WO2011110079A1

WO2011110079A1 - Message forwarding method for avoiding network attacks and gateway

Info

Publication number: WO2011110079A1
Application number: PCT/CN2011/071597
Authority: WO
Inventors: 胡玉胜; 秦欣
Original assignee: 华为技术有限公司
Priority date: 2010-08-31
Filing date: 2011-03-08
Publication date: 2011-09-15
Also published as: CN101917450A; CN101917450B

Abstract

The embodiments of the present invention provide a message forwarding method and gateway for avoiding network attacks. Said method includes: when receiving an uplink message transmitted from a client, judging whether said uplink message is an Internet Control Message Protocol (ICMP) unreachable message; if said uplink message is not an ICMP unreachable message, setting a downlink message token counter as full; judging whether an uplink message token counter is equal to zero; if the uplink message token counter is equal to zero, discarding said uplink message; and if the uplink message token counter is not equal to zero, subtracting one from the numerical value of the uplink message token counter and forwarding said uplink message to a server side. Through a token mechanism, the method and gateway provided by the embodiments of the present invention monitor the forwarding procedure of stream-based uplink and downlink messages and avoid the situation of any excessive unidirectional packet transmission.

Description

Message forwarding method and gateway for preventing network attacks

This application claims priority to Chinese Patent Application No. 201010270874.0, entitled "Message Forwarding Method and Gateway for Preventing Cyber Attacks", filed on August 31, 2010, the entire contents of which are incorporated by reference. In this application. Technical field

The present invention relates to network attacks, and in particular, to a packet forwarding method and a gateway for preventing network attacks. Background technique

Over Billing is a common method of network attack. The principle is that the server on the Internet uses the IP address of the client it detects to penetrate the firewall through the established connection with the client. The terminal sends a large number of packets, causing the client to be incorrectly charged. At this time, the client will be charged more and cause the user's complaint.

In order to solve this problem, the QoS guarantee technology can be used to perform downlink traffic limiting on the gateway side according to the QoS subscription of the client, so that the packets exceeding the QoS sent by the server will be discarded. However, if the QoS of the subscription is large, then The server can still send a lot of downlink messages, and the billing still has a large error. Therefore, at present, the gateway is connected to the firewall. In this mode, the gateway notifies the user of the online status of the user to the firewall. The firewall clears the flow related to the IP address of the user who has been offline. If the user uses the IP address again, the connection initiated by the server will be invalid, and the packet cannot be downlinked, thus protecting the user. However, this method still has the following drawbacks: 1. For online users, there is no good way to block malicious downstream traffic; 2. The development of custom interfaces of gateway devices and firewalls is required, and it is difficult to use between devices of different manufacturers. . Summary of the invention

The embodiment of the invention provides a packet forwarding method and a gateway for preventing network attacks, so as to avoid malicious charging caused by an Over Billing attack initiated by the network side, and improve the terminal user's Experience.

The above object of the embodiment of the present invention is achieved by the following technical solutions:

A packet forwarding method for preventing a network attack, where the method includes:

When receiving the uplink packet sent by the client, determining whether the uplink packet is an ICMP unreachable packet;

If the uplink packet is not an ICMP unreachable packet, the downlink packet token counter is full;

Determine whether the uplink packet token counter is zero;

If the uplink packet token counter is zero, discarding the uplink packet;

If the uplink packet token counter is not zero, the uplink packet token counter is decremented by one, and the uplink packet is forwarded to the server.

A gateway, the gateway includes:

The receiving unit is configured to receive an uplink packet sent by the client, or a downlink packet sent by the server;

The logic unit is configured to: when the receiving unit receives the uplink message sent by the client, determine whether the uplink message is an ICMP unreachable message; and when the uplink message is not an ICMP unreachable message, , determining whether the uplink message token counter is zero;

a processing unit, configured to: when the result of the determining that the uplink packet is not an ICMP unreachable packet, the downlink packet token counter is full; and the result of the logical unit is an uplink packet When the token counter is zero, the uplink packet is discarded, or when the logical unit determines that the uplink packet token counter is not zero, the uplink packet token counter is decremented by one;

And a sending unit, configured to: when the result of the determining by the logical unit is that the uplink packet token counter is not zero, forwarding the uplink packet to the server.

When receiving the downlink packet sent by the server, the uplink packet token counter is filled. Determine whether the downlink message token counter is zero;

If the downlink packet token counter is zero, discarding the downlink packet;

If the downlink packet token counter is not zero, the downlink packet token counter is decremented by one, and the downlink packet is forwarded to the client. The method and the gateway provided by the embodiment of the present invention monitor the forwarding process of the flow-based uplink and downlink packets through a token mechanism, and prevent any one-way over-delivery. DRAWINGS

The drawings described herein are provided to provide a further understanding of the invention and are in no way of limitation. In the drawing:

1 is a schematic diagram of a network architecture applied to a gateway according to an embodiment of the present invention;

2 is a flow chart of a method according to an embodiment of the present invention;

3 is a flowchart of a method according to another embodiment of the present invention;

FIG. 4 is a structural block diagram of a gateway according to an embodiment of the present invention. detailed description

In order to make the objects, technical solutions and advantages of the embodiments of the present invention more clearly, the embodiments of the present invention will be described in detail below with reference to the embodiments and drawings. The illustrative embodiments of the present invention and the description thereof are intended to explain the present invention, but are not intended to limit the invention.

FIG. 1 is a schematic diagram of a network architecture of a packet forwarding method for preventing network attacks according to the embodiment. Referring to FIG. 1 , the network architecture includes a client UE and a server Serve at a gateway GGSN. The number of downlink packets allowed by the server in each uplink packet may be set in advance, that is, the number of downlink packet token counters may be set in advance, and the deep packet parsing may be performed after receiving the uplink packet. The DPI) capability knows the service type, and defines the number of downlink packets allowed by each server in each uplink packet by referring to the service type. That is, the number of downlink packet token counters is set according to this, for example, the HTTP link can be set to allow downlink. The number of packets is 5, and for example, the link of RTSP, the number of allowed downlink packets is set. If the number of the downlink packet token counter is set in advance, if the uplink packet is received, the DPI capability is used to learn the service type, and the downlink packet token counter is referenced by referring to the service type. The number is adjusted. If the above defined value is exceeded, it is discarded at the gateway GGSN. This can block the server from over-sending the message regardless of the client's response capability. Similarly, in the gateway GGSN, the number of uplink packets allowed by each downlink packet may be set in advance, that is, the number of uplink packet token counters may be preset; or deep packet parsing may be used ( The DPI) capability learns the service type, and defines the number of uplink packets allowed by each downlink packet according to the service type, that is, sets the number of uplink packet token counters according to this, for example, the HTTP link can be set to allow uplink. The number of packets is 5, and for example, the link of the RTSP is set to 10, and the number of uplink packets allowed is 10; if the number of uplink token counters is set in advance, if the downlink packet is received, Then, the DPI capability is used to learn the service type, and the number of the uplink packet token counter is adjusted according to the service type. If this value is exceeded, it is also discarded at the gateway GGSN. This prevents the client from sending too many packets to the server.

FIG. 2 and FIG. 3 are flowcharts of a packet forwarding method for preventing network attacks according to an embodiment of the present invention. The method is applied to a gateway, and the gateway monitors flow information established by a client in a process of using a service, for example, TCP ( The Transmission Control Protocol (UDP) and the UDP (User Datagram Protocol) detect the number of upstream and downstream packets and use the uplink/downlink packets as tokens to control packet forwarding. among them:

FIG. 2 is a flowchart of a packet forwarding method for preventing a network attack according to an embodiment of the present invention. When a gateway receives an uplink packet sent by a client, the method includes:

Step 201: Determine whether the uplink packet is an ICMP unreachable packet;

If a malicious packet is sent to the downstream device, for example, the server sends a packet to the client frequently, regardless of the responsiveness of the client, the packet is likely to be a malicious packet, which may result in an uplink ICMP unreachable packet. . For example, the downlink packet sent from the server is sent to the client. If the client does not listen to the port and considers it to be an illegal packet, it sends back to the server. An ICMP unreachable message.

Step 202: If the uplink packet is not an ICMP unreachable packet, determine whether the uplink packet token counter is zero.

As described above, in this embodiment, the number of the uplink packet token counters may be set according to the foregoing three methods to count the packet forwarding status. If the number of the uplink packet token counters is zero, It means that too many uplink messages are sent, and the uplink should be stopped.

Step 203: If the uplink packet token counter is zero, discard the uplink packet, and then fill the downlink packet token counter.

If the upstream packet token counter is zero and the uplink needs to be stopped, the upstream packet can be discarded. If there is an uplink packet, the downlink packet token counter is also filled, indicating that the downlink packet can be smoothly passed. The process of filling the downlink packet token counter can also be performed in the step. In the 202, the embodiment is not limited thereto.

As described above, in this embodiment, the number of the downlink packet token counters may be set according to the foregoing three methods to count the packet forwarding conditions.

Step 204: If the uplink packet token counter is not zero, the uplink packet token counter is decremented by one, then the downlink packet token counter is full, and the uplink packet is forwarded to the server. .

If the uplink packet token counter is not zero, the uplink packet can be sent to the server at the same time, and the uplink packet token counter is decremented by one, indicating that the uplink packet can be sent. The uplink message has been reduced by one. Similarly, since there is an uplink packet, the downlink packet token counter is also full, indicating that the downlink packet can be smoothly passed, and the process of filling the downlink packet token counter can also be placed. In the step 202, the embodiment is not limited thereto.

In this embodiment, according to the judgment result of step 201, if the uplink packet is an ICMP unreachable packet, as described above, it may indicate that a malicious packet may appear in the downlink, and the downlink packet token counter is cleared. Zero, that is, the forwarding of downstream packets is prohibited. The method in this embodiment is applicable not only to the TCP stream but also to the UDP stream, and details are not described herein again.

In the current state, the gateway acts as a forwarding device, and does not pay attention to the health status of the packet flow. This causes the client to inevitably receive malicious packets, and the client can only passively respond to packet loss. The method provided enables the gateway to determine whether the packet flow is normal, and to drop packets before the gateway charges, thereby reducing the charging error.

FIG. 3 is a flowchart of a packet forwarding method for preventing a network attack according to an embodiment of the present invention. When a gateway receives a downlink packet sent by a server, it should be noted that the method in this embodiment may be performed separately. The method of the embodiment shown in FIG. 2 can be used in combination with the method shown in FIG. 2, which is not limited thereto, and is not limited to the sequence when the method of the embodiment shown in FIG. 2 is used. Referring to Figure 3, the method includes:

Step 301: Determine whether the downlink message token counter is zero;

As described above, in this embodiment, the number of the downlink packet token counters may be set according to the foregoing three methods to count the packet forwarding situation. If the number of the downlink packet token counters is zero, It means that too many downlink messages are sent, and the downlink should be stopped.

Step 302: If the downlink packet token counter is zero, discard the downlink packet, and then fill the uplink packet token counter.

If the downstream packet token counter is zero and the downlink needs to be stopped, the downlink packet can be discarded. If there is a downlink packet, the uplink packet token counter is also full, indicating that the uplink packet can be smoothly passed. The process of filling the uplink packet token counter can also be received at the gateway. The downlink packet sent by the server is executed. This embodiment is not limited thereto.

As described above, in this embodiment, the number of the uplink packet token counters may be set according to the foregoing three methods to count the packet forwarding conditions.

Step 303: If the downlink packet token counter is not zero, the downlink packet token counter is decremented by one, and then the uplink packet token counter is full, and the downlink packet is forwarded to the guest. Account.

If the downlink packet token counter is not zero, it indicates that the downlink packet can continue to be sent. Then, the downlink packet is forwarded to the client end, and the downlink packet token counter is decremented by one. The number of downlink messages sent has been reduced by one. Similarly, since there is a downlink packet, the uplink packet token counter is also full, indicating that the uplink packet can be smoothly passed. The process of filling the uplink packet token counter can also be performed at the gateway. It is executed when receiving the downlink packet sent by the server. This embodiment is not limited thereto.

The method in this embodiment is applicable not only to the TCP stream but also to the UDP stream, and will not be described again here.

The method provided by the embodiment of the present invention monitors the forwarding process of the flow-based uplink and downlink packets by using a token mechanism, and solves the one-way excessive uplink and downlink by processing the uplink and downlink packet processes. The problem prevents any one-way over-delivery situation. Since this mechanism is implemented stream by stream, it does not affect the normal traffic delivery of the user. Moreover, since the scheme can be implemented by simply performing a simple counting and judgment, the implementation is simple.

4 is a block diagram of a gateway according to an embodiment of the present invention. Referring to FIG. 4, the gateway includes: a receiving unit 41, configured to receive an uplink packet sent by a client, or a downlink packet sent by a server;

The uplink packet sent by the client or the downlink packet sent by the server is the transmission control protocol packet or the user data packet protocol packet.

The logic unit 42 is configured to determine, when the receiving unit 41 receives the uplink packet sent by the client, whether the uplink packet is an ICMP unreachable packet, and when the uplink packet is not an ICMP unreachable packet. , determining whether the uplink message token counter is zero; The processing unit 43 is configured to: when the result of the determination by the logic unit 42 is that the uplink packet is not an ICMP unreachable packet, the downlink packet token counter is full; and the result of the logic unit 42 is an uplink packet command. When the card counter is zero, the uplink message is discarded, or when the result of the logic unit 42 is that the uplink message token counter is not zero, the uplink message token counter is decremented by one;

The sending unit 44 is configured to forward the uplink packet to the server when the judgment result of the logic unit 42 is that the uplink packet token counter is not zero.

In one embodiment, the processing unit 43 is further configured to clear the downlink message token counter when the result of the determination by the logic unit 42 is that the uplink message is an ICMP unreachable message.

In one embodiment:

The logic unit 42 is further configured to: when the receiving unit 41 receives the downlink packet sent by the server, determine whether the downlink packet token counter is zero;

The processing unit 43 is further configured to: when the receiving unit 41 receives the downlink packet sent by the server, fill the uplink packet token counter; and when the logic unit 42 determines that the downlink packet token counter is zero, Discarding the downlink packet, or decrementing the downlink packet token counter by one when the logic unit 42 determines that the downlink packet token counter is not zero;

The sending unit 44 is further configured to forward the downlink message to the client.

In an embodiment, the gateway further includes:

The setting unit 45 is configured to preset the number of the uplink packet token counter and the number of the downlink packet token counter; or, the receiving unit 41 receives the uplink packet sent by the client or the downlink sent by the server. After the text, the deep packet parsing capability is used to learn the service type, and the reference service type is used to set the number of the uplink packet token counter or the number of the downlink packet token counter; or, the number of the uplink packet token counter is preset. And the number of the downlink packet token counters, after receiving the uplink packet sent by the client or the downlink packet sent by the server, using the deep packet parsing capability to learn the service type, and adjusting the uplink packet according to the service type. The number of token counters or the number of the downlink message token counters to provide to the logical unit 42 judges the number of messages and provides a reset to the processing unit 43 for the values.

The components of the gateway in this embodiment are respectively used to implement the steps of the foregoing method. Since the steps have been described in detail in the method embodiments, details are not described herein.

The gateway provided by the embodiment of the present invention monitors the forwarding process of the flow-based uplink and downlink packets through a token mechanism, and solves the one-way excessive uplink and downlink by processing the uplink and downlink packet processes. The problem prevents any one-way over-delivery situation. Since this mechanism is implemented stream by stream, it does not affect the normal traffic delivery of the user. Moreover, since the scheme can be implemented by simply performing a simple counting and judgment, the implementation is simple.

The specific embodiments of the present invention have been described in detail with reference to the preferred embodiments of the present invention. The scope of the invention, any modifications, equivalents, improvements, etc., made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

Rights request

A packet forwarding method for preventing a network attack, the method includes: when receiving an uplink packet sent by a client, determining whether the uplink packet is an ICMP unreachable packet;

Determine whether the uplink packet token counter is zero;

If the uplink packet token counter is zero, discarding the uplink packet;

2. The method of claim 1 wherein:

If the uplink packet is an ICMP unreachable packet, the downlink packet token counter is cleared.

The method according to claim 1, wherein the method further comprises: when receiving the downlink packet sent by the server, filling the uplink packet token counter; determining the downlink packet token counter Whether it is zero;

If the downlink packet token counter is zero, discarding the downlink packet;

If the downlink packet token counter is not zero, the downlink packet token counter is decremented by one, and the downlink packet is forwarded to the client.

The method according to claim 3, wherein the uplink packet or the downlink packet is a transmission control protocol packet or a user data packet protocol packet.

The method according to claim 3, wherein the method further comprises: presetting the number of uplink message token counters and the number of downlink message token counters; or The number of devices or the number of downlink message token counters; or

The number of the uplink packet token counters and the number of the downlink packet token counters are set in advance. After receiving the uplink packets sent by the client or the downlink packets sent by the server, the service is learned by using the deep packet parsing capability. The type of the uplink packet token counter or the number of the downlink packet token counter is adjusted according to the service type.

A packet forwarding method for preventing a network attack, the method comprising: when receiving a downlink packet sent by a server, filling an uplink packet token counter; determining a downlink packet token Whether the counter is zero;

If the downlink packet token counter is zero, discarding the downlink packet;

The method according to claim 6, wherein the downlink message is a transmission control protocol message or a user data packet protocol message.

The method according to claim 6, wherein the method further comprises: presetting the number of uplink message token counters and the number of downlink message token counters; or

After receiving the uplink packet sent by the client or the downlink packet sent by the server, the deep packet parsing capability is used to learn the service type, and the number of the uplink packet token counter or the downlink packet token counter is set according to the service type. Number of; or

A gateway, wherein the gateway comprises:

The receiving unit is configured to receive an uplink packet sent by the client, or a downlink packet sent by the server; The logic unit is configured to: when the receiving unit receives the uplink message sent by the client, determine whether the uplink message is an ICMP unreachable message; and when the uplink message is not an ICMP unreachable message, , determining whether the uplink message token counter is zero;

10. The gateway of claim 9 wherein:

The processing unit is further configured to: when the determining result of the logic unit is that the uplink packet is an ICMP unreachable packet, clear the downlink packet token counter.

11. The gateway of claim 9 wherein:

The logic unit is further configured to: when the receiving unit receives the downlink packet sent by the server, determine whether the downlink packet token counter is zero;

The processing unit is further configured to: when the receiving unit receives the downlink packet sent by the server, fill the uplink packet token counter; and the judgment result in the logic unit is that the downlink packet token counter is Zero-time, discarding the downlink packet, or decrementing the downlink packet token counter by one when the logic unit determines that the downlink packet token counter is not zero; the sending unit is further configured to: Forwarding the downlink packet to the client.

The gateway according to claim 11, wherein the receiving device receives the uplink packet sent by the client or the downlink packet sent by the server is a transmission control protocol packet or a user data packet protocol packet. .

The gateway according to claim 9, wherein the gateway further comprises: a setting unit, configured to preset a number of uplink packet token counters and a downlink packet order The number of the card counters; or, after receiving the uplink message sent by the client or the downlink message sent by the server, the receiving unit uses the deep packet parsing capability to learn the service type, and sets the uplink message according to the service type. The number of the card counters or the number of the downlink packet token counters; or, the number of the uplink packet token counters and the number of the downlink packet token counters are set in advance, and the uplink packets sent by the client are received. Or, after the downlink packet sent by the server, the service type is obtained by using the deep packet parsing capability, and the number of the uplink packet token counter or the number of the downlink packet token counter is adjusted according to the service type.