CN116366323A - Network target range scene isolated access method and system based on dynamic domain name - Google Patents

Abstract

The invention discloses a network target scene isolation access method and system based on a dynamic domain name, wherein when a user requests to start a target scene or view a target machine address interface of the scene through a browser, a request address used by the user is recorded; when a target range scene is started, dynamically generating a globally unique character string for an access target aircraft in the scene, and accessing the character string as the target aircraft to a domain name with three or more levels in a domain name address; simultaneously recording the corresponding relation between the domain name and the real address of the target drone; when a user requests to access the target aircraft through the domain name address, address consistency verification is carried out, after the verification is passed, the real address of the target aircraft is obtained, and reverse proxy is carried out. The invention does not need to use a special client and occupy public network IP, and has the advantages of simple configuration, easy expansion, high concurrency support, low operation and maintenance cost, high safety and the like.

Description

A dynamic domain name-based network shooting range scene isolation access method and system

technical field

The invention relates to a network shooting range scene isolation access method and system based on a dynamic domain name, belonging to the technical field of network security.

Background technique

The network shooting range is a test platform that simulates the real cyberspace offensive and defensive combat environment through virtualization technology, and can support combat capability research and weapon equipment verification. In order to achieve the above purpose, in the actual training or verification process, it is necessary to provide an isolated environment for different scenarios and provide a unified access method for different users.

As shown in Figure 1, a typical user access system includes at least the following components, client VPN, VPN server, target scene, VLAN switch, and shooting range dispatch center. The functions of each component are as follows: VPN client: the client is installed by the access user, must be run and installed on the access user system, and the user accesses the scene network after operation. VPN server: The server provides different clients with access to different scenarios through network configuration, including functions such as current limiting and scenario isolation, which take up a lot of resources. VLAN switch: build different network isolation environments. Target drone scenario: the target environment to be accessed. Different target drone scenarios should provide corresponding isolation and allow users assigned to the scenario to access. Shooting range scheduling center: Start the target drones in the shooting range, build the network environment in the switch, and assign the target drones to different scenarios.

The access steps of the access system shown in Figure 1 include: 1. The range dispatch center starts the target drone, builds a network isolation environment through a VLAN switch, and connects different target drones to different scenarios. 2. The server VPN enables service access according to predefined rules, and assigns users to different network environments when the client accesses. 3. The user opens the client to access different network isolation environments through the VPN server.

The existing user access system has the following problems: 1. The user needs to install a VPN client, and the client needs to match the user's system environment, and the unused operating system may not be able to access it. 2. The traffic carried by the VPN server is too large, and there is a problem of slow user access when the number of concurrent users is large. 3. The VPN server needs to configure the network for different network shooting range scenarios, which is heavy tasks, complicated operations, and low flexibility. 4. If you directly use port mapping to access, a small number of public network IPs will cause port scanning, and different users will access different scenarios, posing security risks. 5. The VPN client cannot implement anti-cheating restrictions on the network shooting range. Different users only need to exchange VPN client configuration files to access other scenes.

Contents of the invention

Purpose of the invention: The purpose of the present invention is to provide a network shooting range scene isolation access method and system based on a dynamic domain name, by assigning the scene to different third-level or above domain names for dynamic user access, without using a VPN client, without occupying Public network IP has the advantages of simple configuration, easy expansion, support for high concurrency, low operation and maintenance costs, and high security.

Technical solution: In order to achieve the above-mentioned purpose of the invention, the present invention adopts the following technical solution:

A dynamic domain name-based network shooting range scene isolation access method, comprising:

When the user requests to open the shooting range scene or view the scene target machine address interface through the browser, record the request address used by the user;

When the shooting range scene is started, a globally unique character string is dynamically generated for the access target machine in the scene, and it is used as the third-level or above domain name in the target machine access domain name address; at the same time, the third-level or above domain name and the target The corresponding relationship of the real address of the computer;

Feedback the access domain name address of the target machine to the user, receive the user's request to access the target machine through the domain name address, obtain the request address of the user's access request, and pass the consistency check with the recorded request address, according to the domain name address obtain the real address of the target machine, bind the requested domain name address with the real address of the target machine, and proxy the access request of the domain name address.

Preferably, for a situation where multiple users access multiple target machines in the scene, one or more domain names are dynamically generated for each target machine in the scene.

As a preference, when the user views the scene target machine address page, the address requested by the user is written into the target machine to allow access to the address pool; when the user accesses the target machine through a domain name, query whether the requested address is in the address pool, if not If access is denied, if it exists, reverse proxy to the real address of the target machine will be performed.

Preferably, for the case of accessing the target machine in the scene in units of groups, the domain name generated for the target machine includes identification information of the group to which the user belongs.

Preferably, the dynamically generated third-level or above domain names use UUID strings, or strings containing UUIDs.

A network shooting range scene isolation access system based on a dynamic domain name, including:

The request address recording module is used to record the request address used when the user opens the shooting range scene or checks the scene target machine address interface;

The dynamic domain name generation module is used to dynamically generate a globally unique character string for the access target machine in the scene when the shooting range scene is started, and use it as the third-level or above domain name in the target machine access domain name address; at the same time, record the The corresponding relationship between the third-level or above domain name and the real address of the target machine;

The access proxy module is used to receive the user's request to access the target machine through the domain name address, obtain the request address of the user's access request, and pass the consistency check with the recorded request address, according to the third level or above in the domain name address Domain name, obtain the real address of the target machine, bind the requested domain name address with the real address of the target machine, and proxy the access request of the domain name address.

A computer system, comprising a memory, a processor, and a computer program stored on the memory and operable on the processor. When the computer program is loaded into the processor, the dynamic domain name-based network shooting range scene isolation access is realized. method steps.

Beneficial effects: Compared with the prior art, the present invention has the following advantages: 1. It is easier for users to access shooting range scenes without installing an additional VPN client program. 2. Access service configuration is simple, unified management, can quickly expand functions, can quickly add devices in high concurrency scenarios, and reduce operation and maintenance costs. 3. Hide the real target address of the shooting range scene, prevent users from destructive operations on the platform, and improve the ability to resist risks. 4. Record the user's request address and verify it with the domain name. Different users/teams cannot access the target machine through the same domain name address, effectively preventing users from cheating. 5. The domain name is dynamically generated with strong randomness, and users cannot violently access the platform through scanning.

Description of drawings

FIG. 1 is a structural diagram of an existing access system.

Fig. 2 is a schematic flow chart of the method of the embodiment of the present invention.

Fig. 3 is an example diagram of dynamic domain name access in the embodiment of the present invention.

Detailed ways

The technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings and specific embodiments.

As shown in Figure 2, a network shooting range scene isolation access method based on a dynamic domain name disclosed in the embodiment of the present invention records the request address used by the user when the user requests to open the shooting range scene or view the scene target machine address interface through the browser ; When the shooting range scene is started, dynamically generate a globally unique character string for the access target machine in the scene, and use it as the third-level or above domain name in the target machine access domain name address; record the third-level or above domain name and The corresponding relationship of the real address of the target machine; feedback the access domain name address of the target machine to the user, receive the user's request to access the target machine through the domain name address, obtain the request address of the user's access request, and verify the consistency with the recorded request address After the verification is passed, the real address of the target machine is obtained according to the third-level or above domain name in the domain name address, the requested domain name address is bound to the real address of the target machine, and the access request of the domain name address is delegated.

The above solution assigns the target machine in the scene to different third-level or above domain names to dynamically access the scene in the network shooting range. It does not need to install a VPN client, and directly uses the standard access method of different scenes to access the target machine in the scene. That's it. It can be flexibly configured in different application scenarios. For example, in the case of multiple users accessing multiple drones in the scenario, one or more domain names can be dynamically generated for each drone in the scenario for users to access. User/user group identification information can also be added to the domain name to facilitate user identification.

Based on the same inventive concept, a network shooting range scene isolation access system based on a dynamic domain name disclosed in an embodiment of the present invention includes: a request address recording module for recording the user’s address when opening the shooting range scene or viewing the scene target machine address interface The request address; the dynamic domain name generation module is used to dynamically generate a globally unique string for the access target machine in the scene when the shooting range scene is started, and use it as the third-level or above domain name in the target machine access domain name address; At the same time, record the corresponding relationship between the third-level or above domain name and the real address of the target machine; the access proxy module is used to receive the user's request to access the target machine through the domain name address, obtain the request address of the user's access request, and record the request address After the consistency check is passed, the real address of the target machine is obtained according to the third-level or above domain name in the domain name address, and the requested domain name address is bound to the real address of the target machine to proxy the access request of the domain name address.

Based on the same inventive concept, a computer system disclosed in an embodiment of the present invention includes a memory, a processor, and a computer program stored in the memory and operable on the processor. When the computer program is loaded into the processor, the The steps of the above-mentioned dynamic domain name-based network shooting range scene isolation access method.

The following describes a specific dynamic domain name access process with reference to the example in FIG. 3 .

1. The user accesses the platform (such as competition platform, confrontation platform, etc.) through a browser. When the user opens the shooting range scene, record the request address used when opening the shooting range scene. For small-scale problem-solving or experimental scenarios, the user can open the scene by himself, and record the requested IP address when the user opens the scene, and use it to compare and judge whether he has access rights when accessing (for the scene that can access his own , cannot access other people’s scenes); for large-scale confrontation scenes, the scene is pre-started, and the platform can record the IP address used when the user logs in to view the target machine address interface of the scene (the authority of the user to access the scene is managed by the platform). To access the address pool, when the user accesses the platform scene, compare whether the address of the access scene is in the address pool, and judge whether the user has the access authority of the scene.

2. After the shooting range dispatch center starts the scene, the domain name is dynamically generated and assigned to the target machine for access by the target machine. The dynamically generated random third-level domain name can be in the form of UUID + special identification.

In the ordinary online topic scenario, after the shooting range generates the scene, the intranet address is assigned to the target machine in the scene. The competition platform will record the address of the intranet target machine, and generate a random string, combine the random string with the platform domain name to generate the domain name, and Bind the intranet address of the target machine, and store the key-value pair in the database. For users to access through the domain name.

In a large-scale scenario involving multiple groups of confrontations, the platform assigns random strings to a large number of scene target machines, and jointly queries the random string and the intranet address of the target machine. In a large-scale scene, there will be multiple different domain names pointing to the same scene In the case of different intranet addresses of the target machine, the network is isolated by the internal network of the target machine, and is not affected by the domain name address. Perceived in the scene, the user is not affected.

When the platform accesses the target machine in the form of a team, there are cases where different users access the same domain name. In this case, all users of the team must click to view the target machine address interface, and the platform will record the user's name when clicking to view the target machine address. address, and write the target machine to allow access to the address pool. When accessing the target machine, check whether the address pool exists for the address, and determine that the user is a user of the scene team to which it belongs.

3. Users access the platform directly through the domain name.

4. According to the user's access request address, the platform jointly requests the domain name of the target machine for verification to prevent users from accessing the target machine through different request addresses.

For the scene opened by the user, compare whether the opening request address is the same as the address of the access target machine, and if they are the same, run the access and open the reverse proxy; for large-scale scenarios, when the user checks the address of the target machine in the scene, the network address used will be recorded by the platform. And write the address pool that the domain name of the target machine can access. The network address used by the user to access the target machine through the domain name of the target machine will match the address pool that the domain name of the target machine can access. If it does not exist, the connection will be rejected. Access is allowed, and the reverse proxy to the intranet target machine is enabled.

5. After passing the verification, the platform directly proxies the backend address bound to the domain name. Specifically, reverse proxy and load balancing can be realized through the Nginx+Lua tool.

6. The user successfully accesses the target machine.

When the access usage group accesses the scene in groups, such as a competition team competition, there are multiple users in one group, multiple users are allowed to access the same address, and at the same time, the status of multiple users accessing the same address in the on-site environment is reserved , the access system only performs two-way matching between the domain name and the target machine for the target machine, which does not affect the multi-user access situation, and in the case of multiple users, the domain name accessible address pool can allow multiple addresses to exist, The user can access the question after viewing the question. In the team competition, the domain name generation can carry the group name or the corresponding identification code. The domain name component carries some user identifiable information to help users accurately determine whether it is the target address of the desired scene.

In the solution of the present invention, the user does not need to use a dedicated client, and can directly access the target machine only by using a standard service access method. Different users/teams cannot access the target machine through the same domain name address. The domain name is dynamically generated, and users cannot access the platform violently by means of user scanning.

Claims (10)

1. A network shooting range scene isolation access method based on a dynamic domain name, characterized in that, comprising: When the user requests to open the shooting range scene or view the scene target machine address interface through the browser, record the request address used by the user; When the shooting range scene is started, a globally unique character string is dynamically generated for the access target machine in the scene, and it is used as the third-level or above domain name in the target machine access domain name address; at the same time, the third-level or above domain name and the target The corresponding relationship of the real address of the computer; Feedback the access domain name address of the target machine to the user, receive the user's request to access the target machine through the domain name address, obtain the request address of the user's access request, and pass the consistency check with the recorded request address, according to the domain name address obtain the real address of the target machine, bind the requested domain name address with the real address of the target machine, and proxy the access request of the domain name address. 2. the network shooting range scene isolation access method based on dynamic domain name according to claim 1, it is characterized in that, for the situation of a plurality of target machines in a plurality of user access scenes, for each target machine in the scene dynamically generate One or more domain names. 3. the network shooting range scene isolation access method based on the dynamic domain name according to claim 1, is characterized in that, when the user checks the scene target machine address page, the address requested by the user is written into the target machine to allow access to the address pool; When the user accesses the target machine through the domain name, check whether the requested address is in the address pool. If it does not exist, the access will be rejected, and if it exists, the reverse proxy to the real address of the target machine will be performed. 4. the network shooting range scene isolation access method based on dynamic domain name according to claim 1, it is characterized in that, for the situation that the target machine in the scene is accessed in units of groups, the domain name generated for the target machine includes the user's belonging group identifying information. 5. The network shooting range scene isolation access method based on a dynamic domain name according to claim 1, wherein the dynamically generated third-level domain name or above adopts a UUID string, or a string containing a UUID. 6. A network shooting range scene isolation access system based on a dynamic domain name, characterized in that it comprises: The request address recording module is used to record the request address used when the user opens the shooting range scene or checks the scene target machine address interface; The dynamic domain name generation module is used to dynamically generate a globally unique character string for the access target machine in the scene when the shooting range scene is started, and use it as the third-level or above domain name in the target machine access domain name address; at the same time, record the The corresponding relationship between the third-level or above domain name and the real address of the target machine; The access proxy module is used to receive the user's request to access the target machine through the domain name address, obtain the request address of the user's access request, and pass the consistency check with the recorded request address, according to the third level or above in the domain name address Domain name, obtain the real address of the target machine, bind the requested domain name address with the real address of the target machine, and proxy the access request of the domain name address. 7. The network shooting range scene isolation access system based on dynamic domain name according to claim 1, characterized in that, for the situation of multiple target machines in the access scene of multiple users, each target machine in the scene is dynamically generated One or more domain names. 8. The network shooting range scene isolation access system based on a dynamic domain name according to claim 1, wherein when the user checks the scene target machine address page, the address requested by the user is written into the target machine to allow access to the address pool; When the user accesses the target machine through the domain name, check whether the requested address is in the address pool. If it does not exist, the access will be rejected, and if it exists, the reverse proxy to the real address of the target machine will be performed. 9. The network shooting range scene isolation access system based on a dynamic domain name according to claim 1, characterized in that, for the situation of accessing the target machine in the scene in units of groups, the domain name generated for the target machine includes the name of the group to which the user belongs. identifying information. 10. A computer system, comprising a memory, a processor, and a computer program stored in the memory and operable on the processor, characterized in that, when the computer program is loaded into the processor, the computer program according to any of claims 1-5 is implemented. A step of the method for isolating and accessing a network shooting range scene based on a dynamic domain name.

Images