TW202027460A - Dynamic protection method for network node and network protection server - Google Patents

Abstract

The disclosure provides a dynamic protection method for network node and network protection server. The method includes: creating a dynamic protection table, wherein the dynamic protection table includes a plurality of virtual target hosts and a plurality of numbers corresponding to the virtual target hosts; recording a first time point of creating the dynamic protection table, and generating an interval time; updating the correspondence relationships between the virtual target hosts and the foregoing numbers at a second time point to update the dynamic protection table, wherein the second time point is the sum of the first time point and the interval time; and receiving a network packet and adaptively directing the network packet to one of the aforementioned virtual target hosts according to the packet content of the network packet.

Description

Mobile protection method of network node and network protection server

The invention relates to a network protection method and a network protection server, and more particularly to a mobile protection method of a network node and a network protection server.

The current network environment tends to be static and fixed for the network configuration of the system service host itself, and the network configuration information will not be continuously changed after configuration. When the intruder conducts detection and data collection through port scanning attacks, it can target the weaknesses or vulnerabilities of the system service host to perform effective intrusion actions.

In view of this, the present invention provides a mobile protection method for network nodes and a network protection server, which can be used to solve the above technical problems.

The present invention provides a mobile protection method for network nodes, which includes: creating a mobile protection table, wherein the mobile protection table includes a plurality of virtual target hosts and a plurality of mobile protection numbers corresponding to the aforementioned virtual target hosts; A first time point of the protection table, and an interval time is generated; at a second time point, the corresponding relationship between the virtual target host and the mobile protection number is updated to update the mobile protection table, where the second time point is the first time The sum of point and interval time; and receiving a network packet, and adaptively directing the network packet to one of the aforementioned virtual target hosts according to the packet content of the network packet.

The invention provides a network protection server, which includes a storage circuit and a processor. The storage circuit records multiple modules. The processor is coupled to the storage circuit and accesses the aforementioned modules to perform the following steps: create a mobile protection table, wherein the mobile protection table includes a plurality of virtual target hosts and a plurality of mobile protection numbers corresponding to the virtual target hosts; Create a first time point of the mobile protection table and generate an interval time; update the corresponding relationship between the virtual target host and the mobile protection number at a second time point to update the mobile protection table, where the second time point is the first The sum of a time point and an interval time; and receiving a network packet, and adaptively directing the network packet to one of the aforementioned virtual target hosts according to the packet content of the network packet.

Based on the foregoing, the present invention can allow the target host to change and change over time, increase the complexity and cost of hacker attacks, and limit the opportunities for hackers to discover loopholes, thereby achieving the protective effect of active defense.

In order to make the above-mentioned features and advantages of the present invention more comprehensible, the following specific embodiments are described in detail in conjunction with the accompanying drawings.

In summary, the present invention discloses a mobile protection method with random changes of network nodes. When network communication is performed between virtual hosts, software-defined network technology is used to monitor virtual networks and change suspicious connections through mobile protection tables. The location of the network node and host that the line intends to connect to, and the network node in the mobile protection list will continue to change at random time intervals to confuse and deceive suspicious users. When a network packet is received, it will analyze the contents of the packet based on the information of the protected system service host and the target host, and identify whether it is a suspicious connection for mobile protection processing. If the packet is judged to be a suspicious connection, based on the OpenFlow protocol, the mobile protection connection rule can be sent to the cloud virtual switch according to the situation, and the suspicious connection is originally intended to be connected to the network node of the system service host and forwarded to the target The host, or directly discard the packet. If it is determined that the packet is not a suspicious connection, the packet can be connected to the system service host normally. In this way, suspicious users cannot obtain correct system service information, and must deal with a large number of uncertain factors, and the system is more difficult to explore and predict due to its dynamic nature to achieve the purpose of the protection system.

Please refer to FIG. 1, which is a schematic diagram of a network protection server according to an embodiment of the present invention. In this embodiment, the network protection server 100 may be a server, a personal computer (PC), a notebook PC (notebook PC), a netbook PC, a tablet PC, Virtual machine (virtual machine) etc., but not limited to this.

As shown in FIG. 1, the network protection server 100 includes a storage circuit 102 and a processor 104. The storage circuit 102 is, for example, any type of fixed or removable random access memory (Random Access Memory, RAM), read-only memory (Read-Only Memory, ROM), flash memory (Flash memory), hard disk Disk or other similar devices or a combination of these devices can be used to record multiple codes or modules.

The processor 104 is coupled to the storage circuit 102, and can be a general purpose processor, a special purpose processor, a traditional processor, a digital signal processor, multiple microprocessors, one or more combined digital signal processing The core microprocessor, controller, microcontroller, Application Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA), any other types of integrated circuits, State machines, processors based on Advanced RISC Machine (ARM) and similar products.

In the embodiment of the present invention, the processor 104 can load the program code or module recorded in the storage circuit 102 to execute the mobile protection method for network nodes proposed by the present invention, which will be further described below.

Please refer to FIG. 2, which is a flowchart of a mobile protection method for a network node according to an embodiment of the present invention. The method of this embodiment can be executed by the network protection server shown in FIG. 1. The details of each step in FIG. 2 are described below with the components shown in FIG. 1.

In step S210, the processor 104 may create a mobile protection table. In this embodiment, the mobile protection table may include multiple virtual target hosts and multiple mobile protection numbers corresponding to the aforementioned virtual target hosts. For example, assuming that the number of virtual target hosts is n and the mobile protection number is 0~(n-1), the processor 104 may individually assign mobile protection numbers 0~(n-1) to the aforementioned virtual target hosts. One of them, and each virtual target host corresponds to a different mobile protection number. In addition, the aforementioned mobile protection table may also include the target host number, network node, and virtual network interface corresponding to each virtual target host, but it is not limited to this.

In step S220, the processor 104 may record the first time point (hereinafter referred to as T _pre ) of creating the movement protection table, and generate an interval time (hereinafter referred to as T _r ). In various embodiments, the processor 104 according to necessity T _r generated in different ways. For example, the processor 104 may generate a random value between a range of values (e.g., 30 minutes) as T _r, but is not limited thereto.

In step S230, the processor 104 may update the correspondence between the virtual target host and the mobile protection number at a second time point (hereinafter referred to as T _now ) to update the mobile protection table. In the present embodiment, T _now, for example, is the sum of T _r and T _pre. That is, after T _pre , the processor 104 can wait for the time of T _r and update the correspondence between the virtual target host and the mobile protection number.

In one embodiment, the processor 104 can update the mobile protection table by disrupting the correspondence between the virtual target host and the mobile protection number. For example, suppose that the initially created mobile protection table includes the first, second,..., And tenth virtual target hosts, and they correspond to mobile protection numbers 0-9 sequentially one-to-one. However, after the processor 104 performs the above-mentioned update, the first virtual target host to the tenth virtual target host no longer correspond to the mobile protection numbers 0-9 one-to-one, but respectively correspond to 0-9 One of them. For example, the first virtual target host corresponds to the mobile protection number 2, the second virtual target host corresponds to the mobile protection number 6, and so on. However, the foregoing content is only for example, and is not intended to limit the possible implementation of the present invention.

In an embodiment, the processor 104 may update the corresponding relationship between the virtual target host and the mobile protection number again at the third time point to update the mobile protection table again, where the third time point and the second time point are separated by another The interval time, and this other interval time can also be generated by the processor 104 (randomly). That is, the processor 104 can constantly update the mobile protection table by, for example, disrupting the correspondence between the virtual target host and the mobile protection number from time to time, but the present invention is not limited to this.

In step S240, the processor 104 may receive the network packet, and adaptively direct the network packet to one of the aforementioned virtual target hosts according to the packet content of the network packet.

It can be seen from the above that the mobile protection method proposed by the present invention allows the target host to continuously change and then change over time, increase the complexity and cost of hacker attacks, and limit the opportunities for hackers to find loopholes to achieve active defense The protective effect.

In order to make the concept of the present invention clearer, the following is supplemented with FIG. 3 for further explanation. Please refer to FIG. 3, which is a flowchart of adaptively guiding a network packet to one of the aforementioned virtual target hosts according to the packet content of the network packet according to an embodiment of the present invention. First, in step S301, the processor 104 may determine whether an information security alert notification is received. If yes, proceed to step S302, otherwise, proceed to step S303.

In step S302, the processor 104 may record the IP address corresponding to the information security alert notification to a suspicious IP database. In step S303, the processor 104 may receive the network packet, and analyze the packet content of the network packet in step S304. The aforementioned packet content may include the destination IP, source IP, and destination communication port of the network packet, but may not Limited to this.

In one embodiment, when a hacker initiates a port scanning attack in a cloud environment, the method of the present invention uses software defined network (software defined network, SDN) technology to centrally control the flow of network packets, and analyze the packets of these attack packets Content, but the present invention may not be limited to this.

After step S304, the processor 104 may determine whether the suspicious IP database is null in step S305. If yes, then continue to execute step S310, otherwise, continue to execute step S306.

In step S306, the processor 104 can determine whether the source IP has been recorded in the suspicious IP database. That is, the processor 104 can determine whether the source IP of the aforementioned network packet has previously triggered a corresponding information security alert notification. If so, it means that the network packet may be an attack packet and regarded as a suspicious network packet. Therefore, the processor 104 can execute steps S307, S308, and S309 accordingly to direct the network packet to one of the target hosts.

In step S307, the processor 104 may perform a hash operation on the packet content of the network packet to generate a hash value. In step S308, the processor 104 may calculate a reference value based on the hash value. In an embodiment, the processor 104 may convert this hash value into a number of decimal digits of American Standard Code for Information Interchange (ASCII), and add the aforementioned ASCII numbers to a total value. . After that, the processor 104 may calculate a remainder of the total value divided by n (ie, the number of virtual target hosts), and use this remainder as the aforementioned reference value. In this case, the reference value will be an integer value between 0 and (n-1), that is, the reference value will correspond to one of the aforementioned mobile protection numbers. Next, in step S309, the network packet is directed to the specific target host of the aforementioned virtual target host, wherein the mobile protection number of the specific target host corresponds to the aforementioned reference value.

For example, assuming that the calculated reference value is 3, the processor 104 may look up the mobile protection table to find the virtual target host corresponding to the mobile protection number 3 as the aforementioned specific target host. Then, the processor 104 can obtain the network node and virtual network interface of the specific target host from the mobile protection table, compose mobile protection connection rules based on an OpenFlow protocol, and send the aforementioned mobile protection connection rules to the cloud virtual exchange According to the mobile protection connection rules in the flow table, the cloud virtual switch can convert the original network packet flow to direct the network packet to the network node of the specific target host and Virtual network interface.

In short, when the processor 104 finds a suspicious network packet, it can control the flow of the suspicious network packet through the OpenFlow protocol, and then change the virtual network interface of the destination of the suspicious network packet from the original system service host to be connected. , Change to connect to the virtual target host corresponding to the reference value in the mobile protection table. In other words, the system service information detected by the hacker through the port scanning attack is provided by the fake virtual target host, so that the protected system service can be prevented from being targeted after the vulnerability is detected. Vulnerability attacks or Advanced Persistent Threat (APT) attacks.

In addition, as described in the previous embodiment, since the mobile protection table can be continuously updated, even if the processor 104 calculates the same reference value at different time points, suspicious network packets encountered at different time points may be Guide to different virtual target hosts.

In addition, in step S306, if the source IP is not recorded in the suspicious IP database, it means that the network packet may not be a suspicious network packet. Therefore, the processor 104 may perform step S310 to determine whether the destination IP of the network packet is protected IP. If it is, then step S311 can be continued for further judgment, otherwise, step S313 can be continued. In this embodiment, the method of the present invention can protect the system service host, so the protected system service host data is stored first. In this case, the protected system service host IP can be regarded as the protected IP, and the open communication port on the protected system service host is the protected communication port, but the present invention is not limited to this.

In step S311, the processor 104 may determine whether the destination communication port of the network packet belongs to a protected communication port. If so, it can be determined that the network packet should not be a suspicious network packet, so step S312 may be performed to direct the network packet to the protected system service host corresponding to the destination IP. In one embodiment, the processor 104 can compose normal connection rules based on an OpenFlow protocol, and send the aforementioned normal connection rules to the flow direction table of the cloud virtual switch, and the cloud virtual switch can follow the normal connection in the flow direction table. Rules, send network packets to the host (system service or other general) corresponding to the destination IP.

On the other hand, if the processor 104 determines in step S311 that the destination port of the network packet is not a protected port, it means that the network packet is trying to connect to an unopened communication port, and it is regarded as a suspicious network packet. Therefore, the processor 104 can execute steps S307, S308, and S309 accordingly to direct the network packet to one of the target hosts.

In addition, in step S313, the processor 104 can determine whether the destination IP of the network packet belongs to any of the aforementioned virtual target hosts. If yes, the processor 104 may perform step S314 to block network packets; if not, the processor 104 may continue to perform step S315. Specifically, if the destination IP of the network packet belongs to any of the aforementioned virtual target hosts, it means that a hacker has previously scanned and attacked through the front communication port and has been directed to connect to one of the virtual targets. Host and obtain its IP address. It can be seen that the current network packets being processed are a new wave of network attacks launched by hackers directly against the IP address of the virtual target host.

In other words, the processor 104 can know that the network packet currently being processed is a highly suspicious network packet, and therefore can directly block and discard the network packet. In an embodiment, the processor 104 may compose mobile protection blocking rules based on the OpenFlow protocol, and send the aforementioned mobile protection blocking rules to the flow direction table of the cloud virtual switch, and the cloud virtual switch may follow the mobile protection blocking rules in the flow direction table. Discard this network packet to achieve the purpose of blocking the network packet.

On the other hand, in step S313, if the destination IP of the network packet does not belong to any of the aforementioned virtual target hosts, it means that the network packet is harmless traffic. Therefore, the network packet can be imported in step S315 Lead to the host corresponding to the destination IP to allow it to connect to the host corresponding to the destination IP. In different embodiments, the host may be an unprotected system service host, or other client hosts.

In summary, in the mobile protection method and network protection server provided by the present invention, SDN and OpenFlow technologies are used to centrally monitor and analyze the contents of virtual network packets. When a suspicious network packet is detected, the network node can be changed to protect the security of the service system in the SDN environment.

The method provided by the present invention can detect communication port scanning attacks, and after distinguishing normal and suspicious network packets, prevent the suspicious network packets from contacting the protected service system.

In addition, by creating multiple virtual target hosts, hackers can only obtain information about virtual target hosts, but cannot detect real service system host data, thereby achieving the effect of protecting service system hosts in the SDN environment.

In addition, the method provided by the present invention continuously updates the mobile protection table, so that the virtual target host changes and changes over time, increases the complexity and cost of hacker attacks, and limits the opportunities for hackers to discover vulnerabilities. Achieve the protective effect of active defense.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the relevant technical field can make some changes and modifications without departing from the spirit and scope of the present invention. The scope of protection of the present invention shall be subject to those defined by the attached patent scope.

100: Network protection server 102: storage circuit 104: processor S210~S240, S301~S315: steps

FIG. 1 is a schematic diagram of a network protection server according to an embodiment of the present invention. Fig. 2 is a flowchart of a mobile protection method for a network node according to an embodiment of the present invention. FIG. 3 is a flowchart of adaptively guiding a network packet to one of the aforementioned virtual target hosts according to the packet content of the network packet according to an embodiment of the present invention.

S210~S240: steps

Claims (11)

A mobile protection method for network nodes includes: Creating a mobile protection table, wherein the mobile protection table includes a plurality of virtual target hosts and a plurality of mobile protection numbers corresponding to the virtual target hosts; Record a first time point when the mobile protection table is created, and generate an interval time; Updating the correspondence between the virtual target hosts and the mobile protection numbers at a second time point to update the mobile protection table, where the second time point is the sum of the first time point and the interval time; and A network packet is received, and the network packet is adaptively guided to one of the virtual target hosts according to the packet content of the network packet. The method described in item 1 of the scope of patent application includes: In response to receiving an information security alert notification, an internet protocol (IP) address corresponding to the information security alert notification is recorded in a suspicious IP database. The method described in item 2 of the scope of patent application, wherein the packet content of the network packet includes a source IP, and the network packet is adaptively directed to the virtual labels according to the packet content of the network packet One of the steps of the target host includes: Reflecting that the suspicious IP database is not empty, determine whether the source IP has been recorded in the suspicious IP database; In response to that the source IP has been recorded in the suspicious IP database, perform a hash operation on the packet content of the network packet to generate a hash value; Calculating a reference value based on the hash value, where the reference value corresponds to one of the mobile protection numbers; The network packet is directed to a specific target host of the virtual target hosts, where the specific target host corresponds to the reference value. For the method described in item 3 of the scope of patent application, the number of the mobile protection numbers is n, and the step of calculating the reference value based on the hash value includes: Convert the hash value to a number of American Standard Code for Information Interchange (ASCII) numbers in decimal; Add these ASCII numbers to a total value; and Calculate a remainder of the total value divided by n, and use the remainder as the reference value. For the method described in item 3 of the scope of the patent application, the mobile protection table further includes the target host number, network node and virtual network interface corresponding to each virtual target host, and directs the network packet to The steps of the specific target host of the virtual target hosts include: Obtain the network node and the virtual network interface of the specific target host from the mobile protection table; and The mobile protection connection rule is composed based on an OpenFlow protocol, and the aforementioned mobile protection connection rule is sent to the flow direction table of the cloud virtual switch, so that the cloud virtual switch converts the original mobile protection connection rule in the flow direction table The network packet flow direction to guide the network packet to the network node and the virtual network interface of the specific target host. For the method described in claim 2, wherein the packet content of the network packet includes a destination IP, and the network packet is adaptively directed to the virtual labels according to the packet content of the network packet One of the steps of the target host includes: Reflecting that the suspicious IP database is empty, determine whether the destination IP of the network packet belongs to a protected IP; In response to the destination IP of the network packet that does not belong to the protected IP, determine whether the destination IP of the network packet belongs to any of the virtual target hosts; and The destination IP reflected in the network packet belongs to any one of the virtual target hosts, and the network packet is blocked. For the method described in item 6 of the scope of patent application, wherein the packet content of the network packet further includes a destination port, and the destination IP reflected in the network packet belongs to the protected IP, the method further includes : Determine whether the destination port of the network packet belongs to a protected port; and It is reflected that the destination communication port belongs to the protected communication port, and the network packet is directed to a protected system service host corresponding to the destination IP. For example, the method described in item 7 of the scope of patent application, wherein it is reflected that the destination communication port does not belong to the protected communication port, the method further includes: Performing a hash operation on the packet content of the network packet to generate a hash value; Calculating a reference value based on the hash value, where the reference value corresponds to one of the mobile protection numbers; The network packet is directed to a specific target host of the virtual target hosts, where the specific target host corresponds to the reference value. The method described in item 6 of the scope of patent application, wherein the destination IP reflected in the network packet does not belong to any of the virtual target hosts, and the network packet is directed to a corresponding destination IP Host. The method described in item 1 of the scope of patent application includes: At a third time point, the correspondence between the virtual target hosts and the mobile protection numbers is updated again to update the mobile protection table again, wherein the third time point and the second time point are separated by another interval time. A network protection server, including: A storage circuit for recording multiple modules; and A processor, coupled to the storage circuit, accesses the modules to perform the following steps: Creating a mobile protection table, wherein the mobile protection table includes a plurality of virtual target hosts and a plurality of mobile protection numbers corresponding to the virtual target hosts; Record a first time point when the mobile protection table is created, and generate an interval time; Updating the correspondence between the virtual target hosts and the mobile protection numbers at a second time point to update the mobile protection table, where the second time point is the sum of the first time point and the interval time; and A network packet is received, and the network packet is adaptively guided to one of the virtual target hosts according to the packet content of the network packet.

Images