CN114124483A - Method, system and equipment for acquiring authority of router background super administrator - Google Patents

Method, system and equipment for acquiring authority of router background super administrator Download PDF

Info

Publication number
CN114124483A
CN114124483A CN202111322884.9A CN202111322884A CN114124483A CN 114124483 A CN114124483 A CN 114124483A CN 202111322884 A CN202111322884 A CN 202111322884A CN 114124483 A CN114124483 A CN 114124483A
Authority
CN
China
Prior art keywords
router
client
init
message
super administrator
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202111322884.9A
Other languages
Chinese (zh)
Other versions
CN114124483B (en
Inventor
唐荣华
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Zhejiang Hangxin Technology Co ltd
Original Assignee
Zhejiang Hangxin Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Zhejiang Hangxin Technology Co ltd filed Critical Zhejiang Hangxin Technology Co ltd
Priority to CN202111322884.9A priority Critical patent/CN114124483B/en
Publication of CN114124483A publication Critical patent/CN114124483A/en
Application granted granted Critical
Publication of CN114124483B publication Critical patent/CN114124483B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101Access control lists [ACL]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/12Applying verification of the received information
    • H04L63/123Applying verification of the received information received data contents, e.g. message integrity

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention discloses a method, a system and equipment for acquiring the authority of a router background super administrator. The method for acquiring the authority of the background super administrator of the router comprises the following steps: step S1, when the router is powered on, the telnetd _ startup background daemon service is started to monitor the preset port. And step S2, the client sends the init encrypted message to the router. And step S3, the router decrypts the init encrypted message and checks whether the message content is correct, and if so, the router replies an init ACK message to the client. In step S4, the client sends a temporary telnet service opening instruction to the router. In step S5, the router opens telnet service. Therefore, the method for acquiring the authority of the router background super administrator is simple and convenient, the authority of the router super administrator can be dynamically acquired, any legacy influence is avoided, and the safety is improved.

Description

Method, system and equipment for acquiring authority of router background super administrator
Technical Field
The present invention relates to the technical field of routing devices, and in particular, to a method, a system, and a device for obtaining a router background super administrator permission.
Background
The router, the essential 3C product of modern family, the entry of modern family internet connects the pivot of family's intelligent device. The router background super manager authority is the highest authority for the router, and flow can be hijacked, data packets can be modified, user data can be monitored, and even original firmware can be brushed off when the router background super manager authority is obtained. Once the right of the background super administrator of the router is revealed, the safety of the data of the user and the reliability of the network cannot be guaranteed. However, when the factory is produced, the super administrator permission of the router must be acquired, and the problem analysis of the repair machine also needs to acquire the super administrator permission. Therefore, how to dynamically acquire the router super administrator authority without the occurrence of a core point which is revealed to be the above problem.
The router usually starts all services for acquiring the super administrator authority, telnet services, SSH services, serial port services and the like at the engineering prototype stage. However, these services are required to be disabled by default during the mass production phase, or default ports of these services are modified, some manufacturers leave switchable backdoors on local web pages, and so on.
In order to prevent a user from acquiring the super administrator authority, detecting whether the Telnet service of the router is started or not every preset time period; and when detecting that the Telnet service of the router is in an open state, closing the Telnet service. And after the router is electrified, the anti-flashing configuration information table is randomly generated, and the anti-flashing configuration information table comprises the baud rate used by the serial port.
However, after the production test of most routers is finished, all services for acquiring the super administrator are disabled, so that the super administrator authority cannot be acquired any more. This solution does not meet the requirements when there are some rework machines that require positioning. By modifying the default port of the service, the port scan tool can easily find the modified port, which, although improved, cannot solve the problem at all.
The local web page leaves a back door that is open and closed, once leaked to the forum, or will have serious consequences. And the serial port acquires the super administrator authority of the router, needs to be disassembled to weld the serial port, needs to be connected with a serial port line, and is very inconvenient.
The information disclosed in this background section is only for enhancement of understanding of the general background of the invention and should not be taken as an acknowledgement or any form of suggestion that this information forms the prior art already known to a person skilled in the art.
Disclosure of Invention
The invention aims to provide a method, a system and equipment for acquiring the authority of a router background super administrator, which are simple, convenient and fast, can dynamically acquire the authority of the router super administrator, have no any legacy influence and improve the safety.
In order to achieve the above object, in a first aspect, the present invention provides a method for obtaining a router background super administrator authority, including: step S1, when the router is powered on, the telnetd _ startup background daemon service is started to monitor the preset port. And step S2, the client sends the init encrypted message to the router. And step S3, the router decrypts the init encrypted message and checks whether the message content is correct, and if so, the router replies an init ACK message to the client. In step S4, the client sends a temporary telnet service opening instruction to the router. In step S5, the router opens telnet service.
In an embodiment of the present invention, the client sends the init encrypted message to the router through the preset port.
In an embodiment of the present invention, the router opening telnet service includes: and decrypting the received telnet service instruction, judging whether the telnet service instruction is to start the telnet service, and if so, starting the telnet service.
In an embodiment of the present invention, the method for acquiring the authority of the router background super administrator further includes that the router starts telnet service and replies a temporary telnet service start instruction ACK to the client.
In an embodiment of the present invention, when the client always sends the init encrypted message to the router, and the router always rejects the init encrypted message and reaches a preset number of times, the router lists the current client in a blacklist.
In an embodiment of the present invention, when receiving an init encrypted message sent by a client, a router first determines whether the client is in a blacklist. And if the client is not in the blacklist list, the router receives the init encrypted message. If the client is in the blacklist list, the router does not respond to the message request of the client any more.
In an embodiment of the present invention, the telnetd _ startup background daemon service uses socket sockets to create UDP socket file descriptors.
In a second aspect, an embodiment of the present invention further provides a system for acquiring a router background super administrator permission, including: a router and a client. The client is in communication connection with the router. When the router is started, the telnetd _ startup background daemon service is started, and the preset port is monitored. Wherein, the client sends an init encrypted message to the router. The router decrypts the init encrypted message, checks whether the message content is correct, and if the message content is correct, the router replies an init ACK message to the client. And the client sends a temporary telnet service opening instruction to the router. Wherein the router opens telnet service.
In a third aspect, an embodiment of the present invention further provides an apparatus for acquiring a router background super administrator permission, where the apparatus includes:
at least one processor; and the number of the first and second groups,
a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,
the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the above-described method of obtaining router background hypervisor authority.
Compared with the prior art, the method, the system and the equipment for acquiring the router background super administrator permission are simple, convenient and fast, can dynamically acquire the router super administrator permission, have no any legacy influence, and improve the safety.
Drawings
FIG. 1 is a flowchart illustrating a method for obtaining rights of a router background super administrator according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of a logical decision line box of a method for obtaining rights of a router background super administrator according to an embodiment of the present invention;
fig. 3 is a block diagram of an apparatus for acquiring rights of a router background super administrator according to an embodiment of the present invention.
Detailed Description
The following detailed description of the present invention is provided in conjunction with the accompanying drawings, but it should be understood that the scope of the present invention is not limited to the specific embodiments.
Throughout the specification and claims, unless explicitly stated otherwise, the word "comprise", or variations such as "comprises" or "comprising", will be understood to imply the inclusion of a stated element or component but not the exclusion of any other element or component.
Fig. 1 is a flowchart illustrating a method for acquiring rights of a router background super administrator according to an embodiment of the present invention. Fig. 2 is a schematic diagram of a logical judgment box of a method for acquiring rights of a router background super administrator according to an embodiment of the present invention.
In a first aspect, the present invention provides a method for acquiring a router background super administrator permission, as shown in fig. 1 to fig. 2, the method for acquiring the router background super administrator permission includes:
step S1, when the router is powered on, the telnetd _ startup background daemon service is started to monitor the preset port. And step S2, the client sends the init encrypted message to the router. And step S3, the router decrypts the init encrypted message and checks whether the message content is correct, and if so, the router replies an init ACK message to the client. In step S4, the client sends a temporary telnet service opening instruction to the router. In step S5, the router opens telnet service.
In an embodiment of the present invention, the client sends the init encrypted message to the router through the preset port. The router opening telnet service includes: and decrypting the received telnet service instruction, judging whether the telnet service instruction is to start the telnet service, and if so, starting the telnet service.
In an embodiment of the present invention, the method for acquiring the authority of the router background super administrator further includes that the router starts telnet service and replies a temporary telnet service start instruction ACK to the client. When the client side sends the init encrypted message to the router all the time, and the router rejects the init encrypted message all the time and reaches the preset times, the router lists the current client side into a blacklist.
In an embodiment of the present invention, when receiving an init encrypted message sent by a client, a router first determines whether the client is in a blacklist. And if the client is not in the blacklist list, the router receives the init encrypted message. If the client is in the blacklist list, the router does not respond to the message request of the client any more.
In an embodiment of the present invention, the telnetd _ startup background daemon service uses socket sockets to create UDP socket file descriptors.
In a second aspect, an embodiment of the present invention further provides a system for acquiring a router background super administrator permission, including: a router and a client. The client is in communication connection with the router. When the router is started, the telnetd _ startup background daemon service is started, and the preset port is monitored. Wherein, the client sends an init encrypted message to the router. The router decrypts the init encrypted message, checks whether the message content is correct, and if the message content is correct, the router replies an init ACK message to the client. And the client sends a temporary telnet service opening instruction to the router. Wherein the router opens telnet service.
In a third aspect, fig. 3 is a block diagram illustrating an apparatus for obtaining rights of a router background super administrator according to another embodiment of the present invention. The device 1100 may be a host server with computing capabilities, a personal computer PC, or a portable computer or terminal that is portable, etc. The specific embodiment of the present invention does not limit the specific implementation of the electronic device.
The device 1100 includes at least one processor (processor)1110, a Communications Interface 1120, a memory 1130, and a bus 1140. The processor 1110, the communication interface 1120, and the memory 1130 communicate with each other via the bus 1140.
The communication interface 1120 is used for communicating with network elements including, for example, virtual machine management centers, shared storage, etc.
Processor 1110 is configured to execute programs. Processor 1110 may be a central processing unit CPU, or an Application Specific Integrated Circuit (ASIC), or one or more Integrated circuits configured to implement embodiments of the present invention.
The memory 1130 is used for executable instructions. The memory 1130 may comprise high-speed RAM memory, and may also include non-volatile memory (non-volatile memory), such as at least one disk memory. The memory 1130 may also be a memory array. The storage 1130 may also be partitioned and the blocks may be combined into virtual volumes according to certain rules. The instructions stored in the memory 1130 are executable by the processor 1110 to enable the processor 1110 to perform the obtaining of router background hypervisor privileges in any of the method embodiments described above.
In practical application, the method, the system and the equipment for acquiring the super administrator permission of the router background are based on an OPENWRT intelligent router development platform. After the router is started, a background daemon service telnetd _ startup is operated to monitor a certain fixed port. After the messages are successfully interacted for many times, the telnet service is started, otherwise, the messages are discarded, and the initial state is returned again.
The method mainly comprises three steps, and the three steps realize the starting of telnet service, thereby providing super administrator authority outwards. Firstly, when the router is started, a telnetd _ startup background daemon service is started, and the service fixedly monitors UDP (user Datagram protocol) messages of a certain fixed port. Specifically, when creating socket, the UDP protocol type is specified by "SOCK _ DGRAM", and a local port, such as 21212 port, is bound, and the Linux network protocol stack message starts to be listened to. Then, the windows client sends an init message, the background daemon service sends an init ACK message, and the windows client sends a temporary telnet service opening instruction. And finally, the telnetd _ startup background daemon service starts the telnet service. The message interaction is an encrypted message. Based on the cs model, the client side sends the init message all the time, the router rejects the init message all the time and reaches a certain number of times, and the router lists the current client side in a blacklist and does not correspond to the message request any more. This process will continue for a period of time, such as 1 hour, and after a period of time, the message will continue to be accepted. In detail:
1. the router is started to start the telnetd _ startup background daemon service. This service uses socket sockets to create UDP socket file descriptors. And the bind fixed monitoring port, such as 21000, waits for the arrival of a client message.
2. The Windows host runs a client program. The client needs a network to reach the router, the client sends the init encrypted message, and the router decrypts the init message and checks the message content. If the content of the message is checked to be correct, the router replies an init ACK message, and the client sends a temporary telnet service starting instruction.
3. the telnetd _ startup background daemon service starts the telnet service. The router successfully decrypts the temporary telnet service opening instruction and runs the telnet service.
4. And the server side replies a temporary telnet service opening instruction ACK.
In the invention, UDP can be replaced by TCP, both of which are CS models, without essential difference, compared with TCP which is stateful and is a connection-oriented protocol, UDP is more suitable for the scene.
In summary, the method, system and device for acquiring the router background super administrator permission of the present invention have the following beneficial effects:
1. the invention is simple and convenient;
2. the invention is dynamic acquisition, and has no any left-over influence on the equipment;
3. the invention is a classic CS architecture model, only needs network to be reachable, and has no hardware overhead;
4. the message interaction of the invention is encrypted message, and the network packet capturing can not be cracked, thereby improving the security.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The foregoing descriptions of specific exemplary embodiments of the present invention have been presented for purposes of illustration and description. It is not intended to limit the invention to the precise form disclosed, and obviously many modifications and variations are possible in light of the above teaching. The exemplary embodiments were chosen and described in order to explain certain principles of the invention and its practical application to enable one skilled in the art to make and use various exemplary embodiments of the invention and various alternatives and modifications as are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the claims and their equivalents.

Claims (9)

1. A method for obtaining the authority of a router background super administrator is characterized by comprising the following steps:
step S1, when the router is started, the telnetd _ startup background daemon service is started, and a preset port is monitored;
step S2, the client sends an init encrypted message to the router;
step S3, the router decrypts the init encrypted message and checks whether the message content is correct, if so, the router replies an init ACK message to the client;
step S4, the client sends a temporary telnet service opening instruction to the router; and
step S5, the router opens telnet service.
2. The method of claim 1, wherein the client sends an init encrypted message to the router through the predetermined port.
3. The method of obtaining router background super administrator privileges of claim 1, wherein said router opening telnet service comprises: and decrypting the received telnet service instruction, judging whether the telnet service instruction is to start the telnet service, and if so, starting the telnet service.
4. The method for obtaining the router background super administrator permission, according to claim 1, further comprising replying a temporary telnet service open command ACK to the client after the router opens the telnet service.
5. The method of claim 1, wherein when the client always sends an init encrypted message to the router and the router always rejects the init encrypted message for a predetermined number of times, the router blacklists the current client.
6. The method of claim 5, wherein when the router receives the init encrypted message sent by the client, it first determines whether the client is in a blacklist;
if the client is not in the blacklist list, the router receives the init encrypted message;
and if the client is in the blacklist list, the router does not respond to the message request of the client any more.
7. The method for obtaining the router background super administrator authority of claim 1, wherein the telnetd _ startup background daemon service uses socket sockets to create UDP socket file descriptors.
8. A system for obtaining the authority of a router background super administrator is characterized by comprising the following components:
a router; and
the client is in communication connection with the router;
when the router is started, a telnetd _ startup background daemon service is started, and a preset port is monitored;
the client sends an init encrypted message to the router;
the router decrypts the init encrypted message, checks whether the message content is correct, and if the message content is correct, the router replies an init ACK message to the client;
the client sends a temporary telnet service opening instruction to the router;
wherein the router opens telnet service.
9. An apparatus for obtaining a router background super administrator authority, comprising:
at least one processor; and the number of the first and second groups,
a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,
the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of obtaining router background hypervisor authority of any of claims 1-7.
CN202111322884.9A 2021-11-09 2021-11-09 Method, system and equipment for obtaining router background super manager authority Active CN114124483B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202111322884.9A CN114124483B (en) 2021-11-09 2021-11-09 Method, system and equipment for obtaining router background super manager authority

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202111322884.9A CN114124483B (en) 2021-11-09 2021-11-09 Method, system and equipment for obtaining router background super manager authority

Publications (2)

Publication Number Publication Date
CN114124483A true CN114124483A (en) 2022-03-01
CN114124483B CN114124483B (en) 2024-04-30

Family

ID=80377743

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202111322884.9A Active CN114124483B (en) 2021-11-09 2021-11-09 Method, system and equipment for obtaining router background super manager authority

Country Status (1)

Country Link
CN (1) CN114124483B (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040083280A1 (en) * 2002-10-24 2004-04-29 Houston Edward Donald Dynamically modified, multiple-platform computer programs, and methods and apparatus utilizing same
CN101005421A (en) * 2006-11-30 2007-07-25 北京佳讯飞鸿电气有限责任公司 Telnet control method for realizing multiple network system by single network port
WO2016197782A2 (en) * 2016-03-16 2016-12-15 中兴通讯股份有限公司 Service port management method and apparatus, and computer readable storage medium
CN109558148A (en) * 2018-11-29 2019-04-02 网易(杭州)网络有限公司 Plug-in unit installation method, device, equipment and the storage medium of router
CN113507384A (en) * 2021-06-22 2021-10-15 深圳市亿联无限科技有限公司 System and method for switching working modes of equipment

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040083280A1 (en) * 2002-10-24 2004-04-29 Houston Edward Donald Dynamically modified, multiple-platform computer programs, and methods and apparatus utilizing same
CN101005421A (en) * 2006-11-30 2007-07-25 北京佳讯飞鸿电气有限责任公司 Telnet control method for realizing multiple network system by single network port
WO2016197782A2 (en) * 2016-03-16 2016-12-15 中兴通讯股份有限公司 Service port management method and apparatus, and computer readable storage medium
CN109558148A (en) * 2018-11-29 2019-04-02 网易(杭州)网络有限公司 Plug-in unit installation method, device, equipment and the storage medium of router
CN113507384A (en) * 2021-06-22 2021-10-15 深圳市亿联无限科技有限公司 System and method for switching working modes of equipment

Also Published As

Publication number Publication date
CN114124483B (en) 2024-04-30

Similar Documents

Publication Publication Date Title
US11757941B2 (en) System and method for providing network and computer firewall protection with dynamic address isolation to a device
Vigna et al. NetSTAT: A network-based intrusion detection approach
EP3171572A1 (en) Network security protection method and device
US20140289830A1 (en) Method and system of a secure access gateway
EP2132643B1 (en) System and method for providing data and device security between external and host devices
CN102438028B (en) A kind of prevent Dynamic Host Configuration Protocol server from cheating method, Apparatus and system
EP3068093A1 (en) Security authentication method and bidirectional forwarding detection method
CN104580553B (en) Method and device for identifying network address translation equipment
WO2017053494A1 (en) Method, apparatus and system for preventing cross-site request forgery
CN111131310A (en) Access control method, device, system, computer device and storage medium
CN109302397B (en) Network security management method, platform and computer readable storage medium
CN110602130B (en) Terminal authentication system and method, equipment terminal and authentication server
CN102045309A (en) Method and device for preventing computer from being attacked by virus
CN114124483B (en) Method, system and equipment for obtaining router background super manager authority
CN111786932A (en) Account login method and device, electronic equipment and computer storage medium
CN112468610B (en) Data transmission method, monitoring node, monitoring server and monitoring network system
CN111628960B (en) Method and apparatus for connecting to network services on a private network
Cisco Release Notes for the Cisco Secure PIX Firewall Version 5.3(2)
Cisco Release Notes for the Cisco Secure PIX Firewall Version 5.3(4)
Cisco Configuring Network Security
Cisco Configuring Network Security
Cisco Cisco PIX Firewall Release Notes, Version 6.1(1)
CN106790012A (en) Method for authenticating user identity based on the checking of 802.1X protocol datas bag
CN112804144B (en) Information configuration method and network equipment
CN114629683B (en) Access method, device, equipment and storage medium of management server

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant