TWI581124B - A data packet of internet security system and a method thereof - Google Patents

Description

Internet data packet protection system and method

The present invention relates to a data packet protection system for an Internet, and more particularly to a protection system for preventing an unprivileged computer system from being connected to a regional network.

With the advancement of science and technology, enterprise management has gradually developed an enterprise resource planning system (Enterprise Resource Planning, hereinafter referred to as ERP system) for integrated management. Its main connotation is the application of information system technology to various resources of enterprises, such as logistics and capital flow. , information flow, human resources, etc. to integrate and integrate management, combined with various resources to form a supply chain management, that is, to transfer every link of business management to scientific management, so that enterprise resources are optimally configured.

Please refer to the first figure. The architecture of the EPR system 10 is mainly composed of a client 12 and a server 14 connecting the two ends of the network for data transmission, and the server 14 is connected to the database host 16. The client 12 issues a query request to the server terminal 14, and the server terminal 14 transmits the queried data back to the client 12. Some EPR system 10 architectures include the inclusion of a middleware (not shown) between the client 12 and the server terminal 14 to communicate with the two ends, reducing the load on both ends and increasing performance. Under this architecture, the computer system of each client 12 does not need to separately install the access interface software, and only needs to execute the user interface.

At present, the system architecture of the ERP system 20 used in the market is an n-tier architecture, and the user performs the web-based browsing method by the browser, as shown in the second figure. The user logs in through the Web Application Portal 22, and is directed to the mediation software 26 via the Information Flow Engine 24, to the central repository 28, and uses the data packet of the Internet to transmit data.

As the EPR system utilizes the results of inter-network connections, security is important for the connected server and network. Unauthorized access to the company's data network may result in the loss of important company information or the intrusion of external computers. . There are many methods in the prior art for enhancing network security, including the use of Identification and Authentication (I&A), cryptography, and the like.

However, identity authentication licenses often cause human error in setting up loopholes. Once an employee leaves the company, if the account is not removed, a management loophole may occur, causing the departing employee to use an unauthorized computer system to enter the server to steal the internal importance of the company. Information, or people with a willingness to leak or steal the account, these shortcomings will make the security of important information within the company suffer from crisis.

In view of the above needs, the object of the present invention is to provide a data packet protection system for the Internet, and more particularly to a protection system for preventing an unauthorized computer system from connecting to a local area network to modify or access internal data.

In order to achieve the above object, the present invention provides an Internet data packet protection system comprising a plurality of first computer systems (ie, client computer systems), the operating system of which includes a filtering unit. The filtering unit can intercept the data packet output by the operating system and add an identification mark to the blank of the TCP/IP file header of the data packet. In addition, a second computer system (ie, a servo terminal computer system) is included, and the operating system includes a control unit. The control unit can filter and monitor data packets output by the first computer system. The first computer system transmits the data packet to the second computer system via the network, and the control unit of the second computer system confirms whether the blank of the TCP/IP file header of the data packet has an identification mark. If the blank of the TCP/IP header of the data packet has an identification mark, the data is encapsulated; if the blank of the TCP/IP header of the data packet does not have an identification mark, the data packet is blocked.

The present invention further provides an Internet data packet protection system, comprising a processing unit coupled to a network interface unit and connected to a plurality of user terminals via the Internet for receiving a plurality of user terminals. a data packet transmitted by the computer system through the network interface unit; and a control unit coupled to the processing unit for performing filtering and monitoring of the data packet. The control unit confirms whether the blank of the TCP/IP header of the data packet has an identification mark. If the TCP/IP header of the data packet has an identification mark, the data packet is encapsulated. On the other hand, if the TCP/IP header of the data packet does not have an identification mark, the data packet is blocked.

The present invention further provides an Internet data packet protection system, comprising a processing unit coupled to a network interface unit and connected to a servo terminal via the Internet for transmitting a data packet to the servo terminal; And a filtering unit that intercepts the data packet transmitted by the processing unit and adds an identification mark to a blank of the TCP/IP file header of the data packet before being transmitted to the server terminal.

The present invention further provides an internet packet data packet protection method, wherein a data interface is transmitted between a server terminal and a user terminal by a network interface system, and the steps include: first, transmitting the data by using a processing unit of the computer system The packet is encapsulated, and the data packet is intercepted by a filtering unit, and the filtering unit adds an identification mark to a blank of the TCP/IP header of the intercepted data packet. Then, after the step of adding the identification mark is completed, the data packet is transmitted to the servo terminal through the network interface unit. The control unit of the servo terminal is used to confirm whether the TCP/IP header of the received data packet has the identification mark. If the blank of the TCP/IP header of the received data packet has an identification mark, the control unit encapsulates the data, and if the TCP/IP header of the data packet does not have an identification mark, the control unit blocks the Data packet.

The invention further provides an internet data packet protection system, comprising a first computer system comprising a first processing unit and a filtering unit, the filtering unit being coupled to the first processing unit, and a second computer system comprising a second processing unit and a control unit, the control unit being coupled to the second processing unit. The first computer system transmits a data packet to the second computer system via the Internet, and the transmitting step comprises: (a) the first computer system sends the data packet; (b) the filtering unit of the first computer system intercepts the data Encapsulating, and adding an identification mark to the blank of the TCP/IP header of the data packet; (c) receiving the data packet by the second computer system; (d) controlling the data of the data packet by the control unit of the second computer system The identification mark is located in the blank of the IP header. The transmitting step of the present invention further includes: if the blank of the TCP/IP header of the data packet has an identification mark, the control unit of the second computer system passes the data packet; and if the TCP/IP header of the data packet is The blank unit does not have an identification mark, and the control unit of the second computer system blocks the data packet.

The invention adds the identification mark to the blank of the TCP/IP file header of the data packet by using the filtering unit of the computer system of the use end, and sets the firewall on the servo terminal receiving the data packet, and filters and confirms by the control unit of the computer system of the servo terminal. Whether the data packet has an identification mark. If you have the identification mark, you can successfully pass through the firewall and enter the company's internal webpage to modify or read important data.

In other words, if the user uses an unauthorized computer to connect to the company's internal webpage, since the computer system does not contain the filtering unit, the identification token cannot be added to the blank of the TCP/IP header of the sent data packet, and the data packet is transmitted to the servo terminal. After that, the control unit of the computer system of the servo terminal cannot confirm that the blank portion of the TCP/IP header of the data packet has an identification mark, and the data packet is blocked from entering the company internal webpage. Therefore, it can effectively prevent unauthorized external computers from accessing company data or the company data network from external computer intrusion to steal data and avoid data leakage.

The above is used to clarify the object of the present invention, the technical means for achieving the object, the advantages thereof, and the like. The invention will be apparent to those skilled in the art from the description of the appended claims.

The present invention will be described in terms of the preferred embodiments and aspects of the invention, which are intended to be illustrative and not to limit the scope of the invention. Therefore, the present invention may be widely practiced in other embodiments in addition to the preferred embodiments described in the specification.

The present invention utilizes firewall technology to implement the data packet protection system of the Internet of the present invention. In general, the specific internal network (intranet) and other parts of the Internet are isolated, that is, all data packets must pass through the firewall. The firewall mainly enters the protection scope or filters all the agreements that are not explicitly listed by certain agreements, and protects the internal resources of the organization from the invasion of the external Internet.

The present invention uses a computer system device to perform the data packet protection system of the Internet of the present invention. As shown in the third figure, the computer system of the user terminal and the servo terminal according to the present invention respectively includes a central processing unit (CPU) 301 and a system memory 312, including a read only memory (ROM) 313 and random access. Memory (RAM) 314, which is coupled to a central processing unit (CPU) 301. The computer system operates using the BIOS stored in ROM 313, which is a set of basic routines to assist the computer in transferring information. Those skilled in the art should understand that the present invention can also be applied to computers without a BIOS, such as "POWER PC." A typical computer system includes a hard disk 310 coupled to a central processing unit (CPU) 301, and a CD-ROM device 309 coupled to a central processing unit (CPU) 301. The user inputs an instruction by an input device such as a keyboard 305 or a mouse 306. Display unit 304 is coupled to a central processing unit (CPU) 301. The computer system is connected to a remote computer or server via a network interface. The operating system 311 and the application 307 are input to the computer system by a computer readable medium. The operating system 311 enables the application software 307, the program to process various applications. The microphone and speaker (horn) 308 are coupled to the central processing unit 301, and the image capturing device 302 is coupled to the central processing unit 301 for capturing images. The data packet protection system 303 is coupled to the central processing unit 301 for processing the data packet protection system of the Internet of the present invention and methods therefor.

The present invention provides a data packet protection system for the Internet of the present invention by using a transmission control protocol/Internet Protocol (TCP/IP) header setting. TCP/IP is a network communication protocol developed by the Internet Working Committee to enable different computer devices and operating systems to communicate with each other through the same communication protocol. TCP/IP is a stacked hierarchical architecture. The top layer is the "application layer", which provides various network applications (such as www, FTP, E-Mail), and the bottom layer is the "physical layer", which provides physical network routes. (eg Ethernet, fiber optic cable, etc.) transmission. When the user terminal executes the application on the Internet, for example, using a browser to view the webpage, after generating the data packet, it will be from the top to the bottom of the TCP/IP hierarchy, through a layer of communication protocol, via the network route. Transmitted; when the servo terminal receives the data packet, it reverses from the bottom to the top through a layer of communication protocol to the top layer, and finally the uppermost application to interpret the message.

The work of the TCP/IP protocol is mainly to split the data message into data packets, and check whether the packet is correctly transmitted to the destination, and provide a path for transmitting the data packet. When the data packet arrives at the destination, the data packet is reassembled. The original message. Therefore, when the data packet is transmitted, in addition to the content of the file itself, data such as a start address, a destination address, and a packet number are added to the header of the data packet. Wherein, each data includes a plurality of blank spaces, and the data existing in the blank spaces will not be read during transmission, and the data packet reorganization will not be affected. Embodiments of the present invention utilize an identification token in the blank of the TCP/IP header to identify whether the accepted data packet is transmitted via an authorized computer system to provide an Internet data packet protection system.

Please refer to the fourth figure, which is a schematic diagram of the architecture of the data packet protection system of the Internet of the present invention. As shown in the figure, an embodiment of the present invention provides an Internet data packet protection system 303, which includes a first computer system (user terminal) 401 and a second computer system (servo terminal) 402. The operating system of the first computer system 401 includes a filtering unit 4013 that intercepts data packets (not shown) transmitted by the operating system of the first computer system 401 and is blank in the TCP/IP header of the data packet. Add an identification mark. The operating system of the second computer system 402 includes a control unit 4023 that filters and monitors data packets transmitted by the first computer system 401.

In this embodiment, the first computer system 401 transmits the data packet to the second computer system 402 via the Internet 403, and the control unit 4023 of the second computer system 402 confirms the TCP/IP file of the data packet transmitted from the first computer system 401. Whether the blank space of the head has the identification mark. If the blank of the TCP/IP header of the data packet has an identification mark, the data packet is encapsulated. Otherwise, if the blank of the TCP/IP file header of the data packet does not have the identification mark, the data packet is blocked.

In this embodiment, the blank of the TCP/IP header of the data packet is but not limited to a specific location. When the first computer system (user terminal) 401 filtering unit 4013 intercepts the data packet to be sent, and adds an identification mark to a specific location of the TCP/IP file header of the data packet, when the second computer system 402 receives the data After the packet, its control unit 4023 filters and monitors the data packet transmitted by the first computer system 401, and searches for a identification mark at a specific location of the TCP/IP file header of the data packet. If there is an identification mark, the data is encapsulated; otherwise, the data package is blocked.

In the embodiment of the present invention, the identification mark may be any combination of English letters, numbers or symbols, for example, but not limited to 1234-ABC, and the user can set according to requirements.

In this embodiment, the second computer system 402 further includes a packet buffer unit 4024 for storing the data packet that the network interface unit passes. In addition, an encryption and decryption unit may be optionally included. After the data packet is stored in the packet buffer unit, the operating system of the second computer system automatically encrypts and decrypts the data packet. The encryption method is encrypted by an encryption algorithm (for example, Advanced Encryption Standard (AES), DES, 3DES, Blowfish), and the AES high-order encryption standard is taken as an example, but is not limited to AES high-order encryption. The standard has a key length of 128 bits, 192 bits, and 256 bits, and uses a transparent encryption and decryption format.

Referring to FIG. 5, in an embodiment of the present invention, the present invention provides an Internet data packet protection system 500, which includes a processing unit 501 and a control unit 503. The processing unit 501 is coupled to a network interface unit 502, and is connected to a plurality of user terminals 506 via the Internet 507 for receiving data transmitted by the computer system of the plurality of user terminals 506 through the network interface unit 502. Packet. The control unit 503 is coupled to the processing unit 501 for filtering and monitoring data packets.

In this embodiment, after the processing unit 501 receives the data packet from the user terminal 506, the control unit 503 confirms whether the TCP/IP file header of the received data packet has an identification mark. The identification token is added to the computer system of the plurality of user terminals 506 for identification to determine whether the data packet is transmitted by an authorized computer system. If the blank of the TCP/IP header of the data packet has an identification mark, the data packet is encapsulated, and the user terminal 506 can connect to the internal webpage of the company, and can read or modify the internal webpage data. On the other hand, if the blank of the TCP/IP header of the data packet does not have the identification mark, the data packet is blocked, and the user terminal 506 cannot connect to the company internal webpage.

In this embodiment, the data packet protection system 500 of the Internet further includes a packet buffer unit 504 for storing data packets passed by the network interface unit 502. In addition, an encryption and decryption unit 505 may be optionally included. After the data packet is stored in the packet buffer unit 505, the data packet protection system 500 of the Internet will automatically encrypt and decrypt the data packet, and each action of the user terminal will be The encryption and decryption unit 505 automatically encrypts and decrypts, and does not need to wait for the user to modify or read all the encryption and decryption actions to avoid the user's omission and generate information security vulnerabilities. The encryption method is encrypted by an encryption algorithm (for example, Advanced Encryption Standard (AES), DES, 3DES, Blowfish), and the AES high-order encryption standard is taken as an example, but is not limited to AES high-order encryption. The standard has a key length of 128 bits, 192 bits, and 256 bits, and uses a transparent encryption and decryption format.

Referring to the sixth figure, in an embodiment of the present invention, the present invention provides an Internet data packet protection system 600, which includes a processing unit 601 and a filtering unit 603. The processing unit 601 is coupled to the network interface unit 602 and connected to the server terminal 604 via the Internet 605 for transmitting a data packet to the server terminal 604. The filtering unit 603 is coupled to the processing unit 601 for intercepting the data packet transmitted by the processing unit 601, and adding an identification mark to the blank of the TCP/IP file header of the data packet before being transmitted to the servo terminal 604. After the filtering unit 603 finishes adding the identification mark, the processing unit 601 transmits the data packet to the servo terminal 604 through the network interface unit 602. In this embodiment, the blank of the TCP/IP header of the data packet may be, but is not limited to, a specific location.

Through the identification mark added by the filtering unit 603 of the embodiment, it can be determined whether the data packet is transmitted from an authorized computer system, and if there is an identification mark, it is transmitted by an authorized computer system; otherwise, no. The server 604 can determine whether it is willing to pass the data packet to control network information security.

The invention further provides a data packet protection method for the Internet, which transmits a data packet between a server terminal and a user terminal by using a network interface system, and the steps are as follows, please refer to the fourth picture and the seventh A flow chart of a data packet protection method for the Internet of the present invention.

First, in step S701, a data packet (not shown) is transmitted by the processing unit 4011 of the user terminal (ie, the first computer system 401). For example, use a browser to browse through the company's internal web pages. In step S702, the filtering unit 4013 of the user terminal (ie, the first computer system 401) intercepts the data packet to be sent, and adds an identification mark to the blank of the TCP/IP file header of the data packet. The identification mark may be any, but not limited to, an English alphabet, a number or a symbol, and the blank may be, but not limited to, a specific position.

Step S703, after the addition of the identification mark is completed, the processing unit 4011 of the user terminal transmits the data packet to the servo terminal (ie, the second computer system 402) via the network interface unit 4012. Finally, in step S704, after the servo terminal 402 receives the data packet through the network interface unit 4022, the control unit 4023 of the servo terminal 402 is responsible for monitoring all the received data packets, and confirming that the blank of the TCP/IP file header of the data packet has identification. Mark, with the information enveloped by the filter.

In this embodiment, the step of protecting the data packet protection method of the Internet further includes, in step S705, if the blank of the TCP/IP header of the data packet received by the server 402 has an identification mark, the control unit 4023 passes the data packet. . That is, the user terminal 401 can browse the data content of the server terminal 402 through the Internet, and can read or modify the internal webpage of the company. On the other hand, in step S706, if the blank of the TCP/IP header of the data packet received by the server 402 does not have the identification mark, the control unit 4023 blocks the data packet, that is, the user terminal 401 cannot successfully connect to the server 402, and cannot Read or modify the company's internal web pages.

In this embodiment, if the control unit 4023 passes the data packet and the user terminal 401 successfully connects to the server 402 through the Internet, the process proceeds to step S707, where the data packet is stored in the packet buffer unit 4024 of the server 402. At the same time, after the data packet is stored in the packet buffer unit 4024, the process proceeds to step S708, and the encryption and decryption unit 4025 of the server terminal 402 automatically encrypts and decrypts the data packet. Since the user terminal 401 reads or modifies the action of the server 402, at least one data packet is transmitted to the server terminal 402. When the data packet of the user terminal 401 is identified by the control unit 4023 of the server terminal 402, the server terminal 402 The encryption and decryption unit 4025 automatically encrypts and decrypts the data packet, which can increase the privacy and security of the company's internal data.

In addition, it should be noted that the central processing unit 301, the processing unit 102, and the computer operating systems of the first computer system (user terminal) or the second computer system (servo terminal) according to the present invention include, but are not limited to, Windows operations. Systems, Linux operating systems, Mac OS systems, and other operating systems. The present invention is further limited to a browser of a particular operating system executing the invention, such as IE, Firefox or Google...etc.

The invention has the advantages that the unauthorized computer system can be effectively prevented from logging into the company's internal webpage, and the company's confidential information can be arbitrarily modified or stolen, thereby effectively preventing the data leakage and damaging the company's interests.

Another advantage of the present invention is that the filtering unit of the system of the present invention can be modified according to the browser of different operating systems, and can further limit the connection of the servo terminal with a specific browser, and can be combined with identity verification to increase security. Control diversification, effectively reduce security control loopholes.

The above description is a preferred embodiment of the invention. Those skilled in the art should be able to understand the invention and not to limit the scope of the patent claims claimed herein. The scope of patent protection is subject to the scope of the patent application and its equivalent fields. Any modification or refinement made by those skilled in the art without departing from the spirit or scope of the present invention is equivalent to the equivalent change or design made in the spirit of the present disclosure, and should be included in the following patent application scope. Inside.

10‧‧‧EPR system

12‧‧‧Client (client)

14‧‧‧Servo terminal (server)

16‧‧‧Database Host

20‧‧‧ERP system

22‧‧‧Web Application Portal

twenty four. . . Information Flow Engine

26. . . Mediation software

28. . . Central database

301. . . Central processing unit (CPU)

302. . . Image capture device

303. . . Internet data packet protection system

304. . . Display unit

305. . . keyboard

306. . . mouse

307. . . application

308. . . Microphone and speaker (horn)

309. . . CD-ROM device

310. . . Hard disk

311. . . working system

312. . . System memory

313. . . Read only memory (ROM)

314. . . Memory (RAM)

401. . . First computer system (user terminal)

4013. . . Filter unit

402. . . Second computer system (servo terminal)

4023. . . control unit

4024. . . Packet buffer unit

403, 507, 605. . . Internet

500. . . Internet data packet protection system

501‧‧‧Processing unit

502‧‧‧Network interface unit

503‧‧‧Control unit

504‧‧‧Packing buffer unit

505‧‧‧Addition and decryption unit

506‧‧‧user terminal

600‧‧‧Internet data packet protection system

601‧‧‧Processing unit

603‧‧‧Filter unit

602‧‧‧Network Interface Unit

604‧‧‧Servo terminal connection

S701‧‧‧Send data packet

S702‧‧‧ intercept the data packet and add the identification mark to the TCP/IP blank

S703‧‧‧Transfer to the servo terminal

S704‧‧‧Confirm identification mark

S705‧‧‧ Packets with identification marks

S706‧‧‧ Blocking data packets without identification marks

S707‧‧‧Storage data package

S708‧‧‧Addition and decryption

The first picture is the architecture of the EPR system; the second picture is the multi-layer (n-tier) architecture of the ERP system; the third picture is the system architecture diagram of the data packet protection of the Internet system using the computer system equipment The fourth diagram is a system architecture diagram of the data packet protection system of the Internet according to an embodiment of the present invention; and the fifth diagram is a system architecture diagram of the data packet protection system of the Internet according to another embodiment of the present invention; The sixth figure is a system architecture diagram of the data packet protection system of the Internet according to another embodiment of the present invention; and the seventh diagram is a flowchart of the method of the data packet protection system of the Internet of the present invention.

401. . . First computer system (user terminal)

4013. . . Filter unit

402. . . Second computer system (servo terminal)

4023. . . control unit

4024. . . Packet buffer unit

403. . . Internet

Claims (21)

An Internet data packet protection system includes: (a) at least a first computer system, the operating system of the first computer system includes a filtering unit, and the filtering unit can intercept a data packet transmitted by the operating system. And adding an identification mark to the blank of the TCP/IP header of the data packet; and (b) a second computer system, the operating system of the second computer system includes a control unit, and the control unit can filter and monitor The data packet transmitted by the first computer system; (c) wherein the first computer system transmits the data packet to the second computer system via a network, the control unit of the second computer system confirms from the first Whether the blank space of the TCP/IP header of the data packet transmitted by the computer system has the identification mark; if the blank of the TCP/IP file header of the data packet has an identification mark, the data is encapsulated; if the data packet is If there is no identification mark in the blank of the TCP/IP file header, the data packet is blocked. For example, the data packet protection system of the Internet according to Item 1 of the patent application, wherein the blank of the TCP/IP file header of the data packet is a specific location. The data packet protection system of the Internet as described in claim 1, wherein the second computer system further comprises a packet buffer unit for storing the data packet passed by the network interface unit. The data packet protection system of the Internet as described in claim 3, wherein the second computer system further comprises an encryption and decryption unit, and after the data packet is stored in the packet buffer unit, the second computer system The operating system automatically encrypts and decrypts the data packet. An internet data packet protection system includes: (a) a processing unit coupled to a network interface unit and connected to a plurality of user terminals via an internet for receiving a plurality of user terminals a data packet transmitted by the computer system through the network interface unit; and (b) a control unit coupled to the processing unit for filtering and monitoring the data packet; (c) wherein the control unit confirms the data packet Whether the blank of the TCP/IP header has an identification mark; if the blank of the TCP/IP header of the data packet has an identification mark, the data is encapsulated; if the blank of the TCP/IP header of the data packet has Identifying the token blocks the data packet. The data packet protection system of the Internet as described in claim 5, wherein the identification code is added by the computer system of the plurality of user terminals at the time of output. For example, the data packet protection system of the Internet as described in claim 5, wherein the blank of the TCP/IP header of the data packet is a specific location. The data packet protection system of the Internet as described in claim 5, further comprising a packet buffer unit coupled to the processing unit for storing the data packet passed by the network interface unit. The data packet protection system of the Internet as described in claim 8 further includes an encryption and decryption unit coupled to the processing unit and the packet buffer unit. When the data packet is stored, the encryption and decryption unit is automatically Encrypt the data packet. An internet data packet protection system includes: (a) a processing unit coupled to a network interface unit and connected to a servo terminal via the Internet for transmitting a data packet to the server; (b) a filtering unit coupled to the processing unit for intercepting the data packet transmitted by the processing unit and adding an identification to a blank of the TCP/IP header of the data packet before transmitting to the server terminal mark. For example, the data packet protection system of the Internet as described in claim 10, wherein the blank of the TCP/IP file header of the data packet is a specific location. An internet packet protection method for transmitting data packets between a server terminal and a user terminal by a network interface system, the steps comprising: (a) a processing unit transmitting the data packet; and (b) a filtering unit intercepts the data packet and adds an identification mark to a blank of the TCP/IP header of the data packet; (c) transmitting the data packet to the server through the network interface unit; and (d) the The control unit of the servo terminal confirms that the blank of the TCP/IP file header of the data packet has the identification mark. For example, in the data packet protection system of the Internet as described in claim 12, the steps further include: (a) if the blank of the TCP/IP header of the data packet has an identification mark, the control unit passes the The data packet; and (b) if the blank of the TCP/IP header of the data packet does not have an identification mark, the control unit blocks the data packet. The data packet protection method of the Internet according to claim 12, wherein the data packet is stored in a packet buffer unit of the server after the control unit encapsulates the data. The data packet protection method of the Internet according to claim 14, wherein the data packet is stored in the packet buffer unit, and the data packet is automatically encrypted and decrypted by using one of the servo terminals. For example, the data packet protection system of the Internet as described in claim 12, wherein the blank of the TCP/IP header of the data packet is a specific location. An Internet data packet protection system includes: at least a first computer system including a first processing unit and a filtering unit, the filtering unit coupled to the first processing unit; and a second computer system The second processing unit is coupled to the second processing unit, wherein the first computer system transmits a data packet to the second computer system via the Internet, and the transmission step includes (a) the first computer system sends the data packet; (b) the filtering unit of the first computer system intercepts the data packet, and adds an identification mark to a blank space of the TCP/IP file header of the data packet; (c) the second computer system receives the data packet; (d) the control unit of the second computer system confirms that the blank of the TCP/IP file header of the data packet has the identification mark. The data packet protection system of the Internet as described in claim 17, wherein the transmitting step of the first computer system transmitting the data packet to the second computer system further comprises: (a) if the data packet is TCP The blank of the /IP header has an identification mark, and the control unit encapsulates the data; and (b) if the blank of the TCP/IP header of the data packet does not have an identification mark, the control unit blocks the data packet . For example, the data packet protection system of the Internet as described in claim 17 wherein the blank of the TCP/IP header of the data packet is a specific location. The data packet protection system of the Internet according to claim 17, wherein the second computer system further comprises a packet buffer unit coupled to the second processing unit and the control unit for storing the data packet. . The data packet protection system of the Internet as described in claim 20, wherein the second computer system further comprises an encryption and decryption unit coupled to the second processing unit and the packet buffer unit, when the data packet is stored After the packet buffer unit, the operating system of the second computer system automatically encrypts and decrypts the data packet.