WO2020103159A1 - 一种报文收发方法及装置 - Google Patents

一种报文收发方法及装置

Info

Publication number
WO2020103159A1
WO2020103159A1 PCT/CN2018/117304 CN2018117304W WO2020103159A1 WO 2020103159 A1 WO2020103159 A1 WO 2020103159A1 CN 2018117304 W CN2018117304 W CN 2018117304W WO 2020103159 A1 WO2020103159 A1 WO 2020103159A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
dns
user equipment
dns request
request message
Prior art date
Application number
PCT/CN2018/117304
Other languages
English (en)
French (fr)
Inventor
叶朝岭
刘贤
刘成伟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2018/117304 priority Critical patent/WO2020103159A1/zh
Priority to CN201880090542.9A priority patent/CN111788809A/zh
Publication of WO2020103159A1 publication Critical patent/WO2020103159A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • This application relates to the field of communication technology, and in particular, to a method and device for receiving and sending messages.
  • DNS domain name system
  • IP Internet protocol
  • DNS can be understood as a distributed database. The basic function it performs is to convert network resource names (such as host names, domain names, e-mail addresses, etc.) into corresponding IP addresses.
  • the process of the user equipment accessing the Internet may be: after the user enters the destination domain name, the user equipment generates a DNS request, the DNS request carries the destination domain name, and the DNS request is sent to the DNS via a network (such as an access network and a core network) The server; the DNS server sends the DNS response to the user equipment through the network, and the DNS response carries the IP address corresponding to the destination domain name; after receiving the DNS response, the user equipment can access the Internet according to the IP address corresponding to the destination domain name.
  • a network such as an access network and a core network
  • the Third Generation Partnership Project (3 rd generation partnership project, 3GPP ) protocol since the user plane data integrity protection mechanism is not employed, and thus when the forwarding user equipment network DNS request, the DNS request data can not be determined in Whether it has been maliciously tampered with, which leads the attacker to identify and intercept the DNS request sent by the user equipment through some means, and then tamper with the data in the DNS request, misleading the user equipment to access an unsafe network.
  • 3GPP Third Generation Partnership Project
  • Embodiments of the present application provide a message sending and receiving method and apparatus, which are used to reduce the probability of a DNS request being tampered when a user equipment accesses the Internet, thereby improving the security of user equipment network access.
  • an embodiment of the present application provides a method for sending and receiving messages.
  • the method includes the following steps: a user equipment sends a DNS request message to a DNS server of a domain name system, and the DNS request message includes a valid data portion and a random data portion.
  • the data section carries the destination domain name requested by the user equipment; the user equipment receives a DNS response message from the DNS server, and the DNS response message carries the Internet protocol IP address corresponding to the destination domain name.
  • the length of the random data part can satisfy the preset range.
  • the data in the random data part may be randomly generated by the user equipment.
  • the DNS request message sent by the user equipment to the DNS server includes a valid data part and a random data part. Since the random data part is added, compared with the DNS request sent in the prior art, the length of the DNS request message sent by the user equipment in this embodiment of the present application increases, and the attacker is identifying and intercepting according to the length of the message When a DNS request message is sent, it is difficult to intercept the DNS request message with the increased length. Therefore, the probability that the DNS request message is intercepted by the attacker is small, and the DNS request message will be sent to the legitimate DNS server. Then, the DNS response message received by the user equipment also comes from a legitimate DNS server, and the IP address carried in the DNS response message is a legal IP address. The user equipment accesses the Internet according to the IP address, and will not be subjected to malicious attacks.
  • the user equipment may identify the source port number of the message to be sent, the message to be sent includes a valid data portion; then, the user equipment In the case where the source port number of the message to be sent is a preset port number, a random data part is added at the end of the message to be sent to form a DNS request message.
  • the user equipment can identify whether the packet to be sent is a DNS request by identifying the source port number of the packet to be sent, and then add a random data portion after the valid data portion of the DNS request message to form the aforementioned DNS request message Text.
  • the DNS request message includes an IP header, and the length field information in the IP header is used to indicate the length of the DNS request message.
  • the length field information indicates the length of the valid data portion or the valid data portion And the length of the random data part.
  • an embodiment of the present application further provides a message receiving and sending device, which includes a sending module and a receiving module.
  • the sending module is used to send a DNS request message to the DNS server of the domain name system.
  • the DNS request message includes a valid data part and a random data part.
  • the valid data part carries the destination domain name requested by the message sending and receiving device; the receiving module is used to Receive a DNS response message from the DNS server.
  • the DNS response message carries the Internet protocol IP address corresponding to the destination domain name.
  • the length of the random data part can satisfy the preset range.
  • the data in the random data part may be randomly generated by the user equipment.
  • the message sending and receiving device further includes a processing module for identifying the source port number of the message to be sent before the sending module sends the DNS request message to the DNS server, and the message to be sent includes valid data Part; and, in the case where the source port number of the message to be sent is a preset port number, a random data part is added at the end of the message to be sent to form a DNS request message.
  • the DNS request message includes an IP header, and the length field information in the IP header is used to indicate the length of the DNS request message.
  • the length field information indicates the length of the valid data portion or the valid data portion And the length of the random data part.
  • an embodiment of the present application provides an apparatus for receiving and sending messages.
  • the apparatus includes a processor, the processor is coupled to a memory, and reads instructions in the memory for performing the first aspect or the first aspect described above Any of the aspects to design the method.
  • the message transceiving apparatus may be user equipment or a chip in the user equipment.
  • the user equipment includes, but is not limited to, a smart phone, a smart watch, a tablet computer, a virtual reality (VR) device, an augmented reality (AR) device, a personal computer, a handheld computer, and a personal digital assistant.
  • a smart phone a smart watch, a tablet computer
  • a virtual reality (VR) device a virtual reality (VR) device
  • AR augmented reality
  • personal computer a handheld computer
  • personal digital assistant a personal digital assistant
  • an embodiment of the present application further provides a computer-readable storage medium for storing a program used to execute the function of any one of the above-mentioned first aspect or any of the first aspect, when the program is executed by the processor , For implementing the method described in the first aspect or any design of the first aspect.
  • an embodiment of the present application provides a computer program product containing program code, which, when the program code it contains runs on a computer, causes the computer to execute the first aspect or any design of the first aspect Methods.
  • FIG. 1 is a schematic diagram of a length distribution of DNS data packets provided by an embodiment of the present application
  • FIG. 2 is a schematic flowchart of an attacker tampering with a DNS request according to an embodiment of this application;
  • FIG. 3 is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of a method for receiving and sending messages according to an embodiment of the present application
  • FIG. 5 is a schematic structural diagram of a DNS request message provided by an embodiment of this application.
  • FIG. 6 is a schematic flowchart of a base station processing a DNS data message according to an embodiment of the present application
  • FIG. 7 is a schematic flowchart of another process for processing DNS data packets by a base station according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of an IP header provided by an embodiment of this application.
  • FIG. 9 is a schematic structural diagram of another IP header provided by an embodiment of this application.
  • FIG. 10 is a schematic structural diagram of a message sending and receiving device according to an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of another message sending and receiving device according to an embodiment of the present application.
  • the user equipment can obtain the IP address corresponding to the destination domain name by accessing the DNS server, and then access the Internet according to the obtained IP address.
  • the DNS request sent by the user equipment to the DNS server may be maliciously identified, intercepted, and tampered, resulting in the user equipment obtaining a false IP address, thereby increasing the risk of the user equipment being maliciously attacked, and making the user equipment network access Security is difficult to guarantee.
  • the length of the DNS request data packet is usually within a specific range, for example, 50 bytes to 75 bytes; then, an attacker can determine whether the data packet is by identifying the length of the data packet sent by the user device DNS request; in the case where the data packet is a DNS request, the attacker tampers with the destination address in the DNS request, causing the DNS request to be forwarded to the server set by the attacker, which sends the fake IP address to the user device through a DNS response When the user equipment accesses the Internet based on the fake IP address, it may be maliciously attacked.
  • the DNS request needs to be identified first.
  • an attacker recognizes a DNS request in the following manner: The attacker finds that the length of the DNS data packet is usually within a certain range through large data statistics. For example, as shown in FIG. 1, the length of the DNS data packet sent by the user equipment is usually 50 Bytes to 75 bytes. The attacker identifies the DNS data packet by identifying the length of the data packet sent by the user equipment. For example, the attacker recognizes and intercepts a data packet with a length of 50 bytes to 75 bytes as a DNS data packet, and its accuracy is high. Statistics show that the accuracy of DNS packets can be 96.21% by identifying the length of the packets.
  • the process of the attacker tampering the DNS request may be as shown in FIG. 2.
  • Step 0 The user equipment (UE) activates the LTE security configuration through the authentication and key agreement (AKA) process.
  • AKA authentication and key agreement
  • Step 1 The UE initiates a DNS request (that is, sends a DNS data packet).
  • the attacker pretends to be a relay and recognizes the DNS data packet for interception according to the length of the DNS data packet.
  • Step 2 The attacker Relay tampers with the encrypted data according to the characteristics of the DNS packet (for example, the destination address of the DNS server is generally a fixed address) and the characteristics of the security algorithm, so that the security check value is all 0s, so that the tampered DNS
  • the data packet can pass the security check.
  • Step 3 The attacker Relay changes the destination address of the DNS packet to an illegal address.
  • the DNS data packet will be sent to the legitimate DNS server according to the destination address, and then the legitimate DNS server returns a secure IP address, and the UE can access the legal hypertext transfer protocol (HTTP) server;
  • HTTP hypertext transfer protocol
  • the DNS data packet will be sent to the illegal DNS server according to the modified destination address, and then the illegal DNS server returns an unsafe IP address, and the UE will access the illegal HTTP server.
  • Step 4 Since the destination address of the tampered DNS data packet has been modified, the DNS data packet is sent to an illegal DNS server.
  • Step 5 The UE receives the insecure IP address returned by the illegal DNS server.
  • the UE After the UE obtains an unsecured IP address, it will access the illegal network according to the IP address, which will cause the UE to be maliciously attacked.
  • the prior art generally adopts the method of integrity protection of user plane data, that is, the DNS Integrity protection of the data packet, the integrity check is performed on the received DNS data packet on the DNS server side, thereby preventing user plane data from being tampered with.
  • the communication system includes user equipment, network equipment and a DNS server.
  • the network equipment may include base stations and core network equipment.
  • the user equipment may be a device that provides voice and / or data connectivity to the user, a handheld device corresponding to a wireless connection function, or other processing equipment connected to a wireless modem.
  • User equipment can communicate with one or more core networks via a radio access network (RAN).
  • RAN radio access network
  • User equipment can be mobile terminals, such as mobile phones (or "cellular" phones) and computers corresponding to mobile terminals For example, it may be a portable, pocket-sized, handheld, computer built-in or vehicle-mounted mobile device that exchanges language and / or data with the wireless access network.
  • PCS personal communications
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistants
  • Terminal equipment can also be called a system, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, an access point,
  • the remote terminal (remote terminal), access terminal (access terminal), user terminal (user terminal), user agent (user agent) or user equipment (user equipment) are not limited in the embodiments of the present application.
  • the network standards that can be applied to network equipment include but are not limited to code division multiple access (code division multiple access (CDMA), bandwidth code division multiple access (wide-band code division multiple access (WCDMA), and time division synchronization code division multiple Address access (time division-synchronous code division multiple access (TD-SCDMA), long term evolution (LTE), 5th generation (5G) communication system.
  • code division multiple access code division multiple access
  • WCDMA bandwidth code division multiple access
  • TD-SCDMA time division synchronization code division multiple Address access
  • LTE long term evolution
  • 5G 5th generation
  • the DNS server is a server that translates domain names (domain names) and corresponding IP addresses.
  • the user equipment sends a DNS request to the DNS server through the network equipment, and the DNS server sends the IP address corresponding to the destination domain name carried in the DNS request to the user equipment through the network equipment for the user equipment to access the Internet .
  • the DNS request sent by the user equipment is different from the length of the DNS request in the prior art, the DNS request is not easily recognized and intercepted by the attacker, and it is difficult for the attacker to tamper with the DNS request. , Thereby reducing the risk of malicious attacks on user equipment.
  • Embodiments of the present application provide a message sending and receiving method and apparatus, which are used to reduce the probability of a DNS request being tampered when a user equipment accesses the Internet, thereby reducing the risk of malicious attacks on the user equipment and improving the security of user equipment network access.
  • the method and the device are based on the same inventive concept. Since the principles of the method and the device to solve the problem are similar, the implementation of the device and the method can be referred to each other, and the repetition is not repeated here.
  • FIG. 4 it is a schematic flowchart of a message sending and receiving method provided by an embodiment of the present application. The method includes the following steps.
  • S401 The user equipment sends a DNS request message to the DNS server.
  • the DNS request message includes a valid data part and a random data part, and the valid data part carries the destination domain name requested by the user equipment for access.
  • the content of the random data part may be randomly generated by the user equipment, for example, may be padding data.
  • DNS request messages can also be called DNS requests or DNS data packets.
  • the DNS request message includes a valid data part and a random data part.
  • the length of the random data part can satisfy the preset range. That is, the length of the random data portion can be set according to the actual application scenario.
  • the structure of the DNS request message may be as shown in FIG. 5.
  • the DNS request message shown in FIG. 5 includes a protocol data unit (protocol data unit, PDU) header, an IP packet, and a random data part.
  • PDU protocol data unit
  • IP packet IP packet
  • PDU header and the IP packet can be regarded as a valid data part, that is, the DNS request message sent by the user equipment to the DNS server in the prior art includes only the PDU header and the IP packet.
  • the length of DNS data packets in the prior art is usually 50 bytes to 75 bytes, so an attacker usually recognizes data packets in the length range of 50 bytes to 75 bytes as DNS data packets. . Therefore, in S401, by adding a random data portion at the end of the effective data portion, the length range of the DNS request message is not within the range recognized by the attacker, thereby preventing the DNS request message from being identified and intercepted by the attacker.
  • the length of the random data part can be set to [0, 100] bytes, so that the average length of the DNS request message is disguised as [100, 125] bytes, and the attacker will not send the DNS request message sent in S401 Identification and interception.
  • the user equipment can identify the source port number of the message to be sent (the message to be sent includes a valid data part), and when the source port number of the message to be sent is the preset port number, Add random data at the end of the sent message to form a DNS request message.
  • the DNS protocol runs on top of the user datagram protocol (user datagram protocol, UDP), and when the data packet is forwarded at the L2 packet data convergence protocol (packet data, convergence protocol, PDCP) layer, it is usually sent through a preset port, for example
  • the preset port may be a port with a port number of 53.
  • the user equipment may determine that the data packet sent on port 53 is a packet to be sent (including a PDU header and an IP packet), and then add a random data part at the end of the packet to be sent to form a DNS request packet.
  • the DNS request message is first sent to the network device (for example, the base station and the core network device), and then the network device sends the DNS request message to the DNS server.
  • the network device for example, the base station and the core network device
  • the base station in the network device may have the following two processing methods: First, after receiving the DNS request message, the base station may divide the random data part in the DNS request message. Remove it, and then continue to submit the DNS request message, as shown in Figure 6; the second kind, after receiving the DNS request message, the base station does not process the random data part, and continues to submit directly, as shown in Figure 7 .
  • the DNS server does not affect the processing of the DNS request message after receiving the DNS request message, and the DNS server processes the DNS request message according to the existing process.
  • the base station can send the DNS request message to the legal DNS server through the core network device. Since the valid data part in the DNS request message carries the destination domain name requested by the user equipment, the DNS server can respond to the destination domain name requested by the user equipment, and send the IP address corresponding to the destination domain name to the user equipment through the core network and the base station .
  • the DNS server processes the DNS request message in a similar manner to the prior art, and will not be repeated here. It is worth noting that when the DNS server processes the DNS request message, it will intercept the valid data part for processing according to the relevant configuration information, and the random data part will be discarded by the DNS server. Therefore, the contents of the random data part can be randomly generated, and the random data part will not affect the processing of the message by the DNS server.
  • S402 The user equipment receives the DNS response message from the DNS server.
  • the DNS response message carries the IP address corresponding to the destination domain name.
  • the user equipment After receiving the DNS response message, the user equipment can access the Internet according to the IP address corresponding to the destination domain name. Since the DNS request message sent by the user equipment has not been tampered with, the DNS request message is sent to the legitimate DNS server, then the DNS response message received by the user equipment also comes from the legitimate DNS server, and the IP address carried in the DNS response message It is a legal IP address. The user equipment accesses the Internet according to the IP address, and will not be subjected to malicious attacks.
  • the DNS request message may contain a PDU header, an IP packet, and a random data part.
  • the PDU header and IP packet can be regarded as a valid data part.
  • the header of the IP packet (hereinafter referred to as "IP header") contains length field information, which is used to indicate the length of the DNS request message.
  • the structure of the IP header may be as shown in FIG. 8.
  • the total length (ToTal Length) field is used to indicate the length field information;
  • the protocol type corresponding to the IP packet is the Internet Protocol version 6 (internet protocol version 6, Ipv6)
  • the structure of the IP header may be as shown in FIG. 9.
  • the Payload Length field is used to indicate length field information.
  • the length field information in the IP header may have two settings: first, the length indicated by the length field information in the IP header is the length of the valid data portion; second, the length in the IP header The length indicated by the length field information is the sum of the length of the effective data portion and the length of the random data portion.
  • the DNS request message sent by the user equipment to the DNS server includes a valid data part and a random data part. Since the random data part is added, compared with the DNS request sent in the prior art, the length of the DNS request message sent by the user equipment in this embodiment of the present application increases, and the attacker is identifying and intercepting according to the length of the message When a DNS request message is sent, it is difficult to intercept the DNS request message with the increased length. Therefore, the probability that the DNS request message is intercepted by the attacker is small, and the DNS request message will be sent to the legitimate DNS server. Then, the DNS response message received by the user equipment also comes from a legitimate DNS server, and the IP address carried in the DNS response message is a legal IP address. The user equipment accesses the Internet according to the IP address, and will not be subjected to malicious attacks.
  • the embodiments of the present application further provide a message transceiver device.
  • the message transceiving device can be used to perform the operations performed by the user equipment in the method shown in FIG. 4.
  • the message transceiver device includes a sending module 1001 and a receiving module 1002.
  • the sending module 1001 is configured to send a DNS request message to a DNS server.
  • the DNS request message includes a valid data part and a random data part.
  • the valid data part carries a destination domain name requested by the message sending and receiving device.
  • the receiving module 1002 is configured to receive a DNS response message from a DNS server, and the DNS response message carries the IP address corresponding to the destination domain name.
  • the length of the random data part satisfies the preset range.
  • the data in the random data part can be randomly generated by the message sending and receiving device.
  • the message transceiving apparatus 1000 may further include a processing module for identifying the source port number of the message to be sent before the sending module 1001 sends the DNS request message to the DNS server, and the message to be sent includes a valid data portion; In the case where the source port number of the message to be sent is a preset port number, a random data part is added at the end of the message to be sent to form a DNS request message.
  • the DNS request message includes an IP header, and the length field information in the IP header is used to indicate the length of the DNS request message.
  • the length field information indicates the length of the effective data portion or the effective data portion and the random data portion The sum of the lengths.
  • the division of the modules in the embodiments of the present application is schematic, and is only a division of logical functions. In actual implementation, there may be another division manner.
  • the functional modules in the embodiments of the present application may be integrated into one processing module, or each module may exist alone physically, or two or more modules may be integrated into one module.
  • the above integrated modules may be implemented in the form of hardware or software function modules.
  • the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of the present application essentially or part of the contribution to the existing technology or all or part of the technical solution can be embodied in the form of a software product
  • the computer software product is stored in a storage medium It includes several instructions to enable a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods of the embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program codes .
  • the message transceiving apparatus 1000 can be used to perform the operations performed by the user equipment in the method provided in the embodiment corresponding to FIG. 4, and therefore the implementation manners and details of the message transceiving apparatus 1000 shown in FIG. For technical effects, please refer to the relevant description in the method shown in FIG. 4.
  • an embodiment of the present application further provides a message transceiving device, which is used to perform the operations performed by the user equipment in the message transceiving method shown in FIG. 4, which may be the same as that shown in FIG. 10.
  • the message transceiving device 1000 is the same device.
  • FIG. 11 exemplarily shows a schematic structural diagram of a message transceiving device provided by the present application.
  • the message transceiving device 1100 includes a processor, a memory, a control circuit, and an antenna.
  • the processor is mainly used to process the communication protocol and communication data, and control the entire message transceiving device 1100, execute a software program, and process the data of the software program, for example, to support the message transceiving device 1100 to execute the process shown in FIG. 4 Message sending and receiving methods.
  • the memory is mainly used to store software programs and data.
  • the control circuit is mainly used for the conversion of the baseband signal and the radio frequency signal and the processing of the radio frequency signal.
  • the control circuit and the antenna can also be called a transceiver, which is mainly used to send and receive radio frequency signals in the form of electromagnetic waves.
  • the processor can read the software program in the memory, interpret and execute the instructions of the software program, and process the data of the software program.
  • the processor performs baseband processing on the data to be sent, and outputs the baseband signal to the radio frequency circuit.
  • the radio frequency circuit processes the baseband signal after radio frequency processing, and then sends the radio frequency signal to the outside in the form of electromagnetic waves through the antenna.
  • the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and the data Be processed.
  • FIG. 11 only shows one memory and processor.
  • the memory may also be referred to as a storage medium or storage device, etc., which is not limited in this application.
  • the processor may include a baseband processor and a central processor.
  • the baseband processor is mainly used to process communication protocols and communication data
  • the central processor is mainly used to process the entire message transceiver device 1100 Control, execute software programs, process software program data.
  • the processor in FIG. 11 integrates the functions of the baseband processor and the central processor.
  • the baseband processor and the central processor can also be separate processors, which are interconnected through technologies such as a bus.
  • the message transceiving device 1100 can include multiple baseband processors to adapt to different network standards, and the message transceiving device 1100 can include multiple central processors to enhance its processing capability.
  • the various components can be connected via various buses.
  • the baseband processor may also be expressed as a baseband processing circuit or a baseband processing chip.
  • the central processor may also be expressed as a central processing circuit or a central processing chip.
  • the function of processing the communication protocol and communication data may be built in the processor, or may be stored in the storage unit in the form of a software program, and the processor executes the software program to realize the baseband processing function.
  • an antenna and a control circuit with a transceiver function can be regarded as a transceiver unit of the message transceiver device 1100, and a processor with a processing function can be regarded as a processing unit of the message transceiver device 1100.
  • the transceiver unit may also be called a transceiver, a transceiver, a transceiver device, or the like.
  • the device used to implement the receiving function in the transceiver unit can be regarded as the receiving unit
  • the device used to implement the sending function in the transceiver unit can be regarded as the sending unit, that is, the transceiver unit includes a receiving unit and a sending unit.
  • the receiving unit may also be referred to as a receiver, receiver, receiving circuit, etc.
  • the transmitting unit may be referred to as a transmitter, transmitter, or transmitting circuit, etc.
  • the downlink signals (including data and / or control information) sent by the network device are received through the antenna, and on the uplink, the uplink is sent to the network device (e.g., base station) through the antenna
  • Signals (including data and / or control information) are processed in the processor by service data and signaling messages.
  • These units are based on the radio access technology adopted by the radio access network (eg, LTE, NR, and other evolved systems) Access technology).
  • the processor is also used to control and manage the actions of the message transceiving apparatus 1100, and is used to execute the processing performed by the user equipment in the foregoing embodiment.
  • the processor is also used to support the message transceiving apparatus 1100 to execute the execution method of the user equipment in FIG. 4.
  • FIG. 11 only shows a simplified design of the message transceiver device 1100.
  • the message transceiving device 1100 may include any number of antennas, memories, processors, etc., and all message transceiving devices 1100 that can implement the present application are within the scope of protection of the present application.
  • the transceiver when the message transceiving device 1100 executes the message transceiving method shown in FIG. 4, the transceiver is used to send to the DNS server DNS request message, the DNS request message includes a valid data part and a random data part, and the valid data part carries the destination domain name requested by the message sending and receiving device; and, is used to receive a DNS response message from the DNS server, DNS response The packet carries the IP address corresponding to the destination domain name.
  • the processor is used to identify the source port number of the packet to be sent before the transceiver sends a DNS request message to the DNS server, and the packet to be sent includes a valid data part; and, the source port number for the packet to be sent is In the case of a preset port number, a random data part is added at the end of the packet to be sent to form a DNS request packet.
  • the processor may also implement any detailed functions of the user equipment in the method embodiment shown in FIG. 4, which will not be described in detail here, and reference may be made to the processing steps performed by the user equipment in the method embodiment shown in FIG. 4.
  • the message transceiving apparatus shown in FIG. 10 or FIG. 11 can be regarded as an integrated chip in the user equipment, and can also be regarded as user equipment.
  • the user equipment includes but is not limited to a smart phone, a smart watch, a tablet computer, a VR device, an AR device, a personal computer, a handheld computer, and a personal digital assistant.
  • the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.
  • computer usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can be provided to the processor of a general-purpose computer, special-purpose computer, embedded processing machine, or other programmable data processing device to produce a machine that enables the generation of instructions executed by the processor of the computer or other programmable data processing device
  • These computer program instructions may also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, the instructions The device implements the functions specified in one block or multiple blocks of the flowchart one flow or multiple flows and / or block diagrams.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operating steps are performed on the computer or other programmable device to produce computer-implemented processing, which is executed on the computer or other programmable device
  • the instructions provide steps for implementing the functions specified in one block or multiple blocks of the flowchart one flow or multiple flows and / or block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种报文收发方法及装置，用于用户设备访问互联网时降低DNS请求被篡改的概率，从而降低用户设备被恶意攻击的风险，提高用户设备网络访问的安全性。方法包括：用户设备向域名系统DNS服务器发送DNS请求报文，DNS请求报文中包括有效数据部分和随机数据部分，有效数据部分中携带用户设备请求访问的目的域名；用户设备接收来自DNS服务器的DNS响应报文，DNS响应报文中携带目的域名对应的互联网协议IP地址。

Description

一种报文收发方法及装置 技术领域
本申请涉及通信技术领域，尤其涉及一种报文收发方法及装置。
背景技术
用户设备在访问互联网时，通常通过域名进行访问，即用户输入访问的目的域名，然后用户设备通过域名系统(domain name system，DNS)服务器进行域名解析得到该目的域名对应的互联网协议(internet protocol，IP)地址，然后再根据该IP地址访问互联网。DNS可以理解为一个分布式数据库，它所执行的基本功能是将网络资源名称(例如主机名、域名、邮件地址等)转换成对应的IP地址。
通常，用户设备访问互联网的过程可以是：用户输入目的域名后，用户设备生成一个DNS请求，该DNS请求中携带该目的域名，该DNS请求经由网络(例如接入网和核心网)发送给DNS服务器；DNS服务器通过网络将DNS响应发送给用户设备，DNS响应中携带将该目的域名对应的IP地址；用户设备在接收到DNS响应后即可根据目的域名对应的IP地址访问互联网。
但是，在第三代合作伙伴计划(3 rd generation partnership project，3GPP)协议中，由于用户面数据未采用完整性保护机制，因而网络在转发用户设备的DNS请求时，无法判断DNS请求中的数据是否被恶意篡改过，这就导致攻击者可能通过某些手段识别并截获用户设备发送的DNS请求，进而对该DNS请求中的数据进行篡改，误导用户设备访问不安全的网络。
综上，在现有的DNS请求传输机制中，攻击者可识别、截获并篡改DNS请求，因而在现有机制中存在用户设备被恶意攻击的风险，用户设备网络访问的安全性难以保证。
发明内容
本申请实施例提供了一种报文收发方法及装置，用于降低用户设备访问互联网时DNS请求被篡改的概率，从而提高用户设备网络访问的安全性。
第一方面，本申请实施例提供一种报文收发方法，该方法包括如下步骤：用户设备向域名系统DNS服务器发送DNS请求报文，DNS请求报文中包括有效数据部分和随机数据部分，有效数据部分中携带用户设备请求访问的目的域名；用户设备接收来自DNS服务器DNS响应报文，DNS响应报文中携带目的域名对应的互联网协议IP地址。
其中，随机数据部分的长度可满足预设范围。随机数据部分的数据可以由用户设备随机生成。
采用上述方案，用户设备向DNS服务器发送的DNS请求报文包含有效数据部分和随机数据部分。由于填加了随机数据部分，因而与现有技术中发送的DNS请求包含相比，本申请实施例中用户设备发送的DNS请求报文的长度增加，攻击者在根据报文长度来识别、截获DNS请求报文时，难以截获到该长度增加的DNS请求报文。因此，该DNS请求报文被攻击者截获的概率较小，该DNS请求报文将被发送至合法DNS服务器。那么，用户设备接收到的DNS响应报文也来自合法DNS服务器，DNS响应报文中携带的IP地 址为合法IP地址。用户设备根据该IP地址访问互联网，不会受到恶意攻击。
在一种可能的设计中，在用户设备向域名系统DNS服务器发送DNS请求报文之前，用户设备可识别待发送报文的源端口号，该待发送报文包括有效数据部分；然后，用户设备在待发送报文的源端口号为预设端口号的情况下，在待发送报文尾部添加随机数据部分，形成DNS请求报文。
采用上述方案，用户设备可通过识别待发送报文的源端口号来识别该待发送报文是否为DNS请求，进而在DNS请求报文的有效数据部分后添加随机数据部分，形成前述DNS请求报文。
在一种可能的设计中，DNS请求报文中包括IP头，IP头中的长度域信息用于指示DNS请求报文的长度，长度域信息指示的长度为有效数据部分的长度或者有效数据部分和随机数据部分的长度之和。
采用上述方案，提供两种IP头报文的长度域信息设置方式。无论IP头的长度域信息采用如上哪种设置，均不对网络设备(例如基站和核心网设备)以及DNS服务器的处理产生影响。
第二方面，本申请实施例还提供一种报文收发装置，该装置包括发送模块和接收模块。发送模块，用于向域名系统DNS服务器发送DNS请求报文，DNS请求报文中包括有效数据部分和随机数据部分，有效数据部分中携带报文收发装置请求访问的目的域名；接收模块，用于接收来自DNS服务器的DNS响应报文，DNS响应报文中携带目的域名对应的互联网协议IP地址。
其中，随机数据部分的长度可满足预设范围。随机数据部分的数据可以由用户设备随机生成。
在一种可能的设计中，该报文收发装置还包括处理模块，用于在发送模块向DNS服务器发送DNS请求报文之前，识别待发送报文的源端口号，待发送报文包括有效数据部分；以及，在待发送报文的源端口号为预设端口号的情况下，在待发送报文尾部添加随机数据部分，形成DNS请求报文。
在一种可能的设计中，DNS请求报文中包括IP头，IP头中的长度域信息用于指示DNS请求报文的长度，长度域信息指示的长度为有效数据部分的长度或者有效数据部分和随机数据部分的长度之和。
第三方面，本申请实施例提供一种报文收发装置，该装置包括处理器，所述处理器与存储器耦合，并读取所述存储器中的指令，用于执行上述第一方面或第一方面的任意一种设计所述的方法。
其中，该报文收发装置可以是用户设备，也可以是用户设备中的芯片。
具体地，该用户设备包括但不限于智能手机、智能手表、平板电脑、虚拟现实(virtual reality，VR)设备、增强现实(augmented reality，AR)设备、个人计算机、手持式计算机、个人数字助理。
第四方面，本申请实施例还提供了一种计算机可读存储介质，用于存储为执行上述第一方面或第一方面的任意一种设计的功能所用的程序，该程序被处理器执行时，用于实现上述第一方面或第一方面的任意一种设计所述的方法。
第五方面，本申请实施例提供了一种包含程序代码的计算机程序产品，当其包含的程序代码在计算机上运行时，使得计算机执行上述第一方面或第一方面的任意一种设计所述 的方法。
另外，第二方面至第五方面中任一种可能设计方式所带来的技术效果可参见第一方面中不同设计方式所带来的技术效果，此处不再赘述。
附图说明
图1为本申请实施例提供的一种DNS数据包的长度分布示意图；
图2为本申请实施例提供的一种攻击者篡改DNS请求的流程示意图；
图3为本申请实施例提供的一种通信系统的结构示意图；
图4为本申请实施例提供的一种报文收发方法的流程示意图；
图5为本申请实施例提供的一种DNS请求报文的结构示意图；
图6为本申请实施例提供的一种基站对DNS数据报文的处理流程示意图；
图7为本申请实施例提供的另一种基站对DNS数据报文的处理流程示意图；
图8为本申请实施例提供的一种IP头的结构示意图；
图9为本申请实施例提供的另一种IP头的结构示意图；
图10为本申请实施例提供的一种报文收发装置的结构示意图；
图11为本申请实施例提供的另一种报文收发装置的结构示意图。
具体实施方式
如背景技术中所述，用户设备可通过访问DNS服务器获取目的域名对应的IP地址，进而根据获取的IP地址访问互联网。
但是，在现网中，用户设备发送给DNS服务器的DNS请求可能会被恶意识别、截获和篡改，导致用户设备获取到虚假IP地址，进而增加用户设备被恶意攻击的风险，使得用户设备网络访问的安全性难以保证。
示例性地，DNS请求数据包的长度通常处于一个特定的范围内，例如50字节～75字节；那么，攻击者可通过识别用户设备所发送数据包的长度，来确定该数据包是否为DNS请求；在该数据包为DNS请求的情况下，攻击者篡改DNS请求中的目的地址，导致该DNS请求被转发至攻击者设置的服务器，该服务器将虚假IP地址通过DNS响应发送给用户设备，用户设备根据该虚假IP地址访问互联网时，可能受到恶意攻击。
对于攻击者来说，首先需要识别出DNS请求。通常，攻击者通过以下方式识别DNS请求：攻击者通过大数据统计，发现DNS数据包的长度通常在一定范围内，例如，如图1所示，用户设备发送的DNS数据包的长度通常在50字节～75字节。攻击者通过识别用户设备发出的数据包的长度来识别DNS数据包，例如攻击者将长度为50字节～75字节的数据包识别为DNS数据包并进行截获，其准确率较高。有统计表明，通过数据包长度来识别DNS数据包，准确率可以达到96.21％。
进一步地，在通过上述方式识别DNS数据包后，攻击者篡改DNS请求的过程可以如图2所示。
第0步：用户设备(user equipment，UE)通过认证与密钥协商(authentication and key agreement，AKA)过程激活LTE安全配置。
第1步：UE发起DNS请求(即发送DNS数据包)，攻击者伪装成中继(Relay)并根 据DNS数据包的长度识别DNS数据包进行截获。
第2步：攻击者Relay根据DNS数据包的特征(例如DNS服务器的目的地址一般为固定地址)，并结合安全算法的特点篡改加密数据，使得安全校验值为全0，以便篡改后的DNS数据包可以通过安全校验。
第3步：攻击者Relay将DNS数据包的目的地址修改为非法地址。
其中，若不对目的地址进行修改，DNS数据包会根据目的地址被发送至合法DNS服务器，进而合法DNS服务器返回安全的IP地址，UE可访问合法超文本传输协议(hypertext transfer protocol，HTTP)服务器；对目的地址进行修改后，DNS数据包会根据修改后的目的地址被发送至非法DNS服务器，进而非法DNS服务器返回不安全的IP地址，UE会访问到非法HTTP服务器。
第4步：由于篡改后的DNS数据包的目的地址已经被修改，该DNS数据包被发送至非法DNS服务器。
第5步：UE收到非法DNS服务器返回的不安全的IP地址。
UE在获取不安全的IP地址后，会根据该IP地址访问非法网络，进而导致UE受到恶意攻击。
针对上述攻击者恶意识别、截获和篡改DNS请求，导致用户设备受到恶意攻击的问题，现有技术中一般采用对用户面数据进行完整性保护的方式，即在用户设备侧通过完整性算法对DNS数据包进行完整性保护，在DNS服务器侧对接收到的DNS数据包进行完整性校验，从而防止用户面数据被篡改。
采用这种方案，需要用户设备侧和网络侧进行同步升级，且处理过程较为繁琐，不易于实现。
下面，首先对本申请实施例的应用场景进行介绍。
如图3所示，本申请实施例适用于图3所示的通信系统。该通信系统包括用户设备、网络设备和DNS服务器。其中，网络设备可以包括基站和核心网设备。
其中，用户设备可以是向用户提供语音和/或数据连通性的设备，对应无线连接功能的手持式设备、或连接到无线调制解调器的其他处理设备。用户设备可以经无线接入网(radio access network，RAN)与一个或多个核心网进行通信，用户设备可以是移动终端，如移动电话(或称为“蜂窝”电话)和对应移动终端的计算机，例如，可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，它们与无线接入网交换语言和/或数据。例如，个人通信业务(personal communication service，PCS)电话、无绳电话、会话发起协议(session initiated protocol，SIP)话机、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)等设备。终端设备也可以称为系统、订户单元(subscriber unit)、订户站(subscriber station)，移动站(mobile station)、移动台(mobile)、远程站(remote station)、接入点(access point)、远程终端(remote terminal)、接入终端(access terminal)、用户终端(user terminal)、用户代理(user agent)或用户装备(user equipment)，本申请实施例中并不限定。
网络设备可以应用的网络制式包括但不限于码分多址接入(code division multiple access，CDMA)、带宽码分多址接入(wide-band code division multiple access，WCDMA)、时分同步码分多址接入(time division-synchronous code division multiple access， TD-SCDMA)、长期演进(long term evolution，LTE)、第五代(5th generation，5G)通信系统。
DNS服务器是进行域名(domain name)和与之相对应的IP地址转换的服务器。
在图3所示的通信系统中，用户设备通过网络设备向DNS服务器发送DNS请求，DNS服务器通过网络设备将DNS请求中携带的目的域名所对应IP地址发送给用户设备，以供用户设备访问互联网。
采用本申请实施例提供的方案，由于用户设备发送的DNS请求的长度与现有技术中的DNS请求的长度不同，因而该DNS请求不易被攻击者识别和截获，攻击者也就难以篡改DNS请求，从而降低了用户设备被恶意攻击的风险。
下面将结合附图对本申请实施例作进一步地详细描述。
本申请实施例提供了一种报文收发方法及装置，用于用户设备访问互联网时降低DNS请求被篡改的概率，从而降低用户设备被恶意攻击的风险，提高用户设备网络访问的安全性。其中，方法和装置是基于同一发明构思的，由于方法及装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。
需要说明的是，本申请实施例中，多个是指两个或两个以上。另外，需要理解的是，在本申请的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。
参见图4，为本申请实施例提供的一种报文收发方法的流程示意图。该方法包括如下步骤。
S401：用户设备向DNS服务器发送DNS请求报文。
其中，该DNS请求报文中包括有效数据部分和随机数据部分，有效数据部分中携带用户设备请求访问的目的域名。随机数据部分的内容可以由用户设备随机生成，例如可以是padding数据。DNS请求报文也可以称为DNS请求或DNS数据包。
在图4所示的方法中，DNS请求报文中包括有效数据部分和随机数据部分。其中，随机数据部分的长度可以满足预设范围。即，随机数据部分的长度可以根据实际的应用场景进行设置。
示例性地，DNS请求报文的结构可以如图5所示。图5所示的DNS请求报文包括协议数据单元(protocol data unit，PDU)头、IP包和随机数据部分。其中，PDU头和IP包可以视为有效数据部分，即现有技术中用户设备向DNS服务器发送的DNS请求报文中仅包含PDU头和IP包。
如前所述，统计表明，现有技术中DNS数据包的长度通常在50字节～75字节，因而攻击者通常将50字节～75字节长度范围内的数据包识别为DNS数据包。因此，在S401中，通过在有效数据部分尾部增加随机数据部分，可以使得DNS请求报文的长度范围不在攻击者识别的范围内，从而避免DNS请求报文被攻击者识别和截获。例如，随机数据部分的长度可以设置为[0，100]字节，这样DNS请求报文的平均长度被伪装为[100，125]字节，攻击者不会将S401中发送的DNS请求报文识别和截获。
此外，在S401中用户设备向DNS服务器发送DNS请求之前，用户设备如何确定待发送报文为DNS请求报文的有效数据部分，并在有效数据部分的尾部增加随机数据部分也是一个亟需解决的问题。本申请实施例中，用户设备可识别待发送报文(待发送报文包 括有效数据部分)的源端口号，并在待发送报文的源端口号为预设端口号的情况下，在待发送报文尾部添加随机数据部分，形成DNS请求报文。
通常，DNS协议运行在用户数据报协议(user datagram protocol，UDP)之上，在L2的分组数据汇聚协议(packet data convergence protocol，PDCP)层进行数据包转发时，通常通过预设端口发送，例如该预设端口可以是端口号为53的端口。那么，用户设备可以将53号端口上发送的数据包判定为待发送报文(包含PDU头和IP包)，进而在待发送报文尾部添加随机数据部分，形成DNS请求报文。
用户设备将DNS请求报文发送出去后，DNS请求报文先发送至网络设备(例如基站和核心网设备)，然后由网络设备将该DNS请求报文发送给DNS服务器。
具体地，网络设备中的基站在接收到DNS请求报文后，可以有如下两种处理方式：第一种，基站在接收到DNS请求报文后，可以将DNS请求报文中的随机数据部分去掉，然后再将继续递交DNS请求报文，如图6所示；第二种，基站在接收到DNS请求报文后，不对其中的随机数据部分做处理，直接继续递交，如图7所示。
无论基站采用上述哪种处理方式，DNS服务器在接收到DNS请求报文后，对DNS请求报文的处理均不产生影响，DNS服务器按照现有的流程对DNS请求报文进行处理即可。
本申请实施例中，由于用户设备向基站发送的DNS请求报文不易被攻击者识别和截获，因而基站可通过核心网设备将DNS请求报文发送至合法的DNS服务器。由于DNS请求报文中的有效数据部分携带用户设备请求访问的目的域名，因而DNS服务器可以针对用户设备请求访问的目的域名进行响应，将目的域名对应的IP地址通过核心网和基站发送给用户设备。
其中，DNS服务器对DNS请求报文的处理方式与现有技术类似，此处不再赘述。值得注意的是，DNS服务器在对DNS请求报文进行处理时，会根据相关配置信息截取有效数据部分进行处理，随机数据部分将会被DNS服务器丢弃。因此，随机数据部分的内容可以随机生成，且随机数据部分不会对DNS服务器对报文的处理产生影响。
S402：用户设备接收来自DNS服务器的DNS响应报文。
其中，DNS响应报文中携带目的域名对应的IP地址。
用户设备在接收到DNS响应报文后，即可根据目的域名对应的IP地址访问互联网。由于用户设备发送的DNS请求报文未被篡改，因而DNS请求报文被发送至合法DNS服务器，那么用户设备接收到的DNS响应报文也来自合法DNS服务器，DNS响应报文中携带的IP地址为合法IP地址。用户设备根据该IP地址访问互联网，不会受到恶意攻击。
此外，如前所述，DNS请求报文中可以包含PDU头、IP包和随机数据部分。其中，PDU头和IP包可以视为有效数据部分。实际实现时，IP包的头部(以下简称“IP头”)中包含长度域信息，该长度域信息用于指示DNS请求报文的长度。
示例性地，若IP包对应的协议类型为因特网协议第四版(internet protocol version 4，IPv4)，那么IP头的结构可以如图8所示。其中，总长度(ToTal Length)字段用于指示长度域信息；若IP包对应的协议类型为因特网协议第六版(internet protocol version 6，Ipv6)，那么IP头的结构可以如图9所示。其中，载荷长度(Payload Length)字段用于指示长度域信息。
在本申请实施例中，IP头中的长度域信息可以有两种设置：第一种，IP头中的长度域信息所指示的长度为有效数据部分的长度；第二种，IP头中的长度域信息所指示的长度为 有效数据部分的长度和随机数据部分的长度之和。
无论IP头的长度域信息采用如上哪种设置，均不对网络设备(例如基站和核心网设备)以及DNS服务器的处理产生影响。
本申请实施例中，用户设备向DNS服务器发送的DNS请求报文包含有效数据部分和随机数据部分。由于填加了随机数据部分，因而与现有技术中发送的DNS请求包含相比，本申请实施例中用户设备发送的DNS请求报文的长度增加，攻击者在根据报文长度来识别、截获DNS请求报文时，难以截获到该长度增加的DNS请求报文。因此，该DNS请求报文被攻击者截获的概率较小，该DNS请求报文将被发送至合法DNS服务器。那么，用户设备接收到的DNS响应报文也来自合法DNS服务器，DNS响应报文中携带的IP地址为合法IP地址。用户设备根据该IP地址访问互联网，不会受到恶意攻击。
基于同一发明构思，本申请实施例还提供一种报文收发装置。该报文收发装置可用于执行图4所示方法中用户设备所执行的操作。
参见图10，该报文收发装置包括发送模块1001和接收模块1002。
发送模块1001，用于向DNS服务器发送DNS请求报文，DNS请求报文中包括有效数据部分和随机数据部分，有效数据部分中携带报文收发装置请求访问的目的域名。
接收模块1002，用于接收来自DNS服务器的DNS响应报文，DNS响应报文中携带目的域名对应的IP地址。
其中，随机数据部分的长度满足预设范围。随机数据部分的数据可以由报文收发装置随机生成。
此外，报文收发装置1000还可以包括处理模块，用于在发送模块1001向DNS服务器发送DNS请求报文之前，识别待发送报文的源端口号，待发送报文包括有效数据部分；以及，在待发送报文的源端口号为预设端口号的情况下，在待发送报文尾部添加随机数据部分，形成DNS请求报文。
可选地，DNS请求报文中包括IP头，IP头中的长度域信息用于指示DNS请求报文的长度，长度域信息指示的长度为有效数据部分的长度或者有效数据部分和随机数据部分的长度之和。
需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。在本申请的实施例中的各功能模块可以集成在一个处理模块中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
集成的模块如果以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本申请各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
同样需要说明的是，报文收发装置1000可用于执行图4对应的实施例提供的方法中 用户设备所执行的操作，因此图10所示的报文收发装置1000中未详尽描述的实现方式及技术效果可参见图4所示方法中的相关描述。
基于相同构思，本申请实施例还提供一种报文收发装置，该报文收发装置用于执行图4所示的报文收发方法中用户设备所执行的操作，可以是与图10所示的报文收发装置1000相同的装置。
图11示例性示出了本申请提供的一种报文收发装置的结构示意图，如图11所示，报文收发装置1100包括处理器、存储器、控制电路以及天线。处理器主要用于对通信协议以及通信数据进行处理，以及对整个报文收发装置1100进行控制，执行软件程序，处理软件程序的数据，例如用于支持报文收发装置1100执行图4所示的报文收发方法。存储器主要用于存储软件程序和数据。控制电路主要用于基带信号与射频信号的转换以及对射频信号的处理。控制电路和天线一起也可以叫做收发器，主要用于收发电磁波形式的射频信号。
当报文收发装置开机后，处理器可以读取存储器中的软件程序，解释并执行软件程序的指令，处理软件程序的数据。当需要通过无线发送数据时，处理器对待发送的数据进行基带处理后，输出基带信号至射频电路，射频电路将基带信号进行射频处理后将射频信号通过天线以电磁波的形式向外发送。当有数据发送到报文收发装置1100时，射频电路通过天线接收到射频信号，将射频信号转换为基带信号，并将基带信号输出至处理器，处理器将基带信号转换为数据并对该数据进行处理。
本领域技术人员可以理解，为了便于说明，图11仅示出了一个存储器和处理器。在实际的报文收发装置1100中，可以存在多个处理器和存储器。存储器也可以称为存储介质或者存储设备等，本申请对此不做限制。
作为一种可选的实现方式，处理器可以包括基带处理器和中央处理器，基带处理器主要用于对通信协议以及通信数据进行处理，中央处理器主要用于对整个报文收发装置1100进行控制，执行软件程序，处理软件程序的数据。图11中的处理器集成了基带处理器和中央处理器的功能，本领域技术人员可以理解，基带处理器和中央处理器也可以是各自独立的处理器，通过总线等技术互联。本领域技术人员可以理解，报文收发装置1100可以包括多个基带处理器以适应不同的网络制式，报文收发装置1100可以包括多个中央处理器以增强其处理能力，报文收发装置1100的各个部件可以通过各种总线连接。所述基带处理器也可以表述为基带处理电路或者基带处理芯片。所述中央处理器也可以表述为中央处理电路或者中央处理芯片。对通信协议以及通信数据进行处理的功能可以内置在处理器中，也可以以软件程序的形式存储在存储单元中，由处理器执行软件程序以实现基带处理功能。
在本申请实施例中，可以将具有收发功能的天线和控制电路视为报文收发装置1100的收发单元，将具有处理功能的处理器视为报文收发装置1100的处理单元。收发单元也可以称为收发器、收发机、收发装置等。可选地，可以将收发单元中用于实现接收功能的器件视为接收单元，将收发单元中用于实现发送功能的器件视为发送单元，即收发单元包括接收单元和发送单元。示例性的，接收单元也可以称为接收机、接收器、接收电路等，发送单元可以称为发射机、发射器或者发射电路等。
在下行链路上，通过天线接收网络设备(例如基站)发送的下行链路信号(包括数据和/或控制信息)，在上行链路上，通过天线向网络设备(例如基站)发送上行链路信号(包括数据和/或控制信息)，在处理器中，对业务数据和信令消息进行处理，这些单元根据无 线接入网采用的无线接入技术(例如，LTE、NR及其他演进系统的接入技术)来进行处理。所述处理器还用于对报文收发装置1100的动作进行控制管理，用于执行上述实施例中由用户设备进行的处理。处理器还用于支持报文收发装置1100执行图4中用户设备的执行方法。
可以理解的是，图11仅仅示出了报文收发装置1100的简化设计。在实际应用中，报文收发装置1100可以包含任意数量的天线，存储器，处理器等，而所有可以实现本申请的报文收发装置1100都在本申请的保护范围之内。
具体地，本申请中，以收发单元称为收发器，处理单元称为处理器为例，则报文收发装置1100在执行图4所示的报文收发方法时，收发器用于向DNS服务器发送DNS请求报文，DNS请求报文中包括有效数据部分和随机数据部分，有效数据部分中携带报文收发装置请求访问的目的域名；以及，用于接收来自DNS服务器的DNS响应报文，DNS响应报文中携带目的域名对应的IP地址。处理器用于在收发器向DNS服务器发送DNS请求报文之前，识别待发送报文的源端口号，该待发送报文包括有效数据部分；以及，用于在待发送报文的源端口号为预设端口号的情况下，在待发送报文尾部添加随机数据部分，形成DNS请求报文。
处理器还可以实现上述图4所示的方法实施例中用户设备的任意详细功能，在此不再详尽赘述，可以参照上述图4所示的方法实施例中用户设备执行的处理步骤。
需要说明的是，图10或图11中所示的报文收发装置可视为用户设备中的集成芯片，也可以也视为用户设备。
具体地，该用户设备包括但不限于智能手机、智能手表、平板电脑、VR设备、AR设备、个人计算机、手持式计算机、个人数字助理。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请实施例的精神和范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (12)

  1. 一种报文收发方法，其特征在于，包括：
    用户设备向域名系统DNS服务器发送DNS请求报文，所述DNS请求报文中包括有效数据部分和随机数据部分，所述有效数据部分中携带所述用户设备请求访问的目的域名；
    所述用户设备接收来自所述DNS服务器的DNS响应报文，所述DNS响应报文中携带所述目的域名对应的互联网协议IP地址。
  2. 如权利要求1所述的方法，其特征在于，在用户设备向域名系统DNS服务器发送DNS请求报文之前，还包括：
    所述用户设备识别待发送报文的源端口号，所述待发送报文包括所述有效数据部分；
    所述用户设备在所述待发送报文的源端口号为预设端口号的情况下，在所述待发送报文尾部添加所述随机数据部分，形成所述DNS请求报文。
  3. 如权利要求1或2所述的方法，其特征在于，所述随机数据部分的长度满足预设范围。
  4. 如权利要求1～3任一项所述的方法，其特征在于，所述随机数据部分的数据由所述用户设备随机生成。
  5. 如权利要求1～4任一项所述的方法，其特征在于，所述DNS请求报文中包括IP头，所述IP头中的长度域信息用于指示所述DNS请求报文的长度，所述长度域信息指示的长度为所述有效数据部分的长度或者所述有效数据部分和所述随机数据部分的长度之和。
  6. 一种报文收发装置，其特征在于，包括：
    发送模块，用于向域名系统DNS服务器发送DNS请求报文，所述DNS请求报文中包括有效数据部分和随机数据部分，所述有效数据部分中携带所述报文收发装置请求访问的目的域名；
    接收模块，用于接收来自所述DNS服务器的DNS响应报文，所述DNS响应报文中携带所述目的域名对应的互联网协议IP地址。
  7. 如权利要求6所述的报文收发装置，其特征在于，还包括：
    处理模块，用于在所述发送模块向所述DNS服务器发送所述DNS请求报文之前，识别待发送报文的源端口号，所述待发送报文包括所述有效数据部分；以及，在所述待发送报文的源端口号为预设端口号的情况下，在所述待发送报文尾部添加所述随机数据部分，形成所述DNS请求报文。
  8. 如权利要求6或7所述的报文收发装置，其特征在于，所述随机数据部分的长度满足预设范围。
  9. 如权利要求6～8任一项所述的报文收发装置，其特征在于，所述随机数据部分的数据由所述报文收发装置随机生成。
  10. 如权利要求6～9任一项所述的报文收发装置，其特征在于，所述DNS请求报文中包括IP头，所述IP头中的长度域信息用于指示所述DNS请求报文的长度，所述长度域信息指示的长度为所述有效数据部分的长度或者所述有效数据部分和所述随机数据部分的长度之和。
  11. 一种计算机存储介质，其特征在于，所述计算机存储介质上存储有程序，所述程序被处理器执行时，用于实现如权利要求1～5任一项所述的方法。
  12. 一种计算机程序产品，其特征在于，所述计算机程序产品包含的程序代码在计算机上运行时，使得所述计算机执行如权利要求1～5任一项所述的方法。
PCT/CN2018/117304 2018-11-23 2018-11-23 一种报文收发方法及装置 WO2020103159A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2018/117304 WO2020103159A1 (zh) 2018-11-23 2018-11-23 一种报文收发方法及装置
CN201880090542.9A CN111788809A (zh) 2018-11-23 2018-11-23 一种报文收发方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2018/117304 WO2020103159A1 (zh) 2018-11-23 2018-11-23 一种报文收发方法及装置

Publications (1)

Publication Number Publication Date
WO2020103159A1 true WO2020103159A1 (zh) 2020-05-28

Family

ID=70773052

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/117304 WO2020103159A1 (zh) 2018-11-23 2018-11-23 一种报文收发方法及装置

Country Status (2)

Country Link
CN (1) CN111788809A (zh)
WO (1) WO2020103159A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114629822A (zh) * 2022-04-18 2022-06-14 北京小米移动软件有限公司 链路检测方法、装置、电子设备及存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114268669A (zh) * 2022-03-01 2022-04-01 阿里云计算有限公司 访问处理方法及系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110307541A1 (en) * 2010-06-10 2011-12-15 Microsoft Corporation Server load balancing and draining in enhanced communication systems
CN105491179A (zh) * 2015-11-23 2016-04-13 北京天地互连信息技术有限公司 一种应对dns服务器反射放大攻击的解决方法
CN107154927A (zh) * 2017-03-28 2017-09-12 北京安博通科技股份有限公司 报文处理方法及装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101378407B (zh) * 2008-09-26 2012-10-17 成都市华为赛门铁克科技有限公司 一种信息推送方法、系统及设备
CN101567815B (zh) * 2009-05-27 2011-05-11 清华大学 域名服务器dns放大攻击的有效检测与抵御方法
CN102457440A (zh) * 2012-01-13 2012-05-16 华为软件技术有限公司 实现负载均衡的方法、dns服务器和客户端

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110307541A1 (en) * 2010-06-10 2011-12-15 Microsoft Corporation Server load balancing and draining in enhanced communication systems
CN105491179A (zh) * 2015-11-23 2016-04-13 北京天地互连信息技术有限公司 一种应对dns服务器反射放大攻击的解决方法
CN107154927A (zh) * 2017-03-28 2017-09-12 北京安博通科技股份有限公司 报文处理方法及装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114629822A (zh) * 2022-04-18 2022-06-14 北京小米移动软件有限公司 链路检测方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN111788809A (zh) 2020-10-16

Similar Documents

Publication Publication Date Title
CA2501158C (en) Contact validation and trusted contact updating in mobile wireless communications devices
US20150229669A1 (en) Method and device for detecting distributed denial of service attack
CN110247848B (zh) 发送报文的方法、网络设备及计算机可读存储介质
US20190058731A1 (en) User-side detection and containment of arp spoofing attacks
CN110392998B (zh) 一种数据包校验方法及设备
Jamal et al. Denial of service attack in wireless LAN
TWI307232B (en) Wireless local area network with protection function and method for preventing attack
EP4156626A1 (en) Ipv6 network communication method, apparatus and system
EP2025089A1 (en) Methods and apparatus for a keying mechanism for end-to-end service control protection
CN109040059B (zh) 受保护的tcp通信方法、通信装置及存储介质
WO2023011151A1 (zh) 通信方法和装置
WO2020103159A1 (zh) 一种报文收发方法及装置
US10666624B2 (en) Systems and methods for optimized network layer message processing
CN110474922B (zh) 一种通信方法、pc系统及接入控制路由器
JP6651613B2 (ja) ワイヤレス通信
CN109600364B (zh) 一种实现消息验证的方法、装置及计算机可读存储介质
CN108768961B (zh) 存储处理方法及家庭网关
WO2022134089A1 (zh) 一种安全上下文生成方法、装置及计算机可读存储介质
WO2021032126A1 (zh) 一种数据处理方法及装置
EP3552367B1 (en) Method and intermediate network node for managing tcp segment
CN112688948B (zh) 一种对象处理方法及装置
US20200120493A1 (en) Apparatus and method for communications
US20230141028A1 (en) Traffic control server and method
US11589237B2 (en) Methods, systems, and computer readable media for mitigating unauthorized message relay attacks
CN107920054B (zh) 一种数据传输方法及其相关设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18940666

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18940666

Country of ref document: EP

Kind code of ref document: A1