CN113242268B - Authentication method for data secure transmission, data secure transmission method and system - Google Patents
Authentication method for data secure transmission, data secure transmission method and system Download PDFInfo
- Publication number
- CN113242268B CN113242268B CN202110786330.8A CN202110786330A CN113242268B CN 113242268 B CN113242268 B CN 113242268B CN 202110786330 A CN202110786330 A CN 202110786330A CN 113242268 B CN113242268 B CN 113242268B
- Authority
- CN
- China
- Prior art keywords
- address
- virtualized
- mac address
- network security
- security device
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/09—Mapping addresses
- H04L61/25—Mapping addresses of the same type
- H04L61/2503—Translation of Internet protocol [IP] addresses
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/09—Mapping addresses
- H04L61/25—Mapping addresses of the same type
- H04L61/2596—Translation of addresses of the same type other than IP, e.g. translation from MAC to MAC addresses
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
Abstract
The invention provides an authentication method for data security transmission, a data security transmission method and a system, wherein the authentication method comprises the following steps: a first network security device at a sender side acquires a data packet from the sender in a hijacking mode; duplicating a source MAC address and/or a specific field of a source IP address of a sender in a data packet based on a prestored address duplication strategy of both communication parties, and generating a virtualized MAC address and/or a virtualized IP address; sending a data packet carrying the virtualized MAC address and/or the virtualized IP address to a receiver, and analyzing and identifying the virtualized MAC address and/or the virtualized IP address by second network security equipment at the receiver side so as to authenticate the sender; the method comprises the steps of receiving a data packet from a receiving party, analyzing and identifying the virtualized MAC address and/or the virtualized IP address of the receiving party in the received data packet based on address duplication strategies of both communication parties, and authenticating the receiving party based on the analysis and identification results.
Description
Technical Field
The present invention relates to the field of data security technologies, and in particular, to an authentication method, a data security transmission method, and a data security transmission system for data security transmission.
Background
With the progress of the times and the development of technologies, network security becomes increasingly important. Data communicated by conventional network communication is typically an Application Layer (Application Layer) encapsulated in seven layers of the open systems interconnection communication reference model (OSI)). In the data transmission process, the security of data transmission can be guaranteed through means such as data encryption and security verification processes, but the current data monitored event still happens from time to time, that is, the existing communication technology has risks such as illegal monitoring and brute force cracking. For individuals, the disclosure of personal information may cause the privacy of the individual to be disclosed, which may have a malignant impact on the life of the individual and may affect the security of the individual's property; for some enterprises and other departments at all levels, the leakage of information of the enterprises or departments may cause huge economic loss to the enterprises or departments and influence the reputation of the enterprises or departments; the leakage of important information will be at a greater risk to the national level.
For some special industries or departments, special scenes and special requirements which have particularly high requirements on data transmission safety, the guarantee of the data transmission safety is particularly important. Therefore, effective security monitoring measures are urgently needed in important industries, important infrastructures and the like in China to avoid network security from being in a disadvantage. How to ensure the safety of data transmission and prevent information leakage is a very important and very difficult problem to be solved urgently.
Disclosure of Invention
Aiming at the problems in the prior art, the invention provides an authentication method for data secure transmission, a data secure transmission method and a data secure transmission system, which realize the secure transmission of information based on the compiling of MAC addresses and/or IP addresses.
In one aspect of the present invention, an authentication method for data secure transmission is provided, the method comprising the following steps:
a first network security device positioned at a data sender side acquires a data packet from the data sender in a hijacking mode, wherein the first network security device stores address duplication strategies of two communication parties;
the first network security device rewrites a specific field of a source MAC address and/or a source IP address of a sender in a data packet based on the address rewriting strategy of the two communication parties, and generates a virtualized MAC address and/or a virtualized IP address which replaces the source MAC address and/or the source IP address;
the first network security device sends a data packet carrying the virtualized MAC address and/or the virtualized IP address to a receiver, so that a second network security device located on the receiver side can analyze and identify the virtualized MAC address and/or the virtualized IP address based on a pre-stored address duplication policy of both communication parties, and the second network security device can authenticate a sender based on the analysis and identification result;
the first network security device receives a data packet sent by a second network security device from a receiver, analyzes and identifies the virtualized MAC address and/or the virtualized IP address of the receiver in the received data packet based on the address duplication strategies of the two communication parties, and authenticates the receiver based on the analysis and identification results.
In some embodiments of the present invention, the address duplication policy of the two communicating parties includes a correspondence between a specific field of a virtualized MAC address and/or a virtualized IP address of the two communicating parties and a respective original MAC address and/or IP address; the correspondence is stored in the form of a mapping table.
In some embodiments of the present invention, it is preferred that,
the duplication strategies of the addresses of the two communication parties also comprise the corresponding relation between the virtualized MAC addresses and/or the virtualized IP addresses of the sender and the receiver and the carried authentication information, and the corresponding relation is stored in a form of a mapping table;
the analyzing and identifying the virtualized MAC address and/or the virtualized IP address of the receiver in the received data packet further comprises: and analyzing the virtualized MAC address and/or the virtualized IP address of the receiver and identifying the authentication information carried by the analyzed MAC address and/or IP address.
In some embodiments of the invention, the first specific information comprises one or more of the following information: an operation instruction, an authentication mode, an organization name, a user group identifier, a visitor identifier, an access target position and an initiator position; the virtualized MAC address and/or the virtualized IP address are addresses which do not conflict with the existing corresponding addresses of the network segment where the source MAC address and/or the source IP address of the sender are located.
In some embodiments of the present invention, the virtualized MAC address or the virtualized IP address further carries an active initiator or a passive initiator identification.
In some embodiments of the present invention, the first network security device and the second network security device are gateways that communicate via routing or broadcasting.
According to another aspect of the present invention, the present invention also provides a data secure transmission method, comprising the steps of:
the method comprises the steps that a first network security device acquires a data packet from a data sender in a hijacking mode, address duplication strategies of two communication parties are stored in the first network security device, the address duplication strategies of the two communication parties comprise the corresponding relation between a specific field of a virtualized MAC address and/or a virtualized IP address of the two communication parties and an original MAC address and/or an IP address of the two communication parties, and the corresponding relation between the virtualized MAC address and/or the virtualized IP address and specific information carried by the virtualized MAC address and/or the virtualized IP address;
the first network security device writes at least one piece of first specific information into a source MAC address and/or a specific field of a source IP address of a sender in a data packet based on the address duplication strategies of the two communication parties, and generates a virtualized MAC address and/or a virtualized IP address which replaces the source MAC address and/or the source IP address;
and the first network security equipment sends a data packet carrying the virtualized MAC address and/or the virtualized IP address to a receiver, so that the second network security equipment on the receiver side can identify the first specific information from the virtualized MAC address and/or the virtualized IP address based on a pre-stored address duplication policy of both communication sides, and the first specific information is obtained.
In some embodiments of the invention, the method further comprises: and the first network security equipment receives a data packet from a receiver, which is sent by the second network security equipment, and identifies at least one piece of second specific information corresponding to the virtualized MAC address and/or the virtualized IP address of the receiver in the received data packet based on a pre-stored address duplication strategy of both communication parties, so as to obtain the second specific information.
In some embodiments of the present invention, the data packet transmitted between the first network security device and the second network security device is an encrypted data packet.
In another aspect of the present invention, a network security device is further provided, where the network security device includes a processor and a memory, where the memory stores computer instructions and a duplication policy for addresses of both communication parties, and the processor is configured to execute the computer instructions stored in the memory, where the computer instructions, when executed by the processor, implement the following steps:
acquiring a data packet from a message initiator of a local terminal in a hijacking mode;
writing at least one piece of first specific information into a specific field of a source MAC address and/or a source IP address in a data packet based on address duplication strategies of two communication parties, generating a virtualized MAC address and/or a virtualized IP address, and sending the data packet carrying the virtualized MAC address and/or the virtualized IP address to a communication opposite end;
and receiving a data packet from a communication opposite end, and identifying at least one piece of second specific information corresponding to the virtualized MAC address and/or the virtualized IP address in the received data packet based on the address duplication strategies of the two communication parties.
In some embodiments of the present invention, the address duplication policy for both communication parties includes a correspondence between a specific field of a virtualized MAC address and/or a virtualized IP address of both communication parties and a respective original MAC address and/or IP address, and further includes a correspondence between a virtualized MAC address and/or a virtualized IP address and specific information carried by the virtualized MAC address and/or virtualized IP address.
According to another aspect of the present invention, there is also provided a data security system, including a first network security device and a second network security device, where the first network security device and the second network security device each include a processor and a memory, where the memory stores an address duplication policy of both communication parties and computer instructions, and the processor is configured to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the steps of the method are implemented as described above.
In another aspect, the invention also provides a computer-readable storage medium, on which a computer program is stored, which program, when being executed by a processor, carries out the steps of the method as set forth above.
The authentication method for data safety transmission provided by the invention realizes the safety authentication in the communication process of the second network safety equipment by mixing the authentication data into the MAC address identifier of the first network safety equipment and the IP address addressing identifier of the first network safety equipment, thereby ensuring the safety of data transmission. In addition, the data safety transmission method provided by the invention realizes the safety transmission of the specific information based on the compiled MAC address and/or the compiled IP address. The system of the invention can also improve the safety of data communication.
It will be appreciated by those skilled in the art that the objects and advantages that can be achieved with the present invention are not limited to the specific details set forth above, and that these and other objects that can be achieved with the present invention will be more clearly understood from the detailed description that follows.
Drawings
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the invention and together with the description serve to explain the principles of the invention. In the drawings:
fig. 1 is a schematic diagram of a system for implementing secure data transmission and authentication according to an embodiment of the present invention.
Fig. 2 is a flowchart illustrating an authentication method for data secure transmission according to an embodiment of the present invention.
Fig. 3 is a schematic diagram of a data security transmission method according to an embodiment of the invention.
Fig. 4 is a timing diagram illustrating an authentication method for secure data transmission according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention will be described in further detail with reference to the following embodiments and accompanying drawings. The exemplary embodiments and descriptions of the present invention are provided to explain the present invention, but not to limit the present invention.
It should be noted that, in order to avoid obscuring the present invention with unnecessary details, only the structures and/or processing steps closely related to the scheme according to the present invention are shown in the drawings, and other details not so relevant to the present invention are omitted.
It should be emphasized that the term "comprises/comprising/comprises/having" when used herein, is taken to specify the presence of stated features, elements, steps or components, but does not preclude the presence or addition of one or more other features, elements, steps or components.
In order to solve the problem that data transmission safety is difficult to guarantee due to the fact that communication contents are illegally monitored or violently cracked in the existing network communication process, the invention provides an authentication method and a data safety transmission method for data safety transmission. That is, the present invention compiles and converts the address, compiles and converts the source IP address and/or the source MAC address according to the address duplication policy, such as the mapping table, which reflects the mapping relationship between the data content to be transmitted and the compiled IP address and/or the MAC address, maps the data content (authentication data or other information) to be transmitted to the compiled IP address and/or the MAC address, i.e. the data content to be transmitted is placed in the data link layer MAC address and/or the IP address, then transmits the data packet carrying the compiled IP address and/or the MAC address to the destination compiler, and the destination compiler resolves the received IP address and/or the MAC address by using the pre-stored information identification policy corresponding to the address duplication policy, which also reflects the mapping relationship between the data content and the compiled IP address and/or the MAC address, the required data is obtained, so that the aim of data safe transmission is fulfilled, and the safety of data transmission is greatly improved.
While conventional IP/MAC addresses are used in networks to identify devices controlling subnet operations, such as logical addressing packet switching and routing, embodiments of the present invention use IP/MAC addresses for authentication and/or communicating information.
Fig. 1 is a schematic structural diagram of a system capable of implementing network security authentication and data security transmission in the embodiment of the present invention. As shown in fig. 1, the system may include a client device 100 and a server device 200, wherein the client device 100 may include a client computer (e.g., a PC, a mobile terminal, etc.) and a first network security compiling device connected to the client computer for address compiling an IP address/MAC address; the server-side device 200 includes a server and a second network security compiling device connected to the server and used for resolving the IP address/MAC address. In the embodiment of the present invention, the first network security compiling device and the second network security compiling device are used as network security devices to implement the data security transmission and the network security authentication of the real-time embodiment of the present invention, and may also be referred to as the first network security device and the second network security device, respectively. In an example, the first network security compiling device and the second network security compiling device are both gateways provided with compilers, the first network security compiling device is a gateway device on a sender side, and the second network security compiling device is a gateway device on a receiver side. The first network security compiling apparatus and the second network security compiling apparatus may be an industrial module or an embedded chip, in addition to the gateway, and the present invention is not limited thereto. For convenience of description, the first network security compiling device may be referred to as a gateway a, and the second network security compiling device may be referred to as a gateway B. Under the condition that the client computer actively sends data to the server, the client computer is an active initiator of communication, and the server is a passive initiator of communication.
In the system shown in fig. 1, because a compiler (address compiler) is arranged in the gateway, based on the communication by the general network, the gateway a can rewrite (change) a part of identification bits of a source MAC address and/or a source IP address in a sender data packet according to a predefined address rewriting policy (or address compiling policy) by using the compiler, so as to obtain a virtualized MAC address and/or a virtualized IP address which does not really exist and carries first specific information to be transmitted. Then the changed MAC address and/or IP address is transmitted to a target server along with a data packet, after receiving the changed MAC address and/or IP address, a gateway B connected with the target server identifies and verifies the first specific information of the changed MAC address and/or the changed IP address according to an information identification strategy which corresponds to an address duplication strategy in a gateway A and can identify the first specific information, and a sender is authenticated based on a verification result; similarly, the gateway B may use the compiler to rewrite (modify) the source MAC address and/or the part of the identification bits of the source IP address in the receiver data packet according to a predefined address rewriting policy (or called address compiling policy), so as to obtain a virtualized MAC address and/or a virtualized IP address that does not actually exist and carries the second specific information to be transferred. And then transmitting the changed MAC address and/or IP address to the client equipment along with the data packet, after receiving the changed MAC address and/or IP address, the gateway A connected with the client equipment identifies and verifies the second specific information for the changed MAC address and/or the changed IP address according to an information identification strategy which corresponds to an address duplication strategy in the gateway B and can identify the second specific information, and authenticates a receiver based on a verification result. In addition, the invention can obtain the content of the specific information by utilizing the information identification strategy to identify and translate the specific information of the changed MAC address and/or the changed IP address, thereby realizing the safe transmission of important data. The authentication method and the data secure transmission method for data secure transmission according to the embodiment of the present invention are described below with reference to the system shown in fig. 1.
Fig. 2 is a flowchart illustrating an authentication method for data secure transmission according to an embodiment of the present invention. As shown in fig. 2, the authentication method includes the steps of:
step S110, the gateway device (gateway a) of the sending party hijacks the data packet sent by the data sending party.
That is, the sending gateway device (gateway a) acquires the data packet from the data sending party using the hijacking technique.
The physical interface of the gateway equipment in the embodiment of the invention does not need independent IP address and MAC address, acquires the data sent by the sender by hijacking the data message, and sends the data out in a routing mode or a broadcasting mode.
More specifically, gateway a may use a hook hijacking technique to hijack packets in the communication via a hook function. For example, the MAC address and the IP address of the original communication may be replaced by replacing the virtualized MAC address and the virtualized IP address after data conversion and compilation into a corresponding communication application process initiated by the communication initiator in a way of hijacking the global traffic, so as to implement the function of data security transmission authentication.
Since the hook hijacking technique for monitoring and hijacking data packets is a mature technique, it will not be described in detail here.
In the embodiment of the invention, not only a hook hijacking technology can be adopted to obtain the data packet sent by the data sender, but also the existing or future hijacking technology can be adopted to realize the data packet hijacking.
After the gateway device of the sending party hijacks the data packet sent by the data sending party, the source MAC address and the source IP address of the sending party can be obtained from the hijacked data packet.
Step S120, the gateway device of the sending party performs duplication on the source MAC address and/or the specific field of the source IP address of the sending party in the data packet based on the predetermined address duplication policy, and generates a virtualized MAC address and/or a virtualized IP address that replaces the source MAC address and/or the source IP address.
The sender gateway device may pre-store address duplication policies of both communication parties, where the address duplication policies of both communication parties may include correspondence between specific fields of virtualized MAC addresses and/or virtualized IP addresses of both communication parties and respective original MAC addresses and/or IP addresses. The correspondence may be stored in the form of a mapping table. In addition, the duplication policy for addresses of both communication parties may further include a correspondence between the virtualized MAC addresses and/or the virtualized IP addresses of the sender and the receiver and specific information (such as authentication information) carried by the addresses, and the correspondence may also be stored in the form of a mapping table.
Based on the pre-stored address duplication policies of the two communication parties, the gateway device at the sending party can duplicate the specific field of the source MAC address and/or the source IP address of the sending party in the data packet, for example, write at least one piece of first specific information into the specific field of the source MAC address and/or the source IP address of the sending party in the data packet, so as to generate a virtualized MAC address and/or a virtualized IP address replacing the source MAC address and/or the source IP address.
Here, the virtualized MAC address and/or virtualized IP address refers to an address that does not conflict with an existing corresponding address of a network segment where a source MAC address and/or a source IP address of a sender are located, and the virtualized MAC address and/or virtualized IP address is a physical address that does not exist in reality, so that a conflict with a real address does not occur.
In this step, a predefined address duplication policy may be stored in the gateway a, so that the gateway a may use the compiler to duplicate a part of fields of the source MAC address and/or the source IP address of the sender in the packet based on the predefined address duplication policy, thereby generating a new virtualized MAC address and/or IP address. In the embodiment of the invention, either one of the MAC address and the IP address can be duplicated, or both can be duplicated simultaneously. The duplication of the MAC address and the IP address will be described below, respectively.
The current MAC address, usually expressed in hexadecimal numbers, is six bytes (48 bits). MAC addresses are typically represented as 12 16-ary numbers, separated by a colon or bar between every 2 16-ary numbers, such as: 48: 89: e7: d5: 23: the MAC address 7A is a MAC address, wherein the first 6-bit 16-ary number (i.e. the first 3 bytes, the upper 24 bits) represents the serial number of the network hardware manufacturer, which is assigned by the Registration Authority (RA) of the IEEE, and the last 6-bit 16-ary number (i.e. the last 3 bytes, the lower 24 bits) represents the serial number of a certain network product (e.g. a network card) manufactured by the manufacturer.
When the MAC address is duplicated, one or more specific fields in 6 spaced fields (each field corresponds to 1 byte) of the MAC address may be recompiled (duplicated) to carry one or more pieces of specific information (such as authentication information or other information) through the duplicated fields. That is, one or more fields of the virtualized MAC address may carry specific information, and in the case of carrying specific information by using a plurality of fields, different fields may carry different specific information, and of course, the same field may carry more than one type of specific information, for example, a value of a certain field may be used to identify first specific information, and parity of the value of the field may be used to represent second specific information. In an embodiment of the present invention, the one or more pieces of specific information to be carried in the duplicated fields may include one or more of the following information: the operation instruction, the authentication method (such as user password authentication, digital certificate authentication, or other authentication methods), the name of the initiator organization, the identifier of the initiator user group, the identifier of the initiator visitor, the coordinate value of the access target, the coordinate value of the initiator source, and the like, which are only examples, and the present invention is not limited thereto.
For the duplication of the MAC address, the address duplication policy may include a correspondence of one or more pieces of specific information with one or more specific fields of the virtualized MAC address, which may be stored in the form of a mapping table of values of the specific fields and the specific information. For example, based on the stored mapping table, the compiler of gateway a may rewrite the 4 th field of the MAC address to the X-coordinate value of the initiator, the 5 th field of the MAC address to the Y-coordinate value of the initiator, the 6 th field of the MAC address may be rewritten to, for example, the visitor identification, etc. This duplication is merely exemplary, and the present invention is not limited thereto.
For an IP address, the length of the IP address is 32 bits, the IP address is divided into 4 segments (can be understood as 4 fields), each segment is 8 bits and is expressed by decimal numbers, the number range of each segment is 0-255, and the segments are separated by dots. In the embodiment of the present invention, similar to the duplication of the MAC address, the address recompilation (duplication) may be performed on one or more specific fields of the 4 fields spaced apart from each other in the IP address, so as to carry one or more pieces of specific information (such as authentication information or other information) through the duplicated one or more fields. That is, one or more fields of the virtualized IP address may carry specific information, and in the case of carrying specific information by using a plurality of fields, different fields may carry different specific information, and of course, the same field may carry more than one type of specific information, for example, a value of a certain field may be used to identify first specific information, and parity of the value of the field may be used to represent second specific information. In an embodiment of the present invention, the one or more pieces of specific information to be carried in the duplicated fields may include one or more of the following information: the user group identifier may represent a user group to which the user terminal belongs, and these information are merely examples, and the present invention is not limited thereto. In addition to the above information, the virtualized MAC address or the virtualized IP address may also carry an active initiator or passive initiator identification for identifying an active initiator (sender, e.g., a user terminal) or a passive initiator (receiver, e.g., a server).
For the duplication of the IP address, the address duplication policy may also include a correspondence of one or more pieces of specific information with one or more specific fields of the virtualized IP address, which may be stored in the form of a mapping table of values of the specific fields and the specific information. For example, based on the stored mapping table, the compiler of gateway a may rewrite the 2 nd field of the IP address to the longitude (or X-coordinate value) of the initiator, the 3 rd field of the IP address to the latitude (or Y-coordinate value) of the initiator, the 4 th field of the IP address may be rewritten to, for example, the visitor identification or the altitude of the initiator, etc. This duplication is merely exemplary, and the present invention is not limited thereto.
Corresponding to the sender, the gateway at the data receiver (e.g., the destination server) also stores the duplication policy of the addresses of both parties of communication, so that after receiving the data packet, the gateway at the data receiver can identify specific information as authentication information or other information based on the duplicated MAC address and/or IP address.
Step S130, the gateway device of the sending party sends a data packet carrying the virtualized MAC address and/or the virtualized IP address to the receiving party.
By sending a data packet carrying a virtualized MAC address and/or a virtualized IP address to a receiver by a sender gateway device, network deployment can be performed without affecting the original network structure or the change of routing information, and a customized virtualized network is formed between a first network security device (sender gateway) and a second network security device (receiver gateway), so that the virtualized MAC address and the virtualized IP address are not affected.
After receiving the data packet sent by the gateway device of the sender, the gateway device of the receiver can analyze and identify the virtualized MAC address and/or the virtualized IP address based on the pre-stored address duplication policy of both communication parties, and judge whether the source data is sent by the gateway device which is authenticated and knowable based on the identification result, so as to achieve the authentication effect of authenticating the sender of the source.
Step S140, the gateway device of the sender receives the data packet from the receiver sent by the gateway device of the receiver, analyzes and identifies the virtualized MAC address and/or the virtualized IP address of the receiver in the received data packet based on the address duplication policy of both communication parties, and authenticates the receiver based on the analysis and identification result.
The data packet hijacked by the sender gateway may carry the IP address of the destination node (receiver, e.g., server), and in this case, the sender gateway may send the data packet carrying the virtualized MAC address and/or the virtualized IP address to the receiver in a routing manner. In an alternative embodiment of the present invention, the sender gateway may send a packet carrying the virtualized MAC address and/or the virtualized IP address in a broadcast form.
In an actual application scenario, a receiver and a sender should have a trust relationship with each other, so that when network configuration is performed, both a sender gateway and a receiver gateway (gateway B) store address duplication policies of both parties in advance, so that when a receiver gateway receives a data packet with a virtualized MAC address and/or a virtualized IP address, the receiver gateway can identify specific information by using the stored address duplication policies, and thus authentication with the sender can be achieved. In an embodiment of the present invention, the address duplication policy may be a mapping table including a correspondence relationship between specific information (first specific information or second specific information) and specific fields of the virtualized MAC address and/or the virtualized IP address, but the present invention is not limited thereto.
In the embodiment of the present invention, the address addressing between the gateway of the receiving side and the gateway of the sending side may be performed through an existing two-layer network switching protocol or routing protocol to implement data communication, but the present invention is not limited thereto. The main function of writing some specific information of an initiator into one or more fields of an IP address or an MAC address is to control network security, after a data message sent by a gateway A reaches a gateway B after being exchanged or routed by N (N is more than or equal to 1) nodes, the gateway B can perform secondary validation through an information identification strategy corresponding to an address duplication strategy to verify whether a source initiator is a real authorizer, and a compiler of the gateway A and a compiler of the gateway B can perform data exchange through an independent mechanism to ensure the consistency of synchronous related information of equipment at two ends. If the information identification policy stored in the gateway B is consistent with the address duplication policy content stored in the gateway a, the gateway B may identify first specific information for authentication from the received data packet based on the information identification policy, and the verification result of the gateway B is a verification pass, which indicates whether the source initiator is a real authorizer, and at this time, the verification result may be fed back to the gateway a in a manner of verifying the compilation content by confirming the virtual MAC address information in combination with confirming the virtual IP address information to restore. If the verification fails, the source initiator is not the true authorizer, and the received data packet is discarded. In case of successful authentication, the gateway B transmits the data packet from the sender to the receiver, and the receiver can receive and process the received data packet.
The authentication procedure between the sender and the receiver may be implemented, for example, by a three-way handshake or a four-way handshake procedure. Fig. 4 is a timing diagram of an authentication method for data secure transmission according to an embodiment of the present invention, and fig. 4 illustrates an authentication example of a three-way handshake, but the present invention is not limited thereto. As shown in fig. 4, the authentication process includes the steps of:
step 1, the Client sends a Client hello message to the server.
And 2, the gateway A acquires data sent by the client through hook hijack, and rewrites the IP address and/or the MAC address in the message through a pre-stored address rewrite mapping table which embodies the mapping relation between the source address (source IP address and/or source MAC address) and the virtual address (virtual IP address and/or virtual MAC address) of both communication parties to generate a virtual IP address and/or a virtual MAC address.
And 3, the gateway A sends the customer hello message with the virtual IP address and/or the MAC address to the gateway B through broadcasting or routing.
And 4, the gateway B identifies the first specific information based on a mapping table of a mapping relation of the specific field embodying the virtual address of the client and the first specific information for authentication, so as to verify the sender based on the identification result of the first specific information. If the verification is passed, the sender is proved to be an authorized and trusted source, so that the gateway B translates (restores) the virtual IP address and/or the MAC address based on the stored address duplication mapping table to restore the virtual IP address and/or the MAC address to the real IP address and/or the MAC address of the client, and then transmits the message with the restored address to the target server. If the authentication is not passed, the gateway B directly discards the received message and does not transmit it to the target server.
And 5, after receiving the message of the client, the target server returns a confirmation message.
And 6, acquiring the confirmation message returned by the server by the gateway B through hook hijack, compiling the address by using the stored address duplication strategy, and sending the confirmation message carrying the compiled virtual IP address and/or MAC address to the gateway A.
And 7, the gateway A identifies second specific information in the compiled virtual IP address and/or the MAC address based on the stored mapping table so as to verify the sender based on the identification result of the second specific information. If the verification is passed, the receiver (target server) is proved to be an authorized and trusted source, so that the gateway A translates (restores) the virtual IP address and/or the MAC address based on the stored address duplication mapping table to restore the virtual IP address and/or the MAC address to the real IP address and/or the MAC address of the server, and then transmits the message with the restored address to the client.
And 11, after receiving the confirmation message, the client restores the IP address and/or the MAC address of the client after the gateway B verifies based on the similar process in the step 1-5, and sends the confirmation message with the restored address to the server.
So that data transmission can be performed between the client and the server.
In the embodiment of the invention, the safety authentication of the communication process is realized by obtaining the authentication data based on the compiled MAC address and/or the compiled IP address. Because the gateway does not have an independent IP address, and the IP address and/or the MAC address of the sender are/is rewritten through address compiling to carry the authentication information, even if an illegal user such as a hacker obtains the data packet, the illegal user cannot judge the true source of the message based on the IP address and/or the MAC address in the message, and even cannot complete the authentication process. When the server is tried to be attacked, the access operation can not be carried out due to the fact that the server can not pass the authentication, and therefore data safety is guaranteed.
Fig. 3 is a schematic diagram illustrating a data security transmission method according to an embodiment of the invention. As shown in fig. 3, the data secure transmission method includes the following steps:
step S310, the gateway device (gateway A) of the sending party hijacks the data packet sent by the data sending party.
The step is the same as step S110, and is not described herein again.
Step S320, the gateway device of the sending party writes at least one piece of first specific information into a specific field of a source MAC address and/or a source IP address of the sending party in the data packet based on a predetermined duplication policy of addresses of both communication parties, and generates a virtualized MAC address and/or a virtualized IP address replacing the source MAC address and/or the source IP address.
This step may be the same as step S120 or may be slightly different. The difference may be a difference in address copy-back policy for slightly different cases. In this embodiment, the address duplication policy of the two communicating parties may include not only the correspondence between the at least one piece of specific information and the specific field of the virtualized MAC address and/or the virtualized IP address, but also an address duplication algorithm for writing the specific information into the specific field.
Step S330, the gateway device of the sender sends a data packet carrying the virtualized MAC address and/or the virtualized IP address to the receiver, so that the gateway device of the receiver identifies first specific information from the virtualized MAC address and/or the virtualized IP address based on the stored address duplication strategies of both communication parties, and specific information is obtained.
The difference from the foregoing step S130 is that this step is to obtain the transmission of the first specific information itself, and not to automatically implement the authentication between the sender and the receiver based on the specific information.
In the preferred embodiment of the present invention, in order to further ensure the security of data transmission, the data packet transmitted between the gateway device of the sending party and the gateway device of the receiving party is an encrypted data packet, and the security of data is further improved by encrypting data.
The data security transmission method of the embodiment of the invention carries out address exchange or routing communication based on a general network, a gateway A carries out communication by using a virtualized MAC address and/or IP address after mapping data content and the MAC address and/or IP address, the communication is carried out to a destination gateway B through the address, and the destination gateway B equipment restores original data according to a mapping table of the address and the data after receiving the address and the IP address so as to achieve the aim of preventing illegal monitoring.
According to the method, the safety transmission of the specific information to the target address is realized based on the compiled MAC address and/or the compiled IP address, so that the safety of data transmission is ensured. The method provided by the invention redefines network communication, and is different from a general technical method in that data is encapsulated in an application layer of an OSI seven-layer reference model, but authentication information or other important data needing to be transmitted is encapsulated in a MAC address and/or an IP address, namely, the MAC address and/or the IP address is rewritten by using a preset address rewriting strategy, so that partial fields of the MAC address and/or the IP address are rewritten to be provided with at least one piece of specific information, wherein the at least one piece of specific information can be the authentication information used for authentication or other information to be transmitted to a receiver.
In accordance with the above-described authentication method for data secure transmission, the present invention also provides a data security system, which may include a network security device (e.g., a gateway provided with an address compiler), the network security device including a processor and a memory, the memory storing computer instructions, the processor being configured to execute the computer instructions stored in the memory, and the computer instructions, when executed by the processor, implement the steps of the authentication method for data secure transmission as described above.
In accordance with the above-mentioned data security transmission method, the present invention also provides a data security system, which may include a network security device (such as a gateway with an address compiler), the network security device including a processor and a memory, the memory storing computer instructions, the processor being configured to execute the computer instructions stored in the memory, and the computer instructions, when executed by the processor, implement the steps of the data security transmission method as described above.
Accordingly, the present invention also provides a computer-readable storage medium, on which a computer program is stored, which program, when being executed by a processor, is adapted to carry out the steps of the method as set forth above.
The method and the system are particularly suitable for scenes and industries with strong information confidentiality, such as communication between the user terminal and the server in units of industries with special requirements on information happiness, and can effectively prevent monitoring of hackers.
Those of ordinary skill in the art will appreciate that the various illustrative components, systems, and methods described in connection with the embodiments disclosed herein may be implemented as hardware, software, or combinations of both. Whether this is done in hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention. When implemented in hardware, it may be, for example, an electronic circuit, an Application Specific Integrated Circuit (ASIC), suitable firmware, plug-in, function card, or the like. When implemented in software, the elements of the invention are the programs or code segments used to perform the required tasks. The program or code segments may be stored in a machine-readable medium or transmitted by a data signal carried in a carrier wave over a transmission medium or a communication link. A "machine-readable medium" may include any medium that can store or transfer information. Examples of a machine-readable medium include electronic circuits, semiconductor memory devices, ROM, flash memory, Erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, Radio Frequency (RF) links, and so forth. The code segments may be downloaded via a computer network such as a national e-government network, an industrial private network, a metropolitan area network, a financial insurance industry customer private network, a local area network, and the like.
It should also be noted that the exemplary embodiments mentioned in this patent describe some methods or systems based on a series of steps or devices. However, the present invention is not limited to the order of the above-described steps, that is, the steps may be performed in the order mentioned in the embodiments, may be performed in an order different from the order in the embodiments, or may be performed simultaneously.
Features that are described and/or illustrated with respect to one embodiment may be used in the same way or in a similar way in one or more other embodiments and/or in combination with or instead of the features of the other embodiments in the present invention.
The above description is only a preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes may be made to the embodiment of the present invention by those skilled in the art. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims (13)
1. An authentication method for secure transmission of data, the method comprising the steps of:
a first network security device positioned at a data sender side acquires a data packet from the data sender in a hijacking mode, wherein the first network security device stores address duplication strategies of two communication parties;
the first network security device rewrites a specific field of a source MAC address and/or a source IP address of a sender in a data packet based on the address rewriting strategy of the two communication parties, and generates a virtualized MAC address and/or a virtualized IP address which replaces the source MAC address and/or the source IP address;
the first network security device sends a data packet carrying the virtualized MAC address and/or the virtualized IP address to a receiver, so that a second network security device located on the receiver side can analyze and identify the virtualized MAC address and/or the virtualized IP address based on a pre-stored address duplication policy of both communication parties, and the second network security device can authenticate a sender based on the analysis and identification result;
the first network security device receives a data packet from a receiver sent by a second network security device, analyzes and identifies a virtualized MAC address and/or a virtualized IP address of the receiver in the received data packet based on address duplication strategies of both communication parties, and authenticates the receiver based on analysis and identification results;
wherein the physical interfaces of the first network security device and the second network security device do not have an IP address and a MAC address.
2. The method of claim 1,
the address duplication strategies of the two communication parties comprise the corresponding relation between the specific fields of the virtualized MAC addresses and/or the virtualized IP addresses of the two communication parties and the respective original MAC addresses and/or IP addresses;
the correspondence is stored in the form of a mapping table.
3. The method according to claim 1, wherein the address duplication policy of both communication parties further includes a correspondence between virtualized MAC addresses and/or virtualized IP addresses of the sender and the receiver and authentication information carried thereby, and the correspondence is stored in the form of a mapping table;
the analyzing and identifying the virtualized MAC address and/or the virtualized IP address of the receiver in the received data packet further comprises: and analyzing the virtualized MAC address and/or the virtualized IP address of the receiver and identifying the authentication information carried by the analyzed MAC address and/or IP address.
4. The method of claim 3, wherein the authentication information comprises one or more of:
an operation instruction, an authentication mode, an organization name, a user group identifier, a visitor identifier, an access target position and an initiator position;
the virtualized MAC address and/or the virtualized IP address are addresses which do not conflict with the existing corresponding addresses of the network segment where the source MAC address and/or the source IP address of the sender are located.
5. The method of claim 1, wherein the sender's virtualized MAC address or the virtualized IP address also carries an active initiator identification;
the virtualized MAC address or the virtualized IP address of the receiver also carries a passive initiator identification.
6. The method of claim 1, wherein the first network security device and the second network security device are gateways that communicate via routing or broadcasting.
7. A method for secure transmission of data, the method comprising the steps of:
the method comprises the steps that a first network security device acquires a data packet from a data sender in a hijacking mode, address duplication strategies of two communication parties are stored in the first network security device, the address duplication strategies of the two communication parties comprise the corresponding relation between a specific field of a virtualized MAC address and/or a virtualized IP address of the two communication parties and an original MAC address and/or an IP address of the two communication parties, and the corresponding relation between the virtualized MAC address and/or the virtualized IP address and specific information carried by the virtualized MAC address and/or the virtualized IP address;
the first network security device writes at least one piece of first specific information into a source MAC address and/or a specific field of a source IP address of a sender in a data packet based on the address duplication strategies of the two communication parties, and generates a virtualized MAC address and/or a virtualized IP address which replaces the source MAC address and/or the source IP address;
the first network security device sends a data packet carrying the virtualized MAC address and/or the virtualized IP address to a receiver, so that the second network security device at the receiver side can identify the first specific information from the virtualized MAC address and/or the virtualized IP address based on a pre-stored address duplication policy of both communication sides, thereby obtaining the first specific information and authenticating a data sender based on a verification result of the first specific information;
wherein the physical interface of the first network security device does not have an IP address and a MAC address.
8. The method of claim 7, further comprising:
and the first network security equipment receives a data packet from a receiver, which is sent by the second network security equipment, and identifies at least one piece of second specific information corresponding to the virtualized MAC address and/or the virtualized IP address of the receiver in the received data packet based on a pre-stored address duplication strategy of both communication parties, so as to obtain the second specific information.
9. The method of claim 7, wherein the data packets transmitted between the first network security device and the second network security device are encrypted data packets.
10. A network security device, wherein a physical interface of the network security device does not have an IP address and a MAC address, the network security device comprising a processor and a memory, the memory having stored therein computer instructions and a duplication policy for addresses of both parties of communication, the processor being configured to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the processor performing the steps of:
acquiring a data packet from a message initiator of a local terminal in a hijacking mode;
writing at least one piece of first specific information into a specific field of a source MAC address and/or a source IP address in a data packet based on address duplication strategies of two communication parties, generating a virtualized MAC address and/or a virtualized IP address, and sending the data packet carrying the virtualized MAC address and/or the virtualized IP address to a communication opposite end so as to enable the communication opposite end to authenticate a message initiator based on a verification result of the first specific information;
and receiving a data packet from a communication opposite end, identifying at least one piece of second specific information corresponding to the virtualized MAC address and/or the virtualized IP address in the received data packet based on the address duplication strategies of the two communication parties, and authenticating a message receiver based on a verification result of the second specific information.
11. The network security device according to claim 10, wherein the address duplication policy for both communication parties includes a correspondence between a specific field of a virtualized MAC address and/or a virtualized IP address of both communication parties and a respective original MAC address and/or IP address, and further includes a correspondence between a virtualized MAC address and/or a virtualized IP address and specific information carried by the virtualized MAC address and/or the virtualized IP address.
12. A data security system comprising a first network security device and a second network security device, each comprising a processor and a memory, wherein the memory has stored therein a two-way communication address duplication policy and computer instructions, the processor being configured to execute the computer instructions stored in the memory and when executed by the processor to implement the steps of the method of any one of claims 1 to 6 or any one of claims 7 to 9.
13. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the method according to any one of claims 1 to 6.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111071011.5A CN113922987B (en) | 2021-07-12 | 2021-07-12 | Data security transmission method, device, system and storage medium |
| CN202110786330.8A CN113242268B (en) | 2021-07-12 | 2021-07-12 | Authentication method for data secure transmission, data secure transmission method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110786330.8A CN113242268B (en) | 2021-07-12 | 2021-07-12 | Authentication method for data secure transmission, data secure transmission method and system |
Related Child Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111071011.5A Division CN113922987B (en) | 2021-07-12 | 2021-07-12 | Data security transmission method, device, system and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113242268A CN113242268A (en) | 2021-08-10 |
| CN113242268B true CN113242268B (en) | 2021-10-15 |
Family
ID=77135445
Family Applications (2)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110786330.8A Active CN113242268B (en) | 2021-07-12 | 2021-07-12 | Authentication method for data secure transmission, data secure transmission method and system |
| CN202111071011.5A Active CN113922987B (en) | 2021-07-12 | 2021-07-12 | Data security transmission method, device, system and storage medium |
Family Applications After (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111071011.5A Active CN113922987B (en) | 2021-07-12 | 2021-07-12 | Data security transmission method, device, system and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (2) | CN113242268B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117459765B (en) * | 2023-12-20 | 2024-03-12 | 杭州海康威视数字技术股份有限公司 | Multimedia security protection method, device and system based on storage service |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1489339A (en) * | 2002-07-06 | 2004-04-14 | ���ǵ�����ʽ���� | Method for insuring user's anonymous and its wireless local network system |
| CN104322027A (en) * | 2012-05-01 | 2015-01-28 | 贺利实公司 | Router for communicating data in a dynamic computer network |
| CN110177371A (en) * | 2019-04-04 | 2019-08-27 | 阿里巴巴集团控股有限公司 | The method and device of generating device identification information |
| CN112369100A (en) * | 2018-06-29 | 2021-02-12 | 上海诺基亚贝尔股份有限公司 | Method, apparatus and computer readable medium for protecting MAC address |
Family Cites Families (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7457300B2 (en) * | 2003-01-21 | 2008-11-25 | Telefonaktiebolaget L M Ericsson (Publ) | Ethernet address management system |
| US8094666B2 (en) * | 2005-06-30 | 2012-01-10 | Telefonaktiebolaget L M Ericsson (Publ) | Mapping an original MAC address of a terminal to a unique locally administrated virtual MAC address |
| US8923516B2 (en) * | 2012-08-29 | 2014-12-30 | Qualcomm Incorporated | Systems and methods for securely transmitting and receiving discovery and paging messages |
| CN107920020B (en) * | 2013-03-08 | 2021-01-15 | 华为技术有限公司 | Message processing method and gateway |
| CN105208048A (en) * | 2014-05-30 | 2015-12-30 | 株式会社日立制作所 | Global migration manager, gateway, virtual machine migration system and method thereof |
| CN106330849A (en) * | 2015-07-07 | 2017-01-11 | 安恒通（北京）科技有限公司 | Method and device for preventing domain name hijack |
| CN105429957A (en) * | 2015-11-02 | 2016-03-23 | 芦斌 | IP address jump safety communication method based on SDN framework |
| US10382329B1 (en) * | 2016-09-30 | 2019-08-13 | Juniper Networks, Inc. | Source MAC access controls in a virtual redundant router protocol environment |
| CN110493227B (en) * | 2019-08-20 | 2021-12-24 | 上海集成电路研发中心有限公司 | Data frame transmission method and system |
| CN111800423A (en) * | 2020-07-06 | 2020-10-20 | 中国工商银行股份有限公司 | Method, system, computing device and medium for processing IP address |
-
2021
- 2021-07-12 CN CN202110786330.8A patent/CN113242268B/en active Active
- 2021-07-12 CN CN202111071011.5A patent/CN113922987B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1489339A (en) * | 2002-07-06 | 2004-04-14 | ���ǵ�����ʽ���� | Method for insuring user's anonymous and its wireless local network system |
| CN104322027A (en) * | 2012-05-01 | 2015-01-28 | 贺利实公司 | Router for communicating data in a dynamic computer network |
| CN112369100A (en) * | 2018-06-29 | 2021-02-12 | 上海诺基亚贝尔股份有限公司 | Method, apparatus and computer readable medium for protecting MAC address |
| CN110177371A (en) * | 2019-04-04 | 2019-08-27 | 阿里巴巴集团控股有限公司 | The method and device of generating device identification information |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113922987A (en) | 2022-01-11 |
| CN113242268A (en) | 2021-08-10 |
| CN113922987B (en) | 2022-12-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| JP6231054B2 (en) | Verification and management of wireless device platforms | |
| US8224988B2 (en) | Network relay method, network relay apparatus, and network relay program | |
| US6212636B1 (en) | Method for establishing trust in a computer network via association | |
| EP1641210A1 (en) | Configuration information distribution apparatus and configuration information reception program | |
| CN110198297B (en) | Flow data monitoring method and device, electronic equipment and computer readable medium | |
| US20140123269A1 (en) | Filtering of applications for access to an enterprise network | |
| Hijazi et al. | Address resolution protocol spoofing attacks and security approaches: A survey | |
| CN113242269B (en) | Data transmission method and system based on virtualization network and network security equipment | |
| CN115694951A (en) | Data transmission method, device and system based on virtualization network | |
| Tian et al. | Securing ARP/NDP from the ground up | |
| CN113242268B (en) | Authentication method for data secure transmission, data secure transmission method and system | |
| CN113489731B (en) | Data transmission method and system based on virtual network and network security equipment | |
| US20210176051A1 (en) | Method, devices and computer program product for examining connection parameters of a cryptographically protected communication connection during establishing of the connection | |
| CN112016073B (en) | Construction method of server zero trust connection architecture | |
| CN109587134B (en) | Method, apparatus, device and medium for secure authentication of interface bus | |
| EP1836559B1 (en) | Apparatus and method for traversing gateway device using a plurality of batons | |
| CN113992387B (en) | Resource management method, device, system, electronic equipment and readable storage medium | |
| CN110224980B (en) | Credible MPTCP transmission method and system | |
| JP2005065004A (en) | Method, device and program for inspecting encrypted communication data | |
| Tr | Principles and Practices for Securing Software-Defined Networks | |
| CN116866001A (en) | Method and device for accessing terminal equipment to gateway based on key management system | |
| KR20220135899A (en) | Apparatus for electronic control of vehicle, apparatus for gateway and vehicle including them | |
| CN117793702A (en) | Endophytic safety management method of full service chain | |
| CN115378622A (en) | Access control method, device, equipment and computer program product | |
| CN117319080A (en) | Mobile terminal for isolating secret communication and communication method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20220328 Address after: Room 148, floor 1, building 1, No. 16, Shangdi Fifth Street, Haidian District, Beijing 100085 Patentee after: Beijing Beidou Hongpeng Technology Co.,Ltd. Address before: 102206 unit 3, floor 6, building 2, Jiayuan district 5, North Street, Shahe Town, Changping District, Beijing 646 Patentee before: Beijing Yuchuang Ruilian Information Technology Co.,Ltd. |