WO2020258980A1 - 网络攻击防御方法、装置、接收设备及计算机存储介质 - Google Patents

网络攻击防御方法、装置、接收设备及计算机存储介质 Download PDF

Info

Publication number
WO2020258980A1
WO2020258980A1 PCT/CN2020/083583 CN2020083583W WO2020258980A1 WO 2020258980 A1 WO2020258980 A1 WO 2020258980A1 CN 2020083583 W CN2020083583 W CN 2020083583W WO 2020258980 A1 WO2020258980 A1 WO 2020258980A1
Authority
WO
WIPO (PCT)
Prior art keywords
keyword
network attack
receiving device
attack defense
new
Prior art date
Application number
PCT/CN2020/083583
Other languages
English (en)
French (fr)
Inventor
刘仓明
洪先进
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US17/622,860 priority Critical patent/US12088622B2/en
Priority to EP20832962.3A priority patent/EP3968595A4/en
Publication of WO2020258980A1 publication Critical patent/WO2020258980A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2854—Wide area networks, e.g. public data networks
    • H04L12/2856—Access arrangements, e.g. Internet access
    • H04L12/2858—Access network architectures
    • H04L12/2859—Point-to-point connection between the data network and the subscribers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2854—Wide area networks, e.g. public data networks
    • H04L12/2856—Access arrangements, e.g. Internet access
    • H04L12/2869—Operational details of access network equipments
    • H04L12/287—Remote access server, e.g. BRAS
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]

Definitions

  • the embodiments of the present application relate to but not limited to the field of communications, specifically, to but not limited to a network attack defense method, device, receiving device, and computer storage medium.
  • Broadband Access Server as a broadband access device, provides user authentication, authorization, billing, and aggregation and forwarding of multiple services, realizing commercial buildings and Broadband IP Internet access for residential residents is the core equipment for broadband user access.
  • Broadband access services are divided into a control plane and a forwarding plane.
  • the control plane is the core part of controlling broadband user access, including broadband user access protocol processing, authentication, authorization and accounting for broadband user access, and forwarding to
  • the forwarding plane provides equipment management and maintenance functions.
  • the control plane and the forwarding plane can be deployed in a distributed manner.
  • One control plane can control and manage multiple forwarding planes to meet more broadband user access requirements.
  • control plane As the core part of broadband access services, the control plane has high requirements for reliability, including the rapid prevention of network attack packet attacks, that is, it can still satisfy broadband users' access under the condition of withstanding a large number of network attack packets. Performance requirements.
  • the traditional broadband access server After receiving the broadband user access message, the traditional broadband access server confirms through multiple table lookups. If it is a message sent to the control plane, the rate is limited, and then sent to the control plane to prevent attacks on the control plane. effect. However, the rate limit processing will also discard some normal user access packets. The reason is that the broadband access server cannot effectively distinguish normal user access packets from network attack packets. For example, the attacker can copy normal users online through the network. Then, the copied messages are sent to the broadband access server in large quantities as network attack messages, which makes it difficult for the broadband access server to distinguish between normal user access messages and network attack messages.
  • NFV Network Functions Virtualization
  • X86 servers, storage and switching equipment based on industry standards have gradually replaced dedicated network equipment in the communication network, saving operators Huge investment costs and more flexible network capabilities, broadband access equipment is no exception. Therefore, in terms of preventing control surface attacks, the traditional broadband access equipment’s multiple table lookups and speed limit methods are used in a virtualized environment. , It needs to consume a large amount of CPU (Central Processing Unit, central processing unit) processing capacity, so when a large number of network attack packets exist, it directly affects normal user access processing.
  • CPU Central Processing Unit, central processing unit
  • the embodiments of the application provide a network attack defense method, device, receiving device, and computer storage medium.
  • An embodiment of the present application provides a network attack defense method, including: a network attack defense device randomly generates new keywords; the network attack defense device sends the new keywords to a sending device and a receiving device respectively; and the receiving device transmits the The new keyword is updated to the keyword set of the receiving device; the keyword carried in the communication message sent by the sending device is obtained, and whether the communication message is a network is determined according to the carried keyword and the keyword set Attack message; when the communication message is a network attack message, the receiving device discards the communication message.
  • An embodiment of the present application also provides a network attack defense device, including a first processor, a first memory, and a first communication bus; the first communication bus is used to implement connection and communication between the first processor and the first memory The first processor is used to execute one or more computer programs stored in the memory to implement the steps of the network attack defense method implemented by the network attack defense device described above.
  • An embodiment of the present application also provides a receiving device, including a second processor, a second memory, and a second communication bus; the second communication bus is used to implement connection and communication between the second processor and the second memory; The second processor is used to execute one or more computer programs stored in the memory to implement the steps of the network attack defense method implemented by the network attack defense device described above.
  • the embodiments of the present application also provide a computer storage medium, the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to realize the above At least one step of a cyber attack defense method.
  • FIG. 1 is a flowchart of a network attack defense method according to Embodiment 1 of the application;
  • FIG. 2 is a schematic structural diagram of a network attack defense device according to Embodiment 2 of this application;
  • FIG. 3 is a schematic structural diagram of a receiving device according to Embodiment 2 of this application.
  • FIG. 4 is a schematic diagram of the connection of the network attack defense device, receiving device, and sending device according to the second embodiment of the application;
  • FIG. 5 is a schematic diagram of the networking of vBRAS control plane attack defense deployment according to Embodiment 3 of the application;
  • FIG. 6 is a flowchart of a network attack defense method according to Embodiment 3 of this application.
  • FIG. 7 is a schematic diagram of the networking of the VxLAN access attack prevention deployment of the vBRAS device in the fourth embodiment of the application;
  • Fig. 8 is a flowchart of a network attack defense method according to Embodiment 4 of this application.
  • the traditional broadband access server After receiving the broadband user access message, the traditional broadband access server confirms through multiple table lookups. If it is a message sent to the control plane, the rate is limited, and then sent to the control plane to prevent attacks on the control plane. effect.
  • the broadband access server cannot effectively distinguish between normal user access messages and network attack messages, and will also discard some normal user access messages.
  • traditional broadband access equipment In terms of preventing control surface attacks, traditional broadband access equipment’s multiple table lookups and rate limiting methods are used. In a virtualized environment, a large amount of CPU processing power is required. Therefore, a large number of network attack packets are In this case, it directly affects normal user access processing.
  • the embodiment of the present application provides a network attack defense method, which randomly generates new keywords at regular intervals, and sends the constantly changing new keywords to the sending and receiving communication devices.
  • the sending communication device sends a report
  • the message carries keywords.
  • the receiving end communication device After receiving the message carrying the keyword, the receiving end communication device first compares whether the keywords in the message are consistent with the keywords stored locally. If they are consistent, the message is processed normally. , It is judged as an attack packet, and the attack packet is discarded immediately to achieve the purpose of attack prevention.
  • Figure 1 is a flowchart of a network attack defense method.
  • the network attack defense method includes:
  • the network attack defense device randomly generates new keywords.
  • the generated new keyword is random.
  • the keyword is used to identify a piece of information. It can be a number or a character string that can be carried in a communication message, so that the attacker cannot predict the next keyword. For example, a new keyword 1 (such as the number "30)" is generated at t1, and a new keyword 2 (such as the string "abcd123”) is generated at t2. The new keyword 1 is different from the new keyword 2, and there is no rule.
  • the new keyword can be generated periodically, and the time interval before the new keyword generated at two adjacent time points is fixed, for example, the time interval is 20s, 60s, 90s, 150s, etc.; of course t1
  • the time interval between time and time t2 may be different from the time interval between time t2 and subsequent time t3, and can be flexibly adjusted according to actual needs.
  • the network attack defense device sends the new keywords to the sending device and the receiving device respectively.
  • the network attack defense device first sends the new keyword to the receiving device, and the network attack defense device then sends the new keyword to the sending device. Specifically, the network attack defense device sends the new keyword to the receiving device; after the receiving device adds the new keyword to the keyword set of the receiving device, the receiving device reports the confirmation message, and after the network attack defense device receives the confirmation message, The network attack defense device sends the new keyword to the sending device. At this time, if the communication message sent by the sending device carries the latest new keyword, the keyword set of the receiving device must include the latest new keyword, avoiding The receiving device discards the normal communication message, so the keyword set in the embodiment of the present application includes at least one newly generated keyword.
  • the sending device updates an old keyword stored locally to the new keyword. Because the attacker can copy the normal user communication message including the old keyword through the network, for convenience The receiving device can better distinguish between normal communication messages and network attack messages.
  • the sending device returns response information, and the network attack defense device receives the updated and saved messages of the sending device for the new keywords. After responding to the information, notify the receiving device to delete the oldest keyword in the keyword set.
  • the new and old keywords are determined according to the time when the keywords are added. The most recently added keywords are the latest.
  • the receiving device currently includes the keyword set ⁇ key- n-2, key-n-1, key-n ⁇ , key-n-1 in the key set is newer than key-n-2, key-n is the newly added new key in the set, then the key -n-2 delete.
  • one sending device may correspond to one receiving device, or multiple sending devices may correspond to one receiving device.
  • the receiving device includes multiple communication channels corresponding to multiple sending devices, and each communication channel corresponds to Each keyword set of the receiving device, so after receiving the new keyword, the receiving device adds the new keyword to each keyword set. It is understandable that each keyword set of the receiving device may be completely the same, or may be partially the same.
  • the key set corresponding to communication channel 1 is ⁇ key-n-2, key-n-1, key-n ⁇
  • the key set corresponding to communication channel 2 is ⁇ m-2, m-1, key-n ⁇ .
  • the new keyword can also be sent by the network attack defense device to the sending device and the receiving device at the same time, after which the sending device updates and saves the new keyword, and the receiving device replaces the oldest keyword in the keyword set. It is a new keyword. If the communication message sent by the sending device carries a new keyword and the keyword set of the receiving device also contains the new keyword, then the keyword set includes at least one newly generated keyword.
  • the receiving device updates the new keyword to the keyword set of the receiving device, obtains the keywords carried in the communication message sent by the sending device, and determines whether the communication message is a network attack message according to the carried keywords and keyword set .
  • the sending device will send the communication message to the receiving device through the data transmission path between the sending device and the receiving device.
  • the receiving device obtains the communication message sent by the sending device, and extracts the carrying message from the communication message.
  • determine whether the keyword set corresponding to the data transmission path includes the carried keyword and then determine whether the communication message is a network attack message. It is understandable that the data transmission path between the sending device and the receiving device is different, and the keyword set of the receiving device and the data receiving transmission path may be different. Therefore, the communication message is performed through the keyword set corresponding to the data transmission path. Judging, if the user’s normal communication message sent by the sending device, the keyword carried is the received new keyword.
  • the receiving device can determine The communication message is a normal communication message; if the communication message sent by the sending device is a network attack message copied over the network, the keyword is the old keyword, and the keyword set in the receiving device does not include this keyword.
  • the old keyword indicates that the communication message is a network attack message.
  • the receiving device receives the first new keyword at time ta
  • the sending device receives the first new keyword at time tb
  • the receiving device receives the second new keyword at time tc
  • the sending device has not received the first new keyword before time td.
  • Two new keywords when the sending device sends a normal communication message carrying the first new keyword at time td, where ta time is before tb and tc before td, then the receiving device receives the communication message ,
  • the keyword set of the receiving device includes at least ⁇ first new keyword, second new keyword ⁇ , and there is a time difference between the keyword update of the receiving device and the sending device.
  • the communication message is a non-network attack, avoiding the discarding of normal communication messages.
  • the keyword set of the receiving device may only Include a new keyword, and then determine whether the keyword carried in the communication message of the sending device is the same as the keyword of the receiving device, and distinguish the communication message. If the communication message sent by the sending device is a normal communication message, It will definitely carry new keywords.
  • the sending equipment includes but is not limited to Customer Premise Equipment (CPE for short), Broadband Remote Access Server (BRAS for short), and Broadband Network Gateway (for short) BNG), Broadband Service Gateway (BSG), Service Router (SR), Broadband Access Server (BAS), Openflow Logical Switch (Openflow Logical Switch) , OFLS for short), Openflow Switch (OFS for short), Access Controller (AC for short), optical line terminal (optical line terminal, OLT for short), aggregation switch, virtual BRAS (virtual Broadband Remote Access Server, referred to as vBRAS) forwarding plane equipment, virtual BAS (virtual Broadband Access Server, referred to as vBAS) forwarding plane equipment, and virtual BNG (virtual Broadband Network Gateway, referred to as vBNG) forwarding plane equipment.
  • CPE Customer Premise Equipment
  • BRAS Broadband Remote Access Server
  • BNG Broadband Network Gateway
  • BSG Broadband Service Gateway
  • SR Service Router
  • BAS Broadband Access Server
  • Receiving equipment includes, but is not limited to, Broadband Remote Access Server (BRAS), Broadband Network Gateway (BNG), Broadband Service Gateway (BSG), and service router (Service Router, SR for short), Broadband Access Server (BAS for short), Openflow Logical Switch (OFLS), Openflow Switch (OFS for short), wireless Access Controller (AC for short), virtual BRAS (virtual Broadband Remote Access Server, vBRAS) control plane device, virtual BAS (virtual Broadband Access Server, vBAS) control plane device, virtual BNG (virtual BNG) Broadband Network Gateway, referred to as vBNG) control plane equipment.
  • BRAS Broadband Remote Access Server
  • BNG Broadband Service Gateway
  • BNG Broadband Service Gateway
  • acquiring the communication message sent by the sending device and extracting the keywords carried in the communication message include: the known field or extension field defined by the receiving device from the standard communication protocol, or The keyword is extracted from the vendor private definition field added in the communication message.
  • the sending device includes a vBRAS forwarding plane device
  • the receiving device obtains NSH information and a broadband user access protocol packet from the communication packet, and extracts the keyword from the NSH information.
  • a broadband user goes online, it first sends a broadband access protocol message to vBRAS, transmits it through the access network, and sends it to the vBRAS forwarding plane device.
  • the vBRAS forwarding plane device then sends the broadband access protocol message (such as PPPoE, DHCP, etc.) and NSH information (see Network Service Header defined by IETF) is encapsulated together.
  • the NSH information includes the keyword of the sending device, and then the receiving device receives the communication packet and parses it to obtain the broadband access protocol packet and NSH information. From the NSH information To extract keywords.
  • the receiving device obtains the keyword from the UDP source port number in the communication message. For example, when a broadband user goes online, the broadband access protocol message is sent to the OLT device through the ONU device and the access network, and the OLT encapsulates the broadband access protocol message into the VxLAN tunnel between the OLT and the vBRAS forwarding plane.
  • the UDP source port number of the VxLAN tunnel is set as a keyword, and the UDP source port number in the message from the vBRAS forwarding plane of the receiving device is set as the keyword.
  • the receiving device discards the communication message.
  • the communication message When it is distinguished that the communication message includes a network attack message, the communication message is discarded, and when the communication message is a normal communication message, the communication message is reported to the control plane for subsequent processing.
  • the network attack defense method provided by the embodiments of this application sends random keywords to the receiving device and the sending device.
  • the sending device and the receiving device update and save the new keywords respectively, and carry the communication message sent by the sending device.
  • the network attack message sent by the attacker and the normal communication message can be easily identified, and the keyword is random, which also makes the attacker unable to predict the next normal communication message carried
  • the keyword solves the problem that the normal user access packet and the network attack packet cannot be effectively distinguished, and prevents the normal user communication packet from being discarded.
  • the network attack defense device includes a first processor 201, a first memory 202, and a first communication bus 203;
  • the first communication bus 203 is used to implement connection and communication between the first processor 201 and the first memory 202;
  • the first processor 201 is configured to execute one or more computer programs stored in the memory to implement the following steps:
  • the new keywords are sent to the sending device and the receiving device respectively.
  • the new keyword is sent to the receiving device; after the new keyword is added to the keyword set of the receiving device, the new keyword is sent to the sending device. After the keyword of the sending device is updated to the new keyword, the receiving device is notified to delete the oldest keyword in the keyword set. In some embodiments, the keyword may also be sent to the sending device and the receiving device at the same time.
  • the receiving device includes a second processor 301, a second memory 302, and a second communication bus 303;
  • the second communication bus 303 is used to implement connection and communication between the second processor 301 and the second memory 302;
  • the second processor 301 is configured to execute one or more computer programs stored in the memory to implement the following steps:
  • Update the new keyword to the keyword set obtain the keyword carried in the communication message sent by the sending device, and determine whether the communication message is a network attack report according to the carried keyword and keyword set Text
  • the communication message is a network attack message
  • the communication message is discarded.
  • the second processor 302 obtains keywords carried in the communication message sent by the sending device, and determines whether the keyword set includes the keywords, including: obtaining the sending A communication message sent by a device, the communication message is sent through a data transmission path between the sending device and the receiving device; the keyword carried in the communication message is extracted; and it is determined that it corresponds to the data transmission path Whether the keyword set of includes the carried keyword; when not included, the communication message is a network attack message.
  • the receiving device obtains NSH information and a broadband user access protocol packet from the communication packet, and extracts the keyword from the NSH information; when the sending device includes In the case of an OLT device, the receiving device obtains the keyword from the UDP source port number in the communication message.
  • FIG. 4 is a schematic diagram of the relationship between the network attack defense apparatus, the sending device, and the receiving device provided by an embodiment of the application.
  • the network attack defense device includes a random keyword transmitter and channel keyword management examples; the random keyword generator generates random keywords at regular intervals, and sends the generated keywords to each channel keyword management instance, channel keyword management After the instance receives the keyword, it first issues the new keyword to the receiving device. After the receiving device receives the new keyword, it adds the new keyword to the keyword set and returns a confirmation response. The channel keyword management instance receives the received keyword. After the device's confirmation response, the new keyword is issued to the sending device. After the sending device receives the new keyword, it replaces the old keyword with the new keyword and returns a confirmation response.
  • the channel keyword management instance After the channel keyword management instance receives the confirmation response from the sending device, it notifies the receiving device to delete the oldest keyword in the keyword set.
  • the sending device sends a communication message
  • the communication message carries a keyword.
  • the receiving device After the receiving device receives the communication message, it first determines whether the keyword carried in the communication message belongs to an element in the keyword set. It is a normal communication message and will continue to be processed later; if it does not belong, it is judged as a network attack message and discarded immediately.
  • the embodiments of the present application provide a network attack defense device and a receiving device.
  • the network attack defense device generates new keywords and sends the constantly changing new keywords to the sending and receiving communication equipment.
  • the receiving device stores the key locally
  • the old keywords in the word set are replaced with new keywords.
  • the sending communication device sends a message, the message carries the latest keyword.
  • the receiving communication device After the receiving communication device receives the message carrying the keyword, it first compares the Whether the keywords are consistent with the keywords in the keyword set saved locally, if they are the same, the message is processed normally, if they are inconsistent, it is judged as an attack message, and the attack message is immediately discarded to achieve the purpose of attack prevention; Under the environment, it can significantly reduce the CPU processing resources required to identify network attack packets, and improve the access performance of normal users in the presence of a large number of network attack packets.
  • the embodiment of this application uses a specific implementation scenario to describe the network attack defense method and system.
  • the embodiment of this application describes a vBRAS control plane attack defense deployment scenario, where the vBRAS control plane device is deployed in a data center .
  • the vBRAS forwarding plane equipment is deployed at the edge of the metropolitan area network, through the VxLAN tunnel between the vBRAS control plane and the vBRAS forwarding plane, passing through the CR (Core Router, core router), vBRAS forwarding plane Send the broadband user's access protocol messages (such as PPPoE, DHCP, etc.) and NSH information (see the Network Service Header defined by IETF) to the vBRAS control plane.
  • the broadband user's access protocol messages such as PPPoE, DHCP, etc.
  • NSH information see the Network Service Header defined by IETF
  • the vBRAS control plane After the vBRAS control plane send and receive message processing module receives the VxLAN message, After decapsulating the VxLAN and NSH information, the broadband user access protocol message is obtained, and then the broadband user access protocol message is sent to the vBRAS control plane service processing module.
  • the vBRAS control plane is the centralized control point for broadband user access. If it is attacked by a large number of VxLAN attack packets, it will directly affect the processing performance of the vBRAS control plane. A more serious consequence is that normal broadband user access packets cannot be processed in time. , Resulting in a large number of broadband users failing to go online.
  • the random keyword generator and channel keyword management in the embodiment of this application are deployed as software modules in the vBRAS control plane device, while the sending device is the vBRAS forwarding plane device, and the receiving device is the sending and receiving packet processing module in the vBRAS control plane device ,
  • the channel refers to the VxLAN tunnel between the vBRAS forwarding plane and the vBRAS control plane.
  • Each logical channel key management instance manages a key of VxLAN tunnel communication between the vBRAS forwarding plane and the vBRAS control plane.
  • the hardware module of the vBRAS control plane device can be implemented by an X86 server
  • the hardware module of the vBRAS forwarding plane device can be implemented by a BRAS device.
  • the defense methods based on the network attack defense system include:
  • the random keyword generator in the vBRAS control plane generates new keywords at regular intervals, and sends the generated keywords to each channel keyword management instance.
  • the random key generator can generate a new key every 20s, for example, the issued new key key-n.
  • the channel keyword management instance delivers the received new keyword to the sending and receiving message processing module through the interface between the internal modules.
  • the sending and receiving message processing module receives the new keyword and adds it to the channel keyword set corresponding to each VxLAN channel. After the addition is successful, it returns the addition result to the channel keyword management instance.
  • the channel key set information after adding a new keyword is as follows: the channel key set corresponding to vlan tunnel 1 is ⁇ key-n-2, key-n-1, key-n ⁇ , and the channel key corresponding to vlan tunnel 2
  • the word set is ⁇ key-m-2, key-m-1, key-n ⁇ , where key-n-1 is newer than key-n-2 in the channel key set, and key-m-2 is better than key-m- 1 new, key-n is the newly added key in the set.
  • the channel keyword management instance After receiving the successful response of the message processing module for sending and receiving, the channel keyword management instance delivers the new keyword to the vBRAS forwarding plane device.
  • the new keyword key-n is delivered to the vBRAS forwarding plane device through the OpenFlow channel connected to the corresponding vBRAS forwarding plane.
  • the vBRAS forwarding plane device receives the new keyword through the OpenFlow channel, updates and saves the keyword, and then responds to the vBRAS control plane with the result of the keyword update.
  • the channel keyword management instance in the vBRAS control plane receives the successful response to the keyword update of the vBRAS forwarding plane, it notifies the sending and receiving message processing module to delete the VxLAN channel keyword set corresponding to the vBRAS forwarding plane device through the interface between the internal modules The oldest keyword in the.
  • the vBRAS forwarding plane device sends a communication message carrying the keyword.
  • vBRAS When a broadband user goes online, it first sends a broadband access protocol message to vBRAS, transmits it through the access network, and sends it to the vBRAS forwarding plane device.
  • the vBRAS forwarding plane device then encapsulates the broadband access protocol message and NSH information into the VxLAN tunnel.
  • NSH information contains keywords.
  • the MD-type value defined in the NSH protocol is set to 0x1
  • the context data value is the keyword key-n.
  • the sending and receiving message processing module determines whether the received keyword belongs to an element in the keyword set, if yes, go to S409, if not, go to S410.
  • the receiving and sending packet processing module of the vBRAS control plane decapsulates the VxLAN packet to obtain NSH information and broadband user access protocol packets.
  • the sending and receiving message processing module first extracts the keywords in the NSH information, and judges whether the keywords carried in the received message belong to the keywords in the channel keyword set of the corresponding VxLAN tunnel. If they belong, the broadband user access protocol message Send it to the vBRAS control plane service processing module to continue processing; if it does not belong, it is judged as a network attack packet and discarded immediately.
  • the vBRAS control plane sending and receiving message processing module receives a VxLAN message from VxLAN tunnel 1, obtains the keyword key-n from the Context data of the NSH carried in the received message, and then searches for the channel key set corresponding to VxLAN tunnel 1 ⁇ key-n-1, key-n ⁇ , if it is found that key-n belongs to an element in the key set ⁇ key-n-1, key-n ⁇ , it is judged as a legal message.
  • the VxLAN message received from the attack source, and the key obtained from the Context data of NSH does not belong to the elements in the key set ⁇ key-n-1, key-n ⁇ , it is judged as an attack message and discarded immediately.
  • S609 The sending and receiving message processing module reports the communication message to the vBRAS control plane service processing module to continue processing.
  • the embodiment of this application uses a vBRAS device VxLAN access attack defense deployment scenario to illustrate the network attack defense method and system.
  • the vBRAS device centralized deployment of the vBRAS control plane and forwarding plane
  • the broadband user access protocol packet passes through the ONU (Optical Network Unit) device, passes through the access network, and is sent to the OLT device, and the OLT device sends the broadband user access protocol packet through the VxLAN tunnel.
  • the vBRAS forwarding plane After the vBRAS forwarding plane receives the VxLAN message, it determines that it is the VxLAN message on the broadband access side, and then decapsulates the VxLAN message to obtain the broadband user access protocol message, and then upload it Send to vBRAS control plane for processing. If the attack source sends a large number of VxLAN packets to attack the broadband access side interface of the vBRAS forwarding plane device at this time, the vBRAS forwarding plane will consume a lot of CPU processing resources for attack packet processing, affecting normal broadband user access, and even cause vBRAS control Face processing is abnormal.
  • the random keyword generator and channel keyword management are deployed as software modules in the SD-WAN (software-defined wide area network) controller device, while the sending device is an OLT device, and the receiving device is a vBRAS forwarding plane device.
  • the channel refers to the VxLAN tunnel between the OLT and the vBRAS forwarding plane.
  • Each logical channel key management instance manages a key of VxLAN tunnel communication between the OLT and the vBRAS forwarding plane.
  • the SD-WAN controller device can be implemented by the hardware module of the X86 server, and the sending device can be an OLT device (optical line terminal, optical line terminal).
  • the defense methods based on the network attack defense system include:
  • the random keyword generator in the SD-WAN controller randomly generates new keywords at regular intervals, and sends the generated keywords to each channel keyword management instance.
  • the channel keyword management instance delivers the received new keywords to the vBRAS forwarding plane device located in the edge data center through the OpenFlow channel.
  • the vBRAS forwarding plane device receives the new keyword and adds it to the channel keyword set corresponding to each VxLAN channel. After the addition is successful, it returns the addition result to the channel keyword management instance.
  • the channel keyword management instance After receiving the successful response from the vBRAS forwarding plane device, the channel keyword management instance delivers the new keyword to the OLT device through the NETCONF channel connected to the corresponding OLT device.
  • the OLT device receives the new keyword through the NETCONF channel, updates and saves the keyword, and responds to the SD-WAN controller with the result of the keyword update.
  • the channel keyword management instance in the SD-WAN controller receives the successful response to the keyword update of the OLT device, it informs the vBRAS forwarding plane device to delete the oldest keyword in the channel keyword set corresponding to the VxLAN channel through the OpenFlow channel.
  • the OLT encapsulates the broadband access protocol message sent by the wide user into the VxLAN tunnel, and sends the VxLAN message.
  • the broadband access protocol message is sent to the OLT device through the ONU device and the access network, and the OLT encapsulates the broadband access protocol message into the VxLAN tunnel.
  • the UDP source port number of the VxLAN tunnel is set as a new keyword.
  • the new keyword 3000 is used as the UDP source port number of the VxLAN tunnel, and the VxLAN message carries the new keyword.
  • the vBRAS forwarding plane device receives the VxLAN message sent by the OLT device from the VxLAN tunnel, obtains the keyword, and judges the keyword.
  • the vBRAS forwarding plane device After the vBRAS forwarding plane device receives the VxLAN packet sent by the OLT device from the VxLAN tunnel, it obtains the UDP source port number in the VxLAN packet and uses the UDP source port number 3000 as the received keyword to determine whether the keyword 3000 belongs to the corresponding VxLAN For elements in the keyword set of the tunnel, since the keyword set corresponding to the VxLAN tunnel includes the keyword 3000, the broadband user access protocol message is sent to the vBRAS control plane for further processing; if not included, it is judged as a network attack report Text, discard it immediately.
  • This embodiment provides a computer storage medium, which includes volatile or volatile information implemented in any method or technology for storing information (such as computer readable instructions, data structures, computer program modules, or other data).
  • Non-volatile, removable or non-removable media include but are not limited to RAM (Random Access Memory), ROM (Read-Only Memory, read-only memory), EEPROM (Electrically Erasable Programmable read only memory), Flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device, or Any other medium used to store desired information and that can be accessed by a computer.
  • the computer storage medium in this embodiment can be used to store one or more computer programs, and the stored one or more computer programs can be executed by a processor to implement at least the network attack defense methods in the first to fourth embodiments above.
  • This embodiment also provides a computer program product, including a computer readable device, and the computer readable device stores the computer program as shown above.
  • the computer-readable device may include the computer storage medium shown above.
  • communication media usually contain computer-readable instructions, data structures, computer program modules, or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium. Therefore, this application is not limited to any specific hardware and software combination.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请实施例提供一种网络攻击防御方法、系统以及计算机存储介质，网络攻击防御装置随机生成新关键字；将新关键字分别发送给发送设备和接收设备，接收设备将新关键字更新到接收设备的关键字集合，获取发送设备发送的通信报文中携带的关键字，根据携带的关键字和关键字集合确定通信报文是否为网络攻击报文；当通信报文是网络攻击报文时，丢弃通信报文。

Description

网络攻击防御方法、装置、接收设备及计算机存储介质
相关申请的交叉引用
本申请基于申请号为201910563848.8、申请日为2019年6月26日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此以引入方式并入本申请。
技术领域
本申请实施例涉及但不限于通信领域，具体而言，涉及但不限于一种网络攻击防御方法、装置、接收设备及计算机存储介质。
背景技术
随着宽带城域网和宽带IP业务的发展，宽带接入服务器(BAS)作为一种宽带接入设备，提供用户的认证、授权、计费以及多种业务的汇聚与转发，实现商业楼宇及小区住户的宽带IP上网，是宽带用户接入的核心设备。
宽带接入服务分为控制面和转发面，控制面是控制宽带用户接入的核心部分，包括宽带用户接入协议处理，对宽带用户接入进行认证、授权和计费，下发转发表到转发面，提供设备的管理和维护功能。控制面和转发面可以采用分布式部署，一个控制面可以控制和管理多个转发面，以满足更多的宽带用户接入需求。
控制面作为宽带接入服务的核心部分，对可靠性要求很高，其中包括快速防止网络攻击报文的攻击，即在承受大量网络攻击报文的攻击情形下，仍然能够满足宽带用户的接入性能要求。
传统的宽带接入服务器接收到宽带用户接入报文后，通过多次查表确认，如果是上送控制面的报文，则经过限速，然后上送控制面，达到防止攻击控制 面的效果。但是限速处理也会对部分正常用户接入报文进行了丢弃，原因是宽带接入服务器不能有效区分正常用户接入报文和网络攻击报文，例如，攻击者通过网络复制正常的用户上线报文，然后将复制到的报文作为网络攻击报文大量地发送到宽带接入服务器，导致宽带接入服务器难以区分正常用户接入报文和网络攻击报文。
另一方面，随着NFV(Network Functions Virtualization,网络功能虚拟化)技术的发展和普及，基于行业标准的X86服务器、存储和交换设备，逐渐取代通信网中专用的网络设备，为运营商节省了巨大的投资成本和获得更灵活的网络能力，宽带接入设备也不例外，因此对于防止控制面攻击方面，采用传统宽带接入设备的多次查表和限速的方法，在虚拟化环境下，需要消耗大量的CPU(Central Processing Unit，中央处理器)处理能力，因此大量网络攻击报文存在的情况下，直接影响到正常用户接入处理。
发明内容
本申请实施例提供的一种网络攻击防御方法、装置、接收设备及计算机存储介质。
本申请实施例提供一种网络攻击防御方法，包括：网络攻击防御装置随机生成新关键字；所述网络攻击防御装置将所述新关键字分别发送给发送设备和接收设备；接收设备将所述新关键字更新到所述接收设备的关键字集合；获取所述发送设备发送的通信报文中携带的关键字，根据所述携带的关键字和关键字集合确定所述通信报文是否为网络攻击报文；当所述通信报文是网络攻击报文时，所述接收设备丢弃所述通信报文。
本申请实施例还提供一种网络攻击防御装置，包括第一处理器、第一存储器及第一通信总线；所述第一通信总线用于实现第一处理器和第一存储器之间的连接通信；所述第一处理器用于执行存储器中存储的一个或者多个计算机程序，以实现上所述的网络攻击防御装置实现的网络攻击防御方法的步骤。
本申请实施例还提供一种接收设备，包括第二处理器、第二存储器及第二 通信总线；所述第二通信总线用于实现第二处理器和第二存储器之间的连接通信；所述第二处理器用于执行存储器中存储的一个或者多个计算机程序，以实现上所述的网络攻击防御装置实现的网络攻击防御方法的步骤。
本申请实施例还提供一种计算机存储介质，所述计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现如上所述的网络攻击防御方法的至少一个步骤。
其他特征和相应的有益效果在说明书的后面部分进行阐述说明，且应当理解，至少部分有益效果从本申请说明书中的记载变的显而易见。
附图说明
图1为本申请实施例一的网络攻击防御方法的流程图；
图2为本申请实施例二的网络攻击防御装置的结构示意图；
图3为本申请实施例二的接收设备的结构示意图；
图4为本申请实施例二的网络攻击防御装置、接收设备、发送设备的连接示意图；
图5为本申请实施例三的vBRAS控制面防攻击部署的组网示意图；
图6为本申请实施例三的网络攻击防御方法的流程图；
图7为本申请实施例四的vBRAS设备VxLAN接入防攻击部署的组网示意图；
图8为本申请实施例四的网络攻击防御方法的流程图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，下面通过具体实施方式结合附图对本申请实施例作进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
实施例一：
传统的宽带接入服务器接收到宽带用户接入报文后，通过多次查表确认，如果是上送控制面的报文，则经过限速，然后上送控制面，达到防止攻击控制面的效果。但是宽带接入服务器不能有效区分正常用户接入报文和网络攻击报文，也会对部分正常用户接入报文进行了丢弃。另一方面，对于防止控制面攻击方面，采用传统宽带接入设备的多次查表和限速的方法，在虚拟化环境下，需要消耗大量的CPU处理能力，因此大量网络攻击报文存在的情况下，直接影响到正常用户接入处理。为了解决上述问题，本申请实施例提供一种网络攻击防御方法，通过定时随机产生新关键字，并将不断变化的新关键字下发到发端和收端通信设备中，当发端通信设备发送报文时，报文中携带关键字，收端通信设备接收到携带关键字报文后，首先比较报文中的关键字是否和本地保存的关键字一致，如果一致，报文正常处理，如果不一致，则判断为攻击报文，并立即丢弃攻击报文，达到防攻击的目的。如图1所示，图1为网络攻击防御方法的流程图，该网络攻击防御方法包括：
S101、网络攻击防御装置随机生成新关键字。
在本申请实施例中，生成的新关键字具有随机性，关键字用于标识一段信息，其可以是可携带在通信报文的数字或字符串，使得攻击者无法预测到下一个关键字，例如在t1时刻生成新关键字1(如数字“30)”，在t2时刻生成新关键字2(如字符串“abcd123”)，新关键字1和新关键字2不同，且不存在任何规律，可以理解的是，该新关键字可以是定时生成的，两个相邻时间点生成的新关键字之前的时间间隔是固定的，例如时间间隔为20s，60s、90s、150s等；当然t1时刻与t2时刻之间的时间间隔，与t2时刻与后续t3时刻之间的时间间隔可以不同，具体可根据实际需求进行灵活调整。
S102、网络攻击防御装置将新关键字分别发送给发送设备和接收设备。
值得注意的是，网络攻击防御装置先将新关键字发送给接收设备，网络攻击防御装置再将新关键字发送给发送设备。具体的，网络攻击防御装置将新关键字发给接收设备；在接收设备将新关键字添加到接收设备的关键字集合后， 接收设备向上报确认信息，网络攻击防御装置接收到确认信息后，网络攻击防御装置将新关键字发送给发送设备，此时若发送设备发送的通信报文携带有该最新的新关键字，则接收设备的关键字集合中一定包括最新的新关键字，避免了接收设备对正常的通信报文进行丢弃，因此本申请实施例中的关键字集合包括至少一个最新生成的关键字。
网络攻击防御装置将新关键字发送给发送设备之后，发送设备将本地保存的一个旧关键字更新为新关键字，由于攻击者可以通过网络复制正常的包括旧关键字用户通信报文，为了便于接收设备更好的区分正常通信报文和网络攻击报文，在发送设备的关键字更新为新关键字后，发送设备返回应答信息，网络攻击防御装置接收到发送设备对新关键字更新保存的应答信息后，通知接收设备删除关键字集合中最旧的关键字，关键字的新旧是根据关键字添加的时间进行确定，最近添加的关键字最新，例如接收设备当前包括关键字集合{key-n-2，key-n-1，key-n}，关键字集合中key-n-1比key-n-2新，key-n是集合中最新添加的新关键字，则将关键字key-n-2删除。
在本申请实施例中，一个发送设备可以是对应一个接收设备，也可以是多个发送设备对应一个接收设备，则接收设备包括与多个发送设备对应的多个通信通道，每个通信通道对应接收设备的每个关键字集合，因此接收设备接收到新关键字后，将新关键字添加到每个关键字集合中。可以理解的是，接收设备的各个关键字集合可以完全相同，也可以部分相同。例如对应通信通道1的关键字集合为{key-n-2，key-n-1，key-n}，对应通信通道2的关键字集合为{m-2，m-1，key-n}。
在一些实施例中，新关键字也可以是网络攻击防御装置同时下发给发送设备和接收设备，之后发送设备更新保存新关键字，同时接收设备将关键字集合中的最旧的关键字替换为新关键字，若发送设备发送的通信报文携带有新关键字，接收设备的关键字集合中也有该新关键字，则此时该关键字集合至少包括一个最新生成的关键字。
S103、接收设备将新关键字更新到接收设备的关键字集合，获取发送设备 发送的通信报文中携带的关键字，根据携带的关键字和关键字集合确定通信报文是否为网络攻击报文。
在本申请实施例中，发送设备会通过发送设备与接收设备之间的数据传输通路将通信报文发送给接收设备，接收设备获取发送设备发送的通信报文，从通信报文中提取出携带的关键字，判断与数据传输通路对应的关键字集合是否包括携带的关键字，进而确定该通信报文是否为网络攻击报文。可以理解的是，发送设备与接收设备之间的数据传输通路不同，接收设备中与该数据接收传输通路的关键字集合可能不同，因此通过与数据传输通路对应的关键字集合对通信报文进行判断，若发送设备发送的用户正常的通信报文，则携带的关键字为接收的新关键字，此时当接收设备中的对应的关键字集合中也包括新关键字时，接收设备可以确定该通信报文为正常的通信报文；若发送设备发送的通信报文是通过网络复制的网络攻击报文时，该关键字为旧关键字，而接收设备中的关键字集合中不包括该旧关键字时，则表示该通信报文为网络攻击报文。
在本申请实施例中，为了防止发送设备和接收设备更新关键字时间不一致而导致正常通信报文丢弃，需要在接收设备保留一个关键字集合，可设置关键字集合中最大保留2个或2个以上最新的关键字。例如接收设备在ta时刻接收到第一新关键字，发送设备在tb时刻接收第一新关键字，而接收设备在tc时刻接收到第二新关键字，发送设备td时刻之前还未接收到第二新关键字，当发送设备在td时刻发送携带第一新关键字的正常的通信报文，其中ta时刻先于tb时刻先于tc时刻先于td时刻，则接收设备接收到通信报文时，接收设备的关键字集合中至少包括{第一新关键字、第二新关键字}，接收设备与发送设备的关键字更新存在时间差，此时根据该关键字集合中的第一新关键字可以区分出该通信报文为非网络攻击，避免了正常通信报文的丢弃。
在一些实施例中，当接收设备和发送设备同时接收到新关键字，并进行更新保存时，发送设备与接收设备的关键字更新不存在时间差异，此时，接收设备的关键字集合可以只包括新关键字，进而判断发送设备的通信报文携带的关键字与接收设备的关键字是否相同，对该通信报文进行区分，若发送设备发送的通信报文为正常的通信报文时，则一定会携带新关键字。
在本实施例中，发送设备包括但不限于用户侧设备(Customer Premise Equipment，简称为CPE)、宽带远程接入服务器(Broadband Remote Access Server，简称为BRAS)，宽带网络网关(Broadband Network Gateway，简称为BNG)，宽带业务网关(Broadband Service Gateway，简称为BSG)，业务路由器(Service Router，简称为SR)，宽带接入服务器(Broadband Access Server，简称为BAS)，开放流逻辑交换机(Openflow Logical Switch，简称为OFLS)、开放流交换机(Openflow Switch，简称为OFS)，无线接入控制器(Access Controller，简称为AC)，光线路终端设备(optical line terminal,简称为OLT),汇聚交换机，虚拟BRAS(virtual Broadband Remote Access Server，简称为vBRAS)转发面设备，虚拟BAS(virtual Broadband Access Server，简称为vBAS)转发面设备，虚拟BNG(virtual Broadband Network Gateway，简称为vBNG)转发面设备。接收设备包括但不限于宽带远程接入服务器(Broadband Remote Access Server，简称为BRAS)，宽带网络网关(Broadband Network Gateway，简称为BNG)，宽带业务网关(Broadband Service Gateway，简称为BSG)，业务路由器(Service Router，简称为SR)，宽带接入服务器(Broadband Access Server，简称为BAS)，开放流逻辑交换机(Openflow Logical Switch，简称为OFLS)、开放流交换机(Openflow Switch，简称为OFS)，无线接入控制器(Access Controller，简称为AC)，虚拟BRAS(virtual Broadband Remote Access Server，简称为vBRAS)控制面设备，虚拟BAS(virtual Broadband Access Server，简称为vBAS)控制面设备，虚拟BNG(virtual Broadband Network Gateway，简称为vBNG)控制面设备。
值得注意的是，获取所述发送设备发送的通信报文，提取所述通信报文中携带的关键字，包括：所述接收设备从标准通信协议定义的已知字段，或扩展字段，或在通信报文中添加的厂商私有定义字段中提取所述关键字。例如当发送设备包括vBRAS转发面设备时，所述接收设备从所述通信报文中获取NSH信息和宽带用户接入协议报文，从所述NSH信息中提取所述关键字。例如宽带用户上线时，先向vBRAS发送宽带接入协议报文，经过接入网传输，发送到vBRAS转发面设备，vBRAS转发面设备再将宽带接入协议报文(例如PPPoE， DHCP等)和NSH信息(见IETF定义的Network Service Header)一起封装，其中NSH信息中包括发送设备的关键字，进而接收设备接收到通信报文，并解析得到宽带接入协议报文和NSH信息，从NSH信息中提取关键字。
当发送设备包括OLT设备时，所述接收设备从所述通信报文中的UDP源端口号获取所述关键字。例如宽带用户上线时，先通过ONU设备，经过接入网，将宽带接入协议报文发送到OLT设备，OLT再将宽带接入协议报文封装到OLT和vBRAS转发面之间的VxLAN隧道，其中VxLAN隧道的UDP源端口号设置为关键字，进而接收设备vBRAS转发面从报文中的UDP源端口号，该UDP源端口号为关键字。
S104、当通信报文是网络攻击报文时，接收设备丢弃通信报文。
当区分出该通信报文包括网络攻击报文时，丢弃该通信报文，当通信报文为正常的通信报文时，则将该通信报文上报到控制面进行后续处理。
本申请实施例提供的网络攻击防御方法，将具有随机性的关键字发送给接收设备和发送设备，发送设备和接收设备分别根据新关键字进行更新保存，将发送设备发送的通信报文中携带有该新关键字，使得攻击者发送的网络攻击报文和正常的通信报文很容易被识别出来，并且关键字具有随机性，也使得攻击者无法预测到下一个正常通信报文所携带的关键字，解决了不能有效区分正常用户接入报文和网络攻击报文问题，避免了用户正常的通信报文被丢弃。
实施例二：
本实施例提供一种网络攻击防御装置，如图2所示，该网络攻击防御装置包括第一处理器201、第一存储器202及第一通信总线203；
所述第一通信总线203用于实现第一处理器201和第一存储器202之间的连接通信；
所述第一处理器201用于执行存储器中存储的一个或者多个计算机程序，以实现如下步骤：
随机生成新关键字；
将所述新关键字分别发送给发送设备和接收设备。
在本实施例中，将所述新关键字发给所述接收设备；在所述新关键字添加到所述接收设备的关键字集合后，将所述新关键字发送给发送设备。在所述发送设备的关键字更新为所述新关键字后，通知所述接收设备删除所述关键字集合中最旧的关键字。在一些实施例中，也可以同时将所述关键字发给所述发送设备和接收设备。
本实施例提供一种接收设备，如图3所示，该接收设备包括第二处理器301、第二存储器302及第二通信总线303；
所述第二通信总线303用于实现第二处理器301和第二存储器302之间的连接通信；
所述第二处理器301用于执行存储器中存储的一个或者多个计算机程序，以实现如下步骤：
将所述新关键字更新到关键字集合，获取所述发送设备发送的通信报文中携带的关键字，根据携带的所述关键字和关键字集合确定所述通信报文是否为网络攻击报文；
当所述通信报文是网络攻击报文时，所述丢弃所述通信报文。
需要说明的是，在本实施例中第二处理器302获取所述发送设备发送的通信报文中携带的关键字，判断所述关键字集合是否包括所述关键字，包括：获取所述发送设备发送的通信报文，所述通信报文通过所述发送设备与所述接收设备之间的数据传输通路发送；提取所述通信报文中携带的关键字；判断与所述数据传输通路对应的关键字集合是否包括所述携带的关键字；当不包括时，所述通信报文是网络攻击报文。其中当发送设备包括vBRAS转发面设备时，所述接收设备从所述通信报文中获取NSH信息和宽带用户接入协议报文，从所述NSH信息中提取所述关键字；当发送设备包括OLT设备时，所述接收设备从所述通信报文中的UDP源端口号获取所述关键字。
如图4所示，图4为本申请实施例提供的网络攻击防御装置、发送设备、接收设备的关系示意图。网络攻击防御装置包括随机关键字发送器和通道关键字管理实例；随机关键字发生器定时产生随机关键字，并将产生的关键字下发 到每个通道关键字管理实例中，通道关键字管理实例接收到关键字后，先下发新关键字到接收设备，接收设备接收到新关键字后，将新关键字添加到关键字集合中，并返回确认应答，通道关键字管理实例接收到接收设备的确认应答后，再下发新关键字到发送设备，发送设备接收到新关键字后，用新关键字替换到旧关键字，并返回确认应答。通道关键字管理实例接收到发送设备的确认应答后，再通知接收设备删除关键字集合中最旧的关键字。当发送设备发送通信报文时，通信报文中携带关键字，接收设备接收到通信报文后，首先判断通信报文携带的关键字是否属于关键字集合中的一个元素，如果属于，则判为正常通信报文，后续继续处理；如果不属于，则判为网络攻击报文，立即丢弃。
本申请实施例提供了一种网络攻击防御装置、接收设备，网络攻击防御装置产生新关键字，并将不断变化的新关键字下发到发送和接收通信设备中，接收设备将本地保存的关键字集合中的旧关键字替换为新的新关键字，当发送通信设备发送报文时，报文中携带最新关键字，接收通信设备接收到携带关键字报文后，首先比较报文中的关键字是否和本地保存的关键字集合中的关键字一致，如果一致，报文正常处理，如果不一致，则判断为攻击报文，并立即丢弃攻击报文，达到防攻击的目的；在虚拟化环境下，能够明显减少识别网络攻击报文所需消耗的CPU处理资源，提升了大量网络攻击报文存在的情况下正常用户的接入性能。
实施例三：
本申请实施例以一个具体的实现场景对网络攻击防御方法和系统进行说明，如图5所示，本申请实施例描述了一种vBRAS控制面防攻击部署场景，vBRAS控制面设备部署在数据中心，通过城域网集中控制vBRAS转发面设备，vBRAS转发面设备部署在城域网边缘，通过vBRAS控制面和vBRAS转发面之间的VxLAN隧道，经过CR(Core Router，核心路由器)，vBRAS转发面将宽带用户的接入协议报文(例如PPPoE，DHCP等)和NSH信息(见IETF定义的Network Service Header)上送到vBRAS控制面，vBRAS控制面收发报文处理模块接收到VxLAN报文后，解封装VxLAN和NSH信息后，获取宽带用户 接入协议报文，然后将宽带用户接入协议报文上送到vBRAS控制面业务处理模块。而vBRAS控制面是宽带用户接入的集中控制点，如果受到大量VxLAN攻击报文的攻击，将直接影响vBRAS控制面的处理性能，更严重的后果是导致正常宽带用户接入报文无法及时处理，导致大量宽带用户上线失败。
本申请实施例中的随机关键字发生器和通道关键字管理作为软件模块部署在vBRAS控制面设备中，而发送设备是vBRAS转发面设备，接收设备是vBRAS控制面设备中的收发报文处理模块，通道是指vBRAS转发面和vBRAS控制面之间的VxLAN隧道。每个逻辑上的通道关键字管理实例管理着一个vBRAS转发面和vBRAS控制面之间的VxLAN隧道通信的关键字。在本申请实施例中，vBRAS控制面设备的硬件模块可以通过X86服务器实现，vBRAS转发面设备的硬件模块可以通过BRAS设备实现。
如图6所示，基于网络攻击防御系统的防御方法包括：
S601、vBRAS控制面中随机关键字发生器定时产生新关键字，并将产生的关键字下发到每个通道关键字管理实例中。
在本申请实施例中，随机关键字发生器可以每隔20s产生新关键字，例如下发的新关键字key-n。
S602、通道关键字管理实例将接收到的新关键字通过内部模块之间的接口下发到收发报文处理模块。
S603、收发报文处理模块接收新关键字并添加到对应每个VxLAN通道的通道关键字集合中，添加成功后，返回添加结果给通道关键字管理实例。
例如，添加新关键字后的通道关键字集合信息如下：vlan隧道1对应的通道关键字集合为{key-n-2，key-n-1,key-n}，vlan隧道2对应的通道关键字集合为{key-m-2，key-m-1，key-n}，其中通道关键字集合中key-n-1比key-n-2新，key-m-2比key-m-1新，key-n是集合中最新添加的关键字。
S604、通道关键字管理实例接收到收发报文处理模块的成功应答后，将新关键字下发到vBRAS转发面设备。
通过连接到对应vBRAS转发面的OpenFlow通道将新关键字key-n下发到vBRAS转发面设备。
S605、vBRAS转发面设备通过OpenFlow通道接收到新关键字，对关键字进行更新保存后，向vBRAS控制面应答关键字更新结果。
S606、vBRAS控制面中通道关键字管理实例接收到vBRAS转发面的关键字更新成功应答后，通过内部模块之间的接口，通知收发报文处理模块删除对应vBRAS转发面设备的VxLAN通道关键字集合中最老的关键字。
当接收到连接VxLAN隧道1的vBRAS转发面设备应答的关键字更新结果后，通过内部模块之间的接口，通知收发报文处理模块删除对应VxLAN隧道1的通道关键字集合中的关键字key-n-2。
S607、vBRAS转发面设备发送携带关键字的通信报文。
宽带用户上线时，先向vBRAS发送宽带接入协议报文，经过接入网传输，发送到vBRAS转发面设备，vBRAS转发面设备再将宽带接入协议报文和NSH信息一起封装到VxLAN隧道中，其中NSH信息中包含关键字，例如，设置NSH协议中定义的MD-type值为0x1，Context data值为关键字key-n。
S608、收发报文处理模块接收到携带关键字的通信报文后，判断接收关键字是否属于关键字集合中的一个元素，如是，转S409，如否，转S410。
vBRAS控制面的收发报文处理模块从VxLAN隧道接收到vBRAS转发面设备发送的VxLAN报文后，对VxLAN报文进行解封装处理，获取NSH信息和宽带用户接入协议报文。收发报文处理模块首先提取NSH信息中的关键字，判断接收报文中携带的关键字是否属于对应VxLAN隧道的通道关键字集合中的关键字，如果属于，则将宽带用户接入协议报文上送到vBRAS控制面业务处理模块继续处理；如果不属于，则判为网络攻击报文，立即丢弃。例如，vBRAS控制面收发报文处理模块从VxLAN隧道1接收到VxLAN报文，从接收报文携带的NSH的Context data中获取关键字key-n，然后查找VxLAN隧道1对应的通道关键字集合{key-n-1，key-n}，发现key-n属于关键字集合{key-n-1，key-n}中的元素，则判断为合法报文。而从攻击源接收到的VxLAN报文，NSH的 Context data中获取的关键字不属于关键字集合{key-n-1，key-n}中的元素，则判断为攻击报文，立即丢弃。
S609、收发报文处理模块将通信报文上报到vBRAS控制面业务处理模块继续处理。
S610、丢弃该通信报文。
实施例四：
本申请实施例以一种vBRAS设备VxLAN接入防攻击部署场景对网络攻击防御方法和系统进行说明，如图7所示，vBRAS设备(vBRAS控制面和转发面集中部署)部署在边缘数据中心，当宽带用户上线，宽带用户接入协议报文通过ONU(Optical Network Unit，光网络单元)设备，经过接入网，送到OLT设备，OLT设备再通过VxLAN隧道将宽带用户接入协议报文上送到部署在边缘数据中心的vBRAS转发面，vBRAS转发面接收到VxLAN报文后，判断是宽带接入侧VxLAN报文，则解封装VxLAN报文，获取宽带用户接入协议报文，然后上送到vBRAS控制面处理。如果此时攻击源通过发送大量VxLAN报文攻击vBRAS转发面设备的宽带接入侧接口，将导致vBRAS转发面消耗大量CPU处理资源进行攻击报文处理，影响正常宽带用户接入，甚至造成vBRAS控制面处理异常。
在本申请实施例中随机关键字发生器和通道关键字管理作为软件模块部署在SD-WAN(软件定义的广域网)控制器设备中，而发送设备是OLT设备，接收设备是vBRAS转发面设备，通道是指OLT和vBRAS转发面之间的VxLAN隧道。每个逻辑上的通道关键字管理实例管理着一个OLT和vBRAS转发面之间的VxLAN隧道通信的关键字。SD-WAN控制器设备可以通过X86服务器的硬件模块进行实现，发送设备可以为OLT设备(optical line terminal,光线路终端)。
如图8所示，基于网络攻击防御系统的防御方法包括：
S801、SD-WAN控制器中随机关键字发生器定时随机产生新关键字，并将产生的关键字下发到每个通道关键字管理实例中。
S802、通道关键字管理实例将接收到的新关键字通过OpenFlow通道下发到位于边缘数据中心的vBRAS转发面设备。
S803、vBRAS转发面设备接收新关键字并添加到对应每个VxLAN通道的通道关键字集合中，添加成功后，返回添加结果给通道关键字管理实例。
S804、通道关键字管理实例接收到vBRAS转发面设备的成功应答后，将新关键字通过连接到对应OLT设备的NETCONF通道下发到OLT设备。
S805、OLT设备通过NETCONF通道接收到新关键字，对关键字进行更新保存后，向SD-WAN控制器应答关键字更新结果。
S806、SD-WAN控制器中通道关键字管理实例接收到OLT设备的关键字更新成功应答后，通过OpenFlow通道，通知vBRAS转发面设备删除对应VxLAN通道的通道关键字集合中最老的关键字。
S807、OLT将宽度用户发送的宽带接入协议报文封装到VxLAN隧道，发送VxLAN报文。
在本申请实施例中，宽带用户上线时，先通过ONU设备，经过接入网，将宽带接入协议报文发送到OLT设备，OLT再将宽带接入协议报文封装到VxLAN隧道中，其中VxLAN隧道的UDP源端口号设置为新关键字，例如将通过将新关键字3000作为VxLAN隧道的UDP源端口号，进而该VxLAN报文中携带有新关键字。
S808、vBRAS转发面设备从VxLAN隧道接收到OLT设备发送的VxLAN报文，获取关键字，并对关键字进行判断。
vBRAS转发面设备从VxLAN隧道接收到OLT设备发送的VxLAN报文后，获取VxLAN报文中的UDP源端口号，并将UDP源端口号3000作为接收的关键字，判断关键字3000是否属于对应VxLAN隧道的关键字集合中的元素，由于对应VxLAN隧道的关键字集合包括关键字3000，则将宽带用户接入协议报 文上送到vBRAS控制面继续处理；如果不包括，则判为网络攻击报文，立即丢弃。
实施例五：
本实施例提供了一种计算机存储介质，该计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、计算机程序模块或其他数据)的任何方法或技术中实施的易失性或非易失性、可移除或不可移除的介质。计算机存储介质包括但不限于RAM(Random Access Memory，随机存取存储器),ROM(Read-Only Memory，只读存储器),EEPROM(Electrically Erasable Programmable read only memory，带电可擦可编程只读存储器)、闪存或其他存储器技术、CD-ROM(Compact Disc Read-Only Memory，光盘只读存储器)，数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。
本实施例中的计算机存储介质可用于存储一个或者多个计算机程序，其存储的一个或者多个计算机程序可被处理器执行，以实现上述实施例一至实施例四中的网络攻击防御方法的至少一个步骤。
本实施例还提供了一种计算机程序产品，包括计算机可读装置，该计算机可读装置上存储有如上所示的计算机程序。本实施例中该计算机可读装置可包括如上所示的计算机存储介质。
可见，本领域的技术人员应该明白，上文中所公开方法中的全部或某些步骤、系统、装置中的功能模块/单元可以被实施为软件(可以用计算装置可执行的计算机程序代码来实现)、固件、硬件及其适当的组合。在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被 实施为集成电路，如专用集成电路。
此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、计算机程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。所以，本申请不限制于任何特定的硬件和软件结合。
以上内容是结合具体的实施方式对本申请实施例所作的进一步详细说明，不能认定本申请的具体实施只局限于这些说明。对于本申请所属技术领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干简单推演或替换，都应当视为属于本申请的保护范围。

Claims (10)

  1. 一种网络攻击防御方法，包括：
    网络攻击防御装置随机生成新关键字；
    所述网络攻击防御装置将所述新关键字分别发送给发送设备和接收设备；
    接收设备将所述新关键字更新到所述接收设备的关键字集合，获取所述发送设备发送的通信报文中携带的关键字，根据携带的所述关键字和关键字集合确定所述通信报文是否为网络攻击报文；
    当所述通信报文是网络攻击报文时，所述接收设备丢弃所述通信报文。
  2. 如权利要求1所述的网络攻击防御方法，其中，所述将所述新关键字分别发送给发送设备和接收设备，包括：
    所述网络攻击防御装置将所述新关键字发给所述接收设备；
    在所述新关键字添加到所述接收设备的关键字集合后，所述网络攻击防御装置将所述新关键字发送给发送设备。
  3. 如权利要求2所述的网络攻击防御方法，其中，所述网络攻击防御装置将所述新关键字发送给发送设备之后，所述接收设备获取所述发送设备发送的通信报文中的携带关键字之前，包括：
    在所述发送设备的关键字更新为所述新关键字后，所述网络攻击防御装置通知所述接收设备删除所述关键字集合中最旧的关键字。
  4. 如权利要求1所述的网络攻击防御方法，其中，所述将所述新关键字分别发送给发送设备和接收设备，包括：
    所述网络攻击防御装置同时将所述关键字发给所述发送设备和接收设备；
    所述接收设备将所述新关键字更新到所述接收设备的关键字集合，包括：
    所述接收设备将所述关键字集合中最旧的关键字替换为所述新关键字，同时所述发送设备更新保存所述新关键字。
  5. 如权利要求1-4任一项所述的网络攻击防御方法，其中，所述获取所述发送设备发送的通信报文中携带的关键字，判断所述关键字集合是否包括所述 关键字，包括：
    获取所述发送设备发送的通信报文，所述通信报文通过所述发送设备与所述接收设备之间的数据传输通路发送；
    提取所述通信报文中携带的关键字；
    判断与所述数据传输通路对应的关键字集合是否包括所述携带的关键字；
    当不包括时，所述通信报文是网络攻击报文。
  6. 如权利要求5所述的网络攻击防御方法，其中，获取所述发送设备发送的通信报文，提取所述通信报文中携带的关键字，包括：
    所述接收设备从标准通信协议定义的已知字段，或扩展字段，或在通信报文中添加的厂商私有定义字段中提取所述关键字。
  7. 如权利要求1-4任一项所述的网络攻击防御方法，其中，所述，所述关键字集合包括至少一个最新生成的关键字，所述关键字包括数字或字符串。
  8. 一种网络攻击防御装置，包括第一处理器、第一存储器及第一通信总线；
    所述第一通信总线用于实现第一处理器和第一存储器之间的连接通信；
    所述第一处理器用于执行存储器中存储的一个或者多个计算机程序，以实现如权利要求1-7任一项网络攻击防御装置实现的网络攻击防御方法的步骤。
  9. 一种接收设备，包括第二处理器、第二存储器及第二通信总线；
    所述第二通信总线用于实现第二处理器和第二存储器之间的连接通信；
    所述第二处理器用于执行存储器中存储的一个或者多个计算机程序，以实现如权利要求1-7任一项接收设备实现的网络攻击防御方法的步骤。
  10. 一种计算机存储介质，其中，所述计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现如权利要求1至7中任一项所述的网络攻击防御方法的至少一个步骤。
PCT/CN2020/083583 2019-06-26 2020-04-07 网络攻击防御方法、装置、接收设备及计算机存储介质 WO2020258980A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US17/622,860 US12088622B2 (en) 2019-06-26 2020-04-07 Method and apparatus for defending against cyber attacks, receiving device and computer storage medium
EP20832962.3A EP3968595A4 (en) 2019-06-26 2020-04-07 METHOD AND DEVICE FOR DEFENDING NETWORK TERMS, RECEIVER DEVICE AND COMPUTER STORAGE MEDIUM

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910563848.8 2019-06-26
CN201910563848.8A CN112152964A (zh) 2019-06-26 2019-06-26 网络攻击防御方法、装置、接收设备及计算机存储介质

Publications (1)

Publication Number Publication Date
WO2020258980A1 true WO2020258980A1 (zh) 2020-12-30

Family

ID=73868366

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/083583 WO2020258980A1 (zh) 2019-06-26 2020-04-07 网络攻击防御方法、装置、接收设备及计算机存储介质

Country Status (4)

Country Link
US (1) US12088622B2 (zh)
EP (1) EP3968595A4 (zh)
CN (1) CN112152964A (zh)
WO (1) WO2020258980A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113055296A (zh) * 2021-03-16 2021-06-29 烽火通信科技股份有限公司 一种数据处理方法、装置、系统以及终端设备
WO2023273843A1 (zh) * 2021-06-28 2023-01-05 中兴通讯股份有限公司 安全防御方法、装置、设备及存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116055217A (zh) * 2023-03-06 2023-05-02 广州启宁信息科技有限公司 基于sd-wan组网安全管理方法、系统、设备及介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101136747A (zh) * 2006-08-30 2008-03-05 中兴通讯股份有限公司 一种信息验证的系统及方法
US20100122330A1 (en) * 2008-11-13 2010-05-13 Mcmillan Owen Automatic local listing owner authentication system
CN103684792A (zh) * 2013-12-23 2014-03-26 加弘科技咨询(上海)有限公司 一种oam的安全认证方法以及oam报文发送/接收装置
CN104333562A (zh) * 2014-11-27 2015-02-04 沈文策 数据包传输方法及装置
CN106713061A (zh) * 2015-11-17 2017-05-24 阿里巴巴集团控股有限公司 监测攻击报文的方法、系统及装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP6042541B2 (ja) * 2013-06-24 2016-12-14 日本電信電話株式会社 セキュリティ情報管理システム、セキュリティ情報管理方法及びセキュリティ情報管理プログラム
US20160226893A1 (en) * 2015-01-30 2016-08-04 Wipro Limited Methods for optimizing an automated determination in real-time of a risk rating of cyber-attack and devices thereof
CN107800668B (zh) 2016-09-05 2020-09-08 华为技术有限公司 一种分布式拒绝服务攻击防御方法、装置及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101136747A (zh) * 2006-08-30 2008-03-05 中兴通讯股份有限公司 一种信息验证的系统及方法
US20100122330A1 (en) * 2008-11-13 2010-05-13 Mcmillan Owen Automatic local listing owner authentication system
CN103684792A (zh) * 2013-12-23 2014-03-26 加弘科技咨询(上海)有限公司 一种oam的安全认证方法以及oam报文发送/接收装置
CN104333562A (zh) * 2014-11-27 2015-02-04 沈文策 数据包传输方法及装置
CN106713061A (zh) * 2015-11-17 2017-05-24 阿里巴巴集团控股有限公司 监测攻击报文的方法、系统及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3968595A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113055296A (zh) * 2021-03-16 2021-06-29 烽火通信科技股份有限公司 一种数据处理方法、装置、系统以及终端设备
WO2023273843A1 (zh) * 2021-06-28 2023-01-05 中兴通讯股份有限公司 安全防御方法、装置、设备及存储介质

Also Published As

Publication number Publication date
EP3968595A4 (en) 2022-06-15
US20220263859A1 (en) 2022-08-18
US12088622B2 (en) 2024-09-10
CN112152964A (zh) 2020-12-29
EP3968595A1 (en) 2022-03-16

Similar Documents

Publication Publication Date Title
WO2020258980A1 (zh) 网络攻击防御方法、装置、接收设备及计算机存储介质
CN106464534B (zh) 配设和管理用户驻地设备装置的片
CN112703717B (zh) 跨层3网络的端点的唯一身份
CN110266550B (zh) 故障影响预测的方法及装置
TWI495301B (zh) 控制封包的階層式速率限制
EP2947820A1 (en) Method for generating configuration information and network control unit
EP3420687B1 (en) Addressing for customer premises lan expansion
JP7216120B2 (ja) Ｂｇｐメッセージ送信方法、ｂｇｐメッセージ受信方法、及びデバイス
JP2011509619A (ja) Ｍａｃテーブルのオーバーフロー攻撃に対する防御を容易にすること
US20230044321A1 (en) Srv6 trusted domain border filtering method and apparatus
KR102621953B1 (ko) 패킷 검출 방법 및 제1 네트워크 장치
US12074845B2 (en) System and method for remotely filtering network traffic of a customer premise device
US11855888B2 (en) Packet verification method, device, and system
CN107509128B (zh) 一种接入核心网的方法及系统
US20240267326A1 (en) Exit interface selection based on intermediate paths
CN115380516A (zh) 基于lisp的软件定义网络中策略更改的通信
US20220210036A1 (en) Network Measurement System And Method, Device, And Storage Medium
Amamou et al. A trill-based multi-tenant data center network
US8873549B2 (en) Managing L2VPN connectivity after a fiber node split
WO2024055782A1 (zh) 光网络单元的注册方法、光线路终端、光网络单元、介质
US10050937B1 (en) Reducing impact of network attacks in access networks
WO2023187922A1 (ja) 通信制御装置、通信制御方法及び通信制御プログラム
US20220070078A1 (en) Wired/wireless integrated open fronthaul device
Rajamani et al. IN-BAND REMOTE FAILURE DETECTION
CN118555235A (zh) 一种跨网桥环路规避的报文传输方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20832962

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020832962

Country of ref document: EP

Effective date: 20211209

NENP Non-entry into the national phase

Ref country code: DE