WO2018040793A1 - 防御分布式反射拒绝服务攻击的方法、装置及交换机 - Google Patents

防御分布式反射拒绝服务攻击的方法、装置及交换机 Download PDF

Info

Publication number
WO2018040793A1
WO2018040793A1 PCT/CN2017/094053 CN2017094053W WO2018040793A1 WO 2018040793 A1 WO2018040793 A1 WO 2018040793A1 CN 2017094053 W CN2017094053 W CN 2017094053W WO 2018040793 A1 WO2018040793 A1 WO 2018040793A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
ntp
client
mac address
packet
Prior art date
Application number
PCT/CN2017/094053
Other languages
English (en)
French (fr)
Inventor
游学晖
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2018040793A1 publication Critical patent/WO2018040793A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers

Definitions

  • the present invention relates to the field of network security, and in particular, to a method, a device, and a switch for defending against a Distributed Reflection Denial of Service (DRDOS) attack.
  • DRDOS Distributed Reflection Denial of Service
  • the Network Time Protocol is a protocol for time synchronization between a distributed time server and a client.
  • the purpose of the protocol is to synchronize the clocks of all clocked devices in the network.
  • the clocks of all devices in the network are consistent, enabling the device to provide multiple applications based on uniform time. For a local system running NTP, it can receive synchronization from other clock sources, synchronize other clocks as a clock source, and synchronize with other devices.
  • NTP communicates in client and server mode.
  • the client sends a request packet.
  • the server sends back a response packet.
  • Both packets are time stamped.
  • NTP determines the time error based on the timestamps of the two packets and eliminates the effects of network transmission uncertainty through a series of algorithms.
  • there is a one-to-one point-to-point method between the client and the server and there are multiple clients to the broadcast/multicast mode of one server.
  • the working methods of the two are basically the same.
  • the client in both modes performs a brief exchange of information with the server at the initial time, and accordingly quantifies the round trip delay.
  • NTP transmits packets based on the User Data Protocol (UDP).
  • UDP port number used is 123. Since the UDP protocol is for connectionless, the source network protocol (IP) address of the client sending the request packet is easy to forge.
  • IP network protocol
  • the attacker sends a large number of packets with the client IP address to the server, the server A large number of responses are made based on the client's IP address, creating a reflection attack.
  • the DRDOS attack is based on the characteristics of UDP.
  • NTP contains a monlist command, which can get the latest 600 client IPs synchronized with the target NTP server.
  • the response packets are divided according to every 6 IPs. Each client IP receives at most 100 response packets. . Therefore, a small request packet can obtain a large number of consecutive UDP packets consisting of IP addresses. This feature is combined with the NTP protocol for the connectionless UDP protocol. If the attacker forges the target IP address to be attacked Multiple NTP servers initiate monlist query commands. Multiple NTP servers send a large number of newly synchronized client IP packets to the attacked target IP address, occupying the target IP bandwidth resources, thus causing a reflective distributed denial of service attack. This is a typical DRDoS attack. European well-known content delivery networks and decentralized domain name service providers have suffered from large-scale NTP DRDOS attacks, attacking peak traffic of 350 Gbps for two hours, and even affecting the entire European network, posing great risks to network stability.
  • the Kiss-o'-Death mechanism is used to limit the request frequency. In practical applications, this mechanism will make NTP The server sends a Kiss-o'-Death message when the client requests a synchronization frequency that is too high, and stops time synchronization.
  • embodiments of the present invention are directed to providing a method, apparatus, and switch for defending against DRDOS attacks, which avoid system network congestion collapse caused by DRDOS attacks, and effectively prevent time synchronization failure caused by Kiss-o'-Death attacks. happened.
  • the embodiment of the invention provides a method for defending against a distributed reflection denial of service attack, comprising: receiving a first network time protocol NTP message sent by a server; obtaining a data type of the first NTP message and the first NTP message The Internet Protocol IP address and the media access control MAC address of the client included in the text; the first NTP according to the data type of the first NTP message, the pre-stored binding table, and the IP address and MAC address of the client The packet is processed.
  • the binding table is generated by parsing and storing the IP address and the MAC address included in the second NTP packet sent by the client.
  • processing the first NTP packet includes: The data type of the NTP packet is type 3, and the first NTP packet is discarded; if the data type of the first NTP packet is type 1, 2, or 6, the first NTP packet is forwarded; The data type of the first NTP packet is type 4, 5, or 7.
  • the IP address and MAC address of the client are stored in the pre-stored binding table. If the IP address and MAC address of the client do not exist.
  • the first NTP packet is discarded in the pre-stored binding table, and the first NTP packet is forwarded to the pre-stored binding table if the IP address and the MAC address of the client are in the pre-stored binding table.
  • the client is discarded in the pre-stored binding table, and the first NTP packet is forwarded to the pre-stored binding table if the IP address and the MAC address of the client are in the pre-stored binding table.
  • the method before receiving the first NTP message sent by the server, the method further includes: receiving a second NTP message sent by the client; acquiring a data type of the second NTP message and an IP of the client The second NTP packet is processed according to the data type of the second NTP packet, the pre-stored binding table, and the IP address and MAC address of the client.
  • the processing according to the data type of the second NTP packet, the pre-stored binding table, and the IP address and the MAC address of the client, processing the second NTP packet, if the second If the data type of the NTP packet is type 4, 5, or 6, the second NTP packet is discarded. If the data type of the second NTP packet is type 1, 2, or 7, the second NTP is forwarded to the server.
  • the data type of the second NTP packet is type 3
  • check whether the IP address and MAC address of the client exist in the pre-stored binding table if the IP address and MAC address of the client are The IP address and MAC address of the client are bound and stored, and the second NTP message is forwarded to the server, if the IP address and MAC address of the client are not present in the pre-stored binding table.
  • the second NTP message is forwarded to the server in the pre-stored binding table.
  • the method further includes: setting a timer for each entry of the pre-stored binding table; if the timer time is exceeded, deleting the IP of the client in the timer corresponding entry Address, MAC address.
  • the method further includes: refreshing the IP of the client The timer of the address and MAC address entry.
  • the embodiment of the present invention further provides an apparatus for defending against a distributed reflection denial of service attack, comprising: a receiving module, configured to receive a first network time protocol NTP message sent by the server; and an acquiring module, configured to acquire the first NTP message The data type of the text and the Internet Protocol IP address and the media access control MAC address of the client included in the first NTP message, where the binding table is included in the second NTP message sent by the client by parsing and storing the packet The IP address and the MAC address are generated; the processing module is configured to process the first NTP packet according to the data type of the first NTP packet, the pre-stored binding table, and the IP address and MAC address of the client. .
  • the processing module is configured to: if the data type of the first NTP packet is type 3, discarding the first NTP packet; if the data type of the first NTP packet is type 1, 2 or 6, forwarding the first NTP message; if the data type of the first NTP message is type 4, 5, or 7, check whether the IP address and MAC address of the client exist in the pre-stored binding. In the table, if the IP address and the MAC address of the client do not exist in the pre-stored binding table, the first NTP message is discarded, and if the IP address and MAC address of the client exist in the pre-stored In the binding table, the first NTP message is forwarded to the client.
  • the receiving module is further configured to receive a second NTP message sent by the client, where the acquiring module is configured to obtain a data type of the second NTP message and an IP address and a MAC address of the client.
  • the processing module is configured to process the second NTP message according to the data type of the second NTP message, the pre-stored binding table, and the IP address and MAC address of the client.
  • the processing module is further configured to: if the data type of the second NTP packet is type 4, 5, or 6, discarding the second NTP packet; and if the data of the second NTP packet is If the type is 2, 2, or 7, the second NTP message is forwarded to the server; if the data type of the second NTP message is type 3, check whether the IP address and MAC address of the client exist in the In the pre-stored binding table, if the IP address and MAC address of the client do not exist in the pre-stored binding table, the IP address and the MAC address of the client are bound and stored, and the server is forwarded to the server. And the second NTP message, if the IP address and the MAC address of the client are in the pre-stored binding table, forwarding the second NTP message to the server.
  • the device further includes: a setting module, configured to: set a timer for each entry of the pre-stored binding table; the processing module is further configured to delete the timer if the timer time is exceeded The IP address and MAC address of the client in the timer corresponding entry.
  • a setting module configured to: set a timer for each entry of the pre-stored binding table; the processing module is further configured to delete the timer if the timer time is exceeded The IP address and MAC address of the client in the timer corresponding entry.
  • the processing module is further configured to refresh a timer of the client's IP address and MAC address corresponding entry.
  • the embodiment of the invention further provides a switch for defending against distributed reflection denial of service attacks, wherein the switch comprises the above device.
  • the embodiment of the present invention further provides a computer storage medium, where the computer storage medium stores an execution instruction, and the execution instruction is used to execute the foregoing method.
  • Embodiments of the present invention provide a method, apparatus, and switch for defending against a DRDOS attack, the method comprising receiving a client or The NTP packet sent by the server; the data type of the NTP packet, the IP address of the client, and the media access control (MAC) address; the data type of the NTP packet, the pre-stored binding table, and the client's The NTP packet is processed by the IP address and the MAC address.
  • This avoids the system network congestion caused by the DRDOS attack and effectively prevents the time synchronization failure caused by the Kiss-o'-Death attack.
  • Embodiment 1 is a flowchart of Embodiment 1 of a method for defending against a DRDOS attack according to the present invention
  • Embodiment 3 is a flowchart of Embodiment 2 of a method for defending against a DRDOS attack according to the present invention
  • FIG. 4 is a flowchart of processing an NTP packet sent by a client according to the present invention.
  • FIG. 5 is a flowchart of processing an NTP packet sent by a server according to the present invention.
  • FIG. 6 is a schematic structural diagram of an apparatus for defending against a DRDOS attack according to the present invention.
  • execution body of the embodiment provided by the present invention is a switch, and a method for defending against DRDOS attacks is specifically described below with reference to the drawings.
  • FIG. 1 is a flowchart of Embodiment 1 of a method for defending against a DRDOS attack according to the present invention. As shown in FIG. 1, the method provided in this embodiment includes:
  • Step 101 Receive a first NTP packet sent by the server.
  • Step 102 Obtain the data type of the first NTP message and the IP address and MAC address of the client included in the first NTP message.
  • FIG. 2 is a process of processing an NTP packet header according to the present invention.
  • the underlying driver receives an NTP packet, and then parses and records the NTP packet according to ETH->IP->UDP sequence.
  • the ETH is the Layer 2 header of the packet.
  • the parsed packet is processed to obtain the data type of the NTP packet and the IP address and MAC address of the client.
  • NTP is performed according to the UDP->IP->ETH sequence. Encapsulation of the message.
  • Step 103 Process the first NTP packet according to the data type of the first NTP packet, the pre-stored binding table, and the IP address and MAC address of the client.
  • the binding table is generated by parsing and storing the IP address and the MAC address included in the second NTP message sent by the client.
  • the first NTP packet is discarded.
  • the first NTP packet is forwarded.
  • the data type of the first NTP packet is type 4, 5, or 7, check whether the IP address and MAC address of the client exist in the pre-stored binding table. If the IP address and MAC address of the client do not exist in the pre-stored binding. In the table, the first NTP packet is discarded. If the IP address and MAC address of the client are in the pre-stored binding table, the first NTP packet is forwarded to the client.
  • the data type of the NTP packet is 1 and the packet is an active peer mode packet.
  • the data type is 2, indicating that the packet is a passive peer mode packet, and the data type is 3, indicating the packet.
  • NTP time synchronization request If the data type is 4, the packet is an NTP time synchronization response packet. If the data type is 5, the packet is a broadcast/multicast synchronization packet.
  • the data type is 6 to indicate that the packet is a control packet.
  • a value of 7 indicates that the message is a message reserved for internal use by the control message.
  • the trusted client can be manually specified, and the IP address and MAC address of the trusted client are bound and stored in a table, thereby forming a pre-stored binding table.
  • FIG. 3 is a flowchart of Embodiment 2 of a method for defending against a DRDOS attack according to the present invention. As shown in FIG. 3, before receiving the first NTP packet sent by the server, the method provided in this embodiment further includes:
  • Step 104 Receive a second NTP message sent by the client.
  • Step 105 Obtain the data type of the second NTP message and the IP address and MAC address of the client.
  • Step 106 Process the second NTP packet according to the data type of the second NTP packet, the pre-stored binding table, and the IP address and MAC address of the client.
  • the second NTP packet is discarded.
  • the second NTP packet is forwarded to the server.
  • the data type of the second NTP packet is type 3
  • the pre-stored binding table may also store the port information of the second NTP message sent by the client. If the pre-stored binding table contains the port information entry, correspondingly, the receiving server sends the The port information contained in the packet is also obtained when an NTP message or the second NTP message sent by the client is received.
  • the method for defending the DRDOS attack includes: setting a timer for each entry of the pre-stored binding table; if the timer time is exceeded, deleting the IP address and the MAC address of the client in the timer corresponding entry.
  • timer time can be set according to the specific situation and needs. If a client does not send a packet within the time set by the timer, the IP address of the client is deleted in the pre-stored binding table. Address, MAC address, to save the memory space of the switch.
  • the method further includes: a timer for refreshing the IP address of the client and the corresponding entry of the MAC address.
  • the following provides a flowchart for processing the NTP message sent by the client.
  • 4 is a flowchart of processing an NTP packet sent by a client according to the present invention.
  • the switch receives an NTP packet sent by a client, and obtains the data type of the NTP packet and the IP address and MAC address of the client. Address, and then determine the packet type (Mode). If the Mode of the packet is 4, 5, or 6, the switch considers that the three types of packets should not be received by the client, so the packet is discarded. If the Mode of the packet is 1, 2, or 7, the switch forwards the packet normally. If the Mode of the packet is 3, the switch determines whether the IP address and MAC address of the client that sent the packet exist in the pre-stored state.
  • the binding table if it exists, the timer of the corresponding entry is refreshed and the packet is forwarded to the server. If not, the IP address and MAC address of the client are bound and stored in the pre-stored binding table. And forward the message to the server.
  • the following provides a flowchart for processing NTP messages sent by the server.
  • 5 is a flowchart of processing an NTP packet sent by a server according to the present invention.
  • the switch receives an NTP packet sent by the server, and obtains the data type of the NTP packet and the IP address and MAC address of the client. Then, the mode of the packet is determined. If the mode of the packet is 3, the switch considers that the packet of the packet should not be received by the server, so the packet is discarded. 2 or 6, the switch forwards the packet normally; if the Mode of the packet is 4, 5, or 7, the switch determines whether the IP address and MAC address of the client included in the packet exist in the pre-stored binding table. If yes, forward the packet to the server. If it does not exist, discard the packet.
  • the method for defending the DRDOS attack obtained by the embodiment obtains the IP address, the MAC address, and the data type of the sent packet of the client that sends the second NTP packet, and then performs the corresponding NTP packet according to the obtained information.
  • the processing of the client so as to prevent the attacker from impersonating the client IP to initiate a monlist query command to multiple NTP servers, causing a DRDOS attack to occur, maintaining the stability of the system network; and obtaining the client included in the first NTP message by the obtaining server
  • the IP address, the MAC address, and the data type of the packet sent by the server, and then the NTP packet is processed according to the obtained information, so that the switch can block the packet sent by the fake NTP server to ensure that the client is legal.
  • the server obtains an NTP time synchronization response message or a message such as Kiss-o'-Death.
  • FIG. 6 is a schematic structural diagram of an apparatus for defending against a DRDOS attack according to the present invention. As shown in FIG. 6, the apparatus provided in this embodiment includes:
  • the receiving module 20 is configured to receive a first NTP message sent by the server.
  • the obtaining module 21 is configured to obtain the data type of the first NTP message and the IP address and MAC address of the client included in the first NTP message.
  • the processing module 22 is configured to process the first NTP packet according to the data type of the first NTP packet, the pre-stored binding table, and the IP address and MAC address of the client.
  • the binding table is configured to parse and store the client. The IP address and MAC address contained in the second NTP packet sent by the terminal are generated.
  • processing module 22 is configured to:
  • the first NTP packet is discarded.
  • the first NTP packet is forwarded.
  • the data type of the first NTP packet is type 4, 5, or 7, check whether the IP address and MAC address of the client exist in the pre-stored binding table. If the IP address and MAC address of the client do not exist in the pre-stored binding. In the table, the first NTP packet is discarded. If the IP address and MAC address of the client are in the pre-stored binding table, the first NTP packet is forwarded to the client.
  • the receiving module 20 is further configured to receive a second NTP message sent by the client.
  • the obtaining module 21 is further configured to obtain a data type of the second NTP message and an IP address and a MAC address of the client.
  • the processing module 22 is further configured to process the second NTP message according to the data type of the second NTP message, the pre-stored binding table, and the IP address and MAC address of the client.
  • processing module 22 is configured to:
  • the second NTP packet is discarded.
  • the second NTP packet is forwarded to the server.
  • the data type of the second NTP packet is type 3
  • the device for defending against DRDOS attacks further includes:
  • Setting module 23 configured to set a timer for each entry of the pre-stored binding table
  • the processing module 22 is further configured to: if the timer time is exceeded, delete the IP address and MAC address of the client in the timer corresponding entry; and refresh the timer of the IP address and the MAC address corresponding entry of the client.
  • the device for defending against the DRDOS attack provided in this embodiment may be configured to perform the technical solution of the foregoing method embodiment, and the implementation principle and the technical effect are similar, and details are not described herein again.
  • the receiving module 20, the obtaining module 21, the processing module 22, and the setting module 23 may be a central processing unit (CPU), a microprocessor (Micro Processor Unit, etc.) located in a device that defends against DRDOS attacks. MPU), digital signal processor (DSP) or Field Programmable Gate Array (FPGA).
  • CPU central processing unit
  • DSP digital signal processor
  • FPGA Field Programmable Gate Array
  • the present invention also provides a switch for defending DRDOS, which is composed of the apparatus provided by the above device embodiment.
  • the DRDS-protected switch provided in this embodiment can prevent the attacker from impersonating the client IP to initiate a monlist query command to the NTP server, causing a DRDOS attack, and can shield the packet sent by the fake NTP server to ensure the client.
  • the device obtains NTP time synchronization response packets or Kiss-o'-Death packets from the legal server to maintain network stability.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that the computer or Performing a series of operational steps on other programmable devices to produce computer-implemented processing, such that instructions executed on a computer or other programmable device are provided for implementation in a flow or a block and/or block diagram of a block or The steps of the function specified in multiple boxes.
  • the present disclosure is applicable to the field of network security to avoid system network congestion collapse caused by DRDOS attacks, and effectively prevent time synchronization failure caused by Kiss-o'-Death attacks.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明实施例提供一种防御分布式反射拒绝服务攻击的方法，该方法包括接收服务器发送的网络时间协议NTP报文；获取NTP报文的数据类型以及NTP报文中包含的客户端的互联网协议IP地址、媒体访问控制MAC地址；根据NTP报文的数据类型、预存的绑定表以及客户端的IP地址、MAC地址对NTP报文进行处理；本发明实施例同时还提供一种防御分布式反射拒绝服务攻击的装置及交换机。

Description

防御分布式反射拒绝服务攻击的方法、装置及交换机 技术领域
本发明涉及网络安全领域，尤其涉及一种防御分布式反射拒绝服务(Distributed Reflection Denial of Service，简称：DRDOS)攻击的方法、装置及交换机。
背景技术
网络时间协议(Network Time Protocol，简称：NTP)是一种在分布式时间服务器和客户端之间进行时间同步的协议，使用该协议的目的是对网络内所有具有时钟的设备进行时钟同步，使网络内所有设备的时钟保持一致，从而使设备能够提供基于统一时间的多种应用。对于运行NTP的本地系统，既可以接收来自其他时钟源的同步，又可以作为时钟源同步其他的时钟，并且可以和其他设备互相同步。
NTP以客户机和服务器方式进行通信，客户机发送一个请求数据包，服务器接收后回送一个应答数据包，两个数据包都带有时间戳。NTP根据这两个数据包带的时间戳确定时间误差，并通过一系列算法来消除网络传输的不确定性的影响。在数据包的传送方式上，有客户机和服务器一对一的点对点方式，还有多个客户机对一个服务器的广播/多播方式，两者工作方法基本相同。处于两种方式下的客户机在初始时和服务器进行简短的信息交换，据此对往返延时进行量化判断。
NTP基于用户数据报协议(User Data Protocol，简称：UDP)进行报文传输，使用的UDP端口号为123。由于UDP协议是面向无连接的，所以客户端发送请求包的源网络协议(Internet Protocol，简称IP)地址很容易进行伪造，当攻击者发送大量带有客户端IP地址的数据包给服务器，服务器根据客户端IP地址做出大量回应，从而形成了一次反射攻击。DRDOS攻击正是基于UDP的这种特点。
NTP包含一个monlist命令，该指令可以获取与目标NTP服务器进行过同步的最新600个客户机IP，响应包按照每6个IP进行分割，每个客户机IP最多会收到返回的100个响应包。因此一个很小的请求包，就能获取到大量的由IP地址组成的连续UDP包,利用这个特性，再结合NTP协议为面向无连接的UDP协议的特点，攻击者如果伪造被攻击目标IP向多个NTP服务器发起monlist查询指令，多个NTP服务器则将大量含有最新同步过的客户端IP数据包发送至被攻击目标IP，占用目标IP带宽资源，从而造成反射式分布式拒绝服务攻击。这是一种典型的DRDoS攻击方式。欧洲知名内容传送网络及分散式域名服务供应商就曾经遭受大规模的NTP DRDOS攻击，攻击尖峰流量为350Gbps且持续两小时,甚至影响整个欧洲网络，给网络的稳定带来极大的风险。
除了NTP DRDOS攻击风险之外，波士顿大学的研究发现NTP的Kiss-o'-Death机制还存在一个漏洞，Kiss-o'-Death机制用于限制请求频率，在实际应用当中，该机制会使NTP服务器在客户端请求同步频率过高时发送Kiss-o'-Death报文，并且停止时间同步。然而研究人 员指出，因为这种机制的存在，黑客组织可以伪装一份来自于NTP服务器的Kiss-o'-Death报文，且将它传送到与服务器连接的客户端上，之后客户端将不再向服务器请求同步，从而无法更新时间，形成阻断服务攻击，最终增加因系统的时间错误带来诸多的安全隐患和风险。
发明内容
有鉴于此，本发明实施例期望提供一种防御DRDOS攻击的方法、装置及交换机，避免了由于DRDOS攻击造成的系统网络拥塞崩溃，同时有效地防止Kiss-o'-Death攻击导致的时间同步失败的发生。
本发明实施例的技术方案是这样实现的：
本发明实施例提供一种防御分布式反射拒绝服务攻击的方法，包括：接收服务器发送的第一网络时间协议NTP报文；获取所述第一NTP报文的数据类型以及所述第一NTP报文中包含的客户端的互联网协议IP地址、媒体访问控制MAC地址；根据所述第一NTP报文的数据类型、预存的绑定表以及所述客户端的IP地址、MAC地址对所述第一NTP报文进行处理；其中，所述绑定表通过解析并存储客户端发送的第二NTP报文中包含的IP地址和MAC地址生成。
可选地，所述根据所述第一NTP报文的数据类型、预存的绑定表以及所述客户端的IP地址、MAC地址对所述第一NTP报文进行处理包括：若所述第一NTP报文的数据类型为类型3，丢弃所述第一NTP报文；若所述第一NTP报文的数据类型为类型1、2或6，转发所述第一NTP报文；若所述第一NTP报文的数据类型为类型4、5或7，查看所述客户端的IP地址、MAC地址是否存在于所述预存的绑定表中，若所述客户端的IP地址、MAC地址不存在于所述预存的绑定表中，丢弃所述第一NTP报文，若所述客户端的IP地址、MAC地址存在于所述预存的绑定表中，将所述第一NTP报文转发给所述客户端。
可选地，所述接收服务器发送的第一NTP报文之前，该方法还包括：接收客户端发送的第二NTP报文；获取所述第二NTP报文的数据类型以及所述客户端的IP地址、MAC地址；根据所述第二NTP报文的数据类型、所述预存的绑定表以及所述客户端的IP地址、MAC地址对所述第二NTP报文进行处理。
可选地，所述根据所述第二NTP报文的数据类型、预存的绑定表以及所述客户端的IP地址、MAC地址对所述第二NTP报文进行处理包括：若所述第二NTP报文的数据类型为类型4、5或6，丢弃所述第二NTP报文；若所述第二NTP报文的数据类型为类型1、2或7，向服务器转发所述第二NTP报文；若所述第二NTP报文的数据类型为类型3，查看所述客户端的IP地址、MAC地址是否存在于所述预存的绑定表中，若所述客户端的IP地址、MAC地址不存在于所述预存的绑定表中，绑定且存储所述客户端的IP地址、MAC地址，并向所述服务器转发所述第二NTP报文，若所述客户端的IP地址、MAC地址存在于所述预存的绑定表中，向所述服务器转发所述第二NTP报文。
可选地，该方法还包括：为所述预存的绑定表的每个表项设置一个定时器；若超过所述定时器时间，删除所述定时器对应表项中的所述客户端的IP地址、MAC地址。
可选地，若所述客户端的IP地址、MAC地址存在于所述预存的绑定表中，向所述服务器转发所述第二NTP报文之后，该方法还包括：刷新所述客户端的IP地址、MAC地址对应表项的定时器。
本发明实施例还提供一种防御分布式反射拒绝服务攻击的装置，包括：接收模块，设置为接收服务器发送的第一网络时间协议NTP报文；获取模块，设置为获取所述第一NTP报文的数据类型以及所述第一NTP报文中包含的客户端的互联网协议IP地址、媒体访问控制MAC地址，其中，所述绑定表通过解析并存储客户端发送的第二NTP报文中包含的IP地址和MAC地址生成；处理模块，设置为根据所述第一NTP报文的数据类型、预存的绑定表以及所述客户端的IP地址、MAC地址对所述第一NTP报文进行处理。
可选地，所述处理模块设置为：若所述第一NTP报文的数据类型为类型3，丢弃所述第一NTP报文；若所述第一NTP报文的数据类型为类型1、2或6，转发所述第一NTP报文；若所述第一NTP报文的数据类型为类型4、5或7，查看所述客户端的IP地址、MAC地址是否存在于所述预存的绑定表中，若所述客户端的IP地址、MAC地址不存在于所述预存的绑定表中，丢弃所述第一NTP报文，若所述客户端的IP地址、MAC地址存在于所述预存的绑定表中，将所述第一NTP报文转发给所述客户端。
可选地，所述接收模块还设置为接收客户端发送的第二NTP报文；所述获取模块设置为获取所述第二NTP报文的数据类型以及所述客户端的IP地址、MAC地址；所述处理模块设置为根据所述第二NTP报文的数据类型、预存的绑定表以及所述客户端的IP地址、MAC地址对所述第二NTP报文进行处理。
可选地，所述处理模块还设置为：若所述第二NTP报文的数据类型为类型4、5或6，丢弃所述第二NTP报文；若所述第二NTP报文的数据类型为类型1、2或7，向服务器转发所述第二NTP报文；若所述第二NTP报文的数据类型为类型3，查看所述客户端的IP地址、MAC地址是否存在于所述预存的绑定表中，若所述客户端的IP地址、MAC地址不存在于所述预存的绑定表中，绑定且存储所述客户端的IP地址、MAC地址，并向所述服务器转发所述第二NTP报文，若所述客户端的IP地址、MAC地址存在于所述预存的绑定表中，向所述服务器转发所述第二NTP报文。
可选地，所述装置还包括：设置模块，设置为为所述预存的绑定表的每个表项设置一个定时器；所述处理模块还设置为若超过所述定时器时间，删除所述定时器对应表项中的所述客户端的IP地址、MAC地址。
可选地，所述处理模块还设置为刷新所述客户端的IP地址、MAC地址对应表项的定时器。
本发明实施例还提供一种防御分布式反射拒绝服务攻击的交换机，其中，所述交换机包括上述的装置。
本发明实施例还提供一种计算机存储介质，所述计算机存储介质存储有执行指令，所述执行指令用于执行上述的方法。
本发明实施例提供防御DRDOS攻击的方法、装置及交换机，该方法包括接收客户端或 服务器发送的NTP报文；获取NTP报文的数据类型以及客户端的IP地址、媒体访问控制(Media Access Control，简称：MAC)地址；根据NTP报文的数据类型、预存的绑定表以及客户端的IP地址、MAC地址对NTP报文进行处理；如此，避免了由于DRDOS攻击造成的系统网络拥塞崩溃，同时有效地防止Kiss-o'-Death攻击导致的时间同步失败的发生。
附图说明
图1为本发明防御DRDOS攻击的方法实施例一的流程图；
图2为本发明对NTP报文头部处理的过程；
图3为本发明防御DRDOS攻击的方法实施例二的流程图；
图4为本发明对客户端发送的NTP报文的处理流程图；
图5为本发明对服务器发送的NTP报文的处理流程图；
图6为本发明防御DRDOS攻击的装置实施例的结构示意图。
具体实施方式
需要说明的是，本发明提供的实施例的执行主体是交换机，下面结合图示具体说明防御DRDOS攻击的方法。
图1为本发明防御DRDOS攻击的方法实施例一的流程图。如图1所示，本实施例提供的方法包括：
步骤101：接收服务器发送的第一NTP报文；
步骤102：获取第一NTP报文的数据类型以及第一NTP报文中包含的客户端的IP地址、MAC地址。
具体的，图2为本发明对NTP报文头部处理的过程，如图2所示，底层驱动收到NTP报文；然后按照ETH->IP->UDP顺序对NTP报文进行解析、记录，其中，ETH是报文的二层头；接着对解析后的报文进行处理，获取NTP报文的数据类型以及客户端的IP地址、MAC地址；再按照UDP->IP->ETH顺序进行NTP报文的封装。
步骤103：根据第一NTP报文的数据类型、预存的绑定表以及客户端的IP地址、MAC地址对第一NTP报文进行处理。其中，所述绑定表通过解析并存储客户端发送的第二NTP报文中包含的IP地址和MAC地址生成。
具体的，若第一NTP报文的数据类型为类型3，丢弃第一NTP报文；
若第一NTP报文的数据类型为类型1、2或6，转发第一NTP报文；
若第一NTP报文的数据类型为类型4、5或7，查看客户端的IP地址、MAC地址是否存在于预存的绑定表中，若客户端的IP地址、MAC地址不存在于预存的绑定表中，丢弃第一NTP报文，若客户端的IP地址、MAC地址存在于预存的绑定表中，将第一NTP报文转发给客户端。
需要说明的是，NTP报文的数据类型为1表示该报文是主动对等体模式报文，数据类型为2表示该报文是被动对等体模式报文，数据类型为3表示该报文是NTP时间同步请求报 文，数据类型为4表示该报文是NTP时间同步应答报文，数据类型为5表示该报文是广播/组播同步报文，数据类型为6表示该报文是控制报文，数据类型为7表示该报文是控制报文预留给内部使用的报文。
还需要说明的是，初始时，可以通过人为方式指定信任的客户端，将信任客户端的IP地址、MAC地址绑定并存储在一张表里，从而形成预存的绑定表。
图3为本发明防御DRDOS攻击的方法实施例二的流程图。如图3所示，接收服务器发送的第一NTP报文之前，本实施例提供的方法还包括：
步骤104：接收客户端发送的第二NTP报文。
步骤105：获取第二NTP报文的数据类型以及客户端的IP地址、MAC地址。
步骤106：根据第二NTP报文的数据类型、预存的绑定表以及客户端的IP地址、MAC地址对第二NTP报文进行处理。
具体的，若第二NTP报文的数据类型为类型4、5或6，丢弃第二NTP报文；
若第二NTP报文的数据类型为类型1、2或7，向服务器转发第二NTP报文；
若第二NTP报文的数据类型为类型3，查看客户端的IP地址、MAC地址是否存在于预存的绑定表中，若客户端的IP地址、MAC地址不存在于预存的绑定表中，绑定且存储客户端的IP地址、MAC地址，并向服务器转发第二NTP报文，若客户端的IP地址、MAC地址存在于预存的绑定表中，向服务器转发第二NTP报文。
需要说明的是，预存的绑定表中还可以存储客户端发送第二NTP报文的端口信息，如果预存的绑定表中包含端口信息这一表项，相应的，在接收服务器发送的第一NTP报文或接收客户端发送的第二NTP报文时也要获取报文中包含的端口信息。
进一步的，防御DRDOS攻击的方法还包括：为预存的绑定表的每个表项设置一个定时器；若超过定时器时间，删除定时器对应表项中的客户端的IP地址、MAC地址。
需要说明的是，定时器的时间可以根据具体情况和需要进行设定，某一客户端若在定时器设定的时间内没有发送报文，则在预存的绑定表中删除该客户端的IP地址、MAC地址，以节省交换机的内存空间。
进一步的，若客户端的IP地址、MAC地址存在于预存的绑定表中，向服务器转发第二NTP报文之后，还包括：刷新客户端的IP地址、MAC地址对应表项的定时器。
下面提供一个对客户端发送的NTP报文的处理流程图。图4为本发明对客户端发送的NTP报文的处理流程图，如图4所示，交换机接收客户端发送的NTP报文，通过解析获取NTP报文的数据类型以及客户端的IP地址、MAC地址，然后判断报文类型(Mode)，如果该报文的Mode为4、5或6，交换机认为这三种类型的报文不应该是通过客户端接收到的，所以将该报文丢弃；如果该报文的Mode为1、2或7，交换机对该报文进行正常转发；如果该报文的Mode为3，交换机判断发送该报文的客户端的IP地址、MAC地址是否存在于预存的绑定表中，如果存在，则刷新所对应表项的定时器并将该报文转发给服务器，如果不存在，则将客户端的IP地址、MAC地址绑定且存储在预存的绑定表中，并将该报文转发给服务器。
下面提供一个对服务器发送的NTP报文的处理流程图。图5为本发明对服务器发送的NTP报文的处理流程图，如图5所示，交换机接收服务器发送的NTP报文，通过解析获取NTP报文的数据类型以及客户端的IP地址、MAC地址，然后判断报文类型(Mode)，如果该报文的Mode为3，交换机认为这类型的报文不应该是通过服务器接收到的，所以将该报文丢弃；如果该报文的Mode为1、2或6，交换机对该报文进行正常转发；如果该报文的Mode为4、5或7，交换机判断该报文中包含的客户端的IP地址、MAC地址是否存在于预存的绑定表中，如果存在，将该报文转发给服务器，如果不存在，丢弃该报文。
本实施例提供的防御DRDOS攻击的方法，通过获取客户端发送第二NTP报文的客户端的IP地址、MAC地址以及所发送报文的数据类型，然后根据获取的这些信息对NTP报文进行相应的处理，从而避免了攻击者假冒客户端IP向多个NTP服务器发起monlist查询指令而造成DRDOS攻击的情况发生，维护了系统网络的稳定；通过获取服务器发送第一NTP报文中包含的客户端的IP地址、MAC地址以及服务器所发送报文的数据类型，然后根据获取的这些信息对NTP报文进行相应的处理，从而使得交换机能够对假冒NTP服务器发送的报文进行屏蔽，确保客户端从合法的服务器获取NTP时间同步应答报文或者Kiss-o'-Death等报文。
图6为本发明防御DRDOS攻击的装置实施例的结构示意图。如图6所示，本实施例提供的装置包括：
接收模块20，设置为接收服务器发送的第一NTP报文；
获取模块21，设置为获取第一NTP报文的数据类型以及第一NTP报文中包含的客户端的IP地址、MAC地址。
处理模块22，设置为根据第一NTP报文的数据类型、预存的绑定表以及客户端的IP地址、MAC地址对第一NTP报文进行处理；其中，所述绑定表通过解析并存储客户端发送的第二NTP报文中包含的IP地址和MAC地址生成。
具体的，处理模块22设置为：
若第一NTP报文的数据类型为类型3，丢弃第一NTP报文；
若第一NTP报文的数据类型为类型1、2或6，转发第一NTP报文；
若第一NTP报文的数据类型为类型4、5或7，查看客户端的IP地址、MAC地址是否存在于预存的绑定表中，若客户端的IP地址、MAC地址不存在于预存的绑定表中，丢弃第一NTP报文，若客户端的IP地址、MAC地址存在于预存的绑定表中，将第一NTP报文转发给客户端。
接收模块20，还设置为接收客户端发送的第二NTP报文；
获取模块21，还设置为获取第二NTP报文的数据类型以及客户端的IP地址、MAC地址；
处理模块22，还设置为根据第二NTP报文的数据类型、预存的绑定表以及客户端的IP地址、MAC地址对第二NTP报文进行处理。
具体的，处理模块22设置为：
若第二NTP报文的数据类型为类型4、5或6，丢弃第二NTP报文；
若第二NTP报文的数据类型为类型1、2或7，向服务器转发第二NTP报文；
若第二NTP报文的数据类型为类型3，查看客户端的IP地址、MAC地址是否存在于预存的绑定表中，若客户端的IP地址、MAC地址不存在于预存的绑定表中，绑定且存储客户端的IP地址、MAC地址，并向服务器转发第二NTP报文，若客户端的IP地址、MAC地址存在于预存的绑定表中，将第二NTP报文转发给服务器。
进一步的，防御DRDOS攻击的装置还包括：
设置模块23，设置为为预存的绑定表的每个表项设置一个定时器；
处理模块22，还设置为若超过定时器时间，删除定时器对应表项中的客户端的IP地址、MAC地址；刷新客户端的IP地址、MAC地址对应表项的定时器。
本实施例提供的防御DRDOS攻击的装置，可设置为执行上述方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
在实际应用中，所述接收模块20、获取模块21、处理模块22和设置模块23可由位于防御DRDOS攻击的装置中的中央处理器(Central Processing Unit，CPU)、微处理器(Micro Processor Unit，MPU)、数字信号处理器(Digital Signal Processor，DSP)或现场可编程门阵列(Field Programmable Gate Array，FPGA)等实现。
本发明还提供一种防御DRDOS的交换机，由上述装置实施例提供的装置组成。
本实施例提供的防御DRDOS的交换机，能够避免攻击者假冒客户端IP向多个NTP服务器发起monlist查询指令而造成DRDOS攻击的情况发生，并且能够对假冒NTP服务器发送的报文进行屏蔽，确保客户端从合法的服务器获取NTP时间同步应答报文或者Kiss-o'-Death等报文，从而维护网络的稳定。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用硬件实施例、软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或 其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
以上，仅为本发明的较佳实施例而已，并非用于限定本发明的保护范围。
工业实用性
本公开适用于网络安全领域，用以避免由于DRDOS攻击造成的系统网络拥塞崩溃，同时有效地防止Kiss-o'-Death攻击导致的时间同步失败的发生。

Claims (13)

  1. 一种防御分布式反射拒绝服务攻击的方法，包括：
    接收服务器发送的第一网络时间协议NTP报文；
    获取所述第一NTP报文的数据类型以及所述第一NTP报文中包含的客户端的互联网协议IP地址、媒体访问控制MAC地址；
    根据所述第一NTP报文的数据类型、预存的绑定表以及所述客户端的IP地址、MAC地址对所述第一NTP报文进行处理；其中，所述绑定表通过解析并存储客户端发送的第二NTP报文中包含的IP地址和MAC地址生成。
  2. 根据权利要求1所述的方法，其中，所述根据所述第一NTP报文的数据类型、预存的绑定表以及所述客户端的IP地址、MAC地址对所述第一NTP报文进行处理包括：
    若所述第一NTP报文的数据类型为类型3，丢弃所述第一NTP报文；
    若所述第一NTP报文的数据类型为类型1、2或6，转发所述第一NTP报文；
    若所述第一NTP报文的数据类型为类型4、5或7，查看所述客户端的IP地址、MAC地址是否存在于所述预存的绑定表中，若所述客户端的IP地址、MAC地址不存在于所述预存的绑定表中，丢弃所述第一NTP报文，若所述客户端的IP地址、MAC地址存在于所述预存的绑定表中，将所述第一NTP报文转发给所述客户端。
  3. 根据权利要求1所述的方法，其中，所述接收服务器发送的第一NTP报文之前，还包括：
    接收客户端发送的第二NTP报文；
    获取所述第二NTP报文的数据类型以及所述客户端的IP地址、MAC地址；
    根据所述第二NTP报文的数据类型、所述预存的绑定表以及所述客户端的IP地址、MAC地址对所述第二NTP报文进行处理。
  4. 根据权利要求3所述的方法，其中，所述根据所述第二NTP报文的数据类型、预存的绑定表以及所述客户端的IP地址、MAC地址对所述第二NTP报文进行处理包括：
    若所述第二NTP报文的数据类型为类型4、5或6，丢弃所述第二NTP报文；
    若所述第二NTP报文的数据类型为类型1、2或7，向服务器转发所述第二NTP报文；
    若所述第二NTP报文的数据类型为类型3，查看所述客户端的IP地址、MAC地址是否存在于所述预存的绑定表中，若所述客户端的IP地址、MAC地址不存在于所述预存的绑定表中，绑定且存储所述客户端的IP地址、MAC地址，并向所述服务器转发所述第二NTP报文，若所述客户端的IP地址、MAC地址存在于所述预存的绑定表中，向所述服务器转发所述第二NTP报文。
  5. 根据权利要求4所述的方法，还包括：
    为所述预存的绑定表的每个表项设置一个定时器；
    若超过所述定时器时间，删除所述定时器对应表项中的所述客户端的IP地址、MAC 地址。
  6. 根据权利要求5所述的方法，其中，若所述客户端的IP地址、MAC地址存在于所述预存的绑定表中，向所述服务器转发所述第二NTP报文之后，还包括：
    刷新所述客户端的IP地址、MAC地址对应表项的定时器。
  7. 一种防御分布式反射拒绝服务攻击的装置，包括：
    接收模块，设置为接收服务器发送的第一网络时间协议NTP报文；
    获取模块，设置为获取所述第一NTP报文的数据类型以及所述第一NTP报文中包含的客户端的互联网协议IP地址、媒体访问控制MAC地址，其中，所述绑定表通过解析并存储客户端发送的第二NTP报文中包含的IP地址和MAC地址生成；
    处理模块，设置为根据所述第一NTP报文的数据类型、预存的绑定表以及所述客户端的IP地址、MAC地址对所述第一NTP报文进行处理。
  8. 根据权利要求7所述的装置，其中，所述处理模块设置为：
    若所述第一NTP报文的数据类型为类型3，丢弃所述第一NTP报文；
    若所述第一NTP报文的数据类型为类型1、2或6，转发所述第一NTP报文；
    若所述第一NTP报文的数据类型为类型4、5或7，查看所述客户端的IP地址、MAC地址是否存在于所述预存的绑定表中，若所述客户端的IP地址、MAC地址不存在于所述预存的绑定表中，丢弃所述第一NTP报文，若所述客户端的IP地址、MAC地址存在于所述预存的绑定表中，将所述第一NTP报文转发给所述客户端。
  9. 根据权利要求7所述的装置，其中，
    所述接收模块，还设置为接收客户端发送的第二NTP报文；
    所述获取模块，设置为获取所述第二NTP报文的数据类型以及所述客户端的IP地址、MAC地址；
    所述处理模块，设置为根据所述第二NTP报文的数据类型、预存的绑定表以及所述客户端的IP地址、MAC地址对所述第二NTP报文进行处理。
  10. 根据权利要求9所述的装置，其中，所述处理模块还设置为：
    若所述第二NTP报文的数据类型为类型4、5或6，丢弃所述第二NTP报文；
    若所述第二NTP报文的数据类型为类型1、2或7，向服务器转发所述第二NTP报文；
    若所述第二NTP报文的数据类型为类型3，查看所述客户端的IP地址、MAC地址是否存在于所述预存的绑定表中，若所述客户端的IP地址、MAC地址不存在于所述预存的绑定表中，绑定且存储所述客户端的IP地址、MAC地址，并向所述服务器转发所述第二NTP报文，若所述客户端的IP地址、MAC地址存在于所述预存的绑定表中，向所述服务器转发所述第二NTP报文。
  11. 根据权利要求10所述的装置，其中，所述装置还包括：
    设置模块，设置为为所述预存的绑定表的每个表项设置一个定时器；
    所述处理模块，还设置为若超过所述定时器时间，删除所述定时器对应表项中的所述客户端的IP地址、MAC地址。
  12. 根据权利要求11所述的装置，其中，所述处理模块，还设置为刷新所述客户端的IP地址、MAC地址对应表项的定时器。
  13. 一种防御分布式反射拒绝服务攻击的交换机，其中，所述交换机包括如权利要求7-12任一项所述的装置。
PCT/CN2017/094053 2016-08-30 2017-07-24 防御分布式反射拒绝服务攻击的方法、装置及交换机 WO2018040793A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610777618.8 2016-08-30
CN201610777618.8A CN107786521B (zh) 2016-08-30 2016-08-30 防御分布式反射拒绝服务攻击的方法、装置及交换机

Publications (1)

Publication Number Publication Date
WO2018040793A1 true WO2018040793A1 (zh) 2018-03-08

Family

ID=61300035

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/094053 WO2018040793A1 (zh) 2016-08-30 2017-07-24 防御分布式反射拒绝服务攻击的方法、装置及交换机

Country Status (2)

Country Link
CN (1) CN107786521B (zh)
WO (1) WO2018040793A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111837358A (zh) * 2018-03-14 2020-10-27 华为技术有限公司 分布式网络时间协议
CN112615870A (zh) * 2020-12-22 2021-04-06 北京天融信网络安全技术有限公司 一种基于ntp报文数据的攻击行为检测方法及装置

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109302390A (zh) * 2018-09-21 2019-02-01 郑州云海信息技术有限公司 一种漏洞检测方法和装置
CN113746788A (zh) * 2020-05-30 2021-12-03 华为技术有限公司 一种数据处理方法及装置
CN116264510A (zh) * 2021-12-13 2023-06-16 中兴通讯股份有限公司 拒绝服务攻击防御方法及装置、可读存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1983929A (zh) * 2005-11-07 2007-06-20 索尼株式会社 数据通信系统和数据通信方法
US7379423B1 (en) * 2003-03-20 2008-05-27 Occam Networks, Inc. Filtering subscriber traffic to prevent denial-of-service attacks
CN101931627A (zh) * 2010-08-26 2010-12-29 福建星网锐捷网络有限公司 安全检测方法、装置和网络侧设备
US20160099964A1 (en) * 2014-10-01 2016-04-07 Ciena Corporation Systems and methods to detect and defend against distributed denial of service attacks

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7313613B1 (en) * 2002-01-03 2007-12-25 Microsoft Corporation System and method facilitating network diagnostics and self-healing
CN102946385B (zh) * 2012-10-30 2015-09-23 杭州华三通信技术有限公司 一种防止伪造释放报文进行攻击的方法和设备
CN104168104B (zh) * 2014-08-22 2017-12-15 华为技术有限公司 一种用于时间和频率同步的装置和方法
CN104994074B (zh) * 2015-06-01 2018-04-13 浪潮集团有限公司 一种健康体检机通信服务器的实现方法
CN105791307B (zh) * 2016-04-06 2019-09-06 新华三技术有限公司 网络时间协议报文安全认证方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7379423B1 (en) * 2003-03-20 2008-05-27 Occam Networks, Inc. Filtering subscriber traffic to prevent denial-of-service attacks
CN1983929A (zh) * 2005-11-07 2007-06-20 索尼株式会社 数据通信系统和数据通信方法
CN101931627A (zh) * 2010-08-26 2010-12-29 福建星网锐捷网络有限公司 安全检测方法、装置和网络侧设备
US20160099964A1 (en) * 2014-10-01 2016-04-07 Ciena Corporation Systems and methods to detect and defend against distributed denial of service attacks

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111837358A (zh) * 2018-03-14 2020-10-27 华为技术有限公司 分布式网络时间协议
CN111837358B (zh) * 2018-03-14 2022-01-11 华为技术有限公司 网络中时间同步的方法及系统
US11528084B2 (en) 2018-03-14 2022-12-13 Huawei Technologies Co., Ltd. Distributed network time protocol
CN112615870A (zh) * 2020-12-22 2021-04-06 北京天融信网络安全技术有限公司 一种基于ntp报文数据的攻击行为检测方法及装置

Also Published As

Publication number Publication date
CN107786521B (zh) 2021-10-19
CN107786521A (zh) 2018-03-09

Similar Documents

Publication Publication Date Title
WO2018040793A1 (zh) 防御分布式反射拒绝服务攻击的方法、装置及交换机
JP6858749B2 (ja) 負荷平衡システムにおいて接続を確立するデバイス及び方法
US11570098B2 (en) Systems, apparatuses and methods for cooperating routers
US10469532B2 (en) Preventing DNS cache poisoning
US20180176194A1 (en) Service processing method and apparatus
RU2010151959A (ru) Способ и система использования локального поддерживаемого хост-узлом кэша и криптографических хэш-функций для того, чтобы уменьшать сетевой трафик
US10911581B2 (en) Packet parsing method and device
WO2018214853A1 (zh) 一种减小dns报文长度的方法、装置、介质及设备
US10237151B2 (en) Attributing network address translation device processed traffic to individual hosts
US10848313B2 (en) Methods and systems for network security using a cryptographic firewall
US20220174072A1 (en) Data Processing Method and Device
US20200267189A1 (en) Lawful interception security
WO2012088934A1 (zh) 一种报文过滤方法和交换设备
US10268532B2 (en) Application message processing system, method, and application device
CN102427452B (zh) 同步报文发送方法、装置和网络设备
Johari et al. Secure query processing in delay tolerant network using java cryptography architecture
US20180007159A1 (en) Systems, devices, and methods for protecting access privacy of cached content
US11716222B2 (en) Communications bridge
CA3043576A1 (en) Systems, apparatuses and methods for cooperating routers
US20230171191A1 (en) Systems, Apparatuses and Methods for Cooperating Routers
KR101361061B1 (ko) 서버/클라이언트 네트워크에서의 효율적인 정보 전송 방법및 이를 이용한 서버 장치와 클라이언트 장치
US11159562B2 (en) Method and system for defending an HTTP flood attack
Biagioni Preventing UDP flooding amplification attacks with weak authentication
WO2016184079A1 (zh) 一种处理系统日志报文的方法和装置
TWI600298B (zh) 網路位址轉換穿透方法以及使用該方法的系統

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17845096

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17845096

Country of ref document: EP

Kind code of ref document: A1