WO2011041960A1

WO2011041960A1 - Method and apparatus for preventing denial-of-service attack

Info

Publication number: WO2011041960A1
Application number: PCT/CN2010/075781
Authority: WO
Inventors: 张世伟; 符涛; 何辉
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-10-10
Filing date: 2010-08-06
Publication date: 2011-04-14
Also published as: CN102045308B; CN102045308A

Abstract

A method for preventing denial-of-service (DOS) attacks includes: a user is set as a restricted state if the hit-rate of the user is lower than a hit-rate threshold and/or the non-hit number of the user is higher than a non-hit number threshold; a packet is judged whether it is a non-hit packet, if yes, the state of the user transmitting the packet is queried, and if the user is in the restricted state, then the packet is discarded. An apparatus for preventing denial-of- service attacks is provided by this invention, and the apparatus includes: a user data reception unit, a local mapping list query unit and a first-package attack identification and control unit. It is realized by this invention that the DOS/ Distributed-Denial-Of-Service (DDOS) attacks caused by a malicious user transmitting the first-package continually are able to be controlled. The limit of the first-package attack is able to adjusted according to the circumstance of system startup, system over loading, especial users and user logging, et al, thereby it is able to assure that in the above especial scenarios, the first-package attack is avoided in the system and simultaneously the user is able to use the network normally.

Description

Method and device for preventing denial of service attack

TECHNICAL FIELD The present invention relates to a network in which identity and location identification are separated, and more particularly to a method and apparatus for preventing denial of service attacks in a network in which identity and location are separated.

BACKGROUND OF THE INVENTION Currently, an IP address in a Transmission Control Protocol/Internet Protocol (TCP/IP) protocol widely used on the Internet has a dual function, and serves as a communication layer host network interface of a network layer in a network topology. The location identifier, which is also the identity of the transport layer host network interface. The TCP/IP protocol was not designed with host mobility in mind. However, as host mobility becomes more prevalent, the semantic overload defects of such IP addresses are becoming increasingly apparent. When the IP address of the host changes, not only the route changes, but also the identity of the host of the communication terminal changes. This causes the routing load to become heavier and heavy, and the change of the host ID will cause the application and connection to be interrupted. The purpose of separating the identity and location identifiers is to solve the problem of semantic overload and serious routing load and security of IP addresses, and separate the dual functions of IP addresses to achieve dynamic redistribution of mobility, multiple townships, and IP addresses. Support for mitigating routing load and mutual visits between different network areas in the next generation Internet. Figure 1 shows an integrated network architecture proposed by Beijing Jiaotong University, which realizes the separation of the identity and location identifiers of the terminal. The network architecture includes: mapping server (Map Server, MS), access to the server ( Access Service Router (ASR) and User Equipment (UE), each UE has a unique Access Identifier (AID), and each ASR has a Router Identifier (RID). The UE is mobile and can be registered on each ASR. The RID of the ASR accessed by the UE is stored in the MS. That is, the MS maintains a correspondence table between the AID of each UE and the RID of the ASR actually accessed (AID- RID mapping table). When UE1 and UE2 start to use the network, first initiate a registration process to the MS, UE1 After the ASR1 is registered with the MS, the MS will generate an entry AID1-RID1, indicating that UE1 is registered under ASR1, and subsequent packets sent by other UEs to UE1 will be forwarded by ASR1. Similarly, after the UE2 registers with the MS through the ASR2, the MS will generate an entry for the AID2-RID2, indicating that the UE2 is registered under the ASR2, and the subsequent packets sent by the other UE to the UE2 should be forwarded by the ASR2. After a period of time, the UE registered on the MS will tend to be stable, and the MS will establish an AID-RID mapping table as shown in FIG. 2. After both UE1 and UE2 have been registered, and UE1 sends a data packet to UE2 (shown as 103 in FIG. 1), UE1 generates a data packet with the destination address AID2, and sends the data packet to ASR1, and ASR1 receives the data. After the packet, the RID corresponding to AID2 is queried in the local AID-RID mapping table, and the structure of the local AID-RID mapping table of the ASR is as shown in FIG. 3. If ASR1 finds the location mapping relationship AID2-RID2 of AID2 in the local AID-RID mapping table, ASR1 encapsulates the data packet and sends it to ASR2. The ASR2 decapsulates and sends it to UE2. If ASR1 cannot find the location mapping relationship of AID2 in the local AID-RID mapping table, ASR1 will query the MS for the location mapping relationship of AID2. After the MS finds the location mapping relationship of AID2, it sends the mapping relationship table AID2-RID2. After ASR1 and ASR1 receive this mapping table, they are saved to the local AID-RID mapping table. If the subsequent UE1 retransmits the data packet with the destination address AID2, the ASR2-RID2 mapping relationship is saved in the ASR1, and the ASR1 can directly send the data packet of the UE1 without querying the MS again. The foregoing process is a process of UE registration and data packet transmission in a network in which the integrated identity and location identifiers are separated as shown in FIG. 1. It can be seen from the above process that in the network where the identity and location identifiers are separated, there is an MS. In the scenario that poses an attack threat, each time the ASR receives a data packet sent to a different destination AID (hereinafter, the data packet of the different destination AID is referred to as the first packet), the ASR must query the MS when the UE1 continuously goes to the ASR1. When sending packets of different destination AIDs, the packet string shown in Figure 4 will form a network attack. In FIG. 4, each box represents a data packet sent by the UE, and the destination addresses of the data packets are AID2, AID3, and AID27, that is, if UE1 sequentially sends the destination address as AID2, AID3... AID27 This kind of packet with different destination address, ASR1 can't be used every time. The RID corresponding to the AID is found in the local AID-RID mapping table. Therefore, each time the ASR1 sends a message to the MS to query the corresponding mapping entry, the performance of the ASR1 and the MS is greatly degraded. Moreover, if UE1 frequently sends such a first packet, since AIS1 local AID-RID mapping table has limited storage space, ASR1 must age the old mapping entries in the local database, that is, when the database is full, ASR1 When a new mapping entry is received, an old mapping entry must be deleted. When UE1 sends the first packet frequently, many new invalid entries are generated in ASR1. When the database is full, ASR1 may use The newly generated invalid mapping entry of UE1 covers the valid mapping entries of other UEs. When the ASR receives the data of other UEs, it may be forced to query the MS again because the corresponding valid mapping entries are aged and deleted, further reducing the ASR. Processing performance. In summary, the behavior of the UE continuously transmitting data packets of different destination AIDs will cause the following problems:

(1) The ASR must query the MS each time, increasing the signaling load of both the ASR and the MS, and reducing the signaling processing performance.

(2) If the user sends the first packet in a large amount, if the ASR uses the local cache first packet and waits for the MS query result to be forwarded again, the ASR will accumulate a large number of data packets, and the memory consumption is severe. If the ASR uses the scheme of forwarding the first packet by the MS, it will cause the data that should be sent directly by the ASR, but it will be forwarded by the MS, which greatly increases the burden on the MS.

(3) A large number of first-packet queries cause a large number of invalid mapping entries to be stored in the ASR local mapping table. As a result, the ASR mapping table cache is too large. If the number of caches is limited, the mapping entries are updated too fast, and a large number of invalid mappings are caused. The entry will be overwritten with a valid mapping entry. The data packet sent by the normal UE that is overwritten by the mapping entry needs to re-query the MS. As a result, the ASR sends the query message to the MS more frequently, which forms a domino effect, which leads to ASR and MS does not work properly. The above application scenario has formed a denial of service (DOS) attack. If multiple users initiate similar attacks at the same time, the MS signaling load will be more serious, the ASR cache will be more insufficient, and the AID-RID mapping table will be refreshed faster. As a result, the MS is queried more frequently, which further consumes the processing power of the ASR and the MS, thereby causing a Distributed Denial of Service (DDOS) attack. For convenience of presentation, the DOS or DDOS attacks in which the UE continuously transmits the first data packet are collectively referred to as the first packet attack. SUMMARY OF THE INVENTION The technical problem to be solved by the present invention is to provide a method and apparatus for preventing a denial of service attack, which solves the problem that a malicious user frequently sends data packets of different destination addresses, resulting in a network device being overloaded and unable to work normally. In order to solve the above technical problem, a method for preventing a denial of service attack according to the present invention includes: when a user's hit rate is lower than a hit rate threshold and/or the user's miss number is higher than a missed threshold, The user is set to the restricted state; and determining whether the data packet is a miss data packet, and if the data packet is a miss data packet, querying the status of the user who sent the data packet, and discarding the data if the user is in the restricted state package. Hit rate: The number of packets sent by the user in the local access identifier (AID)-route ID (RID) mapping table to find the RID corresponding to the destination AID divided by the packet sent by the user per unit time. total. The number of misses is the number of data packets sent by the user in the local AID-RID mapping table that are not found in the local AID-RID mapping table. The method further includes: adding a record of the number of misses, the number of hits, and the state of the user in the context of the user. The step of determining whether the data packet is a miss data packet includes: querying a local AID-RID mapping table according to the destination AID of the data packet, and determining that the data packet is a missing data packet if the RID corresponding to the destination AID is not found. And incrementing the number of misses saved in the context of the user who sent the data packet by one packet; if the RID corresponding to the destination AID is found, determining that the data packet is a hit data packet, for the user who sent the data packet The number of hits saved in the context is incremented by the record of a packet. The step of setting the user to the restricted state includes: before performing the query of the status of the user who sent the data packet, determining whether the adjustment period of the user restriction state is reached, and if yes, reading the number of misses from the context of the user And the hit number, calculate the hit rate of the user, determine whether the hit rate of the user is lower than the hit rate threshold configured for the user, and/or whether the number of misses of the user is higher than The number of misses configured for the user, and if so, the user is set to the restricted state and counted in the record of the user state in the context of the user. The method further includes: if it is determined that the hit rate of the user is not lower than a hit rate threshold configured for the user and/or the number of misses of the user is not higher than a threshold value of the number of misses configured for the user, further It is determined whether the number of times the user is limited in a period is greater than a limit number threshold. If it is greater, the user is still set to the restricted state; if less, the user is set to the unrestricted state. After the step of calculating the hit rate of the user, the method further includes: clearing the record of the number of misses and hits in the context of the user. The method further determines whether the hit rate of the user is not lower than a hit rate threshold configured for the user and/or whether the number of misses of the user is not higher than a threshold for the number of misses configured for the user. The method includes: determining, according to the attribute of the user, whether the user belongs to a special server user, and if so, lowering the standard hit rate threshold by one level, and increasing the standard miss number threshold by one level respectively as the user's hit rate threshold and The number of misses is greater; if not, the standard hit rate threshold and the standard miss threshold are respectively configured as the user's hit rate threshold and missed threshold. Before determining whether the hit rate of the user is not lower than a hit rate threshold configured for the user and/or whether the number of misses of the user is not higher than a threshold for the number of misses configured for the user, the method further includes : Determine whether the login time of the user is less than a specified login time threshold. If it is less than, the hit rate configured for the user is reduced by one level, and the number of misses configured for the user is increased by one level. Before determining whether the hit rate of the user is not lower than a hit rate threshold configured for the user and/or whether the number of misses of the user is not higher than a threshold for the number of misses configured for the user, the method further includes : Determines whether the startup time is less than a specified startup time threshold. If it is less than, the user-configured hit rate threshold is reduced by one level, and the user-configured miss threshold is increased by one level. Before determining whether the hit rate of the user is not lower than a hit rate threshold configured for the user and/or whether the number of misses of the user is not higher than a threshold for the number of misses configured for the user, the method further includes : Determine if the system is overloaded. If yes, reduce the hit rate threshold configured for the user by one level, and increase the number of misses configured for the user by one level. The standard hit rate threshold and the standard miss threshold are obtained by: counting the number of all packets sent by one or more users and the number of missed packets in a unit time, and calculating the hit ratio as The average hit rate is calculated as the average number of misses, and the average hit rate and the average number of misses are adjusted as the standard hit rate threshold and the standard miss number. The user attribute is saved in the mapping server or the authentication server. The method further includes: after registering the user with the mapping server, the mapping server adds a user attribute field to the registration response message, and sends the user attribute; or After the user is authenticated, the authentication server adds a user attribute field to the authentication response message and delivers the user attribute. The present invention also provides an apparatus for preventing a denial of service attack, comprising: a user data receiving unit, a local mapping table query unit, and a first packet attack identification and control unit, wherein: the user data receiving unit is configured to: receive a data packet sent by the user Sending the received data packet to the local mapping table query unit; the local mapping table query unit is set to: query the destination AID of the received data packet from the local access identifier (AID)-route identification (RID) mapping table The corresponding RID sends the query result and the data packet to the first packet attack identification and control unit; the first packet attack identification and control unit is set to: the hit rate of the user is lower than the hit rate threshold and/or the number of misses of the user When the value is higher than the missed value threshold, the user is set to the restricted state; and when the received data packet is determined to be a missed data packet according to the received query result, the status of the user who sent the data packet is queried, if If the user is in the restricted state, the packet is discarded. Hit rate: The number of packets sent by the user in the local AID-RID mapping table to find the RID corresponding to the destination AID divided by the total number of packets sent by the user per unit time; the number of misses is: The number of data packets sent by the user that did not find the RID corresponding to the destination AID in the local AID-RID mapping table. The first packet attack identification and control unit is further configured to: add a record of a miss number, a hit number, and a user state in a context of the user; and determine, according to the received query result, that the received data packet is a miss data packet. And incrementing a record of the number of misses saved in the context of the user who sent the data packet; and determining, when the received data packet is a hit data packet according to the received query result, the user who sent the data packet The number of hits saved in the context is incremented by a record of the packet. The first packet attack identification and control unit is further configured to: determine whether an adjustment period of the user restriction state is reached before performing a query of the state of the user who sent the data packet, and if so, read the number of misses from the context of the user and Hits, calculates the hit rate of the user, determines whether the hit rate of the user is lower than the hit rate threshold configured for the user, and/or whether the number of misses of the user is higher than the number of misses configured for the user. If yes, the user is set to the restricted state and counted in the record of the user state in the context of the user; after the first packet attack identification and control unit calculates the user's hit rate, it is further set to: The number of misses and hits in the context is cleared. The first packet attack identification and control unit is further configured to: if it is determined that the user's hit rate is not lower than a hit rate threshold configured for the user and/or the user's miss number is not higher than the configured for the user If the hit value is wider, it is further determined whether the limit number of the user in a period is greater than a limit number threshold. If it is greater, the user is still set to the limit state; if less, the user is set to the unrestricted state. . The first packet attack identification and control unit is further configured to: determine whether the user's hit rate is lower than a hit rate threshold configured for the user and/or whether the number of misses of the user is higher than a number of misses configured for the user Before the value, according to the user attribute, it is determined whether the user belongs to the special server user. If yes, the standard hit rate threshold is lowered by one level, and the standard miss number threshold is increased by one level to be configured as the user's hit rate threshold and The number of misses is greater; if not, the standard hit rate threshold and the standard miss threshold are respectively configured as the user's hit rate threshold and missed threshold. The first packet attack identification and control unit is further configured to: determine whether the login time of the user is less than a specified login time threshold, and if less, reduce the hit rate configured for the user by one. Level, which will increase the level of the number of misses configured for this user by one level. The first packet attack identification and control unit is further configured to: determine whether the startup time is less than a specified startup time threshold, and if less, reduce the hit rate threshold configured for the user by one level, and the miss configured for the user The number of thresholds is increased by one level. The first packet attack identification and control unit is further configured to: determine whether the system is overloaded, and if so, reduce the hit rate threshold configured for the user by one level, and increase the number of misses configured for the user by one level. The apparatus also includes a hit rate statistics and modeling unit configured to: count the number of all packets sent by one or more users and the number of missed packets in a unit time, calculate the hit ratio As the average hit rate, the number of misses counted is taken as the average miss. In summary, the present invention combines the hit rate control and the miss number control, and combines the user type identification, the system startup state correction, the system overload correction, and the modification of the user's login state to prevent the denial of service attack. The DOS/DDOS attack caused by the frequent sending of the first packet by the malicious user can be effectively controlled. The limitation of the first packet attack can be adjusted according to the system startup, system overload, special user, user login, etc., to ensure the above special scenarios. The system can also use the network normally while avoiding the first packet attack.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is an architectural diagram of a network in which an identity and a location identity are separated in the prior art; FIG. 2 is a mapping table in a mapping server; FIG. 3 is a local mapping table in an ASR; Schematic diagram of a typical first packet attack; FIG. 5 is an architectural diagram of another network in which identity and location are separated; FIG. 6 is an architectural diagram of a network in which a third identity and location identity are separated; FIG. 7 is an improvement Schematic diagram of the first packet attack; 8 is a schematic structural diagram of an apparatus for preventing a first packet attack according to the present invention; FIG. 9 is a flowchart of main functions implemented by a first packet attack identification and control unit; FIG. 10 is a flow of a method for adjusting a restriction policy by a first packet attack and identification unit. Figure.

BEST MODE FOR CARRYING OUT THE INVENTION Figure 5 shows another architecture for implementing a network in which identity and location identification are separated. The architecture divides the network into an access network and a backbone network. The access network is located at the edge of the backbone network and is responsible for accessing all terminals. The backbone network is responsible for routing and forwarding data packets between terminals accessed through the access network. There is no overlap between the access network and the backbone network in the topology relationship. There are two types of identifiers in the network of this architecture: Access Identifier (AID) and Routing Identifier (RID). The AID is the user identity of the terminal, and is used to identify the identity of the terminal user (also referred to as the user). The network uniquely assigns an AID to each terminal user, which is used in the access network and remains unchanged during the movement of the terminal. Change; RID is the location identifier assigned to the terminal, used in the backbone network. In this architecture, the terminal accessing the network may be one or more of a mobile terminal, a fixed terminal, and a nomadic terminal, such as a mobile phone, a fixed telephone, a computer, an application server, and the like. In this architecture, the access network is used to provide the terminal with a layer 2 (physical layer and link layer) access means, and maintains a physical access link between the terminal and the ASN. Possible Layer 2 access methods include: Cellular Mobile Network Technology (Global System for Mobile Communications (GSM) / Code Division Multiple Access (CDMA) / Time Division Synchronous Code Division Multiple Access (Time Division) - Synchronous Code Division Multiple Access (TD-SCDMA) I Wideband Code Division Multiple Access (WCDMA) / Worldwide Interoperability for Microwave Access (WiMAX) / Long Term Evolution (LTE) )), Digital Subscriber Line (DSL), broadband fiber access or Wireless Fidelity (WiFi) access. The backbone network of the architecture is divided into two planes: a generalized forwarding plane and a mapping forwarding plane, and an access service node (ASN) and a certification center. The ASN is a demarcation node of a generalized forwarding plane, a mapping forwarding plane and an access network, and has an interface with an access network, a generalized forwarding plane, and a mapping forwarding plane. It is used to provide access services for the terminal, maintain the connection between the terminal and the network, assign the RID to the terminal, register and register the RID of the terminal to the mapping forwarding plane, maintain the mapping information of the AID-RID, and implement the routing of the data. Forward. The generalized forwarding plane is mainly used for routing and forwarding data packets with the RID as the destination address according to the RID in the data packet. The data routing and forwarding behavior in the generalized forwarding plane is consistent with the traditional IP network. As shown in the figure, the main network elements of the generalized forwarding plane include a common router (CR) and an Interconnect Service Node (ISN). The mapping forwarding plane is mainly used to store the identity location mapping information of the terminal (ie, AID-RID). Mapping information), processing registration and query of the terminal location, routing and forwarding data packets with the AID as the destination address. As shown in the figure, the primary network element of the mapping forwarding plane includes an Identity Location Register/Packet Transfer Function (ILR/PTF). The authentication center is used to record attribute information of the network terminal user of the architecture, such as user category, authentication information, and user service level, and completes access authentication and authorization for the terminal, and may also have a charging function. The certificate authority supports two-way authentication between the terminal and the network, and generates user security information for authentication, integrity protection, and encryption. In another embodiment, the ASN is independent of the backbone network in the division of the architecture, and is located at the boundary node of the backbone network and the access network, and has an interface with the access network and the backbone network, as shown in FIG. 6. The function actually completed is the same as that of FIG. The method and apparatus of this embodiment can be applied to any of the foregoing network architectures. The following is merely an example of an integrated network architecture, but is not intended to limit the present invention.

To prevent the first packet attack, the best way is to effectively control the malicious operation of the user on the ASR. In order to prevent the first packet of DOS or DDOS attacks, the main measures are: Configure the local mapping table hit rate threshold and the number of misses in the ASR, if a user initiates the restriction in the unit time. Define the local mapping table hit ratio (referred to as the hit rate) as follows: Hit rate = the number of packets (referred to as hit packets) of the RID corresponding to the destination AID found in the local AID-RID mapping table sent by the user per unit time. The total number of packets sent by the user per unit time; The following formula is expressed: R = H / ( H + U ) ; where: R ( Rate ) is the hit rate; H ( Hit ) is the number of hit packets sent by the user per unit time; U ( Unhit ) is the user within the unit time The number of data packets (referred to as miss packets) of the RID corresponding to the destination AID is not found in the local AID-RID mapping table. For example, if the total number of data packets sent by a user in one minute is 200, the number of data packets corresponding to the RID corresponding to the destination AID is 180 in the local mapping table. Then, H=180, U=20, R=H/(H+U)=90%, that is to say, in the above case, the user sends a packet with a hit rate of 90%. Generally speaking, users operate on the Internet mainly by browsing web pages, downloading, instant calls, games, etc. These applications have specific communication objects. The general service is to establish a Transmission Control Protocol (TCP) connection first, and then Sending a service data packet, therefore, after establishing a TCP connection, the corresponding business operation is performed, that is, most Internet applications do not send one data packet to one destination address and then change another destination address, even if Only TCP connections are established. The TCP handshake process also requires multiple signaling interactions. Therefore, if a user has a low hit rate, such as less than 50%, its behavior is generally an abnormal range. In addition to the hit rate, the absolute number of missed packets per unit time also needs attention. Because the hit rate is controlled, the malicious user may perceive that the low hit rate attack that simply sends the first packet has been prevented by the system, and may use the first packet and the subsequent packet to detect the hit rate of the ASR setting. Value, thereby further initiating an attack. For example, if the first packet with a different destination address is denoted as F (First), the subsequent packet with the same address as the first packet is recorded as S (Secondary), if ASR is to be The hit rate is configured to be 50%, and a malicious user can repeatedly send the sequence of packets shown in Figure 7. As shown in Figure 7, if a malicious user sends 15 packets in the graph within the unit time, F is the miss packet, S is the hit packet, the number of missed packets U=6, hit The number of quantity packages is H=9, which is calculated according to the hit rate formula: R=H/ ( H + U ) = 60 % , due to The calculated hit rate R = 60 %, which is greater than the hit rate threshold of 50%, can be used by malicious users to initiate a continuous attack. In order to prevent the first packet attack caused by the data packet of such a fixed sequence, on the basis of considering the limitation of the hit rate, the total amount of the first packet to be sent per unit time is further limited. In the specific operation, the unit time can be counted as missing. The number of packets U, if the number of missed packets reaches the specified threshold (the number of misses), it is also considered that the feature of the first packet attack needs to be restricted, for example, in the above fixed sequence scenario, If the number of misses is configured to 180, the user sends 500 packets within a unit time (such as 1 minute), because the miss rate is 1 - 60% = 40%, then the missed packet The absolute number is 500x40% = 200, which exceeds the missed threshold of 180. The ASR also believes that the user has the characteristics of the first packet attack and should be limited. By counting the number of all packets sent by the user and the number of hit packets in the unit time, you can get the average hit rate and the number of misses. According to the average hit rate and the number of misses, you can establish a suitable first-pack attack defense model. Standard hit rate threshold and missed threshold) and control. For example: To establish a suitable standard hit rate, you can count the sum of all packets received by the local user per unit time under the stable operation of ASR, and the sum of all hit packets, using the sum of all hit packets. Divide by the sum of all received packets, get the average hit rate, and adjust the average hit rate appropriately, and adjust by one third as the standard hit rate threshold. In actual use, some errors may need to be corrected due to the user or ASR, which are manifested in the following situations: (1) Special users, for example, some server users who control multiple sensors need to periodically scan each sensor. The sensor acquires data. Since the scan period is usually long, after the completion of one scan, the AID-RID mapping entry of the server may have been overwritten by the next scan, so the service characteristic itself is a scenario with a low hit rate; There are also some broadcast servers, and similar situations exist. Therefore, ASR should set a lower hit rate for these specific users. For this reason, ASR needs to obtain user attribute information from the authentication server or mapping server. If a special user belonging to the server class, especially the server user of the sensor, can reduce the first packet attack. The strength of control.

(2) ASR startup needs to be considered. If ASR has just started, a large number of users have not completed the login, and the mapping table is not fully established, and the hit rate is low. It usually lasts for tens of minutes or hours to stabilize. During this time, ASR should appropriately reduce the control of the first packet attack.

(3) When the system is overloaded, the hit rate and the number of misses should be modified to increase the strength of the first packet attack control, so that ASR can save more processing performance and handle normal services. (4) When the user just logs in to a new ASR, since the mapping relationship of this user's habit has not been established, the hit rate will be low. Therefore, the ASR should appropriately reduce the control strength during the user's login. To implement the method of the present embodiment, it is necessary to add a record of the number of misses U, the number of hits H, and the hit rate R in the context of the user.

FIG. 8 is a schematic structural diagram of an apparatus for preventing a denial of service attack according to the present invention, wherein a first packet attack identification and control unit 806 is the most critical unit, and a hit ratio statistics and modeling unit 808 is an auxiliary unit. Help the device administrator to set the appropriate hit rate threshold and miss threshold. The following describes the role of each unit: User data receiving unit 804, which is set to: Receive the data packet sent by the user, and send the data packet to the local Mapping table query unit 805. The local mapping table querying unit 805 is configured to: query the RID corresponding to the destination AID from the local AID-RID mapping table according to the destination AID included in the received data packet, and send the query result and the data packet to the first packet attack identification. And the control unit 806, the query result is: the data packet is a hit data packet or a miss data packet. The first packet attack identification and control unit 806 is configured to: calculate a hit rate of the user, and correct the hit rate threshold according to the user attribute, the system startup state, the system overload status, whether the user is just logged in, etc., in the user's hit When the rate is lower than the hit rate threshold and/or the number of misses of the user is higher than the number of misses, the user is set to the restricted state; and according to the limitation, the data packet is distributed to the data encapsulation sending unit, or Notify the offsite mapping table to query the unit, or discard the processing. In addition, this unit will interact with the hit rate statistics and modeling unit and the network management human-machine interface to help establish a reasonable standard hit rate threshold. (For specific functions, please refer to the description of Figure 7 and Figure 8 below) The data encapsulation and sending unit 807 is configured to: perform normal encapsulation and forwarding of the hit data packet. The mapping table receiving unit 801 is configured to: receive the mapping table item sent by the mapping server, and update the local mapping table database 802. The local mapping table database 802 is configured to: save a mapping table (AID-RID mapping table) of the user identity and the route identifier, and the table entry is injected into the new mapping table by the mapping table receiving unit, and the mapping entry is aged And the update function, can accept the query request of the local mapping table query unit, and return the query result to the local mapping table query unit 805. The remote mapping table query unit 803 is configured to: according to the recognition result of the first packet attack identification and control unit 806, is responsible for sending the miss data packet to the mapping server by encapsulating into a specific message. The hit rate statistics and modeling unit 808 is configured to: query the query result of the unit 805 according to the local mapping table, and obtain the number of hits and misses of the user from the first packet attack identification and control unit 806, one or The number of all packets sent by multiple users and the number of missed packets, the hit rate is calculated as the average hit rate, and the number of misses counted is taken as the average miss. That is, at regular intervals, an average hit rate is calculated and recorded, and the respective values of the average hit rate from the start-up to the stable are established to form a corresponding hit rate curve, which helps the administrator to set an appropriate hit rate threshold according to the curve. In addition, the hit rate statistics and modeling unit 808 also interacts with the first packet attack identification and control unit 806 to record the highest hit rate, the lowest hit rate for each time period, and count how many users are each under each hit rate. Detailed hit rate statistical model. The network management human-machine interface 809 is configured to: provide a human-machine interface, set a suitable standard hit ratio and a miss threshold for the first packet attack identification and control unit 806, and query the hit ratio statistics and modeling unit 808 for the hit rate of the system. Model, each hit rate model data is provided according to the administrator's needs.

9 is a flow of functions implemented by the first packet attack identification and control unit, including: 901: The first packet attack identification and control unit 806 receives the query result and the data packet of the local mapping table query unit 805; the query result is: the data packet is a hit data. Package or missed packet. 902: Identify, according to a source address of the data packet, a user who sends the data packet, and find a context of the user;

903: The result of the query received from the local mapping table query unit 805 is analyzed. If the result of the query is that the data packet is a miss data packet, step 904 is performed; if the result of the query is that the data packet is a hit data packet, step 909 is performed;

904: increment the number of misses in the user context by a record of one packet, for example, add 1;

905: Determine whether the adjustment period of the user restriction state is reached (the adjustment period can be configured by the operator), if yes, perform a process of adjusting the packet restriction policy (described in FIG. 8); if not, execute step 906; 906: Find the user Context, determine whether the user has been set to the restricted state, and if so, proceed to step 907; if not, execute step 908;

907: According to the packet processing policy configured by the ASR, the corresponding limiting measures, such as dropping the data packet, are terminated;

908: Send the data packet to the remote mapping table query unit, and the query processing unit initiates the query processing of the mapping table to the MS by the remote mapping table query unit, and ends;

909: forward the data packet to the data encapsulation and sending unit 807 for processing;

910: Add 1 to the number of hits H of the user in the user context, and end.

Figure 10 shows the process of adjusting the packet restriction policy by the first packet attack identification and control unit, including:

1001: The first packet attack and identification unit 806 determines, according to the user attribute, whether the user belongs to the server of the sensor or another special user that performs broadcast or multicast transmission. If yes, step 1002 is performed; if not, step 1003 is performed; Attribute, the mapping server or the authentication server is required to transmit the category information of the user to the ASR. To this end, after the ASR registers with the mapping server or requests authentication from the authentication server, the mapping server registers the response message, and the authentication server Authentication response A user attribute field is added to the message, and the user attribute is transmitted to the ASR, and the ASR is recorded in the context of the user for subsequent control.

1002: Configure the user with a special hit rate threshold and a missed threshold. Generally, the server user needs a hit rate that is one level lower than the standard hit rate (for example, about 10% lower). The number of misses is one level higher than the standard number of misses (for example, about 10% higher), allowing the server to perform the first packet transmission operation necessary for the service, and sending a relatively large first packet;

1003: Configure the standard hit rate and miss threshold for the user;

1004: It is determined whether the login time of the user is less than a specified login time threshold (for example, the login time is less than 10 minutes), if it is less than, then step 1005 is performed; if not less, step 1006 is performed;

1005: Decrease the user's hit rate and miss threshold by one level and up one level (such as 10%), allowing the user who just logged in to send a slightly larger first packet, so that the user just logs in. It is not restricted; when the user just logs in, the destination AID that is used to sending has not been mapped in the local mapping table.

RID projects, therefore, users have a low hit rate and a high number of misses in a short period of time. In order to ensure that the logged-in user has a good quality of service, it is necessary to lower the hit rate and the number of misses.

1006: Determine whether the startup time is less than a specified startup time threshold, if yes, execute step 1007; if not, execute step 1008; when the ASR is just started to be used or the ASR is reset and restarted due to a failure, the local AID of the ASR The -RID mapping table is empty. As the user logs in and sends data, the ASR's local mapping table database entries will gradually increase. After a period of time, the users log in normally and send the packets they frequently send. The local mapping table database entry in the ASR will be stabilized, and the subsequent user's hit rate will maintain a relatively high value. Before the ASR local mapping table is stable, the user's hit rate may be lower. Therefore, when ASR sets and adjusts the hit rate, it must consider the impact of ASR just starting. This startup process usually takes several tens of minutes to several hours. The specific time can be set by the operator according to the operation. It can be seen that the ASR startup state is determined to prevent a large number of users from being judged as the first packet attacking user when the ASR starts, resulting in these uses. The user is not working properly, this is a necessary means.

1007: Lower the hit rate to a level and increase the number of misses by one level (such as 10%) to ensure that a large number of newly registered users can operate normally;

1008: Determine whether the system is overloaded. If yes, go to step 1009. If not, execute 1010. When the ASR and other devices are overloaded, you can increase the hit rate and lower the number of misses. The number of first packets allowed by the class users, ensuring that most users can forward them normally. This is a means of guaranteeing the majority of users' services by sacrificing a small number of users. Because the ASR load capacity is high, a small number of first-packet attacks have little effect on ASR. To ensure the quality of service, a looser control can be given. Value, but if the load on the ASR itself is high, strictly limiting the hit rate and the miss value are necessary means to reduce the load on the equipment.

1009: Increase the hit rate by one level according to the overload condition, and lower the number of misses by one level. The adjustment range is about 10%;

1010: Read the number of misses and hits from the context of the user, calculate the hit rate of the user, determine whether the hit rate of the user is lower than a hit rate threshold configured for the user, and/or a miss of the user. Whether the number is higher than the number of misses configured for the user, and if so, step 1011 is performed; if not, step 1012 is performed;

1011: Set the user to the restricted state, count in the user's context, clear the user's hit rate and number of misses, and end;

1012: Checking whether the user history is restricted, determining whether the number of times the user is limited in a period of time is greater than a specified limit number of thresholds. If it is greater than, the user is still set to the restricted state; if less, the The user is set to an unrestricted state.

This step is mainly for some malicious users who may implement intermittent attacks. For such users, if they find that multiple attacks have been sent in their history, they can extend their release time limit, and the malicious users will be restricted for a long time. .

One of ordinary skill in the art can understand that all or part of the above steps can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium, such as read only. Memory, disk or disc, etc. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiment may be implemented in the form of hardware, or may be implemented in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial Applicability The present invention combines hit rate control and miss number control, and combines user type identification, system startup state correction, system overload correction, and user just-registered state correction to prevent denial of service attacks, and the present invention can implement malicious users. The DOS/DDOS attack caused by the frequent sending of the first packet is effectively controlled; the limitation of the first packet attack can be adjusted according to the system startup, system overload, special user, user login, etc., to ensure that the system avoids the first packet in the above special scenario. Users can also use the network normally while attacking.

Claims

Claim

A method for preventing a denial of service attack, comprising: setting a user to a restricted state when a user's hit rate is lower than a hit rate threshold and/or the user's miss is higher than a miss threshold; And determining whether the data packet is a miss data packet, and if the data packet is a miss data packet, querying a status of the user who sent the data packet, and if the user is in a restricted state, discarding the data packet.

2. The method according to claim 1, wherein: the hit ratio is: finding a RID corresponding to the destination AID in a local access identifier (AID)-route identifier (RID) mapping table sent by the user in a unit time. The number of packets divided by the total number of packets sent by the user per unit of time.

3. The method of claim 2, wherein:

The number of misses is the number of data packets of the RID corresponding to the destination AID that are not found in the local AID-RID mapping table sent by the user.

4. The method of claim 3, the method further comprising: adding a record of the number of misses, the number of hits, and the state of the user in the context of the user.

The method according to claim 4, wherein the step of determining whether the data packet is a miss data packet comprises: querying a local AID-RID mapping table according to the destination AID of the data packet, if the destination is not found The RID corresponding to the AID determines that the data packet is a miss data packet, and increments the number of misses stored in the context of the user who sent the data packet by one data packet; if the RID corresponding to the destination AID is found, it is determined. The packet is a hit packet, and a record of the number of hits saved in the context of the user who sent the packet is incremented by one packet.

6. The method of claim 5, wherein: the step of setting the user to the restricted state comprises: determining whether the user restricted state is reached The entire period, if yes, reads the number of misses and hits from the context of the user, calculates the hit rate of the user, and determines whether the hit rate of the user is lower than the hit rate threshold and/or configured for the user. Whether the number of misses of the user is higher than the number of misses configured for the user, and if so, the user is set to the restricted state and counted in the record of the user state in the context of the user.

7. The method according to claim 6, wherein the method further comprises: if it is determined that the hit rate of the user is not lower than a hit rate threshold configured for the user and/or the number of misses of the user is not higher than If the number of misses configured for the user is greater than, the number of times the user is limited in a period is greater than a limit number of thresholds. If it is greater than, the user is still set to the restricted state; if less, the The user is set to an unrestricted state.

8. The method of claim 6, wherein after the step of calculating a hit rate of the user, the method further comprises: clearing a record of the number of misses and hits in the context of the user.

9. The method of claim 7, wherein determining whether the user's hit rate is not lower than a hit rate threshold configured for the user and/or whether the number of misses of the user is not higher than configured for the user Before the step of missing the threshold value, the method further includes: determining, according to the user attribute, whether the user belongs to a special server user, and if so, lowering the standard hit rate threshold by one level, and increasing the standard miss number threshold One level is configured as the user's hit rate threshold and the number of misses; if not, the standard hit rate threshold and the standard miss threshold are respectively configured as the user's hit rate threshold and the number of misses. value.

10. The method of claim 9, wherein determining whether the user's hit rate is not lower than a hit rate threshold configured for the user and/or whether the number of misses of the user is not higher than configured for the user Before the step of missing the threshold, the method further includes: determining whether the login time of the user is less than a specified login time threshold, and if less than, lowering the hit ratio configured for the user by one level, The number of misses for this user configuration is increased by one level.

The method according to claim 10, wherein it is determined whether the hit rate of the user is not lower than a hit rate threshold configured for the user and/or whether the number of misses of the user is not higher than that for the user. Before the step of setting the number of misses, the method further includes: determining whether the startup time is less than a specified startup time threshold, and if less than, lowering the hit ratio configured for the user by one level, which will be The number of user-configured misses is increased by one level.

12. The method of claim 11, wherein determining whether the user's hit rate is not lower than a hit rate threshold configured for the user and/or whether the number of misses of the user is not higher than configured for the user Before the step of missing the threshold, the method further includes: determining whether the system is overloaded, and if so, lowering the hit rate configured for the user by one level, and increasing the number of misses configured for the user One level.

13. The method according to claim 9, wherein the standard hit rate threshold and the standard miss threshold are obtained by: counting the number of all packets sent by one or more users in a unit time period. The number of missed packets, the hit rate is calculated as the average hit rate, the number of misses is counted as the average miss, and the average hit rate and the average number of misses are adjusted as the standard hit rate threshold. And standard misses.

14. The method of claim 9, wherein: the user attribute is stored in a mapping server or an authentication server; the method further comprising: after registering the user with the mapping server, the mapping server is in the registration response message Adding a user attribute field to the user attribute; or after requesting the authentication server to authenticate the user, the authentication server adds a user attribute field to the authentication response message, and delivers the user attribute.

A device for preventing a denial of service attack, comprising: a user data receiving unit, a local mapping table query unit, and a first packet attack identification and control unit, wherein: the user data receiving unit is configured to: receive a data packet sent by a user, Sending the received data packet to the local mapping table query unit; the local mapping table query unit is set to: a local access identifier (AID) - a route identifier (RID) in the mapping table, querying the RID corresponding to the destination AID of the received data packet, and sending the query result and the data packet to the first packet attack identification and control unit; the first packet attack identification and control unit is set as: When the user's hit rate is lower than the hit rate threshold and/or the user's miss is higher than the miss threshold, the user is set to the restricted state; and the received packet is judged according to the received query result. When the packet is missed, the status of the user who sent the packet is queried, and if the user is in the restricted state, the packet is discarded.

16. The apparatus according to claim 15, wherein: the hit ratio is: the number of data packets of the RID corresponding to the destination AID found in the local AID-RID mapping table sent by the user per unit time divided by the unit time The total number of data packets sent by the user; the number of misses is the number of data packets sent by the user in the local AID-RID mapping table that are not found in the local AID-RID mapping table.

17. The apparatus of claim 16, wherein: the first packet attack identification and control unit is further configured to: add a record of a miss number, a hit number, and a user state in a context of the user; and based on the received When the query result determines that the received data packet is a miss data packet, the number of misses saved in the context of the user who sent the data packet is incremented by one data packet; and the received data packet is judged according to the received query result. When a packet is hit, a record of the packet is incremented by the number of hits saved in the context of the user who sent the packet.

18. The apparatus according to claim 17, wherein: the first packet attack identification and control unit is further configured to: determine whether an adjustment period of the user restriction state is reached before performing the querying the state of the user who sent the data packet If yes, read the number of misses and hits from the context of the user, calculate the hit rate of the user, determine whether the hit rate of the user is lower than the hit rate threshold configured for the user, and/or the user Whether the number of misses is higher than the number of misses configured for the user, and if so, the user is set to the restricted state and counted in the record of the user state in the context of the user; After the first packet attack identification and control unit calculates the hit rate of the user, it is further set to: clear the record of the number of misses and hits in the context of the user.

19. The apparatus of claim 18, wherein: the first packet attack identification and control unit is further configured to: if it is determined that the user's hit rate is not lower than a hit rate threshold configured for the user and/or the user If the number of misses is not higher than the number of misses configured for the user, it is further determined whether the number of times the user is limited in a period is greater than a limit number of thresholds. If greater than, the user is still set to the restricted state. ; If less than, sets the user to an unrestricted state.

20. The apparatus of claim 19, wherein: the first packet attack identification and control unit is further configured to: determine whether the user's hit rate is lower than a hit rate threshold configured for the user and/or the user's If the number of misses is higher than the number of misses configured for the user, it is also determined according to the user attribute whether the user belongs to a special server user. If yes, the standard hit rate is reduced by one level, and the standard is missed. The threshold value is increased by one level to be configured as the user's hit rate threshold and the missed threshold; if not, the standard hit rate threshold and the standard miss threshold are respectively configured as the user's hit rate threshold and The number of misses is wide.

The device according to claim 20, wherein: the first packet attack identification and control unit is further configured to: determine whether the login time of the user is less than a specified login time threshold, and if less than, the user will be the user The configured hit rate threshold is lowered by one level, and the number of misses configured for the user is increased by one level.

22. The apparatus according to claim 21, wherein: the first packet attack identification and control unit is further configured to: determine whether a startup time is less than a specified startup time threshold, and if less, a hit configured for the user Decreasing the rate value by one level will increase the level of the number of misses configured for the user by one level.

23. Apparatus according to claim 22 wherein: The first packet attack identification and control unit is further configured to: determine whether the system is overloaded, and if so, reduce the hit rate threshold configured for the user by one level, and increase the number of misses configured for the user by one. grade.

24. The apparatus of claim 20, wherein the apparatus further comprises a hit rate statistics and modeling unit; the hit rate statistics and modeling unit is configured to: count all packets sent by one or more users per unit time The number of misses and the number of missed packets, the hit rate is calculated as the average hit rate, and the number of misses counted is taken as the average miss.