KR20210066432A - Method for detecting and mitigating interest flooding attack through collaboration between edge routers in Named Data Networking(NDN) - Google Patents

Abstract

The present invention provides a method for detecting and defending against an interest flooding attack. According to the present invention, the method for detecting and defending against an interest flooding attack comprises the following steps of: setting a PIT table use threshold value for each input interface and checking whether the threshold value is exceeded; detecting whether an interest flooding attack is made from a prefix which is deleted by terminating an interest packet use period when the threshold value is exceeded; and deleting a packet having a malicious interest prefix from the PIT table.

Description

{Method for detecting and mitigating interest flooding attack through collaboration between edge routers in Named Data Networking(NDN)}

The present invention relates to a method for detecting and defending an interest flooding attack in Named Data Networking (NDN). More particularly, the present invention relates to a technique for detecting and defending against an interest flooding attack by an NDN router receiving an interest flooding attack in the NDN.

NDN is used in the same concept as Content Centric Networking (CCN) and is one of the implementation examples for future networks discussed in Information Centric Networking (ICN).

However, NDN, a future network technology, is vulnerable to a Denial of Service (DoS) attack that paralyzes the router and application server that provides services similar to the existing IP network.

Specifically, the NDN requests the content by the name of the content, and the content provider that creates the content delivers the content corresponding to the requested name. That is, for example, it consists of a consumer who requests content and a content producer who creates the content. When a consumer requests content with an interest packet, the producer responds to the request for content. It creates a data packet and delivers it to the requesting consumer.

More specifically, for example, an operation of an NDN router for transferring interest and data packets is as follows. The NDN router compares the received interest packet to see if there is data with the same name in the content store (CS). If the same name data exists in the CS, the corresponding data packet is delivered to the face where the received interest packet was received. On the other hand, if the same name data does not exist in the CS, the same name is found in the Pending Interest Table (hereinafter referred to as “PIT” or “PIT table”) in order to check whether there is a previously transferred name. compare whether

Here, if there is a PIT entry with a corresponding name in the PIT, a face number indicating the input path of the interest packet is added to the corresponding PIT entry. On the other hand, if a PIT entry with a corresponding name does not exist in the PIT, the forwarding interest base (FIB: Forwarding Interest Base, hereinafter referred to as “FIB” or “FIB table”) indicating which interface to transfer is referred to. That is, for example, if the same interest packet name exists in the FIB, the interest packet is delivered to the output face designated in the FIB. On the other hand, if the same interest packet name does not exist in the FIB, the corresponding interest packet is deleted.

Therefore, the weak part of the aforementioned NDN router is that the capacity of the PIT table for storing the name of the received interest packet is physically limited. Therefore, if a lot of unprocessed interest names remain because no data packets are received in the PIT table, the names of other interest packets cannot be stored, and the NDN router becomes in a state of being unable to perform any more services.

Aiming at such a vulnerability, a malicious network attacker delivers a large amount of interest packets to the NDN router and abnormally occupies the PIT table of the router, so it is possible to attack without being able to process normal interest packets. In addition, a malicious attacker may cause the application server to consume all resources to process the interest packet and cause a state in which normal service cannot be performed.

In addition, for example, in a conventional denial of service (DoS) attack by a malicious attacker, a bot is installed in a terminal of a normal consumer on the network and the bot is remotely installed using the terminal as described above. It is also possible to attack by forwarding a large number of malicious interest packets to the NDN router.

As described above, a denial of service attack method in which an attacker requests and attacks a large amount of interest in the conventional NDN is called, in particular, an “interest flooding attack”.

In particular, the interest flooding attack in NDN causes the NDN router or content producer to be unable to provide normal service, so that communication through the router is interrupted or the service of the content provider is not performed properly, resulting in socio-economic problems. can cause a lot of problems.

Also, in NDN, source information is not included in an interest packet. Therefore, only the input interface information of the edge router directly connected to the consumer can be known as to where the interest packet was requested. As a result, since it is not possible to accurately determine the interest packet generator, it is more difficult to efficiently respond.

Therefore, in consideration of the unique characteristics of NDNs, there is an urgent need for a detection method for the aforementioned interest flooding attack in the NDN router. In addition, there is also a need for an effective defense method against the detected interest flooding attack in the NDN router.

Accordingly, an object of the present invention is to provide a method for detecting an interest flooding attack in name data networking (NDN) in order to solve the problems of the prior art.

Another object of the present invention is to provide a method for preventing an interest flooding attack detected in name data networking (NDN) in order to solve the problems of the prior art.

Another object of the present invention is to provide a cooperative method between adjacent routers in order to prevent propagation of an interest flooding attack in name data networking (NDN) in order to solve the problems of the prior art.

In addition, an object of the present invention is to provide a program that can be executed in a computer, and a program for detecting and defending an interest flooding attack, and a recording medium in which the program is stored in order to solve the problems of the prior art.

Other objects and advantages of the present invention may be understood by the following description, and will become more clearly understood by the examples of the present invention. Further, it will be readily apparent that the objects and advantages of the present invention can be realized by the means and combinations thereof indicated in the claims.

The method for detecting and defending an interest flooding attack according to the present invention comprises the steps of setting a PIT table usage threshold for each input interface and checking whether the threshold is exceeded, and when the threshold is exceeded, the interest packet usage period ends and is deleted detecting whether there is an interest flooding attack from a prefix that is used, and deleting a packet having the malicious interest prefix from a PIT table.

According to an embodiment of the present invention, it is possible to efficiently detect an interest flooding attack in an NDN.

In addition, according to an embodiment of the present invention, it is possible to effectively defend against an interest flooding attack detected in NDN.

In addition, according to an embodiment of the present invention, it is possible to effectively prevent the propagation of an interest flooding attack by cooperation between neighboring routers in the NDN.

1 is a diagram illustrating an NDN network according to the present invention.
2 is a diagram illustrating an overall process for responding to an interest flooding attack in an NDN router according to the present invention.
3 to 4 show a process for detecting an interest flooding attack in an NDN router according to the present invention.
5 to 7 show interest packets and PIT tables as examples to explain the process of detecting an interest flooding attack according to the present invention.
8 illustrates a process for defending an interest flooding attack detected in an NDN router according to the present invention.
9A and 9B are diagrams for explaining prevention of propagation of an interest flooding attack through cooperation between neighboring routers in an NDN network.
10 is a diagram illustrating a process for defending an interest flooding attack in a neighboring NDN router according to the present invention.
11 illustrates an example of an NDN router configuration according to the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art to which the present invention pertains can easily implement them. However, the present invention may be embodied in various different forms and is not limited to the embodiments described herein.

In describing an embodiment of the present invention, if it is determined that a detailed description of a well-known configuration or function may obscure the gist of the present invention, a detailed description thereof will be omitted. And, in the drawings, parts not related to the description of the present invention are omitted, and similar reference numerals are attached to similar parts.

In the present invention, the components that are distinguished from each other are for clearly explaining their respective characteristics, and do not necessarily mean that the components are separated. That is, a plurality of components may be integrated to form one hardware or software unit, or one component may be distributed to form a plurality of hardware or software units. Accordingly, even if not specifically mentioned, such integrated or dispersed embodiments are also included in the scope of the present invention.

In the present invention, components described in various embodiments do not necessarily mean essential components, and some may be optional components. Accordingly, an embodiment composed of a subset of components described in one embodiment is also included in the scope of the present invention. In addition, embodiments including other components in addition to the components described in various embodiments are also included in the scope of the present invention. Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

1 is a diagram illustrating an NDN network according to the present invention.

The NDN network includes a data or content consumer (101, 102, 103, 104, hereinafter referred to as a 'consumer') that generates an interest packet and a data or content provider 130 that generates a data packet corresponding to the interest packet. hereinafter referred to as 'provider'). Further, the NDN network includes at least one or more NDN routers that forward interest packets and/or data packets between the consumer and the provider. In particular, among the NDN routers, a router adjacent to the consumer is referred to as an edge router 111 , 112 , 113 , 114 . On the other hand, the first core router (Core Router, 121, 122) and the first core router (Core Router, 121, 122) that receives the interest packet from the edge router or forwards the data packet to the edge router It includes a second core router (Core Router, 123) for sending and receiving.

In this case, a malicious attacker 102 attacking the NDN network may be included among the consumers 101 , 102 , 103 , and 104 . The malicious attacker 102 may impersonate the well-intentioned consumers 101, 103, and 104 and attempt an interest flooding attack using the NDN network characteristics. This will be described in detail as follows.

That is, the interest flooding attack by the malicious attacker is mainly intended to prevent normal interest packets from being added to the PIT table by exhausting the PIT table of the limited capacity of the edge router.

For example, it will be described with reference to FIGS. 5 to 7 . 5 to 7 illustrate an interest packet and a PIT table according to the present invention, for example.

In relation to this, Fig. 5 shows the packet name structure in the NDN interest packet. That is, in general, the NDN packet name configuration may be composed of a prefix and a suffix. Here, the prefix is mainly used to indicate the location and data name of the consumer who sends the interest packet, and the suffix may be used to indicate the segment into which the data is divided.

In consideration of the above NDN characteristics, the malicious attacker 102 uses a valid name prefix as the prefix in order to prevent the interest packet from being dropped or deleted from the router. On the other hand, in order to generate a large number of packets, the suffix is formed abnormally.

That is, for example, a malicious attacker 102 attempting an interest flooding attack collects normal name prefixes by monitoring the name data network (NDN). After the normal prefix collection is completed, a malicious attacker adds an abnormal suffix (Un-valid name suffix) to the interest packet consisting of a valid name prefix (Valid name prefix) and an abnormal name suffix (Un-valid name suffix) create and propagate.

In this regard, it is more efficient to perform the process of detecting an interest flooding attack primarily at the edge router directly connected to the consumer. As described above, due to the nature of NDN packet delivery, the inputted interest packets are aggregated in a manner of sequentially arranging input interface numbers with respect to the same name prefix and stored in the PIT table. 6 and 7 illustrate, for example, results stored in the PIT table according to the PIT operation.

Accordingly, the edge routers 111 , 112 , 113 , and 114 can determine the quantity for each prefix of an input interest packet, so that it is possible to more accurately determine an interest flooding attack. On the other hand, since the core routers 121, 122, and 123 manage the prefixes aggregated by the edge router, it is difficult to accurately determine the malicious interest prefix generated by the attacker. Therefore, it is more efficient to detect an interest flooding attack at the edge router and apply a countermeasure.

2 is a diagram illustrating an overall process for responding to an interest flooding attack in an NDN router according to the present invention.

That is, the entire process corresponding to an interest flooding attack according to the present invention may be composed of a process 210 for detecting an interest flooding attack, a process for defending 220 , and a process 230 for delivering. Here, the process 210 for detecting the interest flooding attack includes the process of detecting the interest flooding by using an interest packet and a PIT table characteristic. In addition, the process 220 for preventing the interest flooding attack includes a process of allowing the PIT table to operate normally by identifying and dropping or deleting malicious interest packets. In addition, the process 230 for forwarding the interest flooding attack uses a malicious interest list (eg, a Malicious Interest Prefix List (MIPL) table) with an adjacent NDN router to prevent the propagation of the interest flooding attack. sharing process. Hereinafter, each of the processes 210 , 220 , and 230 will be described in detail.

3 to 4 show a process for detecting an interest flooding attack in an NDN router according to the present invention. First, the NDN router checks whether the threshold of the PIT table is exceeded ( 310 ). Here, the threshold of the PIT table can be calculated as follows.

For example, the maximum number of interest packets that can be processed by the NDN router can be determined by the following equation.

Interest limit = Delay(s) * Bandwidth [Bytes/s] / Data packet size [Bytes]

Here, Delay means a time from transmission of an interest packet to reception of a data packet, Bandwidth means the maximum bandwidth of an output interface of a router, and Data packet size means a size of a data packet, respectively.

For example, when the maximum 1 Tera Bandwidth, Delay is 100 msec, and Data packet size is 1500 Byte, it can be calculated that the maximum number of interest packets can be processed as 66,000,000. Therefore, it is theoretically possible to configure the maximum number of PIT tables by 66,000,000. However, in general, the number of PIT tables can be smaller than this according to the forwarding strategy of the router.

Therefore, for example, if 100 input interfaces are configured in a router that processes 1 Tera, it is assumed that the PIT table is configured so that 6,600,000 interest packets can be processed for each input interface. Therefore, when a larger number of interest packets are input, normal routing becomes impossible in the router. Based on this, the router can calculate the maximum allowable amount of interest for each input interface, and it becomes possible to manage it as a PIT table 'threshold'. Accordingly, the PIT threshold can be set more freely by the system designer according to the network operation method. That is, if strict PIT table management is desired, it is possible to set the threshold value lower than the average value. On the other hand, if relatively relaxed PIT table management is desired, it is also possible to set the threshold value higher than the average. In addition, the threshold can be assigned to each interface.

Referring back to FIG. 3 , when the set PIT table capacity exceeds or approaches the threshold, the NDN router first performs input interface rate limiting, and examines the malicious interest prefix in the PIT table. to perform a process ( 320 ). For example, if the NDN router exceeds the maximum allowable threshold of PIT for each input interface, it first determines that it is a harbinger of an interest flooding attack, and rate-limiting ( rate limiting) can be applied. That is, for example, a certain percentage of received interest packets may be forcibly dropped or deleted. This may be a measure for the router to at least not go into a disabled state.

Next, after examining the malicious interest prefix in the IT table, it is determined whether there is an interest flooding attack ( 330 ). In relation to this, FIG. 4 shows, for example, a detailed process of determining whether the interest flooding attack is performed.

Referring to FIG. 4 , among the prefixes in the PIT, prefixes that are deleted when the 'interest life time' ends are aggregated ( 331 ). Thereafter, the interests are sorted in the order of the largest number of input interface ports among the collected prefixes (332). However, the alignment step 332 may be omitted. Thereafter, a malicious interest is determined among the aligned interests ( 333 ).

The process of examining the malicious interest prefix in the PIT table may use, for example, the 'interest life time' field included in the interest packet. That is, since prefixes that are deleted due to the end of 'interest life time' do not receive data packets normally and occupy the PIT table for a specified time in the packet, these prefixes can be determined as malicious interest prefixes. Specifically, among these prefixes, a prefix with a large number of input interfaces as a prefix with the same name may be determined as a malicious interest prefix.

For example, in the PIT tables of FIGS. 6 and 7 , a PIT entry 710 occupying a plurality of input interfaces 711 may be determined as a malicious interest prefix. However, this is only an example, and the example shown in FIG. 6 does not mean a general malicious interest type.

In particular, in determining the malicious interest, it is more preferable to determine the malicious interest prefix in the order of the number of input interface port numbers among the deleted prefixes. Thereafter, the above-described rate limiting is released, and by forcibly dropping or deleting the malicious interest prefix, it is possible to repeatedly monitor whether the threshold value of the PIT table is exceeded.

8 illustrates a process for defending an interest flooding attack detected in an NDN router according to the present invention.

For example, when an interest flooding attack is confirmed (800), the NDN router forcibly deletes a malicious interest in the PIT and creates a malicious interest list (810).

Also, based on the prefix name included in the malicious interest, it is possible to warn that a malicious interest flooding attack has occurred to the corresponding consumer 102 (either a malicious attacker or a good consumer) ( 820 ). In this case, the attacker 102 may be a good consumer rather than an actual malicious attacker. the above warning. By delivering NACK (Negative Acknowledgment) notifying the occurrence of congestion to the good consumer through the corresponding input interface, the good consumer can be induced to refrain from generating interest packets. On the other hand, there is a high possibility that the malicious attacker who receives the warning ignores the NACK and continues the interest flooding attack.

Therefore, in order to effectively protect against continuous interest flooding attacks of malicious attackers, information sharing between adjacent edge routers is required. That is, the process of propagating the malicious interest list to the neighboring router may be performed ( 830 ).

For example, an edge router may periodically request a Malicious Interest Prefix List (MIPL) from adjacent (eg, 1 hop distance) edge routers. In addition, from the received MIPL table, it is possible to know whether an interest flooding attack has occurred in the neighboring router, and if so, with which interest prefix it was generated. Therefore, upon receiving the MIPL table, the NDN router examines its own PIT table and, if the corresponding prefix exists in the PIT, preemptively forcibly drops or deletes it, thereby effectively preventing an interest flooding attack.

In relation to this, FIGS. 9A and 9B are diagrams for explaining prevention of interest flooding attack propagation through cooperation between neighboring routers in an NDN network. As described above, for example, when the PIT share is abnormally increased by the malicious attacker 921 accessing the edge router #2 920, the edge router #2 920 writes the MIPL and writes the The MIPL may be propagated to the neighboring edge router #1 (910) and router #3 (930). Referring to FIG. 9B , the edge routers 910 , 920 , 930 , and 940 sharing the MIPL table use an interest list used by malicious attackers (eg, 911, 921, 931) registered in the corresponding list. By forcibly dropping or deleting in advance, it is possible not only to protect its own router PIT table, but also to defend the entire NDN network from malicious attackers.

10 is a diagram illustrating a process for defending an interest flooding attack in a neighboring NDN router according to the present invention. The NDN router receives a malicious interest list (eg, MIPL) from the neighboring edge router (1010). Thereafter, by using the malicious interest list, the malicious interest packet is identified and used for self-router defense (1020). In this case, the input malicious interest packet may be ignored or deleted. In addition, it is also possible to forcibly drop or delete malicious interest packets existing in the PIT table by using the malicious interest prefix.

11 shows, for example, the configuration of the NDN router 1100 according to the present invention. The NDN router may include a memory 1110 , a processor 1120 , a transceiver 1130 , and other peripheral devices 1140 . In addition, as an example, the NDN router 1100 may further include other components, and is not limited to the above-described embodiment. As an example, the NDN router may be an NDN edge router or a core router. However, as described above, when it is an edge router, it is more effective in detecting and defending against an interest flooding attack.

More specifically, the NDN router 1100 may be an exemplary hardware or software architecture of an NDN network node. In this case, as an example, the memory 1110 may be a non-removable memory or a removable memory. Also, as an example, the peripheral device 1240 may include a display, GPS, or other peripheral devices, and is not limited to the above-described embodiment. In addition, as an example, the above-described NDN router 1100 may include a wired/wireless communication circuit like the transceiver 1130 or may include a communication interface, and may communicate with an external device based on this.

The processor 1120 may perform a process 210 for detecting, a process 220 for defending, and a process 230 for delivering the interest flooding attack illustrated in FIG. 2 described above. In addition, the processor 1120 is capable of performing all of the detailed processes of detecting, defending, and transferring interest according to FIGS. 3, 4, 8 and 10 described above.

Various embodiments of the present disclosure do not list all possible combinations but are intended to describe representative aspects of the present disclosure, and matters described in various embodiments may be applied independently or in combination of two or more.

In addition, various embodiments of the present disclosure may be implemented by hardware, firmware, software, or a combination thereof. For implementation by hardware, one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), Programmable Logic Devices (PLDs), Field Programmable Gate Arrays (FPGAs), general purpose It may be implemented by a processor (general processor), a controller, a microcontroller, a microprocessor, and the like. For example, the processor may be implemented as software written in a computer-readable programming language, and may take various forms including the general-purpose processor. It is apparent that the processor may be disclosed as hardware composed of one or more combinations. .

The scope of the present disclosure includes software or machine-executable instructions (eg, operating system, application, firmware, program, etc.) that cause an operation according to the method of various embodiments to be executed on a device or computer, and such software or and non-transitory computer-readable media in which instructions and the like are stored and executed on a device or computer.

The present invention described above can be various substitutions, modifications and changes within the scope without departing from the technical spirit of the present invention for those of ordinary skill in the art to which the present invention pertains, so the scope of the present invention is not limited to the above. It is not limited by one embodiment and the accompanying drawings.

Edge routers: 111, 112, 113, 114, 910, 920, 930, 940
Core router: 121, 122, 123
Malicious attacker: 102, 911, 921, 931
Processor: 1120

Claims (1)

A method for detecting and preventing an interest flooding attack, the method comprising:
Setting a PIT table use threshold for each input interface, and checking whether the threshold is exceeded;
When the threshold is exceeded, detecting whether an interest flooding attack occurs from a prefix that is deleted due to the expiration of the interest packet usage period; and
A method for detecting and defending against an interest flooding attack, comprising the step of deleting a packet with the malicious interest prefix from a PIT table

Images