WO2020043098A1 - 建立设备表项 - Google Patents

建立设备表项 Download PDF

Info

Publication number
WO2020043098A1
WO2020043098A1 PCT/CN2019/102852 CN2019102852W WO2020043098A1 WO 2020043098 A1 WO2020043098 A1 WO 2020043098A1 CN 2019102852 W CN2019102852 W CN 2019102852W WO 2020043098 A1 WO2020043098 A1 WO 2020043098A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
trust value
message type
network device
target network
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/102852
Other languages
English (en)
French (fr)
Inventor
赵赟
张友和
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
New H3C Technologies Co Ltd
Original Assignee
New H3C Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by New H3C Technologies Co Ltd filed Critical New H3C Technologies Co Ltd
Publication of WO2020043098A1 publication Critical patent/WO2020043098A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic

Definitions

  • a wireless communication network usually includes an access controller (English: Access Controller, AC for short), an access point (English: Access Point, AP for short), and a user terminal.
  • An AP can be an AP that enables the wireless intrusion prevention system (English: Wireless Intrusion Prevention System, WIPS for short). Based on WIPS, the AP can scan the packets sent and received by each network device within its scanning radio frequency range. The scanned packets determine whether the network device is a malicious device.
  • the specific processing procedure is: for an AP without WIPS function, when it detects the beacon message and probe response message sent by the AP, it determines that the AP is a legitimate AP, and then creates a device entry corresponding to the AP, the device The entry may store information such as the Media Access Control (English: MAC) address, signal strength, and service set identifier (English: Service Set Identifier (SSID)) of the AP.
  • Media Access Control English: MAC
  • SSID Service Set Identifier
  • the beacon message or probe response message sent by the AP does not create a device entry corresponding to the AP; for a user terminal, when a probe request message and a data message sent by the user terminal are detected
  • the device entry may store a media access control (English: Media Access Control (MAC)) address of the user terminal, signal strength, and association relationship with other network devices If the probe or request message or data message sent by the user terminal is not detected, no entry corresponding to the user terminal is created.
  • MAC Media Access Control
  • FIG. 1 is a system framework diagram provided by an embodiment of the present application
  • FIG. 2 is a flowchart of a method for establishing a device entry according to an embodiment of the present application
  • FIG. 3 is a flowchart of an example of a method for establishing a device entry according to an embodiment of the present application
  • FIG. 4 is a flowchart of another example of a method for establishing a device entry according to an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of an apparatus for establishing a device table entry according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of an apparatus for establishing a device table entry according to an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of an apparatus for establishing a device table entry according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of an apparatus for establishing a device entry provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of an AP according to an embodiment of the present application.
  • some illegal devices use a source-variable packet attack to carry out network attacks. For example, an illegal user terminal sends a large number of probe request and data packets through different source MAC addresses. It is determined that the user terminal is a legitimate user terminal. Because each packet carries a different MAC address, the AC considers that there are multiple legitimate user terminals and creates multiple invalid device entries. Therefore, in the related art, the accuracy of the WIPS-enabled AP learning device is low.
  • An embodiment of the present application provides a method for establishing a device entry, and the method can be applied to an AP in a wireless communication network.
  • Wireless communication networks usually also include AC and user terminals that access the network through APs.
  • the AP to which this method is applied may be an AP with WIPS function enabled.
  • a technician can select several APs based on the coverage of each AP in the wireless communication network, and send the configuration information to enable the WIPS function to these APs through the AC to make it a monitoring device.
  • the WIPS-enabled AP is referred to as a monitoring device in the embodiments of the present application.
  • the AC is connected to multiple APs and multiple monitoring devices, where each AP corresponds to a pre-assigned channel, and the terminal can access an AP and access the network through the channel of the AP.
  • a system frame diagram provided by an embodiment of the present application includes an AC, multiple APs, multiple monitoring devices, and multiple terminals. Among them, AC is connected to AP1, AP2, monitoring device 1 and monitoring device 2; terminal 1 and terminal 2 are connected to the wireless communication network through AP1, and terminal 3 and terminal 4 are connected to the wireless communication network through AP2.
  • the method for establishing a device entry can be applied to the above monitoring devices.
  • the monitoring device may establish a temporary device entry corresponding to the target network device, and then continue to detect the target communication of the target network device within a preset period of time.
  • Message and determine the trust value corresponding to the target message type of the target communication message according to the correspondence between the message type and the trust value of the pre-stored communication message, and then update the target according to the trust value corresponding to the target message type Trust value of the network device. Only when the trust value reaches a preset trust value threshold will the monitoring device establish a formal device entry corresponding to the target network device according to the temporary device entry corresponding to the target network device.
  • the illegal network equipment usually does not perform normal business processes and the types of communication messages sent are relatively single, so this solution can effectively identify legitimate network equipment and only target legitimate network equipment.
  • Network equipment establishes formal equipment entries, which improves the accuracy of monitoring equipment learning equipment.
  • the technician can pre-configure the policies for establishing device entries provided by this solution in the AC, and the AC sends these policies to the monitoring devices, so that each monitoring device can implement the device creation table proposed in the embodiment of this application. Item method.
  • Step 201 When a first message type communication message sent by the target network device is detected, a temporary device entry corresponding to the target network device is established.
  • the monitoring device can monitor packets sent and received by each network device within its radio frequency range. For example, for an AP, a monitoring device can monitor a beacon message, a probe response message (that is, a probe response message) sent by the AP, and a data message (that is, an AP data message) sent by the AP to a user terminal. For a user terminal, the monitoring device can monitor a probe request message, an association request message, and a data message (ie, a user data message) sent by the user terminal to the AP.
  • the monitoring device can also obtain device information of each network device within its monitoring range.
  • the device information includes at least the device identification and the occupied channel of the network device.
  • the device identifier may be a MAC address.
  • the device information may also include information such as device association information, the signal strength of the network device, and the frequency of communication messages sent by the network device.
  • the device association information may include an identifier of an AP accessed by the network device, a destination address in a communication packet sent by the network device, and the like. For APs, the device association information can also include information such as the SSID.
  • a monitoring device When a monitoring device detects a specific type (that is, the first message type) communication message sent by a network device (that is, the target network device), the monitoring device can determine whether a device entry corresponding to the target network device has been established locally. If a device entry corresponding to the target network device is not established (the device entry includes a temporary device entry and a formal device entry), a temporary device entry corresponding to the target network device is established.
  • the temporary device entry may include information such as the MAC address, signal strength, and occupied channel of the target network device.
  • the temporary device entry may further include an SSID; when the target network device is a user terminal, the temporary device entry may further include device association information.
  • the monitoring device does not perform subsequent processing; if a temporary device entry corresponding to the target network device has not been established locally, it can be updated according to the processing procedure of step 202
  • the trust value corresponding to the target network device will be described in detail later.
  • the first message type when the target network device is an AP without WIPS enabled, the first message type may be a beacon message type; when the target network device is a user terminal, the first message type may be a probe request message type .
  • Step 202 Detect a target communication message of a target network device within a preset time period, and determine a correspondence corresponding to a target message type of the target communication message according to a correspondence relationship between a message type and a trust value of a pre-stored communication message. Trust value.
  • a correspondence between a message type and a trust value of a communication message may be stored in the monitoring device in advance.
  • the correspondence may be set by a technician, and the correspondence may be stored in the form of a correspondence table. .
  • the content of the corresponding correspondence settings may be different.
  • the message types in the correspondence include a beacon message type, a probe response message (that is, a probe response message) type, and authentication.
  • a response message type that is, an authentication response message
  • an association response message that is, an association response message
  • the trust value corresponding to different message types may be different.
  • the beacon message is a periodically broadcasted message by the AP, and the beacon message type may correspond to a smaller trust value, such as 2.
  • the probe response message is the AP. Sent after receiving the probe request message sent by the user terminal, and the AP responds to the probe request message is a business function that the AP usually has. Therefore, the type of the probe response message can correspond to a larger trust value, such as 20; for the same reason
  • the authentication message type and association message type can also correspond to a larger trust value, such as 20.
  • AP data packets are less effective at identifying rogue APs, and AP data packet types can correspond to lower trust values, such as 10. For the same reason, for APs, user data packets are also effective at identifying rogue APs Lower, the trust value corresponding to the user data packet type can be lower than the trust value corresponding to the AP data packet type, such as 5.
  • the message types in the correspondence include a probe request message (that is, a probe request message) type, and an authentication response message (that is, an authentication response message).
  • a probe request message that is, a probe request message
  • an authentication response message that is, an authentication response message
  • Type association response message (i.e., association response message) type
  • authentication request message i.e., authentication request message
  • association request message i.e., association request message
  • user data message type AP data
  • AP data One or more of the message types.
  • the trust value corresponding to different message types may be different.
  • the probe request message is a message broadcast by the user terminal periodically, and the probe request type may correspond to a smaller trust value, such as 2;
  • the message, the association request message, and the user data message are messages sent by the user terminal for conducting services, and can correspond to a larger trust value, such as 10.
  • the authentication response, association response, and AP data packets are messages that the AP responds to the user terminal. Since the AP has a certain identification capability, and the AP usually only responds to legitimate user terminals, these three types
  • the trust value corresponding to the packet can be larger, such as 20.
  • the monitoring device After the monitoring device establishes a temporary device entry corresponding to the target network device, it can start a timer to start counting, and can continue to detect communication packets of the target network device.
  • a communication message ie, a target communication message
  • the monitoring device can query the corresponding correspondence table according to the device type of the target network device, and then determine the target message of the target communication message.
  • the trust value corresponding to the type Among them, if the target message type does not exist in the correspondence table, the trust value corresponding to the target message type can be considered as 0, that is, the trust value corresponding to the target network device is not updated.
  • Step 203 Update the trust value of the target network device according to the trust value corresponding to the target message type.
  • an update policy of a trust value of a network device may be stored in the monitoring device in advance, and the update policy may be set by a technician.
  • the trust value of the target network device may be increased multiple times, and for other The message type can only increase the trust value of the target network device once.
  • the specific process can be as follows: determine whether the target message type is the first message type; if the target message type is the first message type, obtain the Update the update time of the trust value of the target network device according to the trust value corresponding to the first message type; if the time interval between the update time and the current time exceeds the preset duration threshold, execute the update according to the trust value corresponding to the target message type Step of the trust value of the target network device; if the target message type is not the first message type, determine whether the trust value of the target network device has been updated according to the target message type before the target communication message is detected; The target message type is based on the trust value of the target network device, and the trust value corresponding to the target message type is executed. Update the target network equipment trust value step.
  • the monitoring device may determine whether the target message type is a beacon message type. If the target message type is a beacon message type, it obtains the last time that the target was updated according to the trust value of the beacon message. The update time of the AP's trust value, and then determine whether the time interval between the update time and the current time exceeds a preset duration threshold. If the time interval between the update time and the current time exceeds the preset duration threshold, step 203 is performed; if the time interval between the update time and the current time does not exceed the preset duration threshold, the trust value of the target AP is not updated.
  • the monitoring device determines whether the trust value of the target AP has been updated according to the target message type before detecting the target communication message. If the trust value of the target AP is not based on the target message type, step 203 is performed; if the trust value of the target AP is based on the target message type, the trust value of the target AP is not updated.
  • the monitoring device can determine whether the target message type is a probe request message type. If the target message type is a probe request message type, obtain the update time of the last update of the trust value of the target user terminal according to the trust value of the probe request message, and then determine whether the time interval between the update time and the current time exceeds a preset Duration threshold. If the time interval between the update time and the current time exceeds the preset duration threshold, step 203 is performed; if the time interval between the update time and the current time does not exceed the preset duration threshold, the trust value of the target user terminal is not updated.
  • step 203 is performed; if the trust value of the target user terminal is based on the target message type, the trust value of the target user terminal is not updated.
  • the calculation method of the trust value corresponding to the target network device may be specifically as follows: after the temporary device entry corresponding to the target network device is established, the preset initial value is used as the current trust value of the target network device; the monitoring device determines the target report After the trust value corresponding to the message type is calculated, the sum of the trust value corresponding to the message type of the target communication message and the current trust value of the target network device is calculated, and the trust value of the target network device is updated to the sum value.
  • the monitoring device uses a preset initial value as the current trust value of the target network device; when the monitoring device updates the trust value corresponding to the target network device, the monitoring device monitors The device can calculate the sum of the trust value corresponding to the message type of the target communication message and the current trust value of the target network device, and then update the trust value of the target network device to the sum value.
  • the target network device is an AP.
  • the target network device is a user terminal.
  • Step 204 When the trust value reaches a preset trust value threshold, a formal device entry corresponding to the target network device is established according to a temporary device entry corresponding to the target network device.
  • the monitoring device may establish the target network according to a temporary device entry corresponding to the target network device.
  • the content of the temporary device entry may be the same as the content of the formal device entry. The difference between the two is that the temporary device entry has a temporary identifier assigned by the monitoring device, and the temporary device entry is not for technicians. Visible; formal equipment entries have no temporary identification, and formal equipment entries are visible to technicians.
  • the monitoring device can delete the temporary identifier of the temporary device entry, and add the device entry to the user-visible entry to obtain the formal device entry corresponding to the temporary device entry.
  • the temporary device entry may contain less content than the formal device entry.
  • the temporary device entry may only include preset important information such as the MAC address of the target network device.
  • the monitoring device determines that the trust value of the target network device reaches a preset trust value threshold, in addition to deleting the temporary identification of the temporary device entry and adding the device entry to a user-visible entry, it also needs to Obtain other information of the target network device, such as signal strength, occupied channel, SSID, or device association information, and add these information to the entry corresponding to the target network device to establish a formal device entry corresponding to the target network device.
  • the monitoring device may delete the temporary device entry corresponding to the target network device and set the trust value corresponding to the target network device. Is 0.
  • the AP when the AP detects a first message type communication message sent by the target network device, the AP may establish a temporary device entry corresponding to the target network device, and then continue to detect the target network for a preset period of time.
  • the target communication message of the device and according to the correspondence between the message type and the trust value of the pre-stored communication message, determine the trust value corresponding to the target message type of the target communication message, and then according to the trust corresponding to the target message type Value, update the trust value of the target network device. Only when the trust value reaches a preset trust value threshold, the AP creates a formal device entry corresponding to the target network device according to the temporary device entry corresponding to the target network device.
  • an embodiment of the present application further provides an example of a method for establishing a device entry, as shown in FIG. 3, which specifically includes the following steps.
  • Step 301 When a beacon message sent by the target AP is detected, a temporary device entry corresponding to the target AP is established, and a current trust value of the target AP is set to a preset initial value.
  • Step 302 Detect a target communication message of the target AP, and determine a message type (ie, a target message type) of the target communication message.
  • Step 303 Determine the trust value corresponding to the target message type of the target communication message according to the correspondence between the message type and the trust value of the pre-stored communication message.
  • the message types in the correspondence include a beacon message type, a probe response message type, an authentication response message type, an association response message type, and a user data message type.
  • Step 304 Determine whether the target message type is a beacon message type.
  • step 305 to step 306 are performed; if the target message type is not a beacon message type, step 307 is performed.
  • Step 305 Obtain the update time of the last update of the trust value of the target AP according to the trust value of the beacon message.
  • Step 306 Determine whether the time interval between the update time and the current time exceeds a preset duration threshold.
  • step 308 is performed; if the time interval between the update time and the current time does not exceed the preset duration threshold, the trust value of the target AP is not updated.
  • Step 307 Determine whether the trust value of the target AP has been updated according to the type of the target message before the target communication message is detected.
  • step 308 is performed; if the trust value of the target AP is based on the target message type, the trust value of the target AP is not updated.
  • Step 308 Calculate the sum of the trust value corresponding to the message type of the target communication message and the current trust value of the target AP, and update the trust value of the target AP to the sum.
  • Step 309 Determine whether the trust value of the target AP reaches a preset trust value threshold.
  • step 310 If the trust value of the target AP reaches the preset trust value threshold, step 310 is performed, and if the trust value of the target AP does not reach the preset trust value threshold, step 311 is performed.
  • Step 310 Establish a formal device entry corresponding to the target AP according to the temporary device entry corresponding to the target AP.
  • Step 311 Determine whether the timer reaches a preset duration.
  • step 312 If the timer has not reached the preset duration, return to step 302; if the timer has reached the preset duration, execute step 312.
  • Step 312 Delete the temporary device entry corresponding to the target AP, and set the trust value corresponding to the target AP to 0.
  • an embodiment of the present application further provides an example of a method for establishing a device entry, as shown in FIG. 4, and specifically includes the following steps.
  • Step 401 When a probe request message sent by the target user terminal is detected, a temporary device entry corresponding to the target user terminal is established, and a current trust value of the target user terminal is set to a preset initial value.
  • Step 402 Detect a target communication message of the target user terminal, and determine a message type (ie, a target message type) of the target communication message.
  • Step 403 Determine the trust value corresponding to the target message type of the target communication message according to the correspondence between the message type and the trust value of the pre-stored communication message.
  • the message types in this correspondence include probe request message types, authentication response message types, association response message types, authentication request message types, association request message types, user data message types, and AP datagrams. Text type.
  • Step 404 Determine whether the target message type is a probe request message type.
  • step 405 to step 406 are performed; if the target message type is not a probe request message type, step 407 is performed.
  • Step 405 Obtain an update time of the last time that the trust value of the target user terminal was updated according to the trust value of the probe request message.
  • Step 406 Determine whether the time interval between the update time and the current time exceeds a preset duration threshold.
  • step 408 is performed; if the time interval between the update time and the current time does not exceed the preset duration threshold, the trust value of the target user terminal is not updated.
  • Step 407 Determine whether the trust value of the target user terminal has been updated according to the type of the target message before the target communication message is detected.
  • step 408 is performed; if the trust value of the target user terminal is based on the target message type, the trust value of the target user terminal is not updated.
  • Step 408 Calculate the sum of the trust value corresponding to the message type of the target communication message and the current trust value of the target user terminal, and update the trust value of the target user terminal to the sum.
  • Step 409 Determine whether the trust value of the target user terminal reaches a preset trust value threshold.
  • step 410 If the trust value of the target user terminal reaches the preset trust value threshold, step 410 is performed, and if the trust value of the target user terminal does not reach the preset trust value threshold, step 411 is performed.
  • Step 410 Establish a formal device entry corresponding to the target user terminal according to the temporary device entry corresponding to the target user terminal.
  • Step 411 Determine whether the timer has reached a preset duration.
  • step 412 If the timer has not reached the preset duration, return to step 402; if the timer has reached the preset duration, execute step 412.
  • Step 412 Delete the temporary device entry corresponding to the target user terminal, and set the trust value corresponding to the target user terminal to 0.
  • an embodiment of the present application further provides a device for establishing a device entry.
  • the device is applied to an access point AP that enables a wireless intrusion prevention system WIPS function.
  • the device includes:
  • a first establishing module 510 configured to establish a temporary device entry corresponding to the target network device when a first message type communication message sent by the target network device is detected;
  • a determining module 520 is configured to detect a target communication message of a target network device within a preset time period, and determine a target message of the target communication message according to a correspondence relationship between a message type and a trust value of a pre-stored communication message. Trust value corresponding to the type;
  • An update module 530 configured to update the trust value of the target network device according to the trust value corresponding to the target message type
  • the second establishing module 540 is configured to establish a formal device entry corresponding to the target network device according to the temporary device entry corresponding to the target network device when the trust value reaches a preset trust value threshold.
  • the first message type is a beacon message type
  • the message type in the correspondence includes one or more of a beacon message type, a probe response message type, an authentication response message type, an association response message type, and a user data message type.
  • the first message type is a probe request message type
  • the message types in the correspondence include probe request message types, authentication response message types, association response message types, authentication request message types, association request message types, user data message types, and AP data message types. One or more.
  • the device further includes:
  • a first determining module 550 configured to determine whether a target message type is a first message type
  • the obtaining module 560 is configured to obtain, if the target message type is the first message type, the time when the trust value of the target network device was last updated according to the trust value corresponding to the first message type; if the update time is different from the current time, If the time interval exceeds a preset duration threshold, the update module 530 is triggered to execute the step of updating the trust value of the target network device according to the trust value corresponding to the target message type;
  • the second determining module 570 is configured to determine whether the target network device's trust value has been updated according to the target message type before the target communication message is detected if the target message type is not the first message type; If the target message type is based on the trust value of the target network device, the update module 530 is triggered to execute the step of updating the trust value of the target network device according to the trust value corresponding to the target message type.
  • the device further includes:
  • a setting module 580 configured to use the preset initial value as the current trust value of the target network device
  • the update module 530 is specifically used for:
  • the device further includes:
  • the deleting module 590 is configured to delete the temporary device entry corresponding to the target network device if the trust value does not reach the preset trust value threshold within the preset time period, and set the trust value corresponding to the target network device to 0.
  • the AP when the AP detects a first message type communication message sent by the target network device, the AP may establish a temporary device entry corresponding to the target network device, and then continue to detect the target network for a preset period of time.
  • the target communication message of the device and according to the correspondence between the message type and trust value of the pre-stored communication message, determine the trust value corresponding to the target message type of the target communication message, and then according to the trust corresponding to the target message type Value, update the trust value of the target network device. Only when the trust value reaches a preset trust value threshold, the AP creates a formal device entry corresponding to the target network device according to the temporary device entry corresponding to the target network device.
  • an embodiment of the present application further provides an AP.
  • the AP is a WIPS-enabled AP.
  • the AP includes a processor 901 and a machine-readable storage medium 902.
  • the readable storage medium 902 stores machine-executable instructions that can be executed by the processor 901, and the machine-executable instructions cause the processor 901 to:
  • a formal device entry corresponding to the target network device is established according to a temporary device entry corresponding to the target network device.
  • the first message type is a beacon message type
  • the message type in the correspondence includes one or more of a beacon message type, a probe response message type, an authentication response message type, an association response message type, and a user data message type.
  • the first message type is a probe request message type
  • the message types in the correspondence include probe request message types, authentication response message types, association response message types, authentication request message types, association request message types, user data message types, and AP data messages. One or more of the types.
  • machine-executable instructions further cause the processor 901 to:
  • the target message type is the first message type, obtaining an update time of the last time the trust value of the target network device is updated according to the trust value corresponding to the first message type; if the update time If the time interval from the current time exceeds a preset duration threshold, performing the step of updating the trust value of the target network device according to the trust value corresponding to the target message type;
  • the target message type is not the first message type, determine whether the trust value of the target network device has been updated according to the target message type before the target communication message is detected; if If the trust value of the target network device is not updated according to the target message type, the step of updating the trust value of the target network device according to the trust value corresponding to the target message type is performed.
  • machine-executable instructions further cause the processor 901 to:
  • Updating the trust value of the target network device according to the trust value corresponding to the target message type includes:
  • machine-executable instructions further cause the processor 901 to:
  • the network device may further include a communication bus 903.
  • the communication bus 903 may be a Peripheral Component Interconnect Standard (English: Peripheral Component Interconnect (PCI) for short) bus or an Extended Industry Standard Architecture (English: Extended Industry Standard Architecture (EISA) bus for short).
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the communication bus 903 can be divided into an address bus, a data bus, a control bus, and the like.
  • the machine-readable storage medium 902 may include random access memory (English: Random Access Memory, referred to as RAM), and may also include non-volatile memory (English: Non-Volatile Memory, referred to as NVM), such as at least one disk memory. .
  • the machine-readable storage medium 902 may also be at least one storage device located remote from the foregoing processor 901.
  • the processor 901 may be a general-purpose processor 901, including a central processing unit 901 (English: Central Processing Unit, abbreviated as: CPU), a network processor 901 (English: Network Processor, abbreviated as: NP), etc .; it may also be a digital signal processor 901 (English: Digital Signal Processing, abbreviation: DSP), Application Specific Integrated Circuit (English: Application Specific Integrated Circuit, ASIC), Field Programmable Gate Array (English: Field-Programmable Gate Array, FPGA) or other Programming logic devices, discrete gate or transistor logic devices, discrete hardware components.
  • a central processing unit 901 English: Central Processing Unit, abbreviated as: CPU
  • a network processor 901 English: Network Processor, abbreviated as: NP
  • DSP Digital Signal Processing
  • ASIC Application Specific Integrated Circuit
  • FPGA Field-Programmable Gate Array
  • a computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement any one of the above-mentioned establishment of a device table. Item's method steps.
  • a computer program product containing instructions is also provided.
  • the computer program product When the computer program product is run on a computer, the computer executes the method for establishing a device table entry in any of the foregoing embodiments.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be from a website site, computer, server, or data center Transmission by wire (for example, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.) to another website site, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, a data center, and the like that includes one or more available medium integration.
  • the usable medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state drive (Solid State Disk (SSD)), and the like.
  • a magnetic medium e.g., a floppy disk, a hard disk, a magnetic tape
  • an optical medium e.g., a DVD
  • a semiconductor medium e.g., a solid state drive (Solid State Disk (SSD)

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

当AP检测到目标网络设备发送的第一报文类型的通信报文时，建立所述目标网络设备对应的临时设备表项；在预设时长内，检测所述目标网络设备的目标通信报文，并根据预先存储的通信报文的报文类型和信任值的对应关系，确定所述目标通信报文的目标报文类型对应的信任值；根据所述目标报文类型对应的信任值，更新所述目标网络设备的信任值；当所述信任值达到预设信任值阈值时，根据所述目标网络设备对应的临时设备表项建立所述目标网络设备对应的正式设备表项。采用本申请可以提高学习设备的准确度。

Description

建立设备表项
相关申请的交叉引用
本申请要求于2018年8月29日提交中国专利局、申请号为201810996397.2发明名称为“一种建立设备表项的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
背景技术
随着通信技术的发展，无线通信网络的应用越来越广泛。为了提高无线通信网络的安全性，人们需要对无线通信网络中的网络设备进行监测，以识别无线通信网络中是否存在恶意设备，并在识别出非法设备时，对非法设备进行反制处理，从而防止非法设备入侵无线通信网络。
无线通信网络通常包括接入控制器(英文：Access Controller，简称：AC)、接入点(英文：Access Point，简称：AP)和用户终端。AP可以是启用无线入侵防护系统(英文：Wireless Intrusion Prevention System，简称：WIPS)功能的AP，基于WIPS，该AP可以扫描其扫描射频范围之内的各网络设备发送和接收的报文，进而根据扫描到的报文，判断网络设备是否为恶意设备。具体的处理过程为：针对未启用WIPS功能的AP，当检测到该AP发送的beacon报文和probe response报文时，判定该AP为合法AP，然后建立该AP对应的设备表项，该设备表项中可以存储有该AP的媒体访问控制(英文：Media Access Control，简称：MAC)地址、信号强度、服务集标识(英文：Service Set Identifier，简称：SSID)等信息，如果未检测到该AP发送的beacon报文或probe response(探测响应)报文，不建立该AP对应的设备表项；针对用户终端，当检测到该用户终端发送的probe request(探测请求)报文和数据报文时，建立该用户终端对应的设备表项，该设备表项中可以存储有该用户终端的媒体访问控制(英文：Media Access Control，简称：MAC)地址、信号强度、与其他网络设备的关联关系等信息，如果未检测到该用户终端发送的probe request报文或数据报文，则不建立该用户终端对应的表项。
附图简要说明
图1为本申请实施例提供的系统框架图；
图2为本申请实施例提供的一种建立设备表项的方法的流程图；
图3为本申请实施例提供的一种建立设备表项的方法示例的流程图；
图4为本申请实施例提供的又一种建立设备表项的方法示例的流程图；
图5为本申请实施例提供的建立设备表项的装置的结构示意图；
图6为本申请实施例提供的建立设备表项的装置的结构示意图；
图7为本申请实施例提供的建立设备表项的装置的结构示意图；
图8为本申请实施例提供的建立设备表项的装置的结构示意图；
图9为本申请实施例提供的AP的结构示意图。
具体实施方式
为使本申请的上述目的、特征和优点能够更加明显易懂，下面结合附图和具体实施方式对本申请作进一步详细的说明。
在现有技术中，部分非法设备会采用变源报文攻击的方式进行网络攻击，例如，某非法用户终端会通过不同的源MAC地址发送大量的probe request报文和数据报文，AC则会确定该用户终端为合法用户终端。由于各报文携带的MAC地址不同，因此AC会认为存在多个合法用户终端，建立多个无效的设备表项。因此，相关技术中，启用WIPS功能的AP学习设备的准确度较低。
本申请实施例提供了一种建立设备表项的方法，该方法可以应用于无线通信网络中的AP。无线通信网络中通常还包括AC以及通过AP接入网络的用户终端。其中，该方法所应用的AP可以是启用WIPS功能的AP。技术人员可以根据无线通信网络中各AP的覆盖范围，选择若干个AP，并通过AC向这些AP下发启动WIPS功能的配置信息，使其成为监测设备。为了便于区分，本申请实施例中将启用WIPS功能的AP称为监测设备。AC与多个AP、以及多个监测设备连接，其中，每个AP对应一个预先分配的信道，终端可以接入某AP，并通过该AP的信道访问网络。如图1所示，为本申请实施例提供的系统框架图，包括AC、多个AP、多个监测设备和多个终端。其中，AC连接AP1、AP2、监测设备1和监测设备2；终端1和终端2通过AP1接入至无线通信网络中，终端3和终端4通过AP2接入至无线通信网络中。
本方案提供的建立设备表项的方法，可以应用于上述监测设备中。当监测设备检测到目标网络设备发送的第一报文类型的通信报文时，监测设备可以建立目标网络设备对应的临时设备表项，然后在预设时长内，继续检测目标网络设备的目标通信报文，并根据预先存储的通信报文的报文类型和信任值的对应关系，确定目标通信报文的目标报文类型对应的信任值，进而根据目标报文类型对应的信任值，更新目标网络设备的信任值。只有当信任值达到预设信任值阈值时，监测设备才会根据目标网络设备对应的临时设备表项建立目标网络设备对应的正式设备表项。由于在变源报文攻击的方式中，非法网络设备通常不会进行正常的业务流程，发送的通信报文的种类比较单一，因此，本方案能够有效的识别出合法网络设备，并且只针对合法网络设备建立正式设备表项，提高了监测设备学习设备的准确度。
可选的，技术人员可以在AC中预先配置本方案所提供的建立设备表项的策略，AC将这些策略下发给监测设备，以使各监测设备能够实现本申请实施例提出的建立设备表项的方法。
下面将结合具体实施方式，对本申请实施例提供的一种建立设备表项的方法进行详细的说明，如图2所示，具体步骤如下：
步骤201，当检测到目标网络设备发送的第一报文类型的通信报文时，建立目标网络设备对应的临时设备表项。
在本申请实施例中，监测设备可以监测其射频范围之内的各网络设备发送和接收的报文。例如，针对AP，监测设备可以监测到该AP发送的beacon报文、probe response报文(即探测响应报文)、以及该AP向用户终端发送的数据报文(即AP数据报文)等；针对用户终端，监测设备可以监测到该用户终端发送的probe request(探测请求)报文、关联请求报文和该用户终端向AP发送的数据报文(即用户数据报文)等。
另外，监测设备还可以获取其监测范围内的各网络设备的设备信息，设备信息至少包括网络设备的设备标识和所占信道。其中，设备标识可以是MAC地址。设备信息还可以包括设备关联信息、网络设备的信号强度、以及网络设备发送通信报文的频率等信息。设备关联信息可以包括该网络设备接入的AP的标识、以及该网络设备发送的通信报文中的目的地址等。针对AP，设 备关联信息还可以包括SSID等信息。
当监测设备检测到某网络设备(即目标网络设备)发送的特定类型(即第一报文类型)的通信报文时，该监测设备可以判断本地是否已建立该目标网络设备对应的设备表项，如果未建立该目标网络设备对应的设备表项(该设备表项包括临时设备表项和正式设备表项)，则建立该目标网络设备对应的临时设备表项。其中，临时设备表项中可以包括目标网络设备的MAC地址、信号强度、所占信道等信息。当目标网络设备为未启用WIPS功能的AP时，临时设备表项中还可以包括SSID；当目标网络设备为用户终端时，临时设备表项中还可以包括设备关联信息。
另外，如果本地已建立该目标网络设备对应的正式设备表项，则监测设备不进行后续处理；如果本地未建立该目标网络设备对应的临时设备表项，则可以按照步骤202的处理过程，更新目标网络设备对应的信任值，具体的处理过程后续会进行详细说明。
可选的，当目标网络设备为未启用WIPS功能的AP时，第一报文类型可以为beacon报文类型；当目标网络设备为用户终端时，第一报文类型可以为探测请求报文类型。
步骤202，在预设时长内，检测目标网络设备的目标通信报文，并根据预先存储的通信报文的报文类型和信任值的对应关系，确定目标通信报文的目标报文类型对应的信任值。
在本申请实施例中，监测设备中可以预先存储有通信报文的报文类型和信任值的对应关系，该对应关系可以由技术人员进行设置，该对应关系可以以对应关系表的形式进行存储。其中，针对不同类型的网络设备，设置的对应关系的内容可以是不同的。
在一种可能的实现方式中，当目标网络设备为未启用WIPS功能的AP时，该对应关系中的报文类型包括beacon报文类型、探测响应报文(即probe response报文)类型、认证响应报文(即authentication response报文)类型、关联响应报文(即association response报文)类型、用户数据报文类型和AP数据报文类型中的一种或多种。
其中，不同报文类型对应的信任值可以是不同的，例如，beacon报文是AP周期性广播的报文，beacon报文类型可以对应较小的信任值，比如2；probe response报文是AP在接收到用户终端发送的probe request报文后发送的，而AP响应probe request报文属于AP通常具备的业务功能，因此，probe response报文类型可以对应较大的信任值，比如20；同理，authentication response报文类型和association response报文类型也可以对应较大的信任值，比如20。AP数据报文对于识别非法AP的有效度较低，AP数据报文类型可以对应较低的信任值，比如10；同理，对于AP来说，用户数据报文对于识别非法AP的有效度也较低，用户数据报文类型对应的信任值可以低于AP数据报文类型对应的信任值，比如5。
在一种可能的实现方式中，当目标网络设备为用户终端时，该对应关系中的报文类型包括探测请求报文(即probe request报文)类型、认证响应报文(即authentication response报文)类型、关联响应报文(即association response报文)类型、认证请求报文(即authentication request报文)类型、关联请求报文(即association request报文)类型、用户数据报文类型、AP数据报文类型中的一种或多种。
其中，不同报文类型对应的信任值可以是不同的，例如，probe request报文是用户终端周期性广播的报文，probe request报文类型可以对应较小的信任值，比如2；authentication request报文、association request报文和用户数据报文，是用户终端发送的用于进行业务的报文，可以对应较大的信任值，比如10。authentication response报文、association response报文和AP数据报文是AP响应该用户终端的报文，由于AP具有一定的识别能力，并且，AP通常只针对合法用户终端进行响应，因此，这三种类型的报文对应的信任值可以较大，比如20。
监测设备建立目标网络设备对应的临时设备表项之后，可以启动计时器开始计时，并且，可以继续检测目标网络设备的通信报文。当检测到目标网络设备接收或发送的通信报文(即目标通信报文)时，监测设备可以根据目标网络设备的设备类型，查询相应的对应关系表，进而确定目标通信报文的目标报文类型对应的信任值。其中，如果该对应关系表中不存在目标报文类型，则可以认为目标报文类型对应的信任值为0，即不更新目标网络设备对应 的信任值。
步骤203，根据目标报文类型对应的信任值，更新目标网络设备的信任值。
在本申请实施例中，监测设备中可以预先存储有网络设备的信任值的更新策略，该更新策略可以由技术人员进行设置。
在一种可能的实现方式中，由于第一报文类型是AP或用户终端周期性发送的报文，因此，针对第一报文类型，可以多次增加目标网络设备的信任值，而对于其他报文类型，可以仅增加一次目标网络设备的信任值，具体的处理过程可以如下：判断目标报文类型是否为第一报文类型；如果目标报文类型为第一报文类型，则获取上一次根据第一报文类型对应的信任值更新目标网络设备的信任值的更新时间；如果更新时间与当前时间的时间间隔超过预设时长阈值，则执行根据目标报文类型对应的信任值，更新目标网络设备的信任值步骤；如果目标报文类型不为第一报文类型，则判断在检测到目标通信报文之前，是否已根据目标报文类型更新目标网络设备的信任值；如果未根据目标报文类型根据目标网络设备的信任值，则执行根据目标报文类型对应的信任值，更新目标网络设备的信任值步骤。
在本申请实施例中，针对目标AP，监测设备可以判断目标报文类型是否为beacon报文类型，如果目标报文类型为beacon报文类型，则获取上一次根据beacon报文的信任值更新目标AP的信任值的更新时间，进而判断该更新时间与当前时间的时间间隔是否超过预设时长阈值。如果更新时间与当前时间的时间间隔超过预设时长阈值，则执行步骤203；如果更新时间与当前时间的时间间隔未超过预设时长阈值，则不更新目标AP的信任值。
如果目标报文类型不为beacon报文类型，则监测设备判断在检测到目标通信报文之前，是否已根据目标报文类型更新目标AP的信任值。如果未根据目标报文类型根据目标AP的信任值，则执行步骤203；如果已根据目标报文类型根据目标AP的信任值，则不更新目标AP的信任值。
针对目标用户终端，监测设备可以判断目标报文类型是否为探测请求报文类型。如果目标报文类型为探测请求报文类型，则获取上一次根据探测请求报文的信任值更新目标用户终端的信任值的更新时间，然后判断该更新时 间与当前时间的时间间隔是否超过预设时长阈值。如果更新时间与当前时间的时间间隔超过预设时长阈值，则执行步骤203；如果更新时间与当前时间的时间间隔未超过预设时长阈值，则不更新目标用户终端的信任值。
如果目标报文类型不为探测请求报文类型，则判断在检测到目标通信报文之前，是否已根据目标报文类型更新目标用户终端的信任值。如果未根据目标报文类型根据目标用户终端的信任值，则执行步骤203；如果已根据目标报文类型根据目标用户终端的信任值，则不更新目标用户终端的信任值。
可选的，目标网络设备对应的信任值的计算方式具体可以如下：在建立目标网络设备对应的临时设备表项之后，将预设初始值作为目标网络设备当前的信任值；监测设备确定目标报文类型对应的信任值后，计算目标通信报文的报文类型对应的信任值与目标网络设备当前的信任值的和值，将目标网络设备的信任值更新为和值。
在本申请实施例中，监测设备在建立目标网络设备对应的临时设备表项之后，将预设初始值作为目标网络设备当前的信任值；当监测设备更新目标网络设备对应的信任值时，监测设备可以计算目标通信报文的报文类型对应的信任值与该目标网络设备当前的信任值的和值，然后将目标网络设备的信任值更新为和值。
例如，目标网络设备为AP，当检测到该AP发送的beacon报文时，建立该AP对应的临时设备表项，并设置该AP当前的信任值为初始值10；然后，检测到该AP发送的probe response报文，确定probe response报文类型对应的信任值为20，则该AP的信任值更新为10+20＝30；之后，检测到该AP发送的authentication response报文，确定authentication response报文类型对应的信任值为20，则该AP的信任值更新为30+20＝50；另外，在建立该AP对应的临时设备表项后，监测设备每达到预设时间间隔后检测到该AP发送的beacon报文时，可以将该AP的信任值加2，比如，该AP当前的信任值为50，且已达到预设时间间隔5s，则检测到该AP发送的beacon报文后，将信任值更新为50+2＝52。
又如，目标网络设备为用户终端，当检测到该用户终端发送的probe request报文时，建立该用户终端对应的临时设备表项，并设置该用户终端当前的信任值为初始值10；然后，检测到该用户终端发送的authentication request 报文，确定authentication request报文类型对应的信任值为10，则该用户终端的信任值更新为10+10＝20；之后，检测到AP向该用户终端发送的authentication response报文，确定authentication response报文类型对应的信任值为20，则该用户终端的信任值更新为20+20＝40；同时，建立该用户终端对应的临时设备表项后，监测设备每达到预设时间间隔后检测到该用户终端发送的probe request报文时，可以将该用户终端的信任值加2，比如，该用户终端当前的信任值为40，且已达到预设时间间隔5s，则检测到该用户终端发送的probe request报文后，将信任值更新为40+2＝42。
步骤204，当信任值达到预设信任值阈值时，根据目标网络设备对应的临时设备表项建立目标网络设备对应的正式设备表项。
在本申请实施例中，如果在预设时长内，监测设备判定目标网络设备的信任值达到预设信任值阈值，则监测设备可以根据该目标网络设备对应的临时设备表项，建立该目标网络设备对应的正式设备表项。其中，临时设备表项包含的内容可以与正式设备表项所包含的内容相同，二者的区别在于，临时设备表项具有监测设备分配的临时标识，并且，临时设备表项对技术人员是不可见的；而正式设备表项没有临时标识，并且，正式设备表项对技术人员是可见的。监测设备可以删除临时设备表项的临时标识，并且，将该设备表项添加到用户可见的表项中，以得到该临时设备表项对应的正式设备表项。
在另一种可能的实现方式中，临时设备表项包含的内容可以少于正式设备表项所包含的内容，例如，临时设备表项中可以仅包含目标网络设备的MAC地址等预设的重要参数，相应的，监测设备判定目标网络设备的信任值达到预设信任值阈值时，除了需要删除临时设备表项的临时标识，并将该设备表项添加到用户可见的表项中，还需要获取目标网络设备的其他信息，比如信号强度、所占信道、SSID或设备关联信息等，并将这些信息添加到目标网络设备对应的表项中，以建立目标网络设备对应的正式设备表项。
可选的，如果在预设时长内，目标网络设备的信任值未达到预设信任值阈值，则监测设备可以删除目标网络设备对应的临时设备表项，并将目标网络设备对应的信任值置为0。
本申请实施例中，当AP检测到目标网络设备发送的第一报文类型的通信 报文时，AP可以建立目标网络设备对应的临时设备表项，然后在预设时长内，继续检测目标网络设备的目标通信报文，并根据预先存储的通信报文的报文类型和信任值的对应关系，确定目标通信报文的目标报文类型对应的信任值，进而根据目标报文类型对应的信任值，更新目标网络设备的信任值。只有当信任值达到预设信任值阈值时，AP才会根据目标网络设备对应的临时设备表项建立目标网络设备对应的正式设备表项。由于在变源报文攻击的方式中，非法网络设备通常不会进行正常的业务流程，发送的通信报文的种类比较单一，因此，本方案能够有效的识别出合法网络设备，并且只针对合法网络设备建立正式设备表项，提高了AP学习设备的准确度。
以针对AP的设备学习过程为例，本申请实施例还提供了一种建立设备表项的方法示例，如图3所示，具体包括以下步骤。
步骤301，当检测到目标AP的发送的beacon报文时，建立目标AP对应的临时设备表项，并设置目标AP当前的信任值为预设初始值。
步骤302，检测目标AP的目标通信报文，确定目标通信报文的报文类型(即目标报文类型)。
步骤303，根据预先存储的通信报文的报文类型和信任值的对应关系，确定目标通信报文的目标报文类型对应的信任值。
其中，该对应关系中的报文类型包括beacon报文类型、探测响应报文类型、认证响应报文类型、关联响应报文类型和用户数据报文类型。
步骤304，判断目标报文类型是否为beacon报文类型。
如果目标报文类型为beacon报文类型，则执行步骤305～步骤306；如果目标报文类型不为beacon报文类型，则执行步骤307。
步骤305，获取上一次根据beacon报文的信任值更新目标AP的信任值的更新时间。
步骤306，判断该更新时间与当前时间的时间间隔是否超过预设时长阈值。
如果更新时间与当前时间的时间间隔超过预设时长阈值，则执行步骤308； 如果更新时间与当前时间的时间间隔未超过预设时长阈值，则不更新目标AP的信任值。
步骤307，判断在检测到目标通信报文之前，是否已根据目标报文类型更新目标AP的信任值。
如果未根据目标报文类型根据目标AP的信任值，则执行步骤308；如果已根据目标报文类型根据目标AP的信任值，则不更新目标AP的信任值。
步骤308，计算目标通信报文的报文类型对应的信任值与目标AP当前的信任值的和值，将目标AP的信任值更新为该和值。
步骤309，判断目标AP的信任值是否达到预设信任值阈值。
如果目标AP的信任值达到预设信任值阈值，则执行步骤310，如果目标AP的信任值未达到预设信任值阈值，则执行步骤311。
步骤310，根据目标AP对应的临时设备表项建立目标AP对应的正式设备表项。
步骤311，判断计时器是否达到预设时长。
如果计时器未达到预设时长，则返回步骤302；如果计时器已达到预设时长，则执行步骤312。
步骤312，删除目标AP对应的临时设备表项，并将目标AP对应的信任值置为0。
以针对用户终端的设备学习过程为例，本申请实施例还提供了一种建立设备表项的方法示例，如图4所示，具体包括以下步骤。
步骤401，当检测到目标用户终端的发送的探测请求报文时，建立目标用户终端对应的临时设备表项，并设置目标用户终端当前的信任值为预设初始值。
步骤402，检测目标用户终端的目标通信报文，确定目标通信报文的报文类型(即目标报文类型)。
步骤403，根据预先存储的通信报文的报文类型和信任值的对应关系，确定目标通信报文的目标报文类型对应的信任值。
其中，该对应关系中的报文类型包括探测请求报文类型、认证响应报文类型、关联响应报文类型、认证请求报文类型、关联请求报文类型、用户数据报文类型、AP数据报文类型。
步骤404，判断目标报文类型是否为探测请求报文类型。
如果目标报文类型为探测请求报文类型，则执行步骤405～步骤406；如果目标报文类型不为探测请求报文类型，则执行步骤407。
步骤405，获取上一次根据探测请求报文的信任值更新目标用户终端的信任值的更新时间。
步骤406，判断该更新时间与当前时间的时间间隔是否超过预设时长阈值。
如果更新时间与当前时间的时间间隔超过预设时长阈值，则执行步骤408；如果更新时间与当前时间的时间间隔未超过预设时长阈值，则不更新目标用户终端的信任值。
步骤407，判断在检测到目标通信报文之前，是否已根据目标报文类型更新目标用户终端的信任值。
如果未根据目标报文类型根据目标用户终端的信任值，则执行步骤408；如果已根据目标报文类型根据目标用户终端的信任值，则不更新目标用户终端的信任值。
步骤408，计算目标通信报文的报文类型对应的信任值与目标用户终端当前的信任值的和值，将目标用户终端的信任值更新为该和值。
步骤409，判断目标用户终端的信任值是否达到预设信任值阈值。
如果目标用户终端的信任值达到预设信任值阈值，则执行步骤410，如果目标用户终端的信任值未达到预设信任值阈值，则执行步骤411。
步骤410，根据目标用户终端对应的临时设备表项建立目标用户终端对应的正式设备表项。
步骤411，判断计时器是否达到预设时长。
如果计时器未达到预设时长，则返回步骤402；如果计时器已达到预设时长，则执行步骤412。
步骤412，删除目标用户终端对应的临时设备表项，并将目标用户终端对应的信任值置为0。
基于相同的技术构思，如图5所示，本申请实施例还提供了一种建立设备表项的装置，该装置应用于启用无线入侵防护系统WIPS功能的接入点AP，该装置包括：
第一建立模块510，用于当检测到目标网络设备发送的第一报文类型的通信报文时，建立目标网络设备对应的临时设备表项；
确定模块520，用于在预设时长内，检测目标网络设备的目标通信报文，并根据预先存储的通信报文的报文类型和信任值的对应关系，确定目标通信报文的目标报文类型对应的信任值；
更新模块530，用于根据目标报文类型对应的信任值，更新目标网络设备的信任值；
第二建立模块540，用于当信任值达到预设信任值阈值时，根据目标网络设备对应的临时设备表项建立目标网络设备对应的正式设备表项。
可选的，当目标网络设备为未启用WIPS功能的AP时，第一报文类型为beacon报文类型；
对应关系中的报文类型包括beacon报文类型、探测响应报文类型、认证响应报文类型、关联响应报文类型和用户数据报文类型中的一种或多种。
可选的，当目标网络设备为用户终端时，第一报文类型为探测请求报文类型；
对应关系中的报文类型包括探测请求报文类型、认证响应报文类型、关联响应报文类型、认证请求报文类型、关联请求报文类型、用户数据报文类 型、AP数据报文类型中的一种或多种。
可选的，如图6所示，该装置还包括：
第一判断模块550，用于判断目标报文类型是否为第一报文类型；
获取模块560，用于如果目标报文类型为第一报文类型，则获取上一次根据第一报文类型对应的信任值更新目标网络设备的信任值的更新时间；如果更新时间与当前时间的时间间隔超过预设时长阈值，则触发更新模块530执行根据目标报文类型对应的信任值，更新目标网络设备的信任值步骤；
第二判断模块570，用于如果目标报文类型不为第一报文类型，则判断在检测到目标通信报文之前，是否已根据目标报文类型更新目标网络设备的信任值；如果未根据目标报文类型根据目标网络设备的信任值，则触发更新模块530执行根据目标报文类型对应的信任值，更新目标网络设备的信任值步骤。
可选的，如图7所示，该装置还包括：
设置模块580，用于将预设初始值作为目标网络设备当前的信任值；
更新模块530，具体用于：
计算目标通信报文的报文类型对应的信任值与目标网络设备当前的信任值的和值，将目标网络设备的信任值更新为和值。
可选的，如图8所示，该装置还包括：
删除模块590，用于如果在预设时长内，信任值未达到预设信任值阈值，则删除目标网络设备对应的临时设备表项，并将目标网络设备对应的信任值置为0。
本申请实施例中，当AP检测到目标网络设备发送的第一报文类型的通信报文时，AP可以建立目标网络设备对应的临时设备表项，然后在预设时长内，继续检测目标网络设备的目标通信报文，并根据预先存储的通信报文的报文类型和信任值的对应关系，确定目标通信报文的目标报文类型对应的信任值，进而根据目标报文类型对应的信任值，更新目标网络设备的信任值。只有当信任值达到预设信任值阈值时，AP才会根据目标网络设备对应的临时设备表项建立目标网络设备对应的正式设备表项。由于在变源报文攻击的方式中， 非法网络设备通常不会进行正常的业务流程，发送的通信报文的种类比较单一，因此，本方案能够有效的识别出合法网络设备，并且只针对合法网络设备建立正式设备表项，提高了AP学习设备的准确度。
基于相同的技术构思，如图9所示，本申请实施例还提供了一种AP，该AP为启用WIPS功能的AP，该AP包括：处理器901和机器可读存储介质902，所述机器可读存储介质902存储有能够被所述处理器901执行的机器可执行指令，所述机器可执行指令促使所述处理器901：
当检测到目标网络设备发送的第一报文类型的通信报文时，建立所述目标网络设备对应的临时设备表项；
在预设时长内，检测所述目标网络设备的目标通信报文，并根据预先存储的通信报文的报文类型和信任值的对应关系，确定所述目标通信报文的目标报文类型对应的信任值；
根据所述目标报文类型对应的信任值，更新所述目标网络设备的信任值；
当所述信任值达到预设信任值阈值时，根据所述目标网络设备对应的临时设备表项建立所述目标网络设备对应的正式设备表项。
在本申请的一个可选实施例中，当所述目标网络设备为未启用WIPS功能的AP时，所述第一报文类型为beacon报文类型；
所述对应关系中的报文类型包括beacon报文类型、探测响应报文类型、认证响应报文类型、关联响应报文类型和用户数据报文类型中的一种或多种。
在本申请的一个可选实施例中，当所述目标网络设备为用户终端时，所述第一报文类型为探测请求报文类型；
所述对应关系中的报文类型包括探测请求报文类型、认证响应报文类型、关联响应报文类型、认证请求报文类型、关联请求报文类型、用户数据报文类型、AP数据报文类型中的一种或多种。
在本申请的一个可选实施例中，所述机器可执行指令还促使所述处理器901：
判断所述目标报文类型是否为所述第一报文类型；
如果所述目标报文类型为所述第一报文类型，则获取上一次根据所述第一报文类型对应的信任值更新所述目标网络设备的信任值的更新时间；如果所述更新时间与当前时间的时间间隔超过预设时长阈值，则执行所述根据所述目标报文类型对应的信任值，更新所述目标网络设备的信任值步骤；
如果所述目标报文类型不为所述第一报文类型，则判断在检测到所述目标通信报文之前，是否已根据所述目标报文类型更新所述目标网络设备的信任值；如果未根据所述目标报文类型更新所述目标网络设备的信任值，则执行所述根据所述目标报文类型对应的信任值，更新所述目标网络设备的信任值步骤。
在本申请的一个可选实施例中，所述机器可执行指令还促使所述处理器901：
将预设初始值作为所述目标网络设备当前的信任值；
所述根据所述目标报文类型对应的信任值，更新所述目标网络设备的信任值，包括：
计算所述目标通信报文的报文类型对应的信任值与所述目标网络设备当前的信任值的和值，将所述目标网络设备的信任值更新为所述和值。
在本申请的一个可选实施例中，所述机器可执行指令还促使所述处理器901：
如果在所述预设时长内，所述信任值未达到所述预设信任值阈值，则删除所述目标网络设备对应的临时设备表项，并将所述目标网络设备对应的信任值置为0。
如图9所示，网络设备还可以包括通信总线903。通过通信总线903，处理器901、机器可读存储介质902之间完成通信交互。通信总线903可以是外设部件互连标准(英文：Peripheral Component Interconnect，简称：PCI)总线或扩展工业标准结构(英文：Extended Industry Standard Architecture，简称：EISA)总线等。该通信总线903可以分为地址总线、数据总线、控制总线等。
机器可读存储介质902可以包括随机存取存储器(英文：Random Access Memory，简称：RAM)，也可以包括非易失性存储器(英文：Non-Volatile Memory，简称：NVM)，例如至少一个磁盘存储器。另外，机器可读存储介质902还可以是至少一个位于远离前述处理器901的存储装置。
处理器901可以是通用处理器901，包括中央处理器901(英文：Central Processing Unit，简称：CPU)、网络处理器901(英文：Network Processor，简称：NP)等；还可以是数字信号处理器901(英文：Digital Signal Processing，简称：DSP)、专用集成电路(英文：Application Specific Integrated Circuit，简称：ASIC)、现场可编程门阵列(英文：Field-Programmable Gate Array，简称：FPGA)或其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。
在本申请提供的又一实施例中，还提供了一种计算机可读存储介质，该计算机可读存储介质内存储有计算机程序，所述计算机程序被处理器执行时实现上述任一建立设备表项的方法的步骤。
在本申请提供的又一实施例中，还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述实施例中任一建立设备表项的方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁 性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
本说明书中的各个实施例均采用相关的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于装置实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
以上所述仅为本申请的较佳实施例而已，并非用于限定本申请的保护范围。凡在本申请的精神和原则之内所作的任何修改、等同替换、改进等，均包含在本申请的保护范围内。

Claims (13)

  1. 一种建立设备表项的方法，其特征在于，所述方法应用于启用无线入侵防护系统WIPS功能的接入点AP，所述方法包括：
    当检测到目标网络设备发送的第一报文类型的通信报文时，建立所述目标网络设备对应的临时设备表项；
    在预设时长内，检测所述目标网络设备的目标通信报文，并根据预先存储的通信报文的报文类型和信任值的对应关系，确定所述目标通信报文的目标报文类型对应的信任值；
    根据所述目标报文类型对应的信任值，更新所述目标网络设备的信任值；
    当所述信任值达到预设信任值阈值时，根据所述目标网络设备对应的临时设备表项建立所述目标网络设备对应的正式设备表项。
  2. 根据权利要求1所述的方法，其特征在于，当所述目标网络设备为未启用WIPS功能的AP时，所述第一报文类型为beacon报文类型；
    所述对应关系中的报文类型包括beacon报文类型、探测响应报文类型、认证响应报文类型、关联响应报文类型和用户数据报文类型中的一种或多种。
  3. 根据权利要求1所述的方法，其特征在于，当所述目标网络设备为用户终端时，所述第一报文类型为探测请求报文类型；
    所述对应关系中的报文类型包括探测请求报文类型、认证响应报文类型、关联响应报文类型、认证请求报文类型、关联请求报文类型、用户数据报文类型、AP数据报文类型中的一种或多种。
  4. 根据权利要求1所述的方法，其特征在于，所述根据所述目标报文类型对应的信任值，更新所述目标网络设备的信任值之前，所述方法还包括：
    判断所述目标报文类型是否为所述第一报文类型；
    如果所述目标报文类型为所述第一报文类型，则获取上一次根据所述第一报文类型对应的信任值更新所述目标网络设备的信任值的更新时间；如果所述更新时间与当前时间的时间间隔超过预设时长阈值，则执行所述根据所述目标报文类型对应的信任值，更新所述目标网络设备的信任值步骤；
    如果所述目标报文类型不为所述第一报文类型，则判断在检测到所述目标通信报文之前，是否已根据所述目标报文类型更新所述目标网络设备的信任值；如果未根据所述目标报文类型更新所述目标网络设备的信任值，则执行所述根据所述目标报文类型对应的信任值，更新所述目标网络设备的信任值步骤。
  5. 根据权利要求1～4任一所述的方法，其特征在于，所述建立所述目标网络设备对应的临时设备表项之后，所述方法还包括：
    将预设初始值作为所述目标网络设备当前的信任值；
    所述根据所述目标报文类型对应的信任值，更新所述目标网络设备的信任值，包括：
    计算所述目标通信报文的报文类型对应的信任值与所述目标网络设备当前的信任值的和值，将所述目标网络设备的信任值更新为所述和值。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    如果在所述预设时长内，所述信任值未达到所述预设信任值阈值，则删除所述目标网络设备对应的临时设备表项，并将所述目标网络设备对应的信任值置为0。
  7. 一种接入点AP，其特征在于，所述AP启用无线入侵防护系统WIPS功能的接入点AP，所述AP包括：处理器和机器可读存储介质，所述机器可读存储介质存储有能够被所述处理器执行的机器可执行指令，所述机器可执行指令促使所述处理器：
    当检测到目标网络设备发送的第一报文类型的通信报文时，建立所述目标网络设备对应的临时设备表项；
    在预设时长内，检测所述目标网络设备的目标通信报文，并根据预先存储的通信报文的报文类型和信任值的对应关系，确定所述目标通信报文的目标报文类型对应的信任值；
    根据所述目标报文类型对应的信任值，更新所述目标网络设备的信任值；
    当所述信任值达到预设信任值阈值时，根据所述目标网络设备对应的临时设备表项建立所述目标网络设备对应的正式设备表项。
  8. 根据权利要求7所述的AP，其特征在于，当所述目标网络设备为未启用WIPS功能的AP时，所述第一报文类型为beacon报文类型；
    所述对应关系中的报文类型包括beacon报文类型、探测响应报文类型、认证响应报文类型、关联响应报文类型和用户数据报文类型中的一种或多种。
  9. 根据权利要求7所述的AP，其特征在于，当所述目标网络设备为用户终端时，所述第一报文类型为探测请求报文类型；
    所述对应关系中的报文类型包括探测请求报文类型、认证响应报文类型、关联响应报文类型、认证请求报文类型、关联请求报文类型、用户数据报文类型、AP数据报文类型中的一种或多种。
  10. 根据权利要求7所述的AP，其特征在于，所述机器可执行指令还促使所述处理器：
    判断所述目标报文类型是否为所述第一报文类型；
    如果所述目标报文类型为所述第一报文类型，则获取上一次根据所述第一报文类型对应的信任值更新所述目标网络设备的信任值的更新时间；如果所述更新时间与当前时间的时间间隔超过预设时长阈值，则执行所述根据所述目标报文类型对应的信任值，更新所述目标网络设备的信任值步骤；
    如果所述目标报文类型不为所述第一报文类型，则判断在检测到所述目标通信报文之前，是否已根据所述目标报文类型更新所述目标网络设备的信任值；如果未根据所述目标报文类型更新所述目标网络设备的信任值，则执行所述根据所述目标报文类型对应的信任值，更新所述目标网络设备的信任值步骤。
  11. 根据权利要求7～10任一所述的AP，其特征在于，所述机器可执行指令还促使所述处理器：
    将预设初始值作为所述目标网络设备当前的信任值；
    所述根据所述目标报文类型对应的信任值，更新所述目标网络设备的信 任值，包括：
    计算所述目标通信报文的报文类型对应的信任值与所述目标网络设备当前的信任值的和值，将所述目标网络设备的信任值更新为所述和值。
  12. 根据权利要求11所述的AP，其特征在于，所述机器可执行指令还促使所述处理器：
    如果在所述预设时长内，所述信任值未达到所述预设信任值阈值，则删除所述目标网络设备对应的临时设备表项，并将所述目标网络设备对应的信任值置为0。
  13. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质内存储有计算机程序，所述计算机程序被处理器执行时实现权利要求1-6任一所述的方法步骤。
PCT/CN2019/102852 2018-08-29 2019-08-27 建立设备表项 Ceased WO2020043098A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810996397.2A CN109067764B (zh) 2018-08-29 2018-08-29 一种建立设备表项的方法及装置
CN201810996397.2 2018-08-29

Publications (1)

Publication Number Publication Date
WO2020043098A1 true WO2020043098A1 (zh) 2020-03-05

Family

ID=64756501

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/102852 Ceased WO2020043098A1 (zh) 2018-08-29 2019-08-27 建立设备表项

Country Status (2)

Country Link
CN (1) CN109067764B (zh)
WO (1) WO2020043098A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109067764B (zh) * 2018-08-29 2020-09-04 新华三技术有限公司 一种建立设备表项的方法及装置
CN110087244A (zh) * 2019-04-29 2019-08-02 新华三技术有限公司 一种信息获取方法和装置

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101068179A (zh) * 2007-06-20 2007-11-07 杭州华三通信技术有限公司 一种客户端无线接入方法、系统及其装置
WO2010135085A1 (en) * 2009-05-19 2010-11-25 Symbol Technologies, Inc. Systems and methods for concurrent wireless local area network access and sensing
CN102802236A (zh) * 2012-08-03 2012-11-28 杭州华三通信技术有限公司 无线网络扫描方法及其实现装置
CN104378369A (zh) * 2014-11-11 2015-02-25 上海斐讯数据通信技术有限公司 一种无线防止泛洪攻击的方法
CN106376003A (zh) * 2015-07-23 2017-02-01 中移（杭州）信息技术有限公司 检测无线局域网连接及无线局域网数据发送方法及其装置
CN107548065A (zh) * 2017-07-24 2018-01-05 新华三技术有限公司 一种检测设备的确定方法、装置、接入控制器及存储介质
CN109067764A (zh) * 2018-08-29 2018-12-21 新华三技术有限公司 一种建立设备表项的方法及装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100486246C (zh) * 2004-05-31 2009-05-06 中国科学院声学研究所 一种在移动IPv6快速切换过程中进行AAA认证的方法
US7681531B2 (en) * 2006-02-21 2010-03-23 O'neil Thomas System for assessing habitat value
CN102123071B (zh) * 2010-01-11 2016-06-01 中兴通讯股份有限公司 数据报文分类处理的实现方法、网络、终端及互通服务节点
CN103795581B (zh) * 2012-10-29 2018-05-11 新华三技术有限公司 地址处理方法和设备
CN105188065B (zh) * 2015-08-11 2018-10-23 福建师范大学 一种基于多准则决策的无线Mesh网络信任度量系统
CN106878291B (zh) * 2017-01-22 2021-03-23 新华三技术有限公司 一种基于前缀安全表项的报文处理方法及装置
CN107547510B (zh) * 2017-07-04 2020-03-06 新华三技术有限公司 一种邻居发现协议安全表项处理方法和装置

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101068179A (zh) * 2007-06-20 2007-11-07 杭州华三通信技术有限公司 一种客户端无线接入方法、系统及其装置
WO2010135085A1 (en) * 2009-05-19 2010-11-25 Symbol Technologies, Inc. Systems and methods for concurrent wireless local area network access and sensing
CN102802236A (zh) * 2012-08-03 2012-11-28 杭州华三通信技术有限公司 无线网络扫描方法及其实现装置
CN104378369A (zh) * 2014-11-11 2015-02-25 上海斐讯数据通信技术有限公司 一种无线防止泛洪攻击的方法
CN106376003A (zh) * 2015-07-23 2017-02-01 中移（杭州）信息技术有限公司 检测无线局域网连接及无线局域网数据发送方法及其装置
CN107548065A (zh) * 2017-07-24 2018-01-05 新华三技术有限公司 一种检测设备的确定方法、装置、接入控制器及存储介质
CN109067764A (zh) * 2018-08-29 2018-12-21 新华三技术有限公司 一种建立设备表项的方法及装置

Also Published As

Publication number Publication date
CN109067764B (zh) 2020-09-04
CN109067764A (zh) 2018-12-21

Similar Documents

Publication Publication Date Title
US10542029B2 (en) System and method for security and quality assessment of wireless access points
CN112219381B (zh) 用于基于数据分析的消息过滤的方法和装置
US9467459B2 (en) System and method for detection of rogue routers in a computing network
US9763099B2 (en) System and method for security and quality assessment of wireless access points
RU2546610C1 (ru) Способ определения небезопасной беспроводной точки доступа
US10834596B2 (en) Method for blocking connection in wireless intrusion prevention system and device therefor
CN105611534B (zh) 无线终端识别伪WiFi网络的方法及其装置
US20160142393A1 (en) Terminal Authentication Apparatus and Method
US20150082429A1 (en) Protecting wireless network from rogue access points
US11197157B2 (en) Method, apparatus, and system for performing authentication on terminal in wireless local area network
US8191143B1 (en) Anti-pharming in wireless computer networks at pre-IP state
WO2016086763A1 (zh) 无线访问节点检测方法、无线网络检测系统和服务器
CN109089263B (zh) 一种报文处理方法及装置
US10798125B2 (en) System and method for network entity assisted honeypot access point detection
US11336621B2 (en) WiFiwall
US11689928B2 (en) Detecting unauthorized access to a wireless network
WO2020043098A1 (zh) 建立设备表项
US10547638B1 (en) Detecting name resolution spoofing
CN108235322B (zh) 一种无线设备的反制方法及装置
US20250112952A1 (en) Detection of mac spoofing
CN106488458B (zh) 检测网关arp欺骗的方法及装置
CN117561749A (zh) 预配无头wifi设备以及相关系统、方法和设备
CN107332649B (zh) 802.1x客户端下线方法及802.1x系统
EP4531339A1 (en) Detection of mac spoofing
CN116193421B (zh) 网络连接信息的验证方法、装置、系统及电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19854268

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19854268

Country of ref document: EP

Kind code of ref document: A1