WO2021057348A1 - Server security defense method and system, communication device, and storage medium - Google Patents

Abstract

A server security defense method and system, a communication device, and a storage medium. The method comprises: a client sends a domain name resolution request to a domain name server, and the domain name server resolves a server domain name in request information to an identifier management server IP address and returns same to the client; the client sends a service request to the identifier management server, the service request comprising a service identifier, the identifier management server requests a dynamic identifier from an identifier gateway, the identifier gateway allocates dynamic identifier information and returns same to the identifier management server, and establishes a mapping relationship, and the identifier management server returns a redirection response to the client; the client sends the service request to the identifier gateway, and the identifier gateway converts service request information according to the mapping relationship and sends same to a service server, and converts response information received from the service server and sends same to the client. In some implementation processes, communication parameters of a server are randomly and dynamically changed to proactively protect a target server.

Description

Server security defense method and system, communication equipment, and storage medium

Cross-references to related applications

This application is based on a Chinese patent application with application number 201910913485.6 and an application date of September 25, 2019, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby incorporated by reference into this application.

Technical field

The embodiment of the present invention relates to but not limited to the field of security technology, and specifically relates to but not limited to a server security defense method and system, communication equipment, and storage medium.

Background technique

Moving Target Defense (MTD) is a new type of network security protection idea. Through technical means, the attack surface of the protected target presented to the attacker is continuously and dynamically changed to confuse the attacker and increase The cost and complexity of the attacker's successful attack will reduce the probability of successful attack and improve the system's resilience and security.

In Internet services, in order to ensure the reachability of server services, the IP address of the server and the service port must remain stable and open to all access terminals, which will make the server vulnerable to attacks. Therefore, how to effectively defend the server security has become an urgent problem to be solved.

Summary of the invention

The server security defense method and system, communication equipment, and storage medium provided by the embodiments of the present invention aim to solve one of the related technical problems at least to a certain extent, including: in the Internet, the IP address and service port of the server are The access terminal is open, causing the server to be vulnerable to attacks.

In view of this, an embodiment of the present invention provides a server security defense method, which includes: a client sends a domain name resolution request to a domain name server, and the domain name server resolves the server domain name in the request information to the IP address of the identification management server, and then The IP address is returned to the client; the client sends a service request to the identity management server, the service request includes a service identity, the identity management server requests a dynamic identity from the identity gateway, and the identity gateway allocates dynamic identity information and returns it to the identity management server, and at the same time establishes a mapping Relationship, which identifies the management server returning a redirection response to the client;

The client sends a service request to the identification gateway, and the identification gateway converts the service request information according to the mapping relationship and sends it to the service server, and converts the received response information of the service server and sends it to the client.

The embodiment of the present invention also provides a server security defense system, including: a client, which is used to support the domain name resolution client function and service access function, uses the service identifier to initiate service requests, and is also used to support the service redirection function, that is, according to the service The redirection response returned by the server accesses the specified network resource; the domain name server is used to resolve the domain name of the business server to the IP address of the identity management server; and select one or more identity from multiple identity management servers according to a preset strategy The IP address of the management server; the identification management server is used to receive the service request sent by the client, select the identification gateway according to the preset strategy, request the dynamic identification from the identification gateway, generate the redirection service identification, and return the redirection response to the client; The identification gateway is used to generate a dynamic identification according to the request of the identification management server, establish the mapping relationship between the client IP address, the dynamic identification, and the business server identification, and forward the business request from the client and the response to the client according to the mapping relationship; The business server is used to provide business services.

An embodiment of the present invention also provides a communication device, including: a processor, a memory, and a communication bus; where the communication bus is used to implement connection and communication between the processor and the memory; where the processor is used to execute one or the other stored in the memory. Multiple computer programs to implement the steps of the server security defense method as described above.

The embodiment of the present invention also provides a computer-readable storage medium that stores one or more programs, where the one or more programs can be executed by one or more processors to implement the server security defense as described above Method steps.

Other features and corresponding beneficial effects of the present invention are described in the latter part of the specification, and it should be understood that at least part of the beneficial effects will become apparent from the description in the specification of the present invention.

Description of the drawings

FIG. 1 is a schematic structural diagram of a server security defense system provided by Embodiment 1 of the present invention;

2 is a flowchart of a server security defense method provided by Embodiment 1 of the present invention;

3 is a flowchart of a server security defense method provided by Embodiment 2 of the present invention;

4 is a flowchart of a server security defense method provided by Embodiment 3 of the present invention;

5 is a schematic structural diagram of a service security defense system provided by Embodiment 4 of the present invention;

6 is a flowchart of a server security defense method provided by Embodiment 4 of the present invention;

FIG. 7 is a schematic structural diagram of a communication device according to Embodiment 5 of the present invention.

detailed description

In order to make the objectives, technical solutions, and advantages of the present invention clearer, the following further describes the embodiments of the present invention in detail through specific implementations in conjunction with the accompanying drawings. It should be understood that the specific embodiments described here are only used to explain the present invention, but not to limit the present invention.

Example one:

In order to solve the problem that in the Internet, the server's IP address and service port are open to all accessed terminals, causing the server to be vulnerable to attacks, an embodiment of the present invention provides a server security defense method for use in a server security defense network system.

Please refer to FIG. 1, which is a server security defense system provided by an embodiment of the present invention. In the embodiment of the present invention, the server security defense network system includes: a client 101, a domain name server 102, an identity management server 103, an identity gateway 104, and a business server 105. The identification gateway 104 is located between the client 101 and the business server 105, that is, the client 101 and the business server 105 are divided into different security areas, where the business server 105 is located in a high-security zone, and the identification gateway 104 provides security protection for the business server 105. Prevent attacks from the client.

Among them, the client 101 is used to support the domain name resolution client function and service access function, use the service identifier to initiate service requests, and also support the service redirection function, that is, access the specified network resource according to the redirection response returned by the service server; The server 102 is used to resolve the domain name of the business server 105 into the IP address of the identity management server 103; and select one or more identity management server IP addresses from multiple identity management servers according to a preset strategy; the identity management server 103 uses After receiving the service request sent by the client 101, the identification gateway is selected according to the preset strategy, the dynamic identification is requested from the identification gateway, the redirection service identification is generated, and the redirection response is returned to the client; the identification gateway 104 is used to manage the server according to the identification The 103 request generates a dynamic identifier, establishes the mapping relationship between the client IP address, dynamic identifier, and service server identifier, and forwards the service request from the client and the response to the client according to the mapping relationship; the service server 105 is used to provide services service.

For the server security defense method provided by the embodiment of the present invention, please refer to FIG. 2, which includes the following steps:

S201: The client sends a domain name resolution request to the domain name server, and the domain name server resolves the domain name of the business server to the IP address of the identification management server, and returns it to the client.

In step S201, the client sends a domain name resolution request to the domain name server, and the domain name server resolves the domain name of the business server in the request information to the IP address of the identification management server, and resolves the IP address of the identification management server obtained by the domain name server. Return to the client. Wherein, the identity management server may include one or more identity management servers. After receiving the domain name resolution request sent from the client, the domain name server selects at least one identity management server from a plurality of identity pipeline servers according to a preset policy The IP address is sent to the client.

In the embodiment of the present invention, the strategy includes: selecting the identity management server closest to the location of the client according to the location information of the client; or polling each identity management server; or, selecting the identity management server with a lighter load.

S202: The client sends a service request to the identity management server, the identity management server requests a dynamic identity from the identity gateway, and the identity gateway allocates dynamic identity information and returns it to the identity management server. At the same time, a mapping relationship is established, and the identity management server returns a redirection response to the client.

Wherein, when the identity management server sends a dynamic identity request to the identity gateway, it sends the client's IP address and the service server identity to the selected identity gateway. After receiving the dynamic identification request, the identification gateway allocates the dynamic identification, and establishes the mapping relationship between the client IP and the dynamic identification, or establishes the mapping relationship between the client IP, the dynamic identification, and the service server identification; The dynamic identification is the identification of the gateway address and port, or the domain name and port of the gateway; the business server identification is the IP address and port of the business server, or the domain name and port of the business server. The identity management server replaces the host identity in the service identity with the dynamic identity or inserts the dynamic identity in it according to the service identity in the service request and the dynamic identity, and generates a redirection service identity, and the redirection service identity in the redirection response Information, instructing the client to send a service request to the identification gateway; wherein the host identification includes: the client's IP address, or, the client's IP address and the client's port.

S203: The client sends a service request to the identification gateway, and the identification gateway converts the service request information according to the mapping relationship and sends it to the service server, converts the received response information of the service server, and sends it to the client.

In the embodiment of the present invention, after receiving the service request, the identification gateway searches for the mapping relationship according to the source IP, destination IP, and destination port in the request message. If the corresponding mapping relationship is found, the service request is converted Send to the service server, otherwise, deny access, or lead to a predetermined system; wherein, the conversion of the service request includes: the identification gateway replaces the destination IP and port of the service request, that is, dynamic identification, with the service server in the mapping relationship Identifies the corresponding IP and port, and replaces the source IP and port of the response, that is, the service server identifier, with the IP and port corresponding to the dynamic identifier; said converting the service request further includes: identifying the gateway to convert the service identifier in the service request Replace the dynamic identifier of with the business server identifier.

In a server security defense method provided by an embodiment of the present invention, a client sends a domain name resolution request to a domain name server, and the domain name server resolves the server domain name in the request information into an identification management server IP address, and returns the IP address to the client End; the client sends a service request to the identity management server, the service request includes a service identity, the identity management server requests a dynamic identity from the identity gateway, and the identity gateway allocates dynamic identity information back to the identity management server, and establishes a mapping relationship to identify the management server Return a redirection response to the client; the client sends a service request to the identification gateway, and the identification gateway converts the service request information according to the mapping relationship and sends it to the service server, and converts the received response information from the service server Send to the client, through the addition of the identity management server and the identity gateway, while ensuring the normal business of the server, by randomly changing the communication parameters of the server to the client service, increasing the difficulty of attacking the server, thereby improving the security and service availability of the server , Improve the user experience.

Embodiment two:

In order to solve the problem that the server's IP address and service port are open to all accessed terminals on the Internet, which makes the server vulnerable to attacks, FIG. 3 shows a server security defense method provided by an embodiment of the present invention, which includes the following steps:

First, explain the concept of service identification. The service identification represents the Internet service resources that users want to access. It is generally described by a uniform resource locator and consists of server identification and content identification, such as: www.example.com:80/news/top. xml, where "www.example.com:80" is the server identification, specifically including the server domain name (www.example.com) port (80), where the server domain name can also be identified by the server's IP address, if the default port is used, you can Omit the port; "/news/top.xml/" indicates the specific content provided by the business service, and the combination uniquely indicates the business that the user wants to access. To access the service, the client must first perform a DNS resolution process to obtain the IP address corresponding to the server domain name (www.example.com), and then access the server according to the IP address to obtain the service specified by the service ID.

In the embodiment of the present invention, a server security defense method is provided. The client uses the service identifier to access the service, including the following steps:

S301: The client sends a domain name resolution request to the domain name server;

S302: The domain name server performs domain name resolution and returns a domain name query response;

Wherein, the response information returned by the domain name server to the client includes at least one IP address identifying the management server. In the embodiment of the present invention, in the domain name server, the IP address configured by the server domain name is not the real address of the server, but the IP address of the identity management server. If there are multiple identity management servers in the network, multiple identity management servers can be configured for The domain name server selects the IP address of at least one identity management server from a plurality of identity management servers according to a preset strategy and returns it to the client; in the embodiment of the present invention, the specific strategy includes: selecting according to the location information of the client The identity management server closest to the client's location; or, poll each identity management server; or, select the identity management server with a lighter load.

S303: The client sends a service request to the identity management server according to the result of the domain name resolution;

The service request includes the service identifier. In the request message, the destination IP is the IP address of the identity management server that is parsed in step 302, and the destination port is the default port or designated port of the service application. The message includes the complete business identification.

S304: The identity management server extracts the client IP address and the server identity, selects the identity gateway, and sends a dynamic identity request to the identity gateway;

Among them, the client IP address is extracted from the source IP address header of the service request IP packet, and the server ID is extracted from the service ID. In the selection of the identification gateway, the identification management server selects at least one identification gateway from a plurality of identification gateways according to a preset strategy, and the specific strategy includes: selecting the identification gateway closest to the location of the client according to the location information of the client; or, Polling each identification gateway; or, select an identification gateway with a lighter load.

S305: The identification gateway selects the dynamic identification from the dynamic identification pool, establishes the mapping relationship between the client IP, the dynamic identification, and the server identification, and returns the dynamic identification query response and the selected dynamic identification;

Among them, the dynamic identification pool is composed of an IP address + port number managed by the identification gateway, and a protocol type;

or,

The dynamic identity pool is composed of the IP address managed by the identity, or IP address segment, plus the port range and protocol type to which each IP address belongs.

The above IP address or IP address in the IP address segment can ensure that IP data packets with these addresses as the destination address can be routed and forwarded by other network devices to the correct identification gateway.

In the implementation of the present invention, the specific rules for dynamic identification selection are as follows: select the dynamic identification pool that is not used by all clients, or select the one that is not used by the user client, that is, it can be unique by the client IP and dynamic identification. To determine the mapping relationship.

For example, an identity gateway manages the 10.10.10.1-10.10.10.10 address segment, and each IP address has a port range of 0-65535. For safety reasons, generally select a range other than commonly-known ports, such as 1023-65535. Through the IP addresses in the above IP segment plus more than 60,000 ports for each IP address, a sufficiently large dynamic identification pool is formed, so that the randomness of dynamic identification allocation can be ensured.

If a client, such as 20.20.20.20, needs to access services, you can select an unused dynamic network identifier from the above address pool. For example, 10.10.10.10:5000 is not used, it can be assigned to the client, or by other clients If the client is used, the client can also be assigned, as long as the mapping relationship (20.20.20.20, 10.10.10.10:5000, example.com:80) can be uniquely determined through (20.20.20.20, 10.10.10.10:5000). Because the number of dynamic network identities is large enough, the previous allocation method can be selected first, that is, the dynamic identities that are not used by all user clients, the implementation is relatively simple, and the randomness is high.

S306: The identity management server generates a redirect service identity, and returns a redirect response to the client;

In the embodiment of the present invention, the method for generating the redirect service identifier includes: replacing the service server identifier in the service identifier included in the request message in step 304 with a dynamic identifier, for example: the service identifier "www.example. com:80/news/top.xml" The server identifier "www.example.com:80" is replaced with the dynamic identifier "10.10.10.10:5000" to generate the redirect service identifier "10.10.10.10:5000/news/top.xml" ".

S307: The client sends a service request to the identification gateway according to the redirected service identifier;

Wherein, the service request includes a redirect service identifier. At this time, the destination IP and port in the IP packet in the service request correspond to the IP address and port in the dynamic identification, respectively.

S308: The identification gateway extracts the client IP and the dynamic identification, searches for the mapping relationship, and performs a conversion operation. If the mapping relationship is not found, the service request is rejected or the service request is directed to the predetermined system;

The identification gateway extracts the client IP and dynamic identification, searches for the mapping relationship, and performs conversion operations based on the mapping relationship. If the mapping relationship is not found, it is considered illegal access, and the service request is rejected or the service request is directed to the predetermined system, such as The honeypot system further locates illegal access.

In the embodiment of the present invention, the specific conversion operation includes:

Operation 1: According to the server domain name in the server identifier in the mapping relationship, resolve the server's IP address; the specific resolution process can be through identifying the DNS data stored or cached locally by the gateway, or requesting the resolution result from the domain name server, such as "www.example.com" "Resolves to "30.30.30.30";

Operation 2: Replace the dynamic identifier carried in the destination IP address and port of the service request IP packet with the IP address and port of the server, for example, convert 10.10.10.10:5000 to 30.30.30.30:80;

Operation 3: Restore the host ID or redirect service ID in the service request to the service ID. The restoration method is to restore the ID gateway ID in the host ID to the service server ID, for example, “10.10.10.10:5000” to “www” .example.com:80"; or, restore the identification gateway ID in the redirected service ID to the service server ID, for example, restore "10.10.10.10:5000/news/top.xml" to "www.example.com: 80/news/top.xml".

In another example of the embodiment of the present invention, the identification gateway may resolve the server domain name to the server's IP address in step S308, and the specific resolution process may be through identifying the DNS data stored or cached locally by the gateway, or requesting the resolution result from the domain name server , And replace the host domain name in the mapping relationship with the resolution result. For example, if the IP address corresponding to example.com is 30.30.30.30, the mapping relationship is expressed as (20.20.20.20, 10.10.10.10:5000, 30.30.30.30:80).

In another example of the embodiment of the present invention, two server identifiers can be stored in the mapping relationship at the same time, such as (20.20.20.20, 10.10.10.10:5000, www.example.com:80, 30.30.30.30:80), Use 30.30.30.30:80 in operation one and www.example.com:80 in operation three to improve efficiency.

In specific implementation, a conversion table can be further established, which contains client IP + port, dynamic identification, and server identification including the server IP. The client port is the local port selected by the client when establishing a connection with the server, such as the client selection port Is 1000, then the following forwarding relationship table (20.20.20.20:1000, 10.10.10.10:5000, 30.30.30.30:80) is established, or the following forwarding relationship including the server identifier in the form of the host domain name (20.20.20.20:1000, 10.10 .10.10:5000, 30.30.30.30:80, www.example.com:80).

After the identification gateway receives the service request, it first searches the conversion table, if it finds it, then converts it according to the conversion table, otherwise it searches for the mapping relationship, and if it finds it, it builds the conversion table.

According to this method, the client may select multiple ports to establish a connection with the server, perform different service requests, and identify the gateway to establish multiple corresponding conversion relationships, corresponding to the same mapping relationship, which is convenient for management.

In the step of operation 1, for the sake of security, the domain name server is different from the aforementioned domain name server. It saves the relationship between the server domain name and the server IP address. It is located in the security domain and serves specifically to identify the gateway. Unable to access, thus ensuring the security of the domain name server.

S309: The service server returns a service response;

Among them, the destination address and port in the service response information are the client IP address and port, and the source address and port are the server IP address and port.

S310: The identification gateway performs a conversion operation, and according to the mapping relationship or the conversion relationship, the server IP address and port in the source address and port are replaced with the dynamically identified IP address and port, and then sent to the client.

In the above conversion process, if the mapping relationship or conversion relationship corresponding to the response is not checked, the access is denied, or the service request is directed to the predetermined system.

According to different services, there may be multiple service request and response interactions, and the process of steps S303-S310 will be repeated.

In a server security defense method provided by an embodiment of the present invention, a client sends a domain name resolution request to a domain name server, and the client sends a service request to an identity management server based on the result of the domain name resolution, and the identity management server extracts the client IP address and server identity , Select the identification gateway, send a dynamic identification request to the identification gateway, the identification gateway selects the dynamic identification from the dynamic identification pool, establishes the mapping relationship between the client IP, the dynamic identification, and the server identification, and returns the dynamic identification query response and the selected dynamic identification , The identity management server generates a redirect service identity and returns a redirect response to the client. The client sends a service request to the identity gateway according to the redirect service identity, and the identity gateway extracts the client IP and dynamic identity, finds the mapping relationship, and performs conversion Operation, if the mapping relationship is not found, the service request is rejected or the service request is directed to the predetermined system. The service entrance accessed by the client is dynamically changed randomly, and each entrance can only be accessed by the designated client, thereby increasing the difficulty of hackers attacking the server and improving the security of the server.

Example three:

Figure 4 shows a flowchart of a server security defense method provided by the present invention. The client uses the service identifier to access the service, including the following steps:

S401: The client sends a domain name resolution request to the domain name server;

S402: The domain name server performs domain name resolution and returns a domain name query response;

Wherein, the response information returned by the domain name server to the client includes at least one IP address identifying the management server. In the embodiment of the present invention, in the domain name server, the IP address configured by the server domain name is not the real address of the server, but the IP address of the identity management server. If there are multiple identity management servers in the network, multiple identity management servers can be configured for The domain name server selects the IP address of at least one identity management server from a plurality of identity management servers according to a preset strategy and returns it to the client; in the embodiment of the present invention, the specific strategy includes: selecting according to the location information of the client The identity management server closest to the client's location; or, poll each identity management server; or, select the identity management server with a lighter load.

S403: The client sends a service request to the identity management server according to the result of the domain name resolution;

The service request includes the service identifier. In the request message, the destination IP is the IP address of the identity management server that is parsed in step 302, and the destination port is the default port or designated port of the service application. The message includes the complete business identification.

S404: The identity management server extracts the client IP address and the server identity, selects the identity gateway, and sends a dynamic identity request to the identity gateway;

Among them, the client IP address is extracted from the source IP address header of the service request IP packet, and the server ID is extracted from the service ID. In the selection of the identification gateway, the identification management server selects at least one identification gateway from a plurality of identification gateways according to a preset strategy, and the specific strategy includes: selecting the identification gateway closest to the location of the client according to the location information of the client; or, Polling each identification gateway; or, select an identification gateway with a lighter load.

S405: The identification gateway selects a dynamic identification from the dynamic identification pool, establishes a mapping relationship between the client IP and the dynamic identification, acquires the corresponding identification gateway domain name, and returns a dynamic identification query response and the selected dynamic identification;

Among them, the dynamic identification pool is composed of an IP address + port number managed by the identification gateway, and a protocol type;

or,

The dynamic identity pool is composed of the IP address managed by the identity, or IP address segment, plus the port range and protocol type to which each IP address belongs.

The above IP address or IP address in the IP address segment can ensure that IP data packets with these addresses as the destination address can be routed and forwarded by other network devices to the correct identification gateway.

At the same time, it is necessary to configure the corresponding domain name for the IP address managed by the identification gateway, and configure the resolution relationship between the domain name of the identification gateway and the managed dynamic identification pool IP address in the domain name server, in the case that one identification gateway manages multiple IPs , Each IP address needs to be configured with a domain name. For example, the identification gateway manages 10 IP addresses 10.10.10.1-10.10.10.10, and the corresponding domain names are idg1, idg2,..., idg10.

In the implementation of the present invention, the specific rules for dynamic identification selection are as follows: select the dynamic identification pool that is not used by all clients, or select the one that is not used by the user client, that is, it can be unique by the client IP and dynamic identification. To determine the mapping relationship.

In the embodiment of the present invention, when the dynamic identifier is selected to establish the mapping relationship, the domain name of the corresponding identifier gateway is obtained at the same time. If the IP address is selected as 10.10.10.10, the domain name idg10 is obtained at the same time;

In this example, it is sufficient to establish the mapping relationship between the client and the dynamic identifier, which does not include the server domain name, such as (20.20.20.20, 10.10.10.10:5000). The identification gateway returns a dynamic identification query response.

Wherein, the dynamic identification query response includes the dynamic identification including the domain name of the identification gateway selected in step S305, for example, idg10:5000.

S406: The identity management server generates a redirection service identity according to the service identity and the dynamic identity, and returns a redirection response to the client;

The specific generation method includes: using the business server domain name as the secondary domain name of the identification gateway to construct a new domain name, the specific format is "server domain name" + "." + "identification gateway domain name", such as www.example.com.idg10 , The redirect service identifier at this time is "www.example.com.idg10:5000/news/top.xml".

S407: The client sends a domain name resolution request to the domain name server;

Wherein, the request includes: the host domain name extracted from the redirect service identifier, for example: "www.example.com.idg10".

S408: The domain name server performs domain name resolution and returns a domain name resolution response;

Wherein, the domain name resolution response includes the identification gateway IP address corresponding to the domain name. In the example, the domain name server resolves "www.example.com.idg10" to 10.10.10.10, which is consistent with the dynamic IP generated by the identification gateway.

S409: The client sends a service request to the identity gateway according to the domain name resolution result;

Wherein, the request includes a redirect service identifier; at this time, the destination IP and port in the service request correspond to the identifier gateway IP address and port included in the dynamic identifier, respectively.

S410: The identification gateway extracts the client IP address and the dynamic identification, searches for the mapping relationship, and performs the conversion operation;

The identification gateway extracts the client IP and dynamic identification, searches for the mapping relationship, and performs conversion operations based on the mapping relationship. If the mapping relationship is not found, it is considered illegal access, and the service request is rejected or the service request is directed to the predetermined system, such as The honeypot system further locates illegal access.

In the embodiment of the present invention, the specific conversion operation includes:

Operation 1: According to the server domain name in the server identifier in the mapping relationship, resolve the server's IP address; the specific resolution process can be through identifying the DNS data stored or cached locally by the gateway, or requesting the resolution result from the domain name server, such as "www.example.com" "Resolves to "30.30.30.30";

Operation 2: Replace the dynamic identifier carried in the destination IP address and port of the service request IP packet with the IP address and port of the server, for example, convert 10.10.10.10:5000 to 30.30.30.30:80;

Operation 3: Restore the redirected service ID in the service request to the service ID. The restoration method is to restore the ID gateway ID in the redirected service ID to the service server ID, for example, restore "www.example.com.idg10" to " www.example.com".

S411: The service server returns a service response;

Among them, the destination address and port in the service response information are the client IP address and port, and the source address and port are the server IP address and port.

S412: The identification gateway performs a conversion operation, and according to the mapping relationship or the conversion relationship, the server IP address and port in the source address and port are replaced with the dynamically identified IP address and port, and then sent to the client.

The server security defense method provided by the embodiment of the present invention dynamically changes the service entrances accessed by the client by randomly and dynamically, and each entrance can only be accessed by a designated client, thereby increasing the difficulty of hackers attacking the server and improving the server’s performance. safety.

Embodiment four:

Fig. 6 shows a flowchart of a server security defense method provided by an embodiment of the present invention, which is used in a server security defense system. Please refer to Fig. 5, which includes a client 501, a domain name server 502, an identification integrated gateway 503, and a business server. 504; where the identity integrated gateway 503 includes an identity management function 5031 and an identity gateway function 5032. As shown in Figure 6, the method flow includes the following steps:

S601: The client sends a domain name query request to the domain name server;

S602: The domain name server performs domain name resolution and returns a domain name query response;

Wherein, the response includes the IP address of one or more integrated gateways. Multiple integrated gateways can be deployed in the network. Each integrated gateway can be configured with multiple IP addresses plus the port range to which each IP address belongs to form a dynamic identifier. Pool.

In this embodiment, the IP address configured by the server domain name in the domain name server is the IP address that identifies the integrated gateway, and one or more IP addresses can be configured according to the number of identified integrated gateways and the IP addresses managed by the identified integrated gateway; specific strategies Including: according to the location information of the client, selecting the identification gateway closest to the location of the client; or, polling each identification gateway; or, selecting the identification gateway with a lighter load.

S603: The client sends a service request to the identity integrated gateway according to the result of the domain name resolution, which includes the service identity;

S604: The identity management function in the integrated identity gateway extracts the client identity and the service server identity, and requests a dynamic identity from the identity gateway function through an internal message;

Wherein, the request includes the destination IP of the IP packet, that is, the IP address that identifies the integrated gateway selected by the client from the domain name resolution result.

S605: Identify the gateway function and select the dynamic identifier from the dynamic identifier pool, establish a mapping relationship between the client IP, the dynamic identifier, and the server identifier, and return the dynamic identifier or the port part of the dynamic identifier to the identifier management server;

S606: The identity management function replaces the port in the server identity in the service identity with the port in the dynamic identity, generates a redirection service identity, and returns a redirection response to the client;

If the port 5000 is selected in step S505, the identification gateway generates the redirect service identification “www.example.com:5000/news/top.xml” according to the service identification “www.example.com:80/news/top.xml”.

S607: The client sends a service request to the integrated identification gateway according to the redirected service identifier;

Wherein, the service request includes a redirect service identifier.

S608: The identification gateway function extracts the client IP and dynamic identification, searches for the mapping relationship, and performs conversion operations based on the mapping relationship. If the mapping relationship is not found, access is denied or the service request is directed to the predetermined system;

Among them, after completing the conversion of the destination IP address and port, you can restore the port in the service identifier, for example, restore "www.example.com:5000" to "www.example.com:80".

S609: The business server returns a business response;

Among them, the destination address and port in the service response information are the client IP address and port, and the source address and port are the server IP address and port.

S610: The identification gateway function performs a conversion operation, and according to the mapping relationship or the conversion relationship, the server IP address and port in the source address and port are replaced with the dynamically identified IP address and port, and then sent to the client.

In the above conversion process, if the mapping relationship or conversion relationship corresponding to the response is not checked, the access is denied, or the service request is directed to the predetermined system.

According to a server security defense method provided by an embodiment of the present invention, a client sends a domain name query request to a domain name server, the domain name server performs domain name resolution, and returns a domain name query response, and the client sends a service request to the identity integrated gateway according to the result of domain name resolution, It includes service identification, the identification management function in the integrated identification gateway extracts the client identification and the service server identification, requests the dynamic identification from the identification gateway function through internal messages, identifies the gateway function and selects the dynamic identification from the dynamic identification pool, and establishes the client IP , Dynamic identification, the mapping relationship between the server identification, and the dynamic identification or the port part of the dynamic identification is returned to the identification management server, the identification management function replaces the port in the server identification in the service identification with the port in the dynamic identification, and generates Redirect the service ID and return a redirection response to the client. The client sends a service request to the ID integrated gateway according to the redirected service ID; the ID gateway extracts the client IP and dynamic ID, finds the mapping relationship, and executes the conversion operation according to the mapping relationship If the mapping relationship is not found, the access is denied, or the service request is directed to the predetermined system, and the service server returns a service response. The service entrance accessed by the client is dynamically changed randomly, and each entrance can only be accessed by the designated client, thereby increasing the difficulty of hackers attacking the server and improving the security of the server.

Embodiment five:

This embodiment also provides a communication device, as shown in FIG. 7, which includes a processor 71, a memory 72, and a communication bus 73, wherein:

The communication bus 73 is used to implement connection and communication between the processor 71 and the memory 72;

The processor 71 is configured to execute one or more computer programs stored in the memory 72 to implement at least one step in the server security defense method in the first embodiment and the fifth embodiment.

This embodiment also provides a computer-readable storage medium, which is included in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules, or other data). Volatile or non-volatile, removable or non-removable media. Computer readable storage media include but are not limited to RAM (Random Access Memory), ROM (Read-Only Memory, read-only memory), EEPROM (Electrically Erasable Programmable read only memory, charged Erasable Programmable Read-Only Memory) ), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, Or any other medium that can be used to store desired information and that can be accessed by a computer.

The computer-readable storage medium in this embodiment can be used to store one or more computer programs, and the stored one or more computer programs can be executed by a processor to implement the server security defense in the first embodiment and the fifth embodiment. At least one step of the method.

According to the server security defense method and system, communication device, and computer-readable storage medium provided by the embodiments of the present invention, the client sends a domain name resolution request to the domain name server, and the domain name server resolves the server domain name in the request information into the identification management server IP And return the IP address to the client; the client sends a service request to the identity management server, the service request includes a service identity, the identity management server requests a dynamic identity from the identity gateway, and the identity gateway allocates dynamic identity information and returns it to the identity management The server establishes a mapping relationship at the same time, and the identification management server returns a redirection response to the client; the client sends a service request to the identification gateway, and the identification gateway converts the service request information according to the mapping relationship and sends it to the service server, and The response information received from the service server is converted and sent to the client. By adding the identity management server and the identity gateway, while ensuring the normal business of the server, the communication parameters of the server to the client service are randomly changed to increase the difficulty of attacking the server. , Thereby improving the security of the server and service availability, and improving the user experience.

It can be seen that those skilled in the art should understand that all or some of the steps in the methods disclosed above, the functional modules/units in the system, and the device can be implemented as software (which can be implemented by computer program code executable by a computing device. ), firmware, hardware and their appropriate combination. In the hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may consist of several physical components. The components are executed cooperatively. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit .

In addition, as is well known to those of ordinary skill in the art, communication media usually contain computer-readable instructions, data structures, computer program modules, or other data in a modulated data signal such as carrier waves or other transmission mechanisms, and may include any information delivery medium. Therefore, the present invention is not limited to any specific combination of hardware and software.

The above content is a further detailed description of the embodiments of the present invention in combination with specific implementations, and it cannot be considered that the specific implementations of the present invention are limited to these descriptions. For those of ordinary skill in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as belonging to the protection scope of the present invention.

Claims (14)

A server security defense method, including: The client sends a domain name resolution request to the domain name server, and the domain name server resolves the business server domain name in the request information into an identification management server IP address, and returns the IP address to the client; The client sends a service request to the identity management server, the service request includes a service identity, the identity management server requests a dynamic identity from the identity gateway, and the identity gateway allocates dynamic identity information to the identity management server. At the same time, a mapping relationship is established and the identity management server sends the client The end returns a redirection response; The client sends a service request to the identification gateway, and the identification gateway converts the service request information according to the mapping relationship and sends it to the service server, and converts the received response information of the service server and sends it to the client. The server security defense method according to claim 1, wherein the identity management server includes a plurality of identity management servers; the domain name server selects the IP address of at least one identity management server from the plurality of identity management servers according to a preset policy, And return the IP address to the client. The server security defense method according to claim 2, wherein the strategy comprises: selecting the identity management server closest to the location of the client according to the location information of the client; or, polling each identity management server; or, selecting the load Lighter identity management server. The server security defense method according to claim 1, wherein the identification gateway includes a plurality of identification gateways; the identification management server selects at least one identification gateway according to a preset policy to send the dynamic identification request. The server security defense method according to claim 4, wherein the strategy comprises: selecting the identification gateway closest to the location of the client according to the location information of the client; or polling each identification gateway; or selecting a lighter load The identity gateway. The server security defense method according to any one of claims 1-5, wherein when the identity management server sends a dynamic identity request to the identity gateway, it sends the client's IP address and business server identity to the selected identity gateway . The server security defense method according to claim 6, wherein after receiving the dynamic identification request, the identification gateway allocates the dynamic identification and establishes the mapping relationship between the client IP and the dynamic identification, or establishes the client IP , The mapping relationship between the dynamic identification and the business server identification; the dynamic identification is to identify the gateway address and port, or the gateway domain name and port; the business server identification is the IP address and port of the business server, or the business server domain name and port. The server security defense method according to claim 7, wherein the identity management server replaces the host identity in the service identity with the dynamic identity or inserts the dynamic identity in it according to the service identity in the service request and the dynamic identity, and generates The redirect service identifier, the redirect service identifier information in the redirect response, instructs the client to send a service request to the identification gateway. The server security defense method according to claim 1, wherein after receiving the service request, the identification gateway searches for the mapping relationship according to the source IP, destination IP, and destination port in the request message, and if the corresponding mapping relationship is found, then The service request is converted and sent to the service server; otherwise, access is denied or directed to a predetermined system. The server security defense method according to claim 9, wherein said converting said service request comprises: identifying the destination IP and port of the service request by the identifying gateway, namely, dynamic identification, and replacing it with the IP corresponding to the service server identification in the mapping relationship And port, replace the source IP and port of the response, that is, the service server identifier, with the IP and port corresponding to the dynamic identifier. The server security defense method according to claim 10, wherein the converting the service request further comprises: the identification gateway replaces the dynamic identification of the service identification in the service request with the service server identification. A server security defense system, including: The client is used to support the domain name resolution client function and service access function, use the service identifier to initiate service requests, and also support the service redirection function, that is, access the specified network resources according to the redirection response returned by the service server; The domain name server is used to resolve the domain name of the business server into the IP address of the identity management server; and select one or more IP addresses of the identity management server from multiple identity management servers according to a preset strategy; The identity management server is used to receive the service request sent by the client, select the identity gateway according to a preset strategy, request a dynamic identity from the identity gateway, generate a redirection service identity, and return a redirection response to the client; The identification gateway is used to generate a dynamic identification according to the request of the identification management server, establish the mapping relationship between the client IP address, the dynamic identification, and the business server identification, and forward the business request from the client and the response to the client according to the mapping relationship; The business server is used to provide business services. A communication device, including a processor, a memory, and a communication bus; among them, The communication bus is used to realize the connection and communication between the processor and the memory; The processor is configured to execute one or more computer programs stored in the memory to implement the steps of the server security defense method according to any one of claims 1-11. A computer-readable storage medium that stores one or more computer programs, wherein the one or more computer programs can be executed by one or more processors to implement the one described in any one of claims 1-11 The steps of the server security defense method.

Images