WO2023174143A1

WO2023174143A1 - Data transmission method, device, medium and product

Info

Publication number: WO2023174143A1
Application number: PCT/CN2023/080407
Authority: WO
Inventors: 聂百川
Original assignee: 阿里巴巴（中国）有限公司
Priority date: 2022-03-18
Filing date: 2023-03-09
Publication date: 2023-09-21
Also published as: CN114726513A

Abstract

Disclosed in embodiments of the present disclosure are a data transmission method, a device, a medium and a product. The method comprises: sending a first data packet to a destination port of a destination server for the first time; receiving a destination unreachable message sent by the destination server, the destination unreachable message being used for instructing a client to initiate authentication; in response to receiving the destination unreachable message, generating and returning an authentication data packet, the authentication data packet carrying authentication information; and re-sending the first data packet to the destination port of the destination server. According to the technical solution, the security risk of the exposed surface of the underlying network in the delivery type data center can be reduced, and the cloud platform is protected.

Description

Data transmission methods, equipment, media and products

This application claims priority to the Chinese patent application filed with the China Patent Office on March 18, 2022, with the application number 202210273119.0 and the application name "Data transmission method, equipment, media and products", the entire content of which is incorporated herein by reference. Applying.

Technical field

The embodiments of the present disclosure relate to the field of communication technology, and specifically relate to a data transmission method, device, medium and product.

Background technique

In the new delivery data center scenario, the service provider of the cloud platform will deploy physical servers and other physical networks into the user's computer room, and deploy cloud products to these physical servers. In this way, the underlay of the cloud platform (bottom layer) The network will be exposed beyond the boundaries of the service provider's network isolation and security operation and maintenance, and it will rely heavily on the user's management and protection methods. The risk of attacking the cloud platform through the underlying network will rise sharply. The east-west and north-south communications of the cloud platform are exposed on the underlying network and can be subject to network attacks such as network sniffing, packet hijacking/tampering, listening port scanning and port attacks. Therefore, how to reduce the exposure of the underlying network in the delivery data center Security risks, protecting the cloud platform has become an urgent technical issue that needs to be solved.

Contents of the invention

Embodiments of the present disclosure provide a data transmission method, device, medium and product.

In a first aspect, an embodiment of the present disclosure provides a data transmission method.

Specifically, the data transmission method includes:

Send the first data packet to the destination port of the destination server for the first time;

Receive a destination unreachable message sent by the destination server, where the destination unreachable message is used to instruct the client to initiate authentication;

In response to receiving the destination unreachable message, generate and return an authentication data packet, the authentication data packet carrying authentication information;

Resend the first data packet to the destination port of the destination server.

In a possible implementation, the destination unreachable message carries a random value, and the method further includes:

Obtain the shared secret key of the client;

Use the shared key to perform encryption calculations on the random value and the information to be encrypted to obtain an authentication code. The information to be encrypted includes the client identification, or may also include the current timestamp;

Generate and return authentication data packets, including:

Encapsulate the information to be encrypted and the authentication code in a data packet to generate an authentication data packet;

Send the authentication data packet to the destination server.

In a possible implementation, in response to receiving the destination unreachable message, generating and returning an authentication data packet includes:

The client's transport layer or socket layer responds to the destination unreachable message and generates and returns an authentication data packet. The socket layer is located between the transport layer and the application layer in the protocol stack.

In a possible implementation, the method further includes:

Periodically receive destination unreachable messages sent by the destination server.

In a possible implementation, using the shared key to perform encryption calculations on the random value and the information to be encrypted to obtain an authentication code includes:

Using the shared key, the random value, the information to be encrypted, and the number of authentication times are encrypted and calculated to obtain an authentication code. The number of authentication times includes the number of times the client is instructed by the destination server to initiate authentication.

In a second aspect, an embodiment of the present disclosure provides a data transmission method.

Specifically, the data transmission method includes:

When receiving the first data packet sent by the client for the first time, discard the first data packet;

Return a destination unreachable message to the client, where the destination unreachable message is used to instruct the client to initiate authentication;

Receive an authentication data packet sent by the client, where the authentication data packet carries authentication information;

When it is determined based on the authentication information that the client has the authority to access the destination port, grant access to the destination port for the client;

The first data packet resent by the client is received through the destination port.

In a possible implementation, the destination unreachable message carries a random value, the authentication information includes information to be encrypted and an authentication code, and the information to be encrypted includes a client identifier, or also includes a current timestamp; Determining that the client has the authority to access the destination port based on the authentication information includes:

Based on the client identification query, the shared key and access rights of the client are obtained, and the access rights are used to limit the accessible ports of the client on the destination server;

Use the shared key to perform encryption calculations on the random value and the information to be encrypted to obtain a verification code;

When the verification code and the authentication code are the same, if the accessible port of the destination server by the client includes the destination port to which the first data packet is to arrive, it is determined that the client has the ability to access the destination port. permissions.

In a possible implementation, after allowing access to the destination port for the client, the method further includes:

Periodically send destination unreachable messages to the client.

In a possible implementation, using the shared key to perform encryption calculations on the random value and the information to be encrypted to obtain a verification code includes:

Use the shared key to perform encryption calculations on the random value, the information to be encrypted, and the number of verification times to obtain a verification code. The number of verification times includes the number of times the destination server verifies whether the client has permission to access the destination port. .

In a third aspect, an embodiment of the present disclosure provides a data transmission method.

Specifically, the data transmission method includes:

The client executes the method described in the first aspect, and the destination server executes the method described in the second aspect.

In a fourth aspect, an embodiment of the present disclosure provides a data transmission device.

Specifically, the data transmission device includes:

The first sending module is configured to send the first data packet to the destination port of the destination server for the first time;

The first receiving module is configured to receive a destination unreachable message sent by the destination server, where the destination unreachable message is used to instruct the client to initiate authentication;

A response module configured to generate and return an authentication data packet in response to receiving the destination unreachable message, where the authentication data packet carries authentication information;

The second sending module is configured to resend the first data packet to the destination port of the destination server.

In a possible implementation, the destination unreachable message carries a random value, and the device further includes:

A first acquisition module configured to acquire the shared key of the client;

The first calculation module is configured to use the shared key to perform encryption calculations on the random value and the information to be encrypted to obtain an authentication code, where the information to be encrypted includes a client identification or a current timestamp;

The part of the response module that generates and returns authentication data packets is configured as:

Send the authentication data packet to the destination server.

In a possible implementation, the part of the response module that generates and returns an authentication data packet in response to receiving the destination unreachable message is configured as:

In a possible implementation, the device further includes:

The second receiving module is configured to regularly receive destination unreachable messages sent by the destination server.

In a possible implementation, the first computing module is configured as:

Specifically, the data transmission device includes:

A discarding module configured to discard the first data packet sent by the client for the first time when receiving the first data packet;

The third sending module is configured to return a destination unreachable message to the client, where the destination unreachable message is used to instruct the client to initiate authentication;

The third receiving module is configured to receive the authentication data packet sent by the client, where the authentication data packet carries authentication information;

An opening module configured to allow access to the destination port for the client when it is determined based on the authentication information that the client has the authority to access the destination port;

The fourth receiving module is configured to receive the first data packet resent by the client through the destination port.

In a possible implementation, the destination unreachable message carries a random value, the authentication information includes information to be encrypted and an authentication code, and the information to be encrypted includes a client identifier, or also includes a current timestamp; The part of the opening module that determines that the client has the permission to access the destination port based on the authentication information is configured as:

In a possible implementation, the device further includes:

The fourth sending module is configured to regularly send destination unreachable messages to the client.

In a sixth aspect, an embodiment of the present disclosure provides a data transmission device.

Specifically, the data transmission device includes:

a client configured to perform the method described in the first aspect;

The destination server is configured to perform the method described in the second aspect.

In a seventh aspect, embodiments of the present disclosure provide an electronic device, including a memory and a processor. The memory is used to store one or more computer instructions that support the above device to perform the above method. The processor is configured to Execute computer instructions stored in the memory.

In an eighth aspect, embodiments of the present disclosure provide a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed by a processor, the method steps described in any of the above aspects are implemented.

In a ninth aspect, embodiments of the present disclosure provide a computer program product, including a computer program/instruction, wherein when the computer program/instruction is executed by a processor, the method steps described in any of the above aspects are implemented.

The technical solutions provided by the embodiments of the present disclosure may include the following beneficial effects:

The above technical solution can be used when the client sends the first data packet to the destination port of the server for the first time, and the server refuses to receive it and sends a destination unreachable message to the client, instructing the client to initiate authentication; the client responds by receiving the destination The unreachable message generates and returns an authentication data packet carrying authentication information. Only when the server determines that the client has the authority to access the destination port based on the authentication information will it open access to the destination port for the client. , at this time, the client can legally access the destination port of the server, and the client can re-send the first data packet to the destination port of the server for access. In this way, by setting the server to reject all access from unverified clients and hiding the server's port, only those who pass authentication can access the server's port, which reduces the cost in the delivery data center. Security risks on the exposed surface of the underlying network to protect the cloud platform.

It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and do not limit the embodiments of the present disclosure.

Description of the drawings

Other features, objects, and advantages of embodiments of the present disclosure will become more apparent from the following detailed description of the non-limiting embodiments in conjunction with the accompanying drawings. In the attached picture:

Figure 1 shows a structural block diagram of a cloud platform according to an embodiment of the present disclosure.

FIG. 2 shows a flow chart of a data transmission method applied to a client according to an embodiment of the present disclosure.

FIG. 3 shows a flow chart of a data transmission method applied to a destination server according to an embodiment of the present disclosure.

FIG. 4 shows an overall flow chart of a data transmission method according to an embodiment of the present disclosure.

FIG. 5 shows a structural block diagram of a data transmission device applied to a client according to an embodiment of the present disclosure.

FIG. 6 shows a structural block diagram of a data transmission device applied to a destination server according to an embodiment of the present disclosure.

FIG. 7 shows a structural block diagram of an electronic device according to an embodiment of the present disclosure.

FIG. 8 is a schematic structural diagram of a computer system suitable for implementing the method according to an embodiment of the present disclosure.

Detailed ways

Hereinafter, exemplary implementations of embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. Furthermore, for the sake of clarity, parts irrelevant to describing the exemplary embodiments are omitted in the drawings.

In the embodiments of the present disclosure, it should be understood that terms such as "comprising" or "having" are intended to indicate the presence of features, numbers, steps, acts, components, portions, or combinations thereof disclosed in this specification, and are not intended to indicate Excludes the possibility that one or more other features, numbers, steps, acts, parts, portions or combinations thereof exist or are added.

In addition, it should be noted that the embodiments and features in the embodiments of the present disclosure can be combined with each other as long as there is no conflict. The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings and embodiments.

In this disclosure, the acquisition of user information or user data is an operation authorized, confirmed by the user, or actively selected by the user.

As mentioned before, in the new delivery data center scenario, the service provider of the cloud platform will deploy physical servers and physical networks into the user's computer room, and deploy cloud products to these physical servers. In this way, the cloud platform The underlying network will be exposed outside the boundaries of the service provider's network isolation and security operation and maintenance, and is greatly dependent on the user's management and protection methods. The risk of attacking the cloud platform through the underlying network has increased sharply. The east-west and north-south communications of the cloud platform are exposed on the underlying network and can be subject to network attacks such as network sniffing, packet hijacking/tampering, listening port scanning and port attacks. Therefore, how to reduce the exposure of the underlying network in the delivery data center Security risks, protecting the cloud platform has become an urgent technical issue that needs to be solved.

As shown in Figure 1, the service provider side provides various cloud products for enterprises on the enterprise user side. These cloud products will be deployed on the user-side servers on the enterprise user side. The east-west traffic of the underlying network is switched on the local switching network on the enterprise user side. Complete, the northbound traffic of the underlying network requires the service provider side to open the southbound port of the service provider server on the enterprise user side, and the southbound traffic of the underlying network requires the enterprise user side to open the northbound port of the user-side server on the service provider side. The service provider side will configure network isolation and security operation and maintenance to protect the network on the service provider side, while the network on the enterprise user side relies heavily on the user's management and protection methods. In the process of port access from one server to another server Since the east-west and south-bound ports are exposed to the enterprise user side, network attacks such as network sniffing, packet hijacking/tampering, listening port scanning and port attacks can be implemented, which increases the risk of attacking the cloud platform through the underlying network. increase rapidly.

Considering the above problems, the present disclosure proposes a data transmission method. When the client sends the first data packet to the destination port of the server for the first time, the server refuses to receive it and sends a destination unreachable message to the client, instructing the client to initiate Authentication: In response to receiving the destination unreachable message, the client generates and returns an authentication data packet carrying authentication information. The server will only provide authentication information based on the authentication information when it determines that the client has the authority to access the destination port. The client opens access to the destination port. At this time, the client can legally access the destination port of the server, and the client can re-send the first data packet to the destination port of the server for access. In this way, by setting the server to reject all access from unverified clients and hiding the server port, the server port can only be accessed after passing the authentication, which reduces the security risk of the underlying network exposure in the delivery data center and protects the cloud platform. .

Figure 2 shows a flow chart of a data transmission method applied to a client according to an embodiment of the present disclosure. As shown in Figure 2, the data transmission method includes the following steps S201-S204:

In step S201, the first data packet is sent to the destination port of the destination server for the first time;

In step S202, receive a destination unreachable message sent by the destination server, where the destination unreachable message is used to instruct the client to initiate authentication;

In step S203, in response to receiving the destination unreachable message, generate and return an authentication data packet, where the authentication data packet carries authentication information;

In step S204, the first data packet is re-sent to the destination port of the destination server.

In an embodiment of the present disclosure, the data transmission method can be applied to data transmission within the underlying network in a delivery data center. The data transmission in the underlying network is as shown in Figure 1, including user-side servers on the enterprise user side. access between the east-west ports of the enterprise user side and the southbound port of the service provider side server from the user-side server on the enterprise user side. Each server in the network is installed with multiple applications, and different applications can provide different services. In this embodiment, the application in the source server that initiates access is called a client, which can also be called IH (Initiating Host). , initiating host) process, the application that receives the destination server for access is called the server, which can also be called AH (Accepting Host, receiving host) process. Each client initiating access has its own IHIP and IHport (IH port ), that is, source IP and source port. The server receiving the access also has its own AHIP and AHport, that is, destination IP and destination port. The data packet sent by the client to the server carries the source IP, source port, and destination. IP, destination port to indicate the source and destination of the packet.

In an embodiment of the present disclosure, when the client wants to initiate access to the server, it will send a request to the destination where the server is located. The destination port of the server (that is, the port corresponding to the server) sends the first data packet. The first data packet at this time is sent for the first time. When the client passes through each protocol layer in the process of sending data, it must attach the protocol header and protocol tail of the corresponding layer, that is, the data must be protocol encapsulated to identify the communication protocol used by the corresponding layer. In TCP/IP There are two main protocols at the transport layer, namely TCP (Transmission Control Protocol) and UDP (User Datagram Protocol). Therefore, the first data packet sent by the client can be a TCP packet or It's a UDP packet. For example, if the data transmission protocol between the client and the server is the TCP protocol, the client needs to perform a three-way handshake with the server to establish a connection. At this time, the first data packet sent by the client is TCP SYN (Synchronize Sequence Numbers, Synchronization sequence number) packet, the transport layer of the client protocol stack will construct a TCP SYN packet and send it to the lower layer protocol stack for data transmission. If the data transmission protocol between the client and the server is the UDP protocol, then the client protocol The transport layer of the stack will directly encapsulate the UDP data message and send it to the lower protocol stack for data transmission.

In an embodiment of the present disclosure, each server in the underlying network is configured with a firewall, such as an SDP (Software Defined Perimeter, Software Defined Perimeter) firewall, and the client's access to each server on the server needs to pass through the firewall. The firewall has a deny all policy that denies access to all unverified clients, so each port of the server is invisible to the network. Therefore, when the destination server receives the first data packet sent by the client for the first time, it will directly discard the first data packet and send a destination unreachable message to the client, instructing the client to initiate authentication. In the example, the destination is unreachable. The message may be an ICMP (Internet Control Message Protocol) message, and the ICMP message carries an identifier, which is an identifier that instructs the client to initiate authentication.

In an embodiment of the present disclosure, after receiving the destination unreachable message, the client will immediately construct an authentication data packet and send the authentication data packet to the destination server for authentication. The authentication data packet carries authentication information. , after the destination server receives the authentication data packet, it will determine whether the client has the authority to access its destination port based on the authentication information. If it is determined that the client has the authority to access its destination port, it indicates that the client It is a legal visitor to the destination port. At this time, the destination server will authorize the client's IHIP and IHport to access the server's AHIP and AHport. The IHIP refers to the IP of the destination server where the client is located. The IHport refers to the port corresponding to the client on the destination server, the AHIP refers to the IP of the destination server where the server is located, and the AHport refers to the destination port corresponding to the server on the destination server. In this way, the destination server allows the client access to the destination port, and the client can send a data packet to the destination port. The data packet sent by the client carries the client's IHIP, IHport and required information. The AHIP and AHport of the accessed server. After the destination server receives the packet, since it has been authorized to allow the client's IHIP and IHport to access the AHIP and AHport of the server, the firewall of the destination server will allow the source IP and source port carried. If the data packet of the client's IHIP and IHport as well as the destination IP and destination port is the server's AHIP and AHport, the server's AHport, also the destination port, can receive the data packet, allowing the server to provide corresponding services to the client. .

In an embodiment of the present disclosure, after the client sends the authentication data packet to the destination server, it will directly start the retransmission mechanism and resend the first data packet to the destination port of the destination server. If the authentication information determines that the client has the authority to access its destination port, the destination server can receive the first data packet through the destination port. Of course, if the destination server determines that the client does not have access based on the authentication information, If the destination port does not have the permissions, the destination server will discard the first data packet.

This implementation method sets the server to reject all access from unverified clients and hides the server port. Only authorized ports can be accessed after passing the authentication. This reduces the security risk of the underlying network exposure in the delivery data center and protects the cloud. platform. In addition, the authorization granularity of the access rights for each port is for the client level, and the policy control granularity is refined to the client, that is, the IH process. After an illegal application client invades the destination server, it cannot access without authorization. The destination port service of the destination server; it also provides authentication capabilities for each server's firewall, instead of setting up an independent authentication server for authentication, avoiding a single point of failure.

In a possible implementation, in the above data transmission method, the destination unreachable message carries a random value, and the method further includes:

Obtain the shared secret key of the client;

Generate and return authentication data packets, including:

Send the authentication data packet to the destination server.

In this implementation, for example, the destination unreachable message may be an ICMP destination unreachable message, and the message format of the ICMP destination unreachable message may be as shown in Table 1 below:

Table 1

As shown in Table 1, the type field in the ICMP destination unreachable message has 8 bits, which is used to identify the type of this message as an ICMP error report message. The code field has 8 bits, which is used to identify the error report message. The type of message. In this embodiment, the type of error report message is destination unreachable, which can be identified by a predetermined code field. The checksum field has 16 bits and is the checksum of the entire ICMP data packet including the data part. The ICMP error report message conforms to the RFC (Request For Comments) 792 protocol. In the existing technology, if the ICMP error report message is of destination unreachable type, the data part is unused. The ICMP destination unreachable message provided in this embodiment is different from the existing destination unreachable message. An identifier needs to be filled in the data part to indicate that the ICMP destination unreachable message instructs the client to initiate authentication.

In this implementation, the destination unreachable message carries a random value, which is a Nonce (Number once) value. In cryptography, Nonce is an arbitrary or non-repeating random value that is used only once. This random value is used for subsequent authentication. For example, the random value can be filled in the corresponding field in the data part of the ICMP unreachable message.

In this embodiment, after receiving the destination unreachable message, the client can take out the random value from the destination unreachable message, and then start building an authentication data packet. The authentication data packet can be SPA (Single Packet Authorization (single packet authentication) packet, the authentication data packet includes information to be encrypted and an authentication code. The information to be encrypted may include the client identification (ClientID), or may also include the current timestamp. The ClientID is an identity assigned to the client. It can index the client's shared key and port access permissions, that is, the destination port that the client is authorized to access. The client's shared key is the client and the port it can access. Both parties of the destination port server know that the authentication code is calculated by using the client's shared key to encrypt the random value and the information to be encrypted. For example, the authentication code can be HMAC (Hash Operation Message Authentication) Hash-based Message Authentication Code), which is used for identity authentication, message integrity protection and message replay attack prevention.

In this implementation, the client needs to encapsulate the information to be encrypted and the authentication code in a data packet, construct an authentication data packet, and then send the authentication data packet to the destination server. The firewall of the destination server receives the authentication data packet. When authenticating a data packet, the information to be encrypted and the authentication code in the data packet can be obtained. The destination server can query the client's shared key and access rights based on the ClientID in the information to be encrypted, and use the shared secret key. The key performs encryption calculation on the random value (sent to the client by the destination server, so the destination server knows the random value) and the information to be encrypted to obtain a verification code. If the verification code is the same as the authentication code, then Indicates that the client is a legitimate client. At this time, the destination server will query the client's access rights to determine whether the client has the authority to access the destination port. If the client has the authority to access the destination port, the destination server will Opening the destination port for the client means allowing the client's IHIP and IHport to access the server's AHIP and AHport (i.e. the destination port). If the client does not have the permission to access the destination port, the destination server will not access the destination port for the client. The end-end opens the destination port and refuses to receive the data packet sent by the client to the destination port. If the verification code is different from the authentication code, it means that the client is not a legitimate client. At this time, the destination server will continue to reject the data packets sent by the client.

In a possible implementation, step S103 in the above data transmission method may include the following steps:

The client's transport layer or socket layer responds to the destination unreachable message and generates and returns an authentication data packet. The socket layer is located between the transport layer and the application layer in the client protocol stack.

In this implementation, in order to realize the transparency of the authentication process to the client, this implementation needs to modify the transport layer, or add a socket layer between the transport layer and the application layer to process the destination unreachable message and Construct authentication data packet.

In the existing technology, when the client's protocol stack receives the destination unreachable message, it will process it step by step and finally feed it back to the application layer for processing. This will be opaque to the application and requires the client to explicitly send an authentication data packet. Then resend the first data packet. In order to achieve transparency to the client, in this embodiment, when the client's protocol stack receives the destination unreachable message, it will process it step by step. When it reaches the transport layer or socket layer, the transport layer or socket layer can directly In response to the destination unreachable message, an authentication data packet is generated and returned.

In a possible implementation, the above data transmission method may also include the following steps:

In this implementation, after the client passes the authentication, the destination server will authorize and allow the client's IHIP and IHport to access the server's AHIP and AHport. At this time, if the attacker blocks the legitimate client's data packets and impersonates The client's IHIP and IHport can access the server's AHIP and AHport. In order to avoid man-in-the-middle attacks, a continuous authentication mechanism is introduced. The firewall in the destination server will periodically send destination unreachable messages and require the client sending the packet to continue authentication. If the other party does not respond or the returned authentication packet is incorrect, then Disconnect the connection and refuse to receive data packets from the client.

In this implementation, if it is not attacked, the client will regularly receive the destination unreachable message sent by the destination server, and in response to receiving the destination unreachable message, generate and return an authentication data packet. The authentication data packet carries authentication information; after the firewall authentication in the destination server passes, the connection with the client will be maintained and the destination port of the server will continue to be opened for the client.

In a possible implementation, in the above data transmission method, the shared key is used to perform encryption calculations on the random value and the information to be encrypted. The part of obtaining the authentication code may also include the following steps:

Using the shared key, the random value, the information to be encrypted, and the number of authentication times are encrypted and calculated to obtain an authentication code. The number of authentication times includes the number of times the client is instructed to initiate authentication when accessing the port of the destination server.

In this implementation, when the destination server regularly sends destination unreachable messages, in order to make the authentication more secure and more accurate, the shared key can be used to perform encryption calculations on the random value, the information to be encrypted, and the number of authentication times. , obtain the authentication code, and the number of authentication times includes the number of times the client is instructed by the destination server to initiate authentication. In this way, when the destination server receives the authentication data packet, it can use the found shared key to verify the random value (known) and the number of verifications (that is, the destination server determines whether the client has permission to access the destination port). The number of verifications (the destination server can record) and the information to be encrypted are encrypted and calculated to obtain a verification code. If the number of verifications is the same as the number of verifications, then the calculated verification code is the same as the verification code, indicating that the customer The client is a legitimate client.

Figure 3 shows a flow chart of a data transmission method applied to a destination server according to an embodiment of the present disclosure. As shown in Figure 3, the data transmission method includes the following steps S301-S305:

In step S301, when receiving the first data packet sent by the client for the first time, discard the first data packet;

In step S302, a destination unreachable message is returned to the client, where the destination unreachable message is used to instruct the client to initiate authentication;

In step S303, receive the authentication data packet sent by the client, where the authentication data packet carries authentication information;

In step S304, when it is determined that the client has the authority to access the destination port based on the authentication information, access to the destination port is granted to the client;

In step S305, the first data packet resent by the client is received through the destination port.

In an embodiment of the present disclosure, when the client wants to initiate access to the server, it will send the first data packet to the destination port of the destination server where the server is located (that is, the port corresponding to the server). At this time, the first data packet Sent for the first time. Each server in the underlying network is configured with a firewall, such as an SDP (Software Defined Perimeter) firewall. This firewall has a deny all policy, which denies access to all unverified clients. Therefore, the server's ports are not visible to the network. Therefore, when the destination server receives the client When the first data packet is sent for the first time, the first data packet will be discarded directly, and a destination unreachable message will be sent to the client, instructing the client to initiate authentication. For example, the destination unreachable message may be ICMP (Network Control Message). Protocol, Internet Control Message Protocol) message, the ICMP message carries an identifier, and the identifier is an identifier that instructs the client to initiate authentication.

In an embodiment of the present disclosure, after the client sends the authentication data packet to the destination server, it will directly start the retransmission mechanism and resend the first data packet to the destination port of the destination server. If the destination server is based on the authentication If the information determines that the client has the authority to access its destination port, the destination server can receive the first data packet through the destination port. Of course, if the destination server determines that the client does not have the authority to access its destination based on the authentication information. port permissions, the destination server will discard the first data packet.

What needs to be explained here is that after the destination server passes the authentication of the client, its firewall will restore the Deny ALL state, and the established connection is maintained by the Connection Tracking mechanism.

This implementation method sets the server to reject all access from unverified clients and hides the server port. Only authorized ports can be accessed after passing the authentication. This reduces the security risk of the underlying network exposure in the delivery data center and protects the cloud. platform.

Based on the client identification query, the shared key and access rights of the client are obtained, and the access rights are used to limit the accessible ports of the client on the server;

When the verification code and the authentication code are the same, if the client includes all If the first data packet reaches the destination port, it is determined that the client has the authority to access the destination port.

In this implementation, after receiving the destination unreachable message, the client can take out the random value from the destination unreachable message, and then start building an authentication data packet. The authentication data packet includes the information to be encrypted and the authentication code. The information to be encrypted may include the client identification (ClientID), or may also include the current timestamp. The ClientID is an identity assigned to the client, which can index the client's shared secret key and port access rights, that is, the destination port that the client is authorized to access. The authentication code is calculated by encrypting the random value and the information to be encrypted using the client's shared key. For example, the authentication code can be HMAC. The authentication code is used for identity authentication, message integrity protection and reporting. Defend against replay attacks.

What needs to be explained here is that when defining access rights, you do not need to know the client’s information. You only need to define the source IP and source port that have access rights to the destination IP and destination port. As long as the source of the IP layer of the authentication packet is The source port in the IP and sPort (source port) fields is the source IP and source port with the access permission, which means that the client has the permission to access the destination port.

Periodically send destination unreachable messages to the client.

In this implementation, after the client passes the authentication, the destination server will authorize and allow the client's IHIP and IHport to access the server's AHIP and AHport. At this time, if the attacker blocks the legitimate client's data packets and impersonates the client's IHIP and IHport can access the AHIP and AHport of the server. In order to avoid man-in-the-middle attacks, a continuous authentication mechanism is introduced. The firewall in the destination server will periodically send destination unreachable messages and require The client that sends the data packet continues to authenticate. If the other party does not respond or the returned authentication data packet is incorrect, the connection is interrupted and the client's data packet is refused to be received.

Using the shared key, the random value, the information to be encrypted, and the number of verification times are encrypted and calculated to obtain a verification code. The number of verification times includes the number of times the server verifies whether the client has permission to access the destination port.

In this implementation, when the destination server regularly sends destination unreachable messages, in order to make the authentication more secure and more accurate, the shared key can be used to perform encryption calculations on the random value, the information to be encrypted, and the number of authentication times. , obtain the authentication code, and the number of authentication times includes the number of times the client is instructed by the destination server to initiate authentication. In this way, when the destination server receives the authentication data packet, it can use the found shared key to verify the random value (known) and the number of verifications (that is, the destination server determines whether the client has permission to access the destination port). The number of verifications (the destination server can record) and the information to be encrypted are encrypted and calculated to obtain a verification code. If the number of verifications is the same as the number of verifications, then the calculated verification code is the same as the verification code, indicating that the customer The client is a legitimate client,

Figure 4 shows an overall flow chart of a data transmission method according to an embodiment of the present disclosure. As shown in Figure 4, the data transmission method includes the following steps S401-S406:

In step S401, the client sends the first data packet to the destination port of the destination server for the first time;

In step S402, when receiving the first data packet sent by the client for the first time, the destination server discards the first data packet;

In step S403, the destination server returns a destination unreachable message to the client, where the destination unreachable message is used to instruct the client to initiate authentication;

In step S404, the client generates and returns an authentication data packet in response to receiving the destination unreachable message, and the authentication data packet carries authentication information;

In step S405, when the destination server determines that the client has the authority to access the destination port based on the authentication information, it allows the client to access the destination port;

In step S406, the client resends the first data packet to the destination port of the destination server, and the destination server receives the first data packet resent by the client through the destination port.

In a possible implementation, as shown in Figure 4, the first data packet sent by the client to the destination port of the destination server for the first time will be intercepted and discarded by the firewall on the destination server, and the firewall on the destination server will The client returns a destination unreachable message, instructing the client to initiate authentication; the client responds to receiving the destination unreachable message, Generate and return an authentication data packet. When the destination server determines that the client has the authority to access the destination port based on the authentication information, it allows the client access to the destination port; in this way, the client re- The first data packet sent to the destination port of the destination server can be sent to the destination port of the destination server through the firewall and received by the server.

The client obtains the shared key of the client, uses the shared key to perform encryption calculations on the random value and the information to be encrypted, and obtains an authentication code. The information to be encrypted includes the client identification, or also includes the current timestamp;

The client generates and returns authentication data packets, including:

The client encapsulates the information to be encrypted and the authentication code in a data packet, generates an authentication data packet, and sends the authentication data packet to the destination server.

The destination server determines that the client has the authority to access the destination port based on the authentication information, including:

The destination server queries to obtain the shared key and access rights of the client based on the client identification. The access rights are used to limit the accessible ports of the client on the destination server; using the shared key Perform encryption calculation on the random value and the information to be encrypted to obtain a verification code; when the verification code and the authentication code are the same, if the client includes the header on the accessible port of the destination server, If the destination port that the data packet reaches is determined, it is determined that the client has the permission to access the destination port.

In a possible implementation, in response to receiving the destination unreachable message, the client generates and returns an authentication data packet, including:

The client responds to the destination unreachable message through the client's transport layer or socket layer, which is located between the transport layer and the application layer in the protocol stack, and generates and returns an authentication data packet.

In a possible implementation, the method further includes:

The destination server periodically sends destination unreachable messages to the client.

In a possible implementation, the client uses the shared key to perform encryption calculations on the random value and the information to be encrypted to obtain an authentication code, which includes:

The client uses the shared key to perform encrypted calculations on the random value, the information to be encrypted, and the number of authentication times to obtain an authentication code. The number of authentication times includes the number of times the client is instructed by the destination server to initiate authentication;

The destination server uses the shared key to perform encryption calculations on the random value and the information to be encrypted to obtain a verification code, which includes:

The destination server uses the shared key to perform encryption calculations on the random value, the information to be encrypted, and the number of verifications to obtain a verification code. The number of verifications includes whether the destination server has permission to access the destination port for the client. The number of times verification is performed.

The technical terms and technical features involved in the embodiments shown in Figure 4 and related embodiments are the same or similar to the technical terms and technical features shown in Figures 1-3 and related embodiments. For the embodiments shown in Figure 4 and related For explanations and explanations of the technical terms and technical features involved, please refer to the above explanations of the embodiments shown in FIGS. 1 to 3 and related embodiments, and will not be described again here.

The following are device embodiments of the present disclosure, which can be used to perform method embodiments of the present disclosure.

Figure 5 shows a structural block diagram of a data transmission device applied to a client according to an embodiment of the present disclosure. The device can be implemented as part or all of an electronic device through software, hardware, or a combination of both. As shown in Figure 5, the data transmission device includes:

The first sending module 501 is configured to send the first data packet to the destination port of the destination server for the first time;

The first receiving module 502 is configured to receive a destination unreachable message sent by the destination server, where the destination unreachable message is used to instruct the client to initiate authentication;

The response module 503 is configured to generate and return an authentication data packet in response to receiving the destination unreachable message, where the authentication data packet carries authentication information;

The second sending module 504 is configured to re-send the first data packet to the destination port of the destination server.

A first acquisition module configured to acquire the shared key of the client;

Send the authentication data packet to the destination server.

In a possible implementation, the device further includes:

In a possible implementation, the first computing module is configured as:

The technical terms and technical features involved in the embodiments shown in Figure 5 and related ones are the same or similar to the technical terms and technical features shown in Figures 1-3 and related embodiments. For the embodiments shown in Figure 5 and related For explanations and explanations of the technical terms and technical features involved, please refer to the above explanations of the embodiments shown in FIGS. 1 to 3 and related embodiments, and will not be described again here.

Figure 6 shows a structural block diagram of a data transmission device applied to a destination server according to an embodiment of the present disclosure. The device can be implemented as part or all of an electronic device through software, hardware, or a combination of both. As shown in Figure 6, the data transmission device includes:

The discarding module 601 is configured to discard the first data packet when receiving the first data packet sent by the client for the first time;

The third sending module 602 is configured to return a destination unreachable message to the client. The destination unreachable message The information is used to instruct the client to initiate authentication;

The third receiving module 603 is configured to receive the authentication data packet sent by the client, where the authentication data packet carries authentication information;

The opening module 604 is configured to allow the client to access the destination port when it is determined based on the authentication information that the client has the authority to access the destination port;

The fourth receiving module 605 is configured to receive the first data packet resent by the client through the destination port.

The destination unreachable message carries a random value, the authentication information includes information to be encrypted and an authentication code, and the information to be encrypted includes a client identifier or a current timestamp; the open module is based on the authentication The part of the information that determines that the client has the permission to access the destination port is configured as:

In a possible implementation, the device further includes:

The technical terms and technical features involved in the embodiments shown in Figure 6 and related embodiments are the same or similar to the technical terms and technical features shown in Figures 1-3 and related embodiments. For the embodiments shown in Figure 6 and related For explanations and explanations of the technical terms and technical features involved, please refer to the above explanations of the embodiments shown in FIGS. 1 to 3 and related embodiments, and will not be described again here.

The present disclosure also discloses an electronic device. Figure 7 shows a structural block diagram of an electronic device according to an embodiment of the present disclosure. As shown in Figure 7, the electronic device 700 includes a memory 701 and a processor 702; wherein,

The memory 701 is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor 702 to implement the above method steps.

As shown in FIG. 8 , the computer system 800 includes a processing unit 801 that can perform the above-described implementation according to a program stored in a read-only memory (ROM) 802 or loaded from a storage portion 808 into a random access memory (RAM) 803 Various processing methods. In the RAM 803, various programs and data required for the operation of the system 800 are also stored. The processing unit 801, ROM 802 and RAM 803 are connected to each other via a bus 804. Input/output (I/O) interface 805 Also connected to bus 804.

The following components are connected to the I/O interface 805: an input section 806 including a keyboard, a mouse, etc.; an output section 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., speakers, etc.; and a storage section 808 including a hard disk, etc. ; and a communication section 809 including a network interface card such as a LAN card, a modem, etc. The communication section 809 performs communication processing via a network such as the Internet. Driver 810 is also connected to I/O interface 805 as needed. Removable media 811, such as magnetic disks, optical disks, magneto-optical disks, semiconductor memories, etc., are installed on the drive 810 as needed, so that a computer program read therefrom is installed into the storage portion 808 as needed. Wherein, the processing unit 801 can be implemented as a processing unit such as CPU, GPU, TPU, FPGA, NPU, etc.

In particular, according to embodiments of the present disclosure, the method described above may be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product including a computer program tangibly embodied on a readable medium thereof, the computer program containing program code for performing the method described above. In such embodiments, the computer program may be downloaded and installed from the network via communications portion 809 and/or installed from removable media 811 .

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the roadmap or block diagram may represent a module, segment, or portion of code that contains one or more functions for implementing the specified logical function. Executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown one after another may actually execute substantially in parallel, or they may sometimes execute in the reverse order, depending on the functionality involved. It will also be noted that each block of the block diagram and/or flowchart illustration, and combinations of blocks in the block diagram and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or operations. , or can be implemented using a combination of specialized hardware and computer instructions.

The units or modules described in the embodiments of the present disclosure may be implemented in software or hardware. The described units or modules may also be provided in the processor, and the names of these units or modules do not constitute a limitation on the units or modules themselves under certain circumstances.

As another aspect, embodiments of the present disclosure also provide a computer-readable storage medium. The computer-readable storage medium may be the computer-readable storage medium included in the device described in the above embodiments; it may also exist independently. , a computer-readable storage medium that is not installed in the device. The computer-readable storage medium stores one or more programs, which are used by one or more processors to execute the methods described in the embodiments of the present disclosure.

The above description is only a description of the preferred embodiments of the present disclosure and the technical principles applied. Persons skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to technical solutions composed of specific combinations of the above technical features, but should also cover the above-mentioned technical solutions without departing from the inventive concept. Other technical solutions formed by any combination of technical features or their equivalent features. For example, a technical solution is formed by replacing the above features with technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to).

Claims

A data transmission method, including:

Send the first data packet to the destination port of the destination server for the first time;

Receive a destination unreachable message sent by the destination server, where the destination unreachable message is used to instruct the client to initiate authentication;

In response to receiving the destination unreachable message, generate and return an authentication data packet, the authentication data packet carrying authentication information;

Resend the first data packet to the destination port of the destination server.
The method according to claim 1, wherein the destination unreachable message carries a random value, and the method further includes:

Obtain the shared secret key of the client;

Use the shared key to perform encryption calculations on the random value and the information to be encrypted to obtain an authentication code. The information to be encrypted includes the client identification, or may also include the current timestamp;

Generate and return authentication data packets, including:

Encapsulate the information to be encrypted and the authentication code in a data packet to generate an authentication data packet;

Send the authentication data packet to the destination server.
The method according to claim 1, wherein the generating and returning an authentication data packet in response to receiving the destination unreachable message includes:

The client's transport layer or socket layer responds to the destination unreachable message and generates and returns an authentication data packet. The socket layer is located between the transport layer and the application layer in the protocol stack.
The method according to claim 1 or 2, wherein the method further includes:

Periodically receive destination unreachable messages sent by the destination server.
The method according to claim 4, wherein said using the shared key to perform encryption calculations on the random value and the information to be encrypted to obtain an authentication code includes:

Using the shared key, the random value, the information to be encrypted, and the number of authentication times are encrypted and calculated to obtain an authentication code. The number of authentication times includes the number of times the client is instructed by the destination server to initiate authentication.
A data transmission method, including:

When receiving the first data packet sent by the client for the first time, discard the first data packet;

Return a destination unreachable message to the client, where the destination unreachable message is used to instruct the client to initiate authentication;

Receive an authentication data packet sent by the client, where the authentication data packet carries authentication information;

When it is determined based on the authentication information that the client has the authority to access the destination port, grant access to the destination port for the client;

The first data packet resent by the client is received through the destination port.
The method according to claim 6, wherein the destination unreachable message carries a random value, the authentication information includes information to be encrypted and an authentication code, the information to be encrypted includes a client identifier, or also includes the current time timestamp; determining that the client has the authority to access the destination port based on the authentication information includes:

Based on the client identification query, the shared key and access rights of the client are obtained, and the access rights are used to limit the accessible ports of the client on the destination server;

Use the shared key to perform encryption calculations on the random value and the information to be encrypted to obtain a verification code;

When the verification code and the authentication code are the same, if the accessible port of the destination server by the client includes the destination port to which the first data packet is to arrive, it is determined that the client has the ability to access the destination port. permissions.
The method according to claim 6 or 7, wherein after allowing access to the destination port for the client, the method further includes:

Periodically send destination unreachable messages to the client.
The method according to claim 8, wherein said using the shared key to perform encryption calculations on the random value and the information to be encrypted to obtain a verification code includes:

Use the shared key to perform encryption calculations on the random value, the information to be encrypted, and the number of verification times to obtain a verification code. The number of verification times includes the number of times the destination server verifies whether the client has permission to access the destination port. .
A data transmission method, including:

The client executes the method described in any one of claims 1 to 5, and the destination server executes the method described in any one of claims 6 to 9.
An electronic device including a memory and at least one processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the at least one processor to implement the claims The method steps described in any one of 1-10.
A computer-readable storage medium on which computer instructions are stored, which implement the method steps described in any one of claims 1-10 when executed by a processor.
A computer program product includes a computer program/instruction, wherein when the computer program/instruction is executed by a processor, the method steps described in any one of claims 1-10 are implemented.