KR102184757B1 - Network hidden system and method - Google Patents

Abstract

The present invention provides a network concealment system that hides an IP address and port information of a network connecting communication between a client terminal and a server so that information related to the network to be accessed is not seen from the outside, and a method thereof. To this end, the system comprises: a client terminal which attempts to connect using a fake IP that has no relation to an actual IP of the network when attempting to connect to the desired server through the network; and a virtual perimeter (VP) manager for creating VPs between the client terminal and the network, and directly connecting the created VPs to the fake IP obtained by the client terminal in an end to end signaling method to allow access to the network through the VP even if the client terminal tries to route to the fake IP.

Description

Network hiding system and method {NETWORK HIDDEN SYSTEM AND METHOD}

The present invention relates to a network concealment system and method, and more particularly, a network concealment that hides the IP address and port information of a network connecting communication between a client terminal and a server so that no information of a network to be accessed from outside is visible. It relates to systems and methods.

Due to the rapid development of high-speed Internet networks and technological advances, in recent years, we are in the era of hyper-connectivity that can interconnect all devices around the world, such as automobiles, machines, and home appliances, and in accordance with this, the work environment is also built smart. I'm going.

The existing Ethernet network using IP using a computer device has a vulnerability of openness, so security threats to data and systems are becoming more problematic than ever. Not only normal users but also malicious users such as hackers can easily access, and after accessing the internal network, access to all servers connected to the internal network is possible, so it has a huge vulnerability in terms of security.

For example, referring to FIG. 1, an example in which a terminal accesses a specific server through a network is illustrated. In general, a terminal accesses a network through an IP address, and a terminal that successfully accesses transmits and receives packet data with a specific server through the network.

At this time, the IP is a unique network address assigned when the terminal accesses the network, and if this address is exposed, there is room for an attacker to invade using various hacking techniques. In other words, if an attacker who has accessed for hacking purposes captures a packet, it is easy to find the IP address to which the corresponding terminal is connected and can steal it (①, ②).

Moreover, the successful connection terminal can always remain connected to the network, and access to all servers connected to the network is easy. That is, when the terminal is connected to the network, the attacker's access is also easy and exposed to the risk of attack. There is a problem that it is highly likely to be (③).

In this way, in order to cope with the cybersecurity problems according to the changing times, it is necessary to actively respond by analyzing possible risk factors in depth. Of course, the most fatal and serious part of these threats is in the network itself, and measures to respond to advanced threats are required.

Republic of Korea Patent Publication No. 10-2015-0089900

The present invention is one of the powerful countermeasures against the above problems and intelligent attacks, allowing access to a specific network only to authenticated terminals, but concealing IP address and port information for a specific network to provide packet data The purpose of this is to prevent hacking attacks by attackers by making sure that the address and port information about the network to be accessed is not seen from outside by sending and receiving.

An object of the present invention is to effectively hide information on a network by running a simple agent without the need to install a separate library or module that is expensive and requires complex maintenance costs.

The present invention is to provide an effective method for protecting an internal trusted communication network from an unreliable communication network while using the existing Internet infrastructure as it is.

In addition, the existing security strategies gave the hacker the incentive to find system vulnerabilities by acquiring information on the target. As a result, if the main security strategy was to seek only passive and ad hoc defense measures, the present invention is a change of ideas. It blocks the provision of information and hides the nodes of the network more reliably and effectively by introducing dual virtualization technology using real address concealment and the use of virtual servers, thereby incapacitating the attacker's access and vulnerability analysis behavior and blocking access to the source.

To this end, a network concealment system according to an embodiment of the present invention includes a client terminal that attempts to connect using a fake IP that is not related to an actual IP of the network when attempting to connect to a desired server through a network; Virtual Perimeters (VPs) are created between the client terminal and the network, and the generated virtual boundaries are directly connected to the fake IP obtained by the client terminal in an end-to-end singnaling method, and the client It includes a VP manager that allows the terminal to access the network through the virtual boundary even if the terminal attempts to route to the fake IP.

In addition, the network concealment system according to an embodiment of the present invention further comprises a node manager that periodically dynamically changes IP and port information of each node for at least one or more nodes configured in the network, wherein the client terminal Even after the connection with the server is maintained through the network, the IP and port information of the network is dynamically changed to prevent the attacker's access and chipping.

In addition, the network concealment system according to an embodiment of the present invention is implemented in at least one or more nodes configured in the network, and by referring to the previously stored mapping information, a fake packet transmitted from the client terminal through the virtual boundary It may further include an IP mapping unit for changing the IP to the corresponding node's own IP mapped to the mapping information.

On the other hand, the network concealment method according to an embodiment of the present invention is a method for connecting communication between a client terminal and a server through a network, wherein the client terminal obtains a fake IP that has no relation to the actual IP of the network. Obtaining; Attempting to connect through the acquired fake IP when the client terminal attempts to connect to a desired server through the network; Generating, by a VP manager in the client terminal, virtual perimeters (VPs) for providing a virtual interface between the client terminal and the network; The VP manager connects the virtual boundaries created in the step with the fake IP acquired by the client terminal in an end-to-end singnaling method, and the client terminal attempts to route to the virtual boundary using the fake IP. It includes the step of.

According to the present invention, it is possible to transmit packets between the client terminal and the server without exposing the IP and port information of the network to the outside by concealing the access information (IP address) to be hacked at all, thereby preventing cyber attacks. It has a fundamental blocking effect. That is, there is an effect of reinforcing cybersecurity by making it difficult for malicious users such as hackers to access.

In particular, according to the present invention, it is possible to fundamentally block external attacks from the outside by allowing access through double virtualization, that is, using only fake IPs, and performing communication through a virtual network secondarily.

In addition, according to the present invention, even if the terminal is connected to the server through the network, the node IP and port information that can identify the route of the network are periodically dynamically changed, even if the attacker captures and accesses the fake IP, the node IP before the change Since access is made with the and port information, there is an effect of blocking it. Thereby, there is a remarkable effect that external attacks can be fundamentally blocked.

Further, according to the present invention, there is no need to install separate libraries or modules in the existing hidden server and the host client, and information of the hidden server can be effectively hidden on the network without modifying the existing hidden server or client.

In addition, according to the present invention, there is no need to install a separate library or module that requires expensive and complex maintenance costs to connect communication between a client terminal and a server, and by running a simple agent, information can be effectively hidden on the network. have.

1 is a diagram illustrating a problem of a general Ethernet-based network.
2 is a block diagram showing a network concealment system according to an embodiment of the present invention.
3 is a diagram illustrating a packet transfer process between a client terminal and a network through a network concealment system according to an embodiment of the present invention.
FIG. 4 is a diagram for explaining an example of dynamically changing IP and port information of a node in a node manager according to an embodiment of the present invention.
5 is a diagram illustrating a packet delivery process in a terminal according to an embodiment of the present invention.

The terms or words used in the specification and claims should not be construed as being limited to their usual or dictionary meanings, and the inventor may appropriately define the concept of terms in order to describe his own invention in the best way. It should be interpreted as a meaning and concept consistent with the technical idea of the present invention based on the principle that there is. Therefore, the embodiments described in the present specification and the configurations shown in the drawings are only the most preferred embodiments of the present invention, and do not represent all the technical spirit of the present invention, and thus various alternatives that can be substituted for them at the time of application It should be understood that there may be equivalents and variations.

In addition, the singular expression used in the present specification includes a plurality of expressions unless the context clearly indicates otherwise. In the present application, terms such as "consist of" or "include" should not be construed as necessarily including all of the various elements or various steps described in the specification, and some of the elements or some steps It may not be included, or it should be interpreted that it may further include additional elements or steps.

In particular, in this specification, the terms "~ unit" and "~ module" are not used as terms that mean hardware division. Therefore, a plurality of components may be integrated into one component, or one component may be divided into a plurality of components. Further, the configuration unit may mean a configuration unit of hardware, but may also mean a configuration unit of software. Therefore, it will be understood that the present invention is not particularly limited by the term "~ unit".

Hereinafter, specific embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is a block diagram showing a network concealment system according to an embodiment of the present invention.

A network concealment system according to an embodiment of the present invention includes a client terminal 100, a virtual perimeter (VP) 200, a server 400, a client terminal 100, and a server 400 as shown in FIG. ) Including network configurations (300, 310, 320) for connecting communication.

The client terminal 100 refers to a user or a terminal of a user who accesses the server 400 and receives a service. The client terminal 100 tries to connect to a desired server 400 through a network.

At this time, the client terminal 100 does not attempt to connect using the IP of the network, but attempts to connect using a fake IP that has no relation to the IP of the network. In the present invention, the fake IP refers to a virtual address that does not exist on the network between the actual client terminal 100 and the network. This is to expose false information, not real IP, so that any IP or port information related to network access is not visible to the outside. In other words, it is to hide the actual IP and port information of the network.

To this end, the fake IP acquisition unit 110 of the client terminal 100 may receive a fake IP from a separate external server. The fake IP is operated by an external server having a separate authentication channel, and the fake IP acquisition unit 110 of the client terminal 100 receives the fake IP generated by the external server from the external server. Specifically, the client terminal 100 may periodically receive a preset fake IP from an external server, or may receive a fake IP by synchronizing with the server through a key exchange method in the form of a session. Alternatively, various methods can be used, such as pre-configured and fixed in advance.

The virtual boundary 200 refers to a virtual network built at the boundary between the client terminal 100 and the network.

In this embodiment, the virtual boundary 200 virtualizes a network connection based on a redirect movement method among network movement methods. Through this, a packet transmitted from the client terminal 100 is double virtualized by a redirect method. The packet is transmitted to the node 300 of the network and transmitted from the node 300 of the network is transmitted to the corresponding client terminal 100 through the virtual network.

The virtual boundary 200 provides a virtual network path that can be mapped in a one-to-one correspondence with a packet transmitted from the client terminal 100. Therefore, the virtual boundary 200 has an advantage of being able to expand an existing network without building a separate server.

In particular, the virtual boundary 200 may be configured to separate a network network capable of accessing nodes of a network from a hacking terminal. For example, the virtual boundary 200 connects the device and a specific business server in an end-to-end manner to limit network nodes that can be accessed using the terminal so that only the authentication terminal through the virtual boundary 200 can be connected. In addition, it can be separated from the network network that can access other nodes that do not have IP mapping. Eventually, a dedicated virtual boundary can be formed for each institutional unit of a company or organization or for each service unit.

In addition, the virtual boundary 200 includes a network address translation (NAT) and filtering configuration. Filtering is mainly used to build firewalls because it is responsible for filtering out (rejecting) packets. NAT is used to configure hardware-based perimeters such as firewalls, VPNs, and IPSs in a virtual software form by changing the contents of packets, that is, addresses and port numbers.

The VP manager 120 of the client terminal 100 creates these virtual boundaries 200, and the generated virtual boundaries are acquired by the client terminal 100 and a fake IP and an end-to-end signaling method. Even if the client terminal 100 attempts to route to a fake IP by directly connecting to, it provides access to the network through the virtual boundary 200.

That is, when the connection to the server from the client terminal 100 is attempted, the VP manager 120 performs a redirect to the fake IP obtained by the fake IP acquisition unit 110 at the kernel level. Packet redirection of the VP manager 120 is performed through a kernel device module in the terminal, and at this time, kernel information remaining in the kernel device module may serve as a basis for tracking the access log. Accordingly, the client terminal 100 may change kernel information by performing address translation to the node IP received by the redirection method of the VP manager 120 through the IP mapper in the terminal.

The VP manager 120 may be implemented on the client terminal 100 as shown in FIG. 2, but is not limited thereto and may be provided in a separate agent separately from the client terminal 100.

The network includes network equipment in hardware, and this is called a node. The network includes at least one or more nodes 300, and each node 300 includes a node manager 310 and an IP mapping unit 320, respectively.

The node manager 310 dynamically changes IP and port information of each node 300 periodically using a forward method and a redirect method. For example, the IP and port information of each node is dynamically changed at regular intervals such as 3 seconds, 2 seconds, and 1 second.

At this time, the node manager 120 blocks the ICMP protocol to prevent network discovery. In addition, the node manager 120 makes dynamic changes to IP and ports in less than 10 seconds based on a policy, but randomly changes IP collisions between different nodes. In addition, the node manager 120 basically closes all ports of the server and operates in the form of a'dynamic firewall' in which only the ports required by the policy are dynamically changed.

In this way, if the IP and port information of the node is dynamically changed at short time intervals through the node manager 310, the IP or port information of the corresponding network is maintained even when the client terminal 100 is connected to the server through the network. Since it is constantly changed, it has the effect of fundamentally blocking attacks that attempt to hack previous IP or port information. When the client terminal 100 is connected to the server through the network, the attacker can scan the fake IP of the client terminal 100 and attempt an attack. At this time, the VPN and domain of the server connected to the attacker through the network There is a risk of information such as being exposed. However, with the above configuration, even if an attacker accesses through packet capture, the IP and port information of the node is continuously changed and the access is made to the previous IP and port information, so that the attacker's access can be blocked at the source.

Specifically, a method of dynamically changing the IP and port of the network described above will be described in FIG. 4 below.

Referring back to FIG. 2, the IP mapping unit 320 is implemented in at least one or more nodes 300 configured in a network, and performs IP conversion by referring to previously stored mapping information.

That is, the IP mapping unit 320 changes the fake IP of the packet transmitted from the client terminal 100 via the virtual boundary 200 to the corresponding node's own IP based on the previously stored mapping information. At this time, the IP of the corresponding node itself becomes IP information that has recently been dynamically changed through the node manager 310. The mapping information includes information obtained by mapping between the fake IP obtained by the client terminal 100 and the IP and port information of each node dynamically changed through the node manager 310.

The packet converted through the IP mapping unit 320 is transmitted to a higher level, and the node manager 310 determines whether the packet transmitted from the client terminal 100 via the virtual boundary 200 is the node's own IP. . Since the node's own IP is periodically changed, it is necessary to check in real time for the recently changed IP address. Accordingly, the node manager 310 refers to the routing information of the virtual boundary and, if the packet is a packet containing a fake IP, recognizes that the packet is a packet of the node itself and transmits the packet to the upper layer. After that, communication becomes possible.

Hereinafter, a packet forwarding mechanism will be described based on a network concealment system according to an embodiment of the present invention.

3 is a diagram illustrating a packet delivery process between a client terminal and a network through a network concealment system according to an embodiment of the present invention, and FIG. 5 is a diagram for explaining a packet delivery process in a terminal according to an embodiment of the present invention .

Referring to FIG. 3 using the IP address shown in FIG. 5 as an example, it is assumed that the IP address of the authenticated client terminal is 20.20.20.13. The application in the client terminal attempts to communicate with the application of the server that provides a specific service through the address:port of 30.30.30.7:22 (①). Then, the VP Manager in the client terminal changes the above access address to the address of 1.1.1.1:48743, which is a preset fake IP, and performs a redirect at the kernel level (②). ,③). Packet Redirection of the VP manager is performed through the kernel device module, and through this, a packet with a fake IP is transmitted to the network node via a virtual boundary (④). For 1.1.1.1, which is a fake IP, it is recommended to set up a virtual address that does not exist at all on the network between the actual client terminal and the server, but it is okay to use the actual IP.

After that, packets are delivered to the network interface of a node existing on the network even though it is a fake IP, not an actual IP corresponding to its own bandwidth. At this time, the network node transmits the packet through the NIC (⑤,⑩), and after the IP Mapper checks the node IP mapped to the fake IP, it changes to the recently dynamically changed node's own IP, 10.10.10.x (⑥ ). The changed packet is delivered to the application along the network layer of the OS kernel (⑦). In the next procedure, the application determines whether the packet is the node's own IP. If the packet contains a fake IP by referring to the routing information of the pre-set virtual interface, it recognizes that it is its own packet and passes through the IP layer to the higher layer. Communication becomes possible. After communication is connected, the network node transfers the packet received from the server to the client terminal, and in response, the client terminal delivers the received packet to the application through the kernel driver module (⑧ to ⑬). In this case, the client terminal 100 may change kernel information by performing address translation (NAT) to the node IP received by the VP manager's redirect method through the IP mapper in the terminal as shown in FIG. 5.

In this network configuration, an external hacker terminal may acquire an IP through scanning such as a TCP Dump and attempt to access the network. However, since the client terminal uses a dual virtualized IP, information about the network cannot be found. In addition, the client terminal deletes the transmission log transmitted to the fake IP through the virtual boundary so as not to leave a trace of the relevant information accessible to the network. In addition, it becomes a black core for hackers because no clue can be obtained even through the application of the client terminal.

FIG. 4 is a diagram for explaining an example of dynamically changing IP and port information of a node in a node manager according to an embodiment of the present invention.

Referring to FIG. 4, a random network having a C class 10.10.10.x band is configured. In this network, server nodes #1 to N (#N) exist, and each node manager exists in the node. It is assumed that the time flows from the reference time Time 1 to Time N in units of 1 second.

When the reference time is Time 1, the IP of Node #1 is 10.10.10.5. At this time, the Node Manager in the node randomly changes the IP of the NIC so as not to collide with other nodes in the network bandwidth. When Time 1 + N time, the IP of Node #1 is 10.10.10.54. Node Manager plays the role of continuously changing service ports in the same way. Node Manager does not communicate or cooperate separately with Node Managers existing in other nodes, and plays an exclusive role only in its own node.

Meanwhile, the network concealment method according to an embodiment of the present invention is a method for connecting communication between a client terminal and a server through a network. First, the client terminal acquires a fake IP that is not related to the actual IP of the network. do.

Thereafter, when the client terminal tries to connect to the desired server through the network, it tries to connect through the fake IP obtained.

Next, the VP manager in the client terminal creates virtual perimeters (VPs) for providing a virtual interface between the client terminal and the network.

Next, the VP manager directly connects the virtual boundaries created in the previous step with the fake IP acquired by the client terminal in an end-to-end singnaling method, so that the client terminal attempts routing using the fake IP.

Through this process, in the present invention, even if the client terminal attempts to route to a fake IP that does not exist in the actual network, the VP manager can access the network through the virtual boundary. Accordingly, the present invention enables packet transmission between a terminal and a server without concealing node IP or port information about a network and providing it to the outside, and it is possible to block hacking attacks by external attackers through double virtualization.

In addition, the network concealment method according to an embodiment of the present invention may further include a process in which at least one or more nodes configured in the network periodically dynamically change IP and port information of each node through a node manager.

The above process is to prevent the attacker's access and chipping by dynamically changing the IP and port information of the network even after the client terminal maintains the connection with the server through the network.

In the above process, the node manager dynamically changes the IP and port information of each node at regular intervals, but randomly changes it so that IP does not collide between other nodes. With regard to ports, all ports in the network are closed and required by policy. Dynamically change only the port.

In addition, in the network concealment method of the present invention, the IP mapping unit in the node changes the fake IP of the packet transmitted from the client terminal to the recently dynamically changed node's own IP mapped thereto by referring to the previously stored mapping information. After the process, the node manager determines whether the packet transmitted from the client terminal is the node's own IP, and the node manager recognizes that the packet contains a fake IP by referring to the routing information of the preset virtual boundary. And transmitting the corresponding packet to an upper layer.

Meanwhile, in the present invention, the packet delivery process through the network concealment system described above can be implemented as a software program and recorded in a computer-readable recording medium. The recording medium includes all types of recording devices that store data that can be read by a computer system. In addition, the computer-readable recording medium may be distributed over a computer system connected through a network to store and execute a computer-readable program or code in a distributed manner.

For example, the recording medium may be a hard disk, flash memory, RAM, ROM, etc. as a built-in type of each playback device, or an optical disk such as a CD-R or CD-RW, a compact flash card, a smart media, a memory stick, or a multimedia card as an external type. have.

A program recorded on a computer-readable recording medium according to an embodiment of the present invention, when executed by a terminal, uses a fake IP that has no relation to the actual IP of the network when access to the desired server is attempted. A connection is attempted, and in response to the connection attempt, the fake IP is directly connected to the already created virtual boundaries in an end-to-end manner, and even if routing is attempted with the fake IP, a command to access the network through the virtual boundary is included. .

Also, a program for concealing the network of the present invention may be provided in the form of an application. In this case, the application server stores and manages the application for network concealment in the database, and transmits the application to the client terminal when requested by the client terminal. The client terminal downloads and installs the application and runs the application. When the application is executed, the client terminal operates as a network concealment device and connects to the network through a virtual interface using a fake IP.

In the above, the technical idea of the present invention has been described with the accompanying drawings, but this is illustrative of a preferred embodiment of the present invention and does not limit the present invention. Anyone of ordinary skill in the technical field to which the present invention pertains will be able to variously substitute, modify, and the like without departing from the scope of the technical idea of the present invention. Therefore, the embodiments disclosed in the specification of the present invention do not limit the present invention. The scope of the present invention should be interpreted by the following claims, and all technologies within the scope equivalent thereto should be interpreted as being included in the scope of the present invention.

100: client terminal
110: fake IP acquisition unit
120: VP Manager
200: virtual boundary
300: nodes
310: node manager
320: IP mapping unit

Claims (15)

A client terminal that attempts to connect to a desired server through a network by using a fake IP that has no relation to an actual IP of the network;
Virtual perimeters (VPs) are created between the client terminal and the network, and the generated virtual boundaries are directly connected to the fake IP obtained by the client terminal in an end-to-end signaling method, and the client A VP manager that allows a terminal to access the network through the virtual boundary even if the terminal attempts to route to the fake IP;
For a plurality of nodes configured in the network, the IP and port information of each node is periodically dynamically changed, implemented in each of the plurality of nodes, and the IP and port information of each node are dynamically changed at regular time intervals. A plurality of node managers for randomly changing IP collisions between different nodes; And
IP mapping implemented in the plurality of nodes and changing the fake IP of the packet transmitted from the client terminal through the virtual boundary to the corresponding node's own IP mapped to the mapping information by referring to previously stored mapping information Part; including,
Even after the client terminal maintains a connection with the server through the network, it dynamically changes the IP and port information of the network to prevent the attacker's access and chipping,
The virtual boundary provides a virtual network path that can be mapped in a one-to-one correspondence with a packet transmitted from a client terminal,
The IP of the corresponding node itself is an IP that has been dynamically changed recently through the node manager,
A plurality of node managers, each existing in the different nodes, do not communicate with each other and operate exclusively within the corresponding node,
The node manager,
The packet transmitted from the client terminal via the virtual boundary is determined whether it is the node's own IP, but it is determined in real time whether it is the recently dynamically changed IP, and the packet is a fake IP by referring to the preset routing information A network concealment system, characterized in that, in the case of an included packet, the node recognizes that it is a packet of itself and transmits the packet to an upper layer.
delete delete The method of claim 1,
And the node manager closes all ports of the network and dynamically changes only required ports according to a policy.
delete delete delete The method of claim 1,
The VP manager,
When a connection using the fake IP is attempted from the client terminal, the fake IP is transmitted to the virtual boundary in a redirect manner.
The method of claim 1,
The VP manager is a network concealment system, characterized in that implemented on the client terminal.
The method of claim 8,
The virtual boundary is,
Transmit the packet transmitted from the client terminal to the node of the network by a redirect method,
A network concealment system, characterized in that transmitting the packet received from the network node to a corresponding client terminal.
The method of claim 10,
The client terminal,
A network concealment system, characterized in that the transmission log transmitted to the fake IP through the virtual boundary is deleted so as not to leave a trace of related information accessible to the network.
The method of claim 1,
The fake IP is generated by a separate external server,
The client terminal and the server receive the fake IP from the external server at regular intervals, synchronize between the client terminal and the server in a session-type key exchange method, or use a pre-config method in advance. A network concealment system, characterized in that the fake IP is obtained by any one of a fixedly defined and used method.
As a method for connecting communication between a client terminal and a server through a network,
Obtaining, by the client terminal, a fake IP that has no relation to the actual IP of the network;
Attempting to connect through the acquired fake IP when the client terminal attempts to connect to a desired server through the network;
Generating, by a VP manager in the client terminal, virtual perimeters (VPs) for providing a virtual interface between the client terminal and the network; And
The VP manager connects the virtual boundaries created in the step with the fake IP acquired by the client terminal in an end-to-end signaling method, and the client terminal attempts to route to the virtual boundary using the fake IP. Step to do;
Periodically dynamically changing IP and port information of each node through a node manager implemented in each node by a plurality of nodes configured in the network, but randomly changing IP collisions between other nodes;
The IP mapping unit in the node refers to the previously stored mapping information, and the fake IP of the packet transmitted from the client terminal through the virtual boundary is mapped to the mapping information by referring to the previously stored mapping information, and the node has recently been dynamically changed. Changing to own IP; And
The node manager determines whether it is the node's own IP for the packet transmitted from the client terminal, and determines in real time whether it is the recently dynamically changed IP, and the packet contains a fake IP by referring to the preset routing information of the virtual boundary. In the case of a packet, the packet is double virtualized when connecting to the network, including the step of recognizing that it is the node's own packet and transferring the packet to an upper layer,
The virtual boundary provides a virtual network path that can be mapped in a one-to-one correspondence with a packet transmitted from a client terminal,
A network concealment method in which a plurality of node managers each existing in the different nodes do not communicate with each other and operate exclusively within a corresponding node.

delete delete

Images