TWI714386B - Method for detecting hidden network address and management server - Google Patents

Abstract

The invention provides a method for detecting a hidden network address and a management server. The method includes: receiving an HTTP packet from a terminal computer forwarded by a network address translation device; in response to determining that the content of the user agent field of the HTTP packet is new, determining that the terminal computer is an unmanaged device, and blocking the HTTP packet from being sending to a proxy server; demanding the terminal computer to install the plug-in component; receiving and recording the private IP address collected by the plug-in component, and asking the proxy server to add the private IP address to the white list.

Description

Method for detecting hidden network address and controlling server

The present invention relates to a network security technology, and particularly relates to a method for detecting hidden network addresses and controlling servers.

IP scanning operations in corporate networks are usually limited by network address translation (NAT) devices, which are also called network masking and IP masking devices. Due to the private IP (Private IP) feature of the NAT device, the terminal computer can be set up in the internal closed network segment of the NAT device, circumventing the corporate IP control system, which directly leads to a dead end of information security risk.

In view of this, the present invention provides a method for detecting hidden network addresses and a control server, which can be used to solve the above technical problems.

The present invention provides a method for detecting hidden network addresses, which is suitable for a control server. The method includes: receiving a first HTTP packet from a terminal computer from a network address conversion device, wherein the terminal computer is connected to the network The path address conversion device is assigned a private IP address, and the first HTTP packet has a first user agent field; in response to determining that the content of the first user agent field of the first HTTP packet is new content, the terminal is determined The computer is an uncontrolled device and blocks the first HTTP packet from being sent to a proxy server connected to the network address conversion device; the terminal computer is required to install a plug-in component, and the plug-in component is used to collect the terminal computer’s information Private IP address: Receive and record the private IP address collected by the plug-in component, and request the proxy server to add the private IP address to a whitelist.

The invention provides a management and control server, which includes a storage circuit and a processor. The storage circuit stores multiple modules. The processor is coupled to the storage circuit and accesses the aforementioned module to perform the following steps: Receive a first HTTP packet from a terminal computer from a network address conversion device, wherein the terminal computer is assigned a private address via the network address conversion device IP address, and the first HTTP packet has a first user agent field; in response to determining that the content of the first user agent field of the first HTTP packet is new content, it is determined that the terminal computer is an uncontrolled device, And block the first HTTP packet from being sent to a proxy server connected to the network address conversion device; request the terminal computer to install a plug-in component, where the plug-in component is used to collect the private IP address of the terminal computer; receive and record The private IP address collected by the plug-in component and request the proxy server to add the private IP address to a whitelist.

In order to make the above-mentioned features and advantages of the present invention more comprehensible, the following specific embodiments are described in detail in conjunction with the accompanying drawings.

Please refer to FIG. 1, which is a schematic diagram of a network system according to an embodiment of the present invention. As shown in FIG. 1, the network system 100 includes a control server 101, a NAT device 102, terminal computers 103 and 104, a proxy server 105, and an external network 106.

The control server 101 is, for example, a dedicated server for managing an enterprise network, and it may include a storage circuit 1011 and a processor 1012. The storage circuit 1011 is, for example, any type of fixed or removable random access memory (Random Access Memory, RAM), read-only memory (Read-Only Memory, ROM), flash memory (Flash memory), hard disk Disk or other similar devices or a combination of these devices can be used to record multiple codes or modules.

The processor 1012 is coupled to the storage circuit 1011, and can be a general purpose processor, a special purpose processor, a traditional processor, a digital signal processor, multiple microprocessors, one or more combined digital signal processing Microprocessor, controller, microcontroller, Application Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA), any other type of integrated circuit , State machines, processors based on Advanced RISC Machine (ARM) and similar products.

In the embodiment of the present invention, the management and control server 101 can provide network or IP management personnel to effectively and quickly manage, clearly understand the current IP usage, and can control each IP and settings, and is responsible for implementing monitoring IP and identity authentication procedures , Responsible for detecting HTTP packets from the internal private IP of NAT, and providing browser plug-in component 106 to unmanaged devices (such as terminal computer 104) to download and install, and obtain related return information.

The NAT device 102 is, for example, a device in an internal closed network architecture that provides a private IP (Private IP) in an enterprise network. The terminal computer 103 is, for example, a terminal device in the corporate network that has been controlled by the control server 101, and the terminal computer 104 is, for example, a terminal device in the corporate network that has not yet been controlled by the control server 101. In the embodiment of the present invention, the private IP address of the terminal computer 104 is, for example, the object that the method of the present invention mainly wants to detect and expose.

The proxy server 105 is, for example, in a corporate network, and has a proxy function from an intranet to an external network (Internet). In addition, the proxy server 105 can be used to isolate the external network and the corporate network terminal, thereby protecting the privacy or security of the corporate network and preventing attacks. In the embodiment of the present invention, the structure in which the proxy server 105 can interface with the control server 101 can achieve the effect of controlling the Internet, and forcing the uncontrolled device (such as the terminal computer 104) to execute the controlled program.

The plug-in component 106 is, for example, a browser plug-in component (which can be implemented using a Java Applet). In the embodiment of the present invention, when the browser of an uncontrolled device (such as the terminal computer 104) wants to connect to the external network (Internet), the control server 101 will send the plug-in component 106 to the terminal computer via the network 104 browser and require installation. After the terminal computer 104 completes the installation of the plug-in component 106, the plug-in component 106 will send the terminal computer 104’s IP, network card MAC, and host name to the control server 101, but it is not limited to this.

Please refer to FIG. 2, which is a flowchart of a method for detecting a hidden network address according to an embodiment of the present invention. The method of this embodiment can be executed by the network system 100 in FIG. 1. The details of each step in FIG. 2 are described below with the components shown in FIG. 1.

First, when the terminal computer 104 (ie, an unmanaged device) interfaces the network to the NAT device 102, the NAT device 102 will assign a private IP address (for example, 192.168.1.2) to the terminal computer 104 in step 201, so that The terminal computer 104 can start transmitting network packets (such as the first HTTP packet shown in FIG. 2) after obtaining the private IP address, but at this stage, the enterprise manager cannot know the relevant information of the terminal computer 104.

After the NAT device 102 receives the first HTTP packet from the terminal computer 104, it can forward the first HTTP packet to the management server 101 for further review by the management server 101.

In this embodiment, the first HTTP packet may include a first user agent (user agent) field, and its content may record the first operating system string corresponding to the operating system of the terminal computer 104 and the The name and version string of the browser and the first browser. In different embodiments, the first operating system string can be "Windows NT 10.0" or "Win64; x64", and the first browser name and version string can be "Chrome/77.0.3865.90" Or "Safari/537.36" etc., but the present invention is not limited to this.

After the control server 101 obtains the first HTTP packet, it can determine whether the content of the first user agent field of the first HTTP packet is new content. In one embodiment, the control server 101 can determine whether at least one of the first operating system string and the first browser name and version string is new. If so, the control server 101 may determine that the terminal computer 104 is an uncontrolled device, and determine that the content of the first user agent field of the first HTTP packet is new content in step 202, but the present invention is not limited to this.

After determining that the content of the first user agent field of the first HTTP packet is new content, the control server 101 can block the first HTTP packet from being transmitted to the proxy server 105, and further require the terminal computer 104 to install the prerequisite And the plug-in component 106. Correspondingly, the terminal computer 104 can install the plug-in component 106 in step 203.

In the embodiment of the present invention, the plug-in component 106 can be used to collect the private IP address (ie, 192.168.1.2), network card MAC address and host name of the terminal computer 104, and provide the collected information to the control server器101, but not limited to this.

After the control server 101 receives the private IP address of the terminal computer 104 provided by the plug-in component 106, the control server 101 can record the private IP address in the database of the control server 101 in step 204. In one embodiment, the control server 101 can compare the active IP list in the original database (the fields can include IP information, network card MAC information, host name information, control status, etc.), and based on the control status as uncontrolled Control device, output control list list. After that, the control server 101 can perform control settings for the uncontrolled device list, but the invention is not limited to this.

In addition, the management and control server 101 can also notify the proxy server 105 to record the private IP address of the terminal computer 104 in the white list. Correspondingly, the proxy server 105 can execute step 205 in accordance with the notification from the control server 101 to record the private IP address of the terminal computer 104 in the whitelist, and return a confirmation message to the control server 101 to inform the control server 101 Server 101. In this case, the terminal computer 104 can be regarded as having become a controlled device from an uncontrolled device.

In Figure 2, assuming that the terminal computer 104 (that is, the controlled device) wants to send a second HTTP packet (which includes a second user agent field) to the external network 106, the control server 101 can determine After the content of the second user agent field of the second HTTP packet is not new content (because it is exactly the same as the content of the first user agent field of the first HTTP packet), the proxy server is allowed (that is, not blocked) The device 105 forwards/releases the second HTTP packet to the external network 106.

Moreover, after the proxy server 105 receives the second HTTP packet and confirms that it belongs to the whitelist in step 206, it can release the second HTTP packet to the external network 106 accordingly.

Please refer to FIG. 3, which is a flowchart of a method for detecting a hidden network address according to an embodiment of the present invention. The method of this embodiment can be executed by the control server 101 of FIG. 1. The steps in FIG. 3 will be described below with the content of FIG. 1.

First, in step S310, the processor 1012 may receive the first HTTP packet from the terminal computer 104 from the NAT device 102. In step S320, in response to determining that the content of the first user agent field of the first HTTP packet is new content, the processor 1012 may determine that the terminal computer 104 is an uncontrolled device, and block the first HTTP packet from being transmitted to the agent Server 105. In step S330, the processor 1012 may request the terminal computer 104 to install the plug-in component 106. In step S340, the processor 1012 may receive and record the private IP address collected by the plug-in component 106, and request the proxy server 105 to add the private IP address to the whitelist. For details of each step in FIG. 3, reference may be made to the description in the previous embodiment, which will not be repeated here.

In summary, the present invention can analyze and record the contents of the HTTP packet sent by the terminal computer (uncontrolled), and cooperate with the browser plug-in component technology to obtain relevant feature information of the terminal computer. (For example, the operating system version of the terminal computer and the version of the web browser used), etc., for the purpose of exposing hidden computers in the network. In this way, the present invention can detect the existence of a computer hiding the real IP, and further reduce the information security risk that may be caused by the uncontrolled computer.

It can be seen from the above that the present invention has at least the following features: (1) It can quickly and accurately achieve the purpose of exposing activities in the network using a private IP terminal computer using the NAT network architecture, and using the Ethernet standard network communication Protocol and packet capture are the infrastructure, which can be implemented in pure software form without special hardware requirements or network environment restrictions, without the need to build hardware equipment at a high cost; (2) Using uncontrolled devices The local operating system and browser configuration information extracted by the HTTP packet automatic identification technology, combined with the browser plug-in component technology, obtains the characteristic information of the computer device, and can determine whether the active equipment exists in the general network or hidden in the NAT network Under the road environment, it can achieve comprehensive and anti-concealment detection effects; (3) A comprehensive IP integrated management mechanism within the enterprise can be established to fully improve network quality and efficiency. The control server can provide network or IP management personnel to effectively and quickly manage, and clearly understand the current IP usage status.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the technical field can make some changes and modifications without departing from the spirit and scope of the present invention. The scope of protection of the present invention shall be determined by the scope of the attached patent application.

100: network system 101: Control server 1011: storage circuit 1012: processor 102: NAT device 103, 104: terminal computer 105: Proxy server 106: External network 201~206, S310~S340: steps

FIG. 1 is a schematic diagram of a network system according to an embodiment of the present invention. FIG. 2 is a flowchart of a method for detecting a hidden network address according to an embodiment of the present invention. Fig. 3 is a flowchart of a method for detecting a hidden network address according to an embodiment of the present invention.

S310~S340: steps

Claims (10)

A method for detecting hidden network addresses is suitable for a control server, and the method includes: Receive a first HTTP packet from a terminal computer from a network address conversion device, wherein the terminal computer is assigned a private IP address via the network address conversion device, and the first HTTP packet has a first use Agent field; In response to determining that the content of the first user agent field of the first HTTP packet is new content, it is determined that the terminal computer is an uncontrolled device, and the first HTTP packet is blocked from being transmitted to the network connected to the network. A proxy server of the address conversion device; Request the terminal computer to install a plug-in component, wherein the plug-in component is used to collect the private IP address of the terminal computer; Receive and record the private IP address collected by the plug-in component, and request the proxy server to add the private IP address to a whitelist. The method described in item 1 of the scope of patent application further includes: Receiving a second HTTP packet from the terminal computer from the network address conversion device, wherein the second HTTP packet has a second user agent field; In response to determining that the content of the second user agent field of the second HTTP packet is not new content, the proxy server is allowed to pass the second HTTP packet to an external network, wherein the proxy server is determining the terminal After the private IP address of the computer has been recorded in the whitelist, the second HTTP packet is released to the external network. For the method described in claim 1, wherein the content of the first user agent field includes a first operating system string and a first browser name and version string, which reflects the determination of the first At least one of the operating system string and the first browser name and version string is new, and the content of the first user agent field of the first HTTP packet is determined to be new content. Such as the method described in item 1 of the scope of patent application, wherein the plug-in component is further used to collect the MAC address and host name of the network card of the terminal computer. According to the method described in item 1 of the scope of patent application, after determining that the terminal computer is the uncontrolled device, the method further includes sending the plug-in component to the terminal computer. A control server, including: A storage circuit for storing multiple modules; and A processor, coupled to the storage circuit, accesses the modules to perform the following steps: Receive a first HTTP packet from a terminal computer from a network address conversion device, wherein the terminal computer is assigned a private IP address via the network address conversion device, and the first HTTP packet has a first use Agent field; In response to determining that the content of the first user agent field of the first HTTP packet is new content, it is determined that the terminal computer is an uncontrolled device, and the first HTTP packet is blocked from being transmitted to the network connected to the network. A proxy server of the address conversion device; Request the terminal computer to install a plug-in component, wherein the plug-in component is used to collect the private IP address of the terminal computer; Receive and record the private IP address collected by the plug-in component, and request the proxy server to add the private IP address to a whitelist. For example, the control server described in item 6 of the scope of patent application, wherein the processor is further configured to: Receiving a second HTTP packet from the terminal computer from the network address conversion device, wherein the second HTTP packet has a second user agent field; In response to determining that the content of the second user agent field of the second HTTP packet is not new content, the proxy server is allowed to pass the second HTTP packet to an external network, wherein the proxy server is determining the terminal After the private IP address of the computer has been recorded in the whitelist, the second HTTP packet is released to the external network. For example, in the control server described in item 6 of the scope of patent application, the content of the first user agent field includes a first operating system string and a first browser name and version string, which is reflected in determining the At least one of the first operating system string and the first browser name and version string is new, and the processor determines that the content of the first user agent field of the first HTTP packet is new content. For example, in the control server described in item 6 of the scope of patent application, the plug-in component is used to collect the MAC address and host name of the network card of the terminal computer. For example, in the control server described in item 6 of the scope of patent application, after determining that the terminal computer is the uncontrolled device, the processor is further configured to send the plug-in component to the terminal computer.

Images