first port. The server firewall will map a new port based on the first port to send the SPA data packet. The intermediate server decrypts and verifies the SPA data packet. After successful verification, it updates the address and port of the corresponding server. S2. The client sends an SPA packet to the intermediate server through the second port. The client firewall maps a new port based on the second port and sends the SPA packet. The intermediate server decrypts and verifies the SPA packet from the client. After successful verification, it updates the address and port of the corresponding client and forwards the SPA packet to the server. S3. The server decrypts and verifies the SPA data packet from the client. After successful verification, the server resends the SPA data packet to the intermediate server through the third port. The server firewall will map a new port based on the third port to send out the SPA data packet. S4. The intermediate server forwards the SPA data packets from the server to the client. The client decrypts and verifies the SPA data packets. After successful verification, the client sends a business request to the intermediate server through port 4. The client firewall will map a new specified port based on port 4 to send the business request. S5. The intermediate server forwards the business requests from the client to the server. After the server obtains the application data through a third specific port, it sends a response to the intermediate server. The intermediate server then forwards the response to the client, thus establishing a trusted connection between the client and the server.

2. The remote service access method based on single-packet authorization and reverse connection according to claim 1, characterized in that, SPA data packets are sent in encrypted form. The SPA data includes one or more of the following: version number, request type, user identity information, client ID, server ID, timestamp, and signature.

3. The remote service access method based on single-packet authorization and reverse connection according to claim 2, characterized in that, The user identity information includes the user's username or ID.

4. The remote service access method based on single-packet authorization and reverse connection according to claim 2, characterized in that, The signature is generated from a pre-shared key and a random number.

5. The remote service access method based on single-packet authorization and reverse connection according to claim 1, characterized in that, In step S3, the server firewall will map a new port based on the first port to receive SPA packets and forward them to the server through the first port.

6. The remote service access method based on single-packet authorization and reverse connection according to claim 1, characterized in that, In step S4, the client firewall maps a new port based on the second port, receives SPA packets from the intermediate server, and forwards them to the client through the second port.

7. The remote service access method based on single-packet authorization and reverse connection according to claim 1, characterized in that, In step S5, the server firewall maps a new port based on the third port, receives service requests from clients, and forwards them to the server through the third port. The intermediate server forwards the response to the client firewall, and the client firewall forwards it to the client by mapping a new specified port based on the fourth port.

8. The remote service access method based on single-packet authorization and reverse connection according to claim 1, characterized in that, A connection was established between the server's third port and the client's fourth port.

9. The remote service access method based on single-packet authorization and reverse connection according to claim 1, characterized in that, In step S1, the intermediate server will create a server list. The server list will record the server firewall address and the server firewall will map a new port to the address and first port of the corresponding server ID based on the first port.

10. The remote service access method based on single-packet authorization and reverse connection according to claim 1, characterized in that, In step S3, the intermediate server will create a server list. The server list will record the client firewall address, and the client firewall will map a new port to the address and second port corresponding to the client ID based on the second port.

Images