CN111835735B

CN111835735B - Anti-attack method, device, equipment and machine-readable storage medium

Info

Publication number: CN111835735B
Application number: CN202010603331.XA
Authority: CN
Inventors: 王阳; 廖以顺; 王珍珍
Original assignee: New H3C Security Technologies Co Ltd
Current assignee: New H3C Security Technologies Co Ltd
Priority date: 2020-06-29
Filing date: 2020-06-29
Publication date: 2023-12-29
Anticipated expiration: 2040-06-29
Also published as: CN111835735A

Abstract

The present disclosure provides an anti-attack method, apparatus, device and machine-readable storage medium, the method comprising: receiving a TCP SYN message sent by opposite terminal equipment; establishing an ARP (address resolution protocol) table entry according to the received TCP SYN message, and packaging and sending an ACK (acknowledgement) message response according to the ARP table entry; and aging out ARP list items corresponding to the ACK message response which is not responded. Through the technical scheme of the disclosure, an ACK message response is initiated to the terminal corresponding to the ARP table entry, if the response is not obtained, the TCP SYN message corresponding to the ARP table entry is considered to be a SYN attack message, and the ARP table entry is aged, so that the ARP table is prevented from being unable to work normally due to SYN attack.

Description

Anti-attack method, device, equipment and machine-readable storage medium

Technical Field

The present disclosure relates to the field of communications technologies, and in particular, to an anti-attack method, apparatus, device, and machine-readable storage medium.

Background

TCP (Transmission Control Protocol ) is a connection-oriented, reliable, byte-stream based transport layer communication protocol. TCP is intended to accommodate a layered protocol hierarchy that supports multiple network applications. Reliable communication services are provided by means of TCP between pairs of processes in host computers connected to different but interconnected computer communication networks. TCP assumes that it can obtain simple, possibly unreliable datagram services from lower level protocols.

ARP (Address Resolution Protocol ) is a TCP/IP protocol that obtains a physical address from an IP address. Broadcasting an ARP request containing a target IP address to all hosts on a local area network when the hosts send information, and receiving a return message so as to determine the physical address of the target; after receiving the return message, the IP address and the physical address are stored in the local ARP cache and kept for a certain time, and the ARP cache is directly inquired when the request is next time so as to save resources. The address resolution protocol is based on that each host computer in the network trusts each other, and the host computers on the local area network can autonomously send ARP response messages, and other host computers can record the response messages into the local ARP cache without detecting the authenticity of the messages when receiving the response messages.

SYN (Synchronize Sequence Numbers, synchronization sequence number) is a handshake signal used when TCP/IP establishes a connection. When a normal TCP network connection is established between the client and the server, the client first sends a SYN message, the server uses a SYN+ACK acknowledgement to indicate that the message was received, and finally the client responds with an ACK message. In this way, a reliable TCP connection can be established between the client and the server, and data can be transferred between the client and the server.

The flow of the user accessing the Internet is transmitted to the gateway router ROUTE and then to the external network through the switch, and the return flow of the Internet is opposite. The equipment has no problem under the condition of normal user access, but if someone in the local area network carries out SYN attack of TCP at this time, the SYN report Wen Lun inquires and changes the source IP address, the equipment can initiate ARP request messages to the source address of the SYN message after receiving the SYN message, the attack terminal responds to the ARPs at this time, under the condition, the gateway router quickly learns the ARP list items to be full, and the ageing time of the common ARP is longer, so that the ARP response received by the ARP request initiated by normal new service can not generate the list items, the service is influenced, and in fact, the half connection caused by the TCP SYN attack is aged off very soon.

Disclosure of Invention

In view of this, the disclosure provides an anti-attack method and device, an electronic device, and a machine-readable storage medium, so as to solve the problem that ARP table cannot work normally due to SYN attack.

The technical scheme is as follows:

the present disclosure provides an anti-attack method applied to a network device, the method comprising: receiving a TCP SYN message sent by opposite terminal equipment; establishing an ARP (address resolution protocol) table entry according to the received TCP SYN message, and packaging and sending an ACK (acknowledgement) message response according to the ARP table entry; and aging out ARP list items corresponding to the ACK message response which is not responded.

As a technical solution, the establishing an ARP table entry according to the received TCP SYN message includes: generating a corresponding short connection session according to the received TCP SYN message, initiating an ARP request according to the source IP address of the TCP SYN message, and generating an ARP table entry according to the response of the corresponding ARP request.

As a technical solution, the ARP entry includes an entry type field, where the value of the entry type field of the ARP entry corresponding to the ACK message response that does not obtain the response is different from the value of the entry type field of the ARP entry corresponding to the ACK message response that obtains the response.

As a technical solution, if a message responding to the ACK message response is received, the entry type field of the corresponding ARP entry is updated.

The present disclosure also provides an anti-attack apparatus applied to a network device, the apparatus comprising: the receiving module is used for receiving the TCP SYN message sent by the opposite terminal equipment; the processing module establishes an ARP table entry according to the received TCP SYN message, and encapsulates and sends an ACK message response according to the ARP table entry; and the aging module is used for aging out ARP (address resolution protocol) list items corresponding to the ACK message response which is not responded.

The present disclosure also provides an electronic device comprising a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor, the processor executing the machine-executable instructions to implement the foregoing method of combating attacks.

The present disclosure also provides a machine-readable storage medium storing machine-executable instructions that, when invoked and executed by a processor, cause the processor to implement the foregoing method of preventing attacks.

The technical scheme provided by the disclosure at least brings the following beneficial effects:

and initiating an ACK message response to the terminal corresponding to the generated ARP table entry, and if the response is not obtained, considering the TCP SYN message corresponding to the ARP table entry as a SYN attack message, and aging out the ARP table entry, thereby avoiding that the ARP table cannot work normally due to SYN attack.

Drawings

In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings that are required to be used in the embodiments of the present disclosure or the description of the prior art will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments described in the present disclosure, and other drawings may also be obtained according to these drawings of the embodiments of the present disclosure to those skilled in the art.

FIG. 1 is a flow chart of a method of protecting against attacks in one embodiment of the present disclosure;

FIG. 2 is a block diagram of an anti-attack device in one embodiment of the present disclosure;

fig. 3 is a hardware configuration diagram of an electronic device in one embodiment of the present disclosure.

Detailed Description

The terminology used in the embodiments of the disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. As used in this disclosure and the claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to any or all possible combinations including one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in the embodiments of the present disclosure to describe various information, these information should not be limited to these terms. These terms are only used to distinguish one type of information from another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the present disclosure. Depending on the context, furthermore, the word "if" used may be interpreted as "at … …" or "at … …" or "in response to a determination".

The flow of the user accessing the Internet is transmitted to the gateway router ROUTE and then to the external network through the switch, and the return flow of the Internet is opposite. The equipment has no problem under the condition of normal user access, but if someone in the local area network carries out SYN attack of TCP at this time, the SYN report Wen Lun inquires and changes the source IP address, the equipment can initiate ARP request messages to the source address of the SYN message after receiving the SYN message, the attack terminal responds to the ARPs at this time, under the condition, the gateway router quickly learns the ARP list items to be full, and the ageing time of the common ARP is longer, so that the ARP response received by the ARP request initiated by normal new service can not generate the list items, the service is influenced, and in fact, the half connection caused by the TCP SYN attack is aged off very soon. The current TCP SYN anti-attack can only delay the filling speed of the table entries of the ARP table, but cannot solve the problem.

The specific technical scheme is as follows.

Specifically, as shown in fig. 1, the method comprises the following steps:

step S11, receiving a TCP SYN message sent by the opposite terminal equipment.

And step S12, establishing an ARP (address resolution protocol) list item according to the received TCP SYN message, and packaging and sending an ACK (acknowledgement) message response according to the ARP list item.

And S13, aging out ARP list items corresponding to the ACK message response which is not responded.

In this embodiment, the peer device defaults to a device that initiates a SYN attack, and if the peer device is a normal device, it will respond to an ACK message, so that the corresponding ARP entry will not be aged.

The passive side of the TCP session enters a short connection state after receiving the TCP SYN message, and enters a long connection state after completing three-way handshake, wherein the short connection session is a generic term of the intermediate state of the TCP session, the aging time of the session in the state is very short, and the short connection session which cannot enter the long connection state in the appointed time is quickly aged.

And (3) for the ACK message response with the type of unresponsed, aging the ACK message response after a preset time.

And if the ACK message response is responded within the preset time, refreshing the corresponding type field to be the value of the corresponding response-obtained ACK message response, so that the ACK message response is prevented from being aged in a short time.

The present disclosure also provides an anti-attack device, applied to a network device, as shown in fig. 2, the device includes: a receiving module 21, for receiving a TCP SYN message sent by the opposite terminal device; the processing module 22 establishes an ARP table entry according to the received TCP SYN message, and encapsulates and sends an ACK message response according to the ARP table entry; and the aging module 23 ages the ARP table entry corresponding to the ACK message response which is not responded.

ARP table entry structure is as shown in Table 1

Index

IP

MAC

VLAN

INTERFACE

AGING

TYPE

1

ip1

mac1

vlan1

interface1

t1

T

TABLE 1

IP field: IP information stored in ARP list item;

MAC field: MAC information stored in ARP list item;

VLAN field: learning VLAN information of ARP;

an INTERFACE field: learning interface information of ARP;

the AGING field: normal aging time of ARP table entries;

TYPE field: an entry type field of the ARP entry.

And adding an item type field in an item structure of the ARP list, wherein the item type field is used for marking that the ARP item is learned by an ARP request triggered by the TCP connection, and if the subsequent interaction of the TCP connection is completed and enters a long connection state, switching the value of the ARP item type into a normal type, namely, correspondingly obtaining the response value of the ARP message response.

After receiving the TCP SYN message, the TCP module issues and generates a corresponding short connection session, and notifies the ARP module to initiate an ARP request corresponding to the source IP address of the SYN message;

the ARP module initiates an ARP request corresponding to the SYN message source IP, the opposite terminal equipment under SYN attack responds after receiving the request, and sends an ARP table entry after receiving the response, wherein the ageing time of the ARP table entry is t1 (the ageing time of the TCP short connection), and simultaneously responds to the TCP module.

And after receiving the response, the TCP module packages the ACK message response according to the ARP list item, if the terminal does not respond at the moment, the TCP short connection is aged after t1, and the TCP module notifies the ARP module to delete the corresponding ARP list item after the short connection is aged.

After receiving the response, the TCP module encapsulates the ACK message response according to the ARP list item, when the subsequent complete TCP three-way handshake is completed, the short connection is changed into the long connection, and after the long connection is completed, the TCP module notifies the ARP module to switch the list item type field of the corresponding ARP list item, and simultaneously refreshes the aging time from t1 to t2 (default aging time of dynamic ARP).

In one embodiment, the present disclosure provides an electronic device including a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor, the processor executing the machine-executable instructions to implement the foregoing attack prevention method, and from a hardware level, a hardware architecture diagram may be shown with reference to fig. 3.

In one embodiment, the present disclosure provides a machine-readable storage medium storing machine-executable instructions that, when invoked and executed by a processor, cause the processor to implement the foregoing method of combating attacks.

Here, a machine-readable storage medium may be any electronic, magnetic, optical, or other physical storage device that may contain or store information, such as executable instructions, data, or the like. For example, a machine-readable storage medium may be: RAM (Radom Access Memory, random access memory), volatile memory, non-volatile memory, flash memory, a storage drive (e.g., hard drive), a solid state drive, any type of storage disk (e.g., optical disk, dvd, etc.), or a similar storage medium, or a combination thereof.

The system, apparatus, module or unit set forth in the above embodiments may be implemented in particular by a computer chip or entity, or by a product having a certain function. A typical implementation device is a computer, which may be in the form of a personal computer, laptop computer, cellular telephone, camera phone, smart phone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or a combination of any of these devices.

For convenience of description, the above devices are described as being functionally divided into various units, respectively. Of course, the functions of the various elements may be implemented in the same one or more software and/or hardware when implementing the present disclosure.

It will be apparent to those skilled in the art that embodiments of the present disclosure may be provided as a method, system, or computer program product. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present disclosure may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present disclosure is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the disclosure. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

Moreover, these computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

It will be appreciated by those skilled in the art that embodiments of the present disclosure may be provided as a method, system, or computer program product. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-usable storage media (which may include, but are not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The foregoing is merely an embodiment of the present disclosure and is not intended to limit the present disclosure. Various modifications and variations of this disclosure will be apparent to those skilled in the art. Any modifications, equivalent substitutions, improvements, or the like, which are within the spirit and principles of the present disclosure, are intended to be included within the scope of the claims of the present disclosure.

Claims

1. An attack prevention method, applied to a network device, comprising:

receiving a TCP SYN message sent by opposite terminal equipment;

establishing an ARP (address resolution protocol) table entry according to the received TCP SYN message, and packaging and sending an ACK (acknowledgement) message response according to the ARP table entry;

and aging out ARP list items corresponding to the ACK message response which is not responded.

2. The method of claim 1, wherein the establishing an ARP entry according to the received TCP SYN message comprises:

generating a corresponding short connection session according to the received TCP SYN message, initiating an ARP request according to the source IP address of the TCP SYN message, and generating an ARP table entry according to the response of the corresponding ARP request.

3. The method of claim 1, wherein the ARP entry includes an entry type field, and the ACK message reply that is not responded is different from the value of the entry type field of the ARP entry to which the ACK message reply that is responded corresponds.

4. A method according to claim 3, wherein if a message is received in response to the ACK message reply, the entry type field of the corresponding ARP entry is updated.

5. An anti-attack apparatus for use with a network device, the apparatus comprising:

the receiving module is used for receiving the TCP SYN message sent by the opposite terminal equipment;

the processing module establishes an ARP table entry according to the received TCP SYN message, and encapsulates and sends an ACK message response according to the ARP table entry;

and the aging module is used for aging out ARP (address resolution protocol) list items corresponding to the ACK message response which is not responded.

6. The apparatus of claim 5, wherein the establishing an ARP entry from the received TCP SYN message comprises:

7. The apparatus of claim 5, wherein the ARP entry includes an entry type field, and the ACK message reply that is not responded to differs from the value of the entry type field of the ARP entry to which the ACK message reply that is responded to corresponds respectively.

8. The apparatus of claim 7 wherein the entry type field of the corresponding ARP entry is updated if a message is received in response to the ACK message reply.

9. An electronic device, comprising: a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor to perform the method of any one of claims 1-4.

10. A machine-readable storage medium storing machine-executable instructions which, when invoked and executed by a processor, cause the processor to implement the method of any one of claims 1-4.