TWI836279B - Network data packet processing device and network data packet processing method - Google Patents

Abstract

A network data packet processing device includes a processing unit, an operating system and an analysis unit. The processing unit is electrically connected to a network interface card. The operating system is configured to cooperate with the processing unit to control the network interface card in a promiscuous mode to receive a data packet from the Internet. The analysis unit is configured to obtain the data packet from the network interface, and to analysis a destination address in the data packet. The analysis unit also includes multiple honeypot units, and stores a plurality of honeypot addresses corresponding to the honeypot units. When the analysis unit determines that the destination address of the data packet corresponds to one of the honeypot addresses, the analysis unit is configured to selectively send a response message by one of the honeypot addresses or a preset address.

Description

Network packet processing device and network packet processing method

This disclosure relates to a network packet processing device and method, particularly a technology for receiving data packets through a network card and generating response messages.

With the development of science and technology, network communication technology is widely used in people's lives, and people's demand for network communication is also increasing. In contrast, the security of network communications is becoming increasingly important. How to effectively defend against network attacks has become an important issue in today's Internet technology.

The present disclosure relates to a network packet processing device, including a processing unit, an operating system and an analysis unit. The processing unit is electrically connected to a network interface card. The operating system is used to cooperate with the processing unit to control the network interface card to be in promiscuous mode to receive data packets from the Internet. The analysis unit is used to obtain data packets from the network interface card and to parse the destination address in the data packet. The analysis unit also includes a plurality of honeypot units and stores a plurality of corresponding honeypot addresses. When the analysis unit determines that the destination address of the data packet corresponds to one of the honeypot addresses, the analysis unit is used to selectively send a response message with one of the honeypot addresses or a default address.

This disclosure also relates to a network packet processing method, which includes the following steps: setting the network interface card in a promiscuous mode through a processing unit and an operating system to receive data packets from the Internet; and analyzing the data packets through an analysis unit The destination address of the data packet contains a plurality of honeypot units, and a plurality of honeypot addresses corresponding to the honeypot units are stored; the destination address of the data packet corresponds to one of the honeypot addresses. At one time, the data packet is sent to the honeypot unit corresponding to one of the honeypot addresses; and a response message is selectively sent to one of the honeypot addresses or a default address.

The present disclosure also relates to a network packet processing device, including a processing unit, an operating system and an analysis unit. The processing unit is electrically connected to the network interface card. The operating system cooperates with the processing unit to control the network interface card in promiscuous mode to receive data packets from the Internet. The analysis unit is used to receive data packets. The analysis unit also includes a plurality of honeypot units and is used to store a plurality of honeypot addresses corresponding to the honeypot units. When the analysis unit determines that the data packet corresponds to one of the honeypot addresses, the analysis unit The unit determines whether to send the response message at the default address based on the response setting condition of one of the honeypot addresses.

Since the network packet processing device drives the network interface card through the processing unit running the operating system, and then receives data packets to the analysis unit, the analysis unit does not need to install a corresponding operating system for each honeypot unit, which effectively improves the construction cost of the network packet processing device.

A plurality of embodiments of the present invention will be disclosed in the drawings below. For clarity of explanation, many practical details will be explained in the following description. However, it will be understood that these practical details should not limit the invention. That is to say, in some embodiments of the present invention, these practical details are not necessary. In addition, for the sake of simplifying the drawings, some commonly used structures and components will be illustrated in a simple schematic manner in the drawings.

In this document, when an element is referred to as "connected" or "coupled," it may mean "electrically connected" or "electrically coupled." "Connection" or "coupling" can also be used to indicate the coordinated operation or interaction between two or more components. In addition, although terms such as "first", "second", ... are used to describe different elements herein, the terms are only used to distinguish elements or operations described with the same technical terms. Unless the context clearly indicates otherwise, such terms do not specifically refer to or imply a sequence or order, nor are they intended to limit the invention.

FIG. 1 is a schematic diagram of a network packet processing device 100 according to some embodiments of the present disclosure. The network packet processing device 100 includes a processing unit 110, a network interface card 120, an operating system 130 and an analysis unit 140. The processing unit 110 is electrically connected to the network interface card 120 to cooperate with the operating system 130 and control the network interface card 120 to receive data from the Internet or transmit data to the Internet through the network interface card 120 .

The processing unit 110 is used to perform various operations, and may be implemented as a microcontroller, a microprocessor, a digital signal processor, or an application specific integrated circuit (ASIC). ), a central processing unit (CPU), a system on chip (SoC), or a processing chip or controller with specific functions.

In some embodiments, the operating system 130 is a data storage unit (not shown in the figure) installed in the network packet processing device 100 . The data storage unit is electrically connected to the processing unit 110 and can be implemented as a read-only memory, a flash memory, a hard disk, a pen drive, a database accessible from the network, or those familiar with the art can easily imagine that the data storage unit has the same Functional storage media.

The processing unit 110 is used to execute the operating system 130 to manage the hardware (processor, memory, network card, etc.) in the network packet processing device 100, determine the supply and demand of system resources, control the input and output devices and other basic matters. At the same time, the operating system 130 can also provide an operating interface for users to interact with the network packet processing device 100. In one embodiment, the architecture of the operating system 130 can include a hardware abstraction layer, a system service layer, a subsystem layer, etc. The system service layer provides a function call library of all unified specifications, and the subsystem layer is located above the system service layer and belongs to the user mode, which can prevent user programs from performing illegal actions.

In one embodiment, the analysis unit 140 may be a pre-constructed database analysis program. In other embodiments, the analysis unit 140 may be firmware, a computing chip or a circuit provided in the network packet processing device 100 . The analysis unit 140 may be stored in a data storage unit in the network packet processing device 100, may also be an application program installed in the operating system 130, or may be part of the operating system. In some other embodiments, the operating system 130 includes a system service layer, and the analysis unit 140 is configured/installed above the system service layer.

As shown in FIG. 1 , the analysis unit 140 includes an analysis module 141 and a plurality of honeypot units H1 to Hn, and a response table T is stored therein (e.g., stored in a memory). In one embodiment, the analysis module 141 is a pre-constructed operating program in the analysis unit 140 for analyzing received data, for example, analyzing the internal data and composition of a packet or frame. The response table T stores a plurality of honeypot addresses corresponding to the honeypot units H1 to Hn, and the honeypot units H1 to Hn can also be implemented by independent applications and independently connected to the analysis unit 140. In other words, the honeypot unit implemented by the application can be driven by other hardware devices, and is not limited to the analysis unit 140 in the network packet processing device 100. The honeypot address may include at least one of various parameters such as an Internet Protocol address (IP address), a media access control address (MAC address), a fully qualified domain name (FQDN), or a port code. In some embodiments, the response table T may include a first honeypot address T1 and a second honeypot address T2. The first honeypot address T1 may be an IP address, and the second honeypot address T2 may be a MAC address.

The network packet processing device 100 of the present disclosure is used to construct a "trapping system". A honeypot is a network host that is specially designed with security vulnerabilities but is closely monitored to attract intruders (attackers, hackers) to attack. During the attack process, the honeypot will record the attack behavior and data, and track and collect evidence from the intruder. Since people in this field can understand the construction method and operation principle of the honeypot, it will not be elaborated here.

A honeypot can be a physical device or a virtual device generated by software. In some technologies, whether it is a physical device or a virtual device, an operating system needs to be installed independently to make the intruder think that the honeypot is a real attack target (such as terminal devices, communication devices, robotic arms, etc.).

In this embodiment, the honeypot units H1-Hn also have logic modules and functional modules for recording and tracking attackers, but do not need to install independent operating systems. The processing unit 110 will uniformly send and receive data packets for the honeypot units H1-Hn through the operating system 130 and the network interface card 120, so the analysis unit 140 does not need to set up a complete operating system for each honeypot unit H1-Hn.

When the network packet processing device 100 receives a data packet from the Internet through the network interface card 120 and the operating system 130, the processing unit 110 transmits the data packet to the analysis unit 140. The analysis unit 140 obtains the data packet from the network interface card 120, and determines whether the data packet corresponds to any honeypot address in the response table T through the analysis module 141. Specifically, the analysis module 141 first parses out a destination address in the data packet, and then determines whether the destination address corresponds to any honeypot address. In one embodiment, the destination address refers to the source address of the second layer (data link layer) and the third layer (network layer) in the seven-layer architecture of OSI (open system interconnection), such as the aforementioned IP address and MAC address.

When the analysis module 141 determines that the destination address of the data packet corresponds to one of the honeypot addresses, if the analysis module 141 further determines that a response to the data packet is required, the analysis module 141 will selectively generate a response message based on the honeypot address or a preset address. The analysis module 141 will send the response message to the honeypot address or the preset location through the processing unit 110 and the network interface card 120. Accordingly, since the network packet processing device 100 drives the network interface card through the processing unit 110 to run the operating system and then receive the data packet to the analysis module 141, the analysis module 141 does not need to install a corresponding operating system for each honeypot unit H1~Hn, so as to effectively improve the construction cost of the network packet processing device 100.

FIG. 2 is a flow chart of a network packet processing method according to some embodiments of the present disclosure. In step S201, the processing unit 110 controls the network interface card 120 through the operating system 130 to set the network interface card 120 to a promiscuous mode. When the network interface card 120 is in the promiscuous mode, the network interface card 120 receives all data packets transmitted to the network packet processing device 100, even if the destination address of the data packet is not the network packet processing device 100.

In step S202, the processing unit 110 transmits the received data packet to the analysis unit 140 through the network interface card 120. The analysis unit 140 determines whether the data packet corresponds to any one of the plurality of honeypot addresses, or whether it corresponds to any one of the plurality of honeypot units.

If the data packet does not correspond to any honeypot address, in step S203, the analysis module 141 of the analysis unit 140 determines whether a reply is required. If the analysis module 141 determines that a reply is required, the analysis module 141 will generate an error message, and the processing unit 110 will return the error message to the Internet.

In some embodiments, when a data packet does not correspond to any honeypot address or the format of the data packet is incorrect, the analysis unit 140 may use a set of virtual addresses to send an error message. This method can be responded to by a physical driver in the operating system to ensure resource utilization efficiency.

In step S204, if the data packet does correspond to one of the honeypot addresses, the analysis module 141 transmits the data packet to the honeypot unit corresponding to the honeypot address. For example, if the target address in the data packet is "Add1a", which corresponds to the first honeypot address T1 of the honeypot unit H1 in the response table T, the analysis module 141 transmits the data packet to the honeypot unit H1. In step S205, the honeypot unit H1 that receives the data packet will generate a corresponding response message according to the type and/or content of the data packet, and return the response message to the analysis module 141.

In step S206, the analysis module 141 determines whether to send the response message according to the preset address, or determines whether the honeypot unit H1 has specified an address to be used when responding to the message. The "default address" is used to simulate a firewall. When the network packet processing device 100 returns a response message at the default address, the intruder will think that the honeypot unit is behind a firewall when receiving the response message. , so the message is responded to by the firewall's address.

If the analysis module 141 determines that the response message should be sent at the default address, or the honeypot unit does not specify the address to be used for the response message, in step S207, the analysis module will send the response message at the default address through the processing unit 110, the operating system 130 and the network interface card 120.

If the analysis module 141 determines that it is not necessary to send a response message according to the default address, or the honeypot unit has specified that a response message should be sent at a specific address (i.e., the corresponding honeypot address), then in step S208, the analysis module sends a response message at the corresponding honeypot address in the response table through the processing unit 110, the operating system 130, and the network interface card 120. In other words, the analysis module 141 selectively sends a response message at the honeypot address or the default address.

In one embodiment, multiple response setting conditions can be stored in the response table T, and each response setting condition corresponds to one honeypot unit H1-Hn respectively. Each response setting condition sets the way the corresponding honeypot unit H1~Hn should respond when receiving a data packet. In other words, the analysis module 141 can confirm the judgment result of the aforementioned step S206 based on the response setting conditions in the response table T. The response setting conditions are generated based on the device type simulated by each honeypot unit H1~Hn. For example: if the honeypot unit H1~Hn simulates a robot arm on a production line, and the management network of the robot arm is usually protected by a firewall , then the response setting conditions of the honeypot units H1~Hn will be "When the honeypot units H1~Hn simulate the robot arm behind the firewall, respond with the default address" to ensure that the response message can mislead the intruder. Successfully compromised a device behind a firewall.

In one embodiment, the network packet processing device 100 of the present disclosure installs the analysis unit 140 in the operating system and sets the honeypot unit in a software simulation manner. Accordingly, when the virtual honeypot unit needs to respond to a message, the operating system 130 can respond uniformly through the physical driver, which has better resource utilization.

The components, method steps or technical features in the foregoing embodiments can be combined with each other and are not limited to the order of text description or the order of presentation of the figures in this disclosure.

Although the content of this disclosure has been disclosed in the above embodiments, it is not intended to limit the content of this disclosure. Anyone familiar with this art can make various changes and modifications without departing from the spirit and scope of this disclosure. Therefore, this disclosure The scope of protection of the content shall be determined by the scope of the patent application attached.

100: Network packet processing device 110: Processing unit 120: Network interface card 130: Operating system 140: Analysis unit 141: Analysis module T: Response table T1: First honeypot address T2: Second honeypot address H1-Hn: Honeypot unit S201-S208: Steps

Figure 1 is a schematic diagram of a network packet processing device according to some embodiments of the present disclosure. Figure 2 is a flow chart of a network packet processing method according to some embodiments of the present disclosure.

Domestic storage information (please note in the order of storage institution, date, and number) None Foreign storage information (please note in the order of storage country, institution, date, and number) None

S201-S208: Steps

Claims (17)

A network packet processing device includes: a processing unit electrically connected to a network interface card; an operating system for cooperating with the processing unit to control the network interface card to be in a promiscuous mode to receive a data packet from the Internet; and an analysis unit for obtaining the data packet from the network interface card and for parsing a destination address in the data packet, wherein the analysis unit further includes a plurality of honeypot units and stores a plurality of corresponding honeypot addresses. When the analysis unit determines the destination address of the data packet, When corresponding to one of the honeypot addresses, the analysis unit is used to selectively send a response message using one of the honeypot addresses or a default address, wherein the default address is used to simulate a firewall, and when the analysis unit chooses not to send the response message according to the default address, the analysis unit is used to send the response message according to one of the honeypot addresses; wherein the analysis unit is installed in the operating system, and the processing unit receives the data packets for the honeypot units through the operating system and the network interface card. The network packet processing device as described in claim 1, wherein the analysis unit further includes a response table storing the honeypot addresses, and the analysis unit determines to use these honeypot addresses based on a response setting condition in the response table. Send the response message to one of the honeypot addresses or the default address. The network packet processing device as described in claim 1, wherein The analysis unit is installed on the operating system. A network packet processing device as described in claim 1, wherein the operating system includes a system service layer, and the analysis unit is disposed at an upper layer of the system service layer. A network packet processing device as described in claim 1, wherein one of the honeypot addresses includes at least one of an Internet Protocol address, a media access control address, or a port code. The network packet processing device as described in claim 1, wherein when the analysis unit determines that the destination address of the data packet does not correspond to one of the honeypot addresses, the analysis unit generates an error message. A network packet processing method includes: setting a network interface card in a promiscuous mode through a processing unit and an operating system to receive a data packet from the Internet; analyzing the data packet through an analysis unit a destination address, wherein the analysis unit includes a response table and stores a plurality of honeypot addresses corresponding to a plurality of honeypot units; the destination address of the data packet corresponds to the honeypot addresses When one of them occurs, based on a response setting condition stored in the analysis unit, it is determined whether to send a response message using one of the honeypot addresses or a default address, where the default address is used to simulate a firewall; and When the analysis unit determines that the response message is not to be sent according to the preset address, the analysis unit is used to send the response message according to one of the honeypot addresses. The network packet processing method as described in claim 7, wherein the analysis unit is installed in the operating system. The network packet processing method as described in claim 7, wherein the operating system includes a system service layer, and the analysis unit is disposed at an upper layer of the system service layer. The network packet processing method of claim 7, wherein one of the honeypot addresses includes at least one of an Internet Protocol address, a media access control address, or a transport port code. The network packet processing method described in claim 7 further includes: generating an error message when the destination address of the data packet does not correspond to one of the honeypot addresses. A network packet processing device includes: a processing unit electrically connected to a network interface card; an operating system for cooperating with the processing unit to control the network interface card to be in a promiscuous mode to receive a data packet from the Internet; and an analysis unit for receiving the data packet, wherein the analysis unit further includes a plurality of honeypot units and is used to store a plurality of honeypot addresses corresponding to the honeypot units. When corresponding to one of the honeypot addresses, the analysis unit determines whether to send a response message with a preset address according to a response setting condition of one of the honeypot addresses, wherein when the analysis unit sends the response message according to the preset address, the preset address is used to simulate a firewall, and when the analysis unit determines not to send the response message according to the preset address, the analysis unit is used to send the response message according to one of the honeypot addresses. The network packet processing device of claim 12, wherein the analysis unit is used to determine whether a packet address of the data packet corresponds to the honeypot addresses, and to determine whether the data packet corresponds to the honeypot addresses. One of the addresses. A network packet processing device as described in claim 12, wherein the analysis unit is installed in the operating system. A network packet processing device as described in claim 12, wherein the operating system includes a system service layer, and the analysis unit is disposed at an upper layer of the system service layer. A network packet processing device as described in claim 12, wherein one of the honeypot addresses includes at least one of an Internet Protocol address, a media access control address, or a port code. A network packet processing device as described in claim 12, wherein when the analysis unit determines that the data packet does not correspond to one of the honeypot addresses, the analysis unit generates an error message.

Images