CN113572844A

CN113572844A - Industrial internet identification analysis method

Info

Publication number: CN113572844A
Application number: CN202110852615.7A
Authority: CN
Inventors: 刘巍; 贾高鹏; 徐泺; 韩红强; 范科峰; 张群; 李崇; 陈海
Original assignee: China Electronics Standardization Institute
Current assignee: China Electronics Standardization Institute
Priority date: 2021-07-27
Filing date: 2021-07-27
Publication date: 2021-10-29

Abstract

The invention discloses an industrial internet mark analysis method.A user host runs a mark analysis client; the client initiates an application to the analysis server; the analysis server retrieves an identification analysis database according to identification information carried in an application sent by the client; if the analysis is successful, returning the analysis result to the client in a web json mode; if the analysis is unsuccessful, analyzing the identification information through a traditional DNS analysis system, and returning an analysis result to the client in a web json mode; the client side obtains an identification analysis result according to the web json data returned by the analysis server; and the client accesses the target application server corresponding to the identification analysis result through protocols such as HTTP, HTTPS, FTP and the like to obtain a webpage or a data file. The invention provides an industrial internet identification analyzing method, which adopts a new technology of a non-DNS analyzing mechanism to eliminate the huge hidden trouble of national information safety caused by the limitation of the DNS analyzing mechanism.

Description

Industrial internet identification analysis method

Technical Field

The invention relates to the field of industrial internet, in particular to an industrial internet identification analysis method.

Background

The DNS is a set of mapping systems from domain names to IP, a computer and network service naming system organized in a hierarchy of domains, used in TCP/IP networks, which provides services that are used to convert host names and domain names to IP addresses. DNS is an application layer protocol that in fact works for other application layer protocols, including but not limited to HTTP and SMTP and FTP, to resolve user-supplied hostnames to IP addresses.

The specific process is as follows:

1. the user host runs a DNS client.

2. The browser extracts the domain name field from the received url and transmits the domain name field to the client of the DNS application.

And 3, the DNS client side sends a query message to the DNS server side, wherein the message contains a host name field to be accessed.

4. The DNS client will eventually receive an answer message that includes the IP address corresponding to the host name.

5. The browser, upon receiving the IP address from the DNS, can initiate a TCP connection to the HTTP server located at that IP address.

The domain name resolution system (DNS) of the internet adopts a central centralized management mode, so that the operation of the internet in each country is highly dependent on the original root domain name resolution server located in the united states from the perspective of domain name resolution. The DNS root node is not mastered in China, only the DNS root mirror node is deployed, data synchronization is carried out passively, and many hidden dangers exist in the aspects of performance, safety, management and the like. The distribution of the domain names of the Internet is unequal to the management pattern, so that except a few countries, other countries are at high risk, the risk that the Internet system of one country is deleted from the Internet society as a whole exists, and all countries in the world cannot access the website under the domain name of the country, so that the industrial Internet identification analysis method is provided.

Disclosure of Invention

Based on the technical problems in the background art, the invention provides an industrial internet identification analysis method to solve the problems in the background art.

The invention provides the following technical scheme:

an industrial internet identification analysis method comprises the following steps:

A. running an identifier analysis client on a user host;

B. the client initiates an application to the analysis server;

C. the analysis server retrieves an identification analysis database according to identification information carried in an application sent by the client;

D. if the analysis is successful, returning the analysis result to the client in a web json mode; if the analysis is unsuccessful, analyzing the identification information through a traditional DNS analysis system, and returning an analysis result to the client in a web json mode;

E. the client side obtains an identification analysis result according to the web json data returned by the analysis server;

F. and the client accesses the target application server corresponding to the identification analysis result through protocols such as HTTP, HTTPS, FTP and the like to obtain a webpage or a data file.

Preferably, an identifier resolution server is deployed in the step E, and an identifier resolution database is stored.

The invention provides an industrial internet identification analyzing method, which adopts a new technology of a non-DNS analyzing mechanism to eliminate the huge hidden trouble of national information safety caused by the limitation of the DNS analyzing mechanism.

Drawings

FIG. 1 is an identification resolution diagram of the present invention;

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

Referring to fig. 1, the present invention provides a technical solution:

the first embodiment is as follows:

A. running an identifier analysis client on a user host;

B. the client initiates an application to the analysis server;

Step E, a mark analysis server is deployed and a mark analysis database is stored; and communicating the client and the server in a web json mode, receiving and processing an identifier analysis request lifted by the client, and returning an identifier analysis result. The traditional DNS analysis system is bypassed in the field of identification analysis, and the system is not limited by a source root domain name server any more, so that the autonomous control of information safety in the aspect of identification analysis is realized.

The identification analysis based on the web JSON is a non-DNS analysis system, is applied to the identification analysis of industrial internet, realizes autonomous controllability on the network information security, is a subset of JSON based on JavaScript mapping Language, Standard ECMA-2623 rd Edition-Decumber 1999, is a light-weight data exchange format, is easy to read and write, and is convenient for a machine to analyze and generate.

Example two:

JSON Web Token (JWT) is a very light specification; this specification allows us to use JWT to pass secure and reliable information between users and servers; JWT for short, and performs identity authentication in the HTTP communication process;

A. the client logs in the server through a user name and a password;

B. the server side verifies the identity of the client side;

C. the server generates a Token for the user and returns the Token to the client;

D. a client initiates a request, and the Token needs to be carried;

E. after receiving the request, the server side firstly verifies Token and then returns data;

F. the client saves Token to the local browser, typically in a cookie.

Principle of JWT

The JWT principle is that after the server authenticates, a JSON object is generated and sent back to the user;

later, when the user communicates with the server, the JSON object needs to be sent back; the server only determines the user identity by the object; in order to prevent the user from tampering with the data, the server will add a signature when generating the object;

the server does not store any session data, that is, the server becomes stateless, so that the expansion is easier to realize;

JWT usage pattern

The client receives the JWT returned by the server, and the JWT can be stored in the Cookie or the localStorage;

thereafter, each time the client communicates with the server, the JWT is brought on. You can place it in Cookie to send automatically, but this can not cross the domain, so better practice is to place it in HTTP solicited header information Authorization field;

alternatively, when the domain is crossed, the JWT is placed in the body of the POST request;

characteristics of JWT

JWT is not encrypted by default, but can be encrypted, and can be encrypted once by using a key after generating the original Token;

in the case that the JWT is not encrypted, the secret data cannot be written to the JWT;

JWT can be used not only for authentication, but also for exchanging information; the JWT is effectively used, so that the times of querying the database by the server can be reduced;

the biggest disadvantage of JWT is that since the server does not save the session state, it is not possible to revoke a token, or change the authority of a token, during use; that is, once the JWT issues, it will always be valid until it expires unless the server deploys additional logic;

the JWT itself contains authentication information, and once compromised, anyone can obtain all rights to the token; to reduce theft, the validity period of the JWT should be set relatively short; for some more important authorities, the user should be authenticated again when in use;

to reduce theft, JWT should not use HTTP protocol clear code transport, using HTTPs protocol transport.

The above description is only for the preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art should be able to cover the technical scope of the present invention and the equivalent alternatives or modifications according to the technical solution and the inventive concept of the present invention within the technical scope of the present invention.

Claims

1. An industrial internet identification analysis method is characterized by comprising the following steps:

A. running an identifier analysis client on a user host;

B. the client initiates an application to the analysis server;

D. if the analysis is successful, returning the analysis result to the client in a webjson mode; if the analysis is unsuccessful, analyzing the identification information through a traditional DNS analysis system, and returning an analysis result to the client in a webjson mode;

E. the client side obtains an identification analysis result according to webjson data returned by the analysis server;

2. The method for resolving the industrial internet mark as claimed in claim 1, wherein: and step E, deploying an identification analysis server and storing an identification analysis database.