WO2013091407A1

WO2013091407A1 - Telnet command filter method and network security device and system

Info

Publication number: WO2013091407A1
Application number: PCT/CN2012/081546
Authority: WO
Inventors: 薛智慧; 李世光; 蒋武; 吴功伟
Original assignee: 华为数字技术（成都）有限公司
Priority date: 2011-12-23
Filing date: 2012-09-18
Publication date: 2013-06-27
Also published as: CN102546606B; CN102546606A

Abstract

A Telnet command filter method and a network security device and system. The Telnet command filter method comprises: obtaining, from an interaction message between a client and a server, each line of a telnet command sent by the client to the server; identifying content of the Telnet command; and if the identification result indicates that the Telnet command needs to be blocked, performing filter processing on the Telnet command. In the embodiment of the present invention, the network security device can obtain a Telnet command sent by the client to the server, and then can identify content of the Telnet command; once the Telnet command is identified as a command that may affect normal working of the server and needs to be blocked, the network security device can filter out the Telnet command, thereby ensuring reliable operation of the server.

Description

Telnet command filtering method, network security device and system. The application is filed on December 23, 2011, the Chinese Patent Office, the application number is 201110437645.8, and the invention name is "Telnet command filtering method, network security device and system". Priority is hereby incorporated by reference in its entirety. Technical field

The embodiments of the present invention relate to the field of network security technologies, and in particular, to a Telnet command filtering method, a network security device, and a system. Background technique

Telnet is the standard protocol and main method for Internet remote login services. It provides users with the ability to complete remote host work on local clients.

Specifically, the user can install the Telnet program on the client. If the user needs to remotely manage the server, the Telnet program on the client can be started, and the commands required by the server are input in the Telnet program. After being transmitted to the server, it can be run on the server. For the user, these commands are just as input directly on the console of the server, which is very convenient. However, the user may be mishandled in some cases, and the commands sent by the client to the server may cause the server to crash.

Therefore, when a user sends a command to the server through the Telnet program on the client, how to ensure the reliable operation of the server becomes an urgent problem to be solved. Summary of the invention

The embodiment of the invention provides a Telnet command filtering method, a network security device and a system, so as to ensure reliable operation of the server when the user sends a command to the server through the Telnet program on the client.

An embodiment of the present invention provides a method for filtering a Telnet command, including: Obtain each line of Telnet commands sent by the client to the server from the client and server interaction messages;

Identifying the content of the Telnet command;

If the recognition result is that the Telnet command is a command that needs to be blocked, the Telnet command is filtered.

An embodiment of the present invention provides a network security device, which is deployed between a client and a server, and the network security device includes:

The command obtaining module is configured to obtain, according to the interaction message between the client and the server, each line of the Nett command sent by the client to the server;

a content identification module, configured to identify content of the Telnet command;

The filtering processing module is configured to filter the Telnet command if the telnet command is a command that needs to be blocked.

An embodiment of the present invention provides a network security system, including: a client, a network security device, and a server that are sequentially connected, wherein the network security device uses the network security device.

In the embodiment of the present invention, the network security device can obtain each line of Telnet commands sent from the client to the server, and then can identify the content of the Telnet command, and once the Telnet command is identified, the need to affect the normal operation of the server is If the command is blocked, the network security device can filter the Telnet command to ensure reliable operation of the server. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor.

1 is a flowchart of Embodiment 1 of a Telnet command filtering method according to the present invention;

2 is a flowchart of Embodiment 2 of a Telnet command filtering method according to the present invention;

3 is a schematic diagram of a network architecture applied in Embodiment 2 of the method shown in FIG. 2; 4 is a signaling flowchart of Embodiment 3 of a Telnet command filtering method according to the present invention;

FIG. 5 is a schematic structural diagram of Embodiment 1 of a network security device according to the present invention;

6 is a schematic structural diagram of Embodiment 2 of a network security device according to the present invention;

7 is a schematic structural diagram of Embodiment 3 of a network security device according to the present invention;

FIG. 8 is a schematic structural diagram of an embodiment of a network security system according to the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

1 is a flowchart of Embodiment 1 of a Telnet command filtering method according to the present invention. As shown in FIG. 1, the method in this embodiment may include:

Step 101: Obtain, from the interaction message between the client and the server, a Telnet command sent by the client to the server.

Specifically, a network security device, such as a gateway device or a firewall, may be deployed between the client and the server, and each row of Telnet commands sent by the client to the server may be obtained from the interaction message between the client and the server. This Telnet command is the command that the user enters through the Telnet program installed on the client.

Step 102: Identify content of the Telnet command.

The network security device can identify the content of the Telnet command to know the commands that the user needs to execute the server.

Step 103: If the Telnet command is a command that needs to be blocked, the Telnet command is filtered.

If the network security device knows that the Telnet command is a command that needs to be blocked, the network security device may perform filtering processing on the Telnet command. It should be noted that the need to be The blocked command is a preset command that may affect the normal operation of the server. Those skilled in the art can set the command to be blocked according to the needs and the network security level.

In this embodiment, the network security device can obtain each line of Telnet commands sent from the client to the server, and then can identify the content of the Telnet command. Once the Telnet command is identified, the need to affect the normal operation of the server is blocked. If the command is broken, the network security device can come over the Telnet command to ensure reliable operation of the server.

Step 101 in the method embodiment shown in FIG. 1 can be implemented by using two specific technical solutions. The two specific technical solutions will be described in detail below.

Option 1, modify the negotiation options

In the prior art, for the client, the default is to send a Telnet command to the server in a single-character manner, that is, the single-character mode is used by default when the client negotiates with the server. For example, the client sends a Telnet command containing three characters "ABC" to the server. The client sends the character "A" to the network security device, and the network security device caches the character "A" and the character "A". Sent to the server, then the client can send "B" to the network security device, and the network security device sends "B" to the server. However, since the server generally has the Lenovo function, once the server receives the Telnet command containing the two characters "AB", the server can associate the Telnet command containing the three characters "ABC", so the server can execute "ABC". This telnet command. However, for network security devices, the cached Telnet command is "AB", and the "AB" Telnet command may be the allowed command. The "ABC" Telnet command may be the command that needs to be blocked. Therefore, network security devices cannot guarantee reliable operation of the server.

Therefore, in the first solution, after the client establishes a connection with the server, before the client sends the command message, the network security device can modify the default single-character mode to be in the process of the client and the server performing the option negotiation. In the line mode, that is, the client sends a Telnet command to the server one line at a time, and then the network security device can send the negotiation option to the client mode and the server. For example, the client sends a Telnet command containing the three characters "ABC" to the server. For example, the client does not send a single character such as the character "A" or "B" to the network security device in the line mode. Telnet command with three characters containing "ABC" After the input is complete, the Telnet command is sent to the network security device. Therefore, the network security device can obtain the complete Telnet command, so that only the packet containing the Telnet command needs to be parsed, and the content of the Telnet command can be obtained. Therefore, the Telnet command is reliably filtered to ensure reliable operation of the server.

In a specific implementation, the network security device can act as a proxy, and the network security device can establish a connection with the client and the server respectively, and perform Telnet negotiation options with the client and the server respectively, so that the client uses one line at a time. Line mode sends a Telnet command to the server.

Option 2, character echo comparison

In this scenario, the client can still send Telnet commands to the server using the default single-character mode in the prior art.

The network security device can record the command characters input by the client and the command characters returned by the server according to the command characters during the interaction between the client and the server, and the command characters input by the client and the command characters returned by the server. Performing a comparison analysis to restore the content of each Telnet command input by the client, thereby identifying the Telnet command that the user needs to perform the server, and then filtering the Telnet command.

Specifically, the network security device may receive the first command character input by the client and cache, send the first command character to the server, and receive a second command character that is displayed by the server according to the first command character; the network security device may Comparing the first command character and the second command character. If the second command character is the same as the first command character and is a regular character, the first command character input by the client is a regular character in the Telnet command, The network security device may add the first command character to the end of the regular character of the Telnet command to be executed by the client; if the first command character is a control character and the second command character is a regular character, the server has confirmed that the server has confirmed The specific Telnet command, therefore, the network security device can add the second command character to the end of the regular character of the Telnet command to be executed by the client, and determine that the server has learned the Telnet command to be executed; optionally, in order to Improve the accuracy of command recognition, if the second command character and the first life And control characters are different character, then the Telnet server command execution were treated Lenovo server but not sure you want to perform specific Telnet command, the network security device The first command character and the second command character can be added to the end of the Telnet command to be executed by the client; after the user completes the input of the Telnet command, the enter character can be input through the client, if the network security device recognizes the time The first command character is a carriage return character, and it can be determined that the user needs the server to execute the Telnet command. Therefore, the network security device extracts the cached characters (that is, the Telnet command to be executed sequentially added) as a row of Telnet obtained by the restore. The command can identify the content of each Telnet command obtained by the restore to determine whether the Telnet command contains the command keyword to be blocked. If it is included, the network security device can convert the carriage return character to a non-command character. . Since the server does not recognize non-command characters, the non-command character is invalid for the server. Accordingly, the server will not execute the Telnet command, thereby ensuring reliable operation of the server.

It should be noted that, in this solution, in the composition of the existing Telnet command, the regular characters can be 26 letters of a~z, and the control characters can be tab, space, upper and lower direction keys corresponding operations. Characters, etc., instead of command characters, can be used for ' , , ' : , , '! , and so on. A person skilled in the art can know the conventional characters, control characters, and non-command characters that are required to be used according to the general knowledge, which is not limited herein.

2 is a flowchart of a second embodiment of a method for filtering a Telnet command according to the present invention. FIG. 3 is a schematic diagram of a network architecture applied to the second embodiment of the method shown in FIG. 2. As shown in FIG. 2 and FIG. The technical solution of the foregoing solution is implemented. The method in this embodiment may include:

Step 201: The client sends a system packet (hereinafter referred to as SYN) to the network security device. Step 202: The network security device sends a system response packet (hereinafter referred to as SYN ACK) to the client.

Step 203: The client sends a response to the network security device (hereinafter referred to as ACK). In step 201 to step 203, the network security device can perform a three-way handshake with the client as a proxy server.

Step 204: The network security device sends a SYN packet to the server.

Step 205: The server sends a SYN ACK packet to the network security device.

Step 206: The network security device sends an ACK packet to the server. In steps 204 to 206, the network security device can perform a three-way handshake with the server as a proxy client.

Step 207: The client sends an option negotiation request message to the network security device.

In this embodiment, the line mode option is not included in the option negotiation request message.

Specifically, before the client sends a Telnet command to the server, it needs to negotiate with the server to negotiate the Telnet command in line mode or single-character mode. The network security device can confirm whether the option negotiation request message contains line mode options, such as whether to include the option 'WILL LINEMODE'. In the existing default case, the option negotiation message does not include the line mode option, which is transmitted by default in single-character mode.

Step 208: The network security device sends an option negotiation message to the client and the server.

The line mode option is included in the option negotiation message.

Specifically, if the network security device confirms that the option negotiation request message does not have the option of 'WILL LINEMODE', the network security device can serve as a proxy server to reply an option negotiation message to the client, and the option negotiation message can include The WILL LINEMODE' option causes the client to know that the server is requesting to transfer Telnet commands in line mode.

Moreover, the network security device can send the option negotiation message to the server as a proxy client, so that the server knows that the client requests to transmit the Telnet command in a row mode.

Therefore, in this embodiment, the network security device acts as a proxy, and negotiates the manner in which the Telnet command is sent between the client and the server in a row mode, that is, the client sends the Telnet command one line at a time.

Step 209: The network security device receives the command message of the Telnet command sent by the client in the line mode.

Step 210: The network security device parses the command packet, extracts the Telnet command, and matches the content of the Telnet command with the command content set that needs to be blocked. If the content of the Telnet command matches the content in the command content set, The Telnet command is discarded.

Alternatively, in step 210, the network security device may also identify whether the content of the Telnet command includes a command keyword to be blocked, and if so, the Telnet command is required. The blocked command, therefore, the network security device can discard the Telnet command.

In this embodiment, the network security device can act as a proxy to negotiate options on the mode in which the client transmits the Telnet command to the server, so that the client can transmit the Telnet command to the server in the row mode. Once the client transmits the Telnet command to the server in the line mode, the network security device can obtain a complete and accurate Telnet command, so that the Telnet command can be identified to block the Telnet command that may affect the normal operation of the server. In turn, the server is guaranteed to operate reliably.

4 is a signaling flowchart of a method for filtering a Telnet command in the third embodiment of the present invention. As shown in FIG. 4, the method in this embodiment is specifically used to implement the technical solution described in the foregoing solution 2. The method in this embodiment may include:

Step 401: Perform a three-way handshake between the client and the server.

Step 402: The client and the server perform option negotiation.

In this embodiment, the client can send a Telnet command to the server using the default single-character mode.

Step 403: The client sends the character "m" to the server through the network security device;

The network security device can cache the character "m" locally.

Step 404: The server echoes the character "m" to the client through the network security device.

The network security device finds the echoed character "m" by comparison with the character sent before the client.

"m" is the same, both are regular characters, the network security device can confirm that the character "m" is a character in the Telnet command that the user needs to execute, then the network security device can record the character.

"m".

Step 405: The client sends the character "0" to the server through the network security device;

The network security device can cache the character "0" locally.

Step 406: The server echoes the character "o" to the client through the network security device.

The network security device finds that the echoed character "0" is the same as the character "0" sent by the client before the comparison, which is a regular character. The network security device can confirm that the character "0" is the Telnet command required by the user. One character in , then the network security device can record the character "o" in After the character "m", the character "mo" is generated.

Step 407: The client sends the character "\t" to the server through the network security device;

When the user presses the Tab key, the client sends the corresponding operator to the server: the character "\t". The network security device can cache the character "\t" locally.

Step 408: The server echoes the character "\a" to the client through the network security device.

The network security device finds that the echoed character " \a" is different from the character " \t" sent by the client before the comparison, and both are control characters, then the network security device can learn that the server has been associated, and determine this time. The server did not determine the specific command to execute. At this point, the network security device can record the character "\t\a" at the end of the Telnet command, that is, after the character "o", to generate the character "mo\t\a".

Step 409: The client sends a character "r" to the server through the network security device;

The network security device can cache the character "r" locally.

Step 410: The server echoes the character "r" to the client through the network security device.

The network security device finds that the echoed character "r" is the same as the character "r" sent by the client before the comparison, and both are regular characters. The network security device can confirm that the character "r" is the Telnet required by the user. A character in the command, then the network security device can record the character "r" at the end of the regular character, that is, after "0", and generate the character "mor\t\a".

Step 411: The client sends the character “\t” to the server through the network security device;

The network security device can cache the character "\t" locally.

Step 412: The server echoes the character "e" to the client through the network security device.

After the network security device finds that the echoed character "e" is a regular character, and the character "\t" sent by the client is a control character, the network security device can confirm that the server has learned the specific execution of the user. Command, the character "e" is a character in the Telnet command that the user needs to execute. At this time, the network security device can record the character "e" at the end of the regular character, that is, after the "r", generate the character. "more\t\a"„

At this point, the network security device can restore and obtain the Telnet command entered by the user through the client as "more".

Step 413: The client sends a carriage return character to the server through the network security device. At this point, the network security device can learn that the user confirms to execute the Telnet command. At this time, the network security device can recognize whether the Telnet command "more" contains the command keyword to be blocked. If it is included, the network security device can press Enter. Characters are converted to non-command characters, for example converted to "(", and will be "(" sent to the server, for the server, it is an invalid command, the server will not execute the Telnet command "more".

Optionally, the network security device may further match the content of the Telnet command with the command content set that needs to be blocked. If the content of the Telnet command matches the content in the command content set, the Telnet command is required. Blocked commands.

In this embodiment, the network security device can restore each line of Telnet commands transmitted by the client to the server by recording and analyzing the interactive characters during the interaction between the client and the server in the single-character mode. The content of the Telnet command is identified to block Telnet commands that may affect the normal operation of the server, thereby ensuring reliable operation of the server.

FIG. 5 is a schematic structural diagram of Embodiment 1 of a network security device according to the present invention. As shown in FIG. 5, the network security device in this embodiment may be deployed between a client and a server, and the network security device may include: a command obtaining module 11 The content identification module 12 and the filtering processing module 13 are configured to: obtain, from the interaction message between the client and the server, each Telnet command sent by the client to the server; the content identification module 12 is configured to The content of the Telnet command is identified. The filtering processing module 13 is configured to filter the Telnet command if the Telnet command is a command that needs to be blocked. The device, the network security device of this embodiment may be used to perform the method of the method embodiment shown in FIG. 1, and the implementation principle and the technical effect are similar, and details are not described herein again.

Figure 6 is a schematic structural diagram of Embodiment 2 of the network security device of the present invention. As shown in Figure 6, the device in this embodiment is based on the device shown in Figure 5. Further, the command obtaining module 11 may include: an option negotiation processing unit. And the command obtaining unit 112, wherein the option negotiation processing unit 111 is configured to receive an option negotiation request message sent by the client before sending the command message, where the option negotiation request message does not include a line mode option; Send options to the client and the server a negotiation packet, where the option negotiation message includes the line mode option; the command obtaining unit 11 is configured to receive a command message sent by the client, where the command message includes the client usage line The Telnet command sent by the mode is configured to parse the command packet to obtain a Telnet command. The filtering processing module 13 is configured to discard the Telnet command if the Telnet command is a command that needs to be blocked.

Specifically, the content identification module 12 may include: a storage unit 121 and a matching identification unit 122, where the storage unit 121 is configured to store a command content set that needs to be blocked and/or a command keyword that needs to be blocked; The unit 122 is configured to match and match the content of the Telnet command with the command content set that needs to be blocked. If the content of the Telnet command is the same as the content of at least one command content in the command content set that needs to be blocked, Determining that the Telnet command is a command that needs to be blocked; or determining whether the content of the Telnet command includes a command keyword to be blocked, and if the command keyword to be blocked is included, determining the Telnet The command is a command that needs to be blocked.

The network security device in this embodiment may be used to perform the method in the method embodiment shown in FIG. 2, and the implementation principle and technical effects are similar, and details are not described herein again.

FIG. 7 is a schematic structural diagram of Embodiment 3 of the network security device of the present invention. As shown in FIG. 7, the device in this embodiment is based on the device shown in FIG. 5, and further, the command obtaining module 11 may include: a character acquiring unit 113. And a command recovery unit 114, wherein the character obtaining unit 113 is configured to extract a first command character input by the client from the packet sent by the client to the server, and cache the first command character, and send the first command character to the server. And extracting, from the message returned by the server, the second command character that is sent back by the server according to the first command character; the command restoring unit 114 is configured to: if the second command character is the same as the first command character and If the first command character is a regular character, the first command character is added to the end of the regular character in the Telnet command to be executed, and the initial content of the Telnet command to be executed is null; if the first command character is a control character And the second command character is a regular character, and the second command character is added to the tail of the regular character of the Telnet command to be executed by the client. If the first command character is a carriage return character, extracting the to-be-executed Telnet command generated by adding a character at the end of the sequence as a row of Telnet sent by the client to the server command. Correspondingly, the filtering processing module 13 is specifically configured to: if the recognition result is that the Telnet command is a command that needs to be blocked, convert the carriage return character into a non-command character, and send the non-command character to the server.

The command restoring unit 114 is further configured to: add the first command character and the second command character to the client to be executed if the second command character is different from the first command character and is a control character The tail of the telnet command.

The content identification module 12 may specifically include: a storage unit 121 and a matching identification unit 122, wherein the storage unit 121 is configured to store a command content set that needs to be blocked and/or a command keyword that needs to be blocked; the matching identification unit 122 And matching, the content of the Telnet command is matched with the command content set that needs to be blocked, and if the content of the Telnet command is the same as the content of at least one command in the command content set that needs to be blocked, determining The Telnet command is a command that needs to be blocked; or, the content of the Telnet command is included in the content of the Telnet command, and if the command keyword to be blocked is included, the Telnet command is determined to be The command that needs to be blocked.

The network security device in this embodiment may be used to perform the method in the method embodiment shown in FIG. 4, and the implementation principle and technical effects are similar, and details are not described herein again.

FIG. 8 is a schematic structural diagram of an embodiment of a network security system according to the present invention. As shown in FIG. 8, the system in this embodiment may include: a client 1, a network security device 2, and a server 3 connected in sequence, wherein the network security device 2 may </ RTI> </ RTI> </ RTI> </ RTI> </ RTI> </ RTI> </ RTI> </ RTI> </ RTI> </ RTI> </ RTI> </ RTI>

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., which can store various program codes. Finally, the above embodiments are only used to illustrate the technical solution of the present invention. Without limiting it; although the invention has been described in detail with reference to the foregoing embodiments, It should be understood that: the technical solutions described in the foregoing embodiments may be modified, or some of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the essence of the corresponding technical solutions. The scope of the technical solution.

Claims

Rights request

A Telnet command filtering method, which is characterized by:

Obtain each line of Telnet commands sent by the client to the server from the client and server interaction messages.

Identifying the content of the Telnet command;

If the Telnet command is a command that needs to be blocked, the Telnet command is filtered.

The method according to claim 1, wherein the Telnet command sent by the client to the server is obtained from the interaction message between the client and the server, including:

Receiving an option negotiation request message sent by the client before sending the command message, and if the option negotiation request message does not include the line mode option, sending an option negotiation message to the client and the server, the option The line mode option is included in the negotiation message;

Receiving, by the client, a command packet sent by the client, where the command packet includes a Telnet command sent by the client in a row mode, and parsing the command packet to obtain a Telnet command for each line; The Telnet command is used to filter, including:

Discard the Telnet command.

Extracting, by the client, the first command character input by the client, and buffering, sending the first command character to the server, and extracting the server from the message returned by the server according to the The second command character that is echoed by the first command character;

If the second command character is the same as the first command character and is a regular character, add the first command character to the end of the regular character in the Telnet command to be executed, and the Telnet command to be executed The initial content is empty;

If the first command character is a control character and the second command character is a regular character, adding the second command character to a tail of a regular character of a Telnet command to be executed by the client; And if the first command character is a carriage return character, extracting the to-be-executed Telnet command generated by adding a character at the tail to the Telnet command sent by the client to the server;

The filtering process of the Telnet command includes:

Converting the carriage return character to a non-command character and transmitting the non-command character to the server.

The method according to claim 3, wherein the extracting the Telnet command to be executed after the character is added to the tail is used as a Telnet command sent by the client to the server, and further includes:

And if the second command character is different from the first command character and is a control character, adding the first command character and the second command character to a tail end of the Telnet command to be executed by the client.

The method according to any one of claims 1 to 4, wherein the identifying the content of the Telnet command comprises:

And matching the content of the Telnet command with the command content set that needs to be blocked. If the content of the Telnet command is the same as the content of at least one command in the command content set that needs to be blocked, determining the Telnet command. For commands that need to be blocked; or,

Determining whether the content of the Telnet command includes a command keyword to be blocked, and if the command keyword to be blocked is included, determining that the Telnet command is a command that needs to be blocked.

A network security device, configured to be deployed between a client and a server, where the network security device includes:

The command obtaining module is configured to obtain, from the interaction message between the client and the server, a Telnet command sent by the client to the server.

The network security device according to claim 6, wherein the command acquisition module comprises: An option negotiation processing unit, configured to receive an option negotiation request message sent by the client before sending the command message, where the option negotiation request message does not include a line mode option; and send the message to the client and the server Option negotiation message, where the option negotiation message includes the line mode option;

The command obtaining unit is configured to receive a command message sent by the client, where the command message includes a Telnet command sent by the client in a line mode, and the command message is parsed to obtain a Telnet command for each line. ;

The filtering processing module is specifically configured to discard the Telnet command if the Telnet command is a command that needs to be blocked.

The network security device according to claim 6, wherein the command acquisition module comprises:

a character obtaining unit, configured to extract a first command character input by the client from a message sent by the client to the server, and cache the first command character, and send the first command character to the server, and extract the message returned from the server a second command character that is sent back by the server according to the first command character; a command restore unit, configured to: if the second command character is the same as the first command character and both are regular characters, A command character is added to the end of the regular character in the Telnet command to be executed, and the initial content of the Telnet command to be executed is null; if the first command character is a control character and the second command character is a regular character Adding the second command character to the tail of the regular character of the Telnet command to be executed by the client; if the first command character is a carriage return character, extracting the generated by sequentially adding characters at the tail The Telnet command to be executed serves as a line of Telnet commands sent by the client to the server.

The filtering processing module is configured to: if the recognition result is that the Telnet command is a command that needs to be blocked, convert the carriage return character into a non-command character, and send the non-command character to the server.

9. The network security device of claim 8 wherein:

The command restoring unit is further configured to add the first command character and the second command character to the client if the second command character is different from the first command character and is a control character The tail of the Telnet command to be executed.

The network security device according to any one of claims 6 to 9, wherein the content identification module comprises:

a storage unit, configured to store a set of command content that needs to be blocked and/or a command keyword that needs to be blocked;

a matching identification unit, configured to match and match the content of the Telnet command with a command content set that needs to be blocked, if the content of the Telnet command is the same as the content of at least one command in the command content set that needs to be blocked, Determining that the Telnet command is a command that needs to be blocked; or determining whether the content of the Telnet command includes a command keyword to be blocked, and if the command keyword to be blocked is included, determining the The Telnet command is a command that needs to be blocked.

A network security system, comprising: a client, a network security device, and a server, which are sequentially connected, wherein the network security device uses the network security device according to any one of claims 6 to 10.