Method and system for securing network layer of a remote access embodied smart device

Abstract

The application discloses a network layer security guarantee method and system for remotely accessing embodied intelligent devices, and belongs to the technical field of network security and mobile communication network. The technical problem to be solved by the application is how to prevent port scanning and security threats of violent cracking, and guarantee the security of embodied intelligent applications exposed to public networks. The technical scheme is as follows: an SDK plug-in is installed in advance on a user end, and the SDK plug-in of the user end is authorized, the authorization content including an access application list, the user carrying corresponding message identification information when accessing corresponding applications on the access application list, the public network server checking the message identification information, the public network server allowing the user end to access corresponding applications if the message identification information is successfully checked, the public network server rejecting the user end to access corresponding applications and silently discarding and blocking unauthorized access if the message identification information fails to be checked.

Description

Technical Field

[0001] This invention relates to the fields of network security and mobile communication network technology, specifically to a network layer security protection method and system for remote access to embodied intelligent devices. Background Technology

[0002] In scenarios involving remote access to embodied smart devices, it's often necessary to map multiple applications on these devices, currently under NAT, to the public internet so that users can access them anytime, anywhere. However, conventional ACL security policies are difficult to configure, increasing the risk of these applications being scanned and brute-forced on the public internet. For example, in scenarios like remote robot control or remote fault location, multiple applications on embodied smart devices under NAT typically need to be mapped to the public internet, with each application employing its own application-layer security mechanism, such as username / password protection. However, because the applications are exposed to the public internet while the user (operator or maintenance personnel) is usually in a NAT environment, conventional ACL security policies suffer from limitations in accurately determining the user's source IP address, making ACL rules difficult to configure and further increasing the risk of these applications being scanned and brute-forced on the public internet.

[0003] Therefore, how to prevent security threats such as port scanning and brute-force attacks, and ensure the security of embodied intelligent applications exposed on the public network, is a technical problem that urgently needs to be solved. Summary of the Invention

[0004] The technical objective of this invention is to provide a network layer security protection method and system for remotely accessing embodied intelligent devices, in order to solve the problem of how to prevent security threats such as port scanning and brute-force attacks, and to ensure the security of embodied intelligent applications exposed on the public network.

[0005] The technical objective of this invention is achieved as follows: a network layer security method for remote access to embodied intelligent devices. This method involves pre-installing an SDK plugin on the user's end and authorizing the SDK plugin. The authorization includes accessing a list of applications. When a user accesses a corresponding application on the application list, the user will carry corresponding message identification information. The public network server verifies the message identification information.

[0006] If the message identifier information is successfully verified, the public network server allows the user client to access the corresponding application.

[0007] If the message identification information verification fails, the public network server will refuse the user's access to the corresponding application and silently discard it, blocking unauthorized access.

[0008] The SDK plugin has network detection and packet encapsulation capabilities. Network detection refers to setting traffic characteristic rules through the iptables method. When traffic matching the characteristics is hit, the corresponding packet is further encapsulated.

[0009] Message identification information refers to the identification generated based on user authorization information, application, time, and access location information.

[0010] As a preferred option, the user-side SDK plugin obtains user identity authorization and access to the application list by accessing a specific service center;

[0011] When the license expires or a new application is added, the SDK plugin on the user's end accesses a specific service center to re-authorize.

[0012] Preferably, the encapsulation location of the message identification information includes AH, ESP, IPv6 DOH, or a custom header above the UDP / TCP layer.

[0013] As a preferred option, the public network server authenticates the message identification information of the user terminal based on the same encryption algorithm. Specifically, a fixed-length authentication ciphertext is calculated based on the visitor's identity, the type of the access target, the message characteristics, and the time information. The authentication ciphertext is calculated by the user terminal's SDK plugin and carried in the message. The public network server calculates the ciphertext based on the same information and performs verification.

[0014] Ideally, the encryption algorithm should be HMAC-SHA, MD5, or AES.

[0015] As a preferred option, when a user accesses an application within the application list, all sent business messages carry the corresponding message identification information.

[0016] A network layer security system for remote access to embodied intelligent devices is disclosed. The system includes a user terminal, a specific service center, a public network server, and the embodied intelligent device. The embodied intelligent device maps its embodied intelligent application to the public network server and registers it with the specific service center. The user terminal installs an SDK plugin and registers with the specific service center to obtain identity authorization and an access application list. The user terminal injects packet characteristics into the protocol stack using the iptables method. When a user accesses a specific embodied intelligent application, the system generates and encapsulates a packet identifier based on the corresponding rules. The public network server identifies the packet identifier information, generates and verifies its correctness using the same algorithm, and packets that pass verification are allowed normal access.

[0017] As a preferred option, the SDK plugin has network detection and packet encapsulation capabilities; network detection refers to setting traffic characteristic rules through the iptables method; when traffic matching the characteristics is detected, the corresponding packets are further encapsulated;

[0018] Message identification information refers to the identification generated based on user authorization information, application, time, and access location information.

[0019] An electronic device includes: a memory and at least one processor;

[0020] The memory contains computer programs;

[0021] The at least one processor executes the computer program stored in the memory, causing the at least one processor to perform the network layer security assurance method for remote access to embodied intelligent devices as described above.

[0022] A computer-readable storage medium storing a computer program that can be executed by a processor to implement the network layer security method for remote access to an embodied intelligent device as described above.

[0023] The network layer security method and system for remote access to embodied intelligent devices of the present invention have the following advantages:

[0024] (i) The present invention uses a network layer message identification method for client security authentication. The specified identification information is carried in the message of the user accessing a specific service. The public network server verifies the identification information of the message to ensure the security of the embodied intelligent application exposed on the public network.

[0025] (ii) When using the present invention to access specific embodied intelligent services mapped to the public Internet, the uplink packets of the user terminal will carry a packet identifier that is unique to the user. This packet identifier is generated based on pre-authorization and will be used by the server for security authentication to prevent security threats such as port scanning and brute-force attacks. It is more secure than general ACL rules.

[0026] (III) The present invention generates message identifiers based on pre-authorization information from the user end for security authentication, which can effectively prevent security threats such as port scanning and brute-force attacks at the network layer, improve the security level of the network, and protect the security of remote service-embodied intelligent devices. Attached Figure Description

[0027] The invention will be further described below with reference to the accompanying drawings.

[0028] Appendix Figure 1 A schematic diagram of a network layer security system for remote access to embodied intelligent devices. Detailed Implementation

[0029] The network layer security protection method and system for remote access to embodied intelligent devices of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0030] Example 1:

[0031] This embodiment provides a network layer security method for remote access to embodied smart devices. This method involves pre-installing an SDK plugin on the user's device and authorizing the SDK plugin. The authorization includes access to a list of applications. When a user accesses a corresponding application on the application list, the user will carry corresponding message identification information. The public network server verifies the message identification information.

[0032] If the message identifier information is successfully verified, the public network server allows the user client to access the corresponding application.

[0033] If the message identification information verification fails, the public network server will refuse the user's access to the corresponding application and silently discard it, blocking unauthorized access.

[0034] The SDK plugin has network detection and packet encapsulation capabilities. Network detection refers to setting traffic characteristic rules through the iptables method. When traffic matching the characteristics is hit, the corresponding packet is further encapsulated.

[0035] Message identification information refers to the identification generated based on user authorization information, application, time, and access location information.

[0036] In this embodiment, the user-side SDK plugin obtains user identity authorization and access to the application list by accessing a specific service center.

[0037] When the license expires or a new application is added, the SDK plugin on the user's end accesses a specific service center to re-authorize.

[0038] In this embodiment, a specific service center refers to a place that provides additional protection for some private services (e.g., services related to embodied intelligence) that users want to access. These private services will be registered with the specific service center. The client plugin requests the application list and characteristics of the "private services" from the specific service center to identify the event that "the client wants to access these private services," thereby carrying an identifier for subsequent access to these services.

[0039] In this embodiment, the encapsulation location of the message identification information includes AH, ESP, IPv6 DOH, or a customized header above the UDP / TCP layer. Depending on the business requirements, an encapsulation header is carried above the UDP / TCP layer. This header can be based on RFC specifications such as GRE or VxLAN, and the encapsulation information is carried in the extended fields of this type of header. Alternatively, a completely customized header can be used to carry the encapsulation information, and its header type is specified by the UDP / TCP port.

[0040] In this embodiment, the public network server authenticates the message identification information of the user terminal based on the same encryption algorithm. Specifically, a fixed-length authentication ciphertext is calculated based on the visitor's identity, the type of the access target, the message characteristics, and the time information. The authentication ciphertext is calculated by the user terminal's SDK plugin and carried in the message. The public network server calculates the ciphertext based on the same information and performs verification.

[0041] The encryption algorithm used in this embodiment is HMAC-SHA, MD5, or AES.

[0042] In this embodiment, when the user terminal accesses applications within the application list, it carries corresponding message identification information for all sent business messages.

[0043] Example 2:

[0044] As attached Figure 1 As shown, this embodiment provides a network layer security system for remote access to embodied smart devices. The system includes a user terminal, a specific service center, a public network server, and the embodied smart device. The embodied smart device maps its embodied smart application to the public network server and registers it with the specific service center. The user terminal installs an SDK plugin and registers with the specific service center to obtain identity authorization and an application access list. The user terminal injects packet characteristics into the protocol stack using the iptables method. When a user accesses a specific embodied smart application, the system generates and encapsulates a packet identifier based on the corresponding rules. The public network server identifies the packet identifier information, generates and verifies its correctness using the same algorithm, and packets that pass verification are allowed normal access.

[0045] The SDK plugin in this embodiment has network detection and packet encapsulation capabilities; network detection refers to setting traffic characteristic rules through the iptables method; when traffic matching the characteristics is hit, the corresponding packet is further encapsulated.

[0046] In this embodiment, the message identification information refers to the identifier generated based on user authorization information, application, time, and access location information.

[0047] Example 3:

[0048] This embodiment also provides an electronic device, including: a memory and a processor;

[0049] The memory stores the instructions executed by the computer.

[0050] The processor executes computer execution instructions stored in the memory, causing the processor to perform the network layer security assurance method for remote access to embodied intelligent devices in any embodiment of the present invention.

[0051] The processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), off-the-shelf programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor can be a microprocessor or any conventional processor.

[0052] Memory is used to store computer programs and / or modules. The processor implements various functions of the electronic device by running or executing the computer programs and / or modules stored in the memory, and by accessing data stored in the memory. Memory can mainly include a program storage area and a data storage area. The program storage area can store the operating system, at least one application program required for a function, etc.; the data storage area can store data created based on the use of the terminal, etc. In addition, memory can also include high-speed random access memory, and can also include non-volatile memory, such as hard disks, RAM, plug-in hard disks, smart memory cards (SMC), secure digital cards (SD cards), flash memory cards, at least one disk storage device, flash memory device, or other volatile solid-state storage devices.

[0053] Example 4:

[0054] This embodiment also provides a computer-readable storage medium storing multiple instructions, which are loaded by a processor to cause the processor to execute the network layer security protection method for remote access to embodied intelligent devices according to any embodiment of the present invention. Specifically, a system or apparatus equipped with a storage medium may be provided, on which software program code implementing the functions of any of the above embodiments is stored, and the computer (or CPU or MPU) of the system or apparatus may read and execute the program code stored in the storage medium.

[0055] In this case, the program code read from the storage medium can itself implement the function of any of the above embodiments, and therefore the program code and the storage medium storing the program code constitute part of the present invention.

[0056] Storage media embodiments for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RYM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, program code can be downloaded from a server computer via a communication network.

[0057] Furthermore, it should be clear that not only can the program code read by the computer be executed, but also the operating system or other components operating on the computer can be instructed based on the program code to perform some or all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0058] Furthermore, it is understood that the program code read from the storage medium is written to the memory set in the expansion board inserted into the computer or to the memory set in the expansion unit connected to the computer. Then, based on the instructions of the program code, the CPU or other components installed on the expansion board or expansion unit execute some and all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0059] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network layer security method for remote access to an embodied intelligent device, characterized in that, This method involves pre-installing an SDK plugin on the user's device and authorizing the plugin by accessing a specific service center. The authorization includes access to a list of applications. When a user accesses an application on this list, they will carry the corresponding message identifier information. The public network server then verifies this message identifier information. If the message identifier information is successfully verified, the public network server allows the user client to access the corresponding application. If the message identification information verification fails, the public network server will refuse the user's access to the corresponding application and silently discard it, blocking unauthorized access. Specifically, the public network server's authentication of the user's message identification information is based on the same encryption algorithm. Specifically, a fixed-length authentication ciphertext is calculated based on the visitor's identity, the type of access target, message characteristics, and time information. The authentication ciphertext will be calculated by the user's SDK plugin and carried in the message. The public network server will calculate the ciphertext based on the same information and perform verification. The SDK plugin has network detection and packet encapsulation capabilities. Network detection refers to setting traffic characteristic rules through the iptables method. When traffic matching the characteristics is hit, the corresponding packet is further encapsulated. Message identification information refers to the identification generated based on user authorization information, application, time, and access location information.

2. The network layer security method for remote access to embodied intelligent devices according to claim 1, characterized in that, The user-side SDK plugin obtains user authentication and access to the application list by accessing a specific service center; When the license expires or a new application is added, the SDK plugin on the user's end accesses a specific service center to re-authorize.

3. The network layer security method for remote access to embodied intelligent devices according to claim 1, characterized in that, The encapsulation location of message identification information includes AH, ESP, IPv6 DOH, or a custom header above the UDP / TCP layer.

4. The network layer security method for remote access to embodied intelligent devices according to claim 1, characterized in that, The encryption algorithm used is HMAC-SHA, MD5, or AES.

5. The network layer security method for remote access to embodied intelligent devices according to claim 1, characterized in that, When a user accesses an application within the application list, all business messages sent by the user client carry the corresponding message identification information.

6. A network layer security system for remote access to embodied intelligent devices, characterized in that, The system includes a user terminal, a specific service center, a public network server, and embodied smart devices. The embodied smart devices map embodied smart applications to the public network server and register with the specific service center. The user terminal installs the SDK plugin and registers with the specific service center to obtain identity authorization and access to the application list. The user terminal sets traffic feature rules using the iptables method. When a user accesses a specific embodied smart application, if traffic matching the features is hit, the corresponding packet identifier is generated and encapsulated. The public network server will identify the message identifier information, recalculate the authentication ciphertext using the same algorithm as the user-end SDK plugin, and compare and verify it with the received message identifier information. Messages that pass the verification will be accessed normally. Otherwise, the public network server will refuse the client's access to the corresponding application and silently discard it, blocking unauthorized access; The SDK plugin has network detection and packet encapsulation capabilities. Network detection refers to setting traffic characteristic rules through the iptables method. When traffic matching the characteristics is hit, the corresponding packet is further encapsulated. Message identification information refers to the identification generated based on user authorization information, application, time, and access location information.

7. An electronic device, characterized in that, include: Memory and at least one processor; The memory contains computer programs; The at least one processor executes the computer program stored in the memory, causing the at least one processor to perform the network layer security assurance method for remote access to embodied smart devices as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that can be executed by a processor to implement the network layer security method for remote access to a embodied smart device as described in any one of claims 1 to 5.

Images