Network security protection method

Abstract

The invention provides a network security protection method, which comprises the following steps of: ensuring the legality and the credibility of an access user side through layered identity verification; after the verification is passed, the VLAN region is matched according to the type of the service system, and the minimum permission ACL rule is configured, so that logic isolation and fine management of network flow are realized, and the problem of excessive permission granting or separation of an access control strategy from an identity context is effectively avoided; real-time data packet feature extraction and threat feature library matching are carried out on accessed traffic to form continuous traffic monitoring and dynamic response capability, and real-time interception is carried out on identified threats; for communication data without threat detection, sensitive information is further extracted, and a hybrid encryption mechanism is adopted for transmission protection, so that data encryption protection is not independent of access and monitoring links any more, and the problem that flow monitoring and data encryption protection links of a network security protection technology are disjointed is solved. And fragmentation vulnerabilities exist in security protection.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security protection method. Background Technology

[0002] With the rapid development of cloud computing and Internet of Things technologies, the number of network access devices has surged, and the demand for data transmission across network segments and regions has become increasingly frequent. Network security faces multi-dimensional threats such as identity forgery, data leakage, and malicious attacks. Building a comprehensive and efficient network security protection system has become the key to ensuring the stable operation of the network.

[0003] Current network security protection primarily revolves around firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS), deployed at the network perimeter to form a protection model of boundary isolation and threat interception. For example, firewalls block unauthorized network access through preset access control policies, while IDS and IPS monitor boundary traffic in real time, identifying and alerting or blocking attacks. Endpoints are protected by installing antivirus software and endpoint security management systems. Antivirus software scans endpoint files based on virus signature databases, while endpoint security management systems collect endpoint behavior data, identify abnormal behavior, and perform isolation and removal operations.

[0004] Existing protection solutions have obvious technical flaws. Boundary protection, endpoint protection, and data encryption modules operate independently. When a security incident occurs, it is impossible to quickly trace the root cause of the problem in each link, nor can it simultaneously optimize the protection strategies of each module based on the incident results. It is difficult to cope with complex security threats across network segments and regions, and is seriously inconsistent with the full-process security requirements under the current hybrid network architecture. Summary of the Invention

[0005] This invention provides a network security protection method to solve the technical problem that the disconnect between access control, traffic monitoring and data encryption protection in existing network security protection technologies leads to fragmented vulnerabilities in security protection.

[0006] On the one hand, the present invention provides a network security protection method, comprising: Obtain the identity information submitted by the user and complete the hierarchical verification, then connect the verified user to the network; Match VLAN zones based on the user's business system type, configure ACL access rules, and open port services according to the principle of least privilege. Extract the data packet features of the network access request initiated by the user terminal, compare the data packet features with a preset threat feature database, and obtain the matching result; If the matching result includes threat characteristics, then an interception operation is performed according to the ACL access rule, and threat event information is recorded synchronously to generate an alarm notification; If the matching result does not include threat characteristics, then the network transmission data of the user terminal is obtained and analyzed to obtain sensitive data; The sensitive data is encrypted using a symmetric encryption algorithm, and then the symmetric encryption key is encrypted using an asymmetric encryption algorithm before being sent from the user end to the receiving end.

[0007] Optionally, obtaining the identity information submitted by the user and completing hierarchical verification, and then connecting the verified user to the network, includes: The system receives user-submitted identity information through a user-interactive interface. The identity information includes at least account password, biometric data, and device identification information. The account password is encrypted using a hash algorithm to generate a password hash value. The password hash value is then compared with the user password hash value pre-stored in the identity authentication server. If the comparison results match, the second level of verification is initiated. If the comparison results do not match, a password error message is returned and a verification failure log is recorded. The biometric data is input into a preset biometric comparison model, which outputs the biometric matching degree. If the biometric matching degree is not lower than a preset threshold, the third level of verification is entered. The biometric comparison model is generated by training a convolutional neural network and is used to extract feature points from fingerprint images, match key regions in face images, and compare spectral features of voiceprint segments. The device identification information is compared one by one with the preset trusted device database in the identity authentication server. If the comparison is successful, the layered verification is deemed successful, and the user terminal is connected to the network. If the comparison fails, the verification process is terminated. The preset trusted device database stores the device identification information of the user's historically verified devices.

[0008] Optionally, based on the user's business system type, a VLAN zone is matched, ACL access rules are configured, and port services are opened according to the principle of least privilege, including: Establish a mapping table between business system types and VLAN numbers; Retrieve the permission information of the business system associated with the user terminal, and query the mapping relationship table based on the permission information of the business system to determine the target VLAN number corresponding to the user terminal; A VLAN allocation command is sent to the network access controller to configure the PVID of the user terminal access port as the target VLAN number; the VLAN allocation command includes the MAC address of the user terminal device and the target VLAN number; ACL rules are preset for VLAN areas, and the configured ACL rules are sent to the network access controller. Network traffic initiated by the user terminal is matched and detected according to the order of the ACL rules. Establish a list of associations between port services and business functions, wherein the list records the port number and the corresponding service type; A port scanning tool is used to probe the servers in the VLAN area accessed by the user terminal to obtain a list of currently open ports. The list of open ports is compared with the associated list to filter out redundant ports that are not in the associated list. Perform a shutdown operation on the redundant port. The shutdown operation includes stopping the service process corresponding to the redundant port through the server operating system, or adding a rule to the ACL rules of the network access controller to deny traffic from the redundant port.

[0009] Optionally, the characteristics of the data packets initiating the network access request from the user terminal are extracted, and the data packet characteristics are compared with a preset threat feature database to obtain a matching result, including: Capture all data packets of network access requests initiated by the user terminal through port mirroring; The data packet is parsed to extract the protocol type, source IP address, destination IP address, source port number, destination port number, and data transmission frequency from the packet header. At the same time, feature fields in the data packet content are extracted to form a data packet feature set. A feature matching algorithm is used to compare the data packet feature set with the feature data in a preset threat feature database one by one to obtain the matching result; the feature matching algorithm includes an exact matching algorithm and a fuzzy matching algorithm.

[0010] Optionally, if the matching result includes threat characteristics, then an interception operation is performed according to the ACL access rule, and threat event information is recorded synchronously to generate an alarm notification, including: Receive the matching result and extract the source IP address, destination IP address, and port number corresponding to the network access request; Based on the ACL access rules, filter out the deny ACL rules corresponding to the source IP address, the destination IP address and the port number; The system sends a rule execution command to the network access controller via the SNMP protocol, activates the corresponding denial-class ACL rule, and blocks the transmission of data packets for the network access request. Collect the feature information of the network access request, including the event occurrence time, user terminal device MAC address, source IP address, destination IP address, matched threat feature type, and interception operation execution time; The feature information is stored in a threat event database in a preset format and associated with the user's authentication record. An alarm notification is generated according to a preset alarm template, which includes the event level, event summary, and a list of key information.

[0011] Optionally, if the matching result does not include threat characteristics, then the network transmission data of the user terminal is obtained, and the network transmission data is analyzed to obtain sensitive data, including: Obtain the data packet corresponding to the network access request from the user terminal; Strip the header information of the data packet and extract the network transmission data of the data packet; Based on a pre-defined sensitive data identification rule base, a regular expression matching algorithm is used to scan the network transmission data segment by segment to identify sensitive fields that conform to the sensitive data feature format. A keyword matching algorithm is used to filter out text fragments that contain the aforementioned sensitive fields; The sensitive fields are merged with the text fragments to remove duplicates, forming sensitive data.

[0012] Optionally, the sensitive data is encrypted using a symmetric encryption algorithm, and then the symmetric encryption key is encrypted using an asymmetric encryption algorithm before being sent from the user end to the receiving end, including: Acquire sensitive data and generate a random symmetric encryption key; Using the symmetric encryption key, the sensitive data is encrypted and a random salt value is added to generate encrypted sensitive data. Obtain the asymmetric encryption public key and perform encryption operations on the symmetric encryption key to generate an encrypted symmetric key; The encrypted sensitive data and the encrypted symmetric key are packaged according to a preset format to generate a data transmission packet; The data transmission packet is sent from the user terminal to the receiving terminal through a preset data transmission channel between the user terminal and the receiving terminal.

[0013] Optionally, the data transmission packet is sent from the user terminal to the receiving terminal through a preset data transmission channel between the user terminal and the receiving terminal, including: An encrypted tunnel is established, and tunnel parameters are configured on the network gateway at the user end and the network gateway at the receiving end, respectively. The tunnel parameters include a pre-shared key, an encryption algorithm, an authentication algorithm, and the public IP address of the encrypted tunnel. The network gateway that sends the data transmission packet to the user terminal encapsulates it and adds header information. The encapsulated data transmission packet is transmitted from the user's network gateway to the receiving network gateway through the encrypted tunnel. The authentication data in the header information is verified. If the verification is successful, the header information is stripped, and the data transmission packet is forwarded to the receiving end.

[0014] Optionally, an encrypted tunnel is established, and tunnel parameters are configured on the network gateway at the user end and the network gateway at the receiving end, respectively, including: Obtain the handshake request initiated by the user terminal to the receiving terminal; Based on the handshake request, a server certificate is generated and sent to the user terminal; The validity of the server certificate is verified. If the server certificate is verified, a random session key is generated, the session key is encrypted using the public key in the server certificate, and then sent to the receiving end. Based on the session key, an encrypted tunnel is established between the user terminal and the receiving terminal.

[0015] Optionally, it also includes: Send a server certificate signed using the SM2 algorithm to the user terminal; the server certificate contains the server's SM2 public key. Verify the validity of the server certificate, generate a random session key, encrypt the session key using the SM2 public key, and send it to the server; The session key is obtained by decrypting with the SM2 private key. The user terminal and the server encrypt the sensitive data based on the SM4 algorithm and complete the data transmission through an encrypted tunnel.

[0016] On the other hand, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the network security protection method as described above.

[0017] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network security protection method as described above.

[0018] On the other hand, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the network security protection method as described above.

[0019] The network security protection method provided by this invention uses layered authentication as the first line of defense to ensure the legitimacy and trustworthiness of the accessing user terminal, laying a trust foundation for subsequent access control based on business type. After successful authentication, VLAN regions are automatically matched according to the business system type and least privilege ACL rules are configured, realizing logical isolation and fine-grained management of network traffic, effectively avoiding the problems of excessive permission granting or access control policies being out of context with identity. Real-time packet feature extraction and threat signature database matching are performed on the accessed traffic to form continuous traffic monitoring and dynamic response capabilities, and real-time interception is performed on identified threats, realizing the logical connection between access control and threat monitoring. For communication data for which no threats are detected, sensitive information is further extracted and a hybrid encryption mechanism is used for transmission protection, so that data encryption protection is no longer independent of the access and monitoring links, thus solving the technical problem of fragmented security protection caused by the disconnect between access control, traffic monitoring and data encryption protection links in existing network security protection technologies. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating the network security protection method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0023] Figure 1 This is a flowchart illustrating the network security protection method provided in an embodiment of the present invention.

[0024] like Figure 1 As shown, the network security protection method provided in this embodiment of the invention mainly includes the following steps: 101. Obtain the identity information submitted by the user and complete the hierarchical verification, then connect the verified user to the network.

[0025] Layered verification refers to dividing the identity verification process into multiple levels, each performing different levels of verification. For example, the first level can perform basic identity verification, such as checking the correctness of the username and password; the second level can perform more in-depth verification, such as confirming the user's identity through SMS verification codes or biometric identification. Through layered verification, it can be ensured that only legitimate users can access the network, thereby improving network security.

[0026] Specifically, the process involves obtaining the identity information submitted by the user and completing layered verification, then connecting the verified user to the network, including: The system receives user-submitted identity information through a user interface. This identity information includes at least the account password, biometric data, and device identification information.

[0027] The system receives user-submitted identity information through user-interactive interfaces, such as computer login pages and mobile verification windows. This identity information must include at least the account and password used for basic identity identification, such as the account and password set during user registration; biometric data used for biometric verification, such as fingerprint images obtained by fingerprint collection devices, facial images captured by cameras, and voiceprint fragments recorded by microphones; and device identification information used for device legitimacy identification, such as the MAC (Media Access Control Address) address and serial number of the terminal device. This completes the information collection preparation before verification.

[0028] The account password is encrypted using a hash algorithm to generate a password hash value. This password hash value is then compared with the user password hash value pre-stored in the identity authentication server. If the comparison results match, the process proceeds to the second level of verification. If the comparison results do not match, a password error message is returned and a verification failure log is recorded.

[0029] The system employs a hash algorithm to perform one-way encryption on the received account password, generating an irreversible password hash value. Then, it retrieves the pre-stored historical password hash value corresponding to the user account from the user information database of the identity authentication server and compares the two for consistency. If the comparison result is consistent (i.e., the entered password matches the historically stored password), the first level of verification is considered successful, and the system proceeds to the second level of verification. If the comparison result is inconsistent, an error message is immediately returned to the user, requesting a re-entry of the password, and detailed information about this verification failure is recorded.

[0030] Biometric data is input into a preset biometric comparison model, which outputs the biometric matching degree. If the biometric matching degree is not lower than a preset threshold, the third level of verification is entered. The biometric comparison model is generated by training a convolutional neural network and is used to extract feature points from fingerprint images, match key regions in face images, and compare spectral features of voiceprint segments.

[0031] The biometric matching model possesses the capability to accurately process multiple types of biometric features. For example, for fingerprint images, the model automatically extracts the endpoints and bifurcation points of the fingerprint ridges and compares them with a historical feature database; for face images, it locates key regions such as the eyes, nose, and lips, and calculates the regional similarity between the current image and historical images; for voiceprint segments, it converts them into a spectrogram and extracts spectral features for matching, ultimately outputting a comprehensive biometric matching score. If the biometric matching score is not lower than a preset threshold, the second level of verification is considered successful, and the process proceeds to the third level; if it is lower than the preset threshold, the verification process is terminated directly, and a biometric verification failure message is returned.

[0032] The device identification information is compared one by one with the preset trusted device database in the identity authentication server. If the comparison is successful, the layered verification is deemed successful, and the user terminal is connected to the network. If the comparison fails, the verification process is terminated. The preset trusted device database stores the device identification information of the user's historically verified devices.

[0033] The authentication process involves retrieving historically verified device identifiers associated with the user account from the identity authentication server's pre-set trusted device database. This includes data such as the MAC addresses of previously used and verified mobile phones and computers. The received device identifiers are then compared against the data in the trusted device database. If a matching historical device identifier is found, the third-level verification is considered successful, and the overall layered verification is complete. At this point, the identity authentication server sends an access permission command to the network access controller. Upon receiving the command, the network access controller assigns the corresponding network access permissions to the user and connects the user to the target network. If no matching device identifier is found in the trusted device database, the verification fails, the entire verification process is terminated, and the user's network access request is rejected.

[0034] 102. Match VLAN zones based on the user's business system type, configure ACL access rules, and open port services according to the principle of least privilege.

[0035] VLANs (Virtual Local Area Networks) divide the network into different logical zones based on the security and isolation requirements of different business systems. Each business system corresponds to one or more VLANs to achieve isolation and control of business traffic. ACLs (Access Control Lists) are a set of predefined rules used to control data access permissions between different VLAN zones, preventing unauthorized access and data leakage. The principle of least privilege for opening port services means that when configuring network access permissions for users, only the minimum port services required by the business system are opened, avoiding unnecessary port openings and thus reducing potential security risks. Through preset configuration, it can be ensured that after users access the network, they can only access the network resources required by the business system, improving the overall security and isolation of the network.

[0036] Specifically, based on the user's business system type, VLAN zones are matched, ACL access rules are configured, and port services are opened according to the principle of least privilege, including: 201. Establish a mapping table between business system types and VLAN numbers.

[0037] This involves pre-establishing a one-to-one mapping table between business system types and VLAN IDs. The business system types need to be categorized according to the enterprise's actual business architecture, such as office systems, financial systems, production systems, and R&D systems. Each business system type is assigned a unique and non-repeating VLAN ID; for example, office systems correspond to VLAN 10, and financial systems correspond to VLAN 20. The mapping table also includes records of the subnet segments corresponding to each VLAN ID. This allows for quick location of unique VLAN network resources based on the business system type, providing fundamental data support for VLAN matching at the user end.

[0038] 203. Retrieve the permission information of the business system associated with the user terminal, and query the mapping relationship table based on the permission information of the business system to determine the target VLAN number corresponding to the user terminal.

[0039] This process involves retrieving the business system permission information associated with the user terminal that has passed hierarchical verification; using the retrieved business system permission information as the query condition, searching the mapping relationship table, filtering out the VLAN number corresponding to the type of business system that the user terminal can access, and determining the VLAN number as the target VLAN number of the user terminal. For example, if the user can only access the office system, the target VLAN number is 10, ensuring that the user terminal can only access the VLAN area within its permission range.

[0040] 203. Send a VLAN allocation command to the network access controller to configure the PVID of the user terminal access port as the target VLAN number; the VLAN allocation command includes the MAC address of the user terminal device and the target VLAN number.

[0041] The VLAN allocation command must include the MAC address of the user terminal device to accurately locate the user terminal access port to be configured and the target VLAN number. After receiving the command, the network access controller finds the physical access port bound to the user terminal MAC address and configures the PVID of the physical access port as the target VLAN number. After the configuration is completed, all data frames sent by the user terminal will automatically carry the target VLAN tag, thereby accessing the corresponding VLAN area and realizing network isolation based on service permissions.

[0042] 204. Pre-set ACL rules for VLAN areas, and send the configured ACL rules to the network access controller to match and detect network traffic initiated by users in the order of ACL rules.

[0043] For any given VLAN area, a preset ACL rule is configured. Specifically, the preset ACL rule is defined by source IP address range, destination IP address range, network protocol type, port range, and execution action format. For example, the ACL rule for the financial system can be set to allow the 192.168.20.0 / 24 network segment to access port 1433 of 192.168.30.10 via TCP (Transmission Control Protocol), while denying access from other network segments. The configured ACL rule is then sent to the network access controller via the command-line interface or Simple Network Management Protocol (SMMP). The network access controller stores the ACL rule in its hardware forwarding table. When a user initiates network traffic, the network access controller performs a matching check according to the priority order of the ACL rules; only traffic matching the rules is allowed to pass, achieving precise control over traffic within the VLAN.

[0044] 205. Establish a list of associations between port services and business functions. The list should record the port number and the corresponding service type.

[0045] The association list must be recorded in tabular form, including the name of the business function (e.g., financial data query, production equipment monitoring), the port number required for the normal operation of the business function (e.g., port 1433 for financial data query, port 502 for production equipment monitoring), and the service type corresponding to the port. Furthermore, the list must be dynamically maintained based on updates to the business functions. For example, when a new business function is added, the corresponding port and service information should be added; when a business function is taken offline, the relevant records should be deleted to ensure that the association list accurately reflects the correspondence between business needs and port services.

[0046] 206. Use a port scanning tool to probe the ports of servers in the VLAN area accessed by the user terminal, obtain the list of currently open ports, compare the list of open ports with the associated list, and filter out redundant ports that are not in the associated list.

[0047] Specifically, a port scanning tool is used to perform full port detection on all servers within the VLAN area accessed by the user terminal, covering commonly used ports, and obtaining a list of ports currently open on each server. The list of open ports obtained from the scan is compared line by line with the associated list to filter out ports not recorded in the associated list, i.e., ports without corresponding business function support. These ports are marked as redundant ports, and the range of ports that need to be shut down is determined.

[0048] 207. Perform a shutdown operation on redundant ports. The shutdown operation includes stopping the service process corresponding to the redundant port through the server operating system, or adding a rule to the ACL rules of the network access controller to deny traffic from the redundant port.

[0049] If the service process corresponding to the redundant port is running on the server operating system, the service management module of the server operating system is used to stop the service process corresponding to the port to ensure that the port no longer listens for network requests. If the port is opened at the network device level, a supplementary rule is added to the ACL rules of the network access controller to explicitly deny any IP address from accessing the redundant port through any protocol. After the operation is completed, the port scanning tool is used again to verify whether the redundant port has been closed to ensure that no port is missed and to strictly follow the principle of least privilege to control port opening.

[0050] 103. Extract the data packet characteristics of the network access request initiated by the user terminal, compare the data packet characteristics with the preset threat feature database, and obtain the matching results.

[0051] The packet characteristics include, but are not limited to, source IP address, destination IP address, source port number, destination port number, protocol type, packet size, and keywords or hash values ​​in the packet content. These characteristics reflect the essential attributes of a network access request. The preset threat signature database is a collection of threat signatures for known network attacks, malware, viruses, etc., each associated with a specific security risk and defense measure. By comparing packet characteristics with the preset threat signature database, potential network threats can be identified.

[0052] Specifically, the characteristics of data packets initiating network access requests from the user are extracted, and these characteristics are compared with a preset threat signature database to obtain matching results, including: Capture all data packets from network access requests initiated by the user client through port mirroring; The data packets are parsed to extract the protocol type, source IP address, destination IP address, source port number, destination port number, and data transmission frequency from the packet header. At the same time, the characteristic fields in the packet content are extracted to form a data packet feature set. The feature matching algorithm is used to compare the data packet feature set with the feature data in the preset threat feature database one by one to obtain the matching result; the feature matching algorithm includes the exact matching algorithm and the fuzzy matching algorithm.

[0053] Specifically, traffic acquisition devices are deployed at core nodes where users access the network, and port mirroring is enabled. This copies all incoming and outgoing traffic from the user's access port to a designated monitoring port on the traffic acquisition device. When a user initiates a network access request, all data packets carrying that request are captured by the port mirroring function.

[0054] Then, the captured raw data packets are parsed layer by layer. For example, the physical layer frame header and data link layer identifier are stripped from the data packets, and the IP header information of the network layer is extracted to obtain the source IP address and destination IP address. Next, the transport layer header is parsed to determine the protocol type, source port number, and destination port number, and the data transmission frequency is calculated by counting the number of data packets between the same source IP and destination IP per unit time. Finally, feature fields are extracted from the data packet payload content. The extracted protocol type, IP address, port number, transmission frequency, and feature fields are integrated to form a structured set of data packet features, with each feature labeled with its data type and value range.

[0055] Finally, a preset threat signature database is retrieved. This database stores feature data and malicious feature fields corresponding to known network threats, with the feature data categorized by threat type. A feature matching algorithm is then used to compare the packet feature set with the feature data in the threat signature database one by one: for features with fixed formats, an exact matching algorithm is used, determining a match only when the packet feature and threat feature are completely identical; for features with potential variations, a fuzzy matching algorithm is used, calculating the similarity of feature fields, and determining a match if the similarity exceeds a preset threshold. After comparison, the number of matched threat features is counted: if at least one matching threat feature exists, a match result is generated indicating that the threat feature is included; if no features match, a match result is generated indicating that the threat feature is not included.

[0056] 104. If the matching result includes threat characteristics, then the interception operation will be performed according to the ACL access rules, and the threat event information will be recorded and an alarm notification will be generated simultaneously.

[0057] The matching results include threat signatures, indicating that the data packet contains characteristic data or malicious signature fields corresponding to known network threats in a preset threat signature database. At this point, according to pre-defined ACL access rules, the system automatically intercepts the matched data packet, preventing it from continuing to spread in the network or performing potentially harmful behaviors. Simultaneously, the system records relevant information about this threat event, such as threat signatures, data packet source, destination address, and time of occurrence, and generates an alert notification, promptly sending it to network security administrators so they can respond quickly and take appropriate security measures, thereby effectively preventing and responding to network threats.

[0058] Specifically, if the matching result includes threat characteristics, then an interception operation will be performed according to the ACL access rules, and threat event information will be recorded synchronously to generate an alert notification, including: Receive the matching results and extract the source IP address, destination IP address, and port number corresponding to the network access request.

[0059] Based on ACL access rules, filter out the deny ACL rules corresponding to the source IP address, destination IP address and port number.

[0060] The system sends rule execution commands to the network access controller via the SNMP (Simple Network Management Protocol) protocol, enabling the corresponding denial ACL rules and blocking the transmission of data packets for network access requests.

[0061] Collect characteristic information of network access requests, including event occurrence time, user terminal device MAC address, source IP address, destination IP address, matched threat feature type, and interception operation execution time.

[0062] The feature information is stored in the threat event database in a preset format and linked to the user's authentication records.

[0063] An alarm notification is generated according to a preset alarm template; the alarm template includes the event level, event summary, and a list of key information.

[0064] If the matching result includes threat characteristics, the system first receives the matching result and extracts the source IP address, destination IP address, and port number corresponding to the network access request from the matching result.

[0065] Next, based on the configured ACL access rules, the system filters out the denial ACL rules corresponding to the extracted source IP address, destination IP address, and port number. Then, it sends a rule execution command to the network access controller via the SNMP protocol, and the network access controller activates the corresponding denial ACL rule to block the transmission of network access request data packets. While performing the interception operation, the system collects the characteristic information of the network access request, which specifically includes the event occurrence time, user terminal device MAC address, source IP address, destination IP address, matched threat feature type, and interception operation execution time.

[0066] The collected feature information is stored in the threat event database according to preset field formats, such as event ID, information category, and data format. During the storage process, the previous authentication records of the user terminal are synchronously linked, such as account information and device identifiers that have passed hierarchical authentication. Finally, an alarm notification is generated according to a preset alarm template. The alarm template includes the event level, event summary, and a list of key information in advance, thus completing the entire interception and alarm process.

[0067] 105. If the matching results do not include threat characteristics, obtain the network transmission data from the user terminal, analyze the network transmission data, and obtain sensitive data.

[0068] Sensitive data includes, but is not limited to, personal privacy information, financial information, and key trade secrets. Further assessment is needed to determine if there is a risk of unauthorized access or leakage of this sensitive data. If the analysis indicates that the sensitive data is secure, network transmission will continue to be monitored; if a risk of leakage is detected, a security alert mechanism will be immediately triggered, details of the data breach will be recorded, and network security strategies will be automatically adjusted to enhance the protection of sensitive data and ensure the overall security of the network environment.

[0069] Specifically, if the matching results do not include threat characteristics, then the network transmission data from the user's end is obtained and analyzed to obtain sensitive data, including: Retrieve the data packets corresponding to the network access requests from the user's client.

[0070] When the matching result shows that no threat characteristics are included, a data acquisition instruction is sent to the traffic acquisition device. The data acquisition instruction carries the user's identification information. Based on the identification information, the traffic acquisition device filters out data packets that are directly related to the network access requests initiated by the user from the captured network traffic, and then organizes the data packets in the order of transmission time and transmits them to the data parsing server in real time.

[0071] Strip the header information of the data packet to extract the network transmission data.

[0072] The data parsing server receives data packets and then calls a data packet parsing tool to perform layered parsing on each data packet.

[0073] Specifically, during layered parsing, the frame synchronization signal and frame check sequence of the physical layer are first stripped away, and then the MAC address field of the data link layer, the IP header of the network layer, and the header of the transport layer are removed. After stripping the header control information layer by layer, the payload part that carries the actual business content in the data packet is finally extracted. The payload part is defined as the network transmission data to be analyzed and spliced ​​into a continuous data stream according to the data packet transmission order.

[0074] Based on a pre-defined sensitive data identification rule base, a regular expression matching algorithm is used to scan network transmission data segment by segment to identify sensitive fields that conform to the sensitive data characteristic format.

[0075] The system includes a pre-defined sensitive data identification rule base that stores regular expressions for the characteristic formats of various sensitive data, such as ID card number corresponding to \d{17}[\dXx], bank card number corresponding to \d{16,19}, and mobile phone number corresponding to 1[3-9]\d{9}. Then, the system starts a regular expression matching algorithm to scan the network transmission data segment by segment. When content that matches the characteristic format of a certain type of sensitive data is scanned, it is immediately marked and its position in the data stream is recorded to form a sensitive field, thereby achieving accurate identification of formatted sensitive data.

[0076] A keyword matching algorithm is used to filter out text fragments that contain sensitive fields.

[0077] After completing the identification of formatted sensitive fields, a preset sensitive keyword library is loaded; the keyword matching algorithm is started to traverse and search the complete text content of the network transmission data. When a text fragment containing sensitive keywords is detected, the complete context of the text fragment is extracted, and it is checked whether the text fragment contains the identified sensitive fields; if the text fragment contains both sensitive keywords and sensitive fields, or only contains sensitive keywords but involves business-sensitive scenarios, the text fragment is marked as sensitive text to be merged.

[0078] The sensitive fields are merged with the text fragments to remove duplicates, forming the sensitive data.

[0079] This involves cross-referencing sensitive fields with sensitive information in sensitive text fragments to eliminate duplicate records. For example, if a sensitive field exists in both the field list and a sensitive text fragment, then duplicate records are eliminated.

[0080] Next, the integrated sensitive information is classified by type, and a source identifier is added to each type of sensitive data; finally, the set of classified and deduplicated sensitive information is defined as sensitive data.

[0081] 106. Sensitive data is encrypted using a symmetric encryption algorithm, and then the symmetric encryption key is encrypted using an asymmetric encryption algorithm before the sensitive data is sent from the user end to the receiving end.

[0082] The symmetric encryption algorithm used is AES, and the asymmetric encryption algorithm is RSA. This dual encryption method ensures the security of sensitive data during transmission; even if the data is intercepted, it cannot be decrypted without the corresponding key. Upon receiving the encrypted sensitive data and the symmetric encryption key, the receiving end first uses its private key to decrypt the symmetric encryption key, and then uses the decrypted symmetric encryption key to decrypt the sensitive data, thus obtaining the original sensitive data. This approach guarantees both data transmission security and improves data processing efficiency.

[0083] Specifically, sensitive data is encrypted using a symmetric encryption algorithm, and then the symmetric encryption key is encrypted using an asymmetric encryption algorithm before being sent from the user end to the receiving end. This includes: Acquire sensitive data and generate random symmetric encryption keys.

[0084] Using a symmetric encryption key, sensitive data is encrypted and a random salt value is added to generate encrypted sensitive data.

[0085] Obtain the asymmetric encryption public key and perform encryption operations on the symmetric encryption key to generate an encrypted symmetric key.

[0086] The encrypted sensitive data and the encrypted symmetric key are packaged in a preset format to generate a data transmission packet.

[0087] Data packets are sent from the user terminal to the receiver terminal through a pre-defined data transmission channel between the user terminal and the receiver terminal.

[0088] The process involves acquiring identified sensitive data and generating a random symmetric encryption key. This symmetric key is then used to encrypt the sensitive data, generating encrypted sensitive data. A random salt is added during this process to enhance security and prevent identical ciphertext from being generated after encrypting the same sensitive data. Next, the receiving end's corresponding asymmetric encryption public key is retrieved and used to encrypt the generated symmetric encryption key, generating an encrypted symmetric key. The encrypted sensitive data and the encrypted symmetric key are then packaged according to a preset format to generate a complete data transmission packet containing data identifiers. Finally, the data transmission packet is sent from the user end to the receiving end through a pre-established secure data transmission channel, ensuring that the sensitive data is not stolen or tampered with during transmission.

[0089] In some embodiments, sending a data transmission packet from the user terminal to the receiver terminal via a preset data transmission channel between the user terminal and the receiver terminal includes: Establish an encrypted tunnel and configure tunnel parameters on the network gateway at the user end and the network gateway at the receiving end respectively; the tunnel parameters include the pre-shared key, encryption algorithm, authentication algorithm, and the public IP address of the encrypted tunnel.

[0090] The data transmission packet is sent to the network gateway at the user end for encapsulation and header information is added.

[0091] Encapsulated data packets are transmitted from the user's network gateway to the receiving network gateway via an encrypted tunnel.

[0092] The authentication data in the header is verified. Once verified, the header is stripped and the data transmission packet is forwarded to the receiving end.

[0093] The process involves first establishing an encrypted tunnel and configuring tunnel parameters at both the user's and the receiving network gateways. These parameters include a pre-shared key for authentication, an encryption algorithm to ensure data security, an authentication algorithm to ensure data integrity, and the public IP address of the encrypted tunnel endpoint. Next, the generated complete data transmission packet is sent to the user's network gateway, which encapsulates the packet and adds header information containing the tunnel identifier and authentication details. The encapsulated data packet is then securely transmitted from the user's network gateway to the receiving network gateway through the established encrypted tunnel. Upon receiving the data packet, the receiving network gateway first verifies the authentication data in the header. If verification is successful, the header information added during encapsulation is removed, and the restored original data transmission packet is forwarded to the corresponding receiving end, completing the entire data transmission process.

[0094] Specifically, an encrypted tunnel is established, and tunnel parameters are configured on both the user's network gateway and the receiving network gateway, including: Obtain the handshake request initiated by the user client to the receiving client.

[0095] Based on the handshake request, a server certificate is generated and sent to the user's client.

[0096] Verify the validity of the server certificate. If the server certificate verification is successful, generate a random session key, encrypt the session key using the public key in the server certificate, and send it to the receiving end.

[0097] An encrypted tunnel is established between the user and the receiver based on the session key.

[0098] When a user terminal needs to transmit data packets to a receiving terminal through an encrypted tunnel, the user terminal's network protocol stack first generates a tunnel establishment handshake request. This handshake request includes the user terminal's core identification information, a list of compatible encryption algorithms, and a list of authentication algorithms. The handshake request is transmitted to the network gateway via the user terminal's local network. The network gateway performs a preliminary verification of the request. If the verification passes, the network gateway encapsulates the handshake request into a data packet conforming to the tunnel protocol standard and sends it to the receiving terminal's network gateway via the public network link. This completes the acquisition and forwarding of the handshake request, laying the communication foundation for subsequent tunnel establishment.

[0099] Upon receiving the handshake request, the receiving network gateway parses the protocol version and encryption algorithm information supported by the client contained in the request. It then invokes its built-in certificate generation module to generate a server certificate based on a preset certificate template. The server certificate includes the receiving network gateway's identity identifier, the public key used for encrypted communication, the certificate authority's digital signature, the certificate's validity period, and the encryption algorithms supported by the certificate. After the server certificate is generated, the receiving network gateway verifies its integrity. If it confirms that everything is correct, it encapsulates the server certificate into a data packet and sends it back to the client's network gateway via the original communication link, ensuring that the client can obtain the server certificate used for authentication and key encryption.

[0100] After receiving the server certificate, the user-side network gateway initiates a certificate verification process. First, it verifies the legitimacy of the certificate authority; next, it verifies the certificate's validity period; then, it decrypts the digital signature in the certificate using the public key provided by the certificate authority, compares the decrypted digest with the hash value of the certificate content, and if they match, confirms the certificate has not been tampered with; finally, it checks whether the receiver gateway's identity identifier in the certificate matches the preset receiver information. If all the above verifications pass, the server certificate is deemed valid; if any verification fails, the tunnel establishment process is terminated and a certificate invalidation message is returned. After successful certificate verification, the user-side gateway calls a random number generator to generate a random session key, extracts the receiver's public key from the server certificate, and uses the public key to perform asymmetric encryption on the session key, generating an encrypted session key. The session key is then encapsulated into a key transmission data packet and sent to the receiver's network gateway, ensuring that the session key is not intercepted during transmission.

[0101] After receiving the encrypted session key, the receiving network gateway decrypts it using its stored private key to obtain the original random session key. Based on this session key, the user-end and receiving network gateways negotiate and determine the encryption algorithm, data integrity authentication algorithm, tunnel encapsulation format, and tunnel liveness detection mechanism for encrypted tunnel data transmission. After parameter negotiation, both the user-end and receiving network gateways configure tunnel parameters locally, entering the pre-shared key, encryption algorithm, authentication algorithm, and both parties' public IP addresses into the gateway's tunnel configuration table, and enabling tunnel transmission. At this point, the encrypted tunnel between the user-end and receiving end is officially established, and subsequent data transmission packets can be transmitted encrypted through the tunnel, achieving secure communication across network segments or regions.

[0102] In some embodiments, the network security protection method provided by the present invention further includes: Send a server certificate signed using the SM2 algorithm to the user terminal. The server certificate contains the server's SM2 public key.

[0103] Verify the validity of the server certificate, generate a random session key, encrypt the session key using an SM2 public key, and send it to the server.

[0104] The session key is obtained by decrypting the SM2 private key. The client and server encrypt sensitive data based on the SM4 algorithm and complete the data transmission through an encrypted tunnel.

[0105] When the user end and the receiving end initiate the encrypted communication process, the receiving end first calls the SM2 asymmetric encryption algorithm and uses its own stored SM2 private key to digitally sign the generated server certificate. In addition to the receiving end's identity identifier, certificate validity period, and certificate authority digital signature, the server certificate also explicitly carries the server's SM2 public key. Subsequently, the receiving end sends the signed server certificate to the user end.

[0106] After receiving the server certificate, the client initiates a validity verification process. First, it verifies the legitimacy of the certificate authority and the certificate's validity period. Then, it verifies the overall integrity of the certificate using the certificate authority's public key. Simultaneously, it verifies the validity of the digital signature on the certificate from the receiving end using the SM2 algorithm. If all verification steps pass, a random session key is generated using a cryptographically secure random number generator. The server's SM2 public key is extracted from the server certificate, and asymmetric encryption is performed on the random session key using the SM2 public key to generate an encrypted session key. This session key is then encapsulated into a key transmission data packet and sent to the server. Upon receiving the data packet, the server decrypts the encrypted session key using its stored SM2 private key to obtain the original random session key. Subsequently, the client and server negotiate and determine the operating parameters of the SM4 symmetric encryption algorithm based on the session key. During subsequent sensitive data transmission, both the client and server use the SM4 algorithm to encrypt the sensitive data, generating encrypted sensitive data. This encrypted sensitive data is then transmitted through the previously established encrypted tunnel, ensuring the security and integrity of the data during transmission.

[0107] Figure 2 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention.

[0108] like Figure 2 As shown, the electronic device may include a processor 210, a communications interface 220, a memory 230, and a communication bus 240. The processor 210, communications interface 220, and memory 230 communicate with each other via the communication bus 240. The processor 210 can invoke logical instructions stored in the memory 230 to execute network security protection methods.

[0109] Furthermore, the logical instructions in the aforementioned memory 230 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0110] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the network security protection methods provided by the above methods.

[0111] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the network security protection methods provided by the above methods.

[0112] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0113] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0114] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security protection method, characterized in that, include: Obtain the identity information submitted by the user and complete the hierarchical verification, then connect the verified user to the network; Match VLAN zones based on the user's business system type, configure ACL access rules, and open port services according to the principle of least privilege. Extract the data packet features of the network access request initiated by the user terminal, compare the data packet features with a preset threat feature database, and obtain the matching result; If the matching result includes threat characteristics, then an interception operation is performed according to the ACL access rule, and threat event information is recorded synchronously to generate an alarm notification; If the matching result does not include threat characteristics, then the network transmission data of the user terminal is obtained and analyzed to obtain sensitive data; The sensitive data is encrypted using a symmetric encryption algorithm, and then the symmetric encryption key is encrypted using an asymmetric encryption algorithm before being sent from the user terminal to the receiving terminal.

2. The network security protection method according to claim 1, characterized in that, Obtaining the identity information submitted by the user and completing hierarchical verification, then connecting the verified user to the network, including: The system receives user-submitted identity information through a user-interactive interface. The identity information includes at least account password, biometric data, and device identification information. The account password is encrypted using a hash algorithm to generate a password hash value. The password hash value is then compared with the user password hash value pre-stored in the identity authentication server. If the comparison results match, the second level of verification is initiated. If the comparison results do not match, a password error message is returned and a verification failure log is recorded. The biometric data is input into a preset biometric comparison model, which outputs the biometric matching degree. If the biometric matching degree is not lower than a preset threshold, the third level of verification is entered. The biometric comparison model is generated by training a convolutional neural network and is used to extract feature points from fingerprint images, match key regions in face images, and compare spectral features of voiceprint segments. The device identification information is compared one by one with the preset trusted device database in the identity authentication server. If the comparison is successful, the layered verification is deemed successful, and the user terminal is connected to the network. If the comparison fails, the verification process is terminated. The preset trusted device database stores the device identification information of the user's historically verified devices.

3. The network security protection method according to claim 1, characterized in that, Based on the user's business system type, match the VLAN area, configure ACL access rules, and open port services according to the principle of least privilege, including: Establish a mapping table between business system types and VLAN numbers; Retrieve the permission information of the business system associated with the user terminal, and query the mapping relationship table based on the permission information of the business system to determine the target VLAN number corresponding to the user terminal; A VLAN allocation command is sent to the network access controller to configure the PVID of the user terminal access port as the target VLAN number; the VLAN allocation command includes the MAC address of the user terminal device and the target VLAN number; ACL rules are preset for VLAN areas, and the configured ACL rules are sent to the network access controller. Network traffic initiated by the user terminal is matched and detected according to the order of the ACL rules. Establish a list of associations between port services and business functions, wherein the list records the port number and the corresponding service type; A port scanning tool is used to probe the servers in the VLAN area accessed by the user terminal to obtain a list of currently open ports. The list of open ports is compared with the associated list to filter out redundant ports that are not in the associated list. Perform a shutdown operation on the redundant port. The shutdown operation includes stopping the service process corresponding to the redundant port through the server operating system, or adding a rule to the ACL rules of the network access controller to deny traffic from the redundant port.

4. The network security protection method according to claim 1, characterized in that, Extract the data packet features of the network access request initiated by the user terminal, compare the data packet features with a preset threat feature database, and obtain the matching results, including: Capture all data packets of network access requests initiated by the user terminal through port mirroring; The data packet is parsed to extract the protocol type, source IP address, destination IP address, source port number, destination port number, and data transmission frequency from the packet header. At the same time, feature fields in the data packet content are extracted to form a data packet feature set. A feature matching algorithm is used to compare the data packet feature set with the feature data in a preset threat feature database one by one to obtain the matching result; the feature matching algorithm includes an exact matching algorithm and a fuzzy matching algorithm.

5. The network security protection method according to claim 3, characterized in that, If the matching result includes threat characteristics, then an interception operation is performed according to the ACL access rule, and threat event information is recorded synchronously to generate an alarm notification, including: Receive the matching result and extract the source IP address, destination IP address, and port number corresponding to the network access request; Based on the ACL access rules, filter out the deny ACL rules corresponding to the source IP address, the destination IP address and the port number; The system sends a rule execution command to the network access controller via the SNMP protocol, activates the corresponding denial-class ACL rule, and blocks the transmission of data packets for the network access request. Collect the feature information of the network access request, including the event occurrence time, user terminal device MAC address, source IP address, destination IP address, matched threat feature type, and interception operation execution time; The feature information is stored in a threat event database in a preset format and associated with the user's authentication record. An alarm notification is generated according to a preset alarm template, which includes the event level, event summary, and a list of key information.

6. The network security protection method according to claim 1, characterized in that, If the matching result does not include threat characteristics, then the network transmission data of the user terminal is obtained and analyzed to obtain sensitive data, including: Obtain the data packet corresponding to the network access request from the user terminal; Strip the header information of the data packet and extract the network transmission data of the data packet; Based on a pre-defined sensitive data identification rule base, a regular expression matching algorithm is used to scan the network transmission data segment by segment to identify sensitive fields that conform to the sensitive data feature format. A keyword matching algorithm is used to filter out text fragments that contain the aforementioned sensitive fields; The sensitive fields are merged with the text fragments to remove duplicates, forming sensitive data.

7. The network security protection method according to claim 1, characterized in that, The sensitive data is encrypted using a symmetric encryption algorithm, and then the symmetric encryption key is encrypted using an asymmetric encryption algorithm before being sent from the user terminal to the receiving terminal, including: Acquire sensitive data and generate a random symmetric encryption key; Using the symmetric encryption key, the sensitive data is encrypted and a random salt value is added to generate encrypted sensitive data. Obtain the asymmetric encryption public key and perform encryption operations on the symmetric encryption key to generate an encrypted symmetric key; The encrypted sensitive data and the encrypted symmetric key are packaged according to a preset format to generate a data transmission packet; The data transmission packet is sent from the user terminal to the receiving terminal through a preset data transmission channel between the user terminal and the receiving terminal.

8. The network security protection method according to claim 7, characterized in that, Sending the data transmission packet from the user terminal to the receiving terminal through a preset data transmission channel between the user terminal and the receiving terminal includes: An encrypted tunnel is established, and tunnel parameters are configured on the network gateway of the user end and the network gateway of the receiving end, respectively. The tunnel parameters include a pre-shared key, an encryption algorithm, an authentication algorithm, and the public IP address of the encrypted tunnel. The network gateway that sends the data transmission packet to the user terminal encapsulates it and adds header information. The encapsulated data transmission packet is transmitted from the user's network gateway to the receiving network gateway through the encrypted tunnel. The authentication data in the header information is verified. If the verification is successful, the header information is stripped, and the data transmission packet is forwarded to the receiving end.

9. The network security protection method according to claim 8, characterized in that, Establish an encrypted tunnel, and configure tunnel parameters on the network gateway at the user end and the network gateway at the receiving end, respectively, including: Obtain the handshake request initiated by the user terminal to the receiving terminal; Based on the handshake request, a server certificate is generated and sent to the user terminal; The validity of the server certificate is verified. If the server certificate is verified, a random session key is generated, the session key is encrypted using the public key in the server certificate, and then sent to the receiving end. Based on the session key, an encrypted tunnel is established between the user terminal and the receiving terminal.

10. The network security protection method according to claim 9, characterized in that, Also includes: Send a server certificate signed using the SM2 algorithm to the user terminal; the server certificate contains the server's SM2 public key. Verify the validity of the server certificate, generate a random session key, encrypt the session key using the SM2 public key, and send it to the server; The session key is obtained by decrypting with the SM2 private key. The user terminal and the server encrypt the sensitive data based on the SM4 algorithm and complete the data transmission through an encrypted tunnel.

Images