WO2014090022A1

WO2014090022A1 - Method and apparatus for recognizing dhcp server

Info

Publication number: WO2014090022A1
Application number: PCT/CN2013/084535
Authority: WO
Inventors: 闫立俊
Original assignee: 华为技术有限公司
Priority date: 2012-12-10
Filing date: 2013-09-27
Publication date: 2014-06-19
Also published as: CN103873431A

Abstract

The present invention relates to a method and an apparatus for recognizing a dynamic host configuration protocol (DHCP) server. The method comprises: broadcasting a DHCP Discover message in a virtual machine subnetwork, where the virtual machine subnetwork comprises a plurality of virtual machines and one virtual switch, the plurality of virtual machines is created from physical resources on a host, and the virtual machine subnetwork further comprises at least one valid DHCP server for providing the virtual machine with an IP address; receiving a DHCP Offer message, where the DHCP Offer message comprises address information of a first DHCP server; and acquiring the address information of the first DHCP server, and according to the address information of the first DHCP server, and recognizing whether the first DHCP server is an invalid DHCP server. The embodiments of the present invention implement recognition of a DHCP Server in a physical machine environment and virtualized environment.

Description

Dynamic host configuration protocol server identification method and device

The present invention relates to the field of communications, and in particular, to a method and apparatus for identifying a dynamic host configuration protocol DHCP server. Background technique

In the field of communication, computers connected to the Internet must have their own IP addresses when communicating with other computers. However, due to limited IP address resources, it is not possible to configure a fixed IP address for each host connected to the Internet. Configure a temporary IP address for the host connected to the network using the Dynamic Host Configuration Protocol (DHCP).

The DHCP service facilitates network management. However, since the basic DHCP protocol is a broadcast protocol, the security is relatively low. Some fake DHCP servers (Servers) can respond to the client's IP address allocation request and allocate it after receiving the broadcast message. The Domain Name System (DNS) address, in order to allow client users to access malicious websites. In the prior art, the physical switch is configured with a DHCP snooping function, and the port corresponding to the DHCP server is set as a trusted port, and the other ports are set as untrusted ports, and only the trusted port is allowed to respond through DHCP. The prior art can solve the problem of DHCP server identification in a physical machine environment. However, in a virtual machine environment, when two virtual machines on the same physical machine communicate, one of the virtual machines is installed with a DHCP server, and between the virtual machines. The communication process is performed by the virtual switch on the host, and the communication process does not pass through the physical switch. Therefore, the prior art cannot solve the problem of identifying the DHCP server in the virtualized environment. Summary of the invention The embodiment of the invention provides a method and a device for identifying a DHCP server to implement identification of a DHCP server in a virtualized environment.

In a first aspect, an embodiment of the present invention provides a method for identifying a DHCP server, where the method includes:

The DHCP security module broadcasts a DHCP Di scover message to the virtual machine subnet, where the virtual machine subnet includes multiple virtual machines and one virtual switch, and the multiple virtual machines are configured by one main message, and the virtual machine subnet The method further includes at least one legal DHCP server providing an IP address for the virtual machine;

Receiving a DHCP Offer message, the DHCP Offer message is sent after the first DHCP server in the virtual machine subnet receives the DHCP Di s cover message, and the DHCP Offer message includes address information of the first DHCP server. ;

Obtaining the address information of the first DHCP server, and identifying, according to the address information of the first DHCP server, whether the first DHCP server is an illegal DHCP server.

In a first possible implementation, the identifying whether the first DHCP server is illegal

After the DHCP server, the method further includes: performing alarm processing on the illegal first DHCP server if the first DHCP server is an illegal DHCP server. With reference to the first possible implementation manner of the first aspect, in a second possible implementation, the determining, according to the address information of the first DHCP server, whether the first DHCP server is an illegal DHCP server includes: Comparing the address information of the first DHCP server with the address information of the preset legal DHCP server. If the address information of the first DHCP server is different from the address information of the preset legal DHCP server, Identifying that the first DHCP server is an illegal DHCP server.

In conjunction with the second possible implementation of the first aspect, in a third possible implementation, the method further includes: pre-setting a DHCP server list, where the DHCP server list includes address information of a legal DHCP server.

In conjunction with the first possible implementation of the first aspect, in a fourth possible implementation, The address information is an IP address and a MAC address, and the performing the alarm processing on the illegal first DHCP server includes: obtaining, according to the IP address of the illegal first DHCP server, the illegal first DHCP server The host name is used to perform alarm processing on the host name of the illegal first DHCP server.

With reference to the first aspect, in a fifth possible implementation, the address information is an IP address and

The MAC address, the method further includes: disabling an IP address or a MAC address of the illegal first DHCP server in the virtual machine subnet.

With reference to the first aspect, or the first, second, third, fourth, and fifth possible implementation manners of the first aspect, in a sixth possible implementation manner, the receiving the first DHCP After the DHCP Offer message returned by the server, the method further includes: sending a DHCP request message to the first DHCP server, where the DHCP request message carries an invalid DHCP server address information, and is used to end the DHCP session.

In a second aspect, the embodiment of the present invention further provides a device for identifying a DHCP server, where the device includes:

a sending unit, configured to broadcast a DHCP D i scover message to the virtual machine subnet, where the virtual machine subnet includes multiple virtual machines and one virtual switch, where the multiple virtual machines are configured by physical resources on one host The virtual machine is configured to communicate with each other by using the virtual switch, and the virtual machine subnet further includes at least one legal DHCP server to provide an IP address for the virtual machine.

a receiving unit, configured to receive a DHCP Offer message, where the DHCP Offer message is sent after the first DHCP server in the virtual machine subnet receives the DHCP Di scover message, where the DHCP Offer message includes the first DHCP Address information of the server, transmitting the DHCP Offer message to the processing unit;

a processing unit, configured to receive the DHCP Offer message sent by the receiving unit, obtain address information of the first DHCP server, and identify, according to the address information of the first DHCP server, whether the first DHCP server is Illegal DHCP server. In a first possible implementation manner, the processing unit is further configured to: perform alarm processing on the illegal first DHCP server if the first DHCP server is an illegal DHCP server.

With reference to the second aspect, in a second possible implementation, the processing unit is specifically configured to: compare address information of the first DHCP server with address information of a preset legal DHCP server, if If the address information of the first DHCP server is inconsistent with the address information of the preset legal DHCP server, the first DHCP server is identified as an illegal DHCP server.

With reference to the second possible implementation of the second aspect, in a third possible implementation, the device further includes: a preset unit, configured to preset a DHCP server list, where the DHCP server list includes the The address information of a legitimate DHCP server.

With the first possible implementation of the second aspect, in a fourth possible implementation, the address information is an IP address and a MAC address, and the processing unit is specifically configured to: according to the illegal first DHCP The IP address of the server is obtained, and the host name corresponding to the illegal first DHCP server is obtained, and the host name of the illegal first DHCP server is alarmed.

With reference to the second aspect, in a fifth possible implementation, the address information is an IP address and

The processing unit is further configured to: disable an IP address or a MAC address of the illegal first DHCP server in the virtual machine subnet.

With reference to the second aspect, or the first, second, third, fourth, and fifth possible implementation manners of the second aspect, in the sixth possible implementation manner, the sending unit is further used And sending a DHCP request message to the first DHCP server, where the DHCP request message carries an invalid DHCP server address information, used to end the DHCP session.

The method and device for identifying a DHCP server provided by the embodiment of the present invention, the DHCP security module broadcasts a DHCP Di scover message to the virtual machine subnet, where the virtual machine subnet includes multiple virtual machines and one virtual switch, The virtual machine is created by a physical resource on a host, and includes at least one legal DHCP server to provide an IP address for the virtual machine; receiving DHCP The Offer message, the DHCP Offer message is sent after the first DHCP server in the virtual machine subnet receives the DHCP Di s cover message, and the DHCP Offer message includes address information of the first DHCP server; The address information of the first DHCP server is used to identify whether the first DHCP server is an illegal DHCP server according to the address information of the first DHCP server. The identification device of the DHCP server and the DHCP server can be run in the operating system of the virtual machine. Therefore, the embodiment of the present invention can identify an illegal DHCP server in the virtualized environment, and perform alarm processing on the identified illegal DHCP server, thereby improving Network security. DRAWINGS

FIG. 1 is a schematic diagram of an application scenario of a method for identifying a DHCP server according to an embodiment of the present disclosure;

2 is a flowchart of a method for identifying a DHCP server according to an embodiment of the present invention; FIG. 3 is a schematic diagram of information interaction of a method for identifying a DHCP server according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of a device for identifying a DHCP server according to an embodiment of the present invention; FIG. 5 is a schematic diagram of another apparatus for identifying a DHCP server according to an embodiment of the present invention. detailed description

In the following description, for purposes of illustration and description, reference reference However, well-known devices, circuits, and methods are omitted in the description of the present invention in order to avoid obscuring the description of the present invention.

FIG. 1 is a schematic diagram of an application scenario of a method for identifying a DHCP server according to an embodiment of the present invention. The method and device for identifying a DHCP server provided by the embodiment of the present invention can be applied to a plurality of virtual machines and multiple virtual machines in a physical host/server as a new identification method. The virtual machine forms at least one virtual machine subnet, and each virtual machine subnet internally includes a virtual switch scenario. As shown in Figure 1, there are multiple virtual machines in the physical host, namely virtual machine 1, virtual machine 2, and virtual machine n. Each virtual machine is built on the virtualization platform inside the host. The virtualization platform is each. The host provides processor resources, hard disk resources, memory resources, and network card resources. The network card of the virtual machine is connected to the network card of the host through the network card driver in the management module. Of course, the host also includes a hardware platform including a processor, a hard disk, a memory, and a network card. The IP address can be configured via DHCP before the physical host interacts. In order to ensure that the IP address provided by the illegal DHCP server is not used, that is, the illegal DHCP server is identified, the present invention also provides a DHCP security module, which may be located in a virtual machine of the host, or may be located in the host. The management module can also be located in other hosts. The DHCP security module broadcasts a DHCP Di scover (DHCP Discovery) message in a subnet formed by multiple virtual machines, and determines whether the DHCP server that sends the DHCP message is determined by the IP address carried in the received DHCP Offer message. Is an illegal DHCP server. Therefore, the method for identifying a DHCP server provided by the embodiment of the present invention implements identification of an illegal DHCP server in a virtualized environment, thereby improving network security.

FIG. 2 is a flowchart of a method for identifying a DHCP server according to an embodiment of the present invention. The execution entity of the embodiment is a DHCP security module, and the application scenario is a virtual machine subnet. The virtual machine subnet includes multiple virtual machines and one virtual switch, and the multiple virtual machines are created by physical resources on one host. Include at least one legitimate DHCP server to provide an IP address for the virtual machine. As shown in FIG. 2, the embodiment includes the following steps:

Step 201: The DHCP security module broadcasts a DHCP Di scover message to the virtual machine subnet. Specifically, the DHCP security module may periodically broadcast a DHCP Di s cover message in the virtual machine subnet to enable the DHCP server of the DHCP Di scover message in the subnet to respond to the DHCP Di scover message. The format of the packet of the DHCP Di scover message is the same as the format of the packet specified in the DHCP protocol, and is not mentioned here. Step 202: Receive a DHCP Of fer message, where the DHCP Of fer message is sent after the first DHCP server in the virtual machine subnet receives the DHCP D is cover message, where the DHCP Of fer message includes the The address information of a DHCP server.

The DHCP server that receives the DHCP D i s cever message can send a DHCP Of fer message to the DHCP security module, where the message carries the address information of the DHCP server, and the address information includes the IP address and the MAC address.

Step 203: Obtain the address information of the first DHCP server, and identify, according to the address information of the first DHCP server, whether the first DHCP server is an illegal DHCP server.

Specifically, a DHCP server should be configured in a virtual machine subnet. If the DHCP security module receives multiple DHCP Of fer messages, it indicates that there may be an illegal DHCP server. _{0 The} DHCP security module receives the DHCP Of the first DHCP server. After the fer message, the IP address and MAC address information of the first DHCP server may be first extracted from the message, and the DHCP server is identified as an illegal DHCP server according to the address information. The address information of the first DHCP server may be compared with the address information of the preset legal DHCP server. If the address information of the first DHCP server is different from the address information of the preset legal DHCP server, Then identifying that the first DHCP server is an illegal DHCP server.

A DHCP server list may be preset in the DHCP security module. The list includes a preset DHCP server and its address information. The DHCP server list may also be set in the network server without being set in the DNCP security module. When receiving the DHCP Of fer message returned by the DHCP server, the DHCP module can access the DHCP server list in the network server. The DHCP server list can be set by the user according to the actual networking situation.

Specifically, after the DHCP security module receives the DHCP Of fer message sent by the DHCP server, if only one DHCP Server sends a DHCP Of fer message, the address information of the DHCP server is compared with the address information in the DHCP server list. If they are consistent, the DHCP server is a valid DHCP server. Otherwise, the DHCP server that sends the DHCP Of message is an illegal DHCP server. If the DHCP security module receives multiple DHCP Servers After multiple DHCP Offer messages are sent, the address information corresponding to the multiple DHCP servers is compared with the address information in the DHCP server list one by one. Generally, only one DHCP Server is configured in one virtual machine subnet, so the normal maximum is Only one DHCP server has the same address information as the address information in the list. The DHCP server with the same address information is a valid DHCP server. The DHCP server whose address information is inconsistent is an illegal DHCP server.

For an illegal DHCP server, the DHCP security module can perform alarm processing. For example, the alarm name of the DHCP server is displayed on the display interface for users to view. That is, the DHCP server is displayed on the display interface of the DHCP security module. A prompt for an illegal DHCP server. The DHCP Of fer message can carry the address information such as the IP address and the MAC address. Therefore, the host name can be obtained through the IP address information. For example, the host name corresponding to the IP address is obtained by using the P ing-a i p command.

Since the information about the DHCP server that sends the DHCP Offer information can be displayed on the display interface of the DHCP security module, the user can manually identify the DHCP Offer through the displayed information, and perform alarm processing on the server that is identified as the illegal DHCP server. .

For the illegal first DHCP server, the DHCP module may also disable the IP address or MAC address of the first DHCP server in the virtual machine subnet, so that when receiving the DHCP response message sent by the IP address or the MAC address later, Causes the virtual switch to refuse to forward the packet from the IP address or MAC address.

In a preferred embodiment, after receiving the DHCP Offer message, the DHCP security module may also record the address information of the DHCP server, or may also send a DHCP Reques (DHCP Request) message to the DHCP server, and the message is It carries an invalid DHCP server address information to terminate the DHCP session process.

In the embodiment of the present invention, the DHCP security module broadcasts a DHCP Di s cover message to the virtual machine subnet, where the virtual machine subnet includes multiple virtual machines and one virtual switch, and the multiple virtual machines are supported by one host. The physical resources are created, and the multiple virtual machines communicate with each other through the virtual switch, and the virtual subnet further includes at least one legal DHCP server. The virtual machine provides an IP address, and receives a DHCP Offer message, where the DHCP Offer message is sent after the first DHCP server in the virtual machine subnet receives the DHCP Di scover message, and the DHCP Offer message includes the Obtaining address information of a DHCP server; obtaining address information of the first DHCP server, and identifying, according to the address information of the first DHCP server, whether the first DHCP server is an illegal DHCP server. The identification device of the DHCP server and the DHCP server can be run in the operating system of the virtual machine. Therefore, the embodiment of the present invention can identify an illegal DHCP server in the virtualized environment, and perform alarm processing on the identified illegal DHCP server, thereby improving Network security.

The above embodiment introduces the DHCP server identification process by using the DHCP security module as the execution subject. The following describes the information exchange process between the DHCP security module and the DHCP server during the process of identifying the DHCP server.

FIG. 3 is a schematic diagram of information interaction of a DHCP server identification method according to an embodiment of the present invention. As shown in FIG. 3, this embodiment includes the following steps:

Step 301: The DHCP security module sends a DHCP Di scover message to the DHCP server. The application scenario of the method is a virtual machine subnet, where the virtual machine subnet includes multiple virtual machines and one virtual switch, and the multiple virtual machines are created by physical resources on one host, and multiple virtual machines are used. Communicating through the virtual switch, the virtual machine subnet further includes at least one legal DHCP server providing an IP address for the virtual machine.

Specifically, the DHCP security module may periodically broadcast a DHCP D i scover message in the virtual machine subnet to enable a legitimate or illegal DHCP server of the DHCP D i scover message in the subnet to respond to the DHCP D i scover message.

Step 302: The DHCP server sends a DHCP Offer message to the DHCP security module.

After receiving the DHCP Di scover message, the DHCP server can send a DHCP Offer message to the DHCP security module. The message carries the address information of the DHCP server, and the address information includes the IP address and the MAC address.

Step 303: The DHCP security module identifies the DHCP according to the IP address of the DHCP server. Whether the server is an illegal DHCP server.

The method for identifying the DHCP server is: comparing the address information of the preset DHCP server with the address information of the DHCP server, and if not, identifying the DHCP server as an illegal DHCP server.

For an illegal DHCP server, the DHCP security module can perform alarm processing, for example,

The host name of the DHCP server is displayed as an alarm. It is displayed on the display interface for the user to view. The DHCP server displays the prompt message of the DHCP server as an illegal DHCP server. The DHCP Of fer message can carry the address information such as the IP address and the MAC address. Therefore, the host name can be obtained through the IP address information. For example, the host name corresponding to the IP address is obtained by using the P ng-a i p command.

Step 304: The DHCP security module determines whether all DHCP Offer messages are received, and generally sets a preset time. After the timeout, the DHCP session process may be terminated.

Specifically, the DHCP session can be terminated by sending a DHCP Reques t message to the DHCP server and carrying an invalid DHCP Server address information.

Of course, step 304 can also be performed before step 303 and after step 302.

Therefore, the embodiment of the present invention can identify an illegal DHCP server in a virtualized environment, and perform alarm processing on the identified illegal DHCP server, thereby improving network security.

Correspondingly, an embodiment of the present invention further provides an identifier for a DHCP server. Figure 4 is the basis A schematic diagram of an identification device of a DHCP server provided by an embodiment of the invention. As shown in FIG. 4, this embodiment includes the following units:

The sending unit 401 is configured to broadcast and send a DHCP D i scover message to the virtual machine subnet, where the virtual machine subnet includes multiple virtual machines and one virtual switch, where the multiple virtual machines are physics on one host The virtual machine is configured to communicate with each other, and the virtual machine subnet further includes at least one legal DHCP server to provide an IP address for the virtual machine.

The sending unit 401 can periodically broadcast the DHCP Di scover message in the virtual machine subnet, and can also broadcast and send the DHCP Di scover message after receiving the user's request message.

After receiving the DHCP Offer message sent by the DHCP server, the sending unit 402 is further configured to send a DHCP request message to the first DHCP server, where the DHCP request message carries an invalid DHCP server address information, and is used to end the DHCP session.

The receiving unit 402 is configured to receive a DHCP Offer message, where the DHCP Of fer message is sent after the first DHCP server in the virtual machine subnet receives the DHCP Di s cover message, where the DHCP Offer message includes the The address information of the first DHCP server transmits the DHCP Offer message to the processing unit.

The processing unit 403 is configured to receive the DHCP Offer message sent by the receiving unit, obtain address information of the first DHCP server, and identify, according to the address information of the first DHCP server, whether the first DHCP server is Is an illegal DHCP server.

The processing unit 403 is specifically configured to: compare the address information of the first DHCP server with the address information of a preset legal DHCP server, if the address information of the first DHCP server and the preset legal DHCP If the address information of the server is inconsistent, it is identified that the first DHCP server is an illegal DHCP server.

The processing unit 403 is further configured to: perform alarm processing on the illegal first DHCP server if the first DHCP server is an illegal DHCP server.

The address information carried in the DHCP Offer message is an IP address and a MAC address. An illegal DHCP server, the processing unit 403 is specifically configured to: obtain, according to the IP address of the illegal first DHCP server, a host name corresponding to the illegal first DHCP server, and a host name of the illegal first DHCP server Perform alarm processing.

For an illegal DHCP server, the DHCP security module can perform alarm processing. For example, the alarm name of the DHCP server is displayed on the display interface for users to view. That is, the DHCP server is displayed on the display interface of the DHCP security module. A prompt for an illegal DHCP server. The DHCP Of fer message can carry the address information such as the IP address and the MAC address. Therefore, the host name can be obtained through the IP address information. For example, the host name corresponding to the IP address is obtained by using the P ng-a i p command.

The processing unit 403 is further configured to: disable an IP address or a MAC address of the illegal first DHCP server in the virtual machine subnet. For the illegal first DHCP server, the DHCP module may also disable the IP address or MAC address of the first DHCP server in the virtual machine subnet, so that when receiving the DHCP response message sent by the IP address or the MAC address later, Causes the virtual switch to refuse to forward the packet from the IP address or MAC address.

Preferably, the embodiment further includes: a preset unit 404, configured to preset a DHCP server list, where the DHCP server list includes address information of the legal DHCP server.

FIG. 5 is a schematic diagram of another DHCP server identification apparatus according to an embodiment of the present invention. As shown in FIG. 5, the DHCP server identification apparatus includes: a processor 501, a memory 502, a system bus 503, and a communication interface 504. The processor 501, the memory 502, and the communication interface 504 are connected by the system bus 503 and complete communication with each other.

The processor 501 may be a single core or multi-core central processing unit (Cen ra l Proces s ing Uni t , The CPU) is either a specific integrated circuit (ASIC) or one or more integrated circuits configured to implement embodiments of the present invention.

The memory 502 may be a high speed RAM memory or a non-volatile memory such as at least one disk memory.

Memory 502 is used to store program 505. Specifically, the program code may be included in the program 505, and the program code includes a computer execution instruction.

When the identification device of the DHCP server is running, the processor 501 runs the program 505 to execute the following instructions:

Sending a DHCP Di scover message to the virtual machine subnet, where the virtual machine subnet includes multiple virtual machines and one virtual switch, and the multiple virtual machines include at least a physical asset subnet on one host. A legitimate DHCP server provides an IP address for the virtual machine; receiving a DHCP Offer message, where the DHCP Offer message is sent after the first DHCP server in the virtual machine subnet receives the DHCP Di scover message, The DHCP Offer message includes address information of the first DHCP server;

Specifically, a DHCP server should be configured in a virtual machine subnet. If the DHCP security module receives multiple DHCP Offer messages, it indicates that there may be an illegal DHCP server. _{0 The} DHCP security module receives the DHCP Offer message sent by the first DHCP server. After that, the IP address and MAC address information of the first DHCP server may be first extracted from the message, and the DHCP server is identified as an illegal DHCP server according to the address information. The address information of the first DHCP server may be compared with the address information of the preset legal DHCP server. If the address information of the first DHCP server is different from the address information of the preset legal DHCP server, Then identifying that the first DHCP server is an illegal DHCP server.

Further, the processor 501 performs to identify whether the first DHCP server is an illegal DHCP. After the instruction of the server, according to the program 505, the following instruction is executed: If the recognition result is that the first DHCP server is an illegal DHCP server, the illegal first DHCP server is subjected to alarm processing.

Further, the process of the processor 501 identifying whether the first DHCP server is an illegal DHCP server according to the address information of the first DHCP server specifically includes: setting address information of the first DHCP server with a preset legal The address information of the DHCP server is compared. If the address information of the first DHCP server is different from the address information of the preset legal DHCP server, the first DHCP server is identified as an illegal DHCP server.

The processor 501 can also preset a DHCP server list, where the DHCP server list includes address information of a legitimate DHCP server. The list of DHCP servers can be stored in memory 502, or in a network server, accessed by processor 501 as needed.

Further, the address information of the DHCP server includes an IP address and a MAC address, and the process of the alarm processing by the processor 501 to the illegal first DHCP server includes: acquiring the information according to the IP address of the illegal first DHCP server. The host name corresponding to the illegal first DHCP server is used to perform alarm processing on the host name of the illegal first DHCP server.

For an illegal DHCP server, the DHCP security module can perform alarm processing. For example, the alarm name of the DHCP server is displayed on the display interface for users to view. That is, the DHCP server is displayed on the display interface of the DHCP security module. A prompt for an illegal DHCP server. The DHCP Of fer message can carry the address information such as the IP address and the MAC address. Therefore, the host name can be obtained through the IP address information, for example, the host name corresponding to the IP address is obtained by using the P ng-a i ρ command.

When it is recognized that the first DHCP server is an illegal DHCP server, the processor 501 may also disable the IP address and the MAC address of the illegal first DHCP server in the virtual machine subnet. For the illegal first DHCP server, the DHCP module may also disable the IP address or MAC address of the first DHCP server in the virtual machine subnet, so that when receiving the DHCP response message sent by the IP address or the MAC address later, Causes the virtual switch to refuse to forward the packet from the IP address or MAC address.

Further, after the processor 501 accesses the program 505 in the memory 502, after executing the instruction of receiving the DHCP Offer message returned by the first DHCP server, the processor may further send a DHCP request message to the first DHCP server, where the DHCP request message is sent. It carries an invalid DHCP server address information to end the DHCP session.

A person skilled in the art should further appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both, in order to clearly illustrate hardware and software. Interchangeability, the composition and steps of the various examples have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

The steps of a method or algorithm described in connection with the embodiments disclosed herein can be implemented in hardware, a software module executed by a processor, or a combination of both. Software modules can be placed in random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or technical field Any other form of storage medium known.

The above described embodiments of the present invention are further described in detail, and the embodiments of the present invention are intended to be illustrative only. The scope of the protection, any modifications, equivalents, improvements, etc., made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

claims

1. A method for identifying a Dynamic Host Configuration Protocol DHCP server, characterized in that the method includes:

The DHCP security module broadcasts and sends a DHCP Discover message to the virtual machine subnet, wherein the virtual machine subnet includes multiple virtual machines and a virtual switch, the multiple virtual machines are controlled by a master, and the virtual machine subnet It also includes at least one legal DHCP server providing an IP address for the virtual machine;

Receive a DHCP Offer message. The DHCP Offer message is sent by the first DHCP server in the virtual machine subnet after receiving the DHCP Discover message. The DHCP Offer message includes the address information of the first DHCP server. ;

Obtain the address information of the first DHCP server, and identify whether the first DHCP server is an illegal DHCP server based on the address information of the first DHCP server.

2. The method for identifying a DHCP server according to claim 1, wherein after identifying whether the first DHCP server is an illegal DHCP server, the method further includes: if the identification result is that the first DHCP server is illegal DHCP server, then perform alarm processing on the illegal first DHCP server.

3. The method for identifying a DHCP server according to claim 2, wherein identifying whether the first DHCP server is an illegal DHCP server according to the address information of the first DHCP server includes: The address information of a DHCP server is compared with the address information of a preset legal DHCP server. If the address information of the first DHCP server is inconsistent with the address information of the preset legal DHCP server, the first DHCP server is identified. A DHCP server is an illegal DHCP server.

4. The method for identifying a DHCP server according to claim 3, wherein the method further includes: pre-setting a DHCP server list, and the DHCP server list includes address information of legal DHCP servers.

5. The method for identifying a DHCP server according to claim 2, wherein the address information is an IP address and a MAC address, and the alarm processing for the illegal first DHCP server includes: obtain the IP address of the first DHCP server, obtain the host name corresponding to the illegal first DHCP server, and perform alarm processing on the host name of the illegal first DHCP server.

6. The method for identifying a DHCP server according to claim 1, wherein the address information is an IP address and a MAC address, and the method further includes: prohibiting the illegal first server in the virtual machine subnet. The IP address or MAC address of the DHCP server.

7. The method for identifying a DHCP server according to any one of claims 1 to 6, characterized in that, after receiving the DHCP Of fer message returned by the first DHCP server, the method further includes:

Send a DHCP request message to the first DHCP server, where the DHCP request message carries invalid DHCP server address information to end the DHCP session.

8. A dynamic host configuration protocol DHCP server identification device, characterized in that the device includes:

A sending unit, configured to broadcast and send a DHCP Discover message to a virtual machine subnet, where the virtual machine subnet includes multiple virtual machines and a virtual switch, and the multiple virtual machines are provided by physical resources on one host. Created, the plurality of virtual machines communicate through the virtual switch, and the virtual machine subnet also includes at least one legal DHCP server to provide an IP address for the virtual machine;

A receiving unit, configured to receive a DHCP Offer message. The DHCP Offer message is sent by the first DHCP server in the virtual machine subnet after receiving the DHCP Discover message. The DHCP Offer message includes the first DHCP The address information of the server, transmits the DHCP Offer message to the processing unit;

A processing unit configured to receive the DHCP Of fer message sent by the receiving unit, obtain the address information of the first DHCP server, and identify whether the first DHCP server is based on the address information of the first DHCP server. It is an illegal DHCP server.

9. The device for identifying a DHCP server according to claim 8, wherein the processing unit is further configured to: if the identification result is that the first DHCP server is an illegal DHCP server, then detect the illegal first DHCP server. The DHCP server handles alarms.

10. The device for identifying a DHCP server according to claim 8, wherein the processing unit is specifically configured to compare the address information of the first DHCP server with the address information of a preset legal DHCP server. , if the address information of the first DHCP server is inconsistent with the address information of the preset legal DHCP server, the first DHCP server is identified as an illegal DHCP server.

11. The device for identifying a DHCP server according to claim 10, characterized in that the device further includes a preset unit for presetting a DHCP server list, and the DHCP server list includes the legal DHCP server. address information.

12. The device for identifying a DHCP server according to claim 9, wherein the address information is an IP address and a MAC address, and the processing unit is specifically configured to: according to the IP address of the illegal first DHCP server , obtain the host name corresponding to the illegal first DHCP server, and perform alarm processing on the host name of the illegal first DHCP server.

13. The device for identifying a DHCP server according to claim 8, wherein the address information is an IP address and a MAC address, and the processing unit is further configured to: prohibit the illegal processing in the virtual machine subnet The IP address or MAC address of the first DHCP server.

14. The device for identifying a DHCP server according to any one of claims 8-13, wherein the sending unit is further configured to send a DHCP request message to the first DHCP server, the DHCP request message It carries an invalid DHCP server address information to end the DHCP session.