WO2010121542A1

WO2010121542A1 - Home gateway-based anti-virus method and device thereof

Info

Publication number: WO2010121542A1
Application number: PCT/CN2010/071931
Authority: WO
Inventors: 缪伟; 王伟
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-04-22
Filing date: 2010-04-20
Publication date: 2010-10-28
Also published as: CN101527721A; CN101527721B

Abstract

The present invention provides a home gateway-based anti-virus method and device thereof, which are used for solving the technical problems, such as high requirements for users, complex installation and configuration and the like, of anti-virus and attack software for personal. In the present invention, the key information in a network access message from a user is intercepted by employing the resources of a home gateway; and a security server located in the Internet performs security verification for the key information to avoid that the user accesses a website with security risks, such as viruses and malicious attacks and the like, thereby improving the security of the home network, and meanwhile avoiding the trouble caused by directly installing firewall software on the user's personal computer (PC).

Description

Anti-virus method based on home gateway and related device

The present invention relates to the field of network security technologies, and in particular, to an anti-virus method and related device based on a home gateway. Background technique

With the development of the Internet, the explosive growth of content provided by the Internet can provide people with all kinds of information and become an indispensable factor in people's life, work and entertainment, and bring people help. However, all things have advantages and disadvantages. Internet knowledge is all-encompassing. Its healthy knowledge and timely information really help people and benefit people. But the Internet also has a large number of offensive websites, services with viruses, users. Once these sites are accessed, the attacker and virus programs will automatically infect the user terminal, causing an incalculable loss to the user.

In order to solve such problems, the industry has introduced various types of anti-virus software, installed in the user's

On the PC, as a security barrier for anti-virus. Because such software needs to be installed and configured, the user needs to have certain security protection knowledge and certain configuration of the PC, the software can work normally, and the anti-virus software works, there will be some interference to the normal business development of the user. . Summary of the invention

In view of the above, the main purpose of the present invention is to provide an anti-virus method and related device based on a home gateway, which is used to solve technical problems such as high requirements for users and complicated installation and installation of a stand-alone virus and anti-attack software, in order to achieve the above objectives. The technical solution of the present invention is implemented as follows: A home gateway-based antivirus method, including:

The home gateway captures a network access request message sent by the user terminal, and extracts key information therefrom; the home gateway interacts with a security server located in the Internet, according to the key The information is verified whether there is a security risk in this network access request. If there is a security risk, the network access request is rejected; otherwise, the network access is released.

Further, the key information is: a Uniform Resource Locator (URL) and/or Internet Protocol (IP) address information; the security server stores a network related to the key information for determining user terminal access. Whether the site is secure or not.

Further, the steps for verifying whether the network access request has a security risk are specifically:

Al, the home gateway first analyzes the key information, determines whether a security check is needed, and if necessary, performs step A2; otherwise, the current network access request is released;

A2: The home gateway sends the key information to the security server, and the security server determines whether the server site corresponding to the key information has a security risk, and feeds the determination result to the home gateway.

Further, in step A1, the step of the home gateway determining whether the security check needs to be performed is specifically:

Al1, the home gateway determines whether there is a historical security check record for the key information locally, if yes, step A12 is performed; otherwise, step A2 is performed;

A12. The network access request with the same key information is processed according to the historical security check record.

Another object of the present invention is to provide an anti-virus system based on a home gateway. To achieve the above object, the technical solution of the present invention is implemented as follows:

An anti-virus system based on a home gateway, including:

a user terminal, configured to initiate a network access request by using a home gateway;

a home gateway, configured to capture a message of the network access request, extract key information therefrom, and send the key information to a security server located in the Internet; perform network access control on the user terminal according to a security check result of the security server ;

a security server, configured to perform security check on the key information, and reverse the security check result Feed to the home gateway.

Further, the key information is: a uniform resource locator and/or IP address information; and the security server stores security verification information related to the key information for determining whether the network site accessed by the user terminal is secure.

Further, after extracting the key information, the home gateway first determines whether there is a historical security check record for the key information locally, and if yes, processes according to the historical security check record; otherwise, the key information is sent. Perform security checks on secure servers located on the Internet.

Another object of the present invention is to provide a home gateway. To achieve the above object, the technical solution of the present invention is implemented as follows:

A home gateway, including:

a message capture module, configured to capture a network access message, extract key information therefrom, and send the key information to the message analysis module;

a message analysis module, configured to analyze key information and control network access of the user terminal according to the security check result of the security server;

The client interaction module is configured to exchange information with the user terminal, notify the user terminal and perform a blocking operation when the packet analysis module feedback has a security risk;

Server interaction module: Used for information interaction between the message analysis module and a secure server located in the Internet.

Further, the packet analysis module includes:

The historical analysis judging module is configured to determine whether there is a historical security check record for the key information locally, and if yes, process according to the historical security check record; Pre-analysis and judgment module processing;

The current analysis and judgment module is configured to transmit the key information to the security server, and process according to the security check result of the security server.

The invention utilizes the resources of the home gateway, and intercepts the key information of the content accessed by the user and queries the security server to prevent the user from accessing the website with viruses and malicious attacks, thereby improving the security of the home network and avoiding the user PC. The trouble of installing the firewall software directly.

The invention fully utilizes the resources of the home gateway to realize the firewall barrier of the home network, and the terminal devices connected to the home gateway are automatically protected, unlike the usual anti-virus software, all user terminals are required to be installed, thereby reducing the user. The burden. DRAWINGS

1 is a structural diagram of an anti-virus system based on a home gateway according to the present invention;

2 is a diagram showing an internal module relationship of a home gateway according to the present invention;

FIG. 3 is a flowchart of implementing an anti-virus based on a home gateway according to the present invention. detailed description

The present invention will be further described in detail below with reference to the accompanying drawings.

1 is a structural diagram of a home gateway-based antivirus system according to the present invention, which includes a security server, a home gateway, and a user terminal; the main improvement of the present invention is a home gateway and a security server, and a user terminal connected under the home gateway, such as a personal computer. (Personal Computer, PC), accessing the Internet through the home gateway, the home gateway checks the key information in the text by checking the network request message sent by the PC, such as Uniform Resource Locator (URL) and / Internet Protocol ( Internet Protocol, IP address, etc., interact with the security server, and the security server determines whether the user's access is secure or risky. Users access dangerous network sites (WEB servers) for anti-virus and anti-attack purposes. The security server stores security verification information related to the key information for determining whether the network site that the user terminal wants to access is secure. Security servers can be deployed in a variety of key locations on the Internet to allow users anywhere on the Internet to communicate quickly through the home gateway. At the same time, they need to update the security verification information in the server in time to keep up with the ever-changing Internet. match.

The home gateway is configured to capture a packet of a network access request sent by the user terminal, extract key information therefrom, and send the key information to the security server; perform network access control on the user terminal according to the security check result of the security server; Perform a security check and feed back the security check results to the home gateway.

2 is an internal module relationship diagram of a home gateway according to the present invention. The home gateway includes: a message capture module, a message analysis module, a client interaction module, and a server interaction module.

The packet capture module is configured to capture the packet forwarded by the home gateway, extract key information from the packet, and send the key information to the packet analysis module.

The message analysis module is configured to analyze key information and control network access of the user terminal according to the security check result of the security server; the message analysis module further includes a historical analysis judgment module and a current analysis and judgment module, and the historical analysis judgment module is used to determine the local Whether there is a historical security check record for the key information, if yes, processing according to the historical security check record; otherwise, notifying the current analysis and judgment module processing; the current analysis and judgment module is configured to transmit the key information to the security server, and Processed according to the security check result of the security server.

The client interaction module is used for information interaction with the user terminal, and notifies the user terminal and performs a blocking operation when the packet analysis module reports a security risk;

The server interaction module is used for information interaction between the message analysis module and a secure server located in the Internet.

FIG. 3 is a flowchart of an anti-virus implementation based on a home gateway according to the present invention. In this embodiment, a user is used. The process of accessing the Internet server through the Http protocol is taken as an example to describe the implementation process of the home gateway of the present invention. The specific process is as follows:

Step 301: The user terminal starts Http access, and sends an Http protocol packet to the packet capture module.

Step 302: The packet capture module captures the packet, extracts key information, and sends the key information to the packet analysis module.

In this embodiment, the URL information of the Http message is used as the key information, and the key information may also be an IP address or the like;

Step 303: The message analysis module determines whether the key information needs a security server to perform security check on the key information.

The home gateway first determines whether there is a historical security check record for the key information in the local area. If yes, the local security check records the judgment of whether the Http message has a security risk according to the historical security check; if not, the security server needs the The key information is verified whether there is a security risk. For example, on the same day, for the same network address or the server site, the subsequent access can be processed according to the historical security check record. If the result of the first feedback to the security server is no security risk, the packet is sent. The analysis module stores key information (such as IP address and/or URL address, etc.) and corresponding security check record results locally. When accessing the same address for the second time, the locally saved historical judgment of the same address is directly used. The results are processed and there is no need to send critical information to the secure server located in the Internet for re-authentication.

Step 304: If the security check process is required, the key information is transmitted to the server interaction module;

Step 305: The server interaction module sends a security check request to the security server. Step 306: The security server analyzes or performs a verification query on the key information, and determines whether the network access site or address corresponding to the key information has a security risk such as a virus or a hacker attack. And feedback the security check result to the server interaction module;

Step 307: The server interaction module feeds back the key information check result to the message analysis module. Step 308: The message analysis module determines, according to the feedback security check result, whether the user can access the web server or network address corresponding to the key information, and if so, Forwarding the protocol packet of the user's Http, if not, notifying the client interaction module to perform alarm processing, or prompting the user to select whether to continue, or performing a blocking operation;

Step 309: After receiving the command of the packet analysis module, the client interaction module pushes the Http message and displays it on the user's browser. The site visited this time has a virus or malicious attack code, please do not continue;

The above process exemplifies the entire process of implementing the home gateway anti-virus according to the present invention. Since the present invention does not require the user terminal to install the firewall or the anti-virus software, the software does not need to be configured, and the centralized authentication of the key information by the security server can be realized. In the WAN, the network sites with security risks are shielded and blocked, which is more real-time. Therefore, the network maintenance cost of the home gateway users is greatly reduced, and the network security is improved.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

Claim

An anti-virus method based on a home gateway, the method comprising: the home gateway capturing a network access request message sent by the user terminal, and extracting key information therefrom; the home gateway is performed with a security server located in the Internet Interacting, verifying whether the network access request has a security risk according to the key information, and if there is a security risk, rejecting the network access request; otherwise, releasing the network access.

2. The method according to claim 1, wherein the key information is: a uniform resource locator (URL) and/or an internet protocol (IP) address information; the security server stores and the key Information-related security verification information for determining whether a network site accessed by a user terminal is secure.

The method according to claim 2, wherein the step of verifying whether the network access request has a security risk is specifically:

The method according to claim 3, wherein in step A1, the step of determining, by the home gateway, whether a security check is required is:

5. A home gateway-based antivirus system, characterized in that the system comprises: a user terminal, configured to initiate a network access request by using a home gateway;

The security server is configured to perform security check on the key information, and feedback the security check result to the home gateway.

The system according to claim 5, wherein the key information is: a uniform resource locator and/or IP address information; the security server stores a user terminal associated with the key information for determining Whether the visited network site is secure and secure.

The system according to claim 6, wherein after extracting the key information, the home gateway first determines whether there is a historical security check record for the key information locally, and if yes, according to historical security Check the records for processing; otherwise the critical information is sent to a secure server located on the Internet for security checks.

8. A home gateway, comprising:

The home gateway according to claim 8, wherein the key information is: a uniform resource locator and/or IP address information; and the security server stores, for determining the user, related to the key information. Whether the network site accessed by the terminal is secure and secure.

The home gateway according to claim 9, wherein the message analysis module comprises:

The historical analysis judging module is configured to determine whether there is a historical security check record for the key information locally, and if yes, process according to the historical security check record; otherwise, notify the current analysis and judgment module to process;