WO2015149669A1

WO2015149669A1 - Trusted network attack filtering device and network attack filtering method

Info

Publication number: WO2015149669A1
Application number: PCT/CN2015/075441
Authority: WO
Inventors: 吕卓; 张威; 莫坚松; 张之刚
Original assignee: 国家电网公司; 国网河南省电力公司电力科学研究院
Priority date: 2014-04-03
Filing date: 2015-03-31
Publication date: 2015-10-08
Also published as: CN103905452A

Abstract

Disclosed are a trusted network attack filtering device and a network attack filtering method, comprising a network interface module and a security control module; the network interface module is used to receive and transmit an IP data packet; the security control module is used to identify the received IP data packet transmitted by a protected computer, and to parse and judge the received IP data packet transmitted by an external communication network. The present invention utilizes summary calculation to determine whether an IP data packet has been tampered with or forged, precisely differentiate between authorized and unauthorized data packets, and filter attacks from outside the system; in addition, the present invention can defend against replay attacks initiated by attackers by comparing sent serial numbers and received serial numbers, thus efficiently protecting network devices.

Description

Trusted network attack filtering device and network attack filtering method

Technical field

The present invention relates to the field of network security defense, and in particular, to a network attack filtering device and a network attack filtering method capable of accurately identifying network IP data packets and accurately filtering illegal IP data packets based on the identification.

Background technique

The development of network communication has greatly promoted the development of the whole society, and various industries have adopted networks for information communication to varying degrees. However, current IP-based network communications are not designed with security in mind, so network devices are often attacked by the network, and these attacks are very harmful. Therefore, in order to improve network security, devices such as firewalls, intrusion detection, and encrypted VPNs have been introduced one after another, which has improved network security to some extent.

At present, mainstream network security defense devices include firewalls, intrusion detection, and encrypted VPNs. Each device can play a certain security role, but it also has drawbacks.

The firewall is mainly based on IP packet filtering technology to defend against network attacks. When the network IP packet arrives at the firewall, the firewall checks the IP packet according to the preset filtering rules, releases the allowed IP data packet, and discards the forbidden IP data packet. Based on the above principles, the firewall can defend against many attacks, but the attacker can spoof and bypass the firewall or directly attack the firewall by constructing IP packets that conform to the filtering rules.

Intrusion detection is mainly based on feature detection and anomaly detection to determine attacks. In essence, it analyzes, synthesizes, and extracts certain network behavior patterns or rules based on the activity rules of network IP packets, and then judges IP packets according to the behavior patterns or rules. Whether it is invasive. However, in the above two ways, it is possible to determine that a normal IP data packet is an intruded IP data packet or an intrusion IP data packet as a legitimate IP data packet, and it is difficult to perform accurate detection by intrusion detection.

Encrypted VPN communicates by establishing an encrypted secure channel on both sides of the network communication. Because of the cryptographic principle, it is possible to accurately distinguish IP packets and distinguish between attack packets and legitimate packets. However, the implementation of the device itself is complicated, and the correctness and security of the device itself cannot be guaranteed in principle. The device itself may be compromised. At the same time, in actual applications, encrypting the data may reduce the data throughput rate of the network. And many applications do not have encryption requirements, increasing deployment costs.

It can be seen from the analysis of the above equipment that because the IP network protocol design does not fully consider the security factor at the beginning, the network IP data packet itself has no trusted identifier, and it is easy to avoid spoofing or tampering with the IP data packet to avoid the network security defense device. In addition, the phenomenon of attacking the target is achieved. At the same time, the security of the current high-cost VPN device reduces the security defense level of the VPN device. Therefore, a network defense device with low deployment cost and high security is required. Identify the source of IP packets, distinguish between legitimate IP packets and attack packets, and achieve effective protection of network devices.

Summary of the invention

The object of the present invention is to provide a trusted network attack filtering device and a network attack filtering method, which can accurately identify network IP data packets and accurately filter illegal IP data packets based on the identification, thereby realizing effective protection of network devices.

The invention adopts the following technical solutions:

A trusted network attack filtering device, comprising a network interface module and a security control module;

The network interface module is configured to complete transmission and reception of an IP data packet, the network interface module includes an external network interface module and an internal network interface module; the external network interface module is connected to the security control module and the external communication network, and is configured to receive external communication. The IP data packet sent by the network is transmitted to the security control module, and the IP data packet sent by the security control module is received and sent through the external communication network; the intranet network interface module is connected to the protected computer and the security control module in the internal network. And receiving the IP data packet sent by the security control module and transmitting it to the protected computer in the internal network, and receiving the IP data packet sent by the protected computer in the internal network and transmitting the IP data packet to the security control module;

The security control module is configured to identify the IP data packet sent by the received protected computer and analyze and discriminate the IP data packet sent by the received external communication network; the security control module stores the corresponding destination address. The key corresponding to the source address, the transmission sequence number, and the reception sequence number. When the security control module receives the IP data packet sent by the protected computer in the intranet, the security control module reads the IP data packet and extracts the IP data. The destination address, obtain the corresponding key and the transmission sequence number according to the destination address, place the transmission sequence number at the end of the IP data packet, perform a digest operation on the IP data packet and the transmission sequence number by using the key, and attach the summary operation result to the transmission. After the serial number, the length indication information in the IP header information is adjusted according to the current length, and then the added IP data packet is sent to the external communication network through the external network interface module; when the security control module receives the external communication network, When the IP packet is received, the security control module reads the IP packet and extracts the IP packet source address. According to the IP packet source address, the corresponding key and the receiving serial number are obtained, and the security control module uses the key to perform digest operation on the protected content and the sending serial number in the IP data packet, and the operation result and the IP data packet are included in the IP data packet. The summary operation results are compared. If the results are inconsistent, the IP data packet is considered to be falsified and forged, and the IP data packet is discarded. If the results are consistent, the IP data packet is not falsified and forged, and the comparison is continued from the IP data packet. The size of the transmitted transmission sequence and the received serial number are considered to be valid if the transmission sequence number is greater than the received sequence number, and the security control module receives the IP data packet and sends the IP data packet to the protected network. Computer; if the sending sequence number is less than or equal to the receiving sequence number, the IP packet is considered illegal and the IP packet is discarded.

The security control module includes a security processing chip and an external memory connected to the security processing chip.

The security processing chip is further connected with a switch module and a serial port communication module, wherein the signal output end of the switch module is connected to the signal input end of the security processing chip, and the switch module is used for inputting a high level or low level signal to the security processing chip, and the security is The processing chip enters the IP data packet identification and the analysis and discrimination working mode or the configuration program operation mode according to different signals sent by the receiving switch module. In the configuration program running mode, the security processing chip communicates with the outside world only through the serial communication module.

The network interface module adopts an interface chip supporting an IEEE802.3 Ethernet specification.

The switch module adopts a circuit switch.

The serial communication module adopts an asynchronous serial communication interface chip supporting the RS232 standard.

A network attack filtering method implemented by using the trusted network attack filtering device according to claim 1, comprising the following steps:

A: Connect a network attack filtering device between the protected computer in each intranet and the external communication network. When the security control module in a network attack filtering device receives the IP data packet, it determines the source of the IP data packet. If the received IP data packet source is the computer connected to the network attack filtering device, proceed to step B; if receiving When the IP packet source is another network attack filtering device, proceed to step F;

B: the security control module reads the IP data packet and extracts the IP data packet destination address, and then proceeds to step C;

C: the security control module obtains the corresponding key and the transmission serial number according to the destination address of the IP data packet, and then proceeds to step D;

D: The security control module places the transmission sequence number at the end of the IP data packet, performs a digest operation on the IP data packet and the transmission sequence number by using the key, attaches the digest operation result to the transmission sequence number, and adjusts the IP header information according to the current length. The length indication information in, and then proceeds to step E;

E: the security control module sends the identified IP data packet to the external communication network through the external network interface module, completes the IP packet identification operation, and then returns to step A;

F: the security control module reads the IP data packet and extracts the IP packet source address, and then proceeds to step G;

G: the security control module obtains the corresponding key and the receiving serial number according to the IP packet source address, and then proceeds to step H;

H: The security control module performs a digest operation on the protected content and the transmission sequence number in the IP data packet by using the key, and compares the operation result with the digest operation result included in the IP data packet, and if the results are consistent, the IP is judged. The data packet has not been tampered with and forged, and then proceeds to step I; if the result is inconsistent, the IP data packet is considered to be tampered with and forged, the IP data packet is discarded, and then returns to step A;

I: The security control module reads the transmission sequence number and the reception sequence number in the IP data packet, and compares the transmission sequence number and the reception sequence number size. If the transmission sequence number is greater than the reception sequence number, the IP data packet is considered to be legal, and the IP is received. The data packet is sent to the protected computer in the intranet; if the transmission sequence number is less than or equal to the receiving serial number, the IP data packet is considered illegal, the IP data packet is discarded, and then the process returns to step A.

When the IP data packet sent by the protected computer in the internal network is sent out, the IP data packet and the transmission sequence number are digested by the key, and the digest operation result and the transmission sequence number are attached as identifiers to the IP data packet. Then, the IP data packet containing the identifier is sent to the external communication network through the external network interface module; when receiving the IP data packet sent by the external communication network, the security control module obtains the corresponding key pair IP data packet according to the source address. The protected content and the transmitted serial number are digested, and the operation result is compared with the digest operation result in the IP data packet to determine whether the IP data packet has been tampered with and forged, accurately distinguishing between legal and illegal data packets, and filtering The attack from the outside of the system; at the same time, the present invention uses the security control module to read and compare the transmission sequence number and the reception sequence number in the IP data packet, and can resist the replay attack issued by the attacker, thereby effectively implementing network device protection. Further, the present invention utilizes a hardware switch to isolate two operating logics of the security processing chip, and the security processing chip execution configuration program is not performed through the network, and can only be performed through the serial communication module, which can effectively prevent the security processing chip itself initiated by the network interface module. The attack is greatly improved.

DRAWINGS

1 is a schematic block diagram of a trusted network attack filtering device according to the present invention;

2 is a schematic flowchart of a network attack filtering method according to the present invention;

3 is a schematic diagram of an IP packet identification principle;

FIG. 4 is a schematic block diagram of data communication between two computers through a network attack filtering device.

detailed description

As shown in FIG. 1 , the present invention includes a network interface module for performing transmission and reception of IP data packets, and a security control module for identifying IP data packets sent by the received protected computer and The IP packet sent by the received external communication network is analyzed and discriminated.

The network interface module includes an external network interface module and an internal network interface module, and the external network interface module is connected to the security control module and the external communication network, and is configured to receive the IP data packet sent by the external communication network and transmit the security data packet to the security control. The module, and receiving the IP data packet sent by the security control module and transmitting through the external communication network; the intranet network interface module is connected to the protected computer and the security control module in the internal network, and is used for receiving the IP data sent by the security control module. The packet is transmitted to the protected computer in the internal network, and the IP data packet sent by the protected computer in the internal network is received and transmitted to the security control module.

The security control module comprises a security processing chip and an external memory connected to the security processing chip. The security chip has a ROM, an EFLASH, a RAM storage unit, and the internal storage unit of the security chip stores a key and a transmission sequence corresponding to the corresponding destination address and the source address. And receiving the serial number, when the security control module receives the IP data packet sent by the protected computer in the internal network, the security control module reads the IP data packet and extracts the destination address of the IP data packet, and obtains the corresponding address according to the destination address. Key and transmission sequence number, the transmission sequence number is placed at the end of the IP data packet, and the IP data packet and the transmission sequence number are digested by the key, and the digest operation result is attached to the transmission sequence number, and the IP is adjusted according to the current length. The length indication information in the header information is sent to the external communication network through the external network interface module. The schematic diagram of the IP packet identification principle is shown in Figure 3. When the security control module receives the IP data packet sent by the external communication network, the security control module reads the IP data packet and extracts the IP data packet source address, and obtains the corresponding key and the receiving serial number according to the IP data packet source address. The security control module performs a digest operation on the protected content and the transmission sequence number in the IP data packet by using the key, and compares the operation result with the digest operation result included in the IP data packet, and considers the IP data packet if the result is inconsistent. Tampered and forged, discarding this IP packet; if the result is consistent, it is judged that the IP packet has not been tampered with and forged, and continues to compare the size of the transmission sequence number and the reception sequence number read from the IP packet, if the sequence is transmitted If the number is greater than the receiving sequence number, the IP packet is considered valid. The security control module receives the IP packet and sends the IP packet to the protected computer in the intranet. If the sending sequence number is less than or equal to the receiving sequence number, the IP packet is considered. Illegal, discard this IP packet.

A secure processing chip configuration program is stored in the external memory connected to the security processing chip. The security processing chip is also connected with a switch module and a serial communication module. The signal output end of the switch module is connected to the signal input end of the security processing chip, and the switch module is used to The security processing chip inputs a high level or low level signal, and the security processing chip enters the IP data packet receiving processing working mode or the configuration program running mode according to different signals sent by the receiving switch module, and the security processing chip only passes the configuration program running mode. The serial communication module communicates with the outside world. When the security processing chip executes the IP packet receiving processing mode, the security processing chip is internally activated, that is, the security processing chip reads the program from the internal storage unit and executes, and the security processing chip cannot access the external memory, thereby ensuring that the external device is not falsified. The program in the store, in turn, ensures the security of the configuration program. When the security processing chip executes the configuration program running mode, the security processing chip reads the configuration program from the external memory and executes, the configuration program runs in the user's computer, and the user computer communicates with the security processing chip through the serial communication module. The configuration program is run in the processing chip to form a C/S working mode with the user's computer. The invention utilizes the hardware switch to isolate the two operating logics of the security processing chip, and the security processing chip execution configuration program does not go through the network, and can effectively prevent the attack against the security processing chip itself initiated by the network interface module, regardless of the configuration procedure of the security processing chip No loopholes, the attacker can not modify the configuration program of the security processing chip, and the security is greatly improved.

In this embodiment, the network interface module adopts an interface chip supporting an Ethernet specification such as IEEE802.3, which is called a network card chip, and can support transmission and reception of Ethernet data packets. In order to improve the overall security, the network card chip selects domestic chips. The security processing chip refers to a control chip with security function. The security function refers to the ability to perform cryptographic operations and has strong anti-multiple attack measures. The cryptographic operation can use digest operations, and its own anti-attack measures include multiple layers of chips. Special layout design, voltage detection, storage area encryption protection, light detection, MPU (memory protection unit) and other protection measures against physical attacks and software attacks. The switch module can adopt a circuit switch, and the opening and closing of the circuit switch can send two different control signals of low level and high level to the security processing chip. The serial communication module can adopt the asynchronous serial communication interface chip supporting the RS232 standard. The communication requires a dedicated serial cable to connect the asynchronous serial communication interface chip and the asynchronous serial communication interface chip on the user configuration computer (generally called COM). mouth). The external memory can adopt a FLASH chip, and the FLASH chip is a general-purpose memory chip. When the data is saved in the case of power failure, the FLASH chip can be read, written, erased, etc. through the external interface of the FLASH chip.

As shown in FIG. 2, the network attack filtering method of the present invention includes the following steps:

The IP data packet in the present invention is composed of a header and two parts of data, and the source address and the destination address included in the header are IP protocol addresses. The digest operation in the present invention is one of the basic algorithms in cryptography, and is also called a hash algorithm or a hash algorithm.

The network attack filtering method of the present invention is further described below in conjunction with specific embodiments. In this embodiment, as shown in FIG. 4, the first computer is connected to the external communication network through the first network attack filtering device, and the second computer is connected to the external communication network through the second network attack filtering device.

When the first computer needs to send the IP data packet to the second computer, the first computer first sends an IP data packet to the first network attack filtering device, and the security control module of the first network attack filtering device reads the IP data packet and extracts the IP packet. The destination address of the data packet, that is, the address of the second computer, and then the security control module obtains the corresponding key and the transmission sequence number according to the destination address of the IP data packet, and places the transmission sequence number at the end of the IP data packet, using the key pair IP data packet. And sending a sequence number to perform a digest operation, attaching the digest operation result to the transmission sequence number, and adjusting the length indication information in the IP header information according to the current length, and finally the IP data of the first network attack filtering device is identified by the security control module. The packet is sent to the second computer through the external network through the external network interface module to complete the IP packet identification operation;

When the IP data packet sent by the first computer reaches the second network attack filtering device, the second network attack filtering device external network interface module receives the IP data packet and sends the IP data packet to the second network attack filtering device for security control. The module, the security control module of the second network attack filtering device reads the IP data packet and extracts the IP data packet source address, obtains the corresponding key and the receiving serial number according to the IP packet source address, and then the second network attacks the filtering device. The security control module performs a digest operation on the protected content and the transmission sequence number in the IP data packet by using the key, and compares the operation result with the digest operation result included in the IP data packet, and considers the IP data packet if the result is inconsistent. Tampered and forged, discarding this IP packet; if the result is consistent, it is judged that the IP packet has not been tampered with and forged, and the security control module of the second network attack filtering device reads the transmission sequence number and the receiving sequence in the IP packet. Number, and compare the sending serial number and the receiving serial number size, if the sending serial number is greater than the receiving serial number The IP data packet is considered to be legal. The security control module of the second network attack filtering device receives the IP data packet and sends the IP data packet to the second computer. If the sending serial number is less than or equal to the receiving serial number, the IP data packet is considered illegal. The security control module of the second network attack filtering device discards the IP data packet.

The invention adds the summary information and the serial number information in the IP data packet, and the calculation of the summary information is based on the key and the cryptographic algorithm, and theoretically can ensure the tampering and forgery of the data packet through the abstract; the serial number information Determined to be able to defend against replay attacks by attackers. Through the above mechanism, the present invention can accurately distinguish between legal and illegal data packets, and filter attacks from outside the system. The present invention does not adopt the current complex network password security protocol, and has the functions of simple and convenient implementation. The specific implementation can be verified by a formal method to ensure the correctness and security of the implementation itself. The invention also utilizes the hardware switch to isolate the two operating logics of the security processing chip, and the security processing chip execution configuration program does not go through the network, and can only be performed through the serial communication module, which can effectively prevent the attack against the security processing chip itself initiated by the network interface module. The safety is greatly improved.

Claims

A trusted network attack filtering device, comprising: a network interface module and a security control module;

The network interface module is configured to complete transmission and reception of an IP data packet, the network interface module includes an external network interface module and an internal network interface module; the external network interface module is connected to the security control module and the external communication network, and is configured to receive external communication. The IP data packet sent by the network is transmitted to the security control module, and the IP data packet sent by the security control module is received and sent through the external communication network; the intranet network interface module is connected to the protected computer and the security control module in the internal network. And receiving the IP data packet sent by the security control module and transmitting it to the protected computer in the internal network, and receiving the IP data packet sent by the protected computer in the internal network and transmitting the IP data packet to the security control module;

The security control module is configured to identify the IP data packet sent by the received protected computer and analyze and discriminate the IP data packet sent by the received external communication network; the security control module stores the corresponding destination address. The key corresponding to the source address, the transmission sequence number, and the reception sequence number. When the security control module receives the IP data packet sent by the protected computer in the intranet, the security control module reads the IP data packet and extracts the IP data. The destination address, obtain the corresponding key and the transmission sequence number according to the destination address, place the transmission sequence number at the end of the IP data packet, perform a digest operation on the IP data packet and the transmission sequence number by using the key, and attach the summary operation result to the transmission. After the serial number, the length indication information in the IP header information is adjusted according to the current length, and then the added IP data packet is sent to the external communication network through the external network interface module; when the security control module receives the external communication network, When the IP packet is received, the security control module reads the IP packet and extracts the IP packet source address. According to the IP packet source address, the corresponding key and the receiving serial number are obtained, and the security control module uses the key to perform digest operation on the protected content and the sending serial number in the IP data packet, and the operation result and the IP data packet are included in the IP data packet. The summary operation results are compared. If the results are inconsistent, the IP data packet is considered to be falsified and forged, and the IP data packet is discarded. If the results are consistent, the IP data packet is not falsified and forged, and the comparison is continued from the IP data packet. The size of the transmitted transmission sequence and the received serial number are considered to be valid if the transmission sequence number is greater than the received sequence number, and the security control module receives the IP data packet and sends the IP data packet to the protected network. Computer; if the sending sequence number is less than or equal to the receiving serial number, the IP packet is considered illegal and the IP packet is discarded. .
The trusted network attack filtering device according to claim 1, wherein the security control module comprises a security processing chip and an external memory connected to the security processing chip.
The trusted network attack filtering device according to claim 2, wherein the security processing chip is further connected with a switch module and a serial communication module, and the signal output end of the switch module is connected to the signal input end of the security processing chip. The switch module is configured to input a high level or low level signal to the security processing chip, and the security processing chip respectively enters the IP data packet identifier and the analytical discriminating working mode or the configuration program running mode according to different signals sent by the receiving switch module, and the configuration program runs. In the mode, the security processing chip communicates with the outside world only through the serial communication module.
The trusted network attack filtering device according to claim 3, wherein the network interface module adopts an interface chip supporting an IEEE802.3 Ethernet specification.
The trusted network attack filtering device according to claim 4, wherein the switch module adopts a circuit switch.
The trusted network attack filtering device according to claim 5, wherein the serial communication module adopts an asynchronous serial communication interface chip supporting the RS232 standard.
A network attack filtering method implemented by using the trusted network attack filtering device according to claim 1, comprising the following steps:

A: Connect a network attack filtering device between the protected computer in each intranet and the external communication network. When the security control module in a network attack filtering device receives the IP data packet, it determines the source of the IP data packet. If the received IP data packet source is the computer connected to the network attack filtering device, proceed to step B; if receiving When the IP packet source is another network attack filtering device, proceed to step F;

B: the security control module reads the IP data packet and extracts the IP data packet destination address, and then proceeds to step C;

C: the security control module obtains the corresponding key and the transmission serial number according to the destination address of the IP data packet, and then proceeds to step D;

D: The security control module places the transmission sequence number at the end of the IP data packet, performs a digest operation on the IP data packet and the transmission sequence number by using the key, attaches the digest operation result to the transmission sequence number, and adjusts the IP header information according to the current length. The length indication information in, and then proceeds to step E;

E: the security control module sends the identified IP data packet to the external communication network through the external network interface module, completes the IP packet identification operation, and then returns to step A;

F: the security control module reads the IP data packet and extracts the IP packet source address, and then proceeds to step G;

G: the security control module obtains the corresponding key and the receiving serial number according to the IP packet source address, and then proceeds to step H;

H: The security control module performs a digest operation on the protected content and the transmission sequence number in the IP data packet by using the key, and compares the operation result with the digest operation result included in the IP data packet, and if the results are consistent, the IP is judged. The data packet has not been tampered with and forged, and then proceeds to step I; if the result is inconsistent, the IP data packet is considered to be tampered with and forged, the IP data packet is discarded, and then returns to step A;

I: The security control module reads the transmission sequence number and the reception sequence number in the IP data packet, and compares the transmission sequence number and the reception sequence number size. If the transmission sequence number is greater than the reception sequence number, the IP data packet is considered to be legal, and the IP is received. The data packet is sent to the protected computer in the intranet; if the transmission sequence number is less than or equal to the receiving serial number, the IP data packet is considered illegal, the IP data packet is discarded, and then the process returns to step A.