WO2020147032A1

WO2020147032A1 - Network security management system, and method therefor

Info

Publication number: WO2020147032A1
Application number: PCT/CN2019/071967
Authority: WO
Inventors: 王松伟
Original assignee: 永信科技股份有限公司
Priority date: 2019-01-16
Filing date: 2019-01-16
Publication date: 2020-07-23

Abstract

A network security management system (100), and a method therefor. The network security management system (100) is provided in a network transmission device (1) of an internal area network, and the network transmission device (1) is connected to a plurality of computer terminals (2). The network security management system (100) comprises: a setting module and a checking module, the setting module being provided with a path table, and the path table storing a communication permission of each computer terminal (2) corresponding to a specific computer terminal (2); the checking module receiving a data packet transmitted by one of the computer terminals (2); and the checking module determining the data packet by means of the path table, when communication data of the data packet conforms to the communication permission of the path table, transmitting the data packet to the corresponding target computer terminal (2) according to the communication data. By means of this, mutual data virus infection between various computer terminals (2) can be effectively avoided, so as to ensure the security of data transmission.

Description

Network safety management system and method

Technical field

The present invention relates to a network security related field, in particular to a network security management system and method.

Background technique

With the development and popularization of network technology, the network has become an indispensable part of life. People quickly exchange the required credit through the network. However, in the process of exchanging credit, the computer system may be hacked to steal data or computers. The system was damaged and the computer data was infected.

technical problem

The existing network protection function uses a firewall as a line of defense to prevent external attacks. The firewall can set specific packets. When the firewall receives a specific packet, it will be allowed to enter the device, and the packets that are not set will be blocked by the firewall. . For general network attacks, firewalls can effectively block these attacks, protect the security of equipment and software, and ensure that data is not stolen.

However, the firewall can only block packets that are not accepted by the device. For higher-level network attacks, such as attacks against system and application vulnerabilities, buffer overflow attacks or Trojan horse attacks, it cannot detect Or intercept.

High-level cyber attacks will pretend to be packets permitted by the original system, and enter the system without being blocked by firewalls to attack, thereby paralyzing the device system or stealing confidential information, causing data security problems.

Technical solution

In order to solve the above-mentioned problems, the present invention provides a network security management system and method. By confirming whether the transmitted data packets comply with the exclusive communication authority between each computer terminal, it can effectively avoid the mutual transmission of data viruses between the computer terminals to ensure data Security of transmission.

An embodiment of the present invention provides a network security management system, which is set up on a network transmission device of an internal area network. The network transmission device is connected to a plurality of computer terminals. The network security management system includes: a setting module and a check Module, the setting module is provided with a path table, and the path table stores the communication authority of each computer terminal corresponding to the specific computer terminal; the checking module is used to receive a data packet transmitted by one of the computer terminals, and the data packet has a communication Data; the checking module judges the communication data through the path table, wherein, when the communication data of the data packet meets the communication authority of the path table, the data packet is transmitted to the corresponding target computer terminal according to the communication data.

In one of the embodiments, the checking module determines that the communication data of the data packet cannot correspond to the path table, the checking module deletes or ignores the data packet, and chooses whether to return a failure message.

In one of the embodiments, the path table stores the Internet Protocol address (IP Address) of each computer terminal at the network layer and the communication authority of the communication port (PORT) used by the application software at the transport layer.

In one of the embodiments, the communication data is the Internet Protocol address (IP Address) or the communication port (PORT) of the computer terminal.

In one of the embodiments, the path table stores a media access control address (Media Access Control Address) that allows the computer terminal.

In one of the embodiments, the network transmission equipment is selected from any one of a hub, a switch, and a router.

Through the above, the network security management system of the present invention can confirm whether the data packets transmitted by each computer terminal comply with the exclusive communication authority between each computer terminal through the path table stored in the setting module; thereby, it can effectively avoid each computer Data viruses infect each other between terminals to ensure the security of data transmission.

Furthermore, when the check module judges that the communication data of the data packet cannot correspond to the path table, the check module deletes the data packet and returns a failure message; thereby, it can prevent the problematic data packet from still existing in the system, Prevent the risk of problematic data packets from causing disease or infection.

In addition, the media access control address of the computer terminal can ensure that the communication information is transmitted to the computer terminal existing in the internal area network instead of an externally connected computer terminal, so as to ensure the security of data transmission.

An embodiment of the present invention provides a network security management method, which is applied to an internal area network. The network transmission device is connected to multiple computer terminals. The network security management method includes: setting each computer terminal corresponding to a specific A communication authority of a computer terminal; when one of the computer terminals requests to transmit a data packet to another computer terminal, it is determined whether the data packet meets the communication authority; and when the data packet meets the communication authority, the network transmission device transmits the data packet to The computer terminal of the target.

In one of the embodiments, when the data packet cannot meet the communication authority, the data packet is deleted or ignored, and a failure message is selected whether to return.

In one of the embodiments, the communication authority is that each computer terminal corresponds to the Internet Protocol address (IP Address) of the specific computer terminal at the network layer and the communication port (PORT) of the application software at the transport layer.

In one of the embodiments, the path table stores the media access control address (Media Access Control Address) of the computer terminal.

In one of the embodiments, a path table is established in the network transmission device according to the communication authority allowed for transmission by each computer terminal corresponding to the specific computer terminal; the path table is used to determine whether the transmission destination of the data packet is allowed.

Beneficial effect

Through the above, the network security management method of the present invention can confirm whether the data packets transmitted by each computer terminal comply with the exclusive communication authority between each computer terminal; thereby, it can effectively prevent the data viruses between the computer terminals from infecting each other to ensure data Security of transmission.

BRIEF DESCRIPTION

Figure 1 is a schematic diagram of the connection of the present invention.

Figure 2 is a schematic diagram of the system architecture of the present invention.

Figure 3 is a schematic flow diagram of the method of the present invention.

DESCRIPTION OF REFERENCE NUMERALS

Network transmission equipment 1

Computer terminal 2

The first computer terminal 201

Second computer terminal 202

The third computer terminal 203

Fourth computer terminal 204

Network Security Management System 100

Setting module 10

Path table 11

Check module 20.

Best Mode of the Invention

In order to facilitate the description of the central idea of the present invention expressed in the above column of the content of the invention, it is now expressed in specific embodiments. The various objects in the embodiment are drawn according to the proportion, size, deformation or displacement suitable for explanation, rather than drawn according to the proportion of the actual element, which will be described first.

1 to 3, the present invention provides a network security management system 100, which is set up on a network transmission device 1 of an internal area network. The network transmission device 1 is connected to a plurality of computer terminals 2. Among them, in the embodiment of the present invention Here, the network transmission equipment 1 is selected from any one of a hub, a switch, and a router.

The network security management system 100 of the present invention includes: a setting module 10 and a checking module 20.

The setting module 10 is provided with a path table 11, which stores the communication authority of each computer terminal 2 corresponding to a specific computer terminal 2, wherein the path table 11 stores the Internet protocol address of each computer terminal 2 at the network layer ( IP Address) and the communication authority of the communication port (PORT) used by the application software on the transport layer. Furthermore, the media access control address (Media Access Control Address) of each computer terminal 2 may also be stored; in the embodiment of the present invention Each computer terminal 2 has the same communication port (PORT) corresponding to the specific computer terminal 2.

For example: the network transmission equipment 1 is connected to four computer terminals 2, and the computer terminals 2 are the first computer terminal 201, the second computer terminal 202, the third computer terminal 203, and the fourth computer terminal 204, and the setting module 10 The communication permissions allowed for transmission or reception are set in the path table 11 as follows: the first computer terminal 201 specifies the Internet protocol address of the second computer terminal 202, the second computer terminal 202 specifies the transmission of information to the third computer terminal 203 and The internet protocol address of the fourth computer terminal 204. The fourth computer terminal 204 specifies the internet protocol address to transmit credit to the first computer terminal 201; the PORT number used by the A application software of the first computer terminal 201 is 01, and the second computer terminal 202’s A application software will use the same PORT number as 01; the second computer terminal 202’s B application software and C application software’s PORT numbers are 02 and 03, and the third computer terminal 203’s B application software will use the same PORT number. The PORT number is 02, the C application software of the fourth computer terminal 204 will use the same PORT number as 03; the D application software of the fourth computer terminal 204 uses the PORT number 04, and the D application software of the first computer terminal 201 will Use the same PORT number as 04.

Furthermore, the path table 11 also stores the media access control addresses of the first computer terminal 201, the second computer terminal 202, the third computer terminal 203, and the fourth computer terminal 204, respectively.

The checking module 20 is used for receiving a data packet transmitted by one of the computer terminals 2. The data packet has a communication data, and the communication data is the Internet Protocol address, communication port and media access control address of the sending and target receiving computer terminal 2. The checking module 20 judges the communication data of the data packet through the path table 11, where, when the communication data of the data packet meets the communication authority of the path table 11, the data packet is transmitted to the corresponding target computer terminal 2 according to the communication data; When the core module 20 judges that the communication data of the data packet cannot correspond to the path table 11, the verification module 20 deletes the data packet and returns a failure message, as shown in FIG. 3.

For example: when the first computer terminal 201 requests the network transmission device 1 to send a data packet to the second computer terminal 202, the checking module 20 will determine whether the communication data of the data packet meets the communication authority of the route table 11, that is, checking The core module 20 first judges that the sending end is the first computer terminal 201 based on the Internet Protocol address and the media access control address; then, the check module 20 judges that among the data packets transmitted by the first computer terminal 201, the object to be transmitted is the second The Internet Protocol address of the computer terminal 202 and the port number of the used communication port is 01, which conforms to the communication authority of the path table 11. Therefore, it is determined that the data packet conforms to the transmission communication authority.

Therefore, when the checking module 20 determines that the data packet transmitted by the first computer terminal 201 meets the communication authority stored in the path table 11, the network transmission device 1 transmits the data packet to the target second computer terminal 202.

Conversely, when the data packet transmitted by the first computer terminal 201 cannot meet the communication authority of the route table 11, the network transmission device 1 can delete or ignore the data packet, and choose whether to return the failure information to the transmission first computer terminal 201, and notify The data packet transmitted by the first computer terminal 201 is not successfully transmitted to the target second computer terminal 202; wherein, the data packet cannot meet the communication authority of the routing table 11 in any or more of the following situations:

1. The media access control address of the transmitting computer terminal 2 is not stored in the path table 11, which means that the transmitting computer terminal 2 is not originally connected to the internal area network, and may be a newly added computer terminal 2.

2. The data packet sent by the sending computer terminal 2 is not sent to the Internet Protocol address specified in the path table 11, which means that the sending computer terminal 2 wants to send to another unauthorized destination computer terminal 2, and the destination computer terminal 2 It is not permitted by the path table 11.

3. The communication port that transmits the data packet transmitted by the computer terminal 2 is not the communication port allowed in the path table. Since each application software uses a specific communication port for credit transmission, the foregoing situation indicates the communication port for the software used by the computer terminal 2 Application software not intended to be used by default.

1 to 3, through the above-mentioned network security management system 100, the present invention provides a network security management method, which includes the following steps:

The communication authority of each computer terminal 2 connected to the internal area network corresponding to the specific computer terminal 2 is set in the network transmission device 1 through the setting module 10.

Then, when one of the computer terminals 2 requests to send a data packet to the other computer terminal 2, the checking module 20 will determine whether the communication data of the data packet meets the communication authority stored in the path table 11.

When the communication data of the data packet meets the communication authority, the network transmission device 1 will transmit the data packet to the target computer terminal 2; if the communication data of the data packet cannot meet the communication authority, the data packet will be deleted or ignored , And choose whether to return a failure message.

In summary, the effects that the present invention can achieve:

1. The network security management system 100 of the present invention can confirm whether the data packets transmitted by each computer terminal 2 meet the exclusive communication authority between each computer terminal 2 through the path table 11 stored in the setting module 10 and the checking module 20 In this way, even if the computer terminal 2 of any endpoint is infected with malicious programs or viruses due to any factor, it can effectively prevent the computer terminals 2 from further infecting data viruses with each other to ensure the security of data transmission.

2. The present invention only needs to judge whether the data packet is allowed or blocked according to the Internet Protocol address and communication port in the data packet, and does not need to judge the actual internal transmission characteristics and information of the data packet to judge whether it is a virus as required by the firewall. Therefore, the present invention will not affect the transmission speed of the internal network.

3. The network security management system 100 of the present invention can operate on the network transmission equipment 1, so as to achieve the effect of fast checking and secure credit exchange without affecting the performance of the existing network, and no additional hardware equipment is required.

4. When the data packet cannot correspond to the path table 11, the data packet is deleted and the failure information is returned; this can prevent the problematic data packet from still existing in the network security management system 100, and prevent the problematic data packet from causing disease or The risk of infection exists.

Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by a person of ordinary skill in the art without making creative efforts fall within the protection scope of the present invention.

Claims

A network security management system, which is set up on a network transmission device of an internal area network, and the network transmission device is connected to a plurality of computer terminals, characterized in that the network security management system includes:

A setting module, which is provided with a path table that stores the communication authority of each computer terminal corresponding to the computer terminal; and

A checking module for receiving a data packet sent by one of the computer terminals, the data packet having a communication data; the checking module determines the communication data through the path table, wherein, when the communication data of the data packet When the communication authority of the path table is met, the data packet is transmitted to the computer terminal corresponding to the target according to the communication data.
The network security management system of claim 1, wherein the check module determines that the communication data of the data packet cannot correspond to the path table, then the check module deletes or ignores the data packet, and selects whether to return Send a failure message.
The network security management system of claim 1, wherein the path table stores the information of each computer terminal at the network layer The communication authority of the Internet protocol address and the communication port used by the application software in the transport layer.
4. The network security management system of claim 3, wherein the communication data is an Internet Protocol address or a communication port of the computer terminal.
3. The network security management system of claim 3, wherein the path table stores a media access control address allowing the computer terminal.
The network security management system according to claim 1, wherein the network transmission equipment is selected from any one of a hub, a switch and a router.
A network security management method, which is applied to an internal area network, and a network transmission device is connected to multiple computer terminals, characterized in that the network security management method includes the following steps:

Set a communication authority for each computer terminal corresponding to a specific computer terminal on the network transmission equipment;

When one of the computer terminals requests to transmit a data packet to another computer terminal, determine whether the data packet meets the communication authority; and

When the data packet complies with the communication authority, the network transmission device transmits the data packet to the target computer terminal.
8. The network security management method of claim 7, wherein when the data packet cannot meet the communication authority, the data packet is deleted or ignored, and a failure message is selected whether to return.
8. The network security management method of claim 7, wherein the communication authority is that each computer terminal corresponds to an Internet Protocol address of a specific computer terminal at the network layer and a communication port of the application software at the transport layer.
7. The network security management method of claim 7, wherein a path table is established in the network transmission device according to the communication authority of each computer terminal corresponding to the computer terminal allowed to transmit; the data is determined by the path table Whether the transfer destination of the packet is allowed.
10. The network security management method of claim 10, wherein the path table stores a media access control address of the computer terminal.