CN114124483B - Method, system and equipment for obtaining router background super manager authority - Google Patents

Method, system and equipment for obtaining router background super manager authority Download PDF

Info

Publication number
CN114124483B
CN114124483B CN202111322884.9A CN202111322884A CN114124483B CN 114124483 B CN114124483 B CN 114124483B CN 202111322884 A CN202111322884 A CN 202111322884A CN 114124483 B CN114124483 B CN 114124483B
Authority
CN
China
Prior art keywords
router
client
init
message
telnet service
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202111322884.9A
Other languages
Chinese (zh)
Other versions
CN114124483A (en
Inventor
唐荣华
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Zhejiang Hangxin Technology Co ltd
Original Assignee
Zhejiang Hangxin Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Zhejiang Hangxin Technology Co ltd filed Critical Zhejiang Hangxin Technology Co ltd
Priority to CN202111322884.9A priority Critical patent/CN114124483B/en
Publication of CN114124483A publication Critical patent/CN114124483A/en
Application granted granted Critical
Publication of CN114124483B publication Critical patent/CN114124483B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101Access control lists [ACL]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/12Applying verification of the received information
    • H04L63/123Applying verification of the received information received data contents, e.g. message integrity

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention discloses a method, a system and equipment for acquiring the authority of a router background super manager. The method for acquiring the router background super manager authority comprises the following steps: step S1, when the router is started, a telnetd_start background daemon service is started, and a preset port is monitored. Step S2, the client sends an init encryption message to the router. And S3, the router decrypts the init encrypted message, verifies whether the content of the message is correct, and replies an init ACK message to the client if the content of the message is correct. And S4, the client sends a temporary telnet service opening instruction to the router. Step S5, the router starts telnet service. Therefore, the method for acquiring the router background super manager authority is simple and convenient, can dynamically acquire the router super manager authority, has no legacy effect, and improves the safety.

Description

Method, system and equipment for obtaining router background super manager authority
Technical Field
The invention relates to the technical field of routing equipment, in particular to a method, a system and equipment for acquiring authority of a background super manager of a router.
Background
The router, the requisite 3C product of modern family, the entry of modern family internet, connect the hub of family's smart machine. The router background super manager authority is the highest authority for the router, and acquiring the authority can hijack traffic, modify data packets, monitor user data and even brush out native firmware. Once the router background super manager rights are leaked, the security of the data of the user and the reliability of the network cannot be ensured. However, when the factory is produced, the router super manager authority is required to be acquired, and the repair machine problem analysis also needs to acquire the super manager authority. Therefore, how to dynamically acquire router super administrator authority without leakage becomes a core point of the above problem.
The router typically opens all services that obtain the rights of the super administrator, telnet services, SSH services, serial services, etc. during the engineering prototype phase. But these services either default to be disabled during the mass production phase or the default ports of these services are modified, with some vendors leaving a switchable back door on the local web page, etc.
In order to prevent a user from acquiring the right of a super manager, detecting whether Telnet service of a router is started or not every preset time period; and closing the Telnet service when the Telnet service of the router is detected to be in an on state. And randomly generating a configuration information table of the anti-brush machine after the router is electrified, wherein the configuration information table of the anti-brush machine comprises the baud rate used by the serial port.
However, after the production test of most routers is finished, all the services for acquiring the super administrator are disabled, so that the super administrator authority cannot be acquired any more. When some repairing machines need to be positioned, the scheme can not meet the requirement. Modifying the service default port, the port scan tool can easily discover the modified port, which is improved but not fundamentally solves the problem.
The local web page leaves a back door that switches, once leaked to the forum, or can have serious consequences. And the serial port acquires the authority of the router super manager, the serial port needs to be welded by a disassembling machine, and the serial port line is needed during connection, so that the router super manager is inconvenient.
The information disclosed in this background section is only for enhancement of understanding of the general background of the invention and should not be taken as an acknowledgement or any form of suggestion that this information forms the prior art already known to a person of ordinary skill in the art.
Disclosure of Invention
The invention aims to provide a method, a system and equipment for acquiring the authority of a router background super manager, which are simple and convenient, can dynamically acquire the authority of the router super manager, have no legacy influence and improve the safety.
To achieve the above object, in a first aspect, the present invention provides a method for obtaining rights of a background super administrator of a router, including: step S1, when the router is started, a telnetd_start background daemon service is started, and a preset port is monitored. Step S2, the client sends an init encryption message to the router. And S3, the router decrypts the init encrypted message, verifies whether the content of the message is correct, and replies an init ACK message to the client if the content of the message is correct. And S4, the client sends a temporary telnet service opening instruction to the router. Step S5, the router starts telnet service.
In one embodiment of the present invention, the client sends the init encrypted message to the router through a preset port.
In one embodiment of the present invention, the router opening telnet service includes: decrypting the received telnet service instruction, judging whether the telnet service instruction is to open the telnet service, and if so, opening the telnet service.
In an embodiment of the present invention, the method for obtaining the authority of the router background super administrator further includes replying a temporary telnet service opening instruction ACK to the client after the router opens the telnet service.
In one embodiment of the present invention, when the client always sends an init encrypted message to the router, and the router always refuses the init encrypted message and reaches a preset number of times, the router lists the current client in a blacklist.
In one embodiment of the present invention, when the router receives the init encrypted message sent by the client, it first determines whether the client is in the blacklist. If the client is not in the blacklist, the router receives the init encrypted message. If the client is in the blacklist, the router does not respond to the message request of the client.
In one embodiment of the invention, the telnetd_start daemon background daemon uses socket sockets to create UDP socket file descriptors.
In a second aspect, an embodiment of the present invention further provides a system for obtaining rights of a background super administrator of a router, including: a router and a client. The client is communicatively coupled to the router. When the router is started, a telnetd_start background daemon service is started, and a preset port is monitored. Wherein, the client sends init encrypted message to the router. The router decrypts the init encrypted message, verifies whether the content of the message is correct, and replies an init ACK message to the client if the content of the message is correct. The client sends a temporary telnet service opening instruction to the router. Wherein the router opens a telnet service.
In a third aspect, an embodiment of the present invention further provides an apparatus for obtaining rights of a background super administrator of a router, including:
at least one processor; and
A memory communicatively coupled to the at least one processor; wherein,
The memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of obtaining router back office superadministrator rights described above.
Compared with the prior art, the method, the system and the equipment for acquiring the router background super manager authority are simple and convenient, can dynamically acquire the router super manager authority, have no legacy influence, and improve the safety.
Drawings
FIG. 1 is a flow diagram of a method of obtaining router backend superadministrator privileges according to one embodiment of the invention;
FIG. 2 is a schematic diagram of a logical decision wire frame of a method of obtaining router background superadministrator privileges according to one embodiment of the invention;
Fig. 3 is a block diagram of an apparatus for obtaining router back office superadministrator rights according to an embodiment of the present invention.
Detailed Description
The following detailed description of embodiments of the invention is, therefore, to be taken in conjunction with the accompanying drawings, and it is to be understood that the scope of the invention is not limited to the specific embodiments.
Throughout the specification and claims, unless explicitly stated otherwise, the term "comprise" or variations thereof such as "comprises" or "comprising", etc. will be understood to include the stated element or component without excluding other elements or components.
FIG. 1 is a flow diagram of a method for obtaining router back office superadministrator privileges according to one embodiment of the invention. FIG. 2 is a schematic diagram of a logical decision wire frame of a method of obtaining router backend superadministrator privileges according to one embodiment of the invention.
In a first aspect, the present invention provides a method for obtaining a router background super administrator authority, as shown in fig. 1 to fig. 2, where the method for obtaining the router background super administrator authority includes:
Step S1, when the router is started, a telnetd_start background daemon service is started, and a preset port is monitored. Step S2, the client sends an init encryption message to the router. And S3, the router decrypts the init encrypted message, verifies whether the content of the message is correct, and replies an init ACK message to the client if the content of the message is correct. And S4, the client sends a temporary telnet service opening instruction to the router. Step S5, the router starts telnet service.
In one embodiment of the present invention, the client sends the init encrypted message to the router through a preset port. The router opening telnet service includes: decrypting the received telnet service instruction, judging whether the telnet service instruction is to open the telnet service, and if so, opening the telnet service.
In an embodiment of the present invention, the method for obtaining the authority of the router background super administrator further includes replying a temporary telnet service opening instruction ACK to the client after the router opens the telnet service. When the client always sends the init encrypted message to the router and the router always refuses the init encrypted message and reaches the preset times, the router lists the current client in a blacklist.
In one embodiment of the present invention, when the router receives the init encrypted message sent by the client, it first determines whether the client is in the blacklist. If the client is not in the blacklist, the router receives the init encrypted message. If the client is in the blacklist, the router does not respond to the message request of the client.
In one embodiment of the invention, the telnetd_start daemon background daemon uses socket sockets to create UDP socket file descriptors.
In a second aspect, an embodiment of the present invention further provides a system for obtaining rights of a background super administrator of a router, including: a router and a client. The client is communicatively coupled to the router. When the router is started, a telnetd_start background daemon service is started, and a preset port is monitored. Wherein, the client sends init encrypted message to the router. The router decrypts the init encrypted message, verifies whether the content of the message is correct, and replies an init ACK message to the client if the content of the message is correct. The client sends a temporary telnet service opening instruction to the router. Wherein the router opens a telnet service.
In a third aspect, FIG. 3 illustrates a block diagram of an apparatus for obtaining router back office superadministrator privileges according to another embodiment of the invention. The device 1100 may be a host server with computing capabilities, a personal computer PC, or a portable computer or terminal that can be carried, etc. The specific embodiments of the present invention are not limited to specific implementations of electronic devices.
The device 1100 includes at least one processor 1110, a communication interface (Communications Interface) 1120, a memory 1130, and a bus 1140. Wherein processor 1110, communication interface 1120, and memory 1130 communicate with each other through bus 1140.
The communication interface 1120 is used to communicate with network elements including, for example, virtual machine management centers, shared storage, and the like.
The processor 1110 is used to execute programs. Processor 1110 may be a central processing unit CPU, or an Application-specific integrated Circuit ASIC (Application SPECIFIC INTEGRATED circuits), or one or more integrated circuits configured to implement embodiments of the present invention.
The memory 1130 is used for executable instructions. Memory 1130 may include high-speed RAM memory or non-volatile memory (nonvolatile memory), such as at least one magnetic disk memory. Memory 1130 may also be a memory array. Memory 1130 may also be partitioned and the blocks may be combined into virtual volumes according to certain rules. The instructions stored in memory 1130 may be executable by processor 1110 to enable processor 1110 to perform the acquisition router back office superadministrator authority in any of the method embodiments described above.
In practical application, the method, the system and the equipment for acquiring the authority of the background super manager of the router are based on OPENWRT intelligent router development platform. After the router is started, a background daemon service telnetd_start is operated to monitor a certain fixed port. After the message is successfully interacted for a plurality of times, a telnet service is started, otherwise, the message is discarded, and the initial state is returned again.
The method mainly comprises three steps, and the three steps realize the starting of telnet service, thereby providing the right of the super manager. Firstly, when the router is started, a telnetd_start background daemon service is started, and the service fixedly monitors a certain fixed port UDP message. Specifically, when a socket is created, the "SOCK_ DGRAM" is used for designating the UDP protocol type, and local ports, such as 21212 ports, are bound to start to monitor Linux network protocol stack messages. Then, the windows client sends an init message, the background daemon sends an init ACK message, and the windows client sends a temporary telnet service starting instruction. Finally, the telnet_start background daemon service opens telnet services. The message interactions are all encrypted messages. Based on the cs model, the client always sends an init message, the router always refuses the init message and reaches a certain number of times, and the router lists the current client into a blacklist and does not correspond to the message request any more. This process will continue for a period of time, such as 1 hour, after which the message will continue to be accepted. In detail:
1. The router starts a telnetd_startup background daemon service. The service adopts socket sockets to create UDP socket file descriptors. The bind fixed listening port, e.g., 21000, waits for the arrival of a client message.
2. The Windows host runs the client program. The client needs a network reachable router, the client sends the init encrypted message, and the router decrypts the init message and verifies the message content. If the content of the message is checked to be correct, the router replies an init ACK message, and the client sends a temporary telnet service starting instruction.
3. The telnet_start daemon service starts the telnet service. The router successfully decrypts the temporary telnet service starting instruction and runs telnet service.
4. The server replies a temporary telnet service starting instruction ACK.
In the invention, UDP can be replaced by TCP, both are CS models, and have no essential difference, compared with TCP which is stateful and oriented to a connection protocol, UDP is more suitable for the scene.
In summary, the method, the system and the equipment for acquiring the authority of the router background super manager have the following beneficial effects:
1. The invention is simple and convenient;
2. the invention is dynamic acquisition, and has no legacy effect on the equipment;
3. the invention is a classical CS architecture model, only needs to be reachable by a network, and has no hardware overhead;
4. The message interaction of the invention is an encrypted message, and the network packet can not be broken, thereby improving the safety.
It will be appreciated by those skilled in the art that embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The foregoing descriptions of specific exemplary embodiments of the present invention are presented for purposes of illustration and description. It is not intended to limit the invention to the precise form disclosed, and obviously many modifications and variations are possible in light of the above teaching. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application to thereby enable one skilled in the art to make and utilize the invention in various exemplary embodiments and with various modifications as are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the claims and their equivalents.

Claims (5)

1. A method for obtaining rights of a router backend super administrator, comprising:
Step S1, a telnetd_start background daemon service is started when a router is started, and a preset port is monitored;
Step S2, the client sends an init encryption message to the router;
Step S3, the router decrypts the init encrypted message, verifies whether the message content is correct, and if so, the router replies an init ACK message to the client;
Step S4, the client sends a temporary telnet service opening instruction to the router; and
Step S5, the router starts telnet service;
the client sends an init encryption message to the router through the preset port;
Wherein the router opening telnet service comprises: decrypting the received telnet service instruction, judging whether the telnet service instruction is to open telnet service, and if yes, opening telnet service;
when the client always sends an init encryption message to the router and the router always refuses the init encryption message and reaches the preset times, the router lists the current client in a blacklist;
When the router receives the init encryption message sent by the client, judging whether the client is in a blacklist or not;
If the client is not in the blacklist, the router receives the init encryption message;
And if the client is in the blacklist, the router does not respond to the message request of the client any more.
2. The method for obtaining the router backend super administrator authority according to claim 1, further comprising replying to the client with a temporary telnet service opening command ACK after the router opens telnet service.
3. The method for obtaining router backend super administrator authority according to claim 1, wherein the telnetd_start backend daemon uses socket sockets to create UDP socket file descriptors.
4. A system for obtaining router backend superadministrator privileges, comprising:
a router; and
The client is in communication connection with the router;
The router starts a telnetd_start background daemon service when being started, and monitors a preset port;
the client sends an init encryption message to the router;
The router decrypts the init encrypted message, verifies whether the message content is correct, and replies an init ACK message to the client if the message content is correct;
the client sends a temporary telnet service opening instruction to the router;
The router starts telnet service;
the client sends an init encryption message to the router through the preset port;
Wherein the router opening telnet service comprises: decrypting the received telnet service instruction, judging whether the telnet service instruction is to open telnet service, and if yes, opening telnet service;
when the client always sends an init encryption message to the router and the router always refuses the init encryption message and reaches the preset times, the router lists the current client in a blacklist;
When the router receives the init encryption message sent by the client, judging whether the client is in a blacklist or not;
If the client is not in the blacklist, the router receives the init encryption message;
And if the client is in the blacklist, the router does not respond to the message request of the client any more.
5. An apparatus for obtaining rights of a router backend super administrator, comprising:
at least one processor; and
A memory communicatively coupled to the at least one processor; wherein,
The memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of obtaining router back office superadministrator privileges according to any one of claims 1-3.
CN202111322884.9A 2021-11-09 2021-11-09 Method, system and equipment for obtaining router background super manager authority Active CN114124483B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202111322884.9A CN114124483B (en) 2021-11-09 2021-11-09 Method, system and equipment for obtaining router background super manager authority

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202111322884.9A CN114124483B (en) 2021-11-09 2021-11-09 Method, system and equipment for obtaining router background super manager authority

Publications (2)

Publication Number Publication Date
CN114124483A CN114124483A (en) 2022-03-01
CN114124483B true CN114124483B (en) 2024-04-30

Family

ID=80377743

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202111322884.9A Active CN114124483B (en) 2021-11-09 2021-11-09 Method, system and equipment for obtaining router background super manager authority

Country Status (1)

Country Link
CN (1) CN114124483B (en)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101005421A (en) * 2006-11-30 2007-07-25 北京佳讯飞鸿电气有限责任公司 Telnet control method for realizing multiple network system by single network port
WO2016197782A2 (en) * 2016-03-16 2016-12-15 中兴通讯股份有限公司 Service port management method and apparatus, and computer readable storage medium
CN109558148A (en) * 2018-11-29 2019-04-02 网易(杭州)网络有限公司 Plug-in unit installation method, device, equipment and the storage medium of router
CN113507384A (en) * 2021-06-22 2021-10-15 深圳市亿联无限科技有限公司 System and method for switching working modes of equipment

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7765284B2 (en) * 2002-10-24 2010-07-27 Hewlett-Packard Development Company, L.P. Dynamically modified, multiple-platform computer programs, and methods and apparatus utilizing same

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101005421A (en) * 2006-11-30 2007-07-25 北京佳讯飞鸿电气有限责任公司 Telnet control method for realizing multiple network system by single network port
WO2016197782A2 (en) * 2016-03-16 2016-12-15 中兴通讯股份有限公司 Service port management method and apparatus, and computer readable storage medium
CN109558148A (en) * 2018-11-29 2019-04-02 网易(杭州)网络有限公司 Plug-in unit installation method, device, equipment and the storage medium of router
CN113507384A (en) * 2021-06-22 2021-10-15 深圳市亿联无限科技有限公司 System and method for switching working modes of equipment

Also Published As

Publication number Publication date
CN114124483A (en) 2022-03-01

Similar Documents

Publication Publication Date Title
US9398026B1 (en) Method for authenticated communications incorporating intermediary appliances
CN106034104B (en) Verification method, device and system for network application access
US10097530B2 (en) Security authentication method and bidirectional forwarding detection BFD device
US10419431B2 (en) Preventing cross-site request forgery using environment fingerprints of a client device
US20180198786A1 (en) Associating layer 2 and layer 3 sessions for access control
CN104580553B (en) Method and device for identifying network address translation equipment
CN105791235B (en) Configuration information downloading method and equipment
CN110602130B (en) Terminal authentication system and method, equipment terminal and authentication server
US9118588B2 (en) Virtual console-port management
WO2020229537A1 (en) Method for selectively configuring a container, and network arrangement
CN105049546A (en) Client terminal IP address allocation method through DHCP server and device thereof
CN114124483B (en) Method, system and equipment for obtaining router background super manager authority
CN111478788B (en) Abnormal offline recovery method, device and equipment and machine-readable storage medium
CN103873431A (en) Method and device for identifying dynamic host configuration protocol server
CN111786932A (en) Account login method and device, electronic equipment and computer storage medium
CN114157470B (en) Token management method and device
CN115987660A (en) VPN device communication method, device and storage medium
CN112468610B (en) Data transmission method, monitoring node, monitoring server and monitoring network system
CN111628960B (en) Method and apparatus for connecting to network services on a private network
CN105959251B (en) method and device for preventing NAT from traversing authentication
CN106790012A (en) Method for authenticating user identity based on the checking of 802.1X protocol datas bag
WO2016112613A1 (en) Access control method, device and broadband remote access server (bras)
KR20180050181A (en) Modem apparatus and system for providing static ip
CN105515797B (en) Park area network user authentication charging method, device and system
CN110830509B (en) Method and device for automatically supporting cross-domain access

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant