WO2019000597A1

WO2019000597A1 - Ip address hiding method and device

Info

Publication number: WO2019000597A1
Application number: PCT/CN2017/097201
Authority: WO
Inventors: 杨帆; 王根平; 朱旗; 义远科
Original assignee: 深圳市欧乐在线技术发展有限公司
Priority date: 2017-06-28
Filing date: 2017-08-11
Publication date: 2019-01-03
Also published as: CN107196961A

Abstract

The present invention relates to the technical field of communications, and disclosed thereby are an internet protocol (IP) address hiding method and device, the method comprising: obtaining an access level of a terminal; selecting at least one super node according to the access level of the terminal; the terminal connecting to an access server by means of the at least one super node. For different access levels of the terminal, super nodes of different levels are used so that the terminal does not directly connect to the server, thus achieving the purposes of hiding the IP address and preventing the ecosphere from being attacked so as to ensure the security of the device and server side.

Description

IP address hiding method and device

Technical field

[0001] The present invention relates to the field of communications technologies, and in particular, to an IP address hiding method and apparatus.

Background technique

[0002] The booming development of the Internet market and the advancement of society have also exposed many crises. Each computer on the network has a unique IP address. The computer loads the target IP address and a unique sequence number into each of the transmissions. The communication is implemented on the data packet. At this stage, the hacker can easily intercept the data packet information by means of detection, interception or network segment information, resulting in leakage of data information and IP address (terminal or server). The hacker can easily break the server by DDOS. End or terminal. The field of communication in the existing market can be divided into two types. The first type: Peer-to-peer, such as client A directly connected to server S. This is also the most common way in the market today. In the process of direct connection, hackers can easily intercept user information. Get information such as IP at both ends. Second: transparent transmission of proxy nodes. For example, client A sends to proxy node N, and the proxy node forwards to the server. In this way, the proxy node is fixed. After the hacker finds the agent node, it can easily obtain information about the server. The security of the proxy node is low throughout the process.

[0003] The main purpose of the present invention is to provide an IP address hiding method and apparatus, which use different levels of super nodes for different access levels of the terminal, so that the terminal does not directly connect to the server, and the hidden IP address is reached, and the ecosystem is prevented. The purpose of the attack is to ensure the security of the device and the server.

Problem solution

Technical solution

[0004] In order to achieve the above object, an IP address hiding method provided by the present invention includes:

[0005] obtaining an access level of the terminal;

[0006] selecting at least one super node according to an access level of the terminal;

[0007] The terminal is connected to an access server by the at least one super node.

[0008] Optionally, the access level of the terminal includes: a primary access level, a secondary access level, and a tertiary access. The selecting the at least one super node according to the access level of the terminal includes:

[0009] when the access level of the terminal is a level 1 access level, selecting a super node;

[0010] when the access level of the terminal is a secondary access level, two super nodes are selected;

[0011] When the access level of the terminal is a three-level access level, three super nodes are selected.

[0012] Optionally, the connecting, by the terminal, to the access server by using the at least one super node includes: [0013] when the access level of the terminal is a primary access level, the terminal passes the Describe a super node connected to the access server;

[0014] when the access level of the terminal is a secondary access level, the terminal is connected to the access server by using the two super nodes;

[0015] When the access level of the terminal is a three-level access level, the terminal is connected to the access server by using the three super nodes.

[0016] Optionally, the access level of the terminal is changed according to a policy preset by the management system, and the super node corresponding to the terminal also changes.

[0017] Optionally, the super node goes online and offline according to a policy preset by the management system, and the super node enters the proxy pool after being offline.

[0018] As another aspect of the present invention, an IP address hiding apparatus is provided, including:

[0019] an obtaining module, configured to acquire an access level of the terminal;

[0020] a selection module, configured to select at least one super node according to an access level of the terminal;

[0021] a connection module, configured to connect, by the terminal, the access server by using the at least one super node.

[0022] Optionally, the access level of the terminal includes: a first level access level, a second level access level, and a third level access level; the selecting module includes:

[0023] when the access level of the terminal is a level 1 access level, selecting a super node;

[0024] when the access level of the terminal is a secondary access level, two super nodes are selected;

[0025] When the access level of the terminal is a three-level access level, three super nodes are selected.

Optionally, the connecting module includes:

[0027] when the access level of the terminal is a level 1 access level, the terminal is connected to the access server by using the one super node;

[0028] when the access level of the terminal is a secondary access level, the terminal connects through the two super nodes. Received access to the server;

[0029] When the access level of the terminal is a three-level access level, the terminal is connected to the access server by using the three super nodes.

[0030] Optionally, the access level of the terminal is changed according to a policy preset by the management system, and the super node corresponding to the terminal also changes.

[0031] Optionally, the super node goes online and offline according to a policy preset by the management system, and the super node enters the proxy pool after being offline.

Advantageous effects of the invention

Beneficial effect

[0032] An IP address hiding method and apparatus according to the present invention, the method includes: acquiring an access level of a terminal; selecting at least one super node according to an access level of the terminal; and the terminal passing the at least one super The node is connected to the access server, and different levels of super nodes are used for different access levels of the terminal, so that the terminal does not directly connect to the server, thereby achieving the purpose of hiding the IP address and preventing the ecosystem from being attacked, thereby ensuring the device and the server end. Safety.

Brief description of the drawing

DRAWINGS

1 is a flowchart of an IP address hiding method according to Embodiment 1 of the present invention;

2 is a schematic diagram of a system connection with an access level of a first level according to Embodiment 1 of the present invention;

3 is a schematic diagram of a system connection of an access level of a second level according to Embodiment 1 of the present invention;

4 is a schematic diagram of a system connection with an access level of three levels according to Embodiment 1 of the present invention;

5 is a schematic structural diagram of a communication system according to Embodiment 1 of the present invention;

FIG. 6 is a block diagram showing an exemplary structure of an IP address hiding apparatus according to Embodiment 2 of the present invention.

[0039] The implementation, functional features, and advantages of the present invention will be further described with reference to the accompanying drawings.

BEST MODE FOR CARRYING OUT THE INVENTION

The specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. [0041] In the following description, the use of suffixes such as "module", "component" or "unit" for indicating an element is merely an explanation for facilitating the present invention, and does not have a specific meaning per se. Therefore, "module" and "component" can be used in combination.

[0042] As shown in FIG. 1, in this embodiment, an IP address hiding method includes:

[0043] S10. Obtain an access level of the terminal.

[0044] S20. Select at least one super node according to an access level of the terminal.

[0045] S30. The terminal is connected to the access server by using the at least one super node.

[0046] In this embodiment, different levels of super nodes are used for different access levels of the terminal, so that the terminal does not directly connect to the server, thereby achieving the purpose of hiding the IP address and preventing the ecosystem from being attacked, thereby ensuring the device and Server-side security.

[0047] In this embodiment, the communication system is composed of a terminal 1\ a super node SN, an access server SCR, and a management system BBOSS, wherein the terminal is composed of an electronic device that can be connected to the network, and the terminal cannot directly connect to the server, and must pass through the super node. The SN accesses the server, and at least one to three SN super nodes are forwarded to access the server; the access server is responsible for access authentication with the terminal device. It is the service server device of the operator, which is the entry point for the terminal to request processing of all services; the super node is responsible for forwarding information, and may be composed of any networked electronic device. SN can be divided into three types: SN1, SN2, and SN3. Each SN node can directly connect to the terminal device. Only SN1 can connect to the SCR server. The three types of SNs are hierarchical. The management system is used to operate the system and develop super nodes. Connection strategy.

[0048] In this embodiment, the access level of the terminal includes: a first level access level, a second level access level, and a third level access level; and the at least one super is selected according to the access level of the terminal. Nodes include:

[0049] When the access level of the terminal is a level 1 access level, selecting a super node, only SN1 can be selected;

[0050] When the access level of the terminal is a secondary access level, two super nodes are selected, namely, SN1 and SN2.

[0051] When the access level of the terminal is a three-level access level, three super nodes, namely, SN1, SN2, and SN3, are selected.

[0052] In this embodiment, the terminal connecting to the access server by using the at least one super node includes:

[0053] when the access level of the terminal is a primary access level, the terminal connects through the one super node. Connected to the access server, the connection diagram is shown in Figure 2. The terminal will connect to the SN1 node, connect to the SCR server through SN1, and the SCR server will authenticate the terminal. Then the SCR verifies that the terminal is connected to the server via SN1. of. If the verification passes this connection will be valid. Otherwise you cannot connect to the server

[0054] When the access level of the terminal is a secondary access level, the terminal is connected to the access server by using the two super nodes, and the connection diagram is as shown in FIG. 3, and the terminal is connected to the SN2 node. Connect SN1 through SN2, and SNl connects to the SCR server to perform authentication verification on the terminal. This 吋 SCR verifies that the terminal is connected to the server via SN2. If the verification passes this connection will be valid. Otherwise the server cannot be connected;

[0055] When the access level of the terminal is a three-level access level, the terminal is connected to the access server by using the three super nodes, and the connection diagram is as shown in FIG. 4, and the terminal is connected to the SN3 node. SN2 is connected through SN3, and SN2 is connected to SN1, and SNl is connected to the SCR server to perform authentication verification on the terminal. This 吋 SCR verifies that the terminal is connected to the server via SN3. If the verification passes this connection will be valid. Otherwise the server cannot be connected.

[0056] As shown in FIG. 5, in the communication system of the present embodiment, 1~3 are SN1 super nodes, 4~11 are SN2 super nodes, 12~22 are SN3 super nodes, and 23~31 are ordinary terminals. SN1, SN2, and SN3 form a complete SN proxy pool ecosystem. The BBOSS determines the access line of the SN super node according to the policy, and resets the access level of the terminal. The specific strategy includes: the number of nodes of each type; the maximum length of each type of node is on the line, if it exceeds the length of the node, it is offline; the node is selected again, if the terminal is selected, the node is considered The difference of the selected node; the number of times the node is selected again; the network bandwidth threshold is greater than the bandwidth to be selected; the firewall type, the terminal must have public IP and no firewall setting; IP address change rate; CPU processing capacity . After the BBOSS calculates and processes the above conditions, the super node that needs to go offline is selected from the database, and the terminal of the selected super node is selected.

[0057] In this embodiment, the access level of the terminal changes according to a policy preset by the management system, and the super node corresponding to the terminal also changes.

[0058] As shown in FIG. 5, the BBOOS performs the SN policy to calculate that the access level of the ordinary terminal 31 is changed from the original three levels to the second level. The BBOSS sends the data to the SCR server (n_l process), the SCR server sends the data to the super node 3 (n_5 process), and the super node 3 sends the data to the super node 11 (n_6 process) The super node 11 sends the data to the super node 22 (n_7 flow), and the super node 22 sends the data to the terminal 31 (n_8 flow), and the terminal 31 receives the data, and the data has a list of connected super SN2. . The terminal selects an optimal SN2 node to establish a connection. As shown in the figure, the terminal finally selects the super node 11 to establish a connection.

[0059] In this embodiment, the super node goes online and offline according to a policy preset by the management system, and the super node enters the proxy pool after going offline.

As shown in FIG. 5, the BBOOS executes the SN policy to calculate that the super node 8 needs to go offline. Here, BBOSS sends the data to the SCR server (n_l process), and the SCR server sends the data to the super node 2 (n_2 process), and the super node 2 sends the data to the super node 8 (n_3 process). After the super node receives the data, it will execute the offline program. After the program is executed, the connection between SuperNode 8 and SuperNode 2 will be broken. This super node 8 will send a message to the corresponding connection to tell the super node 18 "I am offline", let the other party connect to other nodes. This super node 18 will connect to other SN2 nodes to find a good node connection. The super node 18 is connected to the super node 9 as shown. This ensures the normal offline of the node without affecting all terminal services.

Embodiment 2

[0062] As shown in FIG. 6, in this embodiment, an IP address hiding device includes:

[0063] The obtaining module 10 is configured to acquire an access level of the terminal.

[0064] The selecting module 20 is configured to select at least one super node according to an access level of the terminal;

[0065] The connection module 30 is configured to connect, by the terminal, the access server by using the at least one super node.

[0066] In this embodiment, different levels of super nodes are used for different access levels of the terminal, so that the terminal does not directly connect to the server, thereby achieving the purpose of hiding the IP address and preventing the ecosystem from being attacked, thereby ensuring the device and Server-side security.

[0067] In this embodiment, the communication system is composed of a terminal 1\super node SN, an access server SCR, and a management system BBOSS, wherein the terminal is composed of an electronic device that can be connected to the network, and the terminal cannot directly connect to the server, and must pass through the super node. The SN accesses the server, and at least one to three SN super nodes are forwarded to access the server; the access server is responsible for access authentication with the terminal device. It is the service server device of the operator, and is the portal for the terminal to request processing of all services; the super node is responsible for forwarding information, and may be any networked electronic device. SN can be divided into three types: SN1, SN2, and SN3, each SN section. Points can be directly connected to the terminal device, only SN1 can connect to the SCR server, and the three types of SN are hierarchical.

The management system is used to operate the system and develop a connection strategy for the super nodes.

[0068] In this embodiment, the access level of the terminal includes: a first level access level, a second level access level, and a third level access level; the selection module includes:

[0069] When the access level of the terminal is a level 1 access level, selecting a super node, only SN1 can be selected;

[0070] When the access level of the terminal is a secondary access level, two super nodes are selected, namely, SN1 and SN2.

[0071] When the access level of the terminal is a three-level access level, three super nodes, namely, SN1, SN2, and SN3, are selected.

[0072] In this embodiment, the connection module includes:

[0073] When the access level of the terminal is a level 1 access level, the terminal is connected to the access server by using the one super node, and the connection diagram is as shown in FIG. 2, and the terminal is connected to the SN1 node. The SCR server is connected to the SCR server through SN1, and the SCR server performs authentication verification on the terminal, and then the SCR verifies whether the terminal is connected to the server through SN1. If the verification passes this connection will be valid. Otherwise you cannot connect to the server

[0074] When the access level of the terminal is a secondary access level, the terminal is connected to the access server by using the two super nodes, and the connection diagram is as shown in FIG. 3, and the terminal is connected to the SN2 node. Connect SN1 through SN2, and SNl connects to the SCR server to perform authentication verification on the terminal. This 吋 SCR verifies that the terminal is connected to the server via SN2. If the verification passes this connection will be valid. Otherwise the server cannot be connected;

[0075] When the access level of the terminal is a three-level access level, the terminal is connected to the access server by using the three super nodes, and the connection diagram is as shown in FIG. 4, and the terminal is connected to the SN3 node. SN2 is connected through SN3, and SN2 is connected to SN1, and SNl is connected to the SCR server to perform authentication verification on the terminal. This 吋 SCR verifies that the terminal is connected to the server via SN3. If the verification passes this connection will be valid. Otherwise the server cannot be connected.

[0076] As shown in FIG. 5, in the communication system of the embodiment, 1~3 are SN1 super nodes, 4~11 are SN2 super nodes, 12~22 are SN3 super nodes, and 23~31 are ordinary terminals. SN1, SN2, and SN3 form a complete SN proxy pool ecosystem. BBOSS determines the upper and lower lines of the SN super node according to the policy, and resets The access level of the terminal. The specific strategy includes: the number of nodes of each type; the maximum length of each type of node is on the line, if it exceeds the length of the node, it is offline; the node is selected again, if the terminal is selected, the node is considered The difference of the selected node; the number of times the node is selected again; the network bandwidth threshold is greater than the bandwidth to be selected; the firewall type, the terminal must have public IP and no firewall setting; IP address change rate; CPU processing capacity . After the BBOSS calculates and processes the above conditions, the super node that needs to go offline is selected from the database, and the terminal of the selected super node is selected.

[0077] In this embodiment, the access level of the terminal changes according to a policy preset by the management system, and the super node corresponding to the terminal also changes.

As shown in FIG. 5, the BBOOS performs the SN policy to calculate that the access level of the ordinary terminal 31 is changed from the original three levels to the second level. The BBOSS sends the data to the SCR server (n_l process), the SCR server sends the data to the super node 3 (n_5 process), the super node 3 sends the data to the super node 11 (n_6 process), and the super node 11 sends the data to The super node 22 (n_7 flow), the super node 22 sends the data to the terminal 31 (n_8 flow), and the terminal 31 receives the data, which has a list of connected super SN2. The terminal selects an optimal SN2 node to establish a connection. As shown in the figure, the terminal finally selects the super node 11 to establish a connection.

[0079] In this embodiment, the super node goes online and offline according to a policy preset by the management system, and the super node enters the proxy pool after going offline.

[0080] As shown in FIG. 5, the BBOOS executes the SN policy to calculate that the super node 8 needs to go offline. Here, BBOSS sends the data to the SCR server (n_l process), and the SCR server sends the data to the super node 2 (n_2 process), and the super node 2 sends the data to the super node 8 (n_3 process). After the super node receives the data, it will execute the offline program. After the program is executed, the connection between SuperNode 8 and SuperNode 2 will be broken. This super node 8 will send a message to the corresponding connection to tell the super node 18 "I am offline", let the other party connect to other nodes. This super node 18 will connect to other SN2 nodes to find a good node connection. The super node 18 is connected to the super node 9 as shown. This ensures the normal offline of the node without affecting all terminal services.

[0081] It is to be understood that the term "comprising", "comprising", or any other variants thereof is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device comprising a plurality of elements includes Those elements, but also other elements that are not explicitly listed, or are included for this The elements inherent in a process, method, item, or device. An element that is defined by the phrase "comprising a ..." does not exclude the presence of additional elements in the process, method, article, or device that comprises the element.

The serial numbers of the embodiments of the present invention are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

The above are only the preferred embodiments of the present invention, and are not intended to limit the scope of the present invention, and the equivalent structure or equivalent process transformations made by the description of the present invention and the contents of the drawings may be directly or indirectly applied to other related The technical field is equally included in the scope of patent protection of the present invention.

Claims

Claim

An IP address hiding method, comprising:

Obtain the access level of the terminal;

Selecting at least one super node according to an access level of the terminal;

The terminal is connected to the access server by the at least one super node.

The IP address hiding method according to claim 1, wherein the access level of the terminal comprises: a first level access level, a second level access level, and a third level access level; Selecting at least one super node for the access level of the terminal includes:

When the access level of the terminal is a level 1 access level, a super node is selected; when the access level of the terminal is a level 2 access level, two super nodes are selected; when the terminal accesses The level is the three-level access level吋, and three super nodes are selected. The IP address hiding method according to claim 2, wherein the connecting the terminal to the access server by using the at least one super node comprises:

When the access level of the terminal is a primary access level, the terminal is connected to the access server by using the one super node;

When the access level of the terminal is a secondary access level, the terminal is connected to the access server by using the two super nodes;

When the access level of the terminal is a three-level access level, the terminal is connected to the access server by using the three super-nodes.

The IP address hiding method according to claim 3, wherein the access level of the terminal is changed according to a policy preset by the management system, and the super node corresponding to the terminal also changes.

The IP address hiding method according to claim 1, wherein the super node goes online and offline according to a policy preset by the management system, and the super node enters the proxy pool after being offline.

An IP address hiding device, comprising:

An obtaining module, configured to acquire an access level of the terminal;

a selecting module, configured to select at least one super node according to an access level of the terminal; And a connection module, configured to connect, by the terminal, the access server by using the at least one super node.

[Claim 7] The IP address hiding device according to claim 6, wherein the access level of the terminal includes: a primary access level, a secondary access level, and a third level access level; The selection module includes:

When the access level of the terminal is a level 1 access level, a super node is selected; when the access level of the terminal is a level 2 access level, two super nodes are selected; when the terminal accesses The level is the three-level access level吋, and three super nodes are selected.

[Claim 8] The IP address hiding device according to claim 7, wherein the connection module comprises:

[Claim 9] The IP address hiding device according to claim 8, wherein the access level of the terminal is changed according to a policy preset by the management system, and the super node corresponding to the terminal is also followed. A change has occurred.

[Claim 10] The IP address hiding method according to claim 6, wherein the super node goes online and offline according to a policy preset by the management system, and the super node enters the proxy pool after going offline.