WO2016197498A1

WO2016197498A1 - Method and device for preventing network attack, and storage medium

Info

Publication number: WO2016197498A1
Application number: PCT/CN2015/092042
Authority: WO
Inventors: 高飞
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-06-10
Filing date: 2015-10-15
Publication date: 2016-12-15
Also published as: CN106302361A

Abstract

Disclosed is a method for preventing a network attack, comprising: setting the number of times of resending a first message to be k, where k is a natural number; acquiring information about a TCP packet sent by a client, and determining the type of the information according to a connection tracking table entry, wherein the type of the information comprises valid information and invalid information; establishing connection tracking for the TCP packet of the invalid information, and sending the first message to the client; and if a second message sent by the client is not received within a second unit time, resending the first message, and if the number of times of resending is greater than k and the second message sent by the client is still not received, deleting the connection tracking. Also disclosed are a device for preventing a network attack, and a storage medium.

Description

Method, device and storage medium for preventing network attack

Technical field

The present invention relates to the field of network security, and in particular, to a method and device for preventing network attacks, and a storage medium.

Background technique

With the popularity of network technology, people are faced with the danger of cyber attacks while enjoying rich network resources.

The normal transmission control protocol (TCP) connection establishment process includes: the client sends a TCP packet including a handshake (SYN) flag to the access device, and the access device returns a handshake to the client after receiving the packet. The TCP message after the signal SYN+Acknowledgement (ACK) is set, indicating that the access device has received the connection request from the client and the access device accepts the client's request, and then the client returns that the ACK is set. The subsequent TCP packet is sent to the access device. At this point, the normal TCP connection process is established. The above process is called TCP three-way handshake.

Assuming that the client sends a power failure after sending a TCP packet containing the SYN flag, the access device cannot receive a response after sending a TCP packet with the SYN+ACK set. The TCP three-way handshake cannot be established. The connection is a semi-join. Normally, the access device resends the TCP packet containing the SYN+ACK set after waiting for a period of time. If the access device waits for a period of time, the access device still cannot receive the packet sent by the client. After the TCP packet with the ACK is set, the access device will try to send again, and the access device discards the connection and releases the memory until the number of times the maximum number of transmissions is reached. In the stipulations of the RFC793 protocol, the maximum number of received TCP connections of the access device is set to 128, and the number of times the server attempts to resend SYN+ACK packets is set to 5. The number of TCP packets processed per unit time is not limited.

The SYN flood attack is the third step of the TCP three-way handshake. "The client needs to return the TCP packet containing the ACK is set to the access device." The so-called SYN flood attack is performed by the client. The TCP connection request containing the TCP message forging the SYN flag, then it is not surprising that a client has a half-connection as described above, causing the access device to wait for a timeout, but if there are tens of thousands of semi-connections in a short time It is a malicious attack. In particular, a TCP connection initiated by a TCP packet containing a forged SYN flag will cause the access device's central processing unit (CPU) to run out of resources and the buffer to be filled. At this time, the connection request of the normal TCP packet cannot be processed in time, which affects the normal communication of the user.

Summary of the invention

In view of this, the embodiments of the present invention are directed to a method, a device, and a storage medium for preventing network attacks, which can effectively reduce SYN flood attacks and improve the efficiency of network attack prevention.

To achieve the above objective, an embodiment of the present invention provides a method for preventing a network attack, where the method includes:

Set the number of times to resend the first message to k, where k is a natural number;

Obtaining information about the TCP packet sent by the client, and determining the type of the information according to the connection tracking entry; the information type includes valid information and invalid information;

Establishing a connection tracking for the TCP message of the invalid information and sending the first message to the client;

If the second message sent by the client is not received in the second unit time, the first message is resent; the number of resends is greater than k and the second message sent by the client is still not received. When the connection trace is deleted.

In the above method, the method further includes: setting the number of receiving TCP connections to m, where m is a natural number;

Establishing connection tracking for the TCP message of the invalid information and sending the solution to the client The first message, including:

Determine the number of currently received TCP connections;

If the number of the currently received TCP connections is greater than m, the TCP packet is discarded; if the number of currently received TCP connections is less than or equal to m, establishing a connection tracking for the TCP packet and going to the client Send the first message.

In the above method, the k is 3, the first unit time is 1 second, and m is 1024.

In the above method, the information of the TCP packet includes: a source IP address, a destination IP address, a source port, a destination port, and a protocol;

The first message is a TCP packet including a handshake signal SYN+ confirming that the ACK is set;

The second message is a TCP packet including the ACK being set.

In addition, to achieve the above object, an embodiment of the present invention further provides a device for preventing a network attack, where the device includes:

Setting a module, configured to set the number of times to resend the first message to k, where k is a natural number;

The determining module is configured to obtain information about the TCP packet sent by the client, and determine the type of the information according to the connection tracking entry; the information type includes valid information and invalid information;

a sending module, configured to establish a connection tracking for the TCP message of the invalid information, and send the first message to the client;

a receiving module, configured to resend the first message if the second message sent by the client is not received in the second unit time; the number of resending times is greater than k and the sending by the client is still not received The connection tracking is deleted when the second message is received.

In the above device, the setting module is further configured to set the number of receiving TCP connections to be m, where m is a natural number;

The sending module is further configured to determine the number of currently received TCP connections;

The configuration is further configured to: if the number of currently received TCP connections is greater than m, the TCP packet is sent. Discarding; if the number of currently received TCP connections is less than or equal to m, establishing a connection tracking for the TCP packet and sending a first message to the client.

In the above device, the k is 3, the first unit time is 1 second, and m is 1024.

The information of the TCP packet includes: a source IP address, a destination IP address, a source port, a destination port, and a protocol;

The second message is a TCP packet including the ACK being set.

The method and device for preventing a network attack and the storage medium provided by the embodiment of the present invention obtain the information of the TCP packet sent by the client by setting the number of times of resending the first message to k, and determining the type of the information according to the connection tracking entry. And when the information type is invalid information, establish a connection tracking for the TCP message of the invalid information, and send the first message to the client, and when the client is not received in the second unit time When the second message is sent, the first message is resent; and when the number of retransmissions is greater than k and the second message sent by the client is still not received, the connection tracking is deleted, and the TCP is implemented. The transmission control of the message; thus, the SYN flood attack is effectively reduced, and the efficiency of the network attack prevention is improved.

DRAWINGS

1 is a flowchart of Embodiment 1 of a method for preventing a network attack according to an embodiment of the present invention;

2 is a flowchart of Embodiment 2 of a method for preventing a network attack according to an embodiment of the present invention;

FIG. 3 is a structural diagram of an apparatus for preventing a network attack according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention will be clearly and completely described in the following with reference to the accompanying drawings.

FIG. 1 is a flowchart of Embodiment 1 of a method for preventing a network attack according to an embodiment of the present invention, as shown in FIG. 1 As shown, the method can include:

Step 101: Set the number of times to resend the first message to k, where k is a natural number.

In this embodiment, the step 101 may be specifically: setting the number of retransmissions of the first message to be k, and processing the number of transmission control protocol TCP packets in the first unit time to be n, where k and n are natural numbers.

In this embodiment, the access device includes, but is not limited to, a data card, a customer premise equipment (CPE), and the like; on the access device, the number of times the first message is retransmitted, and the first unit time is processed and transmitted. The number of TCP packets of the control protocol is set to a specific value, which lays a foundation for the subsequent SYN flood prevention. The first message is a TCP packet containing the SYN+ACK is set, and the second message is set to contain the ACK. The TCP packet after the bit is set. In this embodiment, the setting of the specific value of the parameter may be set before the access device leaves the factory, or the user may be dynamically set according to the specific usage scenario on the access device, and may be set according to actual needs. The settings are not limited herein.

Step 102: Obtain information about a TCP packet sent by the client, and determine the type of the information according to the connection tracking entry, where the information type includes valid information and invalid information.

In this step, after receiving the TCP packet whose SYN field is set to 1, the access device extracts the information carried in the current TCP packet, and then determines the current TCP packet in the connection tracking entry of the access device. Whether the information is valid information or invalid information. If the information is valid, that is, the information of the current TCP packet exists in the connection tracking entry of the access device, the access device forwards the current TCP packet directly. The technique is not described here. If the information is invalid, that is, the information of the current TCP packet does not exist in the connection tracking entry of the access device, step 103 is performed.

The processing of the current TCP packet information by the access device specifically includes:

The access device extracts the source IP address, the destination IP address, the source port, the destination port, and the protocol in the information of the current TCP packet, and then corresponds to the current TCP packet according to the connection tracking entry in the access device. Source IP address, destination IP address, source port, destination port, The protocol is compared. If the five elements match, the information of the current TCP packet can be determined as valid information. If any one of the five elements does not match, the information of the current TCP packet is determined to be invalid.

Step 103: Establish a connection tracking for the TCP message of the invalid information and send the first message to the client.

Here, the access device establishes a new connection tracking in the access device for the TCP message of the invalid information, and sends a TCP packet including the SYN+ACK set to the client.

In this step, establishing a connection tracking for the TCP message of the invalid information and sending the first message to the client may further include:

Set the number of receiving TCP connections to m, where m is a natural number;

The access device determines the number of currently received TCP connections;

If the number of the currently received TCP connections is greater than m, the access device discards the TCP packets; if the number of currently received TCP connections is less than or equal to m, the access device establishes connection tracking for the TCP packets. And sending a first message to the client, where m is a natural number.

Step 104: If the second message sent by the client is not received in the second unit time, resend the first message; the number of resends is greater than k and the second sent by the client is still not received. The connection trace is deleted when the message is received.

Here, if the access device does not receive the TCP packet from the client that includes the ACK set after the second unit time, the access device will resend the TCP including the SYN+ACK set. And the number of times of resending the TCP packet including the SYN+ACK is set, and if the number of retransmissions is less than or equal to the number of times set in step 101, the access device receives the packet sent by the client. After the ACK is set, the access device forwards the TCP packet; if the number of retransmissions is greater than the number of times set in step 101, the access device deletes the record of the connection tracking of the TCP packet. .

It should be noted that, in this embodiment, the first unit time and the second unit time may be It is set according to actual needs and is not limited here.

The method for preventing a network attack provided by the embodiment of the present invention is to set a retransmission of the number of TCP packets including the SYN+ACK set to be k, and the number of TCP packets processed in the first unit time is n. The number of received TCP connections is m, which controls the transmission of TCP packets during TCP packet transmission. This can effectively reduce SYN flood attacks, improve the efficiency of network attack defense, and reduce CPU resource exhaustion in access devices. When the buffer is filled, the connection request of the normal TCP packet can be processed in time to ensure normal communication of the user.

Specifically, the method for preventing network attacks provided by the embodiment of the present invention, by setting the number of times of resending a TCP packet including the SYN+ACK set to be k, and processing the number of transmission control protocol TCP packets in the first unit time The number of receiving TCP connections is m. The access device determines the information type of the current TCP packet according to the connection tracking entry. After determining the invalid information, the access device determines whether it is the current TCP according to the number of currently received TCP connections. The packet establishes a connection tracking, and sends a TCP packet including the SYN+ACK being set to the client; if the access device does not receive the TCP packet after the client sends the ACK that is set in the second unit time If the number of resends is greater than k and the number of resends is greater than k and the TCP packet containing the ACK is set is not received, the current connection trace is deleted. In this way, the SYN flood attack can be effectively reduced, and the efficiency of network attack prevention is improved. In addition, the problem that the CPU of the access device is exhausted and the buffer is filled is reduced, so that the connection request of the normal TCP packet can be processed in time to ensure normal communication of the user.

The embodiment of the invention further provides a computer readable storage medium, the storage medium comprising a set of instructions for performing the method for preventing a network attack as described above.

In order to further embodies the object of the present invention, further exemplification will be made on the basis of the above embodiments. FIG. 2 is a flowchart of Embodiment 2 of a method for preventing a network attack according to an embodiment of the present invention. Such as As shown in Figure 2, the method includes:

Step 201: Set a specific value of the parameter.

The reason for setting the reasonable parameters is to prevent the SYN flood attack. The rationality of the parameter setting is very important. In this embodiment, the home gateway product is oriented to the common user. Therefore, the number of times the access device attempts to resend the SYN+ACK packet is set to 3. The number of the TCP packets processed in the first unit time is set to be 10, and the number of the received TCP connections is set to 1024. Here, in the embodiment of the present invention, the specific parameters are specified. The values are exemplified in the embodiment, and can be set according to actual needs, and are not limited herein.

Step 202: Obtain information about a TCP packet sent by the client, and determine the type of the information according to the connection tracking entry, where the information type includes valid information and invalid information.

After receiving the TCP packet with the SYN field set to 1, the access device extracts the information carried in the current TCP packet, and then determines that the current TCP packet information is valid information in the connection tracking entry of the access device. If the information is valid, that is, the information of the current TCP packet exists in the connection tracking entry of the access device, step 203 is performed; if the information is invalid, the information of the current TCP packet is on the access device. If the connection tracking entry does not exist, go to step 204.

The processing of the current TCP packet information by the access device is specifically as follows:

The access device extracts the source IP address, the destination IP address, the source port, the destination port, and the protocol in the information of the current TCP packet, and then corresponds to the current TCP packet according to the connection tracking entry in the access device. The source IP address, the destination IP address, the source port, the destination port, and the protocol are compared. If the five elements match, the information of the current TCP packet can be determined as valid information; if any of the five elements is any one of the five elements If the information does not match, the information of the current TCP packet is determined to be invalid.

Step 203: Forward the current TCP packet directly.

Step 204: Determine whether the number of currently established TCP connections is greater than the receiving The number of TCP connections.

If the number of currently established TCP connections is greater than the number of the received TCP connections, the access device performs step 205; if the number of currently established TCP connections is less than or equal to the number of the received TCP connections, the access device performs Step 206.

Step 205: Discard the currently established TCP connection.

Step 206: Establish a connection tracking for the TCP message of the invalid information, and send a TCP packet including the SYN+ACK set to the client.

Step 207: Determine whether a TCP packet sent by the client and containing the ACK is set is received in the second unit time.

If the access device receives the TCP packet sent by the client and the ACK is set, the access device performs step 208; if the access device does not receive the second unit time The TCP packet sent by the client, including the ACK, is set, and the access device performs step 209.

Step 208: Determine that the TCP connection is normal.

Step 209: Resend the TCP packet including the SYN+ACK set.

Step 210: Determine whether the number of times of resending the TCP packet including the SYN+ACK being set is greater than 1024.

If the number of resending the TCP packet including the SYN+ACK is not greater than 1024, the process returns to step 207; if the number of times the TCP packet containing the SYN+ACK is set is greater than 1024, then the step is performed. 211.

Step 211: Delete the connection tracking of the current TCP packet.

It should be noted that, in the embodiment of the present invention, the first unit time and the second unit time may be set according to actual requirements, and are not limited herein.

The method for preventing network attacks provided by the embodiment of the present invention reduces the number of unnecessary retransmission SYN+ACK packets while increasing the number of receiving TCP connections compared with the prior art. Control the number of TCP packets in a unit of time. By using the method of "1 increase and decrease", the SYN flood attack can be effectively reduced, and the efficiency of network attack prevention is improved. In addition, the CPU resources in the access device are depleted. When the buffer is filled, the connection request of the normal TCP packet can be processed in time to ensure the normal communication of the user.

FIG. 3 is a structural diagram of an apparatus for preventing a network attack according to an embodiment of the present invention. As shown in FIG. 3, the apparatus for preventing network attacks may include: a setting module 031, a determining module 032, a sending module 033, and a receiving module 034; among them,

The setting module 031 is configured to set the number of times of resending the first message to be k, where k is a natural number; in an actual application, the setting module 031 is configured to set the number of times of resending the first message to be k, The number of TCP packets processed by the transmission control protocol in the first unit time is n, where k and n are natural numbers;

The determining module 032 is configured to obtain information about a TCP packet sent by the client, and determine the type of the information according to the connection tracking entry; the information type includes valid information and invalid information;

The sending module 033 is configured to establish a connection tracking for the TCP message of the invalid information and send the first message to the client.

The receiving module 034 is configured to resend the first message if the second message sent by the client is not received in the second unit time; the number of resends is greater than k and the client is still not received. When the second message is sent, the connection tracking is deleted.

Further, the setting module 031 is further configured to set the number of receiving TCP connections to be m, where m is a natural number;

The sending module 033 is further configured to determine the number of currently received TCP connections;

And configuring, if the number of the currently received TCP connections is greater than m, discarding the TCP packets; if the number of currently received TCP connections is less than or equal to m, establishing a connection tracking for the TCP packets and The client sends the first message.

Further, the k is 3, the first unit time is 1 second, n is 10, and m is 1024.

Further, the information of the TCP packet includes: a source IP address, a destination IP address, a source port, a destination port, and a protocol;

The second message is a TCP packet including the ACK being set.

The device in this embodiment may be used to implement the technical solution of the foregoing method embodiment, and the implementation principle and the technical effect are similar, and details are not described herein again.

In practical applications, the setting module 031, the determining module 032, the sending module 033, and the receiving module 034 may be a central processing unit (CPU), a microprocessor (MPU), and a digital signal processor (DSP) located on the access device. Or device implementation such as field programmable gate array (FPGA).

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the computer is readable and stored The instructions in the reservoir produce an article of manufacture comprising an instruction device that implements the functions specified in one or more blocks of the flow or in a flow or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Industrial applicability

The embodiment of the present invention obtains the information of the TCP packet sent by the client by setting the number of times of resending the first message to k, and determines the type of the information according to the connection tracking entry. When the information type is invalid, The TCP message of the invalid information establishes a connection tracking and sends the first message to the client, and resends the first message when the second message sent by the client is not received within the second unit time a message; and when the number of retransmissions is greater than k and the second message sent by the client is still not received, the connection tracking is deleted, and the transmission control of the TCP packet is implemented; thus, the SYN is effectively reduced. Flood attacks increase the efficiency of network attack prevention.

Claims

A method of preventing a network attack, the method comprising:

Set the number of times to resend the first message to k, where k is a natural number;

Obtaining information about the TCP packet sent by the client, and determining the type of the information according to the connection tracking entry; the information type includes valid information and invalid information;

Establishing a connection tracking for the TCP message of the invalid information and sending the first message to the client;

If the second message sent by the client is not received in the second unit time, the first message is resent; the number of resends is greater than k and the second message sent by the client is still not received. When the connection trace is deleted.
The method of claim 1, wherein the method further comprises: setting the number of receiving TCP connections to m, wherein m is a natural number;

Establishing a connection tracking for the TCP message of the invalid information and sending the first message to the client, including:

Determine the number of currently received TCP connections;

If the number of the currently received TCP connections is greater than m, the TCP packet is discarded; if the number of currently received TCP connections is less than or equal to m, establishing a connection tracking for the TCP packet and going to the client Send the first message.
The method of claim 2, wherein the k is 3, the first unit time is 1 second, and m is 1024.
The method according to claim 1, 2 or 3, wherein the information of the TCP packet comprises: a source IP address, a destination IP address, a source port, a destination port, and a protocol;

The first message is a TCP packet including a handshake signal SYN+ confirming that the ACK is set;

The second message is a TCP packet including the ACK being set.
A device for preventing a network attack, the device comprising:

Setting a module, configured to set the number of times to resend the first message to k, where k is a natural number;

The determining module is configured to obtain information about the TCP packet sent by the client, and determine the type of the information according to the connection tracking entry; the information type includes valid information and invalid information;

a sending module, configured to establish a connection tracking for the TCP message of the invalid information, and send the first message to the client;

a receiving module, configured to resend the first message if the second message sent by the client is not received in the second unit time; the number of resending times is greater than k and the sending by the client is still not received The connection tracking is deleted when the second message is received.
The device according to claim 5, wherein the setting module is further configured to set the number of receiving TCP connections to be m, where m is a natural number;

The sending module is further configured to determine the number of currently received TCP connections;

And configuring, if the number of the currently received TCP connections is greater than m, discarding the TCP packets; if the number of currently received TCP connections is less than or equal to m, establishing a connection tracking for the TCP packets and The client sends the first message.
The apparatus according to claim 6, wherein said k is 3, said first unit time is 1 second, and m is 1024.
The device according to claim 5, 6 or 7, wherein the information of the TCP packet includes: a source IP address, a destination IP address, a source port, a destination port, and a protocol;

The first message is a TCP packet including a handshake signal SYN+ confirming that the ACK is set;

The second message is a TCP packet including the ACK being set.
A computer readable storage medium comprising a set of instructions for performing the method of preventing a network attack of any one of claims 1 to 4.