TWI682644B - Dynamic protection method for network node and network protection server - Google Patents

Abstract

The disclosure provides a dynamic protection method for network node and network protection server. The method includes: creating a dynamic protection table, wherein the dynamic protection table includes a plurality of virtual target hosts and a plurality of numbers corresponding to the virtual target hosts; recording a first time point of creating the dynamic protection table, and generating an interval time; updating the correspondence relationships between the virtual target hosts and the foregoing numbers at a second time point to update the dynamic protection table, wherein the second time point is the sum of the first time point and the interval time; and receiving a network packet and adaptively directing the network packet to one of the aforementioned virtual target hosts according to the packet content of the network packet.

Description

Network node mobile protection method and network protection server

The invention relates to a network protection method and a network protection server, and in particular to a network node mobile protection method and a network protection server.

The current network environment tends to be static and fixed for the network configuration of the system service host itself, and the network configuration information will not be continuously changed after the configuration. After the intruder detects and collects data through, for example, a port scan attack, it can effectively target the weakness or vulnerability of the system service host.

In view of this, the present invention provides a mobile protection method of a network node and a network protection server, which can be used to solve the above technical problems.

The invention provides a mobile protection method for a network node, which includes: creating a mobile protection table, wherein the mobile protection table includes a plurality of virtual target hosts and a plurality of mobile protection numbers corresponding to the aforementioned virtual target hosts; record creation movements A first time point of the protection table, and an interval time is generated; at a second time point, the correspondence between the virtual target host and the mobile protection number is updated to update the mobile protection table, where the second time point is the first time The sum of points and intervals; and receiving a network packet, and adaptively guiding the network packet to one of the aforementioned virtual target hosts according to the packet content of the network packet.

The invention provides a network protection server, which includes a storage circuit and a processor. The storage circuit records multiple modules. The processor is coupled to the storage circuit and accesses the aforementioned module to perform the following steps: create a mobile protection table, wherein the mobile protection table includes multiple virtual target hosts and multiple mobile protection numbers corresponding to the virtual target hosts; records Create a first time point of the mobile protection table and generate an interval; update the correspondence between the virtual target host and the mobile protection number at a second time point to update the mobile protection table, where the second time point is the first The sum of a time point and the interval time; and receiving a network packet, and adaptively guiding the network packet to one of the virtual target hosts according to the packet content of the network packet.

Based on the above, the present invention can allow the target host to change and change over time, increase the complexity and cost of hacker attacks, and limit the chance of hackers discovering vulnerabilities, so as to achieve the protective effect of active defense.

In order to make the above-mentioned features and advantages of the present invention more obvious and understandable, the embodiments are specifically described below in conjunction with the accompanying drawings for detailed description as follows.

In summary, the present invention discloses a mobile protection method in which network nodes randomly change. During network communication between virtual hosts, software-defined network technology is used to monitor the virtual network, and the mobile protection table is used to change suspicious connections. The location of the network node and the host that the line wants to connect, and the network node in the mobile protection table will continue to change at random intervals to confuse and deceive suspicious users. When receiving a network packet, it will analyze the content of the packet based on the protected system service host and target host information to identify whether it is a suspicious connection for mobile protection processing. If the packet is judged to be a suspicious connection, the mobile protection connection rule will be sent to the cloud virtual switch based on the OpenFlow protocol according to the situation. The host, or directly discard the packet. If it is judged that the packet is not a suspicious connection, the packet can be normally connected to the system service host. In this way, suspicious users cannot obtain correct system service information, and must deal with a large number of uncertain factors, and the system is more difficult to explore and predict because of its dynamic nature, so as to achieve the purpose of the protection system.

Please refer to FIG. 1, which is a schematic diagram of a network protection server according to an embodiment of the present invention. In this embodiment, the network protection server 100 may be a server, a personal computer (PC), a notebook PC (notebook PC), a netbook PC (netbook PC), a tablet PC (tablet PC), Virtual machine (virtual machine), etc., but not limited to this.

As shown in FIG. 1, the network protection server 100 includes a storage circuit 102 and a processor 104. The storage circuit 102 is, for example, any type of fixed or removable random access memory (RAM), read-only memory (ROM), flash memory (Flash memory), hard disk Disk or other similar devices or a combination of these devices can be used to record multiple codes or modules.

The processor 104 is coupled to the storage circuit 102, and may be a general-purpose processor, a special-purpose processor, a conventional processor, a digital signal processor, a plurality of microprocessors, or one or more combined digital signal processing The core of the processor is the microprocessor, controller, microcontroller, application specific integrated circuit (ASIC), field programmable gate array (FPGA), any other kind of integrated circuit, State machine, processor based on Advanced Reduced Instruction Set Machine (Advanced RISC Machine, ARM) and similar products.

In the embodiment of the present invention, the processor 104 may load the program code or module recorded in the storage circuit 102 to execute the network node movement protection method proposed by the present invention, which will be further described below.

Please refer to FIG. 2, which is a flowchart of a network node mobility protection method according to an embodiment of the invention. The method of this embodiment may be executed by the network protection server of FIG. 1, and the details of each step of FIG. 2 will be described below with the components shown in FIG. 1.

In step S210, the processor 104 may create a mobile protection table. In this embodiment, the mobile protection table may include multiple virtual target hosts and multiple mobile protection numbers corresponding to the aforementioned virtual target hosts. For example, assuming that the number of virtual target hosts is n and the mobile protection number is 0~(n-1), the processor 104 can individually assign the mobile protection number 0~(n-1) to the virtual target host One of them, and each virtual target host corresponds to a different mobile protection number. In addition, the above mobile protection table may also include the target host number, network node and virtual network interface corresponding to each virtual target host, but it may not be limited to this.

In step S220, the processor 104 may record a first time point to create a mobile protective sheet (hereinafter referred to as T _pre), and generates a time interval (hereinafter, referred to as T _r). In different embodiments, the processor 104 may generate T _{r in} different ways according to requirements. For example, the processor 104 may randomly generate a value within a certain value range (for example, 30 minutes) as T _r , but it may not be limited thereto.

In step S230, the processor 104 may update the correspondence between the virtual target host and the mobile protection number at a second time point (hereinafter referred to as T _now ) to update the mobile protection table. In the present embodiment, T _now, for example, is the sum of T _r and T _pre. That is, after T _pre , the processor 104 may wait for the time of T _r and update the correspondence between the virtual target host and the mobile protection number.

In one embodiment, the processor 104 can update the mobile protection table by disrupting the correspondence between the virtual target host and the mobile protection number. For example, assume that the initially created mobile protection table includes the first, second, ..., and tenth virtual target hosts, and they correspond to mobile protection numbers 0 to 9 in sequence one-to-one. However, after the processor 104 performs the above update, the first virtual target host to the tenth virtual target host no longer correspond to the mobile protection numbers 0 to 9 in sequence one by one, but individually correspond to 0 to 9 One of them. For example, the first virtual target host corresponds to mobile protection number 2, the second virtual target host corresponds to mobile protection number 6, and so on. However, the above content is only used as an example, and is not intended to limit the possible embodiments of the present invention.

In an embodiment, the processor 104 may update the corresponding relationship between the virtual target host and the mobile protection number again at a third time point to update the mobile protection table again, wherein the third time point is separated from the second time point by another The interval time, and this other interval time may also be generated by the processor 104 (randomly). That is, the processor 104 may constantly update the mobile protection table by, for example, disrupting the correspondence between the virtual target host and the mobile protection number, but the present invention may not be limited to this.

In step S240, the processor 104 may receive the network packet, and adaptively guide the network packet to one of the aforementioned virtual target hosts according to the packet content of the network packet.

It can be seen from the above that through the mobile protection method proposed by the present invention, the target host can be continuously changed and changed over time, increasing the complexity and cost of hacker attacks, and limiting the opportunities for hackers to find vulnerabilities, to achieve active defense Protective effect.

In order to make the concept of the present invention clearer, the following is supplemented with FIG. 3 for further explanation. Please refer to FIG. 3, which is a flowchart illustrating adaptively guiding the network packet to one of the virtual target hosts according to the packet content of the network packet according to an embodiment of the invention. First, in step S301, the processor 104 can determine whether a security warning notification is received. If yes, step S302 is executed successively, otherwise, step S303 is executed.

In step S302, the processor 104 may record the IP address corresponding to the security warning notification to a suspicious IP database. In step S303, the processor 104 can receive the network packet, and parse the packet content of the network packet in step S304, wherein the packet content can include the destination IP, source IP, destination communication port of the network packet, etc. Limited to this.

In one embodiment, when a hacker initiates a communication port scanning attack in a cloud environment, the method of the present invention uses a software defined network (SDN) technology to centrally control the flow of network packets and parse the packets of these attack packets Content, but the invention may not be limited to this.

After step S304, the processor 104 can determine whether the above-mentioned suspicious IP database is null in step S305. If yes, step S310 is continued, otherwise, step S306 is continued.

In step S306, the processor 104 can determine whether the source IP has been recorded in the suspicious IP database. That is, the processor 104 can determine whether the source IP of the network packet previously caused a corresponding security warning notification. If so, it means that the network packet may be an attack packet and be regarded as a suspicious network packet, so the processor 104 can execute steps S307, S308, and S309 accordingly to direct the network packet to one of the target hosts.

In step S307, the processor 104 may perform a hash operation on the packet content of the network packet to generate a hash value. In step S308, the processor 104 may calculate the reference value based on the hash value. In an embodiment, the processor 104 may convert the hash value into decimal American Standard Code for Information Interchange (ASCII) digits, and add the aforementioned ASCII digits to a sum value . After that, the processor 104 may calculate a remainder of dividing the total value by n (ie, the number of virtual target hosts), and use the remainder as the reference value. In this case, the reference value will be an integer value between 0 and (n-1), that is, the reference value will correspond to one of the aforementioned mobile protection numbers. Next, in step S309, the network packet is directed to the specific target host of the aforementioned virtual target host, wherein the mobile protection number of the specific target host corresponds to the reference value.

For example, assuming that the calculated reference value is 3, the processor 104 may look up the mobile protection table to find the current virtual target host corresponding to the mobile protection number 3 as the specific target host. Then, the processor 104 can obtain the network node and virtual network interface of the specific target host from the mobile protection table, and form a mobile protection connection rule based on an OpenFlow protocol, and send the aforementioned mobile protection connection rule to the cloud virtual exchange Flow Table of the device, the cloud virtual switch can convert the original network packet flow according to the mobile protection connection rules in the flow table, so as to direct the network packet to the network node of the specific target host and Virtual network interface.

In short, when the processor 104 finds a suspicious network packet, it can control the flow of the suspicious network packet through the OpenFlow protocol, and then the virtual network interface of the suspicious network packet destination from the original system service host , Change to connect to the virtual target host corresponding to the reference value in the mobile protection table. In other words, the system service information detected by the hacker through the communication port scanning attack is provided by the forged virtual target host, so that the protected system service can be prevented from being detected after the vulnerability is targeted. Vulnerability attacks or Advanced Persistent Threat (APT) attacks.

In addition, as described in the previous embodiment, since the mobile protection table can be continuously updated, even if the processor 104 calculates the same reference value at different time points, suspicious network packets encountered at different time points may be Guide to different virtual target hosts.

In addition, in step S306, if the source IP is not recorded in the suspicious IP database, it means that the network packet may not be a suspicious network packet, so the processor 104 can perform step S310 to determine whether the destination IP of the network packet is protected IP. If yes, step S311 can be executed for further determination, otherwise, step S313 can be executed. In this embodiment, the method of the present invention can protect the system service host, so the protected system service host data will be stored at the beginning. In this case, the protected system service host IP can be regarded as the protected IP, and the communication port opened on the protected system service host is the protected communication port, but the invention may not be limited to this.

In step S311, the processor 104 can determine whether the destination communication port of the network packet belongs to the protected communication port. If so, it can be determined that the network packet should not be a suspicious network packet, so step S312 can be performed to direct the network packet to the protected system service host corresponding to the destination IP. In an embodiment, the processor 104 may form a normal connection rule based on an OpenFlow protocol and send the aforementioned normal connection rule to the flow table of the cloud virtual switch, then the cloud virtual switch may follow the normal connection in the flow table The rule is to send the network packet to the host (system service or other general) corresponding to the destination IP.

On the other hand, if the processor 104 determines in step S311 that the destination communication port of the network packet does not belong to the protected communication port, it means that the network packet is trying to connect to the unopened communication port, so it is regarded as a suspicious network packet. Therefore, the processor 104 may perform steps S307, S308, and S309 accordingly to guide the network packet to one of the target hosts.

In addition, in step S313, the processor 104 can determine whether the destination IP of the network packet belongs to any of the aforementioned virtual target hosts. If yes, the processor 104 can perform step S314 to block network packets; if not, the processor 104 can continue to perform step S315. Specifically, if the destination IP of the network packet belongs to any of the aforementioned virtual target hosts, it means that a hacker has previously scanned the attack action through the front-end communication port and was directed to connect to one of the virtual targets. Host and obtain its IP address. It can be seen that the current network packet is a new wave of cyber attacks launched by the hacker directly against the IP address of the virtual target host.

In other words, the processor 104 can know that the current network packet being processed is a highly suspicious network packet, so it can directly block and discard this network packet. In an embodiment, the processor 104 may form a mobile protection blocking rule based on the OpenFlow protocol and send the aforementioned mobile protection blocking rule to the flow direction table of the cloud virtual switch, then the cloud virtual switch may follow the mobile protection blocking rule in the flow direction table Discard this network packet in order to block the network packet.

On the other hand, in step S313, if the destination IP of the network packet does not belong to any of the aforementioned virtual target hosts, it means that the network packet is harmless traffic, so the network packet can be directed in step S315 Lead to the host corresponding to the destination IP to allow it to connect to the host corresponding to the destination IP. In different embodiments, this host may be an unprotected system service host, or other client host, and so on.

In summary, in the mobile protection method and network protection server provided by the present invention, SDN and OpenFlow technologies are used to centrally monitor and analyze virtual network packet content. When a suspicious network packet is found, the network node can be transformed to protect the security of the service system in the SDN environment.

The method provided by the invention can detect the scanning attack of the communication port, and identify the normal and suspicious network packets, so as to avoid the suspicious network packets from contacting the protected service system.

In addition, by creating multiple virtual target hosts, hackers can only obtain the information of the virtual target hosts, and cannot detect the real service system host data, thereby achieving the effect of protecting the service system hosts in the SDN environment.

Moreover, the method provided by the present invention will continuously update the mobile protection table, so that the virtual target host continuously changes and changes over time, increasing the complexity and cost of hacker attacks, and limiting the opportunities for hackers to discover vulnerabilities, To achieve the protective effect of active defense.

Although the present invention has been disclosed as above with examples, it is not intended to limit the present invention. Any person with ordinary knowledge in the technical field can make some changes and modifications without departing from the spirit and scope of the present invention. The scope of protection of the present invention shall be subject to the scope defined in the appended patent application.

100‧‧‧Network protection server 102‧‧‧Storage circuit 104‧‧‧ processor S210~S240, S301~S315

FIG. 1 is a schematic diagram of a network protection server according to an embodiment of the invention. FIG. 2 is a flowchart of a network node mobility protection method according to an embodiment of the invention. FIG. 3 is a flowchart illustrating adaptively guiding network packets to one of the aforementioned virtual target hosts according to the packet content of the network packets according to an embodiment of the invention.

S210~S240‧‧‧Step

Claims (11)

A mobile protection method for network nodes, including: Create a mobile protection table, where the mobile protection table includes multiple virtual target hosts and multiple mobile protection numbers corresponding to the virtual target hosts; Record a first time point for creating the mobile protection table and generate an interval time; Updating the correspondence between the virtual target hosts and the mobile protection numbers at a second time point to update the mobile protection table, where the second time point is the sum of the first time point and the interval time; and Receive a network packet, and adaptively direct the network packet to one of the virtual target hosts according to the packet content of the network packet. The method described in item 1 of the patent application scope further includes: In response to receiving a security alert notification, record a connection internet protocol (IP) address corresponding to the security alert notification to a suspicious IP database. The method as described in item 2 of the patent application scope, wherein the packet content of the network packet includes a source IP, and the network packet is adaptively guided to the virtual targets according to the packet content of the network packet One of the steps of the target host includes: In response to that the suspicious IP database is not empty, determine whether the source IP has been recorded in the suspicious IP database; In response to the source IP being recorded in the suspicious IP database, a hash operation is performed on the packet content of the network packet to generate a hash value; Calculating a reference value based on the hash value, where the reference value corresponds to one of the mobile protection numbers; The network packet is directed to a specific target host of the virtual target hosts, where the specific target host corresponds to the reference value. The method as described in item 3 of the patent application scope, wherein the number of the mobile protection numbers is n, and the step of calculating the reference value based on the hash value includes: Convert the hash value into a decimal number of American Standard Code for Information Interchange (ASCII) digits; Add these ASCII digits to a sum value; and Calculate the remainder by dividing the total value by n, and use the remainder as the reference value. The method as described in item 3 of the patent application scope, wherein the mobile protection table further includes a target host number, a network node and a virtual network interface corresponding to each virtual target host, and guides the network packet to The steps of the specific target host of the virtual target hosts include: Obtaining the network node and the virtual network interface of the specific target host from the mobile protection table; and Based on an OpenFlow protocol, a mobile protection connection rule is formed, and the aforementioned mobile protection connection rule is sent to the flow direction table of the cloud virtual switch, so that the cloud virtual switch converts the original mobile protection connection rule according to the mobile protection connection rule in the flow direction table The network packet flows to direct the network packet to the network node and the virtual network interface of the specific target host. The method according to item 2 of the patent application scope, wherein the packet content of the network packet includes a destination IP, and the network packet is adaptively guided to the virtual targets according to the packet content of the network packet One of the steps of the target host includes: In response to the suspicious IP database being empty, determine whether the destination IP of the network packet belongs to a protected IP; Reflect that the destination IP of the network packet does not belong to the protected IP, determine whether the destination IP of the network packet belongs to any of the virtual target hosts; and The destination IP reflected in the network packet belongs to any of the virtual target hosts, blocking the network packet. The method as described in item 6 of the patent application scope, wherein the content of the network packet further includes a destination communication port, and the destination IP reflected in the network packet belongs to the protected IP, the method further includes : Determine whether the destination communication port of the network packet belongs to a protected communication port; and In response to the destination communication port belonging to the protected communication port, the network packet is directed to a protected system service host corresponding to the destination IP. The method as described in item 7 of the patent application scope, in which the destination communication port does not belong to the protected communication port, the method further includes: Perform a hash operation on the packet content of the network packet to generate a hash value; Calculating a reference value based on the hash value, where the reference value corresponds to one of the mobile protection numbers; The network packet is directed to a specific target host of the virtual target hosts, where the specific target host corresponds to the reference value. The method as described in item 6 of the patent application scope, wherein the destination IP reflected in the network packet does not belong to any of the virtual target hosts, and the network packet is directed to a destination corresponding to the destination IP Host. The method described in item 1 of the patent application scope further includes: The correspondence between the virtual target hosts and the mobile protection numbers is updated again at a third time point to update the mobile protection table again, wherein the third time point is separated from the second time point by another interval. A network protection server, including: A storage circuit to record multiple modules; and A processor, coupled to the storage circuit, accesses the modules to perform the following steps: Create a mobile protection table, where the mobile protection table includes multiple virtual target hosts and multiple mobile protection numbers corresponding to the virtual target hosts; Record a first time point for creating the mobile protection table and generate an interval time; Updating the correspondence between the virtual target hosts and the mobile protection numbers at a second time point to update the mobile protection table, where the second time point is the sum of the first time point and the interval time; and Receive a network packet, and adaptively direct the network packet to one of the virtual target hosts according to the packet content of the network packet.

Images