Network reconnection method based on virtual network card and related equipment

Abstract

The invention relates to a network reconnection method based on a virtual network card and related equipment. The method comprises the following steps: in response to a network interruption event, intercepting and redirecting a data packet issued by an upper-layer application through a system protocol stack through a virtual network card arranged between the system protocol stack and a physical network card, caching the data packet, and returning a simulation network available state response to the system protocol stack; in response to the network recovery event, when a preset risk condition is met, sending an authentication request to an authentication server based on the virtual network card, so that the authentication server executes risk authentication according to the authentication request; if the authentication is passed, sending the cached data packet to a physical network card, and transmitting the cached data packet to an external network through the physical network card to recover network communication; and if the authentication is not passed, executing a safe fusing operation. According to the method, the technical effect of improving the security of network reconnection is realized on the basis of ensuring that a user does not perceive during network reconnection.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a network reconnection method and related equipment based on a virtual network card. Background Technology

[0002] In current network technology, when a user's computer loses internet access, the operating system (Windows, Linux, Android, iOS, etc.) will usually automatically reconnect unconditionally and immediately resume data transmission and reception of upper-layer applications in order to ensure user experience.

[0003] While the aforementioned solutions in related technologies can ensure that the user is unaware of the network reconnection (ensuring user experience), they pose significant security risks due to the lack of identity authentication or security policy checks before network reconnection.

[0004] There is currently no effective solution to the aforementioned problems in the relevant technologies. Summary of the Invention

[0005] The present invention provides a network reconnection method and related equipment based on a virtual network card, which at least solves the problem of high security risks caused by automatic reconnection when the network link is restored in the related technology.

[0006] To address the aforementioned problems, one aspect of this invention provides a network reconnection method based on a virtual network interface card (NIC), comprising: In response to network interruption events, a virtual network interface card (NIC) is set up between the system protocol stack and the physical NIC to intercept and redirect data packets sent by upper-layer applications through the system protocol stack, buffer the data packets, and return a simulated network availability response to the system protocol stack. In response to a network recovery event, when preset risk conditions are met, an authentication request is sent to the authentication server based on the virtual network card, so that the authentication server performs risk authentication based on the authentication request; If authentication is successful, the cached data packet is sent to the physical network card and transmitted to the external network via the physical network card to restore network communication; if authentication fails, a security circuit breaker operation is executed.

[0007] In some embodiments, the method further includes: During network outages, the network environment is monitored based on virtual network interface cards (NICs), and detected network change events are marked. These network change events include one or more of the following: SSID / BSSID change, IP subnet migration, and gateway MAC address change. In response to a network recovery event, if a network environment change event flag exists, and the preset risk conditions are met, an authentication request including the device fingerprint and network environment fingerprint is sent to the authentication server based on the virtual network card, so that the authentication server determines the authentication result based on the authentication request. If the authentication result is successful, an encrypted tunnel is built between the virtual network card and the physical network card, and a real network recovery response is returned to the system protocol stack.

[0008] In some embodiments, the authentication request further includes a one-time challenge code; the method also includes: The authentication server generates a challenge value based on the timestamp and one-time challenge code corresponding to the authentication request, and returns the challenge value to the virtual network interface card. The virtual network interface card (NIC) signs the challenge value using the TEE hardware key to obtain a response value, and sends the response value to the authentication server. This allows the authentication server to authenticate the signature validity and timestamp window based on the response value, and then return the generated authentication result to the virtual NIC.

[0009] In some embodiments, if the authentication result is successful, the method further includes: First, the key network protocol control messages in the cached data packets are sent to the physical network card via an encrypted tunnel, and then the remaining data packets are sent to the physical network card via an encrypted tunnel.

[0010] In some embodiments, the steps of intercepting and redirecting data packets sent by upper-layer applications via the system protocol stack, and caching the data packets, include: During packet interception, the intercepted packets are stream-compressed and the compressed data is encrypted and cached.

[0011] In some embodiments, the method further includes: The system monitors network events on local devices using virtual network adapters and triggers network interruption or recovery events based on the monitoring results.

[0012] In some embodiments, the security circuit breaker operation includes one or more of the following: clearing cached data packets, sending alarm logs, and locking the local device; wherein the method further includes: The number of authentication failures is counted. If the number of authentication failures exceeds a preset threshold, the device is remotely locked and the incident is reported to the security management platform.

[0013] To address the aforementioned problems, one aspect of this invention provides a network reconnection system based on a virtual network interface card (NIC), comprising: The caching module is used to respond to network interruption events. It intercepts and redirects data packets sent by upper-layer applications through the system protocol stack by setting up a virtual network interface card between the system protocol stack and the physical network interface card. It caches the data packets and returns a simulated network availability response to the system protocol stack. The authentication module is used to respond to network recovery events and send an authentication request to the authentication server based on the virtual network card when preset risk conditions are met, so that the authentication server performs risk authentication based on the authentication request. The reconnection module is used to send the cached data packets to the physical network card if authentication is successful, and then transmit them to the external network via the physical network card to restore network communication; if authentication fails, it will perform a security circuit breaker operation.

[0014] To address the aforementioned problems, one aspect of this invention provides an electronic device, comprising: a processor and a memory storing a program, characterized in that the program includes instructions that, when executed by the processor, cause the processor to perform any of the aforementioned network reconnection methods based on a virtual network interface card.

[0015] To address the aforementioned problems, one aspect of this invention provides a non-transitory machine-readable medium storing computer instructions for causing a computer to execute any of the aforementioned network reconnection methods based on a virtual network interface card.

[0016] The beneficial effects of this invention are as follows: By employing a virtual network interface card (NIC) positioned between the system protocol stack and the physical NIC in response to network interruption events, the invention intercepts and redirects data packets sent by upper-layer applications via the system protocol stack, caches the data packets, and returns a simulated network availability response to the system protocol stack. In response to network recovery events, when preset risk conditions are met, the invention sends an authentication request to the authentication server based on the virtual NIC, enabling the authentication server to perform risk authentication based on the authentication request. If authentication is successful, the cached data packets are sent to the physical NIC and transmitted to the external network to restore network communication. If authentication fails, a security circuit breaker operation is performed. This overcomes the problem of high security risks caused by automatic reconnection when the network link is restored in related technologies. It achieves the technical effect of caching data packets based on the virtual NIC during network interruption and returning a simulated network availability response to the upper-layer application. During network recovery, if preset risk conditions are met, the invention sends an authentication request to the authentication server based on the virtual NIC to perform risk authentication, and restores network communication when authentication is successful. This achieves the technical effect of improving the security of network reconnection while ensuring that the user is unaware of the network reconnection process.

[0017] Details of one or more embodiments of the present invention are set forth in the following drawings and description, so that other features, objects and advantages of the invention will be more readily understood. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the main process of a network reconnection method based on a virtual network card, which is an embodiment of the present invention.

[0020] Figure 2 This is a schematic diagram of the main process of a network reconnection method based on a virtual network card in one embodiment of the present invention, before and during network interruption.

[0021] Figure 3 This is a schematic diagram of the main process of a network reconnection method based on a virtual network card in one embodiment of the present invention during network interruption and network recovery.

[0022] Figure 4 This is a schematic diagram illustrating the main process of a network reconnection method based on a virtual network card, as described in one embodiment of the present invention, when the network is restored and authentication fails.

[0023] Figure 5 This is a schematic diagram of the main framework of a network reconnection system based on a virtual network card, which is one embodiment of the present invention.

[0024] Figure 6 This is a schematic diagram of the electronic device of the present invention. Detailed Implementation

[0025] Embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. While some embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the invention. It should be understood that the accompanying drawings and embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the invention.

[0026] The main process of network reconnection in related technologies is as follows: after the terminal detects that the network has recovered, the system protocol stack directly retransmits the cached message, and the application layer continues the session. In implementing the solution of this application, it was found that although the above-mentioned solutions in related technologies achieve seamless connection to the user, they have at least the following problems: (1) After the link is restored, the terminal will directly reconnect to the network without verifying the network identity, which makes it impossible to prove that "the current network is still the trusted network before". If the attacker uses the same SSID (Service Set Identifier) ​​and DHCP (Dynamic Host Configuration Protocol) to clone the gateway, the terminal will directly access the malicious network, resulting in data leakage or man-in-the-middle attack; and at this time, the cached data will be directly sent out. If the network that has been connected is untrusted, sensitive data may be leaked without any encryption or policy check.

[0027] (2) The above-mentioned solutions in the related technologies use the same processing logic for brief signal loss (network jitter scenario) and real changes in the network environment (such as switching from the company intranet to a public hotspot). They cannot avoid unnecessary authentication overhead in jitter scenario, nor can they force security verification in switching scenario.

[0028] (3) If two-factor authentication is to be implemented at the application layer, all network applications must be modified to introduce heartbeat, re-login or certificate verification logic, which is costly and results in a poor user experience. At the same time, when application layer authentication fails, the general solution is to prompt the user to handle it manually, which results in poor security and poor user experience when encountering risk situations.

[0029] To address the aforementioned problems, embodiments of the present invention provide a network reconnection method based on a virtual network interface card (NIC), such as... Figure 1 As shown, this network reconnection method based on a virtual network interface card mainly includes: Step S101: In response to a network interruption event, a virtual network interface card (NIC) set between the system protocol stack and the physical NIC is used to intercept and redirect data packets sent by the upper-layer application through the system protocol stack, cache the data packets, and return a simulated network availability response to the system protocol stack.

[0030] Step S102: In response to a network recovery event, when preset risk conditions are met, an authentication request is sent to the authentication server based on the virtual network card, so that the authentication server performs risk authentication according to the authentication request.

[0031] In step S103, if authentication is successful, the cached data packet is sent to the physical network card and transmitted to the external network via the physical network card to restore network communication; if authentication fails, a security circuit breaker operation is performed.

[0032] In this embodiment, the virtual network interface card (NIC) is positioned between the system protocol stack and the physical NIC, and is equipped with functions such as interception, caching, simulated response, and event monitoring. Through interception and caching, the virtual NIC forces data packets under local control, preventing data packet loss during network interruptions and physically blocking the path of unverified data retransmission after network recovery. Simultaneously, the virtual NIC's simulated response ensures that upper-layer applications are completely unaware of network interruptions and the security authentication process, maintaining a good user experience. Furthermore, based on event monitoring, the virtual NIC can trigger an authentication request to the authentication server when preset risk conditions are met, enabling the authentication server to perform risk authentication and ensuring the security of network reconnection.

[0033] Specifically, network data generated by upper-layer applications (including various software applications running on top of the operating system, such as browsers, email clients, and file transfer applications, which send and receive data packets through the network protocol stack provided by the operating system) is processed by the system protocol stack (i.e., the operating system protocol stack, located in the operating system kernel, responsible for handling various network communication protocols, such as the TCP / IP protocol stack) and then sent to the external network through the network card driver (physical network card). Placing the virtual network card between the system protocol stack and the physical network card means that the virtual network card is located on the necessary path of all outbound network data flows. This ensures that during network outages and before network recovery but authentication, all data packets attempted to be sent by upper-layer applications are intercepted by the virtual network card and cached in the local cache, rather than being sent directly to the external network. This ensures that even if the external network recovers and has been maliciously controlled (e.g., through a cloned hotspot), the user's sensitive data will not be leaked without verification.

[0034] On the other hand, while intercepting data packets, the virtual network card returns a "simulated network availability response" to the upper-layer system protocol stack. The operating system and application layer software will think that the network connection is still available or has been restored normally, so that the upper-layer application does not need to be aware of the underlying network interruption and security authentication process, avoiding problems such as application crashes, connection timeouts, frequent reconnection prompts or the need for manual user intervention, and maintaining a "seamless" user experience.

[0035] Meanwhile, the interception and caching mechanisms also provide a fallback for extreme cases (situations requiring a secure circuit breaker), because if the data has already been sent, the circuit breaker operation becomes meaningless. The virtual network interface card's caching operation also allows for the secure discarding of unsent cached data when authentication fails.

[0036] Understandably, without the operation of simulating network availability response, the system protocol stack would detect transmission failure during network interruption, triggering a series of reactions such as TCP timeout retransmission, upper-layer application connection disconnection, and error messages, which would be perceived by the user and affect the user experience.

[0037] According to a specific embodiment of the present application, Figure 2 This is a schematic diagram illustrating the main flow of a network reconnection method based on a virtual network interface card (NIC) according to an embodiment of the present invention, before and during network interruption. Figure 2 As shown, a virtual network interface card (NIC) is configured in the system protocol stack and the physical NIC. The data packet transmission path is as follows: the upper-layer application sends the data packet to the system protocol stack, which forwards it to the virtual NIC, then forwards it to the physical NIC, and finally the physical NIC transmits it to the external network (i.e.,...). Figure 2 The target network in the context is the network that the client (such as a user's computer, mobile phone, or other terminal device) attempts to connect to. Upon encountering a network outage, the virtual network adapter triggers the NETDEV_DOWN event (this event indicates that the network device's state (such as the virtual network adapter mentioned above) has changed from "active" (up) to "inactive" (down), meaning the virtual network adapter is no longer in a state where it can transmit data packets). The virtual network adapter then enters a secure isolation mode. At this point, because the system protocol stack and upper-layer applications receive a "simulated network status available response," meaning they are unaware of the network outage, they will continue to send new data packets. The virtual network adapter intercepts these new data packets and encrypts and buffers them.

[0038] In some embodiments, the method further includes: during network outages, monitoring the network environment based on a virtual network interface card (NIC) and marking detected network change events; wherein, network change events include one or more of SSID (Service Set Identifier) / BSSID (Basic Service Set Identifier) ​​changes, IP subnet migrations, and gateway MAC (Media Access Control) transitions; in response to a network recovery event, if a network environment change event is marked, a preset risk condition is met, and an authentication request including a device fingerprint and a network environment fingerprint is sent to an authentication server based on the virtual NIC, so that: the authentication server determines the authentication result based on the authentication request; if the authentication result is successful, an encrypted tunnel is constructed between the virtual NIC and the physical NIC, and a real network recovery response is returned to the system protocol stack.

[0039] Based on the aforementioned equipment, the solution provided in this application monitors the network environment during network outages using a virtual network interface card (NIC), marks events, and determines whether risk authentication is triggered based on the marked risk conditions. This enables the intelligent differentiation between two scenarios: brief network jitter and potentially high-risk real network environment changes. It is understandable that for network outages caused by only a brief signal loss (network jitter), even if the network recovers, if no changes are detected in the network environment (SSID / BSSID, IP subnet, gateway MAC), the system will determine that the preset risk conditions are not met. In this case, the step of sending an authentication request to the authentication server can be skipped. This avoids authentication operations when security risks have not significantly increased, significantly reducing network recovery delays and system resource consumption, and optimizing the user experience. When network environment change events such as SSID / BSSID changes (potentially encountering cloned hotspots with the same name), IP subnet migrations (potentially switching to a different network domain, such as a company intranet switching to public WiFi), and gateway MAC jumps (strongly indicating ARP (Address Resolution Protocol) spoofing or man-in-the-middle attacks) are detected, the system will mark these events. When the network recovers, the presence of this flag indicates that the preset risk conditions are met, thereby forcibly triggering the process of sending an authentication request to the authentication server. This ensures that security authentication is enforced in scenarios where the risk is significantly increased, thus compensating for the vulnerability of lack of security verification caused by direct reconnection in related technologies.

[0040] When authentication is triggered, the authentication request includes a device fingerprint (used to identify the user device) and a network environment fingerprint (used to identify the characteristics of the currently restored network environment, such as a new SSID / BSSID, a new IP range, a new gateway MAC address, etc.), to provide information for the authentication server to perform risk assessment and authentication. Specifically, the authentication server can compare the current network environment fingerprint with historical trusted records, the device's Authorization network list, etc., to determine whether the current network is trustworthy or whether there are any anomalies.

[0041] The steps for monitoring the network environment based on a virtual network card provided in this application can be as follows: During a network outage, the virtual network card accesses and listens to signals of the underlying network environment (such as scanning available WiFi SSID / BSSID, detecting ARP table changes, DHCP lease status, link layer events, etc.) through the operating system interface or driver layer capabilities.

[0042] In some embodiments, the authentication request further includes a one-time challenge code; the method further includes: using the authentication server to generate a challenge value based on the timestamp and one-time challenge code corresponding to the authentication request, and returning the challenge value to the virtual network interface card; the virtual network interface card signs the challenge value according to the TEE hardware key to obtain a response value, and sends the response value to the authentication server, so that: the authentication server authenticates the signature validity and timestamp window according to the response value, and returns the generated authentication result to the virtual network interface card.

[0043] The one-time challenge code (Nonce) provided in this application possesses uniqueness and unpredictability. With each authentication request, the virtual network interface card (or its cooperating TEE (Trusted Execution Environment, a security architecture used to isolate and protect sensitive operations and data from malware or attacker threats)) generates a unique and random challenge code (Nonce) used only once, ensuring that each authentication interaction is independent and unpredictable. Because the Nonce is different for each authentication, even if an attacker intercepts previous authentication packets, they cannot use the old Nonce to initiate a new valid authentication, thus possessing replay protection.

[0044] The timestamp corresponding to the authentication request can be either the timestamp of the request initiation included in the authentication request, or the timestamp corresponding to when the authentication server receives the authentication request. This timestamp gives the generated challenge value a time-sensitive validity period.

[0045] Furthermore, by introducing a one-time challenge value and a timestamp, the challenge value generated by the authentication server becomes unique, unpredictable, and time-sensitive. Leveraging hardware security capabilities (possessing those of the TEE hardware key), a response signature is securely generated on the device side, effectively proving the device's physical identity and the trustworthiness of its operating environment. Finally, the authentication server comprehensively verifies both the signature validity and the request's timeliness, significantly mitigating identity cloning and credential replay attacks.

[0046] The risk authentication process provided in this application ensures that the device to be reconnected is a legitimate and trustworthy device before network reconnection, preventing attackers from impersonating legitimate devices or hijacking connections by eavesdropping, intercepting, or replaying authentication data packets. At the same time, the risk authentication results provide a reference for subsequent data recovery transmission (network reconnection) or security circuit breaker operations.

[0047] According to a specific embodiment of the present application, Figure 3 This is a schematic diagram illustrating the main flow of a network reconnection method based on a virtual network interface card (NIC) according to an embodiment of the present invention during network interruption and network recovery. Figure 3 As shown, during a network outage, the virtual network interface card (NIC) actively scans the network environment of the external network (target network) and locally marks any network change events detected. When the network recovers, the virtual NIC triggers the NETDEV_UP event (this event indicates that the network device (such as the virtual NIC mentioned above) has changed from "inactive" (down) to "active" (up), meaning the virtual NIC is ready to transmit data). At this time, the virtual NIC can determine whether the preset risk conditions are met based on the locally marked network table change events, i.e., whether to perform risk authentication. If risk authentication is performed, the virtual NIC sends an authentication request, including the device fingerprint, environment fingerprint, and one-time challenge code, to the authentication server. The authentication server first verifies the device fingerprint and environment fingerprint. If the verification is successful, it generates a challenge value based on the timestamp and one-time challenge code corresponding to the authentication request and returns the challenge value to the virtual NIC. The virtual NIC signs the challenge value according to the TEE hardware key to obtain a response value and sends the response value to the authentication server, so that the authentication server authenticates the signature validity and timestamp window based on the response value and returns the generated authentication result to the virtual NIC.

[0048] According to a specific implementation of the embodiments of this application, the driver layer of the virtual network card can trigger the NETDEV_DOWN and NETDEV_UP events in real time by hooking system network events (such as netdevice_notifier in Linux or NetworkListManager in Windows) to achieve non-intrusive listening without relying on application layer heartbeat packets and reduce the false alarm rate.

[0049] In some embodiments, if the authentication result is successful, the method further includes: first sending the key network protocol control messages in the cached data packets to the physical network card via an encrypted tunnel, and then sending the remaining data packets to the physical network card via an encrypted tunnel.

[0050] According to a specific implementation of this application, network protocol control messages (i.e., the aforementioned key network protocol control messages) that play a crucial and time-sensitive role in maintaining network connection status and basic services are first precisely located. At the very initial moment of network communication recovery, these key network protocol control messages are sent preferentially and quickly. By prioritizing the sending of these key network protocol control messages, the timeliness requirements of the upper-layer system protocol stack (especially the TCP protocol stack) are quickly met, effectively preventing protocol timeouts and connection interruptions caused by authentication delays. This ensures the continuity of existing network sessions, avoids accidental resets or disconnections of TCP connections, improves overall network recovery efficiency, and makes the upper-layer application completely unaware of network interruptions and authentication processes. Connections are not broken, sessions do not need to be rebuilt, and a seamless user experience is guaranteed.

[0051] The key network protocol control messages provided in this application may include TCP ACK messages (TCP ACK messages are used to acknowledge data reception and keep the connection active; TCP stands for Transmission Control Protocol; ACK stands for Acknowledgment), SYN / ACK messages (used to establish a connection; SYN stands for Synchronize SequenceNumbers), Keepalive messages (used to detect whether the connection is alive), DHCP messages (used to obtain or renew IP addresses), and ARP response messages (used to resolve IP addresses to MAC addresses). These key network protocol control messages can quickly notify the server that the local network has recovered and the session is still valid. This helps prevent upper-layer protocols (such as TCP) from triggering timeout retransmissions, connection resets (RST, Reset), or disconnections due to prolonged lack of response, ensuring the continuity and stability of existing network sessions.

[0052] Understandably, although priority sending logic is added, the impact of prioritizing critical control messages on overall data transmission latency is minimal, as these messages are typically very small. Instead, the limited transmission of critical control messages can quickly stabilize the protocol stack state, avoiding the significant latency overhead of needing to rebuild the entire connection due to protocol timeouts (rebuilding the connection involves multiple handshakes, application-layer re-authentication, etc.), thus improving overall network recovery efficiency.

[0053] In some of these embodiments, the steps of intercepting and redirecting data packets sent by the upper-layer application via the system protocol stack and caching the data packets include: during the data packet interception, performing streaming compression on the intercepted data packets and encrypting and caching the compressed data.

[0054] Based on the above settings, streaming compression of the intercepted raw network data packets (which may contain a large amount of redundant information, such as duplicate protocol headers, duplicate application data, or compressible content) can significantly reduce the size of the cached data. This allows the system to support interrupted caching for longer periods / larger amounts of data with limited resources, avoiding data loss or solution failure due to cache space exhaustion. By strongly encrypting the compressed cached data, it is ensured that even if the cache layer is accessed without authentication, attackers cannot directly obtain the original data content, providing crucial security for sensitive data temporarily stored locally.

[0055] The streaming compression algorithm provided in this application can be suitable for network data streams and low latency, such as LZ4 (a lossless compression algorithm known for its extremely fast compression and decompression speeds, suitable for real-time data processing and network transmission), Snappy (a compression algorithm designed to provide fast compression and decompression operations while maintaining a high compression ratio), and Zstd (a lossless compression algorithm that combines compression speed and compression ratio, providing multiple compression levels to adapt to different performance and compression ratio requirements). It is understood that, depending on the specific application scenario, a suitable streaming compression algorithm can be selected based on the actual situation.

[0056] In some embodiments, the method further includes: monitoring network events of the local device based on the virtual network interface card, and triggering network interruption events or network recovery events based on the monitoring results.

[0057] This application uses the virtual network interface card (NIC) as a network event monitoring center and state machine trigger based on the above scheme. By endowing the virtual NIC with the ability to actively monitor and judge network status, it can independently and accurately define and trigger "network interruption events" and "network recovery events" without relying on the native mechanisms of the operating system. This helps ensure that the core processes of the entire secure reconnection scheme (caching, authentication, recovery / circuit breaking) can be started and executed based on more comprehensive, timely, and security policy-compliant status judgments.

[0058] In some instances, virtual network interface cards (NICs), leveraging their unique position between the system protocol stack and the physical NIC, can access and comprehensively analyze multi-source information, including underlying driver signals (such as physical link interruptions and signal strength), operating system protocol stack events (such as IP address failures, route unreachability, and DNS (Domain Name System) failures), and even security threat intelligence (such as the detection of ARP spoofing attacks). This makes the virtual NIC's judgment of whether the network is "truly interrupted" or "truly restored" more accurate and more in line with actual communication capabilities than traditional operating system mechanisms that rely on a single indicator (such as physical link connectivity). Based on this configuration, it avoids overreacting to brief jitter or localized failures, while also identifying situations where the physical layer is not interrupted but is actually unusable or poses a high risk.

[0059] In some examples, virtual network interface cards (NICs) not only passively respond to underlying events but also actively probe network status (such as sending probe packets to check gateway reachability and verify DNS resolution). When potential security threats are detected (such as abnormal changes in gateway MAC addresses but unbroken physical links) or covert interruptions (such as physical links being connected but upper-layer IPs being unreachable), a "network interruption event" can be proactively triggered to activate data caching protection mechanisms in advance, thus achieving proactive defense.

[0060] Based on the above settings, the virtual network interface card is responsible for monitoring and triggering core events (network interruption / recovery). This also ensures the consistency of the internal logical processing state of the entire secure reconnection scheme, so that subsequent operations (caching, authentication, reconnection / circuit breaking) respond based on the judgment of the same event source, avoiding logical errors or security vulnerabilities caused by different modules having inconsistent understandings of the network status.

[0061] In some embodiments, the aforementioned security circuit breaker operation includes one or more of the following: clearing cached data packets, sending alarm logs, and locking the local device; wherein, the method further includes: counting the number of authentication failures, and if the number of authentication failures exceeds a preset threshold, triggering remote device locking and reporting to the security management platform.

[0062] Among them, the security circuit breaker operation of clearing cached data packets helps ensure that sensitive data that is temporarily stored locally through caching and has not yet been sent will not be accidentally or forcibly sent after authentication failure (which may have been connected to a malicious network), thus preventing data leakage.

[0063] Security circuit breaker operation that sends alarm logs: It can promptly record and report authentication failure events and their context (time, device ID, network fingerprint, reason for failure, etc.), providing the security team with the basis for event tracing and threat analysis, facilitating rapid response and investigation.

[0064] The security circuit breaker operation for locking local devices enables the immediate cessation of all network communication capabilities of the device (and even further restrictions on user login or critical functions), physically isolates the device from (potentially existing) malicious networks, and blocks ongoing or subsequent possible attacks (such as malicious command issuance or data transmission).

[0065] By executing a security circuit breaker, potential data breaches or attacks can be immediately blocked, minimizing damage. Furthermore, by tracking the number of authentication failures and triggering remote device locking and reporting to the security management platform when the number exceeds a preset threshold, security protection can be achieved against attackers repeatedly attempting to bypass authentication (such as cracking or credential theft attempts) or malicious use of lost / stolen devices.

[0066] Based on the above settings, by using tiered circuit breaking (especially remote locking circuit breaking operations) and a failure counting mechanism, attackers must complete the attack within a limited number of failures in order to succeed; otherwise, device locking will be triggered, causing the attack to fail completely. This achieves the goal of improving the security of the network reconnection scheme by significantly increasing the cost and risk for attackers.

[0067] According to a specific embodiment of the present application, Figure 4 This is a schematic diagram illustrating the main process of a network reconnection method based on a virtual network card, as described in one embodiment of the present invention, facing authentication success and authentication failure scenarios after network recovery. Figure 4 As shown, if the network is restored and risk authentication is performed, and authentication is successful, the virtual network interface card (NIC) can release cached data and send it to the physical NIC via the established encrypted tunnel (prioritizing critical network protocol control messages). The physical NIC then transmits the cached data to the external network, restoring network communication. Simultaneously, the virtual NIC sends a real network recovery response to the system protocol stack. Upon receiving new data packets from the upper-layer application via the system protocol stack, the virtual NIC can also send these new data packets to the physical NIC via the aforementioned encrypted tunnel, and the physical NIC then transmits the new data packets to the external network. Furthermore, for cases where authentication fails... Figure 4 The document illustrates a specific implementation example of clearing encrypted data from the virtual network adapter cache, sending a security alert to the authentication server, and sending a network status disconnection notification to the system protocol stack.

[0068] The network reconnection method based on a virtual network interface card (NIC) provided in this embodiment of the invention overcomes the high security risks associated with automatic reconnection upon network link recovery in related technologies. It achieves the technical effect of caching data packets during network interruption and returning a simulated network availability response to the upper-layer application while ensuring user-unobstructed network reconnection during network recovery, and sending an authentication request to the authentication server based on the virtual NIC when preset risk conditions are met. This ensures that the authentication server performs risk authentication based on the authentication request. If authentication is successful, the cached data packets are sent to the physical NIC and transmitted to the external network to restore network communication. If authentication fails, a security circuit breaker operation is performed. This method achieves the technical effect of improving network reconnection security while ensuring user-unobstructed reconnection.

[0069] Based on the network reconnection method based on a virtual network interface card (NIC) provided in the embodiments of the present invention, the embodiments of the present invention also provide a network reconnection system based on a virtual NIC, such as... Figure 5 As shown, the network reconnection system 500 based on a virtual network interface card includes: The caching module 501 is used to respond to network interruption events by intercepting and redirecting data packets sent by upper-layer applications through the system protocol stack via a virtual network card set between the system protocol stack and the physical network card, caching the data packets, and returning a simulated network availability response to the system protocol stack. The authentication module 502 is used to respond to a network recovery event and, when preset risk conditions are met, send an authentication request to the authentication server based on the virtual network card, so that the authentication server performs risk authentication according to the authentication request. The reconnection module 503 is used to send the cached data packets to the physical network card if authentication is successful, and then transmit them to the external network via the physical network card to restore network communication; if authentication fails, it performs a security circuit breaker operation.

[0070] Since the network reconnection system 500 based on the virtual network card in this application is used to implement any of the network reconnection methods based on the virtual network card described above, the execution operations of each module in the network reconnection system 500 based on the virtual network card are consistent with those in the aforementioned network reconnection methods based on the virtual network card, and can achieve all the beneficial effects corresponding to the aforementioned network reconnection methods based on the virtual network card. This application will not elaborate further here.

[0071] This invention also provides a non-transitory machine-readable medium storing a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of this invention.

[0072] This invention also provides a computer program product, including a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform the methods of embodiments of this invention. The computer program product should be understood as a software product that primarily implements the methods described above through a computer program.

[0073] This invention also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, which, when executed by the at least one processor, causes the electronic device to perform the method of this invention.

[0074] refer to Figure 6 The present invention will now be described in the form of a structural block diagram of an electronic device that can serve as an embodiment of the present invention, which is an example of a hardware device that can be applied to various aspects of the present invention. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0075] like Figure 6 As shown, the electronic device includes a computing unit 601, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. The RAM 603 may also store various programs and data required for the operation of the electronic device. The computing unit 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0076] Multiple components in the electronic device are connected to I / O interface 605, including: input unit 606, output unit 607, storage unit 608, and communication unit 609. Input unit 606 can be any type of device capable of inputting information into the electronic device. Input unit 606 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of the electronic device. Output unit 607 can be any type of device capable of presenting information and may include, but is not limited to, a display, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 608 may include, but is not limited to, disks and optical discs. Communication unit 609 allows the electronic device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, and / or wireless communication transceivers, such as Bluetooth devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0077] The computing unit 601 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, CPUs, graphics processing units (GPUs), various special-purpose artificial intelligence (AI) computing units, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above. For example, in some embodiments, the method embodiments of the present invention can be implemented as a computer program tangibly contained in a machine-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed on an electronic device via ROM 602 and / or communication unit 609. In some embodiments, the computing unit 601 can be configured to perform the methods described above by any other suitable means (e.g., by means of firmware).

[0078] Computer programs for implementing the methods of embodiments of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0079] In the context of embodiments of the present invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable signal medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, or infrared systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0080] It should be noted that the term "comprising" and its variations used in the embodiments of the present invention are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The modifications of "one" and "multiple" mentioned in the embodiments of the present invention are illustrative and not restrictive. Those skilled in the art should understand that, unless explicitly indicated otherwise in the context, they should be understood as "one or more".

[0081] The user information / data involved in the embodiments of this invention (including but not limited to user device information / data, user personal information / data, information / data used for analysis, stored information / data, displayed information / data, etc.) are all information / data that has been permitted by the user or fully agreed upon by all parties. Furthermore, the collection, use and processing of such information / data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to agree or refuse.

[0082] The steps described in the method embodiments provided by this invention can be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of protection of this invention is not limited in this respect.

[0083] The term "embodiment" in this specification refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of the invention. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply independence or alternativeity from other embodiments. The various embodiments in this specification are described in a related manner, with reference to each other for similar or identical parts. In particular, for apparatus, device, and system embodiments, since they are substantially similar to method embodiments, the description is relatively simple, and relevant details are referred to in the description of the method embodiments.

[0084] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the appended claims.

Claims

1. A method for network reconnection based on virtual network cards, characterized in that, The method comprises: In response to a network interruption event, intercept and redirect data packets issued by an upper-layer application via a system protocol stack through a virtual network card arranged between the system protocol stack and a physical network card, cache the data packets, and return a simulated network available state response to the system protocol stack; In response to a network recovery event, when a preset risk condition is met, send an authentication request to an authentication server based on the virtual network card, so that the authentication server performs risk authentication according to the authentication request; If the authentication is passed, the cached data packets are sent to the physical network card and transmitted to an external network via the physical network card to restore network communication; If the authentication is not passed, a security fuse operation is performed.

2. The method of claim 1, wherein, The method further comprises: During the network interruption, the network environment is monitored based on the virtual network card, and a network change event is marked; wherein the network change event comprises one or more of SSID / BSSID change, IP subnet migration, gateway MAC jump change; In response to a network recovery event, if there is a network environment change event mark, a preset risk condition is met, and an authentication request including a device fingerprint and a network environment fingerprint is sent to the authentication server based on the virtual network card, so that the authentication server determines an authentication result according to the authentication request; In the case that the authentication result is authentication passed, an encrypted tunnel between the virtual network card and the physical network card is constructed based on the virtual network card, and a real network recovery response is returned to the system protocol stack.

3. The method of claim 2, wherein, The authentication request further comprises a one-time challenge code; the method further comprises: The authentication server generates a challenge value based on the timestamp corresponding to the authentication request and the one-time challenge code, and returns the challenge value to the virtual network card; The virtual network card signs the challenge value according to the TEE hardware key to obtain a response value, and sends the response value to the authentication server, so that the authentication server authenticates the signature validity and the timestamp window according to the response value, and returns the generated authentication result to the virtual network card.

4. The method of claim 2, wherein, In the case that the authentication result is authentication passed, the method further comprises: First, send the key network protocol control message in the cached data packets to the physical network card via the encrypted tunnel, and then send the remaining data packets to the physical network card via the encrypted tunnel.

5. The method of claim 1, wherein, The step of intercepting and redirecting data packets issued by an upper-layer application via a system protocol stack, and caching the data packets comprises: During data packet interception, the intercepted data packets are flow compressed, and the compressed data is encrypted and cached.

6. The method of claim 1, wherein, The method further comprises: The network events of the local device are monitored based on the virtual network card, and the network interruption event or the network recovery event is triggered according to the monitoring result.

7. The method of claim 1, wherein, The security fuse operation comprises one or more of emptying the cached data packets, sending an alarm log, and locking the local device; wherein the method further comprises: The number of times of authentication failure is counted, and if the number of times of authentication failure exceeds a preset threshold, a device remote lock is triggered and a security management and control platform is reported.

8. A virtual network card based network reconnection system, comprising: The method comprises: A cache module is configured to, in response to a network interruption event, intercept and redirect, through a virtual network card disposed between a system protocol stack and a physical network card, a data packet issued by an upper-layer application via the system protocol stack, cache the data packet, and return a simulated network available state response to the system protocol stack; An authentication module is configured to, in response to a network recovery event, send an authentication request to an authentication server based on the virtual network card when a preset risk condition is met, so that the authentication server performs risk authentication according to the authentication request; A reconnection module is configured to, if the authentication passes, send the cached data packet to the physical network card and transmit the data packet to an external network via the physical network card to recover network communication. If the authentication fails, a security fuse operation is performed.

9. An electronic device comprising: A processor and a memory storing a program, wherein the program includes instructions that, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 7.

10. A non-transitory machine-readable medium having stored thereon computer instructions, wherein: The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 7.

Images