WO2023241363A1 - 通信防护方法、系统、电子设备及存储介质 - Google Patents

通信防护方法、系统、电子设备及存储介质 Download PDF

Info

Publication number
WO2023241363A1
WO2023241363A1 PCT/CN2023/097581 CN2023097581W WO2023241363A1 WO 2023241363 A1 WO2023241363 A1 WO 2023241363A1 CN 2023097581 W CN2023097581 W CN 2023097581W WO 2023241363 A1 WO2023241363 A1 WO 2023241363A1
Authority
WO
WIPO (PCT)
Prior art keywords
communication
data message
verification
transmission node
receiving end
Prior art date
Application number
PCT/CN2023/097581
Other languages
English (en)
French (fr)
Inventor
闫新成
周娜
蒋志红
宋琳
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2023241363A1 publication Critical patent/WO2023241363A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the field of communication technology, and in particular, to a communication protection method, system, electronic equipment and storage medium.
  • Network cloudification/generalization is evolving, 2B and 2C services are merging, network openness and exposure are constantly increasing, the "border" of network security is further blurred, attack methods continue to upgrade, and the traditional "patch" security design model has rigid structures and Problems such as hindsight and lack of coordination, stacked and reinforced security architecture, and passive protection modes that rely on prior knowledge are difficult to meet the needs of new network security protection. Therefore, it is necessary to break through the traditional design model, inject more powerful security genes into the network, and carry out system security design from the aspects of identity, data, network, communication terminal and other requirements.
  • Network communication protection is based on the verification of access terminals and the protection of the receiving end to ensure the security and credibility of the network, and provide security guarantees for the normal operation of resources and normal business communication.
  • the purpose of this application is to solve the above problems and provide a communication protection method, system, electronic equipment and storage medium, which solves the problems of low protection efficiency, poor defense system and insufficient comprehensive protection in the business interworking process, and achieves the goal of protecting the communication interworking process.
  • the purpose of comprehensive and efficient protection is to solve the above problems and provide a communication protection method, system, electronic equipment and storage medium, which solves the problems of low protection efficiency, poor defense system and insufficient comprehensive protection in the business interworking process, and achieves the goal of protecting the communication interworking process.
  • the method includes: determining the type of data packet to be sent; wherein the type of data packet includes: a first data packet and a second data packet. text; the first data message is the first data message sent to the communication receiving end, and the second data message is not the first data message sent to the communication receiving end; the data message is the first data message If the data message is the second data message, perform strong verification on the data message; if the data message is the second data message, perform weak verification on the data message; where strong verification is the verification with stronger security than weak verification; in If the verification passes, a data message is sent to the communication receiving end.
  • embodiments of the present application provide a communication protection system, including: a communication initiating end, a communication receiving end, a first transmission node and at least one second transmission node; the first transmission node is used to perform the above communication protection Method; the second transmission node and the communication receiving end are used to perform the above communication protection method.
  • embodiments of the present application provide a communication protection system, including: a communication initiating end, a communication receiving end, and a first transmission node; the communication initiating end is used to perform the above communication protection method; the first transmission node and the communication receiving end is used to perform the above communication protection method.
  • embodiments of the present application also provide an electronic device, including: at least one processor; and and, a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor A processor is capable of executing the communication protection method described above.
  • embodiments of the present application also provide a computer-readable storage medium that stores a computer program.
  • the computer program is executed by a processor, the above communication protection method is implemented.
  • the communication protection method provided by the embodiment of the present application implements strong verification on the first data message sent to the communication receiving end, and only forwards the data message to the communication receiving end when the strong verification passes, thus achieving the establishment of While communicating with the communication receiving end, security verification is also performed to avoid the communication receiving end from being attacked and ensure the security and trustworthiness of the network.
  • weak verification is performed on non-first data packets sent to the communication receiving end. Authentication realizes that even if the communication receiving end is connected, weak verification is still required for the incoming and outgoing data packets, avoiding the potential risks brought by the data packets. Therefore, it solves the problem of low protection efficiency, poor defense system and protection in the business interaction process.
  • the problem of insufficient comprehensiveness has achieved the purpose of comprehensive and efficient protection of the communication interaction process.
  • Figure 1 is a flow chart of a communication protection method provided by an embodiment of the present application.
  • Figure 2 is a flow chart for communication protection of the first data message provided by an embodiment of the present application
  • Figure 3 is a flow chart for communication protection of the second data message provided by an embodiment of the present application.
  • Figure 4 is a flow chart for communication protection of the first data message provided by another embodiment of the present application.
  • Figure 5 is a flow chart for communication protection of the second data message provided by another embodiment of the present application.
  • Figure 6 is a schematic structural diagram of a communication protection system provided by an embodiment of the present application.
  • Figure 7 is a schematic structural diagram of a communication protection system provided by another embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • An embodiment of the present application relates to a communication protection method.
  • the method includes: determining the type of data message to be sent; wherein the type of data message includes: a first data message and a second data message; first data The message is the first data message sent to the communication receiving end, and the second data message is not the first data message sent to the communication receiving end; when the data message is the first data message, Perform strong verification on the data message; when the data message is the second data message, perform weak verification on the data message; where strong verification is a verification with stronger security than weak verification; if the verification passes , sending data packets to the communication receiving end, solving the problems of low protection efficiency, poor defense system and insufficient protection in the business interaction process, and achieving the purpose of comprehensive and efficient protection of the communication interaction process.
  • step 101 the type of data packet to be sent is determined.
  • the types of data messages include: a first data message and a second data message; the first data message is the first data message sent to the communication receiving end, and the second data message is sent to the communication receiving end.
  • the data packet may be one or multiple data packets.
  • the data message can be a collection of flows with the same information or multiple combinations of the following information, including the IP of the communication initiator, the identity of the communication initiator, the port of the communication initiator, the IP of the communication receiver, the identity of the communication receiver, and the port of the communication receiver. , protocol number, protocol port.
  • the first data packet may be the initial data packet or the first packet. If the security of the data packet is poor, it may also be the data packet after the first packet.
  • the second data packet may also be the first data packet if the security of the data packet is strong.
  • the data packet when the data packet carries the IP of the communication receiving end that appears for the first time, the data packet is determined to be the first data packet; when the data packet carries the IP of the communication receiving end that does not appear for the first time, Next, the data packet is determined to be the second data packet.
  • the data packet to be sent carries the IP of the communication receiving end A.
  • the data packet is determined to be the first data packet.
  • the communication initiating end has sent a data message to the communication receiving end A
  • the data message is determined to be the second data message.
  • the data message to be sent carries the IP of the communication receiving end A and the IP of the communication initiating end B.
  • the The data message is determined as the first data message; when the communication initiating terminal B has sent a data message to the communication receiving terminal A, the data message is determined as the second data message.
  • the communication initiating end and the communication receiving end can be terminals, PCs, servers, managers, controllers, etc.
  • the data message when the data message is not the first data message sent to the communication receiving end, and the security of the data message is poor, the data message is the first data message; when the data message is The first data message sent to the communication receiving end, and if the data message is highly secure, the data message is the second data message.
  • the above-mentioned data packet can still be determined as the first data packet, and the strong Verification: For the data packet transmitted to the communication receiving end for the first time, if the security of the data packet is detected to be strong, the data packet can be determined to be the second data packet and weak verification can be performed on it.
  • step 102 if the data packet is the first data packet, strong verification is performed on the data packet.
  • strong verification with strong security is required to verify the data packets transmitted by the communication initiator.
  • the operation of performing strong verification on the data message includes: the first transmission node or the communication initiator performs cryptographic calculation on the data message and generates a first verification value, and adds the first verification information to the data message.
  • the first transmission node is a transmission node that receives data packets sent from the communication initiator.
  • the first transmission node may be a router, a switch, a gateway, etc.
  • the first transmission node when the first transmission node performs the above strong verification operation, uses the key of the first transmission node to perform cryptographic calculations on the information of the communication initiator and/or the first transmission node. , and generate a first verification value, or use the key of the communication initiator to perform cryptographic calculations on the information of the communication initiator and/or the first transmission node, and generate the first verification value.
  • the first transmission node since the first transmission node receives the data packet from the communication initiator, and the data packet will carry With the information of the communication initiator, and the key of the communication initiator can be obtained from the key management center through the information of the communication initiator, therefore, the first transmission node can use the key of the first transmission node or the key of the communication initiator, for the first
  • the information (such as identity or address) of the transmission node or communication initiator is subjected to cryptographic calculation or signature to obtain the first verification value.
  • the communication initiating end when the communication initiating end performs the above strong verification operation, uses the communication initiating end's key to perform cryptographic calculations on the communication initiating end's information and generate a first verification value.
  • the only encryption key that the communication initiator can obtain is its own key, and the data message only carries information about the communication initiator. Therefore, the communication When the initiator performs cryptographic calculations on the data message, it can only use the key of the communication initiator to perform cryptographic calculations or sign the identity or address of the communication initiator to generate the first verification value.
  • the operation of performing strong verification on the data message also includes: after adding the first verification value to the data message, the first transmission node performs an authenticity check on the communication initiator; wherein the authenticity check includes the following One or a combination of: access control-based checking, CAPTCHA-based checking, cryptography-based checking, and token-based checking.
  • the first transmission node After receiving the data message, the first transmission node also performs an authenticity check on the communication initiator to avoid forwarding data messages with security risks to the second transmission node.
  • the operation of performing strong verification on the data message also includes: the first transmission node, the second transmission node or the communication receiving end verifying the first verification value carried in the data message.
  • the second transmission node is a transmission node that receives the data message sent from the previous transmission node, where the previous transmission node is the first transmission node or the second transmission node, and the first transmission node and the communication receiving end can
  • the second transmission nodes may be routers, switches, and gateways.
  • the key of the communication initiating end and the information of the communication initiating end are used to perform the first verification on the first verification value.
  • the first transmission node uses the communication initiator's key and the communication initiator's information to perform the first verification on the first verification value.
  • the key of the first transmission node and the information of the communication initiator and/or the first transmission node are used to verify the first verification value. Perform a first verification, or perform a first verification on the first verification value using the key of the communication initiating end and the information of the communication initiating end and/or the first transmission node.
  • the first transmission node when the first transmission node performs cryptographic calculation on the data packet and generates the first verification value, the first transmission node will forward the data packet carrying the first verification value to the second data packet, And the data message also carries information for obtaining the key of the communication initiator or the first transmission node. Therefore, the second transmission node can use the key of the first transmission node and the key of the communication initiator and/or the first transmission node. information, perform the first verification on the first verification value, or use the key of the communication initiating end and the information of the communication initiating end and/or the first transmission node to perform the first verification on the first verification value.
  • the key of the first transmission node and the information of the communication initiating end and/or the first transmission node are used to verify the first verification value.
  • the first verification or using the key of the communication initiator and the information of the communication initiator and/or the first transmission node, performs the first verification on the first verification value.
  • the communication initiating end performs cryptographic calculation on the data message and generates a first verification value. After the first transmission node performs the first verification on the first verification value, the first transmission node transmits data to the data message via the second transmission node. The communication receiving end sends a data message carrying the verification value. Therefore, when the first transmission node verifies the first verification value, the communication receiving end can also verify the first verification value again.
  • the second transmission node After the first transmission node performs cryptographic calculation on the data message and generates the first verification value, After the second transmission node performs the first verification on the first verification value, the second transmission node sends the data message carrying the first verification value to the communication receiving end. Therefore, the first verification value is verified at the second transmission node. In the case of , the communication receiving end can also verify the first verification value again.
  • the first verification value generated by encryption can also be carried for the subsequent second transmission node and communication receiving end to verify the data message.
  • the authenticity of the data message is detected to avoid forwarding data messages with security risks and ensure the security in the data message transmission process.
  • performing strong verification on the data message also includes: the first transmission node, the second transmission node or the communication receiving end generating verification information for the data message and adding verification information to the data message.
  • the verification information includes: warrant, verification code and token.
  • the warrant information is carried in the data message and can be stored in the outer IP header, inner IP header of the data message, the IP address of the communication initiator, and the communication receiver. In the IP address, option header, original extension header or newly defined extension header.
  • the first transmission node when the first transmission node generates verification information for the data packet, the first transmission node generates the verification information of the first transmission node based on the IP of the communication initiating end and the IP of the communication receiving end.
  • the second transmission node when the second transmission node generates verification information for the data packet, and when the data packet carries the IP of the communication receiving end that appears for the first time, the second transmission node generates the second transmission node based on the IP of the first transmission node and the IP of the communication receiving end. Verification information of the second transmission node; when the data message carries the IP of the communication receiving end that appears for the first time and the IP of the communication initiating end that appears for the first time, the second transmission node generates a second transmission node based on the IP of the communication initiating end and the IP of the communication receiving end. inspection information.
  • both the second transmission node and the communication initiating end can generate verification for the data message again based on the IP of the communication initiating end and the IP of the communication receiving end. information.
  • the communication receiving end can also, when the data packet carries the IP of the communication receiving end that appears for the first time, based on the first The IP of the transmission node and the IP of the communication receiving end generate the verification information of the communication receiving end; when the data packet carries the IP of the communication receiving end that appears for the first time and the IP of the communication initiating end that appears for the first time, based on the IP of the communication initiating end and the IP of the communication receiving end Generate verification information for the communication receiving end.
  • the next second transmission node Send the data packet carrying the verification information and the first verification value, so that multiple second transmission nodes can perform the same strong verification operation on the data packet, and complete the strong verification of the data packet at all second transmission nodes, and After passing the verification, a data message is sent to the communication receiving end.
  • each transmission node can perform weak verification on the second data message.
  • the verification information is filtered according to the preset standards to obtain the authorization verification information, where the authorization verification information is sent to the communication initiating end along with the response message of the communication initiating end.
  • the second transmission node A, the second transmission node B, and the second transmission node C respectively generate corresponding verification information a1, verification information a2, and verification information a3 for the data packet, carrying the information of a1, a2, and a3.
  • the data message is sent to the communication receiving end by C.
  • the communication receiving end can filter a1, a2 and a3 according to the authorization whitelist. After a1 and a2 pass the screening, the authorization verification information a1 and a2 are obtained.
  • the communication receiving end sends a response message carrying authorization verification information to the communication initiating end. arts.
  • the second transmission node A, the second transmission node B and the second transmission node C respectively generate corresponding verification information a1, verification information a2 and verification information a3 for the data packet.
  • the second transmission node C can Screen a1, a2 and a3 according to the resource occupancy. After a1 and a2 pass the screening, the authorization verification information a1 and a2 are obtained.
  • the second transmission node C adds the authorization verification information to the response message sent by the communication receiving end, and forwards the response message to the communication receiving end via multiple transmission nodes.
  • the communication receiving end may not filter the generated verification information.
  • the communication receiving end may directly authorize each generated verification information and add the authorization verification information to the response message sent by the communication receiving end. , and forward the response message to the communication receiving end through multiple transmission nodes.
  • the embodiments of this application do not limit the preset authorization standards for authorization verification information.
  • the specific authorization standards used in the above examples are to make the process of obtaining authorization verification information clearer.
  • step 103 if the data packet is the second data packet, weak verification is performed on the data packet.
  • the second data message is a data message that is not sent to the communication receiving end for the first time, indicating that the data message has been strongly verified when the data message is sent to the communication receiving end for the first time. Therefore, for the data message that has been When the data packets between the communication initiator and the communication receiver of strong authentication are transmitted again, weak authentication, which is less secure than strong authentication, can be used for verification.
  • the operation of performing weak verification on the data packet includes: adding stored authorization verification information to the data packet according to the IP information carried in the data packet.
  • the IP information carried by the data packet includes: the IP of the communication receiving end and the IP of the communication initiating end.
  • the authorization verification information Since after the first data message of the communication receiving end is fully verified, the authorization verification information will be sent to the communication initiating end or the first transmission node along with the response message.
  • the authorization verification information When the encryption operation of the data message is performed by the communication initiating end, The authorization verification information will be sent to the communication initiating end and saved by the communication initiating end; when the encryption operation of the data message is performed by the first transmission node, the authorization verification information will be sent to the first transmission node along with the response message.
  • a transmission node stores the authorization verification information and sends a response message to the communication initiator.
  • the IP corresponding to the communication receiving end can be obtained from the stored authorization verification information based on the IP of the communication receiving end of the data message.
  • Authorization check information and add authorization check information to the data packet.
  • the operation of performing weak verification on the data message also includes: verifying the authorization verification information carried in the data message.
  • the second transmission node verifies the authorization verification information carried in the data packet.
  • the data packet carries the IP of the communication receiving end that does not appear for the first time
  • the second transmission node verifies the authorization verification information carried in the data packet based on the IP of the first transmission node and the IP of the communication receiving end; in the data packet
  • the authorization verification information carried in the data message is verified based on the IP of the communication initiating end and the IP of the communication receiving end.
  • the first transmission node verifies the authorization verification information carried in the data message based on the IP of the communication initiating end and the IP of the communication receiving end. .
  • the communication receiving end when the communication receiving end authorizes the verification information generated by the data message, the communication receiving end verifies the authorization verification information carried in the data message based on the IP of the first transmission node and the IP of the communication receiving end. . Or, verify the authorization verification information carried in the data message based on the IP of the communication initiating end and the IP of the communication receiving end.
  • both the communication receiving end and the first transmission node or the second transmission node can verify the data message. Carry the authorization verification information for verification.
  • the second transmission node uses a cryptographic algorithm to calculate the IP of the communication receiving end and the IP of the communication initiating end carried in the data packet, and obtains The calculated value.
  • the calculated value is the same as the authorization verification information carried in the data packet, it is considered that the verification of the authorization verification information has passed.
  • strong verification with strong security is required to verify the data messages transmitted by the communication initiator.
  • weak verification which is less secure than strong verification, can be used for verification to avoid completely opening up the business transactions between the communication initiator and the communication terminal after only one verification. Potential security risks are prevented.
  • multiple second transmission nodes verify the authorization verification information, which avoids the problem that when only one second transmission node performs verification, the verification function of the second transmission node fails and the secure data message cannot be intercepted.
  • the verification of the authorization verification information is used to check whether the source IP of the data message (that is, the IP of the communication initiator) has changed, to avoid forwarding data messages of unknown origin, and to achieve systematic security protection from an end-to-end perspective.
  • step 104 if the verification passes, a data message is sent to the communication receiving end.
  • the second transmission node verifies the first verification value of the data message, and if the verification passes, the second transmission node sends the data message to the next second transmission node, or to the communication
  • the receiving end sends a data message; when the first transmission node passes the verification, the first transmission node sends a data message to the second transmission node.
  • the second transmission node verifies the authorization verification letter carried in the data message, and if the verification passes, the second transmission node sends the data message to the next second transmission node, or to the communication
  • the receiving end sends a data message; when the first transmission node passes the verification, the first transmission node sends a data message to the second transmission node.
  • step 201 the communication initiating end sends a data message to the first transmission node.
  • step 202 when the first transmission node determines that the received data packet is the first data packet, it performs cryptographic calculation on the data packet and generates a first verification value.
  • step 203 the first transmission node forwards the data packet carrying the first verification value to the second transmission node A.
  • step 204 the second transmission node A generates and adds verification information a1 to the data packet.
  • step 205 the second transmission node A verifies the first verification value.
  • step 206 if the verification passes, the data message carrying a1 and the first verification value is forwarded to the second transmission node B.
  • step 207 the second transmission node B generates and adds verification information a2 to the data packet.
  • step 208 the second transmission node A verifies the first verification value.
  • step 209 if the verification passes, the data message carrying a1 and a2 is forwarded to the communication receiving end.
  • step 210 if a1 and a2 pass the authorization standard, the communication receiving end authorizes a1 and a2.
  • step 211 the communication receiving end sends a response message carrying a1 and a2 to the communication initiating end via the second transmission node B, the second transmission node A and the first transmission node.
  • step 212 the first transmission node saves a1 and a2, and forwards the response message to the communication initiator.
  • step 301 the communication initiating end sends a data message to the first transmission node.
  • step 302 according to the IP information of the data packet, the authorization verification information a1 and a2 of the second transmission node A and the second transmission node B are obtained, and a1 and a2 are added to the data packet.
  • step 303 the first transmission node forwards the data packet carrying a1 and a2 to the second transmission node A.
  • step 304 the second transmission node A verifies a1.
  • step 305 if the verification passes, the data packet carrying a1 and a2 is forwarded to the second transmission node B.
  • step 306 the second transmission node B authenticates a2.
  • step 307 if the verification passes, the data message carrying a1 and a2 is forwarded to the communication receiving end.
  • step 308 the communication receiving end sends a response message to the communication initiating end.
  • step 401 when the communication initiating end determines that the data message to be sent is the first data message, it performs cryptographic calculation on the data message and generates a first verification value.
  • step 402 the communication initiating end forwards the data packet carrying the first verification value to the first transmission node.
  • step 403 the first transmission node generates and adds verification information X1 to the data packet.
  • step 404 the first transmission node verifies the first verification value.
  • step 405 if the verification passes, the data message carrying X1 and the first verification value is forwarded to the second transmission node.
  • step 406 the second transmission node generates and adds verification information Y1 to the data packet.
  • step 407 the second transmission node verifies the first verification value.
  • step 408 if the verification passes, the data message carrying X1 and Y1 is forwarded to the communication receiving end.
  • step 409 if X1 and Y1 pass the authorization standard, the communication receiving end authorizes X1 and Y1.
  • step 410 the communication receiving end sends a response message carrying X1 and Y1 to the communication initiating end via the second transmission node and the first transmission node.
  • step 411 the communication initiator saves X1 and Y1.
  • step 501 when the communication initiating end determines that the data packet to be sent is a second data packet, it obtains the authorization verification information X1 and Y1 of the first transmission node and the second transmission node according to the IP information of the data packet. .
  • step 502 the communication initiating end forwards the data packet carrying X1 and Y1 to the first transmission node.
  • step 503 the first transmission node authenticates X1.
  • step 504 if the verification passes, the first transmission node forwards the data packet carrying X1 and Y1 to the second transmission node.
  • step 505 the second transmission node authenticates Y1.
  • step 506 if the verification passes, the second transmission node forwards the data message carrying X1 and Y1 to the communication receiving end.
  • step 507 the communication receiving end sends a response message to the communication initiating end.
  • the communication protection method provided by the embodiment of the present application implements strong verification on the first data message sent to the communication receiving end, and only forwards the data message to the communication receiving end when the strong verification passes, thus achieving the establishment of While communicating with the communication receiving end, security verification is also performed to avoid the communication receiving end from being attacked and ensure the security and trustworthiness of the network.
  • weak verification is performed on non-first data packets to the communication receiving end. Even if the communication receiving end is connected, weak verification is still required for incoming and outgoing data packets, avoiding potential risks brought by data packets. Therefore, it solves the problem of low protection efficiency, poor defense system and insufficient comprehensive protection in the business interaction process. problems, achieving the purpose of comprehensive and efficient protection of the communication interaction process.
  • the first verification value generated by encryption can also be carried for the subsequent second transmission node and communication receiving end to verify.
  • the authenticity of data packets is detected to avoid forwarding data packets with security risks, ensuring the security in the data packet transmission process.
  • the verification of authorization verification information is used to check the source IP of the data packet (i.e. the communication initiator). IP) changes, avoid forwarding data packets from unknown sources, and achieve systemic security protection from an end-to-end perspective.
  • the embodiment of the present application provides a communication protection system.
  • the network architecture of the protection system is shown in Figure 6 and specifically includes: a communication initiating end, a communication receiving end, a first transmission node and at least one second transmission node.
  • the communication initiating end is used to send data messages to the communication receiving end and receive data messages from the communication receiving end.
  • the communication receiving end is used to receive data messages from the communication initiating end, authorize the communication initiating end, and send verification information to the communication initiating end.
  • the verification information is added to the first data packet, and the verification information carried in the second data packet is verified.
  • the first transmission node is used to determine whether the data message is the first data message or the second data message, perform cryptographic calculations on the first data message, and add authorization verification information to the second data message.
  • the first transmission node may also perform an authenticity check on the communication initiator.
  • the second transmission node generates and adds verification information to the first data message, and verifies the authorization verification information carried in the second data message.
  • the communication protection system provided by the embodiment of the present application may also include a key management center for managing key information of the communication initiator and the first transmission node.
  • Embodiments of the present application also provide a protection system.
  • the network architecture of the protection system is shown in Figure 7, specifically including: a communication initiator, a communication receiver, and a first transmission node.
  • the communication initiator is used to determine whether the data message is the first data message or the second data message, perform cryptographic calculations on the first data message, add authorization verification information to the second data message, and receive the communication from the communication receiving end. data message.
  • the communication receiving end is used to receive data messages from the communication initiating end, authorize the communication initiating end, and send verification information to the communication initiating end.
  • the verification information is added to the first data packet, and the verification information carried in the second data packet is verified.
  • the first transmission node generates and adds verification information to the first data message, and verifies the authorization verification information carried in the second data message.
  • the communication protection system provided by the embodiment of the present application may also include a key management center and at least one second transmission node, where the key management center is used to manage the key information of the communication initiation port, and the second transmission node is used to receive the key information from the communication initiation port.
  • the key management center is used to manage the key information of the communication initiation port
  • the second transmission node is used to receive the key information from the communication initiation port.
  • cryptographic calculation is performed on the first data message, and authorization verification information is added to the second data message.
  • the second transmission node can also authorize the communication initiator.
  • a logical unit can be a physical unit, or a part of a physical unit, or it can also be implemented as a combination of multiple physical units.
  • units that are not closely related to solving the technical problems raised in this application are not introduced in this embodiment, but this does not mean that other units do not exist in this embodiment.
  • An embodiment of the present application also provides an electronic device, as shown in Figure 8, including at least one processor 801; and a memory 802 communicatively connected to the at least one processor 801; wherein the memory 802 stores information that can Instructions executed by the at least one processor 801, the instructions are executed by the at least one processor 801, so that the at least one processor can execute the above communication protection method.
  • the bus can include any number of interconnected buses and bridges.
  • the bus connects one or more processors and various circuits of the memory together.
  • the bus may also connect various other circuits together such as peripherals, voltage regulators, and power management circuits, which are all well known in the art and therefore will not be described further herein.
  • the bus interface provides the interface between the bus and the transceiver.
  • a transceiver may be one element or may be multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium.
  • the data processed by the processor is transmitted over the wireless medium through the antenna. Further, the antenna also receives the data and transmits the data to the processor.
  • the processor is responsible for managing the bus and general processing, and can also provide a variety of functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions.
  • Memory can be used to store data used by the processor when performing operations.
  • Embodiments of the present application also provide a computer-readable storage medium storing a computer program.
  • the above method embodiments are implemented when the computer program is executed by the processor.
  • the program is stored in a storage medium and includes several instructions to make a device (which may be A microcontroller, a chip, etc.) or a processor (processor) executes all or part of the steps of the methods described in various embodiments of this application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program code. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例涉及通信技术领域，公开了一种通信防护方法、系统、电子设备及存储介质，方法包括：确定待发送的数据报文的类型；其中，数据报文的类型包括：第一数据报文和第二数据报文；第一数据报文为向通信接收端发送的首个数据报文，第二数据报文为向所述通信接收端发送的非首个数据报文；在数据报文为第一数据报文的情况下，对数据报文进行强验证；在数据报文为第二数据报文的情况下，对数据报文进行弱验证；其中，强验证为安全性强于弱验证的验证；在验证通过的情况下，向通信接收端发送数据报文。

Description

通信防护方法、系统、电子设备及存储介质
相关申请
本申请要求于2022年6月17号申请的、申请号为202210692194.0的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种通信防护方法、系统、电子设备及存储介质。
背景技术
随着社会的不断进步和经济的不断发展，网络已经成为人们日常生活中必不可少的一部分。网络云化/泛化在演进、2B和2C业务融合，网络开放暴露面不断增加，网络安全的“边界”进一步模糊，攻击手段持续升级，传统“补丁式”的安全设计模式，存在结构僵化、后知后觉、缺乏协同等问题，堆叠、加固的安全架构，依赖于先验知识的被动防护模式，难以满足新型网络安全防护需求。因此，需要突破传统设计模式，为网络注入更强大的安全基因，从身份、数据、网络、通信端等需求层面，进行系统安全设计。网络通信防护基于对接入终端的验证、对接收端的保护，以确保网络的安全可信，并为资源正常运行、业务正常通信提供安全保障。
然而常规的通信防护技术存在防护效率低下，防护不够系统、防护不够全面的问题。
发明内容
本申请的目的在于解决上述问题，提供一种通信防护方法、系统、电子设备及存储介质，解决了业务互通过程防护效率低下、防御系统性差和防护不够全面的问题，达到了对通信互通过程，全面高效防护的目的。
为解决上述问题，本申请的实施例提供了一种通信防护方法，方法包括：确定待发送的数据报文的类型；其中，数据报文的类型包括：第一数据报文和第二数据报文；第一数据报文为向通信接收端发送的首个数据报文，第二数据报文为向所述通信接收端发送的非首个数据报文；在数据报文为第一数据报文的情况下，对数据报文进行强验证；在数据报文为第二数据报文的情况下，对数据报文进行弱验证；其中，强验证为安全性强于弱验证的验证；在验证通过的情况下，向通信接收端发送数据报文。
为解决上述问题，本申请的实施例提供了一种通信防护系统，包括：通信发起端、通信接收端、第一传输节点和至少一个第二传输节点；第一传输节点用于执行上述通信防护方法；所述第二传输节点和所述通信接收端用于执行上述通信防护方法。
为解决上述问题，本申请的实施例提供了一种通信防护系统，包括：通信发起端、通信接收端、第一传输节点；通信发起端用于执行上述通信防护方法；所述第一传输节点和所述通信接收端用于执上述通信防护方法。
为解决上述问题，本申请的实施例还提供了一种电子设备，包括：至少一个处理器；以 及，与所述至少一个处理器通信连接的存储器；其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行上述通信防护方法。
为解决上述问题，本申请的实施例还提供了一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时实现上述通信防护方法。
本申请实施例提供的通信防护方法，通过对发向通信接收端的首个数据报文进行强验证，并且，在强验证通过的情况下，才向通信接收端转发数据报文，实现了在建立与通信接收端之间的通信的同时，也进行了安全验证，避免了通信接收端被攻击，确保了网络的安全可信，另外，对向通信接收端发送的非首个数据报文进行弱验证，实现即使已接入通信接收端，对于往来的数据报文仍然需要进行弱验证，避免了数据报文带来的潜在风险，因此，解决了业务互通过程防护效率低下、防御系统性差和防护不够全面的问题，达到了对通信互通过程，全面高效防护的目的。
附图说明
一个或多个实施例通过与之对应的附图中的图片进行示例性说明，这些示例性说明并不构成对实施例的限定，附图中具有相同参考数字标号的元件表示为类似的元件，除非有特别申明，附图中的图不构成比例限制。
图1是本申请一实施例提供的通信防护方法的流程图；
图2是本申请一实施例提供的对第一数据报文进行通信防护的流程图；
图3是本申请一实施例提供的对第二数据报文进行通信防护的流程图；
图4是本申请另一实施例提供的对第一数据报文进行通信防护的流程图；
图5是本申请另一实施例提供的对第二数据报文进行通信防护的流程图；
图6是本申请一实施例提供的通信防护系统的结构示意图；
图7是本申请另一实施例提供的通信防护系统的结构示意图；
图8是本申请一实施例提供的电子设备的结构示意图。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请的各实施方式进行详细的阐述。然而，本领域的普通技术人员可以理解，在本申请各实施方式中，为了使读者更好地理解本申请而提出了许多技术细节。但是，即使没有这些技术细节和基于以下各实施方式的种种变化和修改，也可以实现本申请所要求保护的技术方案。
本申请的一实施例涉及一种通信防护方法，方法包括：确定待发送的数据报文的类型；其中，数据报文的类型包括：第一数据报文和第二数据报文；第一数据报文为向通信接收端发送的首个数据报文，第二数据报文为向所述通信接收端发送的非首个数据报文；在数据报文为第一数据报文的情况下，对数据报文进行强验证；在数据报文为第二数据报文的情况下，对数据报文进行弱验证；其中，强验证为安全性强于弱验证的验证；在验证通过的情况下，向通信接收端发送数据报文，解决了业务互通过程防护效率低下、防御系统性差和防护不够全面的问题，达到了对通信互通过程，全面高效防护的目的。
下面对本实施例中的方法的实现细节进行具体的说明，以下内容仅为方便理解本方案的 实现细节，并非实施本方案的必须。具体流程如图1所示，可包括如下步骤：
在步骤101中，确定待发送的数据报文的类型。
其中，数据报文的类型包括：第一数据报文和第二数据报文；第一数据报文为向通信接收端发送的首个数据报文，第二数据报文为向通信接收端发送的非首个数据报文。其中，数据报文可以是一个或者多个数据报文。数据报文可以是以下一种信息相同或多种组合信息相同的流集合，包含通信发起端的IP、通信发起端身份、通信发起端端口、通信接收端的IP、通信接收端身份、通信接收端端口、协议号、协议端口。其中，第一数据报文可以是始发数据报文或首包，在数据报文安全性差的情况下，还可以是首包之后的数据报文。对于第二数据报文，在数据报文安全性强的情况下，也可以是首个数据报文。
在本申请实施例中，在数据报文携带首次出现的通信接收端的IP的情况下，将数据报文确定为第一数据报文；在数据报文携带非首次出现的通信接收端的IP的情况下，将数据报文确定为第二数据报文。
在一个例子中，待发送的数据报文携带通信接收端A的IP，在通信发起端从未向通信接收端A传输过数据报文的情况下，将数据报文确定为第一数据报文，在通信发起端已经向通信接收端A发送过数据报文的情况下，将数据报文确定为第二数据报文。
在又一个例子中，待发送的数据报文携带通信接收端A的IP，携带通信发起端B的IP，在通信发起端B从未向通信接收端A发送过数据报文的情况下，将数据报文确定为第一数据报文；在通信发起端B已经向通信接收端A发送过数据报文的情况下，将数据报文确定第二数据报文。
其中，通信发起端和通信接收端可以是终端、PC机、服务器、管理器以及控制器等。
在本申请实施例中，在数据报文为向通信接收端发送的非首个数据报文，且数据报文安全性差的情况下，数据报文为第一数据报文；在数据报文为向通信接收端发送的首个数据报文，且数据报文安全性强的情况下，数据报文为第二数据报文。
在一个例子中对于非首次向通信接收端传输的数据报文，在检测到数据报文安全性较差的情况下，依然可以将上述数据报文确定为第一数据报文，对它进行强验证；对于首次向通信接收端传输的数据报文，在检测到数据报文安全性强的情况下，可以将数据报文确定为第二数据报文，对它进行弱验证。
在步骤102中，在数据报文为第一数据报文的情况下，对数据报文进行强验证。
在一个例子中，对于首次进行数据传输的通信发起端和通信终端，需要采取安全性强的强验证对通信发起端传输的数据报文进行检验。
在本申请实施例中，对数据报文进行强验证的操作包括：第一传输节点或通信发起端对数据报文进行密码学计算并生成第一验证值，为数据报文添加第一验证信息。其中，第一传输节点为接收来自通信发起端发送的数据报文的传输节点，第一传输节点可以是路由器、交换机以及网关等。
在本申请实施例中，在第一传输节点执行上述强验证操作的情况下，第一传输节点使用第一传输节点的密钥对通信发起端和/或第一传输节点的信息进行密码学计算，并生成第一验证值，或者，使用通信发起端的密钥对通信发起端和/或第一传输节点的信息进行密码学计算，并生成第一验证值。
在一个例子中，由于第一传输节点接收来自通信发起端的数据报文，且数据报文中会携 带通信发起端的信息，并且通过通信发起端的信息可以从密钥管理中心获取通信发起端的密钥，因此，第一传输节点可以使用第一传输节点的密钥或者通信发起端的密钥，对第一传输节点或者通信发起端的信息(如身份或地址)进行密码学计算或者签名，得到第一验证值。
在本申请实施例中，在通信发起端执行上述强验证操作的情况下，通信发起端使用通信发起端的密钥对通信发起端的信息进行密码学计算并生成第一验证值。
在一个例子中，由于通信发起端对数据报文进行密码学计算时，通信发起端可获取加密的密钥只有自身的密钥，且数据报文中只携带了通信发起端的信息，因此，通信发起端对数据报文进行密码学计算时，只能使用通信发起端的密钥对通信发起端的身份或地址进行密码学计算或签名，生成第一验证值。
在本申请实施例中，对数据报文进行强验证的操作还包括：为数据报文添加第一验证值后，第一传输节点对通信发起端进行真实性检查；其中，真实性检查包括以下一种或多种组合：基于访问控制的检查、基于验证码的检查、基于密码学的检查和基于令牌的检查。
第一传输节点收到数据报文后，也对通信发起端进行一次真实性检查，避免向第二传输节点转发存在安全隐患的数据报文。
在本申请实施例中，对数据报文进行强验证的操作还包括：第一传输节点、第二传输节点或通信接收端，对数据报文携带的第一验证值进行验证。
其中，第二传输节点为接收来自上一传输节点发送的数据报文的传输节点，其中，上一传输节点为第一传输节点或第二传输节点，第一传输节点和通信接收端之间可以有多个第二传输节点，第二传输节点可以是路由器、交换机以及网关。
在本申请实施例中，在第一传输节点对第一验证值进行验证的情况下，使用通信发起端的密钥和通信发起端的信息，对第一验证值进行第一验证。
在一个例子中，通信发起端对数据报文进行密码学计算时，第一传输节点使用通信发起端的密钥和通信发起端的信息，对第一验证值进行第一验证。
在本申请实施例中，在第二传输节点对第一验证值进行验证的情况下，使用第一传输节点的密钥和通信发起端和/或第一传输节点的信息，对第一验证值进行第一验证，或者,使用通信发起端的密钥和通信发起端和/或第一传输节点的信息，对第一验证值进行第一验证。
在一个例子中，在第一传输节点对数据报文进行密码学计算，并生成第一验证值时，第一传输节点会将携带第一验证值的数据报文转发至第二数据报文，并且数据报文中还携带有用于获取通信发起端或者第一传输节点密钥的信息，因此，第二传输节点可以使用第一传输节点的密钥和通信发起端和/或第一传输节点的信息，对第一验证值进行第一验证，或者,使用通信发起端的密钥和通信发起端和/或第一传输节点的信息，对第一验证值进行第一验证。
在本申请实施例中，在通信接收端对第一验证值进行验证的情况下，使用第一传输节点的密钥和通信发起端和/或第一传输节点的信息，对第一验证值进行第一验证，或者,使用通信发起端的密钥和通信发起端和/或第一传输节点的信息，对第一验证值进行第一验证。
在一个例中，在通信发起端对数据报文进行密码学计算，并生成第一验证值，第一传输节点对第一验证值进行第一验证后，第一传输节点经第二传输节点向通信接收端发送携带验证值的数据报文，因此，在第一传输节点对第一验证值验证的情况下，通信接收端还可以再次对第一验证值进行验证。
在又一个例子中，在第一传输节点对数据报文进行密码学计算，并生成第一验证值后， 第二传输节点对第一验证值进行第一验证后，第二传输节点将携带第一验证值的数据报文发送到通信接收端，因此，在第二传输节点进行了对第一验证值验证的情况下，通信接收端还可以再次对第一验证值进行验证。
通过对数据报文中的信息进行密码学计算，避免数据泄露引发安全问题的同时，还可以通过携带因加密而生成的第一验证值，供后面的第二传输节点和通信接收端对数据报文的真实性进行检测，避免转发存在安全隐患的数据报文，保证了数据报文传输流程中的安全。
在本申请实施例中，对数据报文进行强验证还包括：第一传输节点、第二传输节点或者通信接收端为数据报文生成检验信息，并为数据报文添加检验信息。其中，检验信息包括：权证、验证码和令牌，权证信息携带在数据报文中，可以存放在数据报文的外层IP头、内层IP头、通信发起端的IP地址中、通信接收端的IP地址中、选项头、原有扩展头或者新定义的扩展头中。
在一个例子中，在第一传输节点为数据报文生成检验信息的情况下，第一传输节点根据通信发起端的IP和通信接收端的IP生成第一传输节点的检验信息。
在又一个例子中，在第二传输节点为数据报文生成检验信息，且在数据报文携带首次出现的通信接收端的IP的情况下，根据第一传输节点的IP和通信接收端的IP生成第二传输节点的检验信息；在数据报文携带首次出现的通信接收端的IP和首次出现的通信发起端的IP的情况下，第二传输节点根据通信发起端的IP和通信接收端的IP生成第二传输节点的检验信息。
在另一个例子中，在第一传输节点生成第一传输节点的检验信息的情况下，第二传输节点和通信发起端都可以根据通信发起端的IP和通信接收端的IP再次为数据报文生成检验信息。
在一个例子中，在第二传输节点为数据报文生成第二传输节点的检验信息的情况下，通信接收端也可以在数据报文携带首次出现的通信接收端的IP的情况下，根据第一传输节点的IP和通信接收端的IP生成通信接收端的检验信息；在数据报文携带首次出现的通信接收端的IP和首次出现的通信发起端的IP的情况下，根据通信发起端的IP和通信接收端的IP生成通信接收端的检验信息。
另外，当通信接收端和第一传输节点中有多个第二传输节点时，当第一个第二传输节点完成对数据报文的强验证，且验证通过后，向下一个第二传输节点发送携带检验信息和第一验证值的数据报文，供后面的多个第二传输节点对数据报文执行同样的强验证操作，在所有第二传输节点完成对数据报文的强验证，且验证通过后，向通信接收端发送数据报文。
在两个通信终端首次进行数据报文的传输时，根据数据报文携带的IP信息生成检验信息，供通信终端进行下一次通信传输时进行检验，即通信发起端向通信终端传输第二数据报文时，各传输节点可以对第二数据报文进行弱验证。
在本申请实施例中，在对数据报文进行强验证之后，根据预设标准对检验信息进行筛选，得到授权检验信息，其中，授权检验信息随通信发起端的应答报文共同发送至通信发起端。
在一个例子中，第二传输节点A、第二传输节点B和第二传输节点C为数据报文分别生成了对应的检验信息a1、检验信息a2和检验信息a3，携带a1、a2和a3的数据报文被C发送至通信接收端，通信接收端可以根据授权白名单对a1、a2和a3进行筛选，a1、a2通过筛选，得到授权检验信息a1和a2。通信接收端向通信发起端发送携带授权检验信息的应答报 文。
在又一个例子中，第二传输节点A、第二传输节点B和第二传输节点C为数据报文分别生成了对应的检验信息a1、检验信息a2和检验信息a3，第二传输节点C可以根据资源占用情况对a1、a2和a3进行筛选，a1、a2通过筛选，得到授权检验信息a1和a2。第二传输节点C将授权检验信息添加到通信接收端发送的应答报文中，并将应答报文经多个传输节点转发至通信接收端。
在另一个例子中，通信接收端也可以不对生成的检验的信息进行筛选，通信接收端直接为每一个生成的检验信息进行授权，并将授权检验信息添加到通信接收端发送的应答报文中，并将应答报文经多个传输节点转发至通信接收端。
本申请实施例不对授权检验信息的预设的授权标准进行限定，上述例子中所使用的具体授权标准是为了让获取授权检验信息的过程更加清楚。
通过对检验信息进行筛选，避免授权了无效检验信息或者有安全隐患的信息，从而影响通信传输的安全性，以及造成了资源的浪费。
在步骤103中，在数据报文为第二数据报文的情况下，对数据报文进行弱验证。
其中，第二数据报文为非首次向通信接收端发送的数据报文，说明已经在首次向通信接收端发送数据报文时，已经对数据报文进行了强验证，因此，对于已经进行过强验证的通信发起端和通信接收端之间的数据报文，在再次进行数据报文的传输时，可以采取安全性低于强验证的弱验证进行检验。
在本申请实施例中，对数据报文进行弱验证的操作包括：根据数据报文携带的IP信息，为数据报文添加存储的授权检验信息。其中，数据报文携带的IP信息包括：通信接收端的IP和通信发起端的IP。
由于在通信接收端的第一数据报文进行完强验证后，授权检验信息会随应答报文发送至通信发起端或第一传输节点，当对数据报文的加密操作是通信发起端执行时，授权检验信息会发送至通信发起端，并被通信发起端保存；当对数据报文的加密操作是第一传输节点执行时，授权检验信息会随应答报文被发送至第一传输节点，第一传输节点保存授权检验信息，并向通信发起端发送应答报文。
因此，在通信发起端或者第一传输节点确定出数据报文为第二数据报文后，可以根据数据报文的通信接收端的IP，从存储的授权检验信息中，获取通信接收端的IP对应的授权检验信息，并为数据报文添加授权检验信息。
在本申请实施例中，对数据报文进行弱验证的操作还包括：对数据报文携带的授权检验信息进行验证。
在一个例子中，在第二传输节点对数据报文生成的检验信息通过授权的情况下，第二传输节点对数据报文携带的授权检验信息进行检验。第二传输节点在数据报文携带非首次出现的通信接收端的IP的情况下，根据第一传输节点的IP和通信接收端的IP，对数据报文携带的授权检验信息进行验证；在数据报文携带非首次出现的通信接收端的IP和非首次出现的通信发起端的IP的情况下，根据通信发起端的IP和通信接收端的IP，对数据报文携带的授权检验信息进行验证。
在一个例子中，在第一传输节点对数据报文生成的检验信息通过授权的情况下，第一传输节点根据通信发起端的IP和通信接收端的IP，对数据报文携带的授权检验信息进行验证。
在一个例子中，在通信接收端对数据报文生成的检验信息通过授权的情况下，通信接收端根据第一传输节点的IP和通信接收端的IP，对数据报文携带的授权检验信息进行验证。或者，根据通信发起端的IP和通信接收端的IP，对数据报文携带的授权检验信息进行验证。
另外，在通信接收端和第一传输节点或第二传输节点对数据报文生成的检验信息都通过授权的情况下，通信接收端和第一传输节点或第二传输节点都可以对数据报文携带的授权检验信息进行验证。
在一个例子中，第二传输节点在收到携带授权检验信息的数据报文后，第二传输节点采用密码学算法对数据报文中携带的通信接收端的IP和通信发起端的IP进行计算，获得计算值，在计算值与数据报文中携带的授权检验信息相同时，则认为对授权检验信息的检验通过。
对于首次进行数据传输的通信发起端和通信终端，需要采取安全性强的强验证对通信发起端传输的数据报文进行检验，对于已经进行过强验证的通信发起端和通信接收端，在再次进行通信发起端和通信终端之间的数据报文传输时，可以采取安全性低于强验证的弱验证进行检验，避免只经过一次验证，就完全开放通信发起端和通信终端的业务来往，从而预防了带来的潜在安全风险。另外，多个第二传输节点都对授权检验信息进行验证，避免了只有一个第二传输节点进行验证时，第二传输节点验证功能失效而导致存在安全的数据报文无法被拦截的问题。对授权检验信息的验证用于检查数据报文的源IP(即通信发起端的IP)是否发生变化，避免转发来源不明的数据报文，从端到端的角度实现系统性的安全保护。
在步骤104中，在验证通过的情况下，向通信接收端发送数据报文。
在一个例子中，在第二传输节点对数据报文的第一验证值进行验证，并在验证通过的情况下，第二传输节点向下一第二传输节点发送数据报文，或者，向通信接收端发送数据报文；在第一传输节点验证通过的情况下，第一传输节点向第二传输节点发送数据报文。
在一个例子中，在第二传输节点对数据报文携带的授权检验信进行验证，并在验证通过的情况下，第二传输节点向下一第二传输节点发送数据报文，或者，向通信接收端发送数据报文；在第一传输节点验证通过的情况下，第一传输节点向第二传输节点发送数据报文。
为了使本申请实施例提供的通信防护方法更加清楚，参考图2对防护方法的流程进行具体说明，本申请实施例提供的方法应用于SRv6场景下，在数据报文为第一数据报文的情况下，防护流程具体内容如下：
在步骤201，通信发起端向第一传输节点发送数据报文。
在步骤202，第一传输节点确定收到的数据报文为第一数据报文的情况下，对数据报文进行密码学计算，并生成第一验证值。
在步骤203，第一传输节点转发携带第一验证值的数据报文至第二传输节点A。
在步骤204，第二传输节点A为数据报文生成并添加检验信息a1。
在步骤205，第二传输节点A对第一验证值进行验证。
在步骤206，在验证通过的情况下，向第二传输节点B转发携带a1和第一验证值的数据报文。
在步骤207，第二传输节点B为数据报文生成并添加检验信息a2。
在步骤208，第二传输节点A对第一验证值进行验证。
在步骤209，在验证通过的情况下，向通信接收端转发携带a1和a2的数据报文。
在步骤210，在a1和a2通过授权标准的情况下，通信接收端对a1和a2进行授权。
在步骤211，通信接收端经第二传输节点B、第二传输节点A和第一传输节点向通信发起端发送携带a1和a2的应答报文。
在步骤212，第一传输节点保存a1和a2，并将应答报文转发至通信发起端。
为了使本申请实施例提供的通信防护方法更加清楚，参考图3对通信防护方法的流程进行具体说明，本申请实施例提供的方法应用于SRv6场景下，在数据报文为第二数据报文的情况下，防护流程具体内容如下：
在步骤301，通信发起端向第一传输节点发送数据报文。
在步骤302，根据数据报文的IP信息，获取第二传输节点A和第二传输节点B的授权检验信息a1和a2，为数据报文添加a1和a2。
在步骤303，第一传输节点转发携带a1和a2的数据报文至第二传输节点A。
在步骤304，第二传输节点A对a1进行验证。
在步骤305，在验证通过的情况下，向第二传输节点B转发携带a1和a2的数据报文。
在步骤306，第二传输节点B对a2进行验证。
在步骤307，在验证通过的情况下，向通信接收端转发携带a1和a2的数据报文。
在步骤308，通信接收端向通信发起端发送应答报文。
为了使本申请实施例提供的通信防护方法更加清楚，参考图4对防护方法的流程进行具体说明，在数据报文为第一数据报文的情况下，防护流程具体内容还可以如下：
在步骤401中，通信发起端确定待发送的数据报文为第一数据报文的情况下，对数据报文进行密码学计算，并生成第一验证值。
在步骤402，通信发起端转发携带第一验证值的数据报文至第一传输节点。
在步骤403，第一传输节点为数据报文生成并添加检验信息X1。
在步骤404，第一传输节点对第一验证值进行验证。
在步骤405，在验证通过的情况下，向第二传输节点转发携带X1和第一验证值的数据报文。
在步骤406，第二传输节点为数据报文生成并添加检验信息Y1。
在步骤407，第二传输节点对第一验证值进行验证。
在步骤408，在验证通过的情况下，向通信接收端转发携带X1和Y1的数据报文。
在步骤409，在X1和Y1通过授权标准的情况下，通信接收端对X1和Y1进行授权。
在步骤410，通信接收端经第二传输节点和第一传输节点向通信发起端发送携带X1和Y1的应答报文。
在步骤411，通信发起端保存X1和Y1。
为了使本申请实施例提供的防护方法更加清楚，参考图5对防护方法的流程进行具体说明，在数据报文为第二数据报文的情况下，防护流程具体内容还可以如下：
在步骤501中，通信发起端判断待发送的数据报文为第二数据报文的情况下，根据数据报文的IP信息，获取第一传输节点和第二传输节点的授权检验信息X1和Y1。
在步骤502，通信发起端转发携带X1和Y1的数据报文至第一传输节点。
在步骤503，第一传输节点对X1进行验证。
在步骤504，在验证通过的情况下，第一传输节点向第二传输节点转发携带X1和Y1的数据报文。
在步骤505，第二传输节点对Y1进行验证。
在步骤506，在验证通过的情况下，第二传输节点向通信接收端转发携带X1和Y1的数据报文。
在步骤507，通信接收端向通信发起端发送应答报文。
本申请实施例提供的通信防护方法，通过对发向通信接收端的首个数据报文进行强验证，并且，在强验证通过的情况下，才向通信接收端转发数据报文，实现了在建立与通信接收端之间的通信的同时，也进行了安全验证，避免了通信接收端被攻击，确保了网络的安全可信，另外，对向通信接收端的非首个数据报文进行弱验证，实现即使已接入通信接收端，对于往来的数据报文仍然需要进行弱验证，避免了数据报文带来的潜在风险，因此，解决了业务互通过程防护效率低下、防御系统性差和防护不够全面的问题，达到了对通信互通过程，全面高效防护的目的。另外，通过对数据报文中的信息进行密码学计算，避免数据泄露引发安全问题的同时，还可以通过携带因加密而生成的第一验证值，供后面的第二传输节点和通信接收端对数据报文的真实性进行检测，避免转发存在安全隐患的数据报文，保证了数据报文传输流程中的安全，对授权检验信息的验证用于检查数据报文的源IP(即通信发起端的IP)是否发生变化，避免转发来源不明的数据报文，从端到端的角度实现系统性的安全保护。
上面各种方法的步骤划分，只是为了描述清楚，实现时可以合并为一个步骤或者对某些步骤进行拆分，分解为多个步骤，只要包括相同的逻辑关系，都在本申请的保护范围内；对算法中或者流程中添加无关紧要的修改或者引入无关紧要的设计，但不改变其算法和流程的核心设计都在该申请的保护范围内。
本申请实施例提供了一种通信防护系统，防护系统的网络架构如图6所示，具体包括：通信发起端、通信接收端、第一传输节点进而至少一个第二传输节点。
通信发起端，用于向通信接收端发送数据报文，接收来自通信接收端的数据报文。
通信接收端，用于接收来自通信发起端的数据报文，对通信发起端进行授权，向通信发起端发送检验信息。可选地，对第一数据报文添加检验信息，对第二数据报文携带的检验信息进行验证。
第一传输节点，用于确定数据报文时第一数据报文还是第二数据报文，对第一数据报文进行密码学计算，对第二数据报文添加授权检验信息。可选地，第一传输节点还可以对通信发起端进行真实性检查。
第二传输节点，为第一数据报文生成并添加检验信息，对第二数据报文携带的授权检验信息进行验证。
本申请实施例提供的通信防护系统还可以包括密钥管理中心，用于管理通信发起端和第一传输节点的密钥信息。
本申请实施例还提供了一种防护系统，防护系统的网络架构如图7所示，具体包括：通信发起端、通信接收端、第一传输节点。
通信发起端，用于确定数据报文时第一数据报文还是第二数据报文，对第一数据报文进行密码学计算，对第二数据报文添加授权检验信息，接收来自通信接收端的数据报文。
通信接收端，用于接收来自通信发起端的数据报文，对通信发起端进行授权，向通信发起端发送检验信息。可选地，对第一数据报文添加检验信息，对第二数据报文携带的检验信息进行验证。
第一传输节点，为第一数据报文生成并添加检验信息，对第二数据报文携带的授权检验信息进行验证。
本申请实施例提供的通信防护系统还可以包括密钥管理中心和至少一个第二传输节点，其中，密钥管理中心用于管理通信发起端口的密钥信息，第二传输节点用于接收来自上一传输节点的数据报文，对第一数据报文进行密码学计算，对第二数据报文添加授权检验信息，另外，第二传输节点还可以对通信发起端进行授权。
本申请上述实施方式中所涉及到的各模块均为逻辑模块，在实际应用中，一个逻辑单元可以是一个物理单元，也可以是一个物理单元的一部分，还可以以多个物理单元的组合实现。此外，为了突出本申请的创新部分，本实施方式中并没有将与解决本申请所提出的技术问题关系不太密切的单元引入，但这并不表明本实施方式中不存在其它的单元。
本申请的实施例还提供一种电子设备，如图8所示，包括至少一个处理器801；以及，与所述至少一个处理器801通信连接的存储器802；其中，所述存储器802存储有可被所述至少一个处理器801执行的指令，所述指令被所述至少一个处理器801执行，以使所述至少一个处理器能够执行上述通信防护方法。
其中，存储器和处理器采用总线方式连接，总线可以包括任意数量的互联的总线和桥，总线将一个或多个处理器和存储器的各种电路连接在一起。总线还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路连接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口在总线和收发机之间提供接口。收发机可以是一个元件，也可以是多个元件，比如多个接收器和发送器，提供用于在传输介质上与各种其他装置通信的单元。经处理器处理的数据通过天线在无线介质上进行传输，进一步，天线还接收数据并将数据传送给处理器。
处理器负责管理总线和通常的处理，还可以提供各种功能，包括定时，外围接口，电压调节、电源管理以及其他控制功能。而存储器可以被用于存储处理器在执行操作时所使用的数据。
上述产品可执行本申请实施例所提供的方法，具备执行方法相应的功能模块和有益效果，未在本实施例中详尽描述的技术细节，可参见本申请实施例所提供的方法。
本申请的实施例还提供一种计算机可读存储介质，存储有计算机程序。计算机程序被处理器执行时实现上述方法实施例。
本领域技术人员可以理解，实现上述实施例方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM,Read-Only Memory)、随机存取存储器(RAM,Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
上述实施例是提供给本领域普通技术人员来实现和使用本申请的，本领域普通技术人员可以在脱离本申请的发明思想的情况下，对上述实施例做出种种修改或变化，因而本申请的保护范围并不被上述实施例所限，而应该符合权利要求书所提到的创新性特征的最大范围。

Claims (16)

  1. 一种通信防护方法，包括：
    确定待发送的数据报文的类型；其中，所述数据报文的类型包括：第一数据报文和第二数据报文；所述第一数据报文为向通信接收端发送的首个数据报文，所述第二数据报文为向所述通信接收端发送的非首个数据报文；
    在所述数据报文为所述第一数据报文的情况下，对所述数据报文进行强验证；
    在所述数据报文为所述第二数据报文的情况下，对所述数据报文进行弱验证；其中，所述强验证为安全性强于所述弱验证的验证；
    在验证通过的情况下，向所述通信接收端发送所述数据报文。
  2. 根据权利要求1所述的通信防护方法，其中，所述判断所述数据报文的类型，包括：
    在所述数据报文携带首次出现的通信接收端的IP的情况下，将所述数据报文确定为第一数据报文；
    在所述数据报文携带非首次出现的通信接收端的IP的情况下，将所述数据报文确定为第二数据报文。
  3. 根据权利要求1所述的通信防护方法，其中，所述方法应用于第一传输节点或通信发起端，所述对所述数据报文进行强验证，包括：
    对所述数据报文进行密码学计算并生成第一验证值，为所述数据报文添加第一验证值；
    所述对所述数据报文进行弱验证，包括：
    根据所述数据报文携带的IP信息，为所述数据报文添加存储的授权检验信息。
  4. 根据权利要求3所述的通信防护方法，其中，所述对所述数据报文进行密码学计算并生成第一验证值，包括：
    在所述方法应用于所述第一传输节点的情况下，使用第一传输节点的密钥对所述通信发起端和/或所述第一传输节点的信息进行密码学计算，并生成第一验证值，或者，使用通信发起端的密钥对所述通信发起端和/或所述第一传输节点的信息进行密码学计算，并生成第一验证值；
    在所述方法应用于所述通信发起端的情况下，使用所述通信发起端的密钥对所述通信发起端的信息进行密码学计算并生成第一验证值。
  5. 根据权利要求3所述的通信防护方法，其中，所述在为所述数据报文添加第一验证值后，所述方法还包括：
    在所述方法应用于所述第一传输节点的情况下，对所述通信发起端进行真实性检查；其中，所述真实性检查包括以下一种或多种组合：基于访问控制的检查、基于验证码的检查、基于密码学的检查和基于令牌的检查。
  6. 根据权利要求3所述的通信防护方法，其中，在所述向通信接收端发送所述数据报文 之后，还包括：
    接收通信接收端返回的应答报文；其中，所述应答报文携带所述授权检验信息；
    存储所述授权检验信息。
  7. 根据权利要求3所述的通信防护方法，其中，所述方法应用于第一传输节点或第二传输节点或通信接收端，所述对所述数据报文进行强验证，包括：
    对所述数据报文携带的第一验证值进行验证；
    为所述数据报文生成检验信息，并为所述数据报文添加所述检验信息；
    所述对所述数据报文进行弱验证，包括：
    对所述数据报文携带的授权检验信息进行验证。
  8. 根据权利要求7所述的通信防护方法，其中，所述对所述数据报文携带的第一验证值进行验证，包括：
    在所述方法应用于所述第一传输节点的情况下，使用通信发起端的密钥和所述通信发起端的信息，对所述第一验证值进行第一验证；
    在所述方法应用于所述第二传输节点的情况下，使用所述第一传输节点的密钥和所述通信发起端和/或所述第一传输节点的信息，对所述第一验证值进行第一验证，或者,使用所述通信发起端的密钥和所述通信发起端和/或所述第一传输节点的信息，对所述第一验证值进行第一验证；
    在所述方法应用于所述通信接收端的情况下，使用所述第一传输节点的密钥和所述通信发起端和/或所述第一传输节点的信息，对所述第一验证值进行第一验证，或者,使用所述通信发起端的密钥和所述通信发起端和/或所述第一传输节点的信息，对所述第一验证值进行第一验证。
  9. 根据权利要求7所述的通信防护方法，其中，所述为所述数据报文生成检验信息，包括：
    当所述方法应用于第二传输节点时，在所述数据报文携带首次出现的所述通信接收端的IP的情况下，根据第一传输节点的IP和所述通信接收端的IP生成所述检验信息；在所述数据报文携带首次出现的所述通信接收端的IP和首次出现的所述通信发起端的IP的情况下，根据所述通信发起端的IP和所述通信接收端的IP生成所述检验信息；
    当所述方法应用于第一传输节点时，根据所述通信发起端的IP和通信接收端的IP生成检验信息；
    当所述方法应用于所述通信接收端时，根据所述第一传输节点的IP和所述通信接收端的IP生成所述检验信息，或者，根据所述通信发起端的IP和所述通信接收端的IP生成所述检验信息。
  10. 根据权利要求7所述的通信防护方法，其中，所述对所述数据报文携带的授权检验信息进行验证，包括：
    当所述方法应用于所述第二传输节点时，在所述数据报文携带非首次出现的通信接收端 的IP的情况下，根据所述第一传输节点的IP和所述通信接收端的IP，对所述数据报文携带的授权检验信息进行验证；在所述数据报文携带非首次出现的通信接收端的IP和非首次出现的通信发起端的IP的情况下，根据所述通信发起端的IP和所述通信接收端的IP，对所述数据报文携带的授权检验信息进行验证；
    当所述方法应用于所述第一传输节点时，根据所述通信发起端的IP和通信接收端的IP，对所述数据报文携带的授权检验信息进行验证；
    当所述方法应用于所述通信接收端时，根据所述第一传输节点的IP和所述通信接收端的IP，对所述数据报文携带的授权检验信息进行验证，或者，根据所述通信发起端的IP和所述通信接收端的IP，对所述数据报文携带的授权检验信息进行验证。
  11. 根据权利要求7所述的通信防护方法，其中，在所述对所述数据报文进行强验证之后，还包括：
    根据预设授权标准对所述检验信息进行筛选，得到所述授权检验信息，其中，所述授权检验信息随所述通信发起端的应答报文共同发送至所述通信发起端。
  12. 根据权利要求1所述的通信防护方法，其中，在所述数据报文为向所述通信接收端发送的非首个数据报文，且所述数据报文安全性差的情况下，所述数据报文为第一数据报文；在所述数据报文为向所述通信接收端发送的首个数据报文，且所述数据报文安全性强的情况下，所述数据报文为第二数据报文。
  13. 一种通信防护系统，包括：通信发起端、通信接收端、第一传输节点和至少一个第二传输节点；
    所述第一传输节点设置为执行如权利要求3-6中任一项所述通信防护方法；
    所述第二传输节点和所述通信接收端设置为执行如权利要求7-12中任一项所述的通信防护方法。
  14. 一种通信防护系统，包括：通信发起端、通信接收端和第一传输节点；
    所述通信发起端设置为执行如权利要求3-6中任一项所述通信防护方法；
    所述第一传输节点和所述通信接收端设置为执行如权利要求7-12中任一项所述的通信防护方法。
  15. 一种电子设备，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如权利要求1至12中任一项所述的通信防护方法。
  16. 一种计算机可读存储介质，存储有计算机程序，其中，所述计算机程序被处理器执行时实现权利要求1至12中任一项所述的通信防护方法。
PCT/CN2023/097581 2022-06-17 2023-05-31 通信防护方法、系统、电子设备及存储介质 WO2023241363A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210692194.0A CN117318961A (zh) 2022-06-17 2022-06-17 通信防护方法、系统、电子设备及存储介质
CN202210692194.0 2022-06-17

Publications (1)

Publication Number Publication Date
WO2023241363A1 true WO2023241363A1 (zh) 2023-12-21

Family

ID=89192237

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/097581 WO2023241363A1 (zh) 2022-06-17 2023-05-31 通信防护方法、系统、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN117318961A (zh)
WO (1) WO2023241363A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101699873A (zh) * 2009-10-21 2010-04-28 南京邮电大学 基于分级安全的广播认证设计方法
WO2017186069A1 (zh) * 2016-04-29 2017-11-02 华为技术有限公司 一种数据传输方法及网络设备
US20210099464A1 (en) * 2019-09-30 2021-04-01 International Business Machines Corporation Network transmission path verification
CN113873041A (zh) * 2021-09-30 2021-12-31 迈普通信技术股份有限公司 报文传输方法、装置、网络设备及计算机可读存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101699873A (zh) * 2009-10-21 2010-04-28 南京邮电大学 基于分级安全的广播认证设计方法
WO2017186069A1 (zh) * 2016-04-29 2017-11-02 华为技术有限公司 一种数据传输方法及网络设备
US20210099464A1 (en) * 2019-09-30 2021-04-01 International Business Machines Corporation Network transmission path verification
CN113873041A (zh) * 2021-09-30 2021-12-31 迈普通信技术股份有限公司 报文传输方法、装置、网络设备及计算机可读存储介质

Also Published As

Publication number Publication date
CN117318961A (zh) 2023-12-29

Similar Documents

Publication Publication Date Title
US10616379B2 (en) Seamless mobility and session continuity with TCP mobility option
EP1987629B1 (en) Techniques for authenticating a subscriber for an access network using dhcp
US6892308B1 (en) Internet protocol telephony security architecture
US8495710B2 (en) Port tapping for secure access
US6725276B1 (en) Apparatus and method for authenticating messages transmitted across different multicast domains
US20040179521A1 (en) Authentication method and apparatus in EPON
JPH07193569A (ja) 通信の安全を保つ方法及び安全にデータを転送する装置
WO2015085848A1 (zh) 一种安全认证方法和双向转发检测bfd设备
WO2014021870A1 (en) Feature enablement or disablement determination based on discovery message
US8145917B2 (en) Security bootstrapping for distributed architecture devices
Chadalapaka et al. Internet small computer system interface (iSCSI) protocol (consolidated)
CN107277058B (zh) 一种基于bfd协议的接口认证方法及系统
WO2017012142A1 (zh) 一种双连接安全通讯的方法及装置
US10116646B2 (en) Software-defined network threat control
US11012432B2 (en) Method for distributed application segmentation through authorization
CN107040508B (zh) 用于适配终端设备的授权信息的设备和方法
WO2023241363A1 (zh) 通信防护方法、系统、电子设备及存储介质
EP1320975B1 (en) Internet protocol telephony security architecture
CN112333214B (zh) 一种用于物联网设备管理的安全用户认证方法及系统
Harikrishna et al. Network as a service model in cloud authentication by HMAC algorithm
CN114157419B (zh) 一种基于ospf的安全路由协议方法和系统
EP1614269A1 (en) Secure distributed system for management of local community representation within network devices
US20080289004A1 (en) Method and Module for Protecting Against Attacks in a High-Speed Network
Min SIP network secure communication model based on improved SIP protocol
CN100377541C (zh) 在分布式终端组件之间进行连接控制和安全验证的方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23822933

Country of ref document: EP

Kind code of ref document: A1