A virtual network card-based network reconnection method and related device

Abstract

The application relates to a virtual network card-based network reconnection method and related equipment. The method comprises the following steps: in response to a network interruption event, a virtual network card arranged between a system protocol stack and a physical network card is used to intercept and redirect a data packet issued by an upper-layer application via the system protocol stack, the data packet is cached, and a simulated network available state response is returned to the system protocol stack; in response to a network recovery event, when a preset risk condition is met, an authentication request is sent to an authentication server based on the virtual network card, so that: the authentication server performs risk authentication according to the authentication request; if the authentication is passed, the cached data packet is sent to the physical network card and transmitted to an external network via the physical network card to recover network communication; and if the authentication is not passed, a security fuse operation is performed. The method has the technical effect of improving the security of network reconnection while ensuring that the user is not aware of the network reconnection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, and in particular to a network reconnection method based on a virtual network card and related equipment. BACKGROUND

[0002] In current network technology, after a user computer is disconnected from a network, an operating system (Windows, Linux, Android, iOS, etc.) will automatically reconnect without conditions and immediately resume data transmission of upper-layer applications in order to ensure user experience when a link is restored.

[0003] Although the above scheme in the related art can ensure that the user end is not aware (ensuring user experience) when the network is reconnected, there is a high security risk due to the lack of identity authentication or security policy inspection before the network is reconnected.

[0004] In view of the above problems in the related art, no effective solution has been proposed so far. SUMMARY

[0005] The network reconnection method based on a virtual network card and related equipment provided by the embodiments of the present application at least solve the problem of high security risk caused by automatic reconnection when a network link is restored in the related art.

[0006] In order to solve the above problems, one aspect of the embodiments of the present application provides a network reconnection method based on a virtual network card, comprising:

[0007] In response to a network interruption event, a data packet transmitted by an upper-layer application via a system protocol stack is intercepted and redirected by a virtual network card arranged between the system protocol stack and a physical network card, the data packet is cached, and a simulated network available state response is returned to the system protocol stack;

[0008] In response to a network recovery event, when a preset risk condition is met, an authentication request is sent to an authentication server based on the virtual network card, so that: the authentication server performs risk authentication according to the authentication request;

[0009] If the authentication is passed, the cached data packet is sent to the physical network card and transmitted to an external network via the physical network card to restore network communication; if the authentication is not passed, a security fuse operation is performed.

[0010] In some of the embodiments, the method further comprises:

[0011] During the network interruption, the network environment is monitored based on the virtual network card, and a network change event monitored is marked; wherein the network change event comprises one or more of SSID / BSSID change, IP subnet migration, gateway MAC jump change, etc.

[0012] In response to the network recovery event, if there is a network environment change event flag, a preset risk condition is met, and an authentication request including the device fingerprint and the network environment fingerprint is sent to the authentication server based on the virtual network card, so that the authentication server determines an authentication result according to the authentication request;

[0013] In the case where the authentication result is authentication passed, an encrypted tunnel between the virtual network card and the physical network card is constructed based on the virtual network card, and a real network recovery response is returned to the system protocol stack.

[0014] In some embodiments, the authentication request further includes a one-time challenge code; the method further includes:

[0015] The authentication server generates a challenge value based on the timestamp corresponding to the authentication request and the one-time challenge code, and returns the challenge value to the virtual network card;

[0016] The virtual network card signs the challenge value according to the TEE hardware key to obtain a response value, and sends the response value to the authentication server, so that the authentication server authenticates the signature validity and the timestamp window according to the response value, and returns the generated authentication result to the virtual network card.

[0017] In some embodiments, in the case where the authentication result is authentication passed, the method further includes:

[0018] First, the key network protocol control message in the buffered data packet is sent to the physical network card via the encrypted tunnel, and then the remaining data packet is sent to the physical network card via the encrypted tunnel.

[0019] In some embodiments, the intercepted and redirected data packet issued by the upper layer application via the system protocol stack includes:

[0020] During data packet interception, the intercepted data packet is stream compressed and the compressed data is encrypted and buffered.

[0021] In some embodiments, the method further includes:

[0022] The network events of the local device are monitored based on the virtual network card, and the network interruption event or the network recovery event is triggered according to the monitoring result.

[0023] In some embodiments, the security fuse operation includes one or more of emptying the buffered data packet, sending an alarm log, and locking the local device; wherein the method further includes:

[0024] The number of authentication failures is counted, and if the number of authentication failures exceeds a preset threshold, the device is remotely locked and reported to the security management platform.

[0025] To solve the above problems, one aspect of an embodiment of the present application provides a virtual network card-based network reconnection system, comprising:

[0026] A cache module is configured to, in response to a network interruption event, intercept and redirect data packets issued by an upper-layer application via a system protocol stack through a virtual network card arranged between the system protocol stack and a physical network card, cache the data packets, and return a simulated network available state response to the system protocol stack;

[0027] An authentication module is configured to, in response to a network recovery event, send an authentication request to an authentication server based on the virtual network card when a preset risk condition is met, so that the authentication server performs risk authentication according to the authentication request;

[0028] A reconnection module is configured to, if the authentication is passed, send the cached data packets to the physical network card, transmit the data packets to an external network via the physical network card to recover network communication, and if the authentication is not passed, perform a security fuse operation.

[0029] To solve the above problems, one aspect of an embodiment of the present application provides an electronic device, comprising a processor and a memory storing a program, characterized in that the program comprises instructions which, when executed by the processor, cause the processor to perform any of the above virtual network card-based network reconnection methods.

[0030] To solve the above problems, one aspect of an embodiment of the present application provides a non-transitory machine-readable medium storing computer instructions for causing a computer to perform any of the above virtual network card-based network reconnection methods.

[0031] The embodiment of the present application has the beneficial effects that: by adopting the technical means of, in response to a network interruption event, intercepting and redirecting data packets issued by an upper-layer application via a system protocol stack through a virtual network card arranged between the system protocol stack and a physical network card, caching the data packets, and returning a simulated network available state response to the system protocol stack; in response to a network recovery event, sending an authentication request to an authentication server based on the virtual network card when a preset risk condition is met, so that the authentication server performs risk authentication according to the authentication request; if the authentication is passed, sending the cached data packets to the physical network card, transmitting the data packets to an external network via the physical network card to recover network communication; and if the authentication is not passed, performing a security fuse operation, the problem of high security risk caused by automatic reconnection when a network link is recovered in the related art is overcome, and the technical effects of caching data packets based on a virtual network card when a network is interrupted and returning a simulated network available state response to an upper-layer application are achieved; when a network is recovered, if a preset risk condition is met, an authentication request is sent to an authentication server based on a virtual network card to perform risk authentication, and network communication is recovered when the authentication is passed, so that the technical effect of improving the security of network reconnection on the basis of guaranteeing that a user is not aware of network reconnection is achieved.

[0032] The details of one or more embodiments of the application are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the application will be apparent from the description of the embodiments and from the claims. BRIEF DESCRIPTION OF DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other embodiments can also be obtained from these drawings without creative labor.

[0034] Figure 1 is the main flow diagram of the virtual network card-based network reconnection method of an embodiment of the present application.

[0035] Figure 2 is the main flow diagram of the virtual network card-based network reconnection method of an embodiment of the present application before network interruption and at network interruption.

[0036] Figure 3 is the main flow diagram of the virtual network card-based network reconnection method of an embodiment of the present application during network interruption and at network recovery.

[0037] Figure 4 is the main flow diagram of the virtual network card-based network reconnection method of an embodiment of the present application after network recovery, facing the situation of authentication passing and authentication not passing.

[0038] Figure 5 is the main framework diagram of the virtual network card-based network reconnection system of an embodiment of the present application.

[0039] Figure 6 is the structural diagram of the electronic device of the present application. DETAILED DESCRIPTION

[0040] Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although some embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms, and should not be interpreted as being limited to the embodiments set forth herein, but rather these embodiments are provided to make the present application more thorough and complete. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes, and are not intended to limit the scope of protection of the present application.

[0041] The main process of network reconnection in the related art is: after the terminal detects network recovery, the system protocol stack directly resends the cached packets, and the application layer continues the session. In the implementation of the scheme of the present application, it is found that the above scheme in the related art, although realizing user-end non-perception, at least has the following problems:

[0042] (1) After link recovery, the terminal directly reconnects the network without verifying the network identity, resulting in the inability to prove that the current network is still the previous trusted network. If an attacker uses the same SSID (Service Set Identifier) and DHCP (Dynamic Host Configuration Protocol) gateway cloning, the terminal will directly access the malicious network, resulting in data leakage or man-in-the-middle attack; and at this time, the cached data will be directly sent out, and if the untrusted network has been accessed, sensitive data may be leaked without any encryption or policy check.

[0043] (2) The above scheme in the related art uses the same processing logic for temporary signal loss (network jitter scenario) and network environment real change (such as network switching scenario from company intranet to public hotspot), which cannot avoid unnecessary authentication overhead in the jitter scenario, nor can it enforce security verification in the switching scenario.

[0044] (3) If secondary authentication is to be implemented at the application layer, all network applications must be modified, and heartbeat, re-login or certificate verification logic must be introduced, which has high modification cost and poor user experience; at the same time, when the application layer authentication fails, the general scheme is to prompt the user to handle manually, resulting in poor security and poor user experience when encountering risk conditions.

[0045] In order to solve the above problems, the embodiment of the present application provides a network reconnection method based on a virtual network card, as shown in Figure 1 The network reconnection method based on the virtual network card mainly includes:

[0046] Step S101, in response to a network interruption event, a virtual network card set between a system protocol stack and a physical network card is used to intercept and redirect the data packet sent by an upper layer application through the system protocol stack, cache the data packet, and return a simulated network available state response to the system protocol stack.

[0047] Step S102, in response to a network recovery event, when a preset risk condition is met, an authentication request is sent to an authentication server based on the virtual network card, so that: the authentication server performs risk authentication according to the authentication request.

[0048] Step S103, if the authentication is passed, the cached data packet is sent to the physical network card, and is transmitted to the external network via the physical network card to recover the network communication; if the authentication is not passed, a security fuse operation is performed.

[0049] In the embodiment, the virtual network card is arranged between the system protocol stack and the physical network card, and is endowed with the functions of interception, caching, simulated response, event monitoring, etc. According to the interception and caching, the virtual network card forces the data packet to be under local control, avoids the loss of data packet when the network is interrupted, and physically blocks the path of retransmission of data without verification after the network is recovered. Meanwhile, the virtual network card simulates the response, so that the upper-layer application is completely unaware of the network interruption and the security authentication process, and the good user experience is maintained. In addition, the virtual network card can trigger the authentication request to the authentication server when the preset risk condition is met based on the event monitoring, so that the authentication server performs the risk authentication, and the security of network reconnection is ensured.

[0050] Specifically, the network data generated by the upper-layer application (including various software applications running on the operating system, such as browsers, mail clients, file transfer applications, etc., which send and receive data packets through the network protocol stack provided by the operating system) is processed by the system protocol stack (i.e. the operating system protocol stack, which is located in the operating system kernel and is responsible for processing various protocols such as the TCP / IP protocol stack), and then is sent to the external network through the network card driver (physical network card). Arranging the virtual network card between the system protocol stack and the physical network card means that the virtual network card is located on the path that all outbound network data streams must pass through. Thus, during the network interruption and before the network is recovered but not authenticated, all data packets that the upper-layer application attempts to send are intercepted and cached by the virtual network card locally, rather than being sent directly to the external network, ensuring that even if the external network is recovered and has been maliciously controlled (such as a cloned hotspot), the user's sensitive data will not be leaked without verification.

[0051] On the other hand, while intercepting the data packet, the virtual network card returns a "simulated network available state response" to the upper-layer system protocol stack, so that the operating system and the application layer software believe that the network connection is still available or has been normally recovered, and the upper-layer application does not need to perceive the network interruption and the security authentication process at the bottom layer, avoiding problems such as application crash, connection timeout, frequent reconnection prompt, or the need for user manual intervention, and maintaining the "unaware" user experience.

[0052] Meanwhile, the interception and caching mechanism also realizes the bottom case for extreme situations (the situation that needs to perform the security fuse operation). The caching operation of the virtual network card also enables the cached data that has not been sent to be safely discarded when the authentication is not passed.

[0053] It can be understood that, without the operation of simulating the network available state response, the system protocol stack detects the sending failure during the network interruption, and then triggers a series of reactions such as TCP timeout retransmission, upper-layer application connection disconnection, error prompt, so that the user end perceives and affects the user experience.

[0054] According to a specific embodiment of the present application, Figure 2 is a main flow diagram of a network reconnection method based on a virtual network card according to an embodiment of the present application. As shown in the figure, Figure 2 a virtual network card is set in the system protocol stack and the physical network card, and the transmission path of the data packet is: the upper-layer application sends the data packet to the system protocol stack, which is forwarded to the virtual network card, and then the virtual network card forwards it to the physical network card, and finally the physical network card transmits it to the external network (i.e. Figure 2 the target network in the figure, i.e. the network that the client (such as a user's computer, mobile phone or other terminal device) attempts to connect to). When a network interruption event occurs, the virtual network card triggers a NETDEV_DOWN event (this event is used to indicate that the state of the network device (such as the virtual network card) has changed from "activated" (up) to "non-activated" (down). That is, it indicates that the virtual network card is no longer in a state where it can transmit data packets), and the virtual network card starts the security isolation mode. At this time, since the system protocol stack and the upper-layer application receive the "simulated network state available response", i.e. the system protocol stack and the upper-layer application are unaware of the network interruption, they will continue to send new data packets, which are intercepted and encrypted by the virtual network card.

[0055] In some embodiments, the method further comprises: during the network interruption, monitoring the network environment based on the virtual network card, and marking the monitored network change event; wherein the network change event includes one or more of SSID (Service Set Identifier) / BSSID (Basic Service Set Identifier) change, IP subnet migration, gateway MAC (Media Access Control) jump change; in response to the network recovery event, if there is a network environment change event mark, the preset risk condition is met, and an authentication request including the device fingerprint and the network environment fingerprint is sent to the authentication server based on the virtual network card, so that: the authentication server determines the authentication result according to the authentication request; in the case that the authentication result is authentication passed, an encrypted tunnel between the virtual network card and the physical network card is constructed based on the virtual network card, and a real network recovery response is returned to the system protocol stack.

[0056] Based on the above device, the scheme provided by the application realizes intelligent distinction between the two situations of temporary network jitter and potential high-risk real network environment change through the monitoring of network environment during network interruption, event marking and risk condition judgment based on the marking to trigger risk authentication. It can be understood that for network interruption caused by only temporary signal loss (network jitter), even if the network is restored, if it is monitored that the network environment (SSID / BSSID, IP subnet, gateway MAC) has not changed, it will be determined that the preset risk condition is not met, at this time, the step of sending an authentication request to the authentication server can be skipped, thereby the authentication operation can be avoided in the case where the security risk is not significantly increased, the network recovery delay and system resource consumption are significantly reduced, and the user experience is optimized. When the SSID / BSSID change (may encounter a same-name cloned hotspot), IP subnet migration (may be switched to a different network domain, such as company intranet switched to public WiFi), gateway MAC jump (strongly indicates ARP (Address Resolution Protocol) spoofing or man-in-the-middle attack) and other network environment change events are monitored, the system will mark these events. When the network is restored, the presence of the mark meets the preset risk condition, thereby the process of sending an authentication request to the authentication server is triggered, so as to ensure that in the scenario where the risk is significantly increased, the security authentication is enforced, and the vulnerability of lack of security check caused by direct reconnection in the related art is remedied.

[0057] When the authentication is triggered, the authentication request contains the device fingerprint (used to identify the user equipment) and the network environment fingerprint (used to identify the current restored network environment characteristics, such as new SSID / BSSID, new IP segment, new gateway MAC, etc.), so as to provide information for the authentication server to perform risk assessment and identity verification. Specifically, the authentication server can compare the current network environment fingerprint with historical trusted records, device Authorization network list, etc., to judge whether the current network is trusted or whether there is an anomaly.

[0058] Among them, the step of monitoring the network environment based on the virtual network card provided by the application can be: during network interruption, the virtual network card accesses and listens to the underlying network environment signals (such as scanning available WiFi SSID / BSSID, detecting ARP table changes, DHCP lease state, link layer events, etc.) through the operating system interface or the driving layer capability.

[0059] In some embodiments, the authentication request further includes a one-time challenge code; the method further includes: generating, by the authentication server, a challenge value based on the timestamp corresponding to the authentication request and the one-time challenge code, and returning the challenge value to the virtual network card; signing, by the virtual network card, the challenge value according to the TEE hardware key to obtain a response value, and sending the response value to the authentication server, so that: the authentication server authenticates the signature validity and the timestamp window according to the response value, and returns the generated authentication result to the virtual network card.

[0060] In the present application, the one-time challenge code (Nonce) has uniqueness and unpredictability. Each time the virtual network card (or the TEE environment cooperating with it) generates a unique and random challenge code (Nonce) that is used only once to ensure that each authentication interaction is independent and unpredictable. Since the Nonce is different each time the authentication is performed, even if the attacker intercepts the previous authentication data packet, it cannot use the old Nonce to initiate a new valid authentication, which has the feature of anti-replay.

[0061] The timestamp corresponding to the authentication request can be the timestamp of the request initiation included in the authentication request, or the timestamp corresponding to the authentication server receiving the authentication request. Based on the timestamp, the generated challenge value has timeliness.

[0062] Further, by introducing the one-time challenge value and the timestamp, the challenge value generated by the authentication server has uniqueness, unpredictability and timeliness. By using the hardware security capability (TEE hardware key), the response signature is securely generated on the device side, which can effectively prove the physical identity of the device and the trusted running environment. Finally, the authentication server verifies the signature validity and the timeliness of the request, which greatly avoids identity cloning attacks and credential replay attacks.

[0063] The risk authentication process provided by the present application ensures that the object of network reconnection is a legal and trusted device before network reconnection, prevents the situation that an attacker impersonates a legal device or hijacks a connection by eavesdropping, intercepting and replaying authentication data packets, and at the same time, the risk authentication result provides a reference basis for subsequent execution of data recovery transmission (network reconnection) or execution of a security fuse operation.

[0064] According to a specific embodiment of the present application, Figure 3 is a main flowchart of a network reconnection method based on a virtual network card according to an embodiment of the present application. As shown in the figure,Figure 3 As shown, during the network interruption, the virtual network card actively scans the network environment of the external network (target network), and locally marks the monitored network change event. When facing network recovery, the virtual network card triggers a NETDEV_UP event (the event is used to indicate that the state of the network device (such as the virtual network card described above) has changed from “down” to “up”. That is, the virtual network card is ready for data transmission). At this time, the virtual network card can determine whether the preset risk condition is met according to the locally marked network change event, that is, whether to perform risk authentication. If the risk authentication is performed, the virtual network card sends an authentication request including the device fingerprint, the environment fingerprint and the one-time challenge code to the authentication server. The authentication server can first verify the device fingerprint and the environment fingerprint, and when the verification is passed, generate a challenge value based on the timestamp and the one-time challenge code corresponding to the authentication request, and return the challenge value to the virtual network card; the virtual network card signs the challenge value according to the TEE hardware key to obtain a response value, and sends the response value to the authentication server, so that: the authentication server authenticates the signature validity and the timestamp window according to the response value, and returns the generated authentication result to the virtual network card.

[0065] According to a specific embodiment of the embodiment of the application, the driver layer of the virtual network card can trigger the NETDEV_DOWN and NETDEV_UP events in real time by hooking the system network event (such as netdevice_notifier of Linux or NetworkListManager of Windows), so as to realize non-invasive monitoring without relying on the application layer heartbeat packet, and reduce the false positive rate.

[0066] In some embodiments, in the case where the authentication result is authentication passed, the above method further comprises: first sending the key network protocol control message in the buffered data packet to the physical network card via the encrypted tunnel, and then sending the remaining data packet to the physical network card via the encrypted tunnel.

[0067] According to a specific embodiment of the present application, first, the network protocol control packets that have high timeliness and basic service for maintaining network connection state and basic services (i.e., the above-mentioned key network protocol control packets) are accurately positioned; at the most initial moment of network recovery communication, these key network protocol control packets are preferentially and quickly sent; by preferentially sending the key network protocol control packets, the timeliness requirement of the upper system protocol stack (especially the TCP protocol stack) is quickly met, and the protocol timeout and connection interruption caused by authentication delay are effectively prevented. Thus, the continuity of the existing network session is ensured, the TCP connection and the like are avoided from being unexpectedly reset or disconnected, the overall network recovery efficiency is improved, the upper application completely feels no network interruption and authentication process, the connection is not disconnected, the session does not need to be reconstructed, and the "unaware" user experience is ensured.

[0068] Among them, the key network protocol control packet provided by the present application can include a TCP ACK packet (the TCP ACK packet is used to confirm data reception and keep the connection active; TCP, Transmission Control Protocol, transmission control protocol; ACK, Acknowledgment, confirmation), a SYN / ACK packet (used to establish a connection; SYN, Synchronize Sequence Numbers, synchronization sequence number), a Keepalive packet (the Keepalive packet is used to detect whether the connection is alive), a DHCP packet (used to obtain or renew an IP address), an ARP response packet (used to resolve an IP address to a MAC address), and the like. The key network protocol control packet can quickly notify the server that the local network has been restored and the session is still valid. It is helpful to prevent the upper protocol (such as TCP) from triggering timeout retransmission, connection reset (RST, Reset, reset) or disconnection due to a long time of not receiving a response, and ensure the continuity and stability of the existing network session.

[0069] It can be understood that although the sending priority logic is increased, since the key control packet is usually very small in size, preferentially sending them has little effect on the overall data transmission delay. On the contrary, the limited transmission of the key control packet can quickly stabilize the protocol stack state, avoid the huge delay overhead caused by the need to rebuild the entire connection due to protocol timeout (rebuilding the connection involves multiple handshakes, application layer re-authentication, etc.), and thus improve the efficiency of network recovery as a whole.

[0070] In some embodiments, the step of intercepting and redirecting the data packet sent by the upper application through the system protocol stack includes: during the interception of the data packet, the intercepted data packet is flow compressed, and the compressed data is encrypted and cached.

[0071] Based on the above settings, the intercepted original network packets (which may contain a large amount of redundant information such as protocol header repetition, application data repetition or compressible content) are subjected to streaming compression, which can greatly reduce the volume of cached data, enabling the system to support longer / larger data interruption caching under limited resources, avoiding data loss or scheme failure due to exhausted cache space; by strongly encrypting the compressed cached data, even if the cache layer is accessed by non-authenticated access, attackers cannot directly obtain the original data content, providing critical security protection for sensitive data temporarily stored locally.

[0072] Among them, the streaming compression provided by the present application can adopt a network data stream suitable algorithm with low delay, such as LZ4 (a lossless compression algorithm, known for its extremely fast compression and decompression speed, suitable for real-time data processing and network transmission), Snappy (a compression algorithm, designed to provide fast compression and decompression operations while maintaining high compression ratio), Zstd (a lossless compression algorithm that combines compression speed and compression ratio, providing multiple compression levels to adapt to different performance and compression ratio requirements) and the like. It can be understood that according to different actual application scenarios, suitable streaming compression algorithm can be selected according to actual situation.

[0073] In some embodiments, the above method further comprises: monitoring network events of the local device based on the virtual network card, and triggering a network interruption event or a network recovery event according to the monitoring result.

[0074] The present application uses the virtual network card as the network event monitoring center and state machine trigger based on the above scheme. By giving the virtual network card the ability to actively monitor and judge the network state, it can independently define and trigger the "network interruption event" and "network recovery event" independently of the operating system native mechanism. This helps to ensure that the core process of the entire security reconnection scheme (caching, authentication, recovery / fuse) can be started and executed based on more comprehensive, timely and security policy-compliant state judgments.

[0075] In some examples, the virtual network card, by virtue of its unique position between the system protocol stack and the physical network card, can access and synthesize multi-source information from underlying driving signals (such as physical link interruption, signal strength), operating system protocol stack events (such as IP address invalidation, route unreachable, DNS (Domain Name System) failure), and even security threat intelligence (such as detection of ARP spoofing attack). This makes the virtual network card more accurate and more in line with actual communication capabilities in determining whether the network is "truly interrupted" or "truly recovered" than traditional operating system mechanisms that rely on a single indicator (such as physical link on-off). Based on the above settings, both over-reaction to temporary jitter or local faults and identification of situations where the physical layer is not broken but is actually unavailable or at high risk are avoided.

[0076] In some examples, the virtual network card not only passively responds to underlying events, but also actively probes network status (such as sending probe packets to check gateway reachability, verifying DNS resolution). When potential security threats (such as abnormal changes in gateway MAC but the physical link is not broken) or hidden interruptions (such as physical link on but upper-layer IP unreachable) are detected, "network interruption events" can be actively triggered to start data cache protection mechanisms in advance, achieving proactive defense.

[0077] Based on the above settings, the virtual network card is responsible for monitoring and triggering core events (network interruption / recovery), and also ensures the consistency of the internal logic processing state of the entire security reconnection scheme, so that subsequent operations (caching, authentication, reconnection / circuit breaking) are all based on the judgment of the same event source, avoiding logical errors or security vulnerabilities caused by inconsistent understanding of network status by different modules.

[0078] In some embodiments, the above security circuit breaking operation includes one or more of emptying cached data packets, sending alarm logs, and locking the local device; wherein the method further comprises: counting the number of failed authentications, and if the number of failed authentications exceeds a preset threshold, triggering remote locking of the device and reporting to a security management platform.

[0079] The security circuit breaking operation of emptying cached data packets: helps to ensure that sensitive data that is temporarily stored in the local cache and has not been sent will not be accidentally or forcibly sent out after authentication fails (may have accessed a malicious network), preventing data leakage.

[0080] The security circuit breaking operation of sending alarm logs: can record and report authentication failure events and their context (time, device ID, network fingerprint, failure reason, etc.) in a timely manner, providing a basis for event tracing and threat analysis for security teams, facilitating rapid response and investigation.

[0081] Locking the security fuse operation of the local device: all network communication capabilities of the device are immediately stopped (even further limiting user login or critical functions), physically isolating the device from the connection with the malicious network (if any), blocking ongoing or subsequent possible attacks (such as malicious instruction issuance, data export).

[0082] By performing the security fuse operation, potential data leakage or attack behavior can be immediately blocked, and damage can be controlled to the minimum range. Further, by counting the number of authentication failures and triggering device remote locking and reporting to the security management platform when the preset threshold is exceeded, the security protection of the scenario where the attacker who encounters repeated attempts to bypass authentication (such as cracking, credential stealing attempts) or the device is lost / stolen and maliciously used can be realized.

[0083] Based on the above settings, through the hierarchical fuse (especially the remote locking fuse operation) and the failure counting mechanism, the attacker must complete the attack within a limited number of failures to be successful, otherwise the device locking will be triggered to cause the attack to completely fail, thereby improving the security of the network reconnection scheme by significantly increasing the cost and risk of the attacker.

[0084] According to a specific embodiment of the present application, Figure 4 is a main flow diagram of a network reconnection method based on a virtual network card according to an embodiment of the present application in the case of authentication passing and authentication not passing after network recovery. As shown in Figure 4 , the network is recovered and the risk authentication is performed. If the authentication is passed, the virtual network card can release the cached data and send the cached data to the physical network card (preferentially sending the key network protocol control packet) via the established encrypted tunnel, and then transmit the cached data to the external network via the physical network card to recover the network communication. At the same time, the virtual network card sends a real network recovery response to the system protocol stack, and after receiving the new data packet issued by the upper layer application via the system protocol stack, the virtual network card can also send the new data packet to the physical network card via the established encrypted tunnel, and then transmit the new data packet to the external network via the physical network card. In addition, for the case of authentication not passing, Figure 4 , a specific implementation example of emptying the encrypted data of the virtual network card cache and sending a security alarm to the authentication server and sending a network state disconnection reminder to the system protocol stack is shown.

[0085] The network reconnection method based on the virtual network card provided in the embodiments of the present application overcomes the problem of high security risk caused by automatic reconnection when the network link is restored in the related art, achieves the technical effects of buffering the data packets based on the virtual network card when the network is interrupted, returning the simulated network available state response to the upper-layer application, and when the network is restored, sending the authentication request to the authentication server based on the virtual network card to perform the risk authentication if the preset risk condition is met, and restoring the network communication when the authentication is passed, and achieves the technical effects of improving the security of network reconnection on the basis of guaranteeing the user's non-perception during network reconnection.

[0086] Based on the network reconnection method based on the virtual network card provided in the embodiments of the present application, the embodiments of the present application further provide a network reconnection system based on a virtual network card, as shown in the following Figure 5 The network reconnection system 500 based on the virtual network card includes:

[0087] The buffering module 501 is configured to, in response to a network interruption event, intercept and redirect the data packets issued by the upper-layer application through the system protocol stack based on the virtual network card arranged between the system protocol stack and the physical network card, buffer the data packets, and return the simulated network available state response to the system protocol stack.

[0088] The authentication module 502 is configured to, in response to a network recovery event, send an authentication request to an authentication server based on the virtual network card if the preset risk condition is met, so that the authentication server performs the risk authentication according to the authentication request.

[0089] The reconnection module 503 is configured to, if the authentication is passed, send the buffered data packets to the physical network card, and transmit the data packets to the external network via the physical network card to restore the network communication; and if the authentication is not passed, perform the security fuse operation.

[0090] Since the network reconnection system 500 based on the virtual network card in the present application is used to implement any one of the above network reconnection methods based on the virtual network card, the execution operations of each module in the network reconnection system 500 based on the virtual network card are consistent with those in the above network reconnection method based on the virtual network card, and all the beneficial effects corresponding to the above network reconnection method based on the virtual network card can be achieved. Therefore, the present application will not be described here.

[0091] The embodiment of the present application also provides a non-transitory machine readable medium storing a computer program, wherein the computer program is used to make the computer execute the method of the embodiment of the present application when the computer program is executed by the processor of the computer.

[0092] The embodiment of the present application also provides a computer program product comprising a computer program, wherein the computer program is used to make the computer execute the method of the embodiment of the present application when the computer program is executed by the processor of the computer. The computer program product should be understood as a software product mainly realizing the method of the present application through the computer program.

[0093] The embodiment of the present application also provides an electronic device comprising at least one processor and a memory connected with the at least one processor in communication. The memory stores a computer program capable of being executed by the at least one processor, and the computer program is used to make the electronic device execute the method of the embodiment of the present application when the computer program is executed by the at least one processor.

[0094] Reference Figure 6 The structure block diagram of the electronic device which can be the server or the client as the embodiment of the present application will be described, which is an example of the hardware device that can be applied to each aspect of the present application. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices and other similar computing devices. The components shown in this paper, their connections and relationships, and their functions are only as examples, and are not intended to limit the implementation of the present application described and / or claimed herein.

[0095] As Figure 6As shown, the electronic device includes a computing unit 601 that can perform various appropriate actions and processes in accordance with a computer program stored in a read only memory (ROM) 602 or a computer program loaded into a random access memory (RAM) 603 from a storage unit 608. In the RAM 603, various programs and data required for operation of the electronic device can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0096] A plurality of components in the electronic device are connected to the I / O interface 605, including an input unit 606, an output unit 607, a storage unit 608, and a communication unit 609. The input unit 606 can be any type of device that can input information to the electronic device, and can receive inputted numerical or character information, and generate key signal inputs related to user settings and / or function controls of the electronic device. The output unit 607 can be any type of device that can present information, and can include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 608 can include, but is not limited to, a magnetic disk, an optical disk. The communication unit 609 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include, but is not limited to, a modem, a network card, an infrared communication device, and / or a wireless communication transceiver, such as a Bluetooth device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0097] The computing unit 601 can be various general and / or special purpose processing components having processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a CPU, a graphics processing unit (GPU), various special purpose artificial intelligence (AI) computing units, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 601 performs various methods and processes described above. For example, in some embodiments, the method embodiments of the present application can be implemented as a computer program tangibly embodied in a machine readable medium, such as the storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device via the ROM 602 and / or the communication unit 609. In some embodiments, the computing unit 601 can be configured to perform the above-described methods by any other appropriate means, such as by means of firmware.

[0098] A computer program for implementing the method of the embodiments of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, when executed by the processor or controller, generate the functions / operations specified in the flow diagrams and / or the block diagrams. The computer programs can be executed entirely on a machine, partially on a machine, partially on a machine as a standalone software package and partially on a remote machine, or entirely on a remote machine or server.

[0099] In the context of the embodiments of the present application, the machine-readable medium can be a tangible medium that can contain or store the program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. The machine-readable signal medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, or infrared system, apparatus, or device, or any suitable combination thereof. More specific examples of the machine-readable storage medium will include one or more of an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0100] It should be noted that the term "comprising" and variations thereof used in the embodiments of the present application are open-ended, i.e., "including but not limited to". The term "based on" is "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The terms "a" or "an", as used herein in the context of describing structural or compositional aspects of the embodiments of the present application, are to be interpreted to cover "one or more". The terms "plurality" and "a plurality", as used herein in the context of describing structural or compositional aspects of the embodiments of the present application, are to be interpreted to cover "one or more".

[0101] The information / data related to the user (including but not limited to user device information / data, user personal information / data, information / data for analysis, stored information / data, displayed information / data, etc.) involved in the embodiments of the present application are information / data permitted by the user or information / data agreed by all parties, and the collection, use and processing of the related information / data need to comply with relevant laws, regulations and standards, and provide corresponding operation portal for the user to choose to agree or refuse.

[0102] The steps recited in the method embodiments provided by the embodiments of the present application can be executed in different orders and / or in parallel. In addition, the method embodiments can include additional steps and / or omit the execution of the steps shown. The scope of protection of the present application is not limited in this respect.

[0103] The word "comprise" in this specification does not exclude the presence of elements other than those stated in a clause, paragraph or claim. The words "include" and "comprise" and the terms "including" and "comprising" are not used in a restrictive sense. The word "or" is used in a non-exclusive sense, unless specifically stated otherwise. The word "comprise" is used in the sense of "include" and "contain", and not in the sense of "consist only of". The word "comprise" is used in the sense of "include" and "contain", and not in the sense of "consist only of". The word "comprise" is used in the sense of "include" and "contain", and not in the sense of "consist only of". The word "comprise" is used in the sense of "include" and "contain", and not in the sense of "consist only of". The word "comprise" is used in the sense of "include" and "contain", and not in the sense of "consist only of". The word "comprise" is used in the sense of "include" and "contain", and not in the sense of "consist only of".

[0104] The above-described embodiments are merely illustrative of the present application and do not limit the scope of the present application. The scope of the present application is not limited by the above-described embodiments, and various modifications and improvements can be made by those skilled in the art without departing from the spirit of the present application. Accordingly, the scope of the present application should be determined by the appended claims.

Claims

1. A network reconnection method based on a virtual network interface card (NIC), characterized in that, include: In response to a network interruption event, a virtual network interface card (NIC) is set between the system protocol stack and the physical NIC to intercept and redirect data packets sent by upper-layer applications through the system protocol stack, cache the data packets, and return a simulated network availability response to the system protocol stack. In response to a network recovery event, when preset risk conditions are met, an authentication request is sent to the authentication server based on the virtual network card, so that the authentication server performs risk authentication according to the authentication request; If authentication is successful, the cached data packet is sent to the physical network card and transmitted to the external network via the physical network card to restore network communication; If authentication fails, a circuit breaker operation will be executed; among which, The method further includes: during network outages, monitoring the network environment based on the virtual network interface card (NIC) and marking detected network change events; wherein the network change events include one or more of SSID / BSSID changes, IP subnet migrations, and gateway MAC address transitions; in response to a network recovery event, if a network environment change event is marked, a preset risk condition is met, and an authentication request including a device fingerprint and a network environment fingerprint is sent to the authentication server based on the virtual NIC, so that the authentication server determines the authentication result based on the authentication request; if the authentication result is successful, an encrypted tunnel is constructed between the virtual NIC and the physical NIC, and a real network recovery response is returned to the system protocol stack; The authentication request further includes a one-time challenge code; the method further includes: using the authentication server to generate a challenge value based on the timestamp corresponding to the authentication request and the one-time challenge code, and returning the challenge value to the virtual network interface card; the virtual network interface card signs the challenge value according to the TEE hardware key to obtain a response value, and sends the response value to the authentication server, so that: the authentication server authenticates the signature validity and timestamp window according to the response value, and returns the generated authentication result to the virtual network interface card.

2. The method according to claim 1, characterized in that, If the authentication result is successful, the method further includes: First, the key network protocol control messages in the cached data packets are sent to the physical network card via the encrypted tunnel, and then the remaining data packets are sent to the physical network card via the encrypted tunnel.

3. The method according to claim 1, characterized in that, The steps of intercepting and redirecting data packets sent by upper-layer applications via the system protocol stack, and caching the data packets, include: During packet interception, the intercepted packets are stream-compressed and the compressed data is encrypted and cached.

4. The method according to claim 1, characterized in that, The method further includes: The network events of the local device are monitored based on the virtual network card, and the network interruption event or the network recovery event is triggered according to the monitoring results.

5. The method according to claim 1, characterized in that, The security circuit breaker operation includes one or more of the following: clearing the buffered data packets, sending an alarm log, and locking the local device; wherein, the method further includes: The number of authentication failures is counted. If the number of authentication failures exceeds a preset threshold, the device is remotely locked and the incident is reported to the security management platform.

6. A network reconnection system based on a virtual network interface card (NIC), characterized in that, include: The caching module is used to respond to network interruption events by intercepting and redirecting data packets sent by upper-layer applications through the system protocol stack via a virtual network interface card set between the system protocol stack and the physical network interface card, caching the data packets, and returning a simulated network availability response to the system protocol stack. The authentication module is used to respond to a network recovery event and, when preset risk conditions are met, send an authentication request to the authentication server based on the virtual network card, so that the authentication server performs risk authentication according to the authentication request. The reconnection module is used to send the cached data packet to the physical network card if the authentication is successful, and then transmit it to the external network via the physical network card to restore network communication; If authentication fails, a circuit breaker operation will be executed; among which, The system further includes a network change event marking module, used to monitor the network environment based on the virtual network interface card (NIC) and mark the detected network change events during network outages; wherein the network change events include one or more of SSID / BSSID changes, IP subnet migrations, and gateway MAC address transitions; the authentication module is further used to: in response to a network recovery event, if a network environment change event is marked, and a preset risk condition is met, send an authentication request including a device fingerprint and a network environment fingerprint to the authentication server based on the virtual NIC, so that the authentication server determines the authentication result based on the authentication request; the reconnection module is further used to: if the authentication result is successful, construct an encrypted tunnel between the virtual NIC and the physical NIC, and return a real network recovery response to the system protocol stack; The authentication request further includes a one-time challenge code; the system also includes a challenge value generation module, used by the authentication server to generate a challenge value based on the timestamp corresponding to the authentication request and the one-time challenge code, and return the challenge value to the virtual network interface card; the authentication module is further used to: sign the challenge value based on the virtual network interface card according to the TEE hardware key to obtain a response value, and send the response value to the authentication server, so that: the authentication server authenticates the signature validity and timestamp window based on the response value, and returns the generated authentication result to the virtual network interface card.

7. An electronic device, comprising: A processor and a memory storing a program, characterized in that the program includes instructions that, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 5.

8. A non-transitory machine-readable medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 5.

Images