WO2015176445A1 - 移动终端预设联网地址防火墙隔离应用系统 - Google Patents

移动终端预设联网地址防火墙隔离应用系统 Download PDF

Info

Publication number
WO2015176445A1
WO2015176445A1 PCT/CN2014/087303 CN2014087303W WO2015176445A1 WO 2015176445 A1 WO2015176445 A1 WO 2015176445A1 CN 2014087303 W CN2014087303 W CN 2014087303W WO 2015176445 A1 WO2015176445 A1 WO 2015176445A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
network
firewall
mobile terminal
data
Prior art date
Application number
PCT/CN2014/087303
Other languages
English (en)
French (fr)
Inventor
朱雄关
刘晓岩
Original Assignee
成都达信通通讯设备有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 成都达信通通讯设备有限公司 filed Critical 成都达信通通讯设备有限公司
Publication of WO2015176445A1 publication Critical patent/WO2015176445A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications

Definitions

  • the invention relates to a mobile terminal operating system and a system for providing data isolation for different networking addresses in a operating system by using a firewall and a method for creating the same.
  • the means of hacking private service is nothing more than an intrusion server and a Distributed Denial of Service (DDOS) attack.
  • DDOS Distributed Denial of Service
  • the success rate of the former is not high.
  • Game Master, GM Game Master, GM
  • Game Master, GM Game Master, GM
  • the attack power of DDOS is incredibly large, which can make the players in the game instantly drop the line collectively, or even fail to log in.
  • DDOS distributed denial of service attack
  • the so-called DDOS known as the "distributed denial of service attack”
  • the hacker controls a large number of broiler groups to carry out packet flood attacks on a website, causing network bandwidth congestion, thereby achieving the effect of the attack.
  • DDOS's attack power 100 broilers can kill personal websites, 1000 broilers can kill private clothes and medium-sized websites, and 10,000 broilers can kill local portals. It can be seen that if you want to attack private service, you only need a few hundred broilers to complete.
  • An insecure wireless network may cause loss of service or Used to attack other networks.
  • APN Access Point Name
  • IP Internet Protocol
  • GGSN Gateway GPRS Support Node
  • the GPRS Service Support Node queries the specific domain name system DNS server for the GGSN IP address corresponding to the APN according to the APN to determine the GGSN that the user should access; the APN serves as the service domain.
  • the GGSN sends the traffic of the user to different service domains according to different APNs, and the different service domains correspond to different service bearer networking modes, user identity acquisition modes, and charging modes.
  • the service support node SGSN mainly completes the routing and forwarding, mobility management, session management, logical link management, authentication and encryption, and CDR of packet data packets.
  • the SGSN is a GPRS service support node, which provides a connection with the wireless packet controller PCU through the Gb interface, performs mobile data management, such as user identification, encryption, compression, etc.; connects to the HLR through the Gr interface, and accesses the user database. And access control; it is also connected to the GGSN through the Gn interface, providing functions such as transmission path and protocol conversion between the IP data packet and the wireless unit; the SGSN can also provide a Gs interface connection with the MSC and a Gd interface with the SMSC. Connections to support the collaborative work of data services and circuit services and the ability to send and receive text messages.
  • the SGSN cooperates with the GGSN to jointly assume the PS function of TD-SCDMA (WCDMA).
  • WCDMA TD-SCDMA
  • it is a basic network element of the GPRS network, it is connected to the BSS through the Gb interface. Its main role is to perform mobility management for the MS of the SGSN service area and forward the input/output IP packets, which is similar to the VMSC in the GSM circuit network.
  • the SGSN also integrates a function similar to the VLR in the GSM network.
  • the SGSN stores user information and location information related to the packet.
  • the SGSN When the SGSN acts as the PS domain function node of the TD-SCDMA (WCDMA) core network, it passes the Iu_PS interface with the UTRAN. Connected, mainly provides routing and forwarding, mobility management, session management, authentication and encryption of the PS domain.
  • GGSN9811 mainly mentions two APNs, CMWAP and CMNET, which are the earliest provided by China Mobile and are currently the most widely used by users:
  • CMWAP and CMNET are two GPRS access channels divided by China Mobile.
  • the former is set up for mobile WAP access, while the latter is mainly used for PC, laptop, PDA and other GPRS Internet services.
  • CMWAP APN is mainly for HTTP-based services, such as WAP Internet browsing, MMS, and so on.
  • HTTP-based services such as WAP Internet browsing, MMS, and so on.
  • MMS Internet browsing
  • WAP domain of the wireless application protocol has gradually evolved into a default service for most self-operated services and cooperative services through upgrading and configuration. Domain, providing users with MMS, PIM, streaming media, universal download, newsletter, music player, games and other services.
  • the CMWAP APN uses the WAP gateway as a proxy node for HTTP access, and provides some auxiliary functions for users, such as free mobile phone number, content conversion, and adaptive pre-judgment.
  • CMNET is an APN set up for open Internet access services. Users can access the Internet using any protocol without any control and restriction policies, but also do not provide other accessibility features.
  • the mobile terminal accesses the GGSN through the access SGSN, and the service data stream is translated into the Internet through the NAT corresponding to the firewall of the GGSN.
  • a firewall is a combination of components that are placed between different networks, such as trusted intranets and untrusted public networks, or network security domains. It can protect the network by monitoring, limiting, and changing the data flow across the firewall, shielding the information, structure, and health of the network as much as possible from the outside.
  • the BYOD management function provided by the device is generally used to block the unknown mobile terminal, and the firewall is deployed as a gateway device on the Internet outlet, and the existing mobile terminal does not provide a corresponding firewall.
  • the firewall is a splitter, a limiter, and an analyzer that effectively monitors any activity between the intranet and the Internet, ensuring the security of the internal network.
  • Firewalls are generally divided into packet filtering, application-level gateways, and proxy servers.
  • Packet Filtering technology selects packets at the network layer. The basis for selection is the filtering logic set in the system. It is called the access control list. (Access Control Table). Determine whether the packet is allowed to pass by checking the source address, destination address, port number used, protocol status, etc. of each packet in the data stream, or a combination thereof.
  • Packet packet filtering firewall has two disadvantages: one is that if the illegal access breaks through the firewall, the software and configuration vulnerability on the host can be attacked; the second is that the source address, destination address and IP port number of the data packet are in the data packet. Head, it is very likely to be eavesdropped or faked.
  • Application Level Gateways establish protocol filtering and forwarding functions on the network application layer. It uses the specified data filtering logic for a specific network application service protocol, and performs the necessary analysis, registration, and statistics on the data packet to form a report while filtering.
  • the actual application gateway is usually installed on a dedicated workstation system.
  • a common feature of packet filtering and application gateway firewalls is that they rely solely on specific logic to determine whether packets are allowed to pass. Once the logic is met, the computer system inside and outside the firewall establishes direct contact, and the user outside the firewall may directly understand the network structure and running status of the firewall.
  • Proxy service is also called a link-level gateway or a Transmission Control Protocol (TCP) channel (Circuit Level Gateways or TCP Tunnels). Some people also attribute it to an application-level gateway. It is a firewall technology introduced for the shortcomings of packet filtering and application gateway technology. It is characterized by dividing all network communication links across the firewall into two segments. The "link" of the application layer between the computer system inside and outside the firewall is realized by the "link” on the two termination proxy servers. The network link of the external computer can only reach the proxy server, thereby functioning to isolate the computer system inside and outside the firewall.
  • TCP Transmission Control Protocol
  • the LAN of the headquarters can treat the LAN of each branch as an insecure system (via the public network ChinaPac, ChinaDDN, Frame Relay, etc.) when the LAN of the headquarters is connected to each branch.
  • Firewall isolation is used, and VPN is used to form a virtual private network; the LAN of the headquarters and the LAN of the branch office are connected through the Internet, and each need to install a firewall, and use the NetScreen VPN to form a virtual private network.
  • VPDN is the abbreviation of VirtualPrivateDialupNetwork. It is based on the virtual private dial-up network service of dial-up users. It can establish a secure virtual private network by using the bearer function of IP and other networks, combined with the corresponding authentication and authorization mechanism.
  • the VPDN network structure consists of a central office or a central end and a client system.
  • the specific implementation of VPDN is tunnel technology, which encapsulates the data of the enterprise network in the tunnel for transmission.
  • the basic process of tunneling technology is in the source LAN
  • the interface of the public network encapsulates the data as a load.
  • the data In a data format that can be transmitted on the public network, the data is decapsulated at the interface between the destination local area network and the public network, and the load is taken out.
  • the logical path that an encapsulated packet passes as it passes over the Internet is called a "tunnel.”
  • communication protocols are at the heart of the assurance.
  • the VPDN business is primarily for business and government administration. After the enterprise applies for the service, it only needs to access its intranet through a dedicated line to the Internet. Users can dial VPDN service anywhere in the country to enter the virtual private network and securely access the information resources they need. .
  • the user can conveniently and flexibly perform operations such as opening an account, canceling an account, and setting user rights for the dial-up user.
  • the difference between the mobile network VPDN and the ordinary VPDN is mainly the concept of wireless Internet access.
  • the wireless data network of the mobile network is used to construct a virtual private network for wireless mobile users, so that the user can realize the special use through the wireless data network in any place.
  • the connection of the line is designed to guarantee information and system security, there are three major problems in the use of the VPDN channel on mobile terminals:
  • connection of the VPDN channel is a link connection using a dialer, that is, a VPN connection protocol is used on the data connection channel, and the essence is still a public code, which does not have the function of data isolation and encryption, and cannot stop the virus or The invasion of hackers.
  • the real security method of the VPDN channel is to use the MAC address binding method, but it is very troublesome to query the MAC address of the mobile phone, and the general user is very inconvenient to use.
  • the VPDN dialer generally does not have an application-oriented interface, and the application cannot implement the conversion of the normal networking channel and the VPDN channel by calling methods.
  • the current mobile terminal operating system often manages the usage rights of the application through the rights management to achieve the purpose of security protection.
  • the process of implementing the networking in the mobile terminal there is no firewall policy, and only the mobile terminal and the network are realized. connection.
  • the function of the rights management of the mobile terminal operating system is very unknown.
  • Many Android mobile phone users will prompt to obtain root privileges when deleting system software or using some tools. Root is the nerve center of the phone, which can access and modify almost all files on the phone. When a hacker invades a system, it must raise the privilege to the root privilege and add the illegal account to the root user group.
  • the object of the present invention is to provide a firewall isolation for the operating system kernel, which can provide different security protection policies for data networking of a preset network address on the operating system of the mobile terminal.
  • Application systems to meet the needs of different applications in different networked addresses to implement different security protection strategies in data networking.
  • a mobile terminal preset network address firewall isolation application system comprising: a firewall isolation module embedded in the operating system kernel of the mobile terminal and an application layer for transmitting data through the data channel
  • the utility model is characterized in that: the firewall isolation module embeds an IP data analysis module, and the IP data analysis module analyzes all the networked IP address data, and flows all externally according to the preset networked IP address and the specified IP address collection module. The data flow of the network is monitored.
  • the firewall isolation module starts the filtering rule, and all the networking other than the preset designated network IP address is IP address packet shielding, prohibiting access to network IPs not specified by the preset Other IP addresses outside the address allow only the preset designated network IP address data to access various networks.
  • the present invention has the following beneficial effects:
  • the invention embeds a firewall isolation system in a kernel of a mobile terminal operating system, presets an IP address to be protected, and does not provide an interface for modifying a firewall rule, so that a virus or a hacker cannot modify the firewall rule, thereby ensuring a specified IP address. Isolation protection of the address.
  • firewall isolation module embedded in the operating system kernel of the mobile terminal and the IP data analysis module built in the firewall module occupy less system resources and simple rules, and will not affect the original operating efficiency of the mobile terminal operating system.
  • the invention combines the use of the virtual private dial-up network VPDN channel to form a data isolation application form, which greatly improves the security performance of the VPDN network.
  • the IP data analysis module of the present invention includes a preset designated network IP address, and the IP data analysis module monitors all data flows to the external network, and automatically protects the specified or preset IP address, and the application software or the user does not need to Through manual operation, the convenience of the mobile terminal operating system in the security protection mode is greatly improved.
  • the firewall After the IP data analysis module of the present invention detects that the IP data packet contains the preset designated network IP address, the firewall starts the filtering rule, and blocks all IP data packets except the non-designated network address, and prohibits access to the non-designated network address. Other IP addresses. Different firewall isolation policies can be set for different network IP addresses, so that users can use different security protection policies when using different IP addresses. The invention effectively prevents the leakage of accounts or information when accessing a specific target IP address through the network protection of the mobile terminal and the management of the firewall.
  • FIG. 1 is a schematic structural diagram of a firewall isolation system model of a mobile terminal according to the present invention for a preset or designated network address.
  • FIG. 2 is a firewall isolation of a mobile terminal of the present invention for a plurality of preset network addresses and/or address segments Schematic diagram of the system model.
  • FIG. 3 is a schematic diagram of a firewall isolation system model for a mobile terminal of the present invention for a specified VPDN network address.
  • the mobile terminal is configured to implement a firewall system model for a preset or specified network address, and mainly includes a firewall module embedded in the operating system kernel of the mobile terminal and an IP data analysis module in the firewall module.
  • the IP data analysis module includes a preset designated network IP address, and the IP data analysis module monitors all data flows to the external network. After detecting that the IP data packet contains the preset designated network IP address, the firewall starts the filtering rule. All IP packets outside the specified network address are masked, and access to other IP addresses other than the specified network address is prohibited.
  • the firewall closes the filtering rule and allows data to access various networks.
  • the manner in which the mobile terminal firewall starts the filtering rule includes the following two modes:
  • the IP data analysis module After detecting that the IP data packet includes the preset designated network IP address, the IP data analysis module detects the type of the IP data packet, and if it is the transmission control protocol TCP, detects whether the TCP protocol connection is established, and if the TCP connection is established, the firewall starts. Filter rules.
  • the firewall closes the filtering rule and allows data to access all networks.
  • the UDP protocol is directly at the top of the Internet Protocol IP protocol.
  • the IP data analysis module detects the type of the IP data packet after detecting that the IP data packet includes the preset designated network IP address. If the UDP protocol is used, the firewall starts the filtering rule.
  • UDP is a connectionless protocol. Before the data is transmitted, the source and the terminal do not establish a connection. When it wants to transmit, it simply grabs the data from the application and throws it on the network as quickly as possible. On the sending end, the speed at which UDP transfers data is only the speed at which the application generates data; at the receiving end, UDP puts each message segment in a queue, and the application reads a message segment from the queue each time.
  • the UDP protocol uses the checksum in the header to ensure data security. The check value is first calculated by the data sender through a special algorithm, and after being passed to the receiver, it needs to be recalculated.
  • the firewall closes the filtering rule and allows data to access all networks.
  • the firewall isolation module embedded in the operating system kernel is compiled into a part of the system kernel by the system, and the system module loading interface is eliminated, and the external interface is not provided, so that the firewall setting cannot be modified by the application layer or other means.
  • the illustrated IP address set module includes a preset designated networked IP address, a designated IP address 1, a designated IP address 2, a designated IP address 3, a set of a plurality of designated IP addresses, and/or a segment of an IP address.
  • the firewall module embedded with the operating system kernel can set different filtering rules according to different preset designated networking IP addresses. Different filtering rules exist at the same time, and work for different specified IP networking addresses. Filter rules include the following two forms:
  • the IP data analysis module turns off the time setting of the firewall filtering rule, and can set the closing time of the filtering rule of different specified network addresses to different time lengths according to the specific situation of the network delay or the system response time in the actual application. .
  • the mobile terminal when the preset designated network address is changed to the virtual private dial-up network VPDN networking address, the mobile terminal can ensure that the mobile terminal and the VPDN private network are isolated from the Internet after the VPDN network connection is successful. In the network, the VPDN private network can be avoided, and the terminal does not have the security risk of data isolation, thus ensuring the security of the VPDN data network.
  • the mobile terminal includes a mobile phone, a tablet computer, a wireless network card or other mobile device.
  • the program may be stored in a mobile terminal readable storage medium, optionally
  • Each module/unit of the terminal in the above embodiment may be implemented in the form of hardware or in the form of a software function module.
  • the present invention is not limited to the combination of any specific form of hardware and software, and is intended to be within the scope of the present invention.

Landscapes

  • Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明提出的一种移动终端预设联网地址防火墙隔离应用系统，包括：内嵌于移动终端操作系统内核中的防火墙隔离模块和通过数据通道传输数据的应用层。防火墙隔离模块内嵌IP数据分析模块，IP数据分析模块对所有联网IP地址数据进行分析，根据内含预设指定的联网IP地址和指定IP地址集合模块，对所有流向外部网络的数据流进行监控，当检测到联网IP地址数据包内含有预设指定的联网IP地址后，防火墙隔离模块启动过滤规则，将非指定联网地址外的所有联网IP地址数据包屏蔽，禁止访问非指定的联网地址外的其它IP地址，只允许预设指定联网IP地址数据访问各种网络。有效杜绝了访问特定目标IP地址连接互联网，账户或信息的泄露。

Description

移动终端预设联网地址防火墙隔离应用系统
本申请要求于2014年05月21日提交中国专利局、申请号为201410214696.8、发明名称为“移动终端预设联网地址防火墙隔离应用系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及移动终端操作系统和在操作系统中采用防火墙针对不同联网地址提供数据隔离进行联网的系统及其创建方法。
背景技术
随着移动互联网的高速发展，各类移动应用层出不穷，黑客入侵、钓鱼网站等各种非法手段无时无刻不在侵害互联网的安全，各种预装软件、病毒打包等威胁手机网络安全的问题日益突出，并逐渐形成黑色产业链。互联网应用系统的安全，日益成为人们关注的焦点。棱镜门之后，人们发现，在拥有强大技术实力的美国政府面前，任何互联网公司包括当前拥有互联网技术最顶尖科技的苹果和谷歌公司，只要在互联网上建立的信息系统，即使拥有各类安全防护措施，都无法避免信息被窃取的安全漏洞。玩过游戏私服的朋友都知道，私服是极易受到攻击的，一旦受到攻击，轻则游戏变卡，重则彻底无法登录。那么黑客对私服发起了何种攻击，有什么办法可以让私服服务器彻底崩溃呢？黑客攻击私服的手段，不外乎入侵服务器和分布式拒绝服务(Distributed Denial of Service，DDOS)攻击。前者的成功率不高，即使入侵成功，最多也就得到游戏管理者(Game Master，GM)账号，在游戏里乱改一通。但是后者就完全不一样了，DDOS的攻击威力大得惊人，可以让游戏中的玩家瞬间集体掉线，甚至无法登录，如果黑客对某个私服有深仇大恨，甚至可以让私服永久无法上线，造成毁灭性打击。所谓的DDOS，全称为“分布式拒绝服务攻击”，即黑客控制数量庞大的肉鸡群对某网站进行数据包洪水攻击，造成网络带宽堵塞，从而实现攻击的效果。那么DDOS的攻击力有多大？可以这样说，100只肉鸡可以秒杀个人网站，1000只肉鸡可以秒杀私服和中型网站，10000只肉鸡可以秒杀地方门户网站。可见，要攻击私服的话只需几百台肉鸡就可以完成。一个不安全的无线网络可能造成服务丢失或是 被利用来对其他网络发起攻击。
在传统技术领域，物理隔离是保障内部网络安全最重要最有效的举措，无论银行信息系统还是政府信息系统都是使用与互联网物理隔离的内部网络来保障信息安全的。使用与互联网物理隔离的内部网络由于杜绝了互联网的联网通道，任何黑客都无法进行入侵。对于普通用户而言，接入点名称APN(Access Point Name)只是为了上网而在手机终端上预先配置或手工设定的一组参数。而对于移动网络来说，APN是用来实现用户互联网协议(Internet Protocol，IP)报文路由至相应网关GPRS支持节点(Gateway GPRS SupportNode，GGSN)及外部网络的必不可少的标识，其作用具体包括：APN作为路由标识：GPRS服务支持节点(Serving GPRS Support Node，SGSN)根据APN，向特定域名系统DNS服务器查询该APN对应的GGSN IP地址，以确定用户应接入的GGSN；APN作为业务域标识：GGSN根据APN不同，将用户的业务流送到不同的业务域，而不同的业务域则对应了不同的业务承载组网方式、用户标识获取方式、计费模式等。服务支持节点SGSN作为GPRS/TD-SCDMA(WCDMA)核心网分组域设备重要组成部分，主要完成分组数据包的路由转发、移动性管理、会话管理、逻辑链路管理、鉴权和加密、话单产生和输出等功能。SGSN即GPRS服务支持节点，它通过Gb接口提供与无线分组控制器PCU的连接，进行移动数据的管理，如用户身份识别，加密，压缩等功能；通过Gr接口与HLR相连，进行用户数据库的访问及接入控制；它还通过Gn接口与GGSN相连，提供IP数据包到无线单元之间的传输通路和协议变换等功能；SGSN还可以提供与MSC的Gs接口连接以及与SMSC之间的Gd接口连接，用以支持数据业务和电路业务的协同工作和短信收发等功能。SGSN与GGSN配合，共同承担TD-SCDMA(WCDMA)的PS功能。当作为GPRS网络的一个基本的组成网元时，通过Gb接口和BSS相连。其主要的作用就是为本SGSN服务区域的MS进行移动性管理，并转发输入/输出的IP分组，其地位类似于GSM电路网中的VMSC。此外，SGSN中还集成了类似于GSM网络中VLR的功能，当用户处于GPRS Attach(GPRS附着)状态时，SGSN中存储了同分组相关的用户信息和位置信息。当SGSN作为TD-SCDMA(WCDMA)核心网的PS域功能节点，它通过Iu_PS接口与UTRAN 相连，主要提供PS域的路由转发、移动性管理、会话管理、鉴权和加密等功能。GGSN9811主要提以中国移动最早提供、也是目前用户使用最广的两个APN——CMWAP、CMNET为例：
1)CMWAP APN
CMWAP和CMNET是中国移动人为划分的两个GPRS接入通道。前者是为手机WAP上网而设立的，后者则主要是为PC、笔记本电脑、PDA等利用GPRS上网服务。CMWAP APN在设计之初主要面向基于HTTP协议的业务，如WAP上网浏览，彩信等。随着数据业务的不断发展，为了支持逐渐引入的非超文本传输协议HTTP的业务，无线应用协议WAP域通过进行升级改造和配置，逐渐演变为面向绝大多数自营业务和合作业务的默认业务域，面向用户提供彩信、PIM、流媒体、通用下载、快讯、音乐随身听、游戏等业务。CMWAP APN使用了WAP网关作为HTTP访问的代理节点，同时可面向用户提供一些辅助功能，例如免输手机号码、内容转换、适配预判等。
2)CMNET APN
CMNET是为了开展开放的互联网接入服务设置的APN，用户可使用任何协议访问互联网，没有任何控制和限制策略，但同时也不提供其它辅助功能。使用CMNET APN时，移动终端通过接入地SGSN就近接入GGSN，业务数据流通过GGSN对应的防火墙进行NAT地址转换后接入互联网。
防火墙是设置在不同网络(如可信任的企业内部网和不可信的公共网)或网络安全域之间的一系列部件的组合。它可通过监测、限制、更改跨越防火墙的数据流，尽可能地对外部屏蔽网络内部的信息、结构和运行状况，以此来实现网络的安全保护。现有技术防火墙，一般是通过设备提供的BYOD管理功能封堵来历不明的移动终端，将防火墙作为网关设备部署在互联网出口，而现有移动终端内部并未提供相应的防火墙。在逻辑上，防火墙是一个分离器，一个限制器，也是一个分析器，有效地监控了内部网和Internet之间的任何活动，保证了内部网络的安全。防火墙总体上分为包过滤、应用级网关和代理服务器等几大类型。数据包过滤(Packet Filtering)技术是在网络层对数据包进行选择，选择的依据是系统内设置的过滤逻辑，被称为访问控制表 (Access Control Table)。通过检查数据流中每个数据包的源地址、目的地址、所用的端口号、协议状态等因素，或它们的组合来确定是否允许该数据包通过。数据包过滤防火墙的缺点有二：一是非法访问一旦突破防火墙，即可对主机上的软件和配置漏洞进行攻击；二是数据包的源地址、目的地址以及IP的端口号都在数据包的头部，很有可能被窃听或假冒。应用级网关(ApplicationLevel Gateways)是在网络应用层上建立协议过滤和转发功能。它针对特定的网络应用服务协议使用指定的数据过滤逻辑，并在过滤的同时，对数据包进行必要的分析、登记和统计，形成报告。实际中的应用网关通常安装在专用工作站系统上。数据包过滤和应用网关防火墙有一个共同的特点，就是它们仅仅依靠特定的逻辑判定是否允许数据包通过。一旦满足逻辑，则防火墙内外的计算机系统建立直接联系，防火墙外部的用户便有可能直接了解防火墙内部的网络结构和运行状态。
代理服务(Proxy Service)也称链路级网关或传输控制协议(Transmission Control Protocol，TCP)通道(Circuit Level Gateways or TCP Tunnels)，也有人将它归于应用级网关一类。它是针对数据包过滤和应用网关技术存在的缺点而引入的防火墙技术，其特点是将所有跨越防火墙的网络通信链路分为两段。防火墙内外计算机系统间应用层的"链接"，由两个终止代理服务器上的"链接"来实现，外部计算机的网络链路只能到达代理服务器，从而起到了隔离防火墙内外计算机系统的作用。在广域网系统中，由于安全的需要，总部的局域网可以将各分支机构的局域网看成不安全的系统，(通过公网ChinaPac，ChinaDDN，Frame Relay等连接)在总部的局域网和各分支机构连接时采用防火墙隔离，并利用VPN构成虚拟专网；总部的局域网和分支机构的局域网是通过Internet连接，需要各自安装防火墙，并利用NetScreen的VPN组成虚拟专网。
VPDN是虚拟拨号专用网络(VirtualPrivateDialupNetwork)的缩写，它基于拨号用户的虚拟专用拨号网业务，利用IP和其它网络的承载功能，结合相应的认证和授权机制，可以建立安全的虚拟专用网络。VPDN网络结构由局端或称为中心端和客户系统组成。VPDN的具体实现是采用隧道技术，即将企业网的数据封装在隧道中进行传输。隧道技术的基本过程是在源局域网与 公网的接口处将数据作为负载封装，在一种可以在公网上传输的数据格式中，在目的局域网与公网的接口处将数据解封装，取出负载。被封装的数据包在互联网上传递时所经过的逻辑路径被称为“隧道”。要使数据顺利地被封装、传送及解封装，通信协议是保证的核心。VPDN业务主要面向企业以及政府管理部门。企业申请该业务后，只需要将其企业内部网通过一条专线接入到互联网络，用户即可在国内任何地方拨号使用VPDN业务进入到该虚拟专用网中，安全地访问自己所需要的信息资源。用户可以方便灵活地自行对所属拨号用户进行开户、销户、设置用户权限等操作。移动网络VPDN与普通的VPDN不同之处主要体现的是无线上网的概念，利用移动网络的无线数据网络为无线移动用户构建虚拟专用网络，从而使用户在任何地点都能够通过无线数据网络，实现专用线路的连接。无线VPDN网络虽然设计上希望可以保障信息与系统安全，但是在移动终端上VPDN通道的使用存在三大问题：
首先，VPDN通道的连接是使用一段拨号程序进行链路连接，即在数据连接通道上使用了VPN的连接协议，其本质还是一段公开的代码，不具备数据隔离和加密的作用，不能阻止病毒或黑客的入侵。其次，VPDN通道的真正安全的方法是使用MAC地址绑定的方法，但是查询手机的MAC地址非常麻烦，一般用户使用非常不便捷。最后，VPDN拨号程序一般没有面向应用程序的接口，应用程序无法通过调用的方法实现普通联网通道和VPDN通道的转换。
在互联网应用日益普及的今天，人们需要在移动终端上兼顾互联网应用与安全应用两种应用模式。但是，当前的移动终端操作系统，无论是浏览器还是应用程序的API接口都只提供单通道的互联网访问模式，同时，移动终端的智能系统缺乏自动切换不同通道联网的接口，给不同的业务应用带来不便。如何依托公网实现移动终端与企业内网之间的安全通信和数据交换成为当前各大企业亟待解决的问题。远程接入通常涉及三个部分：接入终端、接入通道和内网应用,对这三个部分任一个保护的不到位都将给整个远程接入过程带来安全隐患。传统的基于虚拟专网的移动终端接入方案关注于安全传输通道的建立,虽然在一定程度上对数据安全传输提供了保证,但是缺乏对整个接入过程的保护,无法满足企事业对终端远程接入的安全要求。
当前的移动终端操作系统在设计时，往往仅仅通过权限管理来管理应用程序的使用权限，来达到安全防护的目的，在移动终端实施联网的过程，没有任何防火墙策略，仅仅实现移动终端与网络的连接。但是由于广大用户普遍没有专业知识，对于移动终端操作系统的权限管理的功能非常不了解，很多安卓手机用户在删除系统软件或者是实用某些工具的时候都会提示需要获取root权限。Root是手机的神经中枢，它可以访问和修改手机几乎所有的文件。黑客在入侵系统时，都要把权限提升到Root权限，将非法帐户添加到Root用户组。在手机root或安装应用程序的过程中，用户往往会打开手机的权限，从而被植入病毒，导致账户或密码失窃，发生安全隐患。随着iPad、智能手机等移动终端的广泛应用，而于移动设备的威胁呈几何倍数的增长，对终端防护更加处于失控的状态，高级持续性攻击APT攻击者通过以智能手机、平板电脑等移动设备为跳板继而入侵企业信息系统的方式也显著增加。伴随着新时代网络带来的各种问题，在安全应用的通道联网过程中，增加手机的联网防护和防火墙管理，有效杜绝移动终端在访问特定目标IP地址时，连接互联网，阻止账户或信息的泄露，是较为安全的构想。
发明内容
本发明的目的是针对上述现有技术存在不足之处，提供一种面向操作系统内核设计，能够在移动终端的操作系统上，针对预设的联网地址的数据联网提供不同安全防护策略的防火墙隔离应用系统，以满足不同应用程序在不同联网地址，在数据联网中实施不同安全防护策略的需求。
本发明的上述目的可以通过以下措施来得到，一种移动终端预设联网地址防火墙隔离应用系统，包括：内嵌于移动终端操作系统内核中的防火墙隔离模块和通过数据通道传输数据的应用层，其特征在于：防火墙隔离模块内嵌IP数据分析模块，所述IP数据分析模块对所有联网IP地址数据进行分析，根据内含预设指定的联网IP地址和指定IP地址集合模块，对所有流向外部网络的数据流进行监控，当检测到联网IP地址数据包内含有所述预设指定的联网IP地址后，防火墙隔离模块启动过滤规则，将非所述预设指定的联网IP地址外的所有联网IP地址数据包屏蔽，禁止访问非所述预设指定的联网IP 地址外的其它IP地址，只允许所述预设指定的联网IP地址数据访问各种网络。
本发明相比现有移动终端操作系统和其它应用程序具有如下有益效果：
1)本发明通过在移动终端操作系统内核中内嵌防火墙隔离系统，预设指定需要防护的IP地址，不对外提供修改防火墙规则的接口，使得病毒或黑客无法修改防火墙规则，从而确保对指定IP地址的隔离防护。
2)本发明内嵌于移动终端操作系统内核的防火墙隔离模块和内置于防火墙模块的IP数据分析模块，占用系统资源少，规则简单，不会影响移动终端操作系统原有的运行效率。
3)本发明结合虚拟专用拨号网VPDN通道的使用，可以真正形成数据隔离的应用形式，极大提高VPDN网络的安全性能。
4)本发明IP数据分析模块内包含预设指定的联网IP地址，IP数据分析模块对所有流向外部网络的数据流进行监控，自动对指定或预设的IP地址进行防护，应用软件或用户无需通过手工操作，极大提高了移动终端操作系统在安全防护模式上的便利性。
5)本发明IP数据分析模块检测到IP数据包内包含预设指定的联网IP地址后，防火墙启动过滤规则，将非指定联网地址外的所有IP数据包屏蔽，禁止访问非指定的联网地址外的其它IP地址。可以针对不同联网IP地址设置不同的防火墙隔离策略，使用户在使用不同的IP地址时，可以使用不同的安全防护策略。本发明通过移动终端联网防护和防火墙管理，有效杜绝了访问特定目标IP地址时，连接互联网，造成账户或信息的泄露。
附图说明
为使本发明的目的、技术方案和优点更加清楚明白，下面将结合附图对本发明的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
图1是本发明移动终端针对预设或指定的联网地址的防火墙隔离系统模型结构示意图。
图2是本发明移动终端针对多个预设联网地址和/或地址段的防火墙隔离 系统模型的示意图。
图3是本发明移动终端针对指定VPDN联网地址的防火墙隔离系统模型的示意图。
具体实施方式
参阅图1。在以下描述的一个最佳实施例中，支持移动终端实现针对预设或指定联网地址的防火墙系统模型，主要包括内嵌于移动终端操作系统内核的防火墙模块和防火墙模块内的IP数据分析模块。IP数据分析模块内包含预设指定的联网IP地址，IP数据分析模块对所有流向外部网络的数据流进行监控，当检测到IP数据包内包含预设指定的联网IP地址后，防火墙启动过滤规则，将非指定联网地址外的所有IP数据包屏蔽，禁止访问非指定的联网地址外的其它IP地址。当IP数据分析模块一段时间内没有检测到联网数据中包含预设指定的联网IP地址后，防火墙关闭过滤规则，允许数据访问各种网络。
在上述实施例中，移动终端防火墙启动过滤规则的方式包含以下两种模式：
一、传输控制协议TCP数据包的过滤规则
IP数据分析模块在检测到IP数据包内包含预设指定的联网IP地址后，检测IP数据包的类型，如果是传输控制协议TCP，检测TCP协议连接是否建立，如果TCP连接建立，则防火墙启动过滤规则。
当IP数据分析模块一段时间内没有检测到联网数据中包含预设指定的联网IP地址，或者接受到TCP连接终止的消息后，防火墙关闭过滤规则，允许数据访问所有网络。
二、用户数据包协议(User Datagram Protocol，UDP)数据包的过滤规则
UDP协议直接位于网际协议IP协议的顶层。IP数据分析模块在检测到IP数据包内包含预设指定的联网IP地址后，检测IP数据包的类型，如果是UDP协议，则防火墙启动过滤规则。
UDP是一个无连接协议，传输数据之前源端和终端不建立连接，当它想传送时就简单地去抓取来自应用程序的数据，并尽可能快地把它扔到网络上。 在发送端，UDP传送数据的速度仅仅是受应用程序生成数据的速度；在接收端，UDP把每个消息段放在队列中，应用程序每次从队列中读一个消息段。UDP协议使用报头中的校验值来保证数据的安全。校验值首先在数据发送方通过特殊的算法计算得出，在传递到接收方之后，还需要再重新计算。如果某个数据报在传输过程中被第三方篡改或者由于线路噪音等原因受到损坏，发送和接收方的校验计算值将不会相符，检测是否出错。当IP数据分析模块一段时间内没有检测到联网数据中包含预设指定的联网IP地址后，防火墙关闭过滤规则，允许数据访问所有网络。
内嵌于操作系统内核的防火墙隔离模块，通过系统编译成为系统内核的一部分，并杜绝系统模块加载接口，对外不提供修改接口，使得无论应用层或其它手段无法修改防火墙设定。
参阅图2。所示IP地址集合模块包括预设指定的联网IP地址，指定IP地址1、指定IP地址2、指定IP地址3…，多个指定IP地址的集合和/或一段IP地址段。
内嵌与操作系统内核的防火墙模块可以根据预设的不同的指定的联网IP地址，设置不同的过滤规则，不同的过滤规则同时存在，针对不同的指定的IP联网地址发生作用。过滤规则包括以下两种形式：
1)仅允许单个指定的联网IP地址的数据包通过，其他联网地址数据一律丢弃。
2)允许2个或多个指定的联网IP地址和/或一段联网地址段的数据包通过，其他规则以外的数据包一律丢弃。
IP数据分析模块关闭防火墙过滤规则的时间设定，可以根据实际应用中，网络延时或系统响应时间的具体情况，将不同的指定的网络地址的过滤规则的关闭时间设定为不同的时间长度。
参阅图3。在上述实施例中，当把预设的指定的联网地址变成虚拟专用拨号网VPDN联网地址时，移动终端可以在VPDN网络连接成功以后，保障移动终端、VPDN专网都处于与互联网隔离的内部网络中，就可以避免VPDN专网实际使用中，终端没有进行数据隔离的安全隐患，从而保障VPDN数据网络的安全。
上述实施例中，所述的移动终端包括手机、、平板电脑、无线上网卡或其它移动设备。
以上所述的仅是本发明的优选实施例。应当指出，对于本领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以作出若干变形和改进，比如所述程序可以存储于移动终端可读存储介质中，可选地，上述实施例终端各模块/单元可以采用硬件的形式实现，也可采用软件功能模块的形式实现。本发明不限制于任何特定形式的硬件和软件的结合，亦属于本发明的范畴，这些变更和改变应视为属于本发明的保护范围。

Claims (10)

  1. 一种移动终端预设联网地址防火墙隔离应用系统，包括：内嵌于移动终端操作系统内核中的防火墙隔离模块和通过数据通道传输数据的应用层，其特征在于：防火墙隔离模块内嵌网际协议IP数据分析模块，所述IP数据分析模块对所有联网IP地址数据进行分析，根据内含预设指定的联网IP地址和指定IP地址集合模块，对所有流向外部网络的数据流进行监控，当检测到联网IP地址数据包内含有预设指定的联网IP地址后，防火墙隔离模块启动过滤规则，将非指定联网地址外的所有联网IP地址数据包屏蔽，禁止访问非指定的联网地址外的其它IP地址，只允许预设指定联网IP地址数据访问各种网络。
  2. 如权利要求1所述的移动终端预设联网地址防火墙隔离应用系统，其特征在于：移动终端防火墙启动过滤规则的方式包含传输控制协议TCP数据包的过滤规则模式：IP数据分析模块在检测到IP数据包内包含预设指定的联网IP地址后，检测IP数据包的类型，如果是传输控制协议TCP，检测TCP协议连接是否建立，如果TCP连接建立，则防火墙启动过滤规则。
  3. 如权利要求1或2所述的移动终端预设联网地址防火墙隔离应用系统，其特征在于：当IP数据分析模块一段时间内没有检测到联网数据中包含预设指定的联网IP地址，或者接受到TCP连接终止的消息后，防火墙关闭过滤规则，允许数据访问所有网络。
  4. 如权利要求1所述的移动终端预设联网地址防火墙隔离应用系统，其特征在于：移动终端防火墙启动过滤规则的方式还包含用户数据包协议UDP数据包的过滤规则模式：IP数据分析模块在检测到IP数据包内包含预设指定的联网IP地址后，检测IP数据包的类型，如果是UDP协议，则防火墙启动过滤规则，UDP协议直接位于IP协议的顶层。
  5. 如权利要求1所述的移动终端预设联网地址防火墙隔离应用系统，其特征在于：内嵌于操作系统内核的防火墙隔离模块，通过系统编译成为移动终端操作系统内核的一部分，并杜绝移动终端操作系统模块加载接口，对外不提供修改接口。
  6. 如权利要求1所述的移动终端预设联网地址防火墙隔离应用系统，其 特征在于：防火墙模块根据预设的不同的指定的联网IP地址，设置不同的过滤规则，不同的过滤规则同时存在，针对不同的指定的IP联网地址发生作用。
  7. 如权利要求1所述的移动终端预设联网地址防火墙隔离应用系统，其特征在于：过滤规则包括以下两种形式：
    1)仅允许单个指定的联网IP地址的数据包通过，其它联网地址数据一律丢弃；
    2)允许2个或多个指定的联网IP地址和/或一段联网地址段的数据包通过，其他规则以外的数据包一律丢弃。
  8. 如权利要求1所述的移动终端预设联网地址防火墙隔离应用系统，其特征在于：IP数据分析模块关闭防火墙过滤规则的时间设定，根据实际应用中，网络延时或系统响应时间的具体情况，将不同的指定的网络地址的过滤规则的关闭时间设定为不同的时间长度。
  9. 如权利要求1所述的移动终端预设联网地址防火墙隔离应用系统，其特征在于：所述的IP地址集合模块包括预设指定的联网IP地址，指定IP地址1、指定IP地址2、指定IP地址3…，多个指定IP地址的集合和/或一段IP地址段。
  10. 如权利要求1所述的移动终端预设联网地址防火墙隔离应用系统，其特征在于：当把预设的指定的联网地址变成虚拟专用拨号网VPDN联网地址时，移动终端在VPDN网络连接成功以后，移动终端、VPDN专网都处于与互联网隔离的内部网络中。
PCT/CN2014/087303 2014-05-21 2014-09-24 移动终端预设联网地址防火墙隔离应用系统 WO2015176445A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410214696.8A CN103973700A (zh) 2014-05-21 2014-05-21 移动终端预设联网地址防火墙隔离应用系统
CN201410214696.8 2014-05-21

Publications (1)

Publication Number Publication Date
WO2015176445A1 true WO2015176445A1 (zh) 2015-11-26

Family

ID=51242746

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/087303 WO2015176445A1 (zh) 2014-05-21 2014-09-24 移动终端预设联网地址防火墙隔离应用系统

Country Status (2)

Country Link
CN (1) CN103973700A (zh)
WO (1) WO2015176445A1 (zh)

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105554740A (zh) * 2015-12-31 2016-05-04 北京神州绿盟信息安全科技股份有限公司 一种识别无线热点的方法、装置及设备
CN109587230A (zh) * 2018-11-23 2019-04-05 扬州艾默软件技术有限公司 一种物联网远程控制终端及控制方法
CN110516444A (zh) * 2019-07-23 2019-11-29 成都理工大学 基于kernel的跨终端跨版本Root攻击检测与防护系统
CN112565161A (zh) * 2019-09-25 2021-03-26 北京桔智物联科技有限责任公司 基于串口的隔离通信设备及方法
CN112751843A (zh) * 2020-12-28 2021-05-04 中铁第一勘察设计院集团有限公司 铁路供电系统网络安全防护系统
CN114070622A (zh) * 2021-11-16 2022-02-18 北京宏达隆和科技有限公司 一种基于网络端口安全的微隔离系统
CN114338236A (zh) * 2022-03-01 2022-04-12 四川省商投信息技术有限责任公司 一种防火墙入侵数据分析方法及装置
CN114629676A (zh) * 2021-11-26 2022-06-14 中国大唐集团科学技术研究院有限公司火力发电技术研究院 一种用于火电机组燃料系统的安全防护系统及方法
CN115037551A (zh) * 2022-06-29 2022-09-09 北京奇艺世纪科技有限公司 连接权限控制方法、装置、电子设备及存储介质
CN115622809A (zh) * 2022-12-14 2023-01-17 浙江中电远为科技有限公司 一种面向密柜应用场景的内外网安全隔离系统

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103973700A (zh) * 2014-05-21 2014-08-06 成都达信通通讯设备有限公司 移动终端预设联网地址防火墙隔离应用系统
US10110561B2 (en) * 2014-11-26 2018-10-23 Rockwell Automation Technologies, Inc. Firewall with application packet classifer
CN104519065B (zh) * 2014-12-22 2018-05-01 北京卓越信通电子股份有限公司 一种支持过滤Modbus TCP协议的工控防火墙实现方法
CN104883368B (zh) * 2015-05-28 2020-06-05 上海斐讯数据通信技术有限公司 一种内核防火墙的管理方法
CN105208035B (zh) * 2015-10-09 2018-08-14 上海瀚银信息技术有限公司 一种访问操作屏蔽方法及系统以及服务器设备
CN107360182B (zh) * 2017-08-04 2020-05-01 南京翼辉信息技术有限公司 一种用于嵌入式的主动网络防御系统及其防御方法
CN107835179B (zh) * 2017-11-14 2021-05-04 超越科技股份有限公司 一种基于虚拟化容器的应用程序防护方法与装置
CN109167777A (zh) * 2018-08-28 2019-01-08 西安工业大学 一种手机智能终端防火墙装置
CN109743326B (zh) * 2019-01-10 2021-09-07 新华三云计算技术有限公司 流量传输方法及装置
CN109889529B (zh) * 2019-03-01 2021-06-08 国电南瑞科技股份有限公司 一种基于iptable的通信控制器的防火墙实现方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102378166A (zh) * 2011-09-09 2012-03-14 周伯生 基于无线防火墙的网络安全方法
US8341723B2 (en) * 2007-06-28 2012-12-25 Microsoft Corporation Filtering kernel-mode network communications
CN103795736A (zh) * 2014-03-10 2014-05-14 成都达信通通讯设备有限公司 针对移动终端不同联网通道的防火墙联网系统
CN103973700A (zh) * 2014-05-21 2014-08-06 成都达信通通讯设备有限公司 移动终端预设联网地址防火墙隔离应用系统

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE69925732T2 (de) * 1999-10-22 2006-03-16 Telefonaktiebolaget Lm Ericsson (Publ) Mobiltelefon mit eingebauter Sicherheitsfirmware
JP3526435B2 (ja) * 2000-06-08 2004-05-17 株式会社東芝 ネットワークシステム
CN100514921C (zh) * 2007-01-31 2009-07-15 华为技术有限公司 一种网络流量异常检测方法和系统
CN102510424B (zh) * 2011-10-17 2014-04-16 广东轩辕网络科技股份有限公司 实现多媒体数据在移动终端设备上展现的方法及其应用系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8341723B2 (en) * 2007-06-28 2012-12-25 Microsoft Corporation Filtering kernel-mode network communications
CN102378166A (zh) * 2011-09-09 2012-03-14 周伯生 基于无线防火墙的网络安全方法
CN103795736A (zh) * 2014-03-10 2014-05-14 成都达信通通讯设备有限公司 针对移动终端不同联网通道的防火墙联网系统
CN103973700A (zh) * 2014-05-21 2014-08-06 成都达信通通讯设备有限公司 移动终端预设联网地址防火墙隔离应用系统

Cited By (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105554740A (zh) * 2015-12-31 2016-05-04 北京神州绿盟信息安全科技股份有限公司 一种识别无线热点的方法、装置及设备
CN109587230A (zh) * 2018-11-23 2019-04-05 扬州艾默软件技术有限公司 一种物联网远程控制终端及控制方法
CN110516444A (zh) * 2019-07-23 2019-11-29 成都理工大学 基于kernel的跨终端跨版本Root攻击检测与防护系统
CN112565161A (zh) * 2019-09-25 2021-03-26 北京桔智物联科技有限责任公司 基于串口的隔离通信设备及方法
CN112751843A (zh) * 2020-12-28 2021-05-04 中铁第一勘察设计院集团有限公司 铁路供电系统网络安全防护系统
CN114070622B (zh) * 2021-11-16 2024-02-09 北京宏达隆和科技有限公司 一种基于网络端口安全的微隔离系统
CN114070622A (zh) * 2021-11-16 2022-02-18 北京宏达隆和科技有限公司 一种基于网络端口安全的微隔离系统
CN114629676B (zh) * 2021-11-26 2024-03-19 中国大唐集团科学技术研究院有限公司火力发电技术研究院 一种用于火电机组燃料系统的安全防护系统及方法
CN114629676A (zh) * 2021-11-26 2022-06-14 中国大唐集团科学技术研究院有限公司火力发电技术研究院 一种用于火电机组燃料系统的安全防护系统及方法
CN114338236A (zh) * 2022-03-01 2022-04-12 四川省商投信息技术有限责任公司 一种防火墙入侵数据分析方法及装置
CN114338236B (zh) * 2022-03-01 2022-05-13 四川省商投信息技术有限责任公司 一种防火墙入侵数据分析方法及装置
CN115037551A (zh) * 2022-06-29 2022-09-09 北京奇艺世纪科技有限公司 连接权限控制方法、装置、电子设备及存储介质
CN115037551B (zh) * 2022-06-29 2024-04-26 北京奇艺世纪科技有限公司 连接权限控制方法、装置、电子设备及存储介质
CN115622809A (zh) * 2022-12-14 2023-01-17 浙江中电远为科技有限公司 一种面向密柜应用场景的内外网安全隔离系统

Also Published As

Publication number Publication date
CN103973700A (zh) 2014-08-06

Similar Documents

Publication Publication Date Title
WO2015176445A1 (zh) 移动终端预设联网地址防火墙隔离应用系统
US10541976B2 (en) Secure communications with internet-enabled devices
US10581839B2 (en) Secure communications with internet-enabled devices
US10708233B2 (en) Identification of certificate pinned mobile applications in cloud based security systems
WO2015085808A1 (zh) 移动终端自动切换不同通道联网接口的安全应用系统
WO2009126083A1 (en) Access through non-3gpp access networks
Peng et al. Real threats to your data bills: Security loopholes and defenses in mobile data charging
US11539695B2 (en) Secure controlled access to protected resources
WO2015135314A1 (zh) 针对移动终端不同联网通道的防火墙联网系统
Fitzgerald et al. MASON: Mobile autonomic security for network access controls
Patel et al. A Snort-based secure edge router for smart home
KR20210001728A (ko) 이더넷 기반의 선박 네트워크 보호를 위한 선박 보안 시스템
CN114465744A (zh) 一种安全访问方法及网络防火墙系统
Hernández et al. Ethical Hacking on Mobile Devices: Considerations and practical uses
van Oorschot et al. Firewalls and tunnels
TW202034658A (zh) 立基於軟體定義網路之IPv6存取管理系統及其方法
Nair et al. Intrusion detection in Bluetooth enabled mobile phones
Sharp Network Security
Magpayo et al. Prevent a Wireless Attack
Reynolds et al. STEM: secure telephony enabled middlebox
Ghosh et al. Analysis of network security issues and threats analysis on 5G wireless networks
Alasmary et al. Addressing Polymorphic Advanced Threats in Internet of Things Networks by Cross‐Layer Profiling
Tupakula et al. Securing mobile devices from DoS attacks
Nagy et al. Enhancing security in mobile data networks through end user and core network cooperation
Liu et al. Research on security of VoIP network

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14892862

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 28/03/2017)

122 Ep: pct application non-entry in european phase

Ref document number: 14892862

Country of ref document: EP

Kind code of ref document: A1