Communication method based on dynamic port

Abstract

The invention discloses a communication method based on a dynamic port, and the method comprises the steps: enabling a client to determine a current first target port number according to a preset first period, a seed value pre-negotiated by the client and an edge node, and a current first timestamp, employing a Hash message authentication code in combination with an encryption algorithm, and enabling the current first target port number to be transmitted to an edge node; and the client switches to the first target port number to communicate with the edge node. A client negotiates a seed value in advance with an edge node. And according to the seed value and the current first timestamp, determining a current first target port number by adopting a Hash message authentication code in combination with an encryption algorithm. The port numbers determined by the client and the edge node at the current moment are ensured to be the same, so that the client and the edge node can normally communicate. Moreover, the timestamps corresponding to different periods are different, so that the target port numbers determined in different periods are different. The port scanning attack risk is reduced, and the security of network communication is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a communication method based on dynamic ports. Background Art

[0002] In current network communications, data transmission between clients and edge nodes typically relies on fixed ports. The basic process of this model is as follows: Connection Establishment: The client initiates a Transmission Control Protocol (TCP) connection request to the edge node (or server). This process includes a three-way handshake, namely the exchange of SYN, SYN-ACK, and ACK packets, to ensure that both parties are ready and agree to begin communication. SYN (Synchronous): The handshake signal used when establishing a connection represents a connection request or connection acceptance message. SYN-ACK (Synchronize-Acknowledgement) indicates receipt of the SYN message and is sent in response to an acknowledgment. ACK (Acknowledgement) is an acknowledgment packet, confirming receipt of the other party's data. Data Transmission: Once the connection is established, the client and edge node exchange data using predefined fixed port numbers. This ensures that each data transmission accurately locates the other party. Connection Keepalive: To maintain a long-term connection and prevent disconnection due to network instability, both parties periodically send heartbeat packets to keep the connection active. These heartbeat packets are also sent over the same fixed port number.

[0003] The above technical solution has the following problems: Because it uses fixed port numbers for communication, simple port scanning tools can easily discover open ports and attempt further attacks, such as distributed denial of service (DDoS) attacks or direct data theft. Port scanning attacks are risky and network communication security is poor. Summary of the Invention

[0004] The present application provides a communication method based on dynamic ports to solve the problem of poor security of network communications in the prior art.

[0005] In a first aspect, the present application provides a communication method based on a dynamic port, applied to a client, the method comprising:

[0006] According to a preset first period, based on a seed value pre-negotiated between the client and the edge node and a current first timestamp, a hash message authentication code combined with an encryption algorithm is used to determine the current first target port number;

[0007] The client switches to the first target port number to communicate with the edge node.

[0008] The above technical solution has the following advantages or beneficial effects:

[0009] To address the high risk of port scanning attacks and poor network communication security associated with communication between a client and an edge node using fixed ports, this application proposes a solution in which the client and edge node dynamically update their communication ports according to a preset first period and continue communicating based on the updated port. Specifically, the client determines the current first target port number using a hash message authentication code combined with an encryption algorithm based on a seed value pre-negotiated between the client and the edge node and the current first timestamp during the preset first period. The client then switches to the first target port number to communicate with the edge node. Time synchronization is performed during communication between the client and the edge node, and a seed value is pre-negotiated between the client and the edge node. Based on the seed value and the current first timestamp, a hash message authentication code combined with an encryption algorithm is used to determine the current first target port number. This ensures that the port numbers determined by the client and edge node are the same at the current moment, enabling normal communication between the client and edge node. Furthermore, because different periods correspond to different timestamps, the target port numbers determined for different periods are also different. This enables communication between the client and edge node based on dynamic ports, reducing the risk of port scanning attacks and improving the security of network communication.

[0010] In an optional embodiment, determining the current first target port number using a hash message authentication code combined with an encryption algorithm based on a seed value pre-negotiated between the client and the edge node and the current first timestamp includes:

[0011] Obtaining a first packet loss rate of a current network between the client and the edge node;

[0012] The current first target port number is determined based on a seed value pre-negotiated between the client and the edge node, a current first timestamp, and the first packet loss rate, using a hash message authentication code combined with an encryption algorithm.

[0013] In an optional implementation, the determining the current first target port number by using a hash message authentication code in combination with an encryption algorithm includes:

[0014] The hash message authentication code is combined with an encryption algorithm to determine the current first port number;

[0015] According to the minimum port number and the maximum port number in the valid port number range, the first port number is mapped to the valid port number range to determine the first target port number.

[0016] In an optional implementation, the process of pre-negotiating a seed value includes:

[0017] The client sends a first random number to the edge node; receives a second random number sent by the edge node; and performs a hash operation on the first random number and the second random number using a preset encryption algorithm to determine the seed value.

[0018] In an optional embodiment, the method further includes:

[0019] Sending a first heartbeat packet to the edge node according to a preset second period; wherein the first heartbeat packet carries a second port number currently communicating with the edge node and a current second timestamp;

[0020] If a second heartbeat packet sent by the edge node is received within a preset time period, it is confirmed that the communication connection status with the edge node is normal; wherein the second heartbeat packet is sent to the client when the edge node determines that the third port number currently used for communication with the client is the same as the second port number and that the current third timestamp matches the second timestamp;

[0021] If the second heartbeat packet sent by the edge node is not received within the preset time, a reconnection mechanism is triggered; and the data packet that was not successfully sent is cached. When it is determined that the client is successfully reconnected with the edge node, the data packet is sent to the edge node.

[0022] In a second aspect, the present application provides a communication method based on a dynamic port, which is applied to an edge node, and the method includes:

[0023] According to the preset first period, based on the seed value pre-negotiated between the edge node and the client and the current fourth timestamp, a hash message authentication code combined with an encryption algorithm is used to determine the current second target port number;

[0024] The edge node switches to the second target port number to communicate with the edge node.

[0025] In an optional embodiment, determining the current second target port number using a hash message authentication code combined with an encryption algorithm based on a seed value pre-negotiated between the edge node and the client and the current fourth timestamp includes:

[0026] Obtaining a second packet loss rate of a current network between the client and the edge node;

[0027] The current second target port number is determined according to a seed value pre-negotiated between the client and the edge node, a current fourth timestamp, and the second packet loss rate, using a hash message authentication code combined with an encryption algorithm.

[0028] In an optional implementation, the determining the current second target port number by using a hash message authentication code in combination with an encryption algorithm includes:

[0029] The hash message authentication code is combined with an encryption algorithm to determine the current fourth port number;

[0030] According to the minimum port number and the maximum port number in the valid port number range, the fourth port number is mapped to the valid port number range to determine the second target port number.

[0031] In an optional implementation, the process of pre-negotiating a seed value includes:

[0032] Receive a first random number sent by the client; send a second random number to the client; use a preset encryption algorithm to perform a hash operation on the first random number and the second random number to determine the seed value.

[0033] In an optional embodiment, the method further includes:

[0034] Receiving a third heartbeat packet sent by the client according to a preset second period; wherein the third heartbeat packet carries a fifth port number and a current fifth timestamp for the client to currently communicate with the edge node;

[0035] If it is determined that the sixth port number currently communicating with the client is the same as the fifth port number, and it is determined that the current sixth timestamp matches the fifth timestamp, a fourth heartbeat packet is sent to the client; it is confirmed that the communication connection status with the client is normal; otherwise, a prompt message triggering a reconnection mechanism is sent to the client; and after the reconnection is successful, the cached data packet sent by the client that was not successfully sent is received.

[0036] In a third aspect, the present application provides a communication device based on a dynamic port, applied to a client, the device comprising:

[0037] A first determination module is configured to determine a current first target port number according to a seed value pre-negotiated between the client and the edge node and a current first timestamp using a hash message authentication code combined with an encryption algorithm according to a preset first period;

[0038] The first communication module is configured to switch to the first target port number to communicate with the edge node.

[0039] The first determination module is specifically used to obtain the first packet loss rate of the current network between the client and the edge node; based on the seed value pre-negotiated between the client and the edge node, the current first timestamp and the first packet loss rate, a hash message authentication code combined with an encryption algorithm is used to determine the current first target port number.

[0040] The first determination module is specifically used to determine the current first port number by using a hash message authentication code combined with an encryption algorithm; map the first port number to the valid port number range based on the minimum port number and the maximum port number in the valid port number range to determine the first target port number.

[0041] The first determination module is further configured to cause the client to send a first random number to the edge node; receive a second random number sent by the edge node; and perform a hash operation on the first random number and the second random number using a preset encryption algorithm to determine the seed value.

[0042] The device further comprises:

[0043] A first sending module, configured to send a first heartbeat packet to the edge node according to a preset second period; wherein the first heartbeat packet carries a second port number currently communicating with the edge node and a current second timestamp;

[0044] A confirmation module is configured to confirm that the communication connection status with the edge node is normal if a second heartbeat packet sent by the edge node is received within a preset time period; wherein the second heartbeat packet is sent to the client when the edge node determines that the third port number currently communicating with the client is the same as the second port number and determines that the current third timestamp matches the second timestamp;

[0045] The reconnection module is used to trigger a reconnection mechanism if the second heartbeat packet sent by the edge node is not received within the preset time length; and cache the data packet that was not sent successfully. When it is determined that the client is successfully reconnected with the edge node, the data packet is sent to the edge node.

[0046] In a fourth aspect, the present application provides a dynamic port-based communication device, applied to an edge node, the device comprising:

[0047] A second determining module is configured to determine the current second target port number according to a preset first period, a seed value pre-negotiated between the edge node and the client, and a current fourth timestamp, using a hash message authentication code combined with an encryption algorithm;

[0048] The second communication module is configured to switch the edge node to the second target port number to communicate with the edge node.

[0049] The second determination module is specifically used to obtain the second packet loss rate of the current network between the client and the edge node; based on the seed value pre-negotiated between the client and the edge node, the current fourth timestamp and the second packet loss rate, a hash message authentication code combined with an encryption algorithm is used to determine the current second target port number.

[0050] The second determination module is specifically used to determine the current fourth port number by using a hash message authentication code combined with an encryption algorithm; map the fourth port number to the valid port number range based on the minimum port number and the maximum port number in the valid port number range to determine the second target port number.

[0051] The second determination module is further configured to receive a first random number sent by the client; send a second random number to the client; and perform a hash operation on the first random number and the second random number using a preset encryption algorithm to determine the seed value.

[0052] The device further comprises:

[0053] A receiving module, configured to receive a third heartbeat packet sent by the client according to a preset second period; wherein the third heartbeat packet carries a fifth port number for the client to currently communicate with the edge node and a current fifth timestamp;

[0054] The second sending module is used to send a fourth heartbeat packet to the client if it is determined that the sixth port number currently communicating with the client is the same as the fifth port number, and if it is determined that the current sixth timestamp matches the fifth timestamp; confirm that the communication connection status with the client is normal; otherwise, send a prompt message to the client to trigger a reconnection mechanism; and receive the cached unsuccessfully sent data packet sent by the client after the reconnection is successful.

[0055] In a fifth aspect, the present application provides an electronic device, comprising a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0056] Memory for storing computer programs;

[0057] The processor is used to implement the method when executing the program stored in the memory.

[0058] In a sixth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described is implemented.

[0059] In a seventh aspect, the present application provides a computer program product, wherein the computer program product includes an executable program, and the executable program is executed by a processor to implement the described method. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0061] Figure 1 A schematic diagram of communication based on fixed ports in the related art;

[0062] Figure 2 Schematic diagram of the first communication process based on dynamic ports provided by this application;

[0063] Figure 3 A schematic diagram of the process of determining the first target port number provided by the present application;

[0064] Figure 4 A schematic diagram of the second process for determining the first target port number provided by this application;

[0065] Figure 5 Flowchart of the connection keep-alive phase provided for this application;

[0066] Figure 6 A schematic diagram of the second communication process based on dynamic ports provided in this application;

[0067] Figure 7 Communication flow chart of the dynamic port randomization mechanism provided by this application;

[0068] Figure 8 This is a schematic diagram of the structure of the first communication device based on dynamic ports provided by this application;

[0069] Figure 9 A schematic diagram of the structure of the second communication device based on dynamic ports provided in this application;

[0070] Figure 10 This is a schematic diagram of the electronic device structure provided in this application. DETAILED DESCRIPTION

[0071] In order to make the purpose and implementation of this application clearer, the exemplary implementation of this application will be clearly and completely described below in conjunction with the drawings in the exemplary embodiments of this application. Obviously, the described exemplary embodiments are only part of the embodiments of this application, not all of the embodiments.

[0072] It should be noted that the brief descriptions of terms in this application are only for the purpose of facilitating the understanding of the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their ordinary and usual meanings.

[0073] In the specification and claims of this application and the accompanying drawings, the terms "first," "second," "third," etc. are used to distinguish similar or similar objects or entities, and are not necessarily intended to limit a particular order or sequence, unless otherwise noted. It should be understood that the terms used in this manner are interchangeable under appropriate circumstances.

[0074] The terms "comprise," "include," and "have," and any variations thereof, are intended to cover but not exclude inclusion; for example, a product or device comprising a list of components is not necessarily limited to all the components expressly listed but may include other components not expressly listed or inherent to such product or device.

[0075] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functionality associated with that element.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

[0077] For ease of explanation, the above description has been made with reference to specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or to limit the embodiments to the specific forms disclosed above. Based on the above teachings, various modifications and variations are possible. The above embodiments are selected and described to better explain the principles and practical applications, so that those skilled in the art can better utilize the embodiments and various different variations of the embodiments suitable for specific use considerations.

[0078] Figure 1 A communication diagram based on a fixed port in the related art is shown in FIG. Figure 1 As shown, it includes the connection establishment phase, the data transmission phase and the connection keep-alive phase.

[0079] During the connection establishment phase, the client sends a SYN packet (source port: random, destination port: fixed) to the edge node; the edge node sends a SYN-ACK packet (source port: fixed, destination port: random) to the client; the client sends an ACK packet to the edge node (confirming the connection); at this time, the client and the edge node write a fixed port (such as 8080).

[0080] During the data transmission phase, data is continuously exchanged between the client and the edge node. The client sends a data packet (source port: fixed, destination port: fixed) to the edge node; the edge node sends a response packet (source port: fixed, destination port: fixed) to the client.

[0081] During the connection keepalive phase, heartbeat checks are performed every T seconds. The client sends a heartbeat packet (fixed port, content: "ACK") to the edge node; the edge node sends a heartbeat response (fixed port, content: "ACK") to the client. If the heartbeat times out, a connection reset (reconnection mechanism) is triggered, which means re-starting the three-way handshake process during the connection establishment phase.

[0082] In the current field of network communications, data transmission between clients and edge nodes usually relies on fixed ports. The basic process of this model is as follows: Connection establishment: The client initiates a TCP connection request to the edge node (or server). This process includes a three-way handshake protocol, namely the exchange of SYN, SYN-ACK, and ACK packets to ensure that both parties are ready and agree to start communication. Data transmission: Once the connection is established, the client and edge node will exchange data through a pre-defined fixed port number. This ensures that each data transmission can accurately find the other party. Connection keepalive: In order to maintain a long-term connection and avoid connection interruption due to network instability, both parties will periodically send heartbeat packets to keep the connection active. These heartbeat packets are also sent through the same fixed port.

[0083] However, although this approach is simple and easy to implement, its inherent flaws are becoming increasingly apparent as cybersecurity threats become increasingly complex.

[0084] Based on the above existing technical solutions, there are the following major technical problems:

[0085] High risk of port scanning attacks: Since fixed port numbers are used for communication, hackers can easily discover open ports using simple port scanning tools and attempt further attacks, such as DDoS attacks or direct data theft.

[0086] Long-lasting connections are vulnerable to hijacking: Long-lasting TCP connections increase the risk of man-in-the-middle attacks. Once an attacker successfully inserts themselves into the communication flow, they can impersonate legitimate users and perform malicious operations.

[0087] Lack of effective anti-interference capabilities: Fixed port strategies make communication channels easy targets, especially when facing complex network environments and advanced persistent threats (APTs). Traditional methods are unable to provide adequate protection.

[0088] The core problem this application aims to solve is to significantly reduce the risk of port scanning attacks and prevent the possibility of long-term connection hijacking by introducing a dynamic port randomization mechanism. Specifically, by using a hash message authentication code combined with an encryption algorithm (HMAC-SHA256) to generate a pseudo-random port sequence and automatically switching communication ports according to preset periodic time intervals, the security and stability of network communications can be greatly improved without significantly affecting performance.

[0089] The terms used in this application are explained as follows:

[0090] SC (Service Classifier): Located at the edge of the SRV6 SFC service chain network, it is the source node of the service chain path. The SC can use different traffic diversion methods to direct service data into the SRV6 TE Policy tunnel for forwarding.

[0091] SPA (Single Packet Authorization): A network security technology used to hide service ports and prevent unauthorized access.

[0092] Dynamic port randomization: A technology that prevents port scanning and long-term connection hijacking by switching communication ports in a pseudo-random sequence.

[0093] HMAC-SHA256: Hash-based Message Authentication Code combined with the SHA-256 algorithm to generate a secure port sequence.

[0094] Seed value: The initial value determined by bidirectional negotiation and used to generate a pseudo-random port sequence.

[0095] Edge node: A network node located close to users or devices, typically used to accelerate data transmission and service response.

[0096] Figure 2 The first communication process diagram based on dynamic ports provided in this application, applied to the client, includes the following steps:

[0097] S101: According to a preset first period, based on a seed value pre-negotiated between the client and the edge node and a current first timestamp, a hash message authentication code combined with an encryption algorithm is used to determine a current first target port number;

[0098] S102: The client switches to the first target port number to communicate with the edge node.

[0099] In this application, before determining the current first target port number according to the preset first cycle, the client needs to establish a TCP connection with the edge node. That is, during the handshake phase, the client initiates a connection request (SYN) to the edge node; the edge node sends a SYN-ACK response to the connection request to the client; and the client sends an ACK confirmation to the edge node.

[0100] Then it enters the port switching phase. That is, the client determines the current first target port number according to the preset first period, based on the seed value pre-negotiated between the client and the edge node and the current first timestamp, using a hash message authentication code combined with an encryption algorithm; the client switches to the first target port number to communicate with the edge node. The preset first period is, for example, 1 second. That is, every 1 second, the client determines the current first target port number according to the seed value pre-negotiated between the client and the edge node and the current first timestamp, using a hash message authentication code combined with an encryption algorithm; the client switches to the first target port number to communicate with the edge node. That is, P(t) = HMAC-SHA256(S, t); where: S is the seed value determined by bidirectional negotiation; t is the current first timestamp, and at this time P(t) is the first target port number.

[0101] In this application, in order to further improve the security of determining the current first target port number, the method of determining the current first target port number by using a hash message authentication code combined with an encryption algorithm based on the seed value pre-negotiated between the client and the edge node and the current first timestamp includes:

[0102] Obtaining a first packet loss rate of a current network between the client and the edge node;

[0103] The current first target port number is determined based on a seed value pre-negotiated between the client and the edge node, a current first timestamp, and the first packet loss rate, using a hash message authentication code combined with an encryption algorithm.

[0104] Optionally, the method for obtaining the network packet loss rate may be to use the ping command, the ATKPING tool, the iperf tool, the MTR tool, the Wireshark tool, the GB / T32420-2015 "Wireless LAN Test Specification," the Network Emulator Toolkit tool, etc. Then, based on the seed value pre-negotiated between the client and the edge node, the current first timestamp, and the first packet loss rate, a hash message authentication code combined with an encryption algorithm is used to determine the current first target port number. That is, P(t) = HMAC-SHA256(S, t, PacketLossRate); where: S is the seed value determined by bidirectional negotiation; t is the current first timestamp; PacketLossRate represents the first packet loss rate of the current network, and P(t) is the first target port number.

[0105] In order to ensure that the determined first target port number is valid, in this application, the use of a hash message authentication code combined with an encryption algorithm to determine the current first target port number includes:

[0106] The hash message authentication code is combined with an encryption algorithm to determine the current first port number;

[0107] According to the minimum port number and the maximum port number in the valid port number range, the first port number is mapped to the valid port number range to determine the first target port number.

[0108] For example, the valid port number range is [1024, 65535]. The minimum port number in the valid port number range is 1024, and the maximum port number is 65535. Based on the minimum and maximum port numbers in the valid port number range, the first port number is mapped to the valid port number range, and the first target port number is determined as: Port = (P(t) mod (MaxPort - MinPort)) + MinPort; where MaxPort = 65535 and MinPort = 1024. In this case, P(t) is the first port number, and Port is the first target port number.

[0109] Figure 3 The first process of determining the first target port number provided in this application includes the following steps:

[0110] S201: Determine the current first port number using a hash message authentication code combined with an encryption algorithm based on a seed value pre-negotiated between the client and the edge node and the current first timestamp;

[0111] S202: Map the first port number to the valid port number range according to the minimum port number and the maximum port number in the valid port number range to determine the first target port number.

[0112] Figure 4 The second process for determining the first target port number provided in this application includes the following steps:

[0113] S301: Obtain a first packet loss rate of the current network between the client and the edge node; determine a current first port number using a hash message authentication code combined with an encryption algorithm based on a seed value pre-negotiated between the client and the edge node, a current first timestamp, and the first packet loss rate;

[0114] S302: Map the first port number to the valid port number range according to the minimum port number and the maximum port number in the valid port number range to determine the first target port number.

[0115] In this application, the process of pre-negotiating the seed value includes:

[0116] The client sends a first random number to the edge node; receives a second random number sent by the edge node; and performs a hash operation on the first random number and the second random number using a preset encryption algorithm to determine the seed value.

[0117] The seed value is determined during the handshake phase. Specifically, the client initiates a connection request SYN to the edge node; the edge node sends a response connection request SYN-ACK to the client; the client sends a connection confirmation ACK to the edge node; the client sends a first random number to the edge node; the edge node sends a second random number to the client; the client and the edge node calculate the seed value based on the random number they sent and the random number they received. That is, S = SHA-256 (R C ||R S ); SHA-256 (Secure Hash Algorithm 256-bit) is a secure hash algorithm, which is the above-mentioned preset encryption algorithm. c is the first random number; R s is the second random number; S is the seed value. At this point, the handshake between the client and the edge node is completed and a TCP connection is established.

[0118] Figure 5 The flowchart of the connection keep-alive phase provided for this application includes the following steps:

[0119] S401: Sending a first heartbeat packet to the edge node according to a preset second period; wherein the first heartbeat packet carries a second port number currently communicating with the edge node and a current second timestamp;

[0120] S402: If a second heartbeat packet sent by the edge node is received within a preset time period, confirming that the communication connection status with the edge node is normal; wherein the second heartbeat packet is sent to the client by the edge node when it determines that the third port number currently used for communication with the client is the same as the second port number and that the current third timestamp matches the second timestamp;

[0121] S403: If the second heartbeat packet sent by the edge node is not received within the preset time, a reconnection mechanism is triggered; and unsuccessful data packets are cached. When it is determined that the client is successfully reconnected with the edge node, the data packet is sent to the edge node.

[0122] To address the high risk of port scanning attacks and poor network communication security associated with communication between a client and an edge node using fixed ports, this application proposes a solution in which the client and edge node dynamically update their communication ports according to a preset first period and continue communicating based on the updated port. Specifically, the client determines the current first target port number using a hash message authentication code combined with an encryption algorithm based on a seed value pre-negotiated between the client and the edge node and the current first timestamp during the preset first period. The client then switches to the first target port number to communicate with the edge node. Time synchronization is performed during communication between the client and the edge node, and a seed value is pre-negotiated between the client and the edge node. Based on the seed value and the current first timestamp, a hash message authentication code combined with an encryption algorithm is used to determine the current first target port number. This ensures that the port numbers determined by the client and edge node are the same at the current moment, enabling normal communication between the client and edge node. Furthermore, because different periods correspond to different timestamps, the target port numbers determined for different periods are also different. This enables communication between the client and edge node based on dynamic ports, reducing the risk of port scanning attacks and improving the security of network communication.

[0123] Figure 6 The second communication process diagram based on dynamic ports provided in this application is applied to edge nodes and includes the following steps:

[0124] S501: According to a preset first period, based on a seed value pre-negotiated between the edge node and the client and a current fourth timestamp, a hash message authentication code combined with an encryption algorithm is used to determine a current second target port number;

[0125] S502: The edge node switches to the second target port number to communicate with the edge node.

[0126] In an optional embodiment, determining the current second target port number using a hash message authentication code combined with an encryption algorithm based on a seed value pre-negotiated between the edge node and the client and the current fourth timestamp includes:

[0127] Obtaining a second packet loss rate of a current network between the client and the edge node;

[0128] The current second target port number is determined according to a seed value pre-negotiated between the client and the edge node, a current fourth timestamp, and the second packet loss rate, using a hash message authentication code combined with an encryption algorithm.

[0129] In an optional implementation, the determining the current second target port number by using a hash message authentication code in combination with an encryption algorithm includes:

[0130] The hash message authentication code is combined with an encryption algorithm to determine the current fourth port number;

[0131] According to the minimum port number and the maximum port number in the valid port number range, the fourth port number is mapped to the valid port number range to determine the second target port number.

[0132] The process of the edge node determining the second target port number is the same as the process of the client determining the first target port number, and will not be described in detail here.

[0133] In an optional implementation, the process of pre-negotiating a seed value includes:

[0134] Receive a first random number sent by the client; send a second random number to the client; use a preset encryption algorithm to perform a hash operation on the first random number and the second random number to determine the seed value.

[0135] The process of determining the seed value by the edge node is the same as the process of determining the seed value by the client, and will not be described in detail here.

[0136] In an optional embodiment, the method further includes:

[0137] Receiving a third heartbeat packet sent by the client according to a preset second period; wherein the third heartbeat packet carries a fifth port number and a current fifth timestamp for the client to currently communicate with the edge node;

[0138] If it is determined that the sixth port number currently communicating with the client is the same as the fifth port number, and it is determined that the current sixth timestamp matches the fifth timestamp, a fourth heartbeat packet is sent to the client; it is confirmed that the communication connection status with the client is normal; otherwise, a prompt message triggering a reconnection mechanism is sent to the client; and after the reconnection is successful, the cached data packet sent by the client that was not successfully sent is received.

[0139] In this application, during the connection establishment phase: the client establishes an initial connection with the edge node. A two-way negotiation is used to determine the seed value. During the port switching phase: the communication port is switched according to a pseudo-random sequence. The HMAC-SHA256 algorithm for generating the port sequence is improved, and timestamps and network status information (such as packet loss rate) are added. Dynamic port switching is implemented once per second to ensure the security and stability of the connection. During the connection keepalive phase: the connection is kept active through regular heartbeat packets. A heartbeat packet is sent after each port switch to confirm the connection status of both parties.

[0140] The present invention mainly solves the following technical problems:

[0141] High risk of port scanning attacks: Traditional fixed-port communication methods are susceptible to port scanning attacks, which may leak sensitive information. This application increases the difficulty of port scanning attacks and reduces exposure by using dynamic port randomization.

[0142] Long-lasting connections are vulnerable to hijacking: Long-lasting TCP connections can be easily hijacked by malicious attackers, compromising data transmission security. Frequent port switching increases the difficulty of connection hijacking and improves data transmission security.

[0143] Lack of effective anti-interference capabilities: Fixed port strategies make communication channels easy targets, especially in complex network environments and advanced persistent threats (APTs). Traditional methods cannot provide adequate protection. This application provides stronger anti-interference capabilities through dynamic port switching and heartbeat packet mechanisms.

[0144] The dynamic port randomization connection keepalive mechanism of this application is applicable to various network communication scenarios, especially in data transmission environments that require high security. The following are the main network element devices involved in this application and their communication connection relationships:

[0145] Network element equipment and function description:

[0146] Client device:

[0147] Function: Initiate connection requests with edge nodes and be responsible for generating and switching communication ports.

[0148] Form: It can be a terminal device such as a smartphone, tablet computer, or laptop computer.

[0149] Type: Supports multiple operating systems (such as Android, iOS, Windows, macOS).

[0150] Edge nodes:

[0151] Function: Receive connection requests from clients, process data transmission, and generate and switch communication ports.

[0152] Form: It can be a virtual machine or a physical server in the cloud service.

[0153] Type: Deployed at edge computing nodes close to the user's geographic location to reduce latency and improve response speed.

[0154] Network Infrastructure:

[0155] Function: Provides communication links between clients and edge nodes, including network devices such as routers and switches.

[0156] Form: Typical Internet infrastructure, ensuring reliable transmission of data packets.

[0157] Software Architecture:

[0158] Client software modules:

[0159] Connection management module: responsible for establishing and maintaining connections with edge nodes.

[0160] Port management module: generates a pseudo-random port sequence and switches the communication port at time intervals.

[0161] Heartbeat detection module: regularly sends and receives heartbeat packets to confirm the connection status of both parties.

[0162] Edge node software module:

[0163] Connection management module: processes connection requests from clients and maintains connection status.

[0164] Port management module: Synchronously generates a pseudo-random port sequence and switches the communication port at time intervals.

[0165] Heartbeat detection module: regularly sends and receives heartbeat packets to confirm the connection status of both parties.

[0166] The following describes the communication process based on dynamic ports provided by this application.

[0167] Step 1: Connection established.

[0168] Execution entities: clients and edge nodes.

[0169] Trigger condition: The user starts the application and initiates a connection request with the edge node.

[0170] Processing action: The client generates a random number R C And send it to the edge node. The edge node generates a random number R S And send it to the client. Both parties use SHA-256 to perform hash operation on the two random numbers to obtain the seed value: S = SHA-256 (R C ||R S ). Establish a TCP connection.

[0171] Result: The two parties have established a secure initial connection and determined the seed value S for generating a pseudo-random port sequence.

[0172] Function: Ensures that both parties can generate consistent pseudo-random port sequences, laying the foundation for subsequent secure communication.

[0173] Step 2: Port switching.

[0174] Execution entities: clients and edge nodes.

[0175] Trigger condition: Timer triggers every second.

[0176] Action: Improve HMAC-SHA256 port sequence generation: introduce timestamp t and the current network packet loss rate PacketLossRate as additional input variables. The new port number generation formula is as follows:

[0177] P(t)=HMAC-SHA256(S, t, PacketLossRate);

[0178] Where: S is the seed value determined by bidirectional negotiation; t is the current timestamp; PacketLossRate represents the packet loss rate of the current network. Map the generated port number to a valid port range (such as 1024 to 65535):

[0179] Port=(P(t)mod(MaxPort-MinPort))+MinPort;

[0180] Where: MaxPort = 65535, MinPort = 1024. Switch to the new port number for communication.

[0181] Result: The client and edge node synchronously switch to the new port number, ensuring that the port used for each communication is pseudo-random and difficult to predict.

[0182] Function: Increases the difficulty of port scanning attacks and improves the security of communications.

[0183] Step 3: Keep the connection alive.

[0184] Execution entities: clients and edge nodes.

[0185] Trigger condition: After each port switch.

[0186] Processing action: Send a heartbeat packet containing the current port number and timestamp: Heartbeat = {Port, Timestamp}; receive the other party's heartbeat packet to confirm the connection status. If the other party's heartbeat packet is not received within the specified time, the connection is considered broken and the reconnection mechanism is triggered.

[0187] Result: Ensure the connection status of both parties is synchronized, and interrupted connections are discovered and restored in a timely manner.

[0188] Effect: Improves the reliability and durability of the connection, allowing communication to remain smooth even when the network is unstable.

[0189] The core of this application is to enhance the security and reliability of network communications through a dynamic port randomization mechanism.

[0190] Key technical points of the dynamic port randomization mechanism: The client and edge node determine the seed value S through bidirectional negotiation and use the improved HMAC-SHA256 to generate a pseudo-random port sequence.

[0191] The communication port is switched every second to ensure that the port used for each communication is pseudo-random and difficult to predict.

[0192] advantage:

[0193] Improved security: Compared with the traditional HMAC-SHA256 algorithm, the improved algorithm introduces timestamp and packet loss rate as dynamic parameters, further enhancing the unpredictability of port sequences and effectively preventing port scanning attacks.

[0194] Preventing connection hijacking: Since changes in port sequences depend on real-time packet loss rate information, even if an attacker obtains partial port sequence information, it is difficult to predict future ports and thus impossible to maintain the connection status.

[0195] Enhanced anti-interference capabilities: Introducing packet loss rate as an additional variable into the port generation algorithm can effectively cope with complex network environment changes, allowing a high level of security to be maintained even when network conditions fluctuate.

[0196] Key technical points of determining the seed value through two-way negotiation: During the connection establishment phase, the client and the edge node determine a seed value S through two-way negotiation. This seed value is used to generate a pseudo-random port sequence.

[0197] advantage:

[0198] Enhanced consistency: Bidirectional negotiation ensures that the pseudo-random port sequences generated by both parties are consistent, avoiding communication interruptions caused by asynchrony.

[0199] Increased security: Seed values ​​are generated and exchanged in a secure manner, ensuring their confidentiality and integrity, further enhancing the security of the system.

[0200] Key technical aspects of the heartbeat mechanism: After each port switch, the client and edge node send heartbeat packets to each other to confirm the connection status of both parties. The heartbeat packet contains the current port number and timestamp to ensure synchronization between the two parties.

[0201] advantage:

[0202] Keep the connection active: Sending heartbeat packets regularly can effectively keep the connection active and avoid connection interruptions caused by network instability.

[0203] Timely fault detection: If the heartbeat packet from the other party is not received within the specified time, the system can detect it in time and trigger the reconnection mechanism to ensure the continuity of communication.

[0204] Technical points of the port mapping strategy: Map the generated port number to a valid port range (such as 1024 to 65535) to ensure that the generated port number is within the legal range.

[0205] advantage:

[0206] Avoid illegal ports: Use port mapping policies to ensure that the generated port numbers are within the legal range and avoid using illegal or unauthorized ports for communication.

[0207] Reduce conflicts: Rationally allocate port numbers to reduce port conflicts with other services or applications, and improve system stability and reliability.

[0208] Figure 7 This is the communication flow chart of the dynamic port randomization mechanism provided by this application. Figure 7 As shown, in the handshake phase, the client sends a connection request SYN to the edge node; the edge node sends a response connection request SYN-ACK to the client; the client sends a connection confirmation ACK to the edge node; the client sends a first random number to the edge node; the edge node sends a second random number to the client; the client and the edge node calculate the seed value based on the random number they sent and the random number they received. That is, S = SHA-256 (R C ||R S );SHA-256 (Secure Hash Algorithm 256-bit) is a secure hash algorithm, which is the above-mentioned preset encryption algorithm. c is the first random number; Rs is the second random number; S is the seed value. At this point, the handshake between the client and the edge node is completed and a TCP connection is established.

[0209] During the port switching phase, a hash message authentication code combined with an encryption algorithm is used to determine the current first target port number based on the seed value pre-negotiated between the client and the edge node, the current first timestamp, and the first packet loss rate. Specifically, P(t) = HMAC-SHA256(S, t, PacketLossRate), where S is the seed value determined through bilateral negotiation, t is the current first timestamp, and PacketLossRate represents the current network's first packet loss rate. In this case, P(t) is the first target port number. Based on the minimum and maximum port numbers within the valid port number range, the first port number is mapped to the valid port number range, determining the first target port number as: Port = (P(t) mod (MaxPort - MinPort)) + MinPort, where MaxPort = 65535 and MinPort = 1024. At this point, P(t) is the first port number, and Port is the first target port number. The client and edge node switch to the first target port number for communication.

[0210] During the connection keepalive phase, the client sends a first heartbeat packet to the edge node according to a preset second period. The first heartbeat packet carries the second port number currently communicating with the edge node and the current second timestamp, i.e., Heartbeat = {Port, t}. Based on the first heartbeat packet, the edge node determines that the third port number currently communicating with the client is the same as the second port number, and that the current third timestamp matches the second timestamp. Then, the edge node sends a second heartbeat packet (i.e., a response heartbeat packet) to the client. At this point, the client confirms that the communication connection status with the edge node is normal, continues communication, and sends a data packet to the edge node.

[0211] If the client doesn't receive the second heartbeat packet from the edge node within a preset time, the reconnection mechanism is triggered. The client caches any unsent packets. Once the client is determined to have successfully reconnected to the edge node, the client sends the packet to the edge node. This means the handshake phase is repeated, and after the connection is reestablished, the cached packets are sent.

[0212] Figure 8 The first structural diagram of a communication device based on dynamic ports provided in this application includes:

[0213] A first determining module 11 is configured to determine a current first target port number according to a seed value pre-negotiated between the client and the edge node and a current first timestamp using a hash message authentication code combined with an encryption algorithm according to a preset first period;

[0214] The first communication module 12 is configured to switch to the first target port number to communicate with the edge node.

[0215] The first determination module 11 is specifically used to obtain the first packet loss rate of the current network between the client and the edge node; based on the seed value pre-negotiated between the client and the edge node, the current first timestamp and the first packet loss rate, a hash message authentication code combined with an encryption algorithm is used to determine the current first target port number.

[0216] The first determination module 11 is specifically used to determine the current first port number by using a hash message authentication code combined with an encryption algorithm; map the first port number to the valid port number range based on the minimum port number and the maximum port number in the valid port number range to determine the first target port number.

[0217] The first determination module 11 is further configured for the client to send a first random number to the edge node; receive a second random number sent by the edge node; and perform a hash operation on the first random number and the second random number using a preset encryption algorithm to determine the seed value.

[0218] The device further comprises:

[0219] A first sending module 13 is configured to send a first heartbeat packet to the edge node according to a preset second period; wherein the first heartbeat packet carries a second port number currently communicating with the edge node and a current second timestamp;

[0220] A confirmation module 14 is configured to confirm that the communication connection status with the edge node is normal if a second heartbeat packet sent by the edge node is received within a preset time period; wherein the second heartbeat packet is sent to the client when the edge node determines that the third port number currently communicating with the client is the same as the second port number and determines that the current third timestamp matches the second timestamp;

[0221] The reconnection module 15 is used to trigger a reconnection mechanism if the second heartbeat packet sent by the edge node is not received within the preset time length; and cache the data packet that was not sent successfully. When it is determined that the client is successfully reconnected with the edge node, the data packet is sent to the edge node.

[0222] Figure 9 The second structural diagram of the communication device based on dynamic ports provided in this application includes:

[0223] A second determining module 21 is configured to determine the current second target port number according to a preset first period, based on a seed value pre-negotiated between the edge node and the client and a current fourth timestamp, using a hash message authentication code combined with an encryption algorithm;

[0224] The second communication module 22 is configured to switch the edge node to the second target port number to communicate with the edge node.

[0225] The second determination module 21 is specifically used to obtain the second packet loss rate of the current network between the client and the edge node; based on the seed value pre-negotiated between the client and the edge node, the current fourth timestamp and the second packet loss rate, a hash message authentication code combined with an encryption algorithm is used to determine the current second target port number.

[0226] The second determination module 21 is specifically used to determine the current fourth port number by using a hash message authentication code combined with an encryption algorithm; map the fourth port number to the valid port number range based on the minimum port number and the maximum port number in the valid port number range to determine the second target port number.

[0227] The second determination module 21 is further configured to receive a first random number sent by the client; send a second random number to the client; and perform a hash operation on the first random number and the second random number using a preset encryption algorithm to determine the seed value.

[0228] The device further comprises:

[0229] A receiving module 23 is configured to receive a third heartbeat packet sent by the client according to a preset second period; wherein the third heartbeat packet carries a fifth port number for the client to currently communicate with the edge node and a current fifth timestamp;

[0230] The second sending module 24 is used to send a fourth heartbeat packet to the client if it is determined that the sixth port number currently communicating with the client is the same as the fifth port number, and if it is determined that the current sixth timestamp matches the fifth timestamp; confirm that the communication connection status with the client is normal; otherwise, send a prompt message to the client to trigger the reconnection mechanism; and receive the cached unsuccessfully sent data packet sent by the client after the reconnection is successful.

[0231] The present application also provides an electronic device, such as Figure 10 As shown, it includes: a processor 31, a communication interface 32, a memory 33 and a communication bus 34, wherein the processor 31, the communication interface 32, and the memory 33 communicate with each other through the communication bus 34;

[0232] The memory 33 stores a computer program, and when the program is executed by the processor 31 , the processor 31 performs any of the above method steps.

[0233] The communication bus mentioned in the electronic device mentioned above may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not mean that there is only one bus or only one type of bus.

[0234] The communication interface 32 is used for communication between the electronic device and other devices.

[0235] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk memory. Alternatively, the memory may be at least one storage device located away from the processor.

[0236] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0237] The present application also provides a computer storage readable storage medium, which stores a computer program that can be executed by an electronic device. When the program runs on the electronic device, the electronic device implements any of the above method steps when executing.

[0238] The present application provides a computer program product, which includes an executable program. When the executable program is executed by a processor, the method described above is implemented.

[0239] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0240] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A communication method based on dynamic ports, characterized in that: Applied to a client, the method includes: According to a preset first period, based on a seed value pre-negotiated between the client and the edge node and a current first timestamp, a hash message authentication code combined with an encryption algorithm is used to determine the current first target port number; The client switches to the first target port number to communicate with the edge node.

2. The method according to claim 1, wherein Determining the current first target port number by using a hash message authentication code combined with an encryption algorithm based on a seed value pre-negotiated between the client and the edge node and the current first timestamp includes: Obtaining a first packet loss rate of a current network between the client and the edge node; The current first target port number is determined based on a seed value pre-negotiated between the client and the edge node, a current first timestamp, and the first packet loss rate, using a hash message authentication code combined with an encryption algorithm.

3. The method according to claim 1 or 2, wherein: Determining the current first target port number by using a hash message authentication code in combination with an encryption algorithm includes: The hash message authentication code is combined with an encryption algorithm to determine the current first port number; According to the minimum port number and the maximum port number in the valid port number range, the first port number is mapped to the valid port number range to determine the first target port number.

4. The method according to claim 1, wherein The process of pre-negotiating a seed value includes: The client sends a first random number to the edge node; receives a second random number sent by the edge node; and performs a hash operation on the first random number and the second random number using a preset encryption algorithm to determine the seed value.

5. The method according to claim 1, wherein The method further comprises: Sending a first heartbeat packet to the edge node according to a preset second period; wherein the first heartbeat packet carries a second port number currently communicating with the edge node and a current second timestamp; If a second heartbeat packet sent by the edge node is received within a preset time period, it is confirmed that the communication connection status with the edge node is normal; wherein the second heartbeat packet is sent to the client when the edge node determines that the third port number currently used for communication with the client is the same as the second port number and that the current third timestamp matches the second timestamp; If the second heartbeat packet sent by the edge node is not received within the preset time, a reconnection mechanism is triggered; and the data packet that was not successfully sent is cached. When it is determined that the client is successfully reconnected with the edge node, the data packet is sent to the edge node.

6. A communication method based on dynamic ports, characterized in that: Applied to an edge node, the method includes: According to the preset first period, based on the seed value pre-negotiated between the edge node and the client and the current fourth timestamp, a hash message authentication code combined with an encryption algorithm is used to determine the current second target port number; The edge node switches to the second target port number to communicate with the edge node.

7. The method according to claim 6, wherein Determining the current second target port number using a hash message authentication code combined with an encryption algorithm based on a seed value pre-negotiated between the edge node and the client and the current fourth timestamp includes: Obtaining a second packet loss rate of a current network between the client and the edge node; The current second target port number is determined according to a seed value pre-negotiated between the client and the edge node, a current fourth timestamp, and the second packet loss rate, using a hash message authentication code combined with an encryption algorithm.

8. The method according to claim 6 or 7, wherein: Determining the current second target port number by using a hash message authentication code in combination with an encryption algorithm includes: The hash message authentication code is combined with an encryption algorithm to determine the current fourth port number; According to the minimum port number and the maximum port number in the valid port number range, the fourth port number is mapped to the valid port number range to determine the second target port number.

9. The method according to claim 6, wherein The process of pre-negotiating a seed value includes: Receive a first random number sent by the client; send a second random number to the client; use a preset encryption algorithm to perform a hash operation on the first random number and the second random number to determine the seed value.

10. The method according to claim 6, wherein The method further comprises: Receiving a third heartbeat packet sent by the client according to a preset second period; wherein the third heartbeat packet carries a fifth port number and a current fifth timestamp for the client to currently communicate with the edge node; If it is determined that the sixth port number currently communicating with the client is the same as the fifth port number, and it is determined that the current sixth timestamp matches the fifth timestamp, a fourth heartbeat packet is sent to the client; it is confirmed that the communication connection status with the client is normal; otherwise, a prompt message triggering a reconnection mechanism is sent to the client; and after the reconnection is successful, the cached data packet sent by the client that was not successfully sent is received.

Images