WO2008141584A1 - Message processing method, system, and equipment - Google Patents

Message processing method, system, and equipment Download PDF

Info

Publication number
WO2008141584A1
WO2008141584A1 PCT/CN2008/071043 CN2008071043W WO2008141584A1 WO 2008141584 A1 WO2008141584 A1 WO 2008141584A1 CN 2008071043 W CN2008071043 W CN 2008071043W WO 2008141584 A1 WO2008141584 A1 WO 2008141584A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
binding
packet
user terminal
entry
Prior art date
Application number
PCT/CN2008/071043
Other languages
English (en)
French (fr)
Inventor
Xuefei Tan
Original Assignee
Huawei Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co., Ltd. filed Critical Huawei Technologies Co., Ltd.
Publication of WO2008141584A1 publication Critical patent/WO2008141584A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H04L61/5014—Internet protocol [IP] addresses using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]

Definitions

  • the present invention relates to the field of network communication technologies, and in particular, to a packet processing method, system, and device. Background technique
  • DHCP Dynamic Host Configuration Protocol
  • DHCP encounters many security problems during the application process.
  • the main methods for attackers to use DHCP are: DoS (Denial of Service) attacks, DHCP server spoofing attacks, and man-in-the-middle attacks and IP/MAC (Media Access Control) , media access control) spoofing attacks, etc.
  • DoS Delivery of Service
  • DHCP server spoofing attacks and man-in-the-middle attacks and IP/MAC (Media Access Control) , media access control) spoofing attacks, etc.
  • the man-in-the-middle attack and the IP/MAC spoofing attack mainly cause the attacker to send a false message with the spoofing information to the victim, so that the victim learns the spoofing information, and forwards the message according to the spoofing information, thereby making The victim could not receive or send the message normally.
  • the DHCP snooping protocol stack is configured to enable DHCP snooping (Dynamic Host Configuration Protocol Snooping).
  • the DHCP snooping protocol stack monitors DHCP packets to establish IP, MAC, and port ports.
  • the virtual local area network (VLAN) binding table is used to check the ARP (Address Resolution Protocol) and the IP address in the binding table to resolve the above spoofing attack. safe question.
  • FIG. 1 is a schematic diagram of a DHCP snooping solution for spoofing attack security in the prior art.
  • the Snooping function for example, a normal user terminal, such as user terminal B, or other user terminal that may have an attack behavior, such as user terminal C, must first apply for the first IP address through DHCP.
  • the gateway switch listens to all DHCP messages in the application process, and analyzes the DHCP snooping binding table shown in Figure 1 by analyzing the incoming DHCP messages.
  • the gateway switch discards the packet.
  • the spoofed ARP packet cannot reach any other user.
  • the terminal including the user terminal B, thereby suppressing the attack behavior of the user terminal C.
  • DHCP Snooping is used to solve an attacker's attack. Since there is no record of the attacker's behavior, it cannot be effectively tracked. The specific behavior and information of the attacker, which leads to the location and elimination of faults is very difficult. Summary of the invention
  • the embodiments of the present invention provide a packet processing method, system, and device, which are used to solve the problem that the attacker's behavior is not tracked and the fault location is difficult to be solved when the DHCP snooping is used to solve the packet attack security problem in the prior art.
  • the embodiment of the present invention provides a packet processing method, including: receiving a packet sent by a user terminal, where the packet carries the identifier information;
  • the identifier information is stored in the blacklist binding entry when the number is missed.
  • the embodiment of the invention further provides a message processing system, including:
  • a user terminal configured to send a packet to the network device, where the packet carries the identifier information;
  • the network device is configured to determine whether the packet is a normal binding entry, and when the packet is missed, the identifier information is stored in the blacklist binding entry.
  • the embodiment of the invention further provides a network device, including:
  • a message judging unit configured to determine whether the received packet hits a normal binding entry
  • an information storage unit configured to: when the packet does not match the normal binding entry, identify the packet Information is stored.
  • the embodiment of the present invention adds a blacklist binding entry, which can effectively track the specific behavior and information of the attacker, and facilitates fault location and elimination.
  • FIG. 1 is a schematic diagram of a DHCP snooping solution for spoofing attack security in the prior art
  • FIG. 2 is a flowchart of a packet processing method according to Embodiment 1 of the present invention.
  • FIG. 3 is a flowchart of a packet processing method according to Embodiment 2 of the present invention.
  • FIG. 4 is a schematic diagram of abnormal loss of binding table information according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of setting a blacklist binding entry according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of re-establishing a binding entry in the embodiment of the present invention.
  • FIG. 7 is a flowchart of a packet processing method according to Embodiment 3 of the present invention.
  • FIG. 8 is a schematic diagram of a message processing system according to an embodiment of the present invention. detailed description
  • the embodiment of the invention provides a packet processing method.
  • the binding table in the prior art only includes the KEY, such as the source MAC, the source IP, the PORT, and the VLAN as shown in FIG. 1.
  • the embodiment of the present invention adds two on the basis of maintaining the KEY of the prior art. Fields, one of which is used to indicate the type of the binding entry. One is a normal DHCP snooping binding entry, and the other is an abnormal DHCP snooping binding entry.
  • a binding entry created by extracting related information from the packet also called a blacklist binding entry; another field is used to indicate that the blacklist binding entry is hit. Frequency.
  • the information of the user terminal 100 is counted in the blacklist binding entry to effectively monitor the behavior and information of the attacker.
  • the embodiment of the present invention uses a field to identify the normal binding entry and the blacklist binding entry in the same binding table.
  • a flowchart of a packet processing method according to Embodiment 1 of the present invention, as shown in FIG. 2, includes the following steps:
  • Step S201 The network device 200 receives the packet sent by the user terminal 100, where the packet carries the identifier information.
  • the packet includes the normal Internet packet of the user terminal 100.
  • the attack packet sent by the attacker may also exist.
  • Step S202 The network device 200 determines, according to the identifier information, whether to hit the normal binding entry.
  • the packet received by the network device 200 includes the normal Internet access message of the user terminal 100. However, the attack packet sent by the attacker may also exist. The network device 200 needs to identify the received message.
  • the DHCP snooping function is enabled on the ingress port of the network device 200. Therefore, the network device 200 needs to analyze and determine all the received packets, and parse the identifier information of the received packet, and the identifier information includes : source MAC address, source IP address, PORT, and VLAN, and then source MAC address, source IP address, PORT, and VLAN with the source MAC address, source IP address, PORT, and VLAN in the normal binding entry of network device 200. Information is matched. That is, the network device 200 searches for the information corresponding to the normal binding entry according to the identification information of the received packet. If the corresponding information is found, the information is successfully matched. If the corresponding information is not found, the information matches. unsuccessful.
  • the normal binding entry is called. If the information is not matched successfully, the normal binding entry is not hit.
  • the source MAC address, the source IP address, the PORT, and the VLAN in the packet identification information are matched.
  • the identification information used for matching may also be in the source MAC according to specific needs. Any combination between address, source IP address, PORT, and VLAN.
  • Step S203 when the miss occurs, the network device 200 stores the identification information in the black.
  • the list is bound to the entry.
  • the network device 200 When the packet received by the network device 200 does not match the normal binding entry, the network device 200 extracts the source MAC address, the source IP address, the PORT, and the VLAN information from the packet that does not hit the normal binding entry, and the The source MAC address, source IP address, PORT, and VLAN information are stored in the corresponding entries in the blacklist binding entry. And the network device 200 records the receiving time and the number of hits of the packet that does not hit the normal binding entry, calculates the sending frequency of the abnormal packet by the received time and the number of hits, and stores the calculated sending frequency in the The field used to store frequency information in the blacklist binding entry.
  • the foregoing embodiment of the present invention adds a blacklist binding entry type to the existing binding table, and is used to store information about a packet that does not hit the normal binding entry, and hits the blacklist by using the packet.
  • the frequency of the binding entries is counted, so that the attacker's attack behavior and information can be effectively tracked and monitored.
  • the normal packet sent by the user terminal 100 cannot be hit by the network device 200, for example, the abnormal binding of the normal binding entry information in the network device 200 is lost.
  • the abnormal loss of the normal binding entries of the network device 200 including:
  • the network device 200 enabled with the DHCP snooping function is restarted, and some data loss occurs during the recovery process of the original normal binding entries.
  • the data in the normal binding entries caused by the DHCP snooping-enabled network device 200 is lost due to internal communication.
  • the user terminal 100 that has obtained the IP address through the DHCP device before the device is enabled will have no DHCP binding entry in the network device 200.
  • the binding table data for the user terminal 100 is abnormally lost.
  • DHCP snooping is used to monitor packets. Once the user terminal 100 successfully applies for an IP address through DHCP, whether it can access the Internet is completely determined. Whether the information about the packet of the user terminal 100 matches one of the normal binding entries of the network device 200. If the information does not match, the user terminal 100 will be discarded, and the user terminal 100 will not be able to access the Internet. If the user terminal 100 needs to continue to access the Internet due to the abnormal loss of the normal binding entries, if the user terminal 100 needs to continue to access the Internet, the user terminal 100 can manually trigger the IP address application through DHCP again, or the current The IP address of the application expires before going online.
  • Manually triggering the user terminal 100 to re-apply an IP address through DHCP means that the user terminal 100 releases the existing IP address, and then resends the IP address request request to the network device 200; by resending the IP address request, the user terminal 100 reacquires The new IP address, at the same time, establishes new binding table information on the network device 200.
  • Manually triggering the user terminal 100 to re-apply for an IP address the user terminal 100 is required to first detect that the Internet access is not available. However, in actual applications, the user terminal 100 cannot access the Internet normally until the user terminal 100 senses that the Internet access time cannot be normal. It is relatively long, and thus it may cause the user terminal 100 to be disconnected from the Internet for a long time.
  • the user terminal 100 After the IP address of the current application expires and then accesses the Internet, the user terminal 100 detects that the IP address expires after the user terminal 100 expires, and then automatically sends an IP address request to the network device 200; After the IP address application is sent, the user terminal 100 reacquires the new IP address and establishes new binding table information on the network device 200. After the IP address of the current application expires and then accesses the Internet, it is apparent that the user terminal 100 is required to wait for a long time, which may cause the user terminal 100 to interrupt the Internet for a long time.
  • a flowchart of a packet processing method according to Embodiment 2 of the present invention includes the following steps:
  • Step S301 The network device 200 receives the packet sent by the user terminal 100 and cannot hit the normal binding entry.
  • the transmitted message includes two types: one is a data packet that the user terminal 100 normally accesses, such as an IP packet or ARP message, etc.; the other is because the IP lease period is approaching, the lease renewal request message sent by the user terminal 100.
  • the network device 200 extracts the source MAC address, the source IP address, the PORT, and the VLAN information from the received message, and then the source MAC address, the source IP address, the PORT, and the VLAN.
  • the PORT and the VLAN information are matched, and the matching fails. That is, the packet sent by the user terminal 100 does not hit the normal binding entry of the network device 200.
  • the gateway switch After receiving the packet, the gateway switch extracts the source MAC address information and the source IP address information, and adds the port information of the gateway switch, that is, the port number and VLAN information of the gateway switch, to find the corresponding information in the binding table. .
  • the binding table information of the corresponding user terminal 100B in the gateway switch is lost, the corresponding information in the binding table cannot be found, and the binding table cannot be hit.
  • the network device 200 stores the packet identification information of the normal binding entry in the blacklist binding entry.
  • Source IP address, PORT, and VLAN information and store the source MAC address, source IP address, PORT, and VLAN information in the blacklist binding entry.
  • the network device 200 records the receiving time and the number of hits of the packet that does not hit the normal binding entry in the blacklist binding entry, and calculates the missed normal binding entry by using the received time and the number of hits.
  • the frequency of the packet is sent, and the calculated transmission frequency is stored in the field used to store the frequency information in the blacklist binding entry.
  • step S301 the message sent by the user terminal 100B is incapable of being killed.
  • the binding table of the gateway switch so the message is determined by the gateway switch to be an abnormal message.
  • the gateway switch will correspond to the storage entry in the binding table, and extract the source IP address and source from the packet.
  • the information such as the MAC address information, port number, and VLAN is stored in the corresponding entry in the binding table.
  • the gateway switch also records the receiving time and the current number of hits of the packet, and calculates the sending frequency of the packet that does not hit the normal binding entry by recording the received time and the number of hits, and stores the calculated sending frequency in black.
  • Y represents the binding table of the segment as a normal binding entry
  • N represents the binding table of the segment as a blacklist binding entry
  • a RATE field is established in the binding table, and the normal binding is calculated.
  • the message transmission frequency of the entry is stored in the RATE field.
  • Step S303 the network device 200 sends the IP address unavailable information to the user terminal 100.
  • the network device 200 transmits an IP address unavailable information to the user terminal 100 to inform the user terminal that the current IP address is no longer available.
  • the user terminal 100 After receiving the IP address unavailability information sent by the network device 200, the user terminal 100 knows that the current IP address is no longer available, and the user terminal 100 can no longer access the Internet if the current IP address is used again. If the user terminal 100 needs to continue to access the Internet, the network device 200 may resend the IP address request request and re-apply for a new IP address.
  • the gateway switch redirects the packet that does not hit the normal binding entry to the DHCP snooping function module, and the DHCP snooping function module sends a DHCPNAK packet to the user terminal 100B, and the fake DHCP server notifies the user.
  • Terminal 100B has its IP address not available.
  • the DHCPNAK is a message sent by the DHCP server to the user terminal 100 to tell the user terminal 100 that its IP address is incorrect or that the lease period expires. If the user terminal 100B receives the DHCPNAK message, it will no longer use the original IP address and restart the DHCP configuration process to re-apply for a new IP address.
  • Step S304 After receiving the IP address unavailability information, the user terminal 100 resends the IP address request request to the network device 200.
  • the user terminal 100 After receiving the IP address unavailability information sent by the network device 200, the user terminal 100 knows that the current IP address can no longer be used, and the user terminal 100 can no longer access the Internet if the current IP address is used again. If the user terminal 100 needs to continue to access the Internet, the network device 200 may resend the IP address request request and re-apply for a new IP address. The network device 200 re-establishes the binding table for the user terminal 100 by listening to the DHCP message sent by the user terminal 100 according to the normal DHCP snooping process. After the application for the IP address succeeds, the user terminal 100 can access the Internet as usual.
  • step S303 after receiving the DHCPNAK message sent by the gateway switch, the user terminal 100B knows that the current IP address is no longer available, and then according to the DHCP process, the user terminal 100B re-initiates the first IP address application to the gateway switch. request.
  • the gateway switch re-establishes the binding entry for the user terminal 100B by monitoring the DHCP message sent by the user terminal 100B according to the normal DHCP snooping process.
  • FIG. 6 is a re-establishment binding table according to an embodiment of the present invention.
  • the binding entry of the re-established binding entry includes the source IP address, the source MAC address, the port number, the VLAN, and the BLK.
  • the binding entry re-established by the user terminal 100B on the gateway switch belongs to the normal binding table.
  • the value of the BLK identifier in the binding entry is Y, and the RATE entry is used to record the frequency information of the packets that do not match the normal binding entry. Therefore, the re-established binding entry does not exist. Information, the RATE information can also be considered empty. After the user terminal 100B successfully applies for a new IP address, the user terminal 100B can access the Internet as usual.
  • the IP address unavailability information is actively sent to the user terminal 100, so that the network access abnormality may be triggered due to the network abnormality.
  • the user terminal 100 re-initiates the IP address application process, and can quickly restore the Internet access function, thereby greatly improving the network service quality.
  • the attacker sends a packet to the network device 200 that is unable to pass the DHCP snooping authentication.
  • the network device 200 according to the process of the second embodiment of the present invention, because the packet cannot be matched with the normal binding entry.
  • the IP address unavailability information is frequently sent to the user terminal 100, thereby increasing the processing workload of the network device 200. Reduce system performance.
  • the third embodiment of the present invention improves the foregoing embodiment, and sets a threshold in the network device 200 to compare the packet sending frequency in the blacklist binding entry with the threshold. When the sending frequency is greater than the threshold, the network device 200 stops sending the IP address unavailable information to the user terminal 100 that sends the text.
  • the above threshold may be set in advance on the network device 200, or may be modified and reset according to the specific situation in the actual application.
  • FIG. 7 it is a flowchart of a packet processing method according to Embodiment 3 of the present invention, which specifically includes the following steps:
  • Step S701 The network device 200 receives the packet sent by the user terminal 100 and cannot hit the normal binding entry.
  • the specific implementation process of this step is the same as the foregoing, and will not be described here.
  • Step S702 The network device 200 stores the packet identification information that does not hit the normal binding entry in the blacklist binding entry.
  • the specific implementation process of this step is the same as the foregoing, and will not be described here.
  • Step S703 The network device 200 determines, according to the frequency information in the blacklist binding entry, whether to send the IP address unavailable information to the user terminal 100.
  • the frequency information is calculated by the network device 200 according to the sending time and the number of hits of the recorded message.
  • the network device 200 records the sending time and hit of the packet. The number of times, and then the frequency information of the message is calculated according to the recorded transmission time and the number of hits.
  • the network device 200 compares the frequency with the set threshold. If the frequency is less than the threshold, the network device 200 sends the IP address unavailability information to the user terminal 100; if the frequency is greater than the threshold, the network device 200 stops The user terminal 100 transmits an IP address unavailable information.
  • the network device 200 determines that the packet whose transmission frequency is greater than the threshold is an attack packet, and the network device 200 directly discards the attack packet, and does not perform any further processing.
  • the packet whose transmission frequency is greater than the set threshold is determined as the attack message, and the sending of the IP address unavailability information to the user terminal 100 that sends the attack message is stopped, which can effectively avoid the attacker frequently. attack.
  • An embodiment of the present invention further provides a message processing system, as shown in FIG. 8, including: User terminal 100 and network device 200.
  • the user terminal 100 is configured to send a message to the network device 200.
  • the network device 200 is configured to store the packet identifier information of the received packet in the blacklist binding entry.
  • the network device 200 includes: a message determination unit 210 and an information storage unit 220.
  • the text judging unit 210 is configured to obtain the identifier information carried by the received e-mail, and use the identifier information as a key to search for a binding table, and determine whether the received packet hits a normal binding entry.
  • the message judging unit 210 searches for the information corresponding to the normal binding entry according to the identifier information of the received packet. If the corresponding information is found, the information is successfully matched. If the corresponding information is not found, the information matching is unsuccessful. . If the information is successfully matched, the normal binding entry is hit. If the information is not matched successfully, the normal binding entry is not hit.
  • the information storage unit 220 is configured to store, in the blacklist binding entry in the binding table, packet identification information that does not hit the normal binding entry.
  • the network device 200 extracts relevant information from the message that does not hit the normal binding entry, and stores the information in the corresponding entry of the information storage unit 220.
  • the information storage unit 220 includes: an identification information storage subunit 221, a recording subunit
  • the identifier information storage sub-unit 221 is configured to store identifier information of the packet that does not hit the binding table.
  • the recording sub-unit 222, the connection identifier information storage sub-unit 221, is configured to record the receiving time and the number of hits of the packet that does not hit the binding table.
  • the frequency calculation sub-unit 223, the connection record sub-unit 222 is configured to calculate the transmission frequency of the miss-binding table message according to the receiving time and the number of hits of the recorded message in the recording sub-unit 222.
  • Another embodiment of the present invention adds an information transmitting unit 230 and a frequency comparing unit 240 to the network device 200.
  • the information sending unit 230 is connected to the information storage unit 220 for transmitting IP address unavailability information to the user terminal 100.
  • the frequency comparison unit 240, the connection information storage unit 220 is configured to compare the transmission frequency of the missed binding table message in the information storage unit 220 with the set threshold, or whether to send the IP address unavailable information to the user terminal 100.
  • the notification information transmitting unit 230 sends an IP address unavailability letter to the user terminal 100 when the transmission frequency of the message is less than the set threshold.
  • the embodiment of the present invention adds a blacklist binding entry type, which can effectively track the specific behavior and information of the attacker, understand the attacker's attack frequency, and the main attack object.
  • the packet of the user terminal 100 fails to hit the binding table, and the user terminal 100 cannot access the Internet normally, the user terminal 100 can be triggered to re-initiate the address application process, and the Internet access function can be quickly restored. , greatly improved the quality of network services.
  • the network device 200 in the embodiment of the present invention includes a network device 200 having a packet processing capability, such as a switch and a router. And corresponding software in the embodiment of the present invention may be stored in a computer readable storage medium.

Description

报文处理方法、 系统和设备 技术领域
本发明涉及网络通信技术领域， 尤其涉及一种报文处理方法、 系 统和设备。 背景技术
随着网络规模的扩大和网络复杂度的提高， 网络配置越来越复 杂， 经常出现计算机位置变化和计算机数量超过可分配 IP ( Internet Protocol , 因特网协议） 地址的情况， 现有技术通常釆用 DHCP ( Dynamic Host Configuration Protocol , 动态主机西己置协议 ) , 来解决 IP地址动态分配的问题， DHCP具有对重新使用的网络地址进行自动 分配和附加配置选项的功能。
DHCP 在应用过程中遇到很多安全方面的问题， 攻击者利用 DHCP进行攻击的主要手段包括： DoS ( Denial of Service,拒绝服务） 攻击、 DHCP Server 仿冒攻击以及中间人攻击和 IP/MAC ( Media Access Control, 媒体接入控制）欺骗攻击等。 其中， 中间人攻击和 IP/MAC欺骗攻击主要是由攻击者向受害者发送带有欺骗信息的虚假 报文， 让受害者学习到该欺骗信息， 并根据该欺骗信息进行报文的转 发， 从而使得受害者无法正常接收或发送报文。
现有技术通常釆用在接入用户终端的网络设备处使能 DHCP Snooping ( Dynamic Host Configuration Protocol Snooping, 动态主机 配置协议监听） 功能， DHCP Snooping协议栈通过监听 DHCP报文， 建立 IP、 MAC, 端口和 VLAN ( Virtual Local Area Network, 虚拟局 域网）绑定表；在转发报文时，利用绑定表对 ARP( Address Resolution Protocol, 地址解析协议） 文、 IP ^艮文进行检查， 解决上述的欺骗 攻击安全问题。
图 1是现有技术中釆用 DHCP Snooping解决欺骗攻击安全问题 的示意图。如图 1所示，在接入用户终端的网关交换机上，使能 DHCP Snooping功能， 则无论是正常用户终端， 如用户终端 B, 还是其 它可能有攻击行为的用户终端， 如用户终端 C, 首先必须通过 DHCP 进行首次 IP地址申请。 网关交换机监听申请过程中的所有 DHCP报 文， 通过分析往来的 DHCP 4艮文， 建立图 1所示的 DHCP Snooping 绑定表。 那么， 当攻击者发起欺骗攻击时， 如用户终端 C发起一个免 费 ARP报文给 B欺骗用户终端 B说， IP地址为 10.1.1.1网关路由器 的 MAC为 C, 那么在网关交换机处将对此 ARP报文进行检测， 该 ARP报文携带的信息，包括其源 MAC地址，源 IP地址以及入接口信 息， 如图 1所示， MAC地址为 C、 IP地址为 10.1.1.1、 PORT (端口） 为 E2、 VLAN ( Virtual Local Area Network, 虚拟局域网）为 3 , 去查 找绑定表， 由于没有对应的表项， 因此网关交换机将该报文丟弃， 则 此欺骗 ARP报文将无法到达其它任何用户终端， 包括用户终端 B , 从而制止了用户终端 C的攻击行为。
在实现本发明的过程中， 发明人发现现有技术至少存在以下问 题： 现有技术中釆用 DHCP Snooping解决攻击者攻击的方法中， 由 于对攻击者的行为没有任何记录， 因此， 无法有效跟踪攻击者的具体 行为和信息， 从而导致故障的定位和排除非常困难。 发明内容
本发明实施例提供一种报文处理方法、 系统和设备， 以解决现有 技术中釆用 DHCP Snooping解决报文攻击安全问题时， 对攻击者的 行为没有跟踪记录， 故障定位排除困难的缺陷。
为达上述目的， 本发明实施例提供了一种报文处理方法， 包括： 接收用户终端发送的报文， 所述报文携带标识信息；
根据所述标识信息确定是否命中正常绑定表项；
当未命中时， 将所述标识信息存储在黑名单绑定表项中。
本发明实施例还提供了一种报文处理系统， 包括：
用户终端， 用于向网络设备发送报文， 所述报文携带标识信息； 网络设备， 用于判断所述报文是否命中正常绑定表项， 当未命中 时， 将所述标识信息存储在黑名单绑定表项中。
本发明实施例还提供了一种网络设备， 包括：
报文判断单元， 用于判断所接收的报文是否命中正常绑定表项； 信息存储单元， 用于当所述报文未命中所述正常绑定表项时， 将 所述报文的标识信息进行存储。
与现有技术相比， 本发明实施例增加了黑名单绑定表项， 可以有 效跟踪攻击者的具体行为和信息， 方便了故障的定位和排除。 附图说明
图 1是现有技术中釆用 DHCP Snooping解决欺骗攻击安全问题 的示意图；
图 2是本发明实施例一的报文处理方法流程图；
图 3是本发明实施例二的报文处理方法流程图；
图 4是本发明实施例绑定表信息异常丟失的示意图；
图 5是本发明实施例设置黑名单绑定表项的示意图；
图 6是本发明实施例重新建立绑定表项的示意图；
图 7是本发明实施例三的报文处理方法流程图；
图 8是本发明实施例一种报文处理系统的示意图。 具体实施方式
本发明实施例提供了一种报文处理方法。现有技术中的绑定表只 包括有 KEY, 如图 1中所示的源 MAC、 源 IP、 PORT和 VLAN, 本发明 的实施例在保持现有技术 KEY不变的基础上， 增加了两个字段， 其中 一个字段用来表示该绑定表项的类型， 一类是正常 DHCP Snooping绑 定表项， 另一类是非正常 DHCP Snooping绑定表项， 由于某报文没有 命中正常绑定表项而从该报文中提取相关信息创建的绑定表项，也称 为黑名单绑定表项；另一个字段用来表示该黑名单绑定表项被命中的 频率。 通过对用户终端 100的信息在黑名单绑定表项被命中频率的统 计， 从而有效监控攻击者的行为和信息。 本发明实施例釆用一个字段 来标识同一绑定表中的正常绑定表项和黑名单绑定表项， 当然， 在实 绑定表项的信息。
本发明实施例一的报文处理方法的流程图， 如图 2所示， 包括以 下步骤：
步骤 S201 , 网络设备 200接收用户终端 100发送的报文， 该报 文中携带标识信息。 该报文包括用户终端 100的正常上网报文， 当然 也可能存在攻击者发送的攻击报文。
步骤 S202, 网络设备 200根据该标识信息确定是否命中正常绑 定表项。
网络设备 200所接收的报文中包括用户终端 100 的正常上网报 文， 但是也可能存在攻击者发送的攻击报文， 网络设备 200需要对所 接收的报文进行辨别。
由于在网络设备 200的入端口使能了 DHCP Snooping功能， 因 此， 网络设备 200需要对所有接收到的报文进行分析判断， 解析所接 收才艮文的标识信息， 该标识信息包括^艮文的： 源 MAC地址、 源 IP 地址、 PORT和 VLAN, 然后将该源 MAC地址、 源 IP地址、 PORT 和 VLAN与网络设备 200正常绑定表项中对应的源 MAC地址、源 IP 地址、 PORT和 VLAN信息进行匹配。 也就是说， 网络设备 200根据 所接收报文的标识信息， 查找正常绑定表项中有无对应的信息， 若查 找到对应信息， 则信息匹配成功； 若没有查找到对应信息， 则信息匹 配不成功。 若信息匹配成功， 则称命中正常绑定表项； 若信息匹配不 成功， 则称没有命中正常绑定表项。 本发明实施例中是将报文标识信 息中的源 MAC地址、 源 IP地址、 PORT和 VLAN进行匹配， 当然， 在实际应用中， 用来进行匹配的标识信息也可根据具体需要， 在源 MAC地址、 源 IP地址、 PORT和 VLAN之间进行任意搭配。
步骤 S203 , 当未命中时， 网络设备 200将该标识信息存储在黑 名单绑定表项中。
当网络设备 200接收到的报文未命中正常绑定表项时，网络设备 200从没命中正常绑定表项的报文中提取源 MAC地址、 源 IP地址、 PORT和 VLAN信息， 并将该些源 MAC地址、 源 IP地址、 PORT和 VLAN信息存储在黑名单绑定表项的对应各表项中。 并且网络设备 200记录该没命中正常绑定表项报文的接收时间和命中次数， 通过记 录的接收时间和命中次数计算出该非正常报文的发送频率，并将计算 出的发送频率存储在黑名单绑定表项中用来存储频率信息的字段中。
上述本发明的实施例，在现有绑定表的基础上增加黑名单绑定表 项类型， 用来存储没命中正常绑定表项的报文的相关信息， 并且通过 对报文命中黑名单绑定表项的频率进行统计，从而可实现对攻击者的 攻击行为和信息进行有效跟踪和监控。
在实际应用中，也会出现用户终端 100发送的正常报文无法命中 网络设备 200正常绑定表项的情况， 例如： 网络设备 200中正常绑定 表项信息的异常丟失。网络设备 200正常绑定表项信息异常丟失的原 因有很多种， 包括：
由于一个网络设备 200上要接入大量的用户终端 100,而用于存放 正常绑定表项的空间有限， 因此， 需要对长期没有命中的正常绑定表 项项进行删除；
或者， 由于使能 DHCP Snooping功能的网络设备 200重新启动， 而原正常绑定表项保存恢复过程中发生部分数据丟失；
或者， 使能 DHCP Snooping功能的网络设备 200由于自身内部通 信原因， 而造成的正常绑定表项中的数据丟失；
再或者， 网络设备 200的一个端口上一旦使能 DHCP Snooping功 能，那么在使能前已经通过 DHCP获得 IP地址的用户终端 100将在网络 设备 200中没有 DHCP绑定表项， 此时也可以理解为该用户终端 100的 绑定表数据异常丟失。
现有技术中釆用 DHCP Snooping对报文进行监听， 一旦用户终 端 100通过 DHCP动态申请 IP地址成功以后， 能否上网， 完全取决 于用户终端 100报文的相关信息能否与网络设备 200正常绑定表项中 某一项匹配， 如果不匹配， 用户终端 100 ^艮文将被丟弃， 用户终端 100将无法上网。 在由于上述正常绑定表项异常丟失， 导致用户终端 100无法正常上网的情况下， 如果用户终端 100需要继续上网， 则只 能通过手工触发用户终端 100重新通过 DHCP进行 IP地址申请， 或 者等目前申请的 IP地址过期后再上网。
所谓手工触发用户终端 100重新通过 DHCP进行 IP地址申请， 是指用户终端 100释放现有的 IP地址， 然后向网络设备 200重新发 送 IP地址申请请求； 通过重新发送 IP地址申请， 用户终端 100重新 获得新的 IP地址， 同时在网络设备 200上建立新的绑定表信息。 手 工触发用户终端 100重新进行 IP地址申请， 需要用户终端 100首先 感知到已无法正常上网的情况， 但是在实际应用中， 从用户终端 100 无法正常上网到用户终端 100感知到无法正常上网的时间会比较长， 因此会导致较长时间的用户终端 100上网中断。
所谓等目前申请的 IP地址过期后再上网， 是指等用户终端 100 目前申请的 IP地址过期后， 用户终端 100会检测到 IP地址过期， 然 后自动向网络设备 200发送 IP地址申请请求； 通过重新发送 IP地址 申请， 用户终端 100重新获得新的 IP地址， 同时在网络设备 200上 建立新的绑定表信息。 等目前申请的 IP地址过期后再上网， 显然更 需要用户终端 100等待较长的时间，从而会导致用户终端 100长时间 的上网中断。
针对上述的问题， 本发明实施例二在网络设备 200接收到用户终 端 100发送的报文无法命中正常绑定表项的情况下， 主动向用户终端 100发送 IP地址不可用信息， 触发用户终端 100向网络设备 200重新发 送 IP地址申请请求， 立即申请新的 IP地址， 快速恢复上网。 如图 3所 示， 为本发明实施例二的报文处理方法流程图， 包括以下步骤：
步骤 S301 ,网络设备 200接收用户终端 100发送的报文无法命中正 常绑定表项。
在网络设备 200上由于前述的某种原因， 或者其它原因， 导致网 络设备 200的正常绑定表项信息丟失，则一般用户终端 100无法感知此 情况的发生， 甚至很有可能都不知道在网络设备 200上使能了 DHCP Snooping功能。 此时， 用户终端 100会继续正常上网， 并向网络设备 200发送 ^艮文， 该发送的^艮文包括两种类型： 一种是用户终端 100正常 上网的数据报文， 如 IP报文或 ARP报文等； 另一种是由于 IP租约期将 至， 用户终端 100发送的租期续约请求报文。
网络设备 200从所接收的报文中提取源 MAC地址、 源 IP地址、 PORT和 VLAN信息，然后将该源 MAC地址、源 IP地址、 PORT和 VLAN
PORT和 VLAN信息进行匹配， 无法匹配成功， 也即用户终端 100发送 的报文没有命中网络设备 200的正常绑定表项。
例如， 如图 4所示的本发明实施例绑定表信息异常丟失示意图。 用户终端 100B向网关交换机发送报文， 该报文中携带有用户终端 100 的源 IP地址和源 MAC地址信息， 源 IP地址信息为： 10.1.1.2, 源 MAC 地址信息为： B。 网关交换机接收到该报文后， 从中提取源 MAC地址 信息和源 IP地址信息， 再加上网关交换机的端口信息， 也即网关交换 机的端口号和 VLAN信息， 去查找绑定表中的对应信息。 但是， 由于 网关交换机中对应用户终端 100B的绑定表信息丟失，因此无法查找到 绑定表中的对应信息， 也就无法命中绑定表。
步骤 S302, 网络设备 200将没命中正常绑定表项的报文标识信息 存储在黑名单绑定表项中。 源 IP地址、 PORT和 VLAN信息， 并将该些源 MAC地址、 源 IP地址、 PORT和 VLAN信息存储在黑名单绑定表项中。 并且网络设备 200在黑 名单绑定表项中，记录该没命中正常绑定表项报文的接收时间和命中 次数，通过记录的接收时间和命中次数计算出该没命中正常绑定表项 的报文发送频率，并将计算出的发送频率存储在黑名单绑定表项中用 来存储频率信息的字段中。
仍以步骤 S301中的举例为例，用户终端 100B发送的报文没能命 中网关交换机的绑定表， 因此该报文被网关交换机判定为非正常报 文。 网关交换机会对应绑定表中的存储表项， 从该报文中提取源 IP 地址、 源
MAC地址信息、端口号和 VLAN等信息，将该些信息存入绑定表 的对应表项中。网关交换机还会记录该报文的接收时间和当前命中次 数，通过记录的接收时间和命中次数计算出该没命中正常绑定表项的 报文发送频率，并将计算出的发送频率存储在黑名单绑定表项中用来 存储频率信息的字段中。在黑名单绑定表项中建立一个字段来标识该 段绑定表信息的类型， 即非正常报文。 举例来说， 该黑名单绑定表项 如图 5中所示， 在绑定表中建立 BLK字段， 在该 BLK字段中设置不同 的标识， 代表该段绑定表的不同类型。 Y代表该段绑定表为正常绑定 表项， N代表该段绑定表为黑名单绑定表项； 并在绑定表中建立一个 RATE (频率） 字段， 将计算出没命中正常绑定表项的报文发送频率 存储在 RATE字段中。
步骤 S303 , 网络设备 200向用户终端 100发送 IP地址不可用信息。 网络设备 200向用户终端 100发送 IP地址不可用信息， 以告知该用 户终端 100当前的 IP地址已经不可用。 用户终端 100接收到网络设备 200发送的 IP地址不可用信息后， 得知当前的 IP地址已经不能再使用， 用户终端 100若再使用当前的 IP地址已不能再上网。若用户终端 100需 要继续上网， 可以向网络设备 200重新发送 IP地址申请请求， 重新申 请新的 IP地址。
接续步骤 S302中的举例，网关交换机将该没命中正常绑定表项的 报文重定向到 DHCP Snooping功能模块， 并由 DHCP Snooping功能模 块向用户终端 100B发送一个 DHCPNAK报文， 仿冒 DHCP服务器告知 用户终端 100B其 IP地址不可用。 DHCPNAK, 是 DHCP服务器用来告 诉用户终端 100其 IP地址已经不正确， 或租约期时间过期， 而向用户 终端 100发送的报文。 如果用户终端 100B收到 DHCPNAK消息后， 它 将不再使用原有的 IP地址， 而重新启动 DHCP配置流程来重新申请新 的 IP地址。 步骤 S304 , 用户终端 100接收到 IP地址不可用信息后， 向网络设 备 200重新发送 IP地址申请请求。
用户终端 100接收到网络设备 200发送的 IP地址不可用信息后，得 知当前的 IP地址已经不能再使用， 用户终端 100若再使用当前的 IP地 址已不能再上网。 若用户终端 100需要继续上网， 则可以向网络设备 200重新发送 IP地址申请请求， 重新申请新的 IP地址。 网络设备 200按 照正常的 DHCP Snooping流程，通过监听用户终端 100发送的 DHCP报 文， 重新建立针对该用户终端 100的绑定表， 则该用户终端 100在申请 IP地址成功之后可以照常上网了。
接续步骤 S303中的举例， 用户终端 100B接收到网关交换机发送 的 DHCPNAK报文后， 得知当前的 IP地址已经不能再使用， 于是按照 DHCP流程， 用户终端 100B向网关交换机重新发起首次 IP地址申请的 请求。 网关交换机按照正常的 DHCP Snooping流程， 通过监听用户终 端 100B发送的 DHCP报文， 重新建立针对用户终端 100B的绑定表项， 如图 6所示， 图 6是本发明实施例重新建立绑定表项的示意图， 该重新 建立的绑定表项包括源 IP地址、 源 MAC地址、 端口号、 VLAN和 BLK 等信息，由于用户终端 100B在网关交换机上重新建立的绑定表项属于 正常绑定表项， 绑定表项中的 BLK标识为 Y, 而 RATE表项是用来记 录没命中正常绑定表项的报文的频率信息，因此该重新建立的绑定表 项中也就不存在 RATE信息，也可认为 RATE信息为空。用户终端 100B 在申请新的 IP地址成功之后即可照常上网了。
上述本发明的实施例， 在网络设备 200接收到的报文无法命中正 常绑定表项的情况下， 主动向用户终端 100发送 IP地址不可用信息， 从而能够触发因网络异常导致无法正常上网的用户终端 100重新发起 IP地址申请流程，即可快速恢复上网功能，大大提高了网络服务质量。
但是， 考虑到实际应用中， 攻击者会向网络设备 200频繁发送无 法通过 DHCP Snooping认证的报文， 由于该报文无法命中正常绑定表 项， 按照本发明实施例二的流程， 网络设备 200则会频繁向用户终端 100发送 IP地址不可用信息， 从而会增加网络设备 200的处理工作量， 降低系统性能。
针对上述问题， 本发明实施例三对前述的实施例进行改进， 在网 络设备 200中设定一个阀值， 将黑名单绑定表项中的报文发送频率和 该阀值进行比较， 当报文发送频率大于阀值的时候， 网络设备 200则 停止向发送该 文的用户终端 100发送 IP地址不可用信息。 当然， 上 述阀值可以预先在网络设备 200上设定好， 也可在实际应用中根据具 体情况进行修改， 重新设定。
如图 7所示， 是本发明实施例三的报文处理方法流程图， 具体包 括以下步骤：
步骤 S701 ,网络设备 200接收用户终端 100发送的报文无法命中正 常绑定表项。 该步骤的具体实施过程与前述相同， 在此不再多述。
步骤 S702, 网络设备 200将没命中正常绑定表项的报文标识信息 存储在黑名单绑定表项中。 该步骤的具体实施过程与前述相同， 在此 也不再多述。
步骤 S703， 网络设备 200根据黑名单绑定表项中的频率信息判断 是否向用户终端 100发送 IP地址不可用信息。
该频率信息是网络设备 200根据记录报文的发送时间和命中次数 计算出来的，网络设备 200每收到一次该没命中正常绑定表项的报文， 则记录该报文的发送时间和命中次数，然后根据记录的发送时间和命 中次数计算出该报文的频率信息。 网络设备 200将该频率和设定的阀 值进行比较， 若该频率小于阀值， 则网络设备 200向用户终端 100发送 IP地址不可用信息； 若该频率大于阀值， 则网络设备 200停止向用户 终端 100发送 IP地址不可用信息。 网络设备 200将发送频率大于阀值的 报文判定为攻击报文， 网络设备 200对该攻击报文直接丟弃， 不做再 任何处理。
上述本发明的实施例，将发送频率大于设定的阀值的报文判定为 攻击 4艮文， 并停止向发送攻击 文的用户终端 100发送 IP地址不可用 信息， 可有效避免攻击者的频繁攻击。
本发明的实施例还提供了一种报文处理系统， 如图 8所示， 包括： 用户终端 100和网络设备 200。 其中， 用户终端 100 , 用于向网络设备 200发送报文。
网络设备 200 , 用于将所接收报文中， 没命中正常绑定表项的报 文标识信息存储在黑名单绑定表项中。
其中， 网络设备 200包括： 4艮文判断单元 210和信息存储单元 220。 文判断单元 210 , 用于获取接收的^艮文携带的标识信息， 以该标识 信息为关键字查找绑定表， 确定接收的报文是否命中正常绑定表项。 报文判断单元 210根据所接收报文的标识信息， 查找正常绑定表项中 有无对应的信息， 若查找到对应信息， 则信息匹配成功； 若没有查找 到对应信息， 则信息匹配不成功。 若信息匹配成功， 则命中正常绑定 表项； 若信息匹配不成功， 则没有命中正常绑定表项。 信息存储单元 220 , 用于在所述绑定表中的黑名单绑定表项中， 存储没命中正常绑 定表项的报文标识信息。 网络设备 200从没命中正常绑定表项的报文 中提取相关信息，并将该些信息存入信息存储单元 220的对应表项中。
信息存储单元 220包括： 标识信息存储子单元 221、 记录子单元
222、 频率计算子单元 223和频率存储子单元 224。 标识信息存储子 单元 221 , 用于存储没命中绑定表报文的标识信息。 记录子单元 222, 连接标识信息存储子单元 221 , 用于记录没命中绑定表报文的接收时 间和命中次数。 频率计算子单元 223 , 连接记录子单元 222, 用于根 据记录子单元 222 中所记录报文的接收时间和命中次数计算没命中 绑定表报文的发送频率。 频率存储子单元 224, 连接频率计算子单元
223 , 用于存储没命中绑定表报文的发送频率。
本发明另一实施例在上述网络设备 200的基础上，增设了信息发 送单元 230和频率比较单元 240。 信息发送单元 230, 连接信息存储 单元 220,用于向用户终端 100发送 IP地址不可用信息。频率比较单 元 240, 连接信息存储单元 220, 用于将信息存储单元 220中没命中 绑定表报文的发送频率和设定的阀值进行比较，作为是否向用户终端 100发送 IP地址不可用信息的依据，当报文的发送频率小于设定的阀 值时， 通知信息发送单元 230向用户终端 100发送 IP地址不可用信 本发明的实施例增加了一种黑名单绑定表项类型，可以有效跟踪 攻击者的具体行为和信息， 了解攻击者的攻击频率， 以及主要攻击对 象。 本发明的实施例中， 在用户终端 100的报文无法命中绑定表， 从 而导致用户终端 100无法正常上网的情况下，可以主动触发用户终端 100重新发起地址申请流程， 即可快速恢复上网功能， 大大提高了网 络服务质量。 本发明实施例中的网络设备 200包括交换机、路由器等 具有报文处理能力的网络设备 200。 且本发明实施例中对应的软件可 以存储在一个计算机可读取存储介质中。
以上公开的仅为本发明的几个具体实施例， 但是， 本发明并非局 限于此，任何本领域的技术人员能思之的变化都应落入本发明的保护 范围。

Claims

权利要求
1、 一种报文处理方法， 其特征在于， 包括：
接收（201 )用户终端发送的报文， 所述报文携带标识信息； 获取 ( 202 )所述标识信息， 以所述标识信息为关键字查找（ 202 ) 绑定表；
当未命中所述绑定表中的正常绑定表项时，将所述标识信息存储 ( 203 , 302, 702 )在所述绑定表中的黑名单绑定表项中。
2、 如权利要求 1所述方法， 其特征在于， 所述将所述标识信息 存储（203 , 302, 702 )在所述绑定表中的黑名单绑定表项之后， 还 包括： 向用户终端发送（303 ) IP地址不可用信息。
3、 如权利要求 1所述方法， 其特征在于， 所述将所述将标识信 息存储（203 , 302, 702 )在所述绑定表中的黑名单绑定表项中之后， 还包括： 记录（703 )所述报文的发送频率， 将所述发送频率与阀值 进行比较（ 703 ) ,当所述发送频率小于阀值时，向用户终端发送（703 ) IP地址不可用信息。
4、 如权利要求 3所述方法， 其特征在于， 所述记录（703 )所述 报文的发送频率具体包括：
记录所述报文的接收时间和命中次数；
根据所述接收时间和命中次数计算所述报文的发送频率； 将所述发送频率存储在所述黑名单绑定表项中。
5、 如权利要求 4所述方法， 其特征在于， 将所述发送频率存储 ( 702 )在所述黑名单绑定表项中具体为：将所述发送频率存储（ 304 ) 在黑名单绑定表项的频率字段中。
6、 如权利要求 1所述方法， 其特征在于， 所述绑定表包含绑定 表项类型字段， 标识正常绑定表项和黑名单绑定表项。
7、 如权利要求 1所述方法， 其特征在于， 所述标识信息包括： 所述报文的源媒体接入控制 MAC地址、 源 IP地址、 端口 PORT和 虚拟局域网 VLAN。
8、 一种报文处理系统， 其特征在于， 所述系统包括网络设备 ( 200 ) , 用于与用户终端 （100 )通信， 具体为：
接收用户终端 （100 )发送的报文， 所述报文携带标识信息； 获取所述标识信息， 以所述标识信息为关键字查找绑定表； 当未命中所述绑定表中的正常绑定表项时，将所述标识信息存储 在所述绑定表中的黑名单绑定表项中。
9、 如权利要求 8所述报文处理系统， 其特征在于， 所述网络设 备（200 )还用于在将所述标识信息存储在所述绑定表中的黑名单绑 定表项之后， 向用户终端 （100 )发送 IP地址不可用信息。
10、 如权利要求 8所述报文处理系统， 其特征在于， 所述网络设 备（200 )还用于在将所述将标识信息存储在所述绑定表中的黑名单 绑定表项中之后， 记录所述报文的发送频率， 将所述发送频率与阀值 进行比较， 当所述发送频率小于阀值时， 向用户终端 （ 100 )发送 IP 地址不可用信息。
11、 一种网络设备（200 ) , 其特征在于， 包括：
报文判断单元（210 ) , 用于获取接收的报文携带的标识信息， 以所述标识信息为关键字查找绑定表，确定所述报文是否命中正常绑 定表项；
信息存储单元（220 ) , 用于当所述报文未命中所述正常绑定表 项时，将所述报文的标识信息存储在所述绑定表中的黑名单绑定表项 中。
12、 如权利要求 11所述网络设备（200 ) , 其特征在于， 所述信 息存储单元（ 220 ) 包括：
标识信息存储子单元（221 ) , 用于存储所述 "^文的标识信息； 记录子单元（222 ) , 用于记录所述报文的接收时间和命中次数； 频率计算子单元（223 ) ， 与所述记录子单元（222 )通信， 用于 根据所述接收时间和命中次数计算所述报文的发送频率；
频率存储子单元（224 ) ， 与所述频率计算子单元（223 )通信， 用于将所述发送频率存储在所述黑名单绑定表项中。
13、 如权利要求 11所述网络设备（200 ) , 其特征在于， 所述网 络设备 ( 200 )还包括： 信息发送单元（ 230 ) , 用于向用户终端（ 100 ) 发送 IP地址不可用信息。
14、 如权利要求 13所述网络设备（200 ) , 其特征在于， 所述网 络设备（ 200 )还包括频率比较单元（ 240 ) ,与所述信息存储单元（ 220 ) 通信， 用于将所述报文的发送频率和设定的阀值进行比较， 当所述报 文的发送频率小于所述阀值时， 通知所述信息发送单元（230 ) 向用 户终端 （ 100 )发送 IP地址不可用信息。
15、 一种网关交换机， 其特征在于， 包括：
报文判断单元（210 ) , 用于获取接收的报文携带的标识信息， 以所述标识信息为关键字查找绑定表，确定所述报文是否命中正常绑 定表项；
信息存储单元（220 ) , 用于当所述报文未命中所述正常绑定表 项时，将所述报文的标识信息存储在所述绑定表中的黑名单绑定表项 中。
16、 一种计算机程序， 其特征在于， 包括若干指令用以执行前述 权利要求 1-7任意一项所述的报文处理方法。
17、 一种存储介质， 其特征在于， 存储权利要求 16所述的计算 机程序。
18、 一种计算机设备， 其特征在于， 包括用以执行权利要求 16 所述的计算机程序的软件及与软件配合的硬件。
PCT/CN2008/071043 2007-05-22 2008-05-22 Message processing method, system, and equipment WO2008141584A1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200710107569.8 2007-05-22
CN200710107569A CN100586106C (zh) 2007-05-22 2007-05-22 报文处理方法、系统和设备

Publications (1)

Publication Number Publication Date
WO2008141584A1 true WO2008141584A1 (en) 2008-11-27

Family

ID=38866391

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2008/071043 WO2008141584A1 (en) 2007-05-22 2008-05-22 Message processing method, system, and equipment

Country Status (2)

Country Link
CN (1) CN100586106C (zh)
WO (1) WO2008141584A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11050860B2 (en) * 2018-05-08 2021-06-29 Qnap Systems, Inc. Method and apparatus for network address analysis
CN113114799A (zh) * 2021-04-25 2021-07-13 新华三信息安全技术有限公司 decline报文攻击下防IP禁锢方法、系统及网络设备、存储介质
US11258757B2 (en) * 2019-02-28 2022-02-22 Vmware, Inc. Management of blacklists and duplicate addresses in software defined networks
CN114827077A (zh) * 2022-03-31 2022-07-29 中国电信股份有限公司 报文处理方法、装置、计算机可读存储介质及电子设备

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100563149C (zh) * 2007-04-25 2009-11-25 华为技术有限公司 一种dhcp监听方法及其装置
CN100586106C (zh) * 2007-05-22 2010-01-27 华为技术有限公司 报文处理方法、系统和设备
CN101296182A (zh) * 2008-05-20 2008-10-29 华为技术有限公司 一种数据传输控制方法以及数据传输控制装置
CN101834870A (zh) * 2010-05-13 2010-09-15 中兴通讯股份有限公司 一种防止mac地址欺骗攻击的方法和装置
CN102413205A (zh) * 2011-12-23 2012-04-11 华为技术有限公司 一种ip地址分配方法及相关中继设备、服务器和系统
CN103095722A (zh) * 2013-02-01 2013-05-08 华为技术有限公司 一种更新网络安全表的方法及网络设备、dhcp服务器
CN105991791A (zh) * 2015-05-12 2016-10-05 杭州迪普科技有限公司 报文转发方法及装置
US9900247B2 (en) * 2015-12-30 2018-02-20 Juniper Networks, Inc. Media access control address and internet protocol address binding proxy advertisement for network devices of a network
CN106878479B (zh) * 2016-12-23 2020-07-07 新华三技术有限公司 一种地址分配方法及装置
CN109274588A (zh) * 2017-07-18 2019-01-25 中兴通讯股份有限公司 Ip报文的处理方法及装置
CN110995877B (zh) * 2019-11-12 2022-08-16 锐捷网络股份有限公司 自动更新ip地址的方法、窥探设备和dhcp服务器
CN111431912B (zh) * 2020-03-30 2021-12-28 上海尚往网络科技有限公司 用于检测dhcp劫持的方法和设备
CN112383646B (zh) * 2020-11-13 2022-04-22 新华三大数据技术有限公司 一种安全表项的配置方法、装置、sdn控制器及介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1416239A (zh) * 2001-10-31 2003-05-07 华为技术有限公司 光纤同轴混合接入网中的虚拟局域网接入方法
US20050015626A1 (en) * 2003-07-15 2005-01-20 Chasin C. Scott System and method for identifying and filtering junk e-mail messages or spam based on URL content
WO2006047927A1 (en) * 2004-11-01 2006-05-11 Mail Prove Limited Jurisdiction-wide anti-phishing network service
CN1874303A (zh) * 2006-03-04 2006-12-06 华为技术有限公司 一种黑名单实现的方法
CN101060495A (zh) * 2007-05-22 2007-10-24 华为技术有限公司 报文处理方法、系统和设备

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100417127C (zh) * 2002-04-10 2008-09-03 中兴通讯股份有限公司 一种基于动态主机配置协议的用户管理方法
EP2472823B1 (en) * 2002-11-06 2013-09-18 Telefonaktiebolaget L M Ericsson AB (Publ) A method and a device in an IP network

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1416239A (zh) * 2001-10-31 2003-05-07 华为技术有限公司 光纤同轴混合接入网中的虚拟局域网接入方法
US20050015626A1 (en) * 2003-07-15 2005-01-20 Chasin C. Scott System and method for identifying and filtering junk e-mail messages or spam based on URL content
WO2006047927A1 (en) * 2004-11-01 2006-05-11 Mail Prove Limited Jurisdiction-wide anti-phishing network service
CN1874303A (zh) * 2006-03-04 2006-12-06 华为技术有限公司 一种黑名单实现的方法
CN101060495A (zh) * 2007-05-22 2007-10-24 华为技术有限公司 报文处理方法、系统和设备

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11050860B2 (en) * 2018-05-08 2021-06-29 Qnap Systems, Inc. Method and apparatus for network address analysis
US11258757B2 (en) * 2019-02-28 2022-02-22 Vmware, Inc. Management of blacklists and duplicate addresses in software defined networks
US11533294B2 (en) 2019-02-28 2022-12-20 Vmware, Inc. Management of blacklists and duplicate addresses in software defined networks
US11736441B2 (en) 2019-02-28 2023-08-22 Vmware, Inc. Management of blacklists and duplicate addresses in software defined networks
CN113114799A (zh) * 2021-04-25 2021-07-13 新华三信息安全技术有限公司 decline报文攻击下防IP禁锢方法、系统及网络设备、存储介质
CN113114799B (zh) * 2021-04-25 2023-06-16 新华三信息安全技术有限公司 decline报文攻击下防IP禁锢方法、系统及网络设备、存储介质
CN114827077A (zh) * 2022-03-31 2022-07-29 中国电信股份有限公司 报文处理方法、装置、计算机可读存储介质及电子设备

Also Published As

Publication number Publication date
CN101060495A (zh) 2007-10-24
CN100586106C (zh) 2010-01-27

Similar Documents

Publication Publication Date Title
WO2008141584A1 (en) Message processing method, system, and equipment
JP3824274B2 (ja) 不正接続検知システム及び不正接続検知方法
EP2790382B1 (en) Protection method and device against attacks
US8918875B2 (en) System and method for ARP anti-spoofing security
US7757285B2 (en) Intrusion detection and prevention system
KR100992968B1 (ko) 네트워크 스위치 및 그 스위치의 주소충돌방지방법
US20100095351A1 (en) Method, device for identifying service flows and method, system for protecting against deny of service attack
WO2008131658A1 (fr) Procédé et dispositif pour fureter le dhcp
CN108270722B (zh) 一种攻击行为检测方法和装置
WO2014101634A1 (zh) 一种防御攻击的方法和设备
CN108471369B (zh) 一种网络拨号方法、装置及存储介质
WO2009140889A1 (zh) 一种数据传输控制方法以及数据传输控制装置
US10834125B2 (en) Method for defending against attack, defense device, and computer readable storage medium
KR20120060655A (ko) 서버 공격을 탐지할 수 있는 라우팅 장치와 라우팅 방법 및 이를 이용한 네트워크
CN104883360A (zh) 一种arp欺骗的细粒度检测方法及系统
KR100533785B1 (ko) Ｄｈｃｐ 패킷을 이용한 동적 ｉｐ 주소할당 환경에서의ａｒｐ/ｉｐ 스푸핑 자동 방지 방법
WO2008131650A1 (fr) Procédé de furetage de dhcp et dispositif associé
WO2019096104A1 (zh) 攻击防范
US9686311B2 (en) Interdicting undesired service
EP2007066A2 (en) A policy enforcement point and a linkage method and system for intrude detection system
JP4922620B2 (ja) ネットワークシステム
KR101687811B1 (ko) ARP_Probe 패킷을 이용한 Agent 방식의 ARP 스푸핑 탐지 방법
JP4002276B2 (ja) 不正接続検知システム
CN109327465B (zh) 一种安全抵御网络劫持的方法
Barbhuiya et al. An active detection mechanism for detecting icmp based attacks

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 08748649

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 08748649

Country of ref document: EP

Kind code of ref document: A1