Network security protection method and system based on password technology

Abstract

The invention relates to the technical field of network security, in particular to a network security protection method and system based on the cryptographic technology, and the method comprises the steps: 1, obtaining a network topology structure, and setting a network security protection boundary; 2, constructing a password block, wherein the password block comprises a unique identifier, data content and metadata; 3, constructing a plurality of mobile spaces, distributing the plurality of mobile spaces in different physical positions and logic areas of the network, covering the whole network through the plurality of mobile spaces, and covering a plurality of network connection nodes by each mobile space; 4, putting a plurality of password blocks into the mobile space, wherein the number of the password blocks is not less than that of the network nodes; 5, according to a preset moving strategy, controlling the password block to move dynamically among the moving spaces and controlling each moving space to move dynamically in the network security protection boundary; the mobility policy is triggered based on a network event and / or based on a time.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security prevention method and system based on cryptographic technology. Background Art

[0002] Existing technologies use cryptographic technology for identity authentication and access control, which is the basis for ensuring that only authorized users can access sensitive information or key resources. By implementing strong password policies, such as requiring the use of complex passwords that are long and contain a combination of uppercase letters, lowercase letters, numbers and special characters, the difficulty of illegal cracking can be significantly increased. At the same time, in complex application scenarios such as temporary networking and dynamic networks, cryptographic technology also plays an important role, which can achieve the integration and unified supervision of network security resources, ensuring that a high level of security can be maintained even in a constantly changing environment.

[0003] To further enhance security, many companies choose to use Advanced Cryptography Standard Modules (HSMs) to store and manage keys. HSMs are devices or software solutions designed specifically to perform cryptographic operations and provide physical security. By storing keys in HSMs, strict access control can be achieved to the keys, effectively preventing unauthorized personnel from obtaining these valuable assets. In addition, regular key updates are also an integral part of maintaining system security; comprehensive audit monitoring helps to identify potential risk points in a timely manner and take appropriate measures to deal with them.

[0004] However, it is worth noting that although the above methods are very effective in enhancing the security of a single account, with the development of computing power, especially supercomputer technology, it is difficult to completely resist attacks from malicious attackers by simply increasing the complexity of passwords. Therefore, how to adopt a more flexible and dynamic protection strategy from the perspective of the entire network system to increase the possibility of successful intrusion of each node has become one of the key issues that need to be solved urgently. Summary of the invention

[0005] The present invention sets up multiple cipher blocks, each of which contains a unique identifier, data content, and some metadata (such as timestamp, hash value, etc.). In order to enhance the security of the network, we define multiple cipher block mobile spaces. These spaces can be distributed in different physical locations or logical areas to increase the difficulty for attackers to obtain all cipher blocks. By dynamically moving cipher blocks between multiple mobile spaces, we can ensure that each connected part of the system is protected. Even if a mobile space is compromised, other spaces remain secure.

[0006] The technical solution proposed by the present invention is: a network security prevention method based on cryptographic technology, the method comprising: Step 1: Obtain the network topology and set the network security boundary; Step 2: construct a cryptographic block, wherein the cryptographic block includes a unique identifier, data content, and metadata; Step 3: Build multiple mobile spaces and distribute them in different physical locations and logical areas of the network. Cover the entire network with multiple mobile spaces, and each mobile space covers multiple network connection nodes. Step 4: Put multiple cipher blocks into the mobile space, and the number of the cipher blocks is not less than the number of network nodes; Step 5: According to the preset movement strategy, control the dynamic movement of the cipher block between various movement spaces and control the dynamic movement of each movement space within the network security prevention boundary; The mobility strategy is triggered based on network events and / or time, and the network events include network attack events and network communication failure events.

[0007] Preferably, the obtaining of the network topology structure and setting of the network security prevention boundary includes: Use the Simple Network Management Protocol (SNMP) to obtain the IP address and connection status of the target device in the network; Returns a NetworkX graph object, which represents the topology of the network. Use the API interface or configuration commands to set firewall rules for each node in the network topology; Identify the central nodes of the network topology and visualize the central nodes and edges.

[0008] Preferably, the building block comprises: Create a block and assign a unique identifier to each block; Add a creation timestamp to each block; Add proof of work to the block and calculate the hash value of the current block through the SHA-256 cryptographic hash function; Add a nonce value to each block, and adjust the nonce value to find a hash value under preset conditions to verify the integrity of the block; Verify the validity of blocks through the workload mechanism; The multiple blocks are organized into a linked list structure, wherein the cipher block includes multiple linked list structures.

[0009] Preferably, the constructing of multiple mobile spaces and distributing the multiple mobile spaces in different physical locations and logical areas of the network includes: Setting up multiple virtual environments, each of which includes computing resources, storage resources, and network resources; Allocate mobile space to different physical locations of the network based on the network's geographical information or network latency indicators; Through the load balancing algorithm, network requests are distributed to different mobile spaces; A plurality of synchronous data areas and asynchronous data areas are set in each mobile space, and data in the synchronous data areas in different mobile spaces are synchronized.

[0010] Preferably, the step of setting a plurality of synchronous data areas and asynchronous data areas in each mobile space and synchronizing data in the synchronous data areas in different mobile spaces includes: Synchronize data in synchronization data areas of different mobile spaces through distributed transactions or consensus algorithms; The data that does not require strong consistency is stored in the asynchronous data area, and the data that does not require strong consistency is returned after being written locally; Through the load balancing algorithm, network requests are distributed to different physical locations based on the geographical information of each node in the network or the network delay index.

[0011] Preferably, synchronizing data in synchronization data areas of different mobile spaces by distributed transactions or consensus algorithms includes: Select a central node, process write operations through the central node, and synchronize data to other nodes in the network; Alternatively, multiple nodes are selected to process write operations through multiple nodes, and the data consistency between multiple nodes and other nodes that are not selected is ensured through a conflict approach mechanism; Alternatively, a distributed transaction processing protocol is used to maintain consistency in operations among multiple nodes in the network.

[0012] Preferably, the entire network is covered by multiple mobile spaces, each mobile space covers multiple network connection nodes, including: Get network node information and connection information of each node; Creating a network node set, wherein the network node set includes all network node information and connection information of the network; Create an empty list to store the final moving space; Use a greedy algorithm to select the moving space that covers the most uncovered nodes and store it in an empty list; Update the network node set, remove the covered nodes, and stop iterating when the network node set is empty.

[0013] Preferably, controlling the dynamic movement of the cipher blocks between the various mobile spaces and controlling the dynamic movement of the various mobile spaces within the network security prevention boundary according to the preset mobile strategy includes: Get the IP information and connection information of each node in the network topology; Randomly generate a multidimensional time series one; copy the multidimensional time series one to generate multiple multidimensional time copy series one; Encrypting the multidimensional time replication sequence one to generate a multidimensional time encryption sequence one; Selecting one or more cipher blocks according to a time point within a multidimensional time series; Randomly select a node in the moving space, and move the selected one or more cipher blocks to the selected node; Copying the multidimensional time encryption sequence 1 to the selected node, so as to select the cipher block of the current node according to the time point in the multidimensional time encryption sequence 1 and move it to the next randomly selected node; Repeat the above steps until all time points in the multi-dimensional time encryption sequence 1 are used; Obtaining the location information and size of the current mobile space, wherein the location information of the current mobile space is the geographical location information or IP information of the central node of the current mobile space; Randomly generate a multidimensional sequence ,in, , Respectively represent The switching time and Switch positions; Randomly select a movement space; Select a switching time point in the multidimensional sequence, and move the mobile space to the switching position at the switching time; If the mobile space exceeds the network security prevention boundary after moving to the switching position; Calculate the area beyond the boundary. If the area is less than the preset safety area threshold, the move is considered valid; otherwise, select a new moving space.

[0014] The present invention also provides a network security prevention system based on cryptographic technology, and the system is used to execute the network security prevention method based on cryptographic technology.

[0015] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the network security prevention method based on cryptographic technology.

[0016] Beneficial effects of the present invention: 1. The present invention constructs a topology diagram of the entire network by analyzing network devices, connection nodes, and the connection relationships between them. According to the network topology, one or more security areas (such as subnets) are defined, which will serve as the boundaries of network security to prevent unauthorized access. A unique identifier is assigned to each cipher block to distinguish different cipher blocks. Multiple mobile spaces are created in different physical locations and logical areas of the network. Ensure that each mobile space can cover multiple network connection nodes to achieve comprehensive coverage of the entire network.

[0017] 2. The present invention controls the dynamic movement of the cipher block between various mobile spaces and controls the dynamic movement of each mobile space within the network security prevention boundary according to a preset mobile strategy, so as to increase the difficulty of tracking by attackers. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 The present invention is a flowchart of a network security prevention method based on cryptographic technology. DETAILED DESCRIPTION

[0019] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art can think of other obvious variations. The basic principles of the present invention defined in the following description can be applied to other embodiments, variations, improvements, equivalents, and other technical solutions that do not deviate from the spirit and scope of the present invention.

[0020] It is to be understood that the term "one" should be understood as "at least one" or "one or more", that is, in one embodiment, the number of an element may be one, while in another embodiment, the number of the element may be multiple, and the term "one" should not be understood as a limitation on the quantity.

[0021] refer to Figure 1 The technical solution provided by the present invention is: a network security prevention method based on cryptographic technology, comprising the following steps: Step 1: Obtain the network topology and set the network security boundary, including the following steps: Use the Simple Network Management Protocol (SNMP) to obtain the IP address and connection status of the target device in the network; return a NetworkX graph object, and use the NetworkX graph object to represent the topology of the network; use the API interface or configuration commands to set firewall rules for each node in the network topology; identify the central node of the network topology, and visualize the central node and boundaries.

[0022] Step 2: Construct a cipher block, which includes a unique identifier, data content and metadata; the data content is the actual data information stored, which can be encrypted data. The metadata includes the creation time, last modification time, mobile space and other information of the cipher block. Specifically, the following steps are included:

[0023] Create a block and assign a unique identifier to each block; add a creation timestamp to each block; Add proof of work to the block and calculate the hash value of the current block through the SHA-256 cryptographic hash function; A nonce value is added to each block, and a hash value under preset conditions is found by adjusting the nonce value to verify the integrity of the block; the validity of the block is verified through a workload mechanism; and multiple blocks are organized into a linked list structure, wherein the cipher block includes multiple linked list structures.

[0024] Step 3: Build multiple mobile spaces, distribute the multiple mobile spaces in different physical locations and logical areas of the network, cover the entire network through multiple mobile spaces, and each mobile space covers multiple network connection nodes, including the following steps: Setting a plurality of virtual environments, each of the virtual environments comprising computing resources, storage resources and network resources; Allocate mobile space to different physical locations of the network based on the network's geographical information or network latency indicators; Through the load balancing algorithm, network requests are distributed to different mobile spaces; multiple synchronous data areas and asynchronous data areas are set in each mobile space to synchronize the data in the synchronous data areas of different mobile spaces, specifically: synchronize the data in the synchronous data areas of different mobile spaces through distributed transactions or consensus algorithms; The data that does not require strong consistency is stored in the asynchronous data area, and the data that does not require strong consistency is returned after being written locally; Through the load balancing algorithm, network requests are distributed to different physical locations based on the geographical information of each node in the network or the network delay index.

[0025] The so-called synchronization of data in the synchronization data area of ​​different mobile spaces through distributed transactions or consensus algorithms includes: Select a central node, process write operations through the central node, and synchronize data to other nodes in the network; Alternatively, multiple nodes are selected to process write operations through multiple nodes, and the data consistency between multiple nodes and other nodes that are not selected is ensured through a conflict approach mechanism; Alternatively, a distributed transaction processing protocol is used to maintain consistency in operations among multiple nodes in the network.

[0026] Wherein, the entire network is covered by multiple mobile spaces, and each mobile space covers multiple network connection nodes, including: Acquire network node information and connection information of each node; create a network node set, the network node set includes all network node information and connection information of the network; Create an empty list and use it to store the final moving space; use the greedy algorithm to select the moving space that covers the most uncovered nodes and store it in the empty list; Update the network node set, remove the covered nodes, and stop iterating when the network node set is empty.

[0027] Step 4: Put multiple cipher blocks into the mobile space, and the number of the cipher blocks is not less than the number of network nodes; Step 5: According to the preset movement strategy, control the dynamic movement of the cipher block between various movement spaces and control the dynamic movement of each movement space within the network security prevention boundary. The movement strategy is triggered based on network events and / or time. The network events include network attack events and network communication failure events. The following steps are included:

[0028] Get the IP information and connection information of each node in the network topology; Randomly generate a multidimensional time series one; copy the multidimensional time series one to generate multiple multidimensional time copy series one; Encrypting the multidimensional time replication sequence one to generate a multidimensional time encryption sequence one; Selecting one or more cipher blocks according to a time point within a multidimensional time series; Randomly select a node in the moving space, and move the selected one or more cipher blocks to the selected node; Copying the multidimensional time encryption sequence 1 to the selected node, so as to select the cipher block of the current node according to the time point in the multidimensional time encryption sequence 1 and move it to the next randomly selected node; Repeat the above steps until all time points in the multi-dimensional time encryption sequence 1 are used; Obtaining the location information and size of the current mobile space, wherein the location information of the current mobile space is the geographical location information or IP information of the central node of the current mobile space; Randomly generate a multidimensional sequence ,in, , Respectively represent The switching time and Switch positions; Randomly select a movement space; Select a switching time point in the multidimensional sequence, and move the mobile space to the switching position at the switching time; For example: define a two-dimensional grid, where each cell represents a possible location. Define a cryptographic block: it can be a data block or an encryption key, which needs to be moved in the mobile space. Multiple mobile spaces cover the entire network; the cryptographic block moves in the mobile space according to a preset path or a randomly generated path. The mobile space moves randomly within the network security defense boundary to change the position of the entire mobile space.

[0029] Define a boundary area. The so-called boundary can be a closed area formed by the connection lines of network nodes (end nodes) located at the edge of the network. All movement spaces and cipher block movements must be carried out within this area. Exceeding this boundary will be considered an illegal operation.

[0030] If the mobile space exceeds the network security prevention boundary after moving to the switching position; Calculate the area beyond the boundary. If the area is less than the preset safety area threshold, the move is considered valid; otherwise, select a new moving space.

[0031] If one or more cipher blocks in a network node are encryption keys, then cryptographic protection can be provided for the node. If one or more cipher blocks in each node are data blocks and encryption keys, then cryptographic protection can be improved for the node, and intruders can be prevented from obtaining all data blocks from a node, because data blocks are randomly distributed across multiple nodes, thereby improving network security protection.

[0032] The movement of cipher blocks and mobile spaces can also be triggered by events. For example, if the cipher block of a node is illegally obtained or cracked, one or more cipher blocks in a mobile space are moved to the corresponding node to protect the connection of the node.

[0033] Similarly, if multiple nodes in a mobile area are destroyed, the computing resources and network resources in the mobile space are transferred to another mobile space. By moving the mobile space, the destroyer cannot use the computing resources and network resources in the mobile space, and thus cannot use the network nodes in the mobile space to attack other mobile spaces in the network. At the same time, when the mobile space moves, the data in the synchronization data area is copied to the new location, and the data in the original location is deleted; the data consistency during the movement can be ensured through a lock mechanism or transaction, so that the attacker cannot obtain the data in the synchronization data area; by choosing synchronous data movement, the amount of data movement is reduced, and the data movement speed can be increased.

[0034] The present invention also provides a network security prevention system based on cryptographic technology, and the system is used to execute the network security prevention method based on cryptographic technology.

[0035] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the network security prevention method based on cryptographic technology.

[0036] In the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. The embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part, and / or installed from a removable medium. When the computer program is executed by the central processing unit (CPU), the above functions defined in the method of the present application are executed. It should be noted that the computer-readable medium mentioned above in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more wire segments, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, electrical wire, optical cable, RF, etc., or any suitable combination of the foregoing.

[0037] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in a different order than the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0038] Those skilled in the art should understand that the embodiments of the present invention described above and shown in the accompanying drawings are only examples and do not limit the present invention. The objectives of the present invention have been fully and effectively achieved. The functions and structural principles of the present invention have been demonstrated and explained in the embodiments. Without departing from the principles, the implementation methods of the present invention may be subject to any changes or modifications.

Claims

1. A network security prevention method based on cryptographic technology, characterized in that: The method comprises: Step 1: Obtain the network topology and set the network security boundary; Step 2: construct a cryptographic block, wherein the cryptographic block includes a unique identifier, data content, and metadata; Step 3: Build multiple mobile spaces and distribute them in different physical locations and logical areas of the network. Cover the entire network with multiple mobile spaces, and each mobile space covers multiple network connection nodes. Step 4: Put multiple cipher blocks into the mobile space, and the number of the cipher blocks is not less than the number of network nodes; Step 5: According to the preset movement strategy, control the dynamic movement of the cipher block between various movement spaces and control the dynamic movement of each movement space within the network security prevention boundary; The mobility strategy is triggered based on network events and / or time, and the network events include network attack events and network communication failure events.

2. A network security prevention method based on cryptographic technology according to claim 1, characterized in that: The obtaining of the network topology structure and setting of the network security prevention boundary include: Use the Simple Network Management Protocol (SNMP) to obtain the IP address and connection status of the target device in the network; Returns a NetworkX graph object, which represents the topology of the network. Use the API interface or configuration commands to set firewall rules for each node in the network topology; Identify the central nodes of the network topology and visualize the central nodes and edges.

3. A network security prevention method based on cryptographic technology according to claim 2, characterized in that: The building block of the password includes: Create a block and assign a unique identifier to each block; Add a creation timestamp to each block; Add proof of work to the block and calculate the hash value of the current block through the SHA-256 cryptographic hash function; Add a nonce value to each block, and adjust the nonce value to find a hash value under preset conditions to verify the integrity of the block; Verify the validity of blocks through the workload mechanism; The multiple blocks are organized into a linked list structure, wherein the cipher block includes multiple linked list structures.

4. A network security prevention method based on cryptographic technology according to claim 3, characterized in that: The construction of multiple mobile spaces, distributing the multiple mobile spaces in different physical locations and logical areas of the network, includes: Setting up multiple virtual environments, each of which includes computing resources, storage resources, and network resources; Allocate mobile space to different physical locations of the network based on the network's geographical information or network latency indicators; Through the load balancing algorithm, network requests are distributed to different mobile spaces; A plurality of synchronous data areas and asynchronous data areas are set in each mobile space, and data in the synchronous data areas in different mobile spaces are synchronized.

5. A network security prevention method based on cryptographic technology according to claim 4, characterized in that: The method of setting a plurality of synchronous data areas and asynchronous data areas in each mobile space and synchronizing data in the synchronous data areas in different mobile spaces includes: Synchronize data in synchronization data areas of different mobile spaces through distributed transactions or consensus algorithms; The data that does not require strong consistency is stored in the asynchronous data area, and the data that does not require strong consistency is returned after being written locally; Through the load balancing algorithm, network requests are distributed to different physical locations based on the geographical information of each node in the network or the network delay index.

6. A network security prevention method based on cryptographic technology according to claim 5, characterized in that: The method of synchronizing data in synchronization data areas of different mobile spaces through distributed transactions or consensus algorithms includes: Select a central node, process write operations through the central node, and synchronize data to other nodes in the network; Alternatively, multiple nodes are selected to process write operations through multiple nodes, and the data consistency between multiple nodes and other nodes that are not selected is ensured through a conflict approach mechanism; Alternatively, a distributed transaction processing protocol is used to maintain consistency in operations among multiple nodes in the network.

7. A network security prevention method based on cryptographic technology according to claim 6, characterized in that: The entire network is covered by multiple mobile spaces, each mobile space covers multiple network connection nodes, including: Get network node information and connection information of each node; Creating a network node set, wherein the network node set includes all network node information and connection information of the network; Create an empty list to store the final moving space; Use a greedy algorithm to select the moving space that covers the most uncovered nodes and store it in an empty list; Update the network node set, remove the covered nodes, and stop iterating when the network node set is empty.

8. A network security prevention method based on cryptographic technology according to claim 7, characterized in that: The method of controlling the dynamic movement of the cipher block between the various mobile spaces and controlling the dynamic movement of the various mobile spaces within the network security prevention boundary according to the preset mobile strategy includes: Get the IP information and connection information of each node in the network topology; Randomly generate a multidimensional time series one; copy the multidimensional time series one to generate multiple multidimensional time copy series one; Encrypting the multidimensional time replication sequence one to generate a multidimensional time encryption sequence one; Select one or more cipher blocks according to time points within the multidimensional time series; Randomly select a node in the moving space, and move the selected one or more cipher blocks to the selected node; Copying the multidimensional time encryption sequence 1 to the selected node, so as to select the cipher block of the current node according to the time point in the multidimensional time encryption sequence 1 and move it to the next randomly selected node; Repeat the above steps until all time points in the multi-dimensional time encryption sequence 1 are used; Obtaining the location information and size of the current mobile space, wherein the location information of the current mobile space is the geographical location information or IP information of the central node of the current mobile space; Randomly generate a multidimensional sequence ,in, , Respectively represent The switching time and Switch positions; Also included: randomly selecting a movement space; Select a switching time point in the multidimensional sequence, and move the mobile space to the switching position at the switching time; If the mobile space exceeds the network security prevention boundary after moving to the switching position; Calculate the area beyond the boundary. If the area is less than the preset safety area threshold, the move is considered valid; otherwise, select a new moving space.

9. A network security prevention system based on cryptographic technology, characterized in that: The system is used to execute a network security prevention method based on cryptographic technology as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement a network security prevention method based on cryptographic technology as described in any one of claims 1 to 8.

Images