WO2023060881A1 - 报文源地址识别方法及装置 - Google Patents

报文源地址识别方法及装置 Download PDF

Info

Publication number
WO2023060881A1
WO2023060881A1 PCT/CN2022/091003 CN2022091003W WO2023060881A1 WO 2023060881 A1 WO2023060881 A1 WO 2023060881A1 CN 2022091003 W CN2022091003 W CN 2022091003W WO 2023060881 A1 WO2023060881 A1 WO 2023060881A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
packet
protection device
source address
address
Prior art date
Application number
PCT/CN2022/091003
Other languages
English (en)
French (fr)
Inventor
吴波
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP22879831.0A priority Critical patent/EP4366236A1/en
Publication of WO2023060881A1 publication Critical patent/WO2023060881A1/zh
Priority to US18/609,958 priority patent/US20240223584A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L1/00—Arrangements for detecting or preventing errors in the information received
    • H04L1/12—Arrangements for detecting or preventing errors in the information received by using return channel
    • H04L1/16—Arrangements for detecting or preventing errors in the information received by using return channel in which the return channel carries supervisory signals, e.g. repetition request signals
    • H04L1/18—Automatic repetition systems, e.g. Van Duuren systems
    • H04L1/1829—Arrangements specially adapted for the receiver end
    • H04L1/1858—Transmission or retransmission of more than one copy of acknowledgement message
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/164—Adaptation or special uses of UDP protocol
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the field of network security, in particular to a method and device for identifying message source addresses.
  • DoS attack is a means of network attack.
  • the principle of a DoS attack is that the attacker (also known as a hacker) controls the controlled computer to send a large number of packets to the attack target, making the attack target busy processing the packets from the attacker, thereby exhausting the computing resources and network resources of the attack target. system resources, causing the attack target to be unable to respond to service requests from normal users.
  • this attack method is called a distributed denial of service (DDoS) attack.
  • DDoS distributed denial of service
  • UDP flood User Datagram Protocol flood (UDP flood) attack is a DDoS attack that is harmful and difficult to defend.
  • the attacker launches a UDP flood attack by sending a large number of UDP packets to the target.
  • the traditional UDP flood attack defense scheme relies on the rate limiting mechanism of the firewall. Specifically, the firewall takes the Internet Protocol (Internet Protocol, IP) address of the protected server as the statistical object, and counts the transmission rate of the packets whose destination address is the IP address. If the transmission rate exceeds the threshold, the firewall discards subsequent packets to access the protected server.
  • IP Internet Protocol
  • the firewall cannot distinguish whether a packet is a normal packet from a normal client or an attack packet from an attacker. As a result, normal packets may also be discarded by the firewall, resulting in damage to normal services.
  • This application provides a message source address identification method and device, which can solve the current problem that normal services may be damaged due to the inability to distinguish whether a message comes from a normal client or an attacker.
  • a method for identifying a message source address includes: the protection device intercepts the first message whose destination address is the IP address of the protected device, and the protected device provides services based on the quick UDP network connection (quick UDP internet connections, QUIC) protocol.
  • the protection device sends a first retransmission (retry) packet to the source address of the first packet. If the protection device does not receive the response packet corresponding to the first retransmission packet, the protection device identifies the source address of the first packet as the attack source address.
  • the client when the client wants to access the protected device, it first needs to establish a communication connection with the protected device. During the establishment of the communication connection, the client sends the original message to the protected device.
  • the protection device intercepts the message sent to the protected device, and sends a retransmission message to the source address of the intercepted original message.
  • the normal client if the normal client receives a retransmission message, the normal client will respond to the retransmission message, that is, send a response message corresponding to the retransmission message.
  • the attacker since the attacker uses a false source IP address to send a message to the protected device, the retransmitted message will not be responded.
  • the protection device in this application can judge whether the source address of the intercepted original message is the attack source address or the normal source address by receiving the response message corresponding to the retransmission message, and realize the detection of the source address of the message. Effective identification. Further, the protection device determines the packet from the attack source address as an attack packet, prevents the attack packet from being sent to the protected device, and determines the packet from the normal source address as a normal packet and sends it to the protected device, It can not only effectively defend against attacks, but also ensure the operation of normal business, which improves the reliability of normal business operation.
  • the protection device identifies the source address of the first message as the attack source address, including: if the protection device does not receive the first For a response message corresponding to a retransmission message, the protection device updates the number of verification failures corresponding to the source address of the first message. If the number of failed verifications corresponding to the updated source address of the first packet reaches the threshold, the protection device identifies the source address of the first packet as the attack source address.
  • the protection device subsequently receives another IP address from the source address of the first message and the destination address is the IP address of the protected device. After the original message, a second retransmission message is sent to the source address of the first message, so as to verify the source address of the first message again.
  • the threshold is greater than or equal to 1. If the threshold is equal to 1, the protection device will identify the source address as an attack source address if it fails to pass the verification of the source address once. If the threshold is greater than 1, the protection device recognizes the source address as an attack source address only after failing multiple verifications on the same source address.
  • the protection device recognizes the source address of the first packet as a normal source address.
  • the protection device After the protection device recognizes the source address of the first message as a normal source address, the protection device sends a connection close (connection close) message to the source address of the first message, and the close connection message is used to indicate End this connection, so that the device that sends the first message resends the original message to the protected device when it needs to access the protected device.
  • connection close connection close
  • the protection device After the protection device recognizes the source address of the first message as a normal source address, when the protection device receives a message from the source address of the first message (whether it is an original message or a service message, etc.), the protection device The message will be sent to the protected device, so that a communication connection can be established between the source device of the first message and the protected device and normal communication can be performed.
  • the protection device in response to the fact that the first message is an original message, sends the first retransmission message to the source address of the first message, including: responding to the fact that the source address of the first message is an unknown address , and the first packet is an original packet, the protection device sends the first retransmission packet to the source address of the first packet.
  • the protection device if the source address of the first packet is a known address, or the first packet is not an original packet, the protection device will not send the first retransmission packet to the source address of the first packet.
  • the protection device also intercepts the second packet whose destination address is the IP address of the protected device. In response to the fact that the source address of the second packet is an unknown address and the second packet is not an original packet, the protection device discards the second packet.
  • the normal client Since a normal client needs to establish a communication connection with the protected device before it can access the protected device, before sending a business message to the protected device, the normal client will send an original message to the protected device to establish communication with the protected device connect.
  • the source address of the first message is an unknown address, indicating that the device that sent the first message has not sent the original message to the protected device, or has not responded to the retransmission message sent by the protective device after sending the original message to the protected device text, so the protection device does not recognize the source address as a normal source address. In this case, most of the source addresses of the first packet are attack source addresses, so the protection device directly discards the first packet.
  • the protection device also intercepts the third packet whose destination address is the IP address of the protected device. In response to the source address of the third packet being the attack source address, the protection device discards the third packet.
  • the protection device discards the intercepted packets from the attack source address, so as to realize effective defense against the attack packets.
  • the protection device also intercepts the fourth packet whose destination address is the IP address of the protected device. In response to the source address of the fourth packet being a normal source address, the protection device sends the fourth packet to the protected device.
  • the protection device sends a message from a normal source address to the protected device to realize normal communication between the normal client and the protected device.
  • the first retransmission message carries the first indication
  • the response message is a message whose source address is the source address of the first message, whose destination address is the IP address of the protected device, and which carries the first indication .
  • the response packet is an original packet.
  • the first indication is respectively in the token field of the first retransmission packet and the token field of the response packet.
  • the protection device before the protection device sends the first retransmission packet to the source address of the first packet, the protection device generates the first indication according to the content of the target field in the packet header of the first packet.
  • the protective device generates the first indication according to a random number.
  • the guard device generates the first indication based on the current time stamp.
  • the protection device generates instructions according to the content of the target field in the message header, so that different instructions are generated for different messages, or the protection device generates instructions according to the random number updated regularly, so that the protection device can periodically Update the generated instructions, or, the protection device generates instructions based on the current timestamp, so that the protection device can generate different instructions at different times, that is, the instructions generated by the protection device are not static, thereby reducing the number of instructions generated by the protection device. After the theft, the risk of being replayed by the attacker.
  • the implementation manner in which the protection device generates the first indication according to the content of the target field in the header of the first message includes: the protection device performs a target operation on the content of the target field to obtain the first indication, and the target operation includes requesting One or more of AND, XOR, or Hash operations.
  • the protection device After the protection device sends the first retransmission message to the source address of the first message, the protection device receives the message whose source address is the source address of the first message and whose destination address is the IP address of the protected device. After the message, the target operation is performed on the content of the target field in the message header of the message to obtain the second indication. If the designated field of the message carries the second indication, the protection device determines that the response message is received, and the designated field is a field that is required to carry the first indication in the pre-agreed response message.
  • the protection device after the protection device sends the first retransmission message to the source address of the first message, after receiving a message with the same source address and destination address as the first message, the The content of the target field in the message header is calculated using the same calculation method as the calculation of the first indication to obtain the indication value. By comparing whether the value of the specified field of the message is the same as the calculated indication value, it is verified whether the message is It is the response message corresponding to the first retransmission message.
  • the protective device need not store the generated first indication.
  • the content of the target field includes one or more of source IP address, source port number, destination IP address, destination port number, source connection identifier, or destination connection identifier.
  • the protection device intercepts the first packet whose destination address is the IP address of the protected device. packets with IP addresses.
  • the protection device when the protected device is attacked by traffic, the protection device intercepts the message whose destination address is the IP address of the protected device. When the protected device is not attacked by traffic, the protection device does not intercept packets whose destination address is the IP address of the protected device. In this way, the protected device can be effectively protected, and the processing overhead of the protected device can be reduced as much as possible.
  • a protective device in a second aspect, includes a plurality of functional modules, and the plurality of functional modules interact to implement the methods in the above first aspect and various implementation manners thereof.
  • the multiple functional modules can be implemented based on software, hardware or a combination of software and hardware, and the multiple functional modules can be combined or divided arbitrarily based on specific implementations.
  • a protective device including: a memory, a network interface, and at least one processor,
  • the memory is used to store program instructions
  • the protection device After the at least one processor reads the program instructions stored in the memory, the protection device is enabled to execute the methods in the above first aspect and various implementation manners thereof.
  • a computer-readable storage medium In a fourth aspect, a computer-readable storage medium is provided. Instructions are stored on the computer-readable storage medium. When the instructions are executed by a processor, the above-mentioned first aspect and the methods in each implementation manner thereof are implemented.
  • a computer program product including a computer program.
  • the computer program is executed by a processor, the method in the above first aspect and its various implementation manners is realized.
  • a chip is provided, and the chip includes a programmable logic circuit and/or program instructions, and when the chip is running, implements the method in the above first aspect and various implementation manners thereof.
  • FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the present application
  • Fig. 2 is a schematic structural diagram of a protective device provided by an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of a method for identifying a message source address provided in an embodiment of the present application
  • FIG. 4 is a schematic flowchart of another message source address identification method provided by the embodiment of the present application.
  • Fig. 5 is a schematic structural diagram of a protective device provided by an embodiment of the present application.
  • the QUIC protocol is a UDP-based low-latency transport layer protocol.
  • attackers attack protected devices that provide external services based on the QUIC protocol by sending a large number of QUIC packets, causing the protected device to deny services.
  • the UDP flood attack defense method that relies on the rate limiting mechanism of the protection device is used, the protection device cannot distinguish whether the QUIC packets accessing the protected device are normal packets from normal clients or attack packets from attackers, resulting in normal reports Files may also be discarded by protective equipment, resulting in damage to normal business.
  • the QUIC message includes an original (initial) message, a retransmission (retry) message, a connection close (connection close) message, a service message, and the like.
  • the original packet is also called an initialization packet, and is used to negotiate connection parameters, such as an encryption key.
  • the retransmission message is used to verify the legitimacy of the client.
  • the close connection message is used to close the current connection.
  • the embodiment of the present application proposes a technical solution for identifying the source address of the message.
  • the protection device sends a retransmission to the source address of the original message when it intercepts an original message and the destination address of the original message is the IP address of the protected device that provides services based on the QUIC protocol message. If the protection device does not receive the response message corresponding to the retransmission message, it will identify the source address of the original message as the attack source address, so that the subsequent message from the attack source address can be identified as the attack message, and then Realize effective defense against attack packets.
  • the protection device recognizes the source address of the original message as a normal source address, so as to subsequently identify the message from the normal source address as Normal messages are sent to the protected device to ensure normal business operation.
  • the protection device can distinguish whether the message is a normal message from a normal client or an attack message from an attacker, thereby blocking the attack message from an attacker Sending to the protected device and releasing the normal packets from the normal client to the protected device can not only effectively defend against attacks, but also ensure the operation of normal business and improve the reliability of normal business operation.
  • the protection device processes the intercepted packets based on the blacklist and blacklist mechanisms.
  • the attack source address is recorded in the black list
  • the normal source address is recorded in the white list.
  • the attack source addresses in the blacklist include historical attack source addresses identified by the protection device and/or known attack source addresses input from outside.
  • the normal source addresses in the white list include historical normal source addresses identified by the protection device and/or known normal source addresses input from outside.
  • the protection device If the protection device intercepts a non-original packet whose destination address is the IP address of the protected device and whose source address is an unknown address, the protection device discards the non-original packet. If the protection device intercepts a packet whose destination address is the IP address of the protected device and whose source address is the attack source address, the protection device discards the packet. If the protection device intercepts a message whose destination address is the IP address of the protected device and whose source address is a normal source address, the protection device sends the message to the protected device.
  • an aging time is set for the attack source addresses in the blacklist, that is, the attack source addresses in the blacklist are time-sensitive. Since attackers may update the virtual source addresses used to launch DDoS attacks every once in a while, setting an aging mechanism for the blacklist and cleaning up invalid attack source addresses in the blacklist can reduce the storage resources of the protection device on the one hand. On the other hand, it can reduce the number of attack source addresses in the blacklist, so as to improve the query efficiency of the protection device to the blacklist, thereby improving the protection efficiency of the protection device.
  • an aging time is set for the normal source addresses in the whitelist, that is, the normal source addresses in the whitelist are time-sensitive. Since normal clients may only have access requirements for protected devices within a certain period of time, setting an aging mechanism for the whitelist and clearing outdated normal source addresses in the whitelist can reduce the waste of storage resources on the protection device on the one hand, and on the other hand On the one hand, the number of normal source addresses in the white list can be reduced to improve the query efficiency of the protection device to the white list, thereby improving the protection efficiency of the protection device.
  • an aging mechanism is set for the blacklist and/or whitelist in the protection device, so that the protection device can better respond to changes in the network environment.
  • the basic principle of identifying the source address of the message in the above technical solution is that, according to the requirements of the QUIC protocol, when the client wants to access the protected device, it first needs to establish a communication connection with the protected device. During the establishment of the communication connection, the client sends the original message to the protected device. In this application, the protection device intercepts the message sent to the protected device, and when the original message is intercepted, the protection device sends a retransmission message to the source address of the original message. For a normal client, if the normal client receives a retransmission message, the normal client will respond to the retransmission message, that is, send a response message corresponding to the retransmission message.
  • the protection device in this application can judge whether the source address of the intercepted original message is the attack source address or the normal source address by receiving the response message corresponding to the retransmission message, and realize the detection of the source address of the message. Effective identification.
  • a normal client after sending the original message to the protected device, if it receives a retransmitted message, it will send a response message corresponding to the retransmitted message to the protected device to verify that it is legal sex.
  • the normal client does not need to distinguish whether the received retransmission message is sent by the protection device or the protected device, and only needs to respond according to the existing QUIC protocol. Therefore, the technical solution of this application does not need to improve the client to realize Simple.
  • the technical solution proposed in this application is used to defend against DDoS attacks launched by attackers on protected devices that provide services based on the QUIC protocol.
  • FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the present application.
  • the application scenario shown in Figure 1 is a typical DDoS protection scenario.
  • the protection scenario mainly involves four network devices, which are normal client, attacker, protection device and protected device. In the following, the four network devices are described with examples respectively.
  • a normal client is the initiator of normal traffic. Normal clients access services provided on the server by generating normal traffic and sending normal traffic to the server.
  • the normal client is an application program supporting the QUIC protocol. Normal clients access services provided on the server through the QUIC protocol.
  • a normal client is, for example, browser software or business client software.
  • normal clients are installed in various devices with computing capabilities on the Internet. After a normal client on the Internet initiates normal traffic, the protection device intercepts the normal traffic and conducts security inspection on the normal traffic. When it is determined that the normal traffic is not threatening, the protection device forwards the normal traffic to the protected device in the protected network.
  • Attackers generate and send attack traffic to protected devices through tools, zombie hosts, or proxies.
  • the attacker is located in the Internet, that is, the attacker launches an attack from the Internet to the protected device in the protected network.
  • the protected device is on the protected network. From the perspective of the protected device, the protected network where the protected device is located is an internal network, and the Internet is an external network. Optionally, the protected network includes one or more local area networks.
  • a protected device is a protected server. Protected devices are used to provide services to legitimate clients. In this embodiment of the application, the protected device provides services based on the QUIC protocol. Protected devices include, but are not limited to, application servers or web servers. Wherein, the application server includes but not limited to game server, video application server, file server, search engine server, instant messaging server and so on.
  • a web server is also called a World Wide Web (world wide web, web) server or a website server.
  • Protection devices are deployed between the Internet and the protected network.
  • the guard device is deployed at the border of the protected network to protect the protected devices in the protected network from attacks.
  • the protection device performs security inspection on the traffic entering the protected network, so as to confirm whether the traffic is normal traffic or attack traffic.
  • the protection device will block attack traffic to ensure the security of the protected device, and forward normal traffic to ensure that the protected device can provide services to normal clients.
  • Protection equipment includes but not limited to firewalls, security gateways (such as routers or switches), intrusion detection system (intrusion detection system, IDS) type equipment, intrusion prevention system (intrusion prevention system, IPS) type equipment, unified threat management (unified threat management) , UTM) equipment, anti-virus (anti-virus, AV) equipment, anti-distributed denial of service attack (anti-DDoS) equipment, the integration of one or more of the next generation firewall (next generation firewall, NGFW).
  • security gateways such as routers or switches
  • intrusion detection system intrusion detection system
  • IDS intrusion detection system
  • IPS intrusion prevention system
  • unified threat management unified threat management
  • UTM anti-virus
  • anti-DDoS anti-distributed denial of service attack
  • NGFW next generation firewall
  • the basic hardware structure of the protective equipment is illustrated below with an example.
  • FIG. 2 is a schematic structural diagram of a protective device provided in an embodiment of the present application.
  • the protection device 200 includes a central processing unit (central processing unit, CPU) 201 , a dedicated hardware chip 202 and at least one network interface 203 .
  • the CPU 201 and the dedicated hardware chip 202 may be collectively referred to as a processor.
  • the protection device 200 in FIG. 2 is the protection device shown in FIG. 1 .
  • CPU 201 refers to a general-purpose central processing unit, which has high scalability and flexibility.
  • the CPU 201 is, for example, a single-core processor (single-CPU), or a multi-core processor (multi-CPU).
  • the dedicated hardware chip 202 is a high-performance processing hardware module.
  • the dedicated hardware chip 202 includes at least one of an application-specific integrated circuit (application-specific integrated circuit, ASIC), a field-programmable gate array (field-programmable gate array, FPGA) or a network processor (network processor, NP).
  • ASIC application-specific integrated circuit
  • FPGA field-programmable gate array
  • NP network processor
  • the at least one network interface 203 includes, for example, network interface 1, network interface 2, network interface 3...network interface n in FIG. 2 .
  • Network interface 203 uses any transceiver-like device for communicating with other devices or a communication network.
  • network interface 1 in FIG. 2 communicates with the protected device
  • network interface 2 in FIG. 2 communicates with normal clients.
  • the network interface 203 includes at least one of a wired network interface or a wireless network interface.
  • the wired network interface is, for example, an Ethernet interface.
  • the Ethernet interface is, for example, an optical interface, an electrical interface or a combination thereof.
  • the wireless network interface is, for example, a wireless protected network (wireless local area networks, WLAN) interface, a cellular network interface or a combination thereof.
  • At least one network interface 203 is connected to the dedicated hardware chip 202, and between the dedicated hardware chip 202 and the CPU 201 through an internal connection 204.
  • the internal connection 204 includes a path for data transmission between the network interface 203, the dedicated hardware chip 202 and the CPU 201.
  • the internal connection 204 is a single board or a bus.
  • the internal connection 204 is Ethernet, fiber channel (fibre channel), PCI-E (peripheral component interconnect express, PCI Express, a high-speed serial computer bus), RapidIO (a high-performance, low pin count, based on packet-switched interconnect architecture), InfiniBand, or the XAUI bus (an interface extender that features an Ethernet Media Access Control (MAC) layer connected to the physical layer).
  • MAC Ethernet Media Access Control
  • the protection device 200 further includes a content addressable memory (content addressable memory, CAM) 205 .
  • the CAM 205 is, for example, a ternary content addressable memory (TCAM) or the like.
  • TCAM ternary content addressable memory
  • the CAM 205 is used to store the IP address of the protected device with attack risk and/or the IP address of the protected device without attack risk.
  • the CAM 205 exists independently and is connected to the dedicated hardware chip 202 through the above-mentioned internal connection 204. Or, the CAM 205 and the dedicated hardware chip 202 are integrated together, that is, the CAM 205 is used as the internal memory of the dedicated hardware chip 202.
  • the protection device 200 further includes a memory 206 .
  • the memory 206 is, for example, a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (random access memory, RAM) or a memory that can store information and instructions.
  • ROM read-only memory
  • RAM random access memory
  • the memory 206 is also used to separately store a blacklist and a whitelist, the blacklist includes IP addresses of attack sources, and the whitelist includes IP addresses of normal clients. Both the blacklist and the whitelist can be accessed by the CPU 201.
  • the memory 206 exists independently, for example, and is connected to the CPU 201 through the internal connection 204. Or the memory 206 and the CPU 201 are integrated together.
  • An operating system 207 and program code 208 are stored in the memory 206 .
  • the CPU 201 reads the operating system 207 from the memory 206 and runs the operating system 207, and the CPU 201 also reads the program code 208 from the memory 206, and realizes the implementation of the present application by running the program code 208 on the operating system 207.
  • the method provided by the example is the example.
  • the protection device 200 is the protection device shown in Figure 1, and the CPU 201 executes the following process in the process of running the program code 208: the protection device 200 intercepts the first message whose destination address is the IP address of the protected device, and the protected The device provides services based on the QUIC protocol; in response to the fact that the first message is an original message, the protection device 200 sends the first retransmission message to the source address of the first message; if the protection device 200 does not receive the first retransmission message For the corresponding response packet, the protection device 200 identifies the source address of the first packet as the attack source address.
  • the above-mentioned devices are respectively arranged on independent chips, or at least part or all of them are arranged on the same chip. Whether each device is independently arranged on different chips or integrated and arranged on one or more chips often depends on the needs of product design.
  • the embodiments of the present application do not limit the specific implementation forms of the foregoing devices.
  • FIG. 3 is a schematic flowchart of a method 300 for identifying a packet source address provided by an embodiment of the present application.
  • the method 300 includes the following steps 301 to 304 .
  • the network deployment scenario on which the method 300 is based is shown in FIG. 1 .
  • the protective device in method 300 is the protective device in FIG. 1 .
  • the traffic flowing through the protection device in method 300 comes from normal clients or attackers in FIG. 1 .
  • the protected device in method 300 is the protected device in FIG. 1 .
  • the protection device in method 300 includes, but is not limited to, one physical device, or a distributed system (sometimes called a protection system) including multiple physical devices.
  • the protection device in method 300 has the hardware structure shown in FIG. 2 .
  • Step 301 the protection device intercepts the first packet whose destination address is the IP address of the protected device.
  • the protective device starts the process shown in method 300 when the predetermined condition is met.
  • the predetermined conditions include but are not limited to: the situation that the protected device is currently under attack, or the resource utilization rate of the protected device is lower than a set threshold, or a protection request from the protected device is received, and so on.
  • the protection device starts the process shown in method 300 when it determines that the protected device is under attack. Specifically, when the protected device is attacked by traffic, the protection device intercepts the packet whose destination address is the IP address of the protected device. When the protected device is not attacked by traffic, the protection device does not intercept packets whose destination address is the IP address of the protected device. In this way, the protected device can be effectively protected, and the processing overhead of the protected device can be reduced as much as possible.
  • the protection device determines that the protected device is under traffic attack.
  • Step 302 In response to the fact that the first packet is an original packet, the protection device sends a first retransmission packet to the source address of the first packet.
  • the first retransmission packet carries the first indication.
  • the first indication is in a specified field of the first retransmission message, and the specified field is a field used to carry the first indication in the pre-agreed retransmission message.
  • the pre-agreement here can be understood as agreement agreement or pre-negotiation.
  • the first indication is in a token (token) field of the first retransmission message, that is, the first indication is a value of the token field of the first retransmission message.
  • the protection device In a first implementation manner, the protection device generates the first indication according to the content of the target field in the packet header of the first packet.
  • the protection device performs a target operation on the content of the target field in the message header of the first packet to obtain the first indication.
  • the target operation includes one or more of a sum operation, an exclusive OR operation, or a hash operation.
  • the content of the target field includes one or more of source IP address, source port number, destination IP address, destination port number, source connection identifier (identity, ID) or destination connection identifier.
  • source IP address source port number
  • destination IP address destination IP address
  • destination port number destination connection identifier
  • destination connection identifier destination connection identifier
  • the protection device generates the first indication according to the field content in the header of the first message, so that the protection device can generate different indications for different original messages, that is, the indications generated by the protection device are not static , thereby reducing the risk of replay attacks by the attacker after the instruction generated by the protection device is stolen by the attacker.
  • the protection device In the second implementation manner, the protection device generates the first indication according to the random number.
  • the random number is periodically generated by the guard.
  • the protective device refreshes a random number every 1 minute.
  • the current random number is 418818144890, and it will be refreshed to 742378908452 after 1 minute.
  • the protective device generates the first instruction according to the regularly updated random number, so that the protective device can periodically update the generated instruction, that is, the instruction generated by the protective device will change with time, and is not static, thereby reducing the generation of protective equipment. After the instruction is stolen by the attacker, the attacker may carry out the risk of replay attack.
  • the protection device generates the first indication according to the current time stamp.
  • the current time stamp is the time stamp of receiving the first packet by the protection device, or the current time stamp is the start time stamp of generating the first indication by the protection device.
  • the timestamp here is Unix timestamp (Unix timestamp).
  • the current time is 2021/8/27 15:32:00
  • the converted timestamp is 1630049520.
  • the protection device generates the first indication according to the current time stamp, so that the protection device can generate different indications at different times, that is, the indication generated by the protection device will change with time, and is not static, thereby reducing the generation of protection equipment.
  • the attacker may carry out the risk of replay attack.
  • the protection device generates the first indication according to any two or all of the content of the target field in the header of the first packet, the random number, and the current timestamp.
  • the protection device after the protection device sends the first retransmission message to the source address of the first message, it needs to determine whether a response message corresponding to the first retransmission message is received within a period of time.
  • the response message corresponding to the first retransmission message is that the source address is the source address of the first message, the destination address is the IP address of the protected device, And carry the message with the first indication.
  • the response packet is an original packet.
  • the first indication in the response message is in the token field of the response message.
  • the original message will be sent to the protected device again, and the value of the token field of the original message will be Set to the value of the token field of the received retransmission packet.
  • the attacker will only continue to send packets to the protected device, and will not respond to the received retransmission packets.
  • the protection device will receive the source address as the source address of the first message, the destination address as the IP address of the protected device, and the value of the token field is the same as the token field of the first retransmission message The message with the same value as the response message corresponding to the first retransmission message.
  • the protection device after the protection device generates the first indication carried in the first retransmission message, it stores the correspondence between the first indication and the source address and destination address of the first message, In order to verify whether the first indication is carried in a subsequently received packet having the same source address and destination address as the first packet, and then determine whether the packet is a response packet corresponding to the first retransmission packet.
  • the protection device since the target field content of the response message corresponding to the first retransmission message is the same as the target field content of the first message, in the above first implementation, the protection device generates After the first indication in the message, there is no need to store the first indication. After the protection device sends the first retransmission message to the source address of the first message, after receiving a message with the same source address and destination address as the first message, based on the header of the message For the content of the target field, the indication value is calculated by the same calculation method as the first indication, and whether the message is the first retransmission is verified by comparing whether the value of the specified field of the message is the same as the calculated indication value The response message corresponding to the message.
  • the specific implementation process includes: after the protection device receives the message whose source address is the source address of the first message and whose destination address is the IP address of the protected device, it executes the target field content in the message header of the message. to get a second indication. If the indication carried in the specified field of the message is the same as the second indication, the protection device determines that the response message corresponding to the first retransmission message has been received. Wherein, the target operation is an operation adopted when the protective device generates the first indication.
  • the specified field is a field that needs to carry the first indication in the pre-agreed response message.
  • the pre-agreement here can be understood as agreement agreement or pre-negotiation.
  • the specified field is a token field.
  • the protection device carries the first indication in the first retransmission message, and verifies whether the subsequent received message carries the first indication, so as to determine whether the first retransmission message corresponding to The response message is simple to implement.
  • Step 303 If the protection device does not receive the response packet corresponding to the first retransmission packet, the protection device identifies the source address of the first packet as the attack source address.
  • the protection device updates the number of verification failures corresponding to the source address of the first message. If the number of failed verifications corresponding to the updated source address of the first packet reaches the threshold, the protection device identifies the source address of the first packet as the attack source address.
  • the protection device subsequently receives another IP address from the source address of the first message and the destination address is the IP address of the protected device. After the original message, a second retransmission message is sent to the source address of the first message, so as to verify the source address of the first message again. In other words, if the number of verification failures corresponding to the updated source address of the first packet does not reach the threshold, the protection device continues to verify the source address of the first packet.
  • the threshold is greater than or equal to 1. If the threshold is equal to 1, the protection device will identify the source address as an attack source address if it fails to pass the verification of the source address once. If the threshold is greater than 1, the protection device recognizes the source address as an attack source address only after failing multiple verifications on the same source address.
  • the threshold can be set and changed according to actual protection requirements, and the embodiment of the present application does not limit the specific value of the threshold.
  • the protection device identifies the source address of the first packet as the attack source address, it regards subsequent received packets from the source address of the first packet as attack packets, and then implements attack packet effective defense.
  • Step 304 If the protection device receives the response message corresponding to the first retransmission message, the protection device recognizes the source address of the first message as a normal source address.
  • the protection device After the protection device recognizes the source address of the first message as a normal source address, the protection device sends a close connection message to the source address of the first message, and the close connection message is used to indicate the termination of this connection, so that When the device sending the first message needs to access the protected device, resend the original message to the protected device. After the protection device receives the message from the source address of the first message, the protection device sends the message to the protected device, so that the source device of the first message and the protected device can communicate normally .
  • the protection device After the protection device recognizes the source address of the first message as a normal source address, it regards subsequent received messages from the source address of the first message as normal messages and sends them to the protected device, Ensure normal business operations.
  • the protection device can distinguish whether the message is a normal message from a normal client or an attack message from an attacker, thereby preventing attacks from the attacker Packets are sent to the protected device, and normal packets from normal clients are released to the protected device, which can not only effectively defend against attacks, but also ensure normal business operation and improve the reliability of normal business operation.
  • one implementation of the above step 302 is: in response to the fact that the source address of the first message is an unknown address and the first message is an original message, the protection device sends the first message to the source address of the first message. Retransmit the message.
  • the protection device will not send the first retransmission packet to the source address of the first packet.
  • the protection device discards the first packet. Since a normal client needs to establish a communication connection with the protected device before it can access the protected device, before sending a business message to the protected device, the normal client will send an original message to the protected device to establish communication with the protected device connect.
  • the source address of the first message is an unknown address, indicating that the device that sent the first message has not sent the original message to the protected device, or has not responded to the retransmission message sent by the protection device after sending the original message to the protected device text, so the protection device does not recognize the source address as a normal source address. In this case, most of the source addresses of the first packet are attack source addresses, so the protection device directly discards the first packet.
  • the protection device discards the first packet to implement effective defense against the attack packet.
  • the protection device sends the first message to the protected device, so that the source device of the first message and the protected device normal communication between them.
  • a blacklist and a whitelist are stored in the protection device, the known attack source addresses are recorded in the blacklist, and known normal source addresses are recorded in the whitelist.
  • the protection device also intercepts the second message whose destination address is the IP address of the protected device; in response to the source address of the second message being an unknown address and the second message not being an original message, the protection device discards the second message . And/or, the protection device also intercepts the third packet whose destination address is the IP address of the protected device; in response to the source address of the third packet being the attack source address, the protection device discards the third packet. And/or, the protection device also intercepts the fourth packet whose destination address is the IP address of the protected device; in response to the source address of the fourth packet being a normal source address, the protection device sends the fourth packet to the protected device.
  • FIG. 4 is a schematic flowchart of a method 400 for identifying a packet source address provided by an embodiment of the present application.
  • the method 400 includes the following steps 401 to 410.
  • the network deployment scenario on which the method 400 is based is shown in FIG. 1 .
  • the protective device in method 400 is the protective device in FIG. 1 .
  • the traffic flowing through the protection device in method 400 comes from normal clients or attackers in FIG. 1 .
  • the protected device in method 400 is the protected device in FIG. 1 .
  • the protection device in method 400 includes, but is not limited to, one physical device, or a distributed system (sometimes also called a protection system) including multiple physical devices.
  • the protection device in method 400 has the hardware structure shown in FIG. 2 .
  • Step 401 the protection device intercepts the packet whose destination address is the IP address of the protected device.
  • the message is any message whose destination address is the IP address of the protected device intercepted by the protection device.
  • the message may be the above-mentioned first message, second message, third message or fourth message.
  • step 401 please refer to the relevant description in the above step 301, and the embodiment of the present application will not repeat it here.
  • Step 402 the protection device judges that the source address of the message is an unknown address, an attack source address or a normal source address. If the source address of the message is an unknown IP address, then perform step 403; if the source address of the message is an attack source address, then perform step 409; if the source address of the message is a normal source address, then perform step 410 .
  • blacklists and whitelists are stored in the protection device. If the source address of the packet is in the blacklist, the protection device determines that the source address of the packet is an attack source address. If the source address of the message is in the white list, the protection device determines that the source address of the message is a normal source address. If the source address of the packet is neither in the blacklist nor in the whitelist, the protection device determines that the source address of the packet is an unknown address.
  • the protection device first queries whether the source address of the packet is recorded in the stored blacklist. If the source address of the message is not recorded in the blacklist, the protection device checks whether the source address of the message is recorded in the stored white list. Alternatively, the protection device first queries whether the source address of the message is recorded in the stored white list. If the source address of the message is not recorded in the white list, the protection device checks whether the source address of the message is recorded in the stored black list. Alternatively, the protection device simultaneously queries whether the source address of the packet is recorded in the stored blacklist and whitelist. The embodiment of the present application does not limit the order in which the protection device queries the blacklist and the whitelist.
  • Step 403 the protection device judges whether the message is an original message. If the packet is an original packet, execute step 404; if the packet is not an original packet, execute step 409.
  • Step 404 the protection device sends a retransmission message carrying indication 1 to the source address of the message.
  • step 404 For the explanation and implementation of step 404, reference may be made to the relevant description in step 302 above, and details will not be repeated here in this embodiment of the present application.
  • Step 405 the protection device judges whether a response message corresponding to the retransmission message is received. If the protection device does not receive the response message corresponding to the retransmission message, perform step 406; if the protection device receives the response message corresponding to the retransmission message, perform step 407.
  • the source address of the response message corresponding to the retransmission message is the source address of the message intercepted by the protection device in step 401
  • the destination address of the response message is the destination address of the message intercepted by the protection device in step 401 (i.e. the IP address of the protected device).
  • the source address of the response message corresponding to the retransmission message is the source address of the message intercepted by the protection device in step 401
  • the destination address of the response message is the destination address of the message intercepted by the protection device in step 401 (i.e. the IP address of the protected device).
  • Step 406 the protection device identifies the source address of the message as the attack source address.
  • step 406 For the explanation and implementation of step 406, reference may be made to the related description in step 303 above, and details will not be repeated here in this embodiment of the present application.
  • Step 407 the protection device recognizes the source address of the message as a normal source address.
  • step 407 please refer to the relevant description in the above step 304, and the embodiment of the present application will not repeat it here.
  • Step 408 the protection device sends a close connection message to the source address of the message.
  • the protection device If the device to which the source address of the message belongs still needs to access the protected device, it will send the original message to the protected device again after receiving the close connection message.
  • the protection device receives a message from a normal source address (whether it is an original message or a service message, etc.), the protection device will send the message to the protected device, so that the device to which the normal source address belongs and the protected device A communication connection can be established between devices and normal communication can be carried out.
  • Step 409 the protection device discards the packet.
  • Step 410 the protection device sends the message to the protected device.
  • known attack source addresses are stored through a blacklist, or known normal source addresses are stored through a whitelist.
  • the protection device subsequently receives the original message, before verifying the source address of the original message based on the retransmitted message, it can reduce the need for verification by matching the source address of the original message with the blacklist or whitelist
  • the number of original packets can improve the protection efficiency of the protection equipment.
  • the order of the steps in the method for identifying the message source address provided in the embodiment of the present application can be adjusted appropriately, and the steps can also be increased or decreased accordingly according to the situation. Any person familiar with the technical field within the technical scope disclosed in this application can easily think of changing methods, which should be covered within the scope of protection of this application.
  • the virtual device in the embodiment of the present application is illustrated below with an example.
  • Fig. 5 is a schematic structural diagram of a protective device provided by an embodiment of the present application.
  • the protection device with the structure shown in FIG. 5 realizes the function of the protection device in the solutions described in the above embodiments.
  • the protective device shown in FIG. 5 is the protective device in the application scenario shown in FIG. 1 or the protective device shown in FIG. 2 , and performs the function of the protective device described in the embodiment shown in FIG. 3 or FIG. 4 .
  • the protection device 50 includes a processing module 501 and a sending module 502 .
  • the processing module 501 is configured to intercept the first packet whose destination address is the IP address of the protected device, and the protected device provides services based on the QUIC protocol.
  • the sending module 502 is configured to send the first retransmission message to the source address of the first message in response to the fact that the first message is an original message.
  • the processing module 501 is further configured to identify the source address of the first message as the attack source address if the protection device does not receive the response message corresponding to the first retransmission message.
  • the processing module 501 uses step 301 in the method 300 to intercept the first message whose destination address is the IP address of the protected device; The source address of the first message sends the first retransmission message; the processing module 501 also uses step 303 in the method 300 when the protection device does not receive the response message corresponding to the first retransmission message, and sends the first message identified as the source address of the attack.
  • step 301 in the method 300 to intercept the first message whose destination address is the IP address of the protected device;
  • the source address of the first message sends the first retransmission message;
  • the processing module 501 also uses step 303 in the method 300 when the protection device does not receive the response message corresponding to the first retransmission message, and sends the first message identified as the source address of the attack.
  • the processing module 501 is configured to: if the protection device does not receive the response message corresponding to the first retransmission message, update the number of verification failures corresponding to the source address of the first message; and, if the updated The number of verification failures corresponding to the source address of a packet reaches a threshold, and the source address of the first packet is identified as the attack source address.
  • the processing module 501 reference may be made to the relevant descriptions of step 303 in the method 300 , or, reference may be made to the relevant descriptions of the steps 405 and 406 in the method 400 .
  • the processing module 501 is further configured to: if the protection device receives a response packet corresponding to the first retransmission packet, identify the source address of the first packet as a normal source address.
  • the processing module 501 reference may be made to the relevant descriptions of step 304 in the method 300 , or, reference may be made to the relevant descriptions of the steps 405 and 407 in the method 400 .
  • the sending module 502 is further configured to: after identifying the source address of the first message as a normal source address, send a close connection message to the source address of the first message, where the close connection message is used to indicate the end of the current session. Second connection, so that when the device that sent the first message needs to access the protected device, it can resend the original message to the protected device.
  • the sending module 502 reference may be made to the related description of step 408 in the method 400.
  • the sending module 502 is further configured to: send the first retransmission message to the source address of the first message in response to the fact that the source address of the first message is an unknown address and the first message is an original message.
  • the implementation process of the sending module 502 may refer to the related description of step 302 in the method 300 , or may refer to the related description of the step 404 in the method 400 .
  • the processing module 501 is further configured to: intercept the second message whose destination address is the IP address of the protected device; , discarding the second packet.
  • the processing module 501 for the implementation process of the processing module 501 , reference may be made to the related descriptions of step 403 and step 409 in the method 400 .
  • the first retransmission message carries the first indication
  • the response message is a message whose source address is the source address of the first message, whose destination address is the IP address of the protected device, and which carries the first indication .
  • the response packet is an original packet.
  • the first indication is respectively in the token field of the first retransmission packet and the token field of the response packet.
  • the processing module 501 is further configured to: before sending the first retransmission message to the source address of the first message, generate the first indication according to the content of the target field in the message header of the first message; or, Generate the first indication according to the random number; or, generate the first indication according to the current timestamp.
  • the processing module 501 for the implementation process of the processing module 501 , reference may be made to the relevant description of step 302 in the method 300 .
  • the processing module 501 is configured to: perform a target operation on the content of the target field to obtain the first indication, where the target operation includes one or more of a sum operation, an exclusive OR operation, or a hash operation.
  • the processing module 501 is further configured to: after sending the first retransmission message to the source address of the first message, after receiving the After the message of the IP address, perform the target operation on the content of the target field in the message header of the message to obtain the second indication; if the specified field of the message carries the second indication, it is determined that the response message is received, and the specified field
  • the pre-agreed response packet needs to carry the first indicated field.
  • the content of the target field includes one or more of source IP address, source port number, destination IP address, destination port number, source connection identifier, or destination connection identifier.
  • the processing module 501 is configured to: intercept a packet whose destination address is the IP address of the protected device when it is determined that the protected device is under traffic attack.
  • the processing module 501 for the implementation process of the processing module 501 , reference may be made to the related description of step 301 in the method 300 .
  • each functional module in each embodiment of the present application may be integrated into one processing module, each module may exist separately physically, or two or more modules may be integrated into one module.
  • Each of the above-mentioned modules in FIG. 5 can be implemented in the form of hardware or in the form of software functional units.
  • the above-mentioned processing module 501 may be implemented by a software function module generated by the CPU 201 in FIG. 2 after reading the program code stored in the memory.
  • each module among Fig. 5 also can be realized respectively by different hardware in the protection device, for example processing module 501 is realized by a part of processing resource (such as a core in the multi-core processor) in CPU 201 among accompanying drawing 2, and sending module 502 It is completed by the network interface 203 of FIG. 2 and the rest of the processing resources in the CPU 201 (for example, other cores in a multi-core processor), or by the dedicated hardware chip 202 of FIG. 2 .
  • the above functional modules can also be implemented by a combination of software and hardware.
  • the sending module 502 is implemented by a hardware programmable device
  • the processing module 501 is a software function module generated by the CPU after reading the program code stored in the memory.
  • the embodiment of the present application also provides a protective device, including: a memory, a network interface, and at least one processor,
  • the memory is used to store program instructions
  • the protective device After the at least one processor reads the program instructions stored in the memory, the protective device is made to execute the steps in the above-mentioned method 300 or method 400 .
  • the hardware structure of the protection device is shown in FIG. 2 .
  • the embodiment of the present application also provides a computer-readable storage medium, where instructions are stored on the computer-readable storage medium, and when the instructions are executed by a processor, the steps in the above method 300 or method 400 are implemented.
  • the embodiment of the present application also provides a computer program product, including a computer program, and when the computer program is executed by a processor, the steps in the above method 300 or method 400 are implemented.
  • traffic is also referred to as network traffic (network traffic) or data traffic (data traffic).
  • Traffic refers to the data transmitted over a network at a given point in time.
  • traffic received by a device at time T refers to all packets received by the device at time T.
  • first and second in the description and claims of the embodiments of the present application are used to distinguish different objects, not to describe a specific order of objects, nor can they be interpreted as indicating or implying relative importance sex.
  • first packet and the second packet are used to distinguish different packet groups, rather than describing a specific sequence of packets.
  • a reference to B means that A is the same as B or A is a simple variation of B.
  • all or part of the implementation is implemented by software, hardware, firmware or any combination thereof.
  • all or part of it is implemented in the form of a computer program product.
  • a computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions described in accordance with the embodiments of the present application will be generated in whole or in part.
  • the computer is a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions are stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, computer instructions can be Wired (eg, coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.) transmission to another website site, computer, server, or data center.
  • the computer-readable storage medium is any available medium that can be accessed by a computer or a data storage device including a server, a data center, and the like integrated with one or more available media.
  • the usable medium is a magnetic medium, (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, a Solid State Disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种报文源地址识别方法及装置。属于网络安全领域。防护设备拦截目的地址为受保护设备的IP地址的报文，该受保护设备基于QUIC协议提供服务。响应于该报文为原始报文，防护设备向该报文的源地址发送重传报文。如果防护设备未接收到该重传报文对应的响应报文，防护设备将该报文的源地址识别为攻击源地址。防护设备通过对拦截到的原始报文的源地址进行判断，识别出攻击者使用的攻击源地址，后续仅阻止来自攻击源地址的报文发往受保护设备，既能有效防御攻击，又能保证正常业务的运行。

Description

报文源地址识别方法及装置
本申请要求于2021年10月15日提交的申请号为202111203775.5、发明名称为“报文源地址识别方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络安全领域，特别涉及一种报文源地址识别方法及装置。
背景技术
拒绝服务(denial of service，DoS)攻击是一种网络攻击手段。DoS攻击的原理是攻击者(也被称为黑客)控制受控计算机向攻击目标发送大量报文，使得攻击目标忙于处理来自攻击者的报文，从而耗尽攻击目标的计算资源、网络资源等系统资源，导致攻击目标无法响应来自正常用户的服务请求。当攻击者使用网络中两个或两个以上受控计算机发动DoS攻击时，这种攻击方式被称为分布式拒绝服务(distributed denial of service，DDoS)攻击。
用户数据报协议(User Datagram Protocol，UDP)泛洪(UDP flood)攻击是DDoS攻击中一种危害大而防御难度高的攻击方式。攻击者通过向攻击目标发送大量的UDP报文，以发动UDP flood攻击。
传统的UDP flood攻击防御方案依赖于防火墙的限速机制。具体地，防火墙以受保护服务器的互联网协议(Internet Protocol，IP)地址为统计对象，统计目的地址为该IP地址的报文的传输速率。如果传输速率超过阈值，则防火墙丢弃后续访问该受保护服务器的报文。
然而采用上述方式时，防火墙无法区分报文是来自正常客户端的正常报文还是来自攻击者的攻击报文，导致正常报文也可能被防火墙丢弃，造成正常业务受损。
发明内容
本申请提供了一种报文源地址识别方法及装置，可以解决目前由于无法区分报文来自正常客户端还是攻击者而导致的正常业务可能受损的问题。
第一方面，提供了一种报文源地址识别方法。该方法包括：防护设备拦截目的地址为受保护设备的IP地址的第一报文，该受保护设备基于快速UDP网络连接(quick UDP internet connections，QUIC)协议提供服务。响应于第一报文为原始(initial)报文，防护设备向第一报文的源地址发送第一重传(retry)报文。如果防护设备未接收到第一重传报文对应的响应报文，防护设备将第一报文的源地址识别为攻击源地址。
由于QUIC协议下，客户端想要访问受保护设备时，首先需要与受保护设备建立通信连接。在建立通信连接的过程中，客户端会向受保护设备发送原始报文。本申请中，防护设备通过拦截发往受保护设备的报文，并向拦截到的原始报文的源地址发送重传报文。对于正常客户端而言，如果正常客户端接收到重传报文，那么正常客户端会响应该重传报文，即发送该重传报文对应的响应报文。而对于攻击者而言，由于攻击者使用虚假的源IP地址向受保护设备发送报文，因此不会响应该重传报文。基于此，本申请中防护设备能够通过是否接收到 重传报文对应的响应报文，来判断拦截到的原始报文的源地址为攻击源地址还是正常源地址，实现对报文源地址的有效识别。进一步地，防护设备将来自攻击源地址的报文判定为攻击报文，阻止攻击报文发往受保护设备，并将来自正常源地址的报文判定为正常报文后发送至受保护设备，既能有效防御攻击，又能保证正常业务的运行，提高了正常业务的运行可靠性。
可选地，如果防护设备未接收到第一重传报文对应的响应报文，防护设备将第一报文的源地址识别为攻击源地址的实现方式，包括：如果防护设备未接收到第一重传报文对应的响应报文，防护设备更新第一报文的源地址对应的验证未通过次数。如果更新后的第一报文的源地址对应的验证未通过次数达到阈值，防护设备将第一报文的源地址识别为攻击源地址。
进一步地，如果更新后的第一报文的源地址对应的验证未通过次数未达到阈值，防护设备后续接收到来自第一报文的源地址、目的地址为受保护设备的IP地址的另一原始报文后，向第一报文的源地址发送第二重传报文，以对第一报文的源地址进行再次验证。可选地，该阈值大于或等于1。如果该阈值等于1，则防护设备对源地址一次验证未通过，就将该源地址识别为攻击源地址。如果该阈值大于1，则防护设备对同一源地址多次验证未通过，才将该源地址识别为攻击源地址。
可选地，如果防护设备接收到第一重传报文对应的响应报文，防护设备将第一报文的源地址识别为正常源地址。
可选地，在防护设备将第一报文的源地址识别为正常源地址之后，防护设备向第一报文的源地址发送关闭连接(connection close)报文，该关闭连接报文用于指示结束本次连接，以便于发送第一报文的设备需要访问受保护设备时，向受保护设备重新发送原始报文。
在防护设备将第一报文的源地址识别为正常源地址之后，当防护设备再接收到来自第一报文的源地址的报文(无论是原始报文还是业务报文等)，防护设备会将该报文发送至受保护设备，以使第一报文的源端设备与受保护设备之间能够建立通信连接并进行正常通信。
可选地，响应于第一报文为原始报文，防护设备向第一报文的源地址发送第一重传报文的实现方式，包括：响应于第一报文的源地址为未知地址、且第一报文为原始报文，防护设备向第一报文的源地址发送第一重传报文。可选地，如果第一报文的源地址为已知地址，或者第一报文不为原始报文，则防护设备不会向第一报文的源地址发送第一重传报文。
可选地，防护设备还拦截目的地址为受保护设备的IP地址的第二报文。响应于第二报文的源地址为未知地址、且第二报文不为原始报文，防护设备丢弃第二报文。
由于正常客户端需要与受保护设备建立通信连接之后才能访问受保护设备，因此正常客户端在向受保护设备发送业务报文之前，会向受保护设备发送原始报文以与受保护设备建立通信连接。第一报文的源地址为未知地址，说明发送第一报文的设备没有向受保护设备发送过原始报文，或者向受保护设备发送原始报文后没有响应过防护设备发送的重传报文，因此防护设备未将该源地址识别为正常源地址。这种情况下，第一报文的源地址多数为攻击源地址，因此防护设备将该第一报文直接丢弃。
可选地，防护设备还拦截目的地址为受保护设备的IP地址的第三报文。响应于第三报文的源地址为攻击源地址，防护设备丢弃第三报文。
本申请中，防护设备丢弃拦截到的来自攻击源地址的报文，实现对攻击报文的有效防御。
可选地，防护设备还拦截目的地址为受保护设备的IP地址的第四报文。响应于第四报文的源地址为正常源地址，防护设备向受保护设备发送第四报文。
本申请中，防护设备向受保护设备发送来自正常源地址的报文，实现正常客户端与受保护设备之间的正常通信。
可选地，第一重传报文携带有第一指示，响应报文是源地址为第一报文的源地址、目的地址为受保护设备的IP地址、并且携带有第一指示的报文。
可选地，响应报文为原始报文。
可选地，第一指示分别在第一重传报文的令牌字段以及响应报文的令牌字段。
可选地，防护设备向第一报文的源地址发送第一重传报文之前，防护设备根据第一报文的报文头中的目标字段内容生成第一指示。或者，防护设备根据随机数生成第一指示。或者，防护设备根据当前时间戳生成第一指示。
本申请中，防护设备根据报文的报文头中的目标字段内容生成指示，使得针对不同的报文生成不同的指示，或者，防护设备根据定期更新的随机数生成指示，使得防护设备能够定期更新生成的指示，又或者，防护设备根据当前时间戳生成指示，使得防护设备能够在不同时刻生成不同的指示，即防护设备生成的指示并非是一成不变的，进而降低防护设备生成的指示被攻击者窃取后，被攻击者进行重放攻击的风险。
可选地，防护设备根据第一报文的报文头中的目标字段内容生成第一指示的实现方式，包括：防护设备对目标字段内容执行目标操作，以得到第一指示，目标操作包括求和操作、异或操作或哈希操作中的一种或多种。
可选地，防护设备向第一报文的源地址发送第一重传报文之后，防护设备在接收到源地址为第一报文的源地址、目的地址为受保护设备的IP地址的报文之后，对报文的报文头中的目标字段内容执行目标操作，以得到第二指示。如果报文的指定字段携带有第二指示，防护设备确定接收到响应报文，指定字段为预先约定的响应报文需要携带第一指示的字段。
本实现方式中，防护设备向第一报文的源地址发送第一重传报文之后，后续接收到与第一报文的源地址和目的地址分别相同的报文后，基于该报文的报文头中的目标字段内容，采用与计算第一指示相同的计算方式计算得到指示值，通过比对该报文的指定字段的值是否与计算得到的指示值相同，以验证该报文是否为第一重传报文对应的响应报文。防护设备无需存储生成的第一指示。
可选地，目标字段内容包括源IP地址、源端口号、目的IP地址、目的端口号、源连接标识或目的连接标识中的一个或多个。
由同一设备发往另一设备的不同报文中，上述这些目标字段内容都是相同的。
可选地，防护设备拦截目的地址为受保护设备的互联网协议IP地址的第一报文的实现方式，包括：确定受保护设备受到流量攻击的情况下，防护设备拦截目的地址为受保护设备的IP地址的报文。
本申请中，当受保护设备受到流量攻击时，防护设备拦截目的地址为该受保护设备的IP地址的报文。当受保护设备未受到流量攻击时，防护设备不拦截目的地址为该受保护设备的IP地址的报文。这样既能够对受保护设备进行有效防护，又能尽量降低防护设备的处理开销。
第二方面，提供了一种防护设备。所述防护设备包括多个功能模块，所述多个功能模块相互作用，实现上述第一方面及其各实施方式中的方法。所述多个功能模块可以基于软件、硬件或软件和硬件的结合实现，且所述多个功能模块可以基于具体实现进行任意组合或分割。
第三方面，提供了一种防护设备，包括：存储器、网络接口和至少一个处理器，
所述存储器用于存储程序指令，
所述至少一个处理器读取所述存储器中保存的程序指令后，使得所述防护设备执行上述第一方面及其各实施方式中的方法。
第四方面，提供了一种计算机可读存储介质，所述计算机可读存储介质上存储有指令，当所述指令被处理器执行时，实现上述第一方面及其各实施方式中的方法。
第五方面，提供了一种计算机程序产品，包括计算机程序，所述计算机程序被处理器执行时，实现上述第一方面及其各实施方式中的方法。
第六方面，提供了一种芯片，芯片包括可编程逻辑电路和/或程序指令，当芯片运行时，实现上述第一方面及其各实施方式中的方法。
附图说明
图1是本申请实施例提供的一种应用场景的示意图；
图2是本申请实施例提供的一种防护设备的结构示意图；
图3是本申请实施例提供的一种报文源地址识别方法的流程示意图；
图4是本申请实施例提供的另一种报文源地址识别方法的流程示意图；
图5是本申请实施例提供的一种防护设备的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
QUIC协议是一种基于UDP的低时延传输层协议。目前，攻击者会通过发送大量的QUIC报文攻击基于QUIC协议对外提供服务的受保护设备，导致该受保护设备拒绝服务。而采用依赖于防护设备的限速机制的UDP flood攻击防御方式时，防护设备无法区分访问受保护设备的QUIC报文是来自正常客户端的正常报文还是来自攻击者的攻击报文，导致正常报文也可能被防护设备丢弃，造成正常业务受损。可选地，QUIC报文包括原始(initial)报文、重传(retry)报文、关闭连接(connection close)报文、业务报文等。其中，原始报文也称为初始化报文，用于协商连接参数，比如加密密钥。重传报文用于验证客户端的合法性。关闭连接报文用于关闭当前连接。
有鉴于此，本申请实施例提出了一种识别报文源地址的技术方案。防护设备通过实施本技术方案，在拦截到一个原始报文、且该原始报文的目的地址为基于QUIC协议提供服务的受保护设备的IP地址时，向该原始报文的源地址发送重传报文。如果防护设备未接收到该重传报文对应的响应报文，则将该原始报文的源地址识别为攻击源地址，以便后续将来自该攻击源地址的报文识别为攻击报文，进而实现对攻击报文的有效防御。
可选地，如果防护设备接收到上述重传报文对应的响应报文，则防护设备将该原始报文 的源地址识别为正常源地址，以便后续将来自该正常源地址的报文识别为正常报文并发送至受保护设备，保证正常业务的运行。
本申请中，防护设备基于发往受保护设备的报文的源地址，能够区分该报文是来自正常客户端的正常报文还是来自攻击者的攻击报文，进而阻止来自攻击者的攻击报文发往受保护设备，并向受保护设备放行来自正常客户端的正常报文，既能有效防御攻击，又能保证正常业务的运行，提高了正常业务的运行可靠性。
在一些实施例中，防护设备基于黑白名单机制对拦截到的报文进行处理。其中，黑名单中记录有攻击源地址，白名单中记录有正常源地址。可选地，黑名单中的攻击源地址包括防护设备识别得到的历史攻击源地址和/或由外部输入的已知攻击源地址。白名单中的正常源地址包括防护设备识别得到的历史正常源地址和/或由外部输入的已知正常源地址。本实施例中，如果防护设备拦截到目的地址为受保护设备的IP地址、源地址为未知地址的原始报文，则防护设备向该原始报文的源地址发送重传报文。如果防护设备拦截到目的地址为受保护设备的IP地址、源地址为未知地址的非原始报文，则防护设备丢弃该非原始报文。如果防护设备拦截到目的地址为受保护设备的IP地址、源地址为攻击源地址的报文，则防护设备丢弃该报文。如果防护设备拦截到目的地址为受保护设备的IP地址、源地址为正常源地址的报文，则防护设备向该受保护设备发送该报文。
可选地，黑名单中的攻击源地址设置有老化时间，即黑名单中的攻击源地址具有时效性。由于攻击者可能每隔一段时间会更新用来发起DDoS攻击所使用的虚拟源地址，因此针对黑名单设置老化机制，清理黑名单中的无效攻击源地址，一方面能够减少对防护设备的存储资源的浪费，另一方面能够减少黑名单中的攻击源地址的数量，以提高防护设备对黑名单的查询效率，进而提高防护设备的防护效率。
可选地，白名单中的正常源地址设置有老化时间，即白名单中的正常源地址具有时效性。由于正常客户端可能只在某段时间内对受保护设备具有访问需求，针对白名单设置老化机制，清理白名单中的过期正常源地址，一方面能够减少对防护设备的存储资源的浪费，另一方面能够减少白名单中的正常源地址的数量，以提高防护设备对白名单的查询效率，进而提高防护设备的防护效率。
本申请中，针对防护设备中的黑名单和/或白名单设置老化机制，能够使防护设备更好地应对网络环境的变化。
上述技术方案识别报文源地址的基本原理在于，根据QUIC协议的要求，客户端想要访问受保护设备时，首先需要与受保护设备建立通信连接。在建立通信连接的过程中，客户端会向受保护设备发送原始报文。本申请中，防护设备拦截发往受保护设备的报文，当拦截到原始报文，防护设备向该原始报文的源地址发送重传报文。对于正常客户端而言，如果正常客户端接收到重传报文，那么正常客户端会响应该重传报文，即发送该重传报文对应的响应报文。而对于攻击者而言，由于攻击者使用虚假的源IP地址向受保护设备发送报文，因此不会响应该重传报文。基于此，本申请中防护设备能够通过是否接收到重传报文对应的响应报文，来判断拦截到的原始报文的源地址为攻击源地址还是正常源地址，实现对报文源地址的有效识别。另外，对于正常客户端而言，在向受保护设备发送原始报文后，如果接收到重传报文，则会向受保护设备发送该重传报文对应的响应报文，以验证自身合法性。正常客户端无需区分接收到的重传报文是防护设备发送的还是受保护设备发送的，只需按照现有QUIC 协议进行响应即可，因此本申请的技术方案无需对客户端进行改进，实现简单。
本申请提出的技术方案用于防御攻击者对基于QUIC协议提供服务的受保护设备发起的DDoS攻击。
下面从应用场景、硬件装置、软件装置、方法流程等多个角度，对本技术方案进行详细介绍。
下面对本申请实施例的应用场景举例说明。
例如，图1是本申请实施例提供的一种应用场景的示意图。图1示出的应用场景为一种典型的DDoS防护场景。如图1所示，该防护场景主要涉及到四个网络设备，这四个网络设备分别是正常客户端、攻击者、防护设备和受保护设备。下面对这四个网络设备分别举例说明。
(1)正常客户端
正常客户端为正常流量的发起方。正常客户端通过生成正常流量并向服务器发送正常流量，从而访问服务器上提供的服务。本申请实施例中，正常客户端为支持QUIC协议的应用程序。正常客户端通过QUIC协议访问服务器上提供的服务。正常客户端例如为浏览器软件或者业务客户端软件。可选地，正常客户端安装于互联网中的各种具有计算能力的设备中。互联网中的正常客户端发起正常流量后，防护设备拦截正常流量并对正常流量进行安全检测，在确定正常流量无威胁的情况下，防护设备将正常流量转发至受保护网络中的受保护设备。
(2)攻击者
攻击者通过工具、僵尸主机或者代理生成并向受保护设备发送攻击流量。可选地，攻击者位于互联网中，即，攻击者从互联网向受保护网络中的受保护设备发起攻击。
(3)受保护设备
受保护设备位于受保护网络中。从受保护设备的角度来看，受保护设备所在的受保护网络为内部网络，互联网为外部网络。可选地，受保护网络包括一个或多个局域网。受保护设备为受保护的服务器。受保护设备用于向正常客户端提供服务。本申请实施例中，受保护设备基于QUIC协议提供服务。受保护设备包括但不限于应用服务器或网页服务器。其中，应用服务器包括但不限于游戏服务器、视频应用服务器、文件服务器、搜索引擎服务器、即时通信服务器等等。网页服务器也称万维网(world wide web，web)服务器或者网站服务器。
(4)防护设备
防护设备部署于互联网与受保护网络之间。换句话说，防护设备部署在受保护网络的边界，用于保护受保护网络中的受保护设备免受攻击。防护设备对进入受保护网络的流量进行安全性检测，从而确认流量是正常流量还是攻击流量。此外，防护设备会阻断攻击流量从而保证受保护设备的安全性，同时转发正常流量从而保证受保护设备能向正常客户端提供服务。防护设备包括但不限于防火墙、安全网关(如路由器或交换机)、入侵检测系统(intrusion detection system，IDS)类设备、入侵防御系统(intrusion prevention system，IPS)类设备、统一威胁管理(unified threat management，UTM)设备、反病毒(anti-virus，AV)设备、抗分布式拒绝服务攻击(anti-DDoS)设备、下一代防火墙(next generation firewall，NGFW)中一项或多项的集成。
下面对防护设备的基本硬件结构举例说明。
例如，图2是本申请实施例提供的一种防护设备的结构示意图。如图2所示，防护设备200包括中央处理器(central processing unit，CPU)201、专用硬件芯片202和至少一个网络接口203。其中，CPU 201和专用硬件芯片202可统称为处理器。可选地，结合图1来看，图2中的防护设备200是图1所示的防护设备。
CPU 201是指通用的中央处理器，其扩展性和灵活性较高。CPU 201例如是一个单核处理器(single-CPU)，又如是一个多核处理器(multi-CPU)。
专用硬件芯片202是一个高性能处理的硬件模块。专用硬件芯片202包括专用集成电路(application-specific integrated circuit，ASIC)、现场可编程逻辑门阵列(field-programmable gate array，FPGA)或者网络处理器(network processer，NP)中的至少一项。
至少一个网络接口203例如包括图2中的网络接口1、网络接口2、网络接口3……网络接口n。网络接口203使用任何收发器一类的装置，用于与其它设备或通信网络通信。例如，图2中的网络接口1与受保护设备通信，图2中的网络接口2与正常客户端通信。可选地，网络接口203包括有线网络接口或者无线网络接口中的至少一项。其中，有线网络接口例如为以太网接口。以太网接口例如是光接口，电接口或其组合。无线网络接口例如为无线受保护网络(wireless local area networks，WLAN)接口，蜂窝网络接口或其组合等。
至少一个网络接口203与专用硬件芯片202之间，以及专用硬件芯片202与CPU 201之间通过内部连接204相连。内部连接204包括一通路，在网络接口203、专用硬件芯片202与CPU 201之间传输数据。可选的，内部连接204是单板或总线。例如，内部连接204为以太网、光纤信道(fibre channel)、PCI-E(peripheral component interconnect express，PCI Express，一种高速串行计算机总线)、RapidIO(一种高性能、低引脚数、基于数据包交换的互连体系结构)、无限带宽(InfiniBand)或XAUI总线(一个接口扩展器，特点是把以太网媒体访问控制(Media Access Control，MAC)层与物理层相连)。
可选地，防护设备200还包括内容可寻址存储器(content addressable memory，CAM)205。CAM 205例如是三态内容寻址存储器(ternary content addressable memory，TCAM)等。CAM 205用于存储具有攻击风险的受保护设备的IP地址和/或不具有攻击风险的受保护设备的IP地址。可选地，CAM 205独立存在，并通过上述内部连接204与专用硬件芯片202相连接。或者，CAM 205和专用硬件芯片202集成在一起，即CAM 205作为专用硬件芯片202内部的存储器。
可选地，防护设备200还包括存储器206。存储器206例如是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备，又如是随机存取存储器(random access memory，RAM)或者可存储信息和指令的其它类型的动态存储设备，又如是电可擦可编程只读存储器(electrically erasable programmable read-only Memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备，或者是能够用于携带或存储具有指令或数据结构形式的期望的程序代码208并能够由计算机存取的任何其它介质，但不限于此。可选地，存储器206还用于分别存储黑名单和白名单，黑名单包括攻击源的IP地址，白名单包括正常客户端的IP地址。黑名单和白名单都能够被CPU 201访问。存储器206例如是独立存在，并通过内部连接204与CPU 201相连接。或者存储器206 和CPU 201集成在一起。
存储器206中存储有操作系统207和程序代码208。可选地，CPU 201从存储器206中读取操作系统207并运行该操作系统207，CPU 201还从存储器206读取程序代码208，通过在该操作系统207上运行该程序代码208实现本申请实施例提供的方法。例如，防护设备200是图1所示的防护设备，CPU 201在运行程序代码208的过程中，执行以下过程：防护设备200拦截目的地址为受保护设备的IP地址的第一报文，受保护设备基于QUIC协议提供服务；响应于第一报文为原始报文，防护设备200向第一报文的源地址发送第一重传报文；如果防护设备200未接收到第一重传报文对应的响应报文，防护设备200将第一报文的源地址识别为攻击源地址。
可选地，上述器件分别设置在彼此独立的芯片上，或者至少部分的或者全部的设置在同一块芯片上。将各个器件独立设置在不同的芯片上，还是整合设置在一个或者多个芯片上，往往取决于产品设计的需要。本申请实施例对上述器件的具体实现形式不做限定。
下面对本申请实施例的方法流程举例说明。
图3是本申请实施例提供的一种报文源地址识别方法300的流程示意图。方法300包括以下步骤301至步骤304。
可选地，方法300所基于的网络部署场景如图1所示。方法300中的防护设备为图1中的防护设备。方法300中流经防护设备的流量来自图1中的正常客户端或攻击者。方法300中的受保护设备为图1中的受保护设备。
方法300中的防护设备包括但不限于一台物理设备、或者包含多台物理设备的分布式系统(有时也称为防护系统)。可选地，方法300中的防护设备具有图2所示的硬件结构。
步骤301、防护设备拦截目的地址为受保护设备的IP地址的第一报文。
可选地，防护设备在满足预定条件的情况下，启动方法300所示的流程。预定条件包括但不限于：受保护设备当前受攻击的情况、或者防护设备的资源利用率低于设定阈值、或者接收到了受保护设备的防护请求等等。
例如在预定条件为受保护设备当前受攻击的情况时，防护设备在确定受保护设备正在受到攻击的情况下，启动方法300所示的流程。具体地，当受保护设备受到流量攻击时，防护设备拦截目的地址为该受保护设备的IP地址的报文。当受保护设备未受到流量攻击时，防护设备不拦截目的地址为该受保护设备的IP地址的报文。这样既能够对受保护设备进行有效防护，又能尽量降低防护设备的处理开销。
可选地，当单位时间内流经防护设备的流量中目的地址为同一受保护设备的IP地址的报文数量高于数量阈值时，防护设备确定该受保护设备受到流量攻击。
步骤302、响应于第一报文为原始报文，防护设备向第一报文的源地址发送第一重传报文。
可选地，第一重传报文携带有第一指示。第一指示在第一重传报文的指定字段，该指定字段为预先约定的重传报文用于携带第一指示的字段。这里的预先约定可理解为协议约定或预先协商。可选地，第一指示在第一重传报文的令牌(token)字段，也即是，第一指示为第一重传报文的令牌字段的值。防护设备在确定拦截到的第一报文为原始报文之后，生成第一指示。本申请实施例提供了防护设备生成第一指示的以下三种实现方式。
第一种实现方式，防护设备根据第一报文的报文头中的目标字段内容生成第一指示。
可选地，防护设备对第一报文的报文头中的目标字段内容执行目标操作，以得到第一指示。该目标操作包括求和操作、异或操作或哈希操作中的一种或多种。
可选地，目标字段内容包括源IP地址、源端口号、目的IP地址、目的端口号、源连接标识(identity，ID)或目的连接标识中的一个或多个。例如，第一报文的报文头中多个字段的内容如表1所示。
表1
Figure PCTCN2022091003-appb-000001
假设选取源IP地址、源端口号和目的连接ID进行求和操作，计算出32位的值作为令牌字段的值来表示第一指示。则在第一重传报文中携带第一指示，包括：将第一重传报文中令牌字段的值设置为0x681b7773+0xcf58+0xfb5114＝0x691797df。
本实现方式中，防护设备根据第一报文的报文头中的字段内容生成第一指示，使得防护设备能够针对不同的原始报文生成不同的指示，即防护设备生成的指示并非是一成不变的，进而降低防护设备生成的指示被攻击者窃取后，被攻击者进行重放攻击的风险。
第二种实现方式，防护设备根据随机数生成第一指示。
可选地，随机数由防护设备定期生成。例如，防护设备每1分钟刷新一个随机数，比如当前随机数为418818144890，1分钟以后刷新为742378908452。
本实现方式中，防护设备根据定期更新的随机数生成第一指示，使得防护设备能够定期更新生成的指示，即防护设备生成的指示会随时间发生变化，并非是一成不变的，进而降低防护设备生成的指示被攻击者窃取后，被攻击者进行重放攻击的风险。
第三种实现方式，防护设备根据当前时间戳生成第一指示。
可选地，当前时间戳为防护设备对第一报文的接收时间戳，或者当前时间戳为防护设备生成第一指示的开始时间戳。这里的时间戳为Unix时间戳(Unix timestamp)。例如，当前时间为2021/8/27 15:32:00，转换后得到的时间戳为1630049520。
本实现方式中，防护设备根据当前时间戳生成第一指示，使得防护设备能够在不同时刻生成不同的指示，即防护设备生成的指示会随时间发生变化，并非是一成不变的，进而降低防护设备生成的指示被攻击者窃取后，被攻击者进行重放攻击的风险。
可选地，上述三种实现方式也可部分或全部结合执行。防护设备根据第一报文的报文头中的目标字段内容、随机数、当前时间戳中的任意两种或全部生成第一指示。
本申请实施例中，防护设备向第一报文的源地址发送第一重传报文之后，需要判断在一段时间内是否接收到该第一重传报文对应的响应报文。可选地，第一重传报文携带有第一指示，则第一重传报文对应的响应报文是源地址为第一报文的源地址、目的地址为受保护设备的IP地址、并且携带有第一指示的报文。
可选地，响应报文为原始报文。响应报文中的第一指示在响应报文的令牌字段。对于正 常客户端而言，在向受保护设备发送原始报文之后，如果接收到重传报文，则会向受保护设备再次发送原始报文，并将该原始报文的令牌字段的值设置为接收到的重传报文的令牌字段的值。而对于攻击者而言，攻击者只会向受保护设备持续发送报文，并不会响应接收到的重传报文。这种实现方式下，防护设备将接收到的源地址为第一报文的源地址、目的地址为受保护设备的IP地址、并且令牌字段的值与第一重传报文的令牌字段的值相同的报文作为第一重传报文对应的响应报文。
可选地，在上述三种实现方式中，防护设备在生成携带在第一重传报文中的第一指示之后，存储第一指示与第一报文的源地址和目的地址的对应关系，以便验证后续接收到的与第一报文的源地址和目的地址分别相同的报文中是否携带有该第一指示，进而判断该报文是否为第一重传报文对应的响应报文。
或者，由于第一重传报文对应的响应报文的目标字段内容与第一报文的目标字段内容分别相同，因此在上述第一种实现方式中，防护设备在生成携带在第一重传报文中的第一指示之后，无需存储第一指示。防护设备向第一报文的源地址发送第一重传报文之后，后续接收到与第一报文的源地址和目的地址分别相同的报文后，基于该报文的报文头中的目标字段内容，采用与计算第一指示相同的计算方式计算得到指示值，通过比对该报文的指定字段的值是否与计算得到的指示值相同，以验证该报文是否为第一重传报文对应的响应报文。具体实现过程包括：防护设备在接收到源地址为第一报文的源地址、目的地址为受保护设备的IP地址的报文之后，对该报文的报文头中的目标字段内容执行目标操作，以得到第二指示。如果该报文的指定字段携带的指示与第二指示相同，防护设备确定接收到第一重传报文对应的响应报文。其中，该目标操作为防护设备生成第一指示时采用的操作。该指定字段为预先约定的响应报文需要携带第一指示的字段。这里的预先约定可理解为协议约定或预先协商。可选地，该指定字段为令牌字段。
本申请实施例中，防护设备通过在第一重传报文中携带第一指示，验证后续接收到的报文中是否携带有该第一指示，以确定是否接收到第一重传报文对应的响应报文，实现简单。
步骤303、如果防护设备未接收到第一重传报文对应的响应报文，防护设备将第一报文的源地址识别为攻击源地址。
可选地，如果防护设备未接收到第一重传报文对应的响应报文，防护设备更新第一报文的源地址对应的验证未通过次数。如果更新后的第一报文的源地址对应的验证未通过次数达到阈值，防护设备将第一报文的源地址识别为攻击源地址。
进一步地，如果更新后的第一报文的源地址对应的验证未通过次数未达到阈值，防护设备后续接收到来自第一报文的源地址、目的地址为受保护设备的IP地址的另一原始报文后，向第一报文的源地址发送第二重传报文，以对第一报文的源地址进行再次验证。换句话说，如果更新后的第一报文的源地址对应的验证未通过次数未达到阈值，防护设备对该第一报文的源地址继续进行验证。
可选地，该阈值大于或等于1。如果该阈值等于1，则防护设备对源地址一次验证未通过，就将该源地址识别为攻击源地址。如果该阈值大于1，则防护设备对同一源地址多次验证未通过，才将该源地址识别为攻击源地址。该阈值可根据实际防护需求进行设置和更改，本申请实施例对该阈值的具体取值不做限定。
可选地，防护设备在将第一报文的源地址识别为攻击源地址之后，将后续接收到的来自 第一报文的源地址的报文视为攻击报文，进而实现对攻击报文的有效防御。
步骤304、如果防护设备接收到第一重传报文对应的响应报文，防护设备将第一报文的源地址识别为正常源地址。
进一步地，防护设备将第一报文的源地址识别为正常源地址之后，防护设备向第一报文的源地址发送关闭连接报文，该关闭连接报文用于指示结束本次连接，以便于发送第一报文的设备需要访问受保护设备时，向受保护设备重新发送原始报文。当防护设备再接收到来自第一报文的源地址的报文后，防护设备将该报文发送至受保护设备，以使第一报文的源端设备与受保护设备之间能够正常通信。
可选地，防护设备在将第一报文的源地址识别为正常源地址之后，将后续接收到的来自第一报文的源地址的报文视为正常报文并发送至受保护设备，保证正常业务的运行。
本申请实施例中，防护设备基于发往受保护设备的报文的源地址，能够区分该报文是来自正常客户端的正常报文还是来自攻击者的攻击报文，进而阻止来自攻击者的攻击报文发往受保护设备，并向受保护设备放行来自正常客户端的正常报文，既能有效防御攻击，又能保证正常业务的运行，提高了正常业务的运行可靠性。
可选地，上述步骤302的一种实现方式为：响应于第一报文的源地址为未知地址、且第一报文为原始报文，防护设备向第一报文的源地址发送第一重传报文。可选地，如果第一报文的源地址为已知地址，或者第一报文不为原始报文，则防护设备不会向第一报文的源地址发送第一重传报文。
可选地，如果第一报文的源地址为未知地址、且第二报文不为原始报文，则防护设备丢弃该第一报文。由于正常客户端需要与受保护设备建立通信连接之后才能访问受保护设备，因此正常客户端在向受保护设备发送业务报文之前，会向受保护设备发送原始报文以与受保护设备建立通信连接。第一报文的源地址为未知地址，说明发送第一报文的设备没有向受保护设备发送过原始报文，或者向受保护设备发送原始报文后没有响应过防护设备发送的重传报文，因此防护设备未将该源地址识别为正常源地址。这种情况下，第一报文的源地址多数为攻击源地址，因此防护设备将该第一报文直接丢弃。
可选地，如果第一报文的源地址为攻击源地址(已知地址)，则防护设备丢弃该第一报文，实现对攻击报文的有效防御。
可选地，如果第一报文的源地址为正常源地址(已知地址)，则防护设备向受保护设备发送该第一报文，以实现第一报文的源端设备与受保护设备之间的正常通信。
在步骤302的该实现方式下，防护设备中存储有黑名单和白名单，黑名单中记录有已知的攻击源地址，白名单中记录有已知的正常源地址。防护设备还拦截目的地址为受保护设备的IP地址的第二报文；响应于第二报文的源地址为未知地址、且第二报文不为原始报文，防护设备丢弃第二报文。和/或，防护设备还拦截目的地址为受保护设备的IP地址的第三报文；响应于第三报文的源地址为攻击源地址，防护设备丢弃第三报文。和/或，防护设备还拦截目的地址为受保护设备的IP地址的第四报文；响应于第四报文的源地址为正常源地址，防护设备向受保护设备发送第四报文。
可选地，结合步骤302的上述实现方式，通过以下实施例对本申请技术方案的实现过程进行详细说明。图4是本申请实施例提供的一种报文源地址识别方法400的流程示意图。方 法400包括以下步骤401至步骤410。
可选地，方法400所基于的网络部署场景如图1所示。方法400中的防护设备为图1中的防护设备。方法400中流经防护设备的流量来自图1中的正常客户端或攻击者。方法400中的受保护设备为图1中的受保护设备。
方法400中的防护设备包括但不限于一台物理设备、或者包含多台物理设备的分布式系统(有时也称为防护系统)。可选地，方法400中的防护设备具有图2所示的硬件结构。
步骤401、防护设备拦截目的地址为受保护设备的IP地址的报文。
该报文为防护设备拦截到的目的地址为受保护设备的IP地址的任意报文。例如该报文可能是上述第一报文、第二报文、第三报文或第四报文。此步骤401的解释和实现具体可参考上述步骤301中的相关描述，本申请实施例在此不再赘述。
步骤402、防护设备判断该报文的源地址为未知地址、攻击源地址或正常源地址。如果该报文的源地址为未知IP地址，则执行步骤403；如果该报文的源地址为攻击源地址，则执行步骤409；如果该报文的源地址为正常源地址，则执行步骤410。
可选地，防护设备中存储有黑名单和白名单。如果该报文的源地址在黑名单中，则防护设备确定该报文的源地址为攻击源地址。如果该报文的源地址在白名单中，则防护设备确定该报文的源地址为正常源地址。如果该报文的源地址既不在黑名单中，又不在白名单中，则防护设备确定该报文的源地址为未知地址。
可选地，防护设备先查询存储的黑名单中是否记录有该报文的源地址。如果黑名单中未记录有该报文的源地址，则防护设备再查询存储的白名单中是否记录有该报文的源地址。或者，防护设备先查询存储的白名单中是否记录有该报文的源地址。如果白名单中未记录有该报文的源地址，则防护设备再查询存储的黑名单中是否记录有该报文的源地址。又或者，防护设备同时分别查询存储的黑名单和白名单中是否记录有该报文的源地址。本申请实施例对防护设备查询黑名单和白名单的先后顺序不做限定。
步骤403、防护设备判断该报文是否为原始报文。如果该报文为原始报文，则执行步骤404；如果该报文不为原始报文，则执行步骤409。
步骤404、防护设备向该报文的源地址发送携带有指示1的重传报文。
此步骤404的解释和实现具体可参考上述步骤302中的相关描述，本申请实施例在此不再赘述。
步骤405、防护设备判断是否接收到该重传报文对应的响应报文。如果防护设备未接收到该重传报文对应的响应报文，则执行步骤406；如果防护设备接收到该重传报文对应的响应报文，则执行步骤407。
其中，重传报文对应的响应报文的源地址为步骤401中防护设备拦截到的报文的源地址，该响应报文的目的地址为步骤401中防护设备拦截到的报文的目的地址(即受保护设备的IP地址)。此步骤405的解释和实现具体可参考上述步骤302中的相关描述，本申请实施例在此不再赘述。
步骤406、防护设备将该报文的源地址识别为攻击源地址。
此步骤406的解释和实现具体可参考上述步骤303中的相关描述，本申请实施例在此不再赘述。
步骤407、防护设备将该报文的源地址识别为正常源地址。
此步骤407的解释和实现具体可参考上述步骤304中的相关描述，本申请实施例在此不再赘述。
步骤408、防护设备向该报文的源地址发送关闭连接报文。
如果该报文的源地址所属的设备仍需访问受保护设备，在接收到该关闭连接报文后，会再次向受保护设备发送原始报文。当防护设备接收到来自正常源地址的报文(无论是原始报文还是业务报文等)后，防护设备会将该报文发送至受保护设备，以使正常源地址所属的设备与受保护设备之间能够建立通信连接并进行正常通信。
步骤409、防护设备丢弃该报文。
步骤410、防护设备向受保护设备发送该报文。
本申请实施例中通过黑名单存储已知攻击源地址、或通过白名单存储已知正常源地址。防护设备在后续接收到原始报文时，在基于重传报文对原始报文的源地址进行验证之前，通过将原始报文的源地址与黑名单或白名单进行匹配，能够减少需要进行验证的原始报文数量，提升防护设备的防护效率。本申请实施例提供的报文源地址识别方法的步骤的先后顺序能够进行适当调整，步骤也能够根据情况进行相应增减。任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化的方法，都应涵盖在本申请的保护范围之内。
下面对本申请实施例的虚拟装置举例说明。
图5是本申请实施例提供的一种防护设备的结构示意图。具有图5所示结构的防护设备实现上述实施例描述的方案中防护设备的功能。可选地，图5所示的防护设备是图1所示应用场景中的防护设备、图2所示的防护设备，执行图3或图4所示实施例中描述的防护设备的功能。如图5所示，防护设备50包括处理模块501和发送模块502。
处理模块501，用于拦截目的地址为受保护设备的IP地址的第一报文，受保护设备基于QUIC协议提供服务。发送模块502，用于响应于第一报文为原始报文，向第一报文的源地址发送第一重传报文。处理模块501，还用于如果防护设备未接收到第一重传报文对应的响应报文，将第一报文的源地址识别为攻击源地址。
这里，处理模块501和发送模块502的实现过程请参照前面方法实施例中的描述。例如，处理模块501采用方法300中的步骤301拦截目的地址为受保护设备的IP地址的第一报文；发送模块502采用方法300中的步骤302响应于第一报文为原始报文，向第一报文的源地址发送第一重传报文；处理模块501还采用方法300中的步骤303在防护设备未接收到第一重传报文对应的响应报文时，将第一报文的源地址识别为攻击源地址。本申请实施例在此不再重复描述。
可选地，处理模块501用于：如果防护设备未接收到第一重传报文对应的响应报文，更新第一报文的源地址对应的验证未通过次数；并且，如果更新后的第一报文的源地址对应的验证未通过次数达到阈值，将第一报文的源地址识别为攻击源地址。这里，处理模块501的实现过程可参考方法300中的步骤303的相关描述，或者，可参考方法400中的步骤405和步骤406的相关描述。
可选地，处理模块501还用于：如果防护设备接收到第一重传报文对应的响应报文，将第一报文的源地址识别为正常源地址。这里，处理模块501的实现过程可参考方法300中的步骤304的相关描述，或者，可参考方法400中的步骤405和步骤407的相关描述。
可选地，发送模块502还用于：在将第一报文的源地址识别为正常源地址之后，向第一报文的源地址发送关闭连接报文，关闭连接报文用于指示结束本次连接，以便于发送第一报文的设备需要访问受保护设备时，向受保护设备重新发送原始报文。这里，发送模块502的实现过程可参考方法400中的步骤408的相关描述。
可选地，发送模块502还用于：响应于第一报文的源地址为未知地址、且第一报文为原始报文，向第一报文的源地址发送第一重传报文。这里，发送模块502的实现过程可参考方法300中的步骤302的相关描述，或者，可参考方法400中的步骤404的相关描述。
可选地，处理模块501还用于：拦截目的地址为受保护设备的IP地址的第二报文；响应于第二报文的源地址为未知地址、且第二报文不为原始报文，丢弃第二报文。这里，处理模块501的实现过程可参考方法400中的步骤403和步骤409的相关描述。
可选地，第一重传报文携带有第一指示，响应报文是源地址为第一报文的源地址、目的地址为受保护设备的IP地址、并且携带有第一指示的报文。
可选地，响应报文为原始报文。
可选地，第一指示分别在第一重传报文的令牌字段以及响应报文的令牌字段。
可选地，处理模块501还用于：在向第一报文的源地址发送第一重传报文之前，根据第一报文的报文头中的目标字段内容生成第一指示；或者，根据随机数生成第一指示；或者，根据当前时间戳生成第一指示。这里，处理模块501的实现过程可参考方法300中的步骤302的相关描述。
可选地，处理模块501用于：对目标字段内容执行目标操作，以得到第一指示，目标操作包括求和操作、异或操作或哈希操作中的一种或多种。
可选地，处理模块501还用于：在向第一报文的源地址发送第一重传报文之后，在接收到源地址为第一报文的源地址、目的地址为受保护设备的IP地址的报文之后，对报文的报文头中的目标字段内容执行目标操作，以得到第二指示；如果报文的指定字段携带有第二指示，确定接收到响应报文，指定字段为预先约定的响应报文需要携带第一指示的字段。这里，处理模块501的实现过程可参考方法300中的步骤302的相关描述，或者，可参考方法400中的步骤405。
可选地，目标字段内容包括源IP地址、源端口号、目的IP地址、目的端口号、源连接标识或目的连接标识中的一个或多个。
可选地，处理模块501用于：确定受保护设备受到流量攻击时，拦截目的地址为受保护设备的IP地址的报文。这里，处理模块501的实现过程可参考方法300中的步骤301的相关描述。
附图5所描述的装置实施例仅仅是示意性的，例如，所述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个模块或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。在本申请各个实施例中的各功能模块可以集成在一个处理模块中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。附图5中上述各个模块既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。例如，采用软件实现时，上述处理模块501可以是由附图2中的CPU 201读取存储器中存储的程序代码后，生成的软件功能模块来实现。图5中上述各个模块也可以由防护设备中的不同硬件分别实现，例如处理模块501由附图2中CPU 201中的一部分处理资 源(例如多核处理器中的一个核)实现，而发送模块502由附图2的网络接口203和CPU 201中的其余部分处理资源(例如多核处理器中的其他核)完成，或者由附图2的专用硬件芯片202来完成。显然上述功能模块也可以采用软件硬件相结合的方式来实现，例如发送模块502由硬件可编程器件实现，而处理模块501是由CPU读取存储器中存储的程序代码后，生成的软件功能模块。
本申请实施例还提供了一种防护设备，包括：存储器、网络接口和至少一个处理器，
所述存储器用于存储程序指令，
所述至少一个处理器读取所述存储器中保存的程序指令后，使得所述防护设备执行上述方法300或方法400中的步骤。可选地，该防护设备的硬件结构如图2所示。
本申请实施例还提供了一种计算机可读存储介质，所述计算机可读存储介质上存储有指令，当所述指令被处理器执行时，实现上述方法300或方法400中的步骤。
本申请实施例还提供了一种计算机程序产品，包括计算机程序，所述计算机程序被处理器执行时，实现上述方法300或方法400中的步骤。
本申请实施例中术语流量(traffic)也称网络流量(network traffic)或数据流量(data traffic)。流量是指在一个给定时间点通过网络传输的数据。例如，设备在时间点T接收的流量是指设备在时间点T接收的所有报文。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分可互相参考，每个实施例重点说明的都是与其他实施例的不同之处。
本申请实施例的说明书和权利要求书中的术语“第一”和“第二”等是用于区别不同的对象，而不是用于描述对象的特定顺序，也不能理解为指示或暗示相对重要性。例如，第一报文和第二报文用于区别不同的报文组，而不是用于描述报文的特定顺序。
在本申请实施例的描述中，除非另有说明，“至少一个”的含义是指一个或多个。“多个”的含义是指两个或两个以上。
A参考B，指的是A与B相同或者A为B的简单变形。
本申请中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示存在三种关系，例如，A和/或B，表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
可选地，在上述实施例中，全部或部分地通过软件、硬件、固件或者其任意组合来实现。可选地，当使用软件实现时，全部或部分地以计算机程序产品的形式实现。计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行计算机程序指令时，全部或部分地产生按照本申请实施例描述的流程或功能。可选地，计算机是通用计算机、专用计算机、计算机网络、或者其他可编程装置。可选地，计算机指令存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，计算机指令能够从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进 行传输。可选地，计算机可读存储介质是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。可选地，可用介质是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然能够对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (30)

  1. 一种报文源地址识别方法，其特征在于，所述方法包括：
    防护设备拦截目的地址为受保护设备的互联网协议IP地址的第一报文，所述受保护设备基于快速用户数据报协议网络连接QUIC协议提供服务；
    响应于所述第一报文为原始报文，所述防护设备向所述第一报文的源地址发送第一重传报文；
    如果所述防护设备未接收到所述第一重传报文对应的响应报文，所述防护设备将所述第一报文的源地址识别为攻击源地址。
  2. 根据权利要求1所述的方法，其特征在于，如果所述防护设备未接收到所述第一重传报文对应的响应报文，所述防护设备将所述第一报文的源地址识别为攻击源地址，包括：
    如果所述防护设备未接收到所述第一重传报文对应的响应报文，所述防护设备更新所述第一报文的源地址对应的验证未通过次数；
    如果更新后的所述第一报文的源地址对应的验证未通过次数达到阈值，所述防护设备将所述第一报文的源地址识别为攻击源地址。
  3. 根据权利要求1或2所述的方法，其特征在于，所述方法还包括：
    如果所述防护设备接收到所述第一重传报文对应的响应报文，所述防护设备将所述第一报文的源地址识别为正常源地址。
  4. 根据权利要求3所述的方法，其特征在于，在所述防护设备将所述第一报文的源地址识别为正常源地址之后，所述方法还包括：
    所述防护设备向所述第一报文的源地址发送关闭连接报文，所述关闭连接报文用于指示结束本次连接，以便于发送所述第一报文的设备需要访问所述受保护设备时，向所述受保护设备重新发送原始报文。
  5. 根据权利要求1至4任一所述的方法，其特征在于，所述响应于所述第一报文为原始报文，所述防护设备向所述第一报文的源地址发送第一重传报文，包括：
    响应于所述第一报文的源地址为未知地址、且所述第一报文为原始报文，所述防护设备向所述第一报文的源地址发送所述第一重传报文。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    所述防护设备拦截目的地址为所述受保护设备的IP地址的第二报文；
    响应于所述第二报文的源地址为未知地址、且所述第二报文不为原始报文，所述防护设备丢弃所述第二报文。
  7. 根据权利要求1至6任一所述的方法，其特征在于，所述第一重传报文携带有第一指 示，所述响应报文是源地址为所述第一报文的源地址、目的地址为所述受保护设备的IP地址、并且携带有所述第一指示的报文。
  8. 根据权利要求7所述的方法，其特征在于，所述响应报文为原始报文。
  9. 根据权利要求7或8所述的方法，其特征在于，所述第一指示分别在所述第一重传报文的令牌字段以及所述响应报文的令牌字段。
  10. 根据权利要求7至9任一所述的方法，其特征在于，所述防护设备向所述第一报文的源地址发送第一重传报文之前，所述方法还包括：
    所述防护设备根据所述第一报文的报文头中的目标字段内容生成所述第一指示；或者，
    所述防护设备根据随机数生成所述第一指示；或者，
    所述防护设备根据当前时间戳生成所述第一指示。
  11. 根据权利要求10所述的方法，其特征在于，所述防护设备根据所述第一报文的报文头中的目标字段内容生成所述第一指示，包括：
    所述防护设备对所述目标字段内容执行目标操作，以得到所述第一指示，所述目标操作包括求和操作、异或操作或哈希操作中的一种或多种。
  12. 根据权利要求11所述的方法，其特征在于，所述防护设备向所述第一报文的源地址发送第一重传报文之后，所述方法还包括：
    所述防护设备在接收到源地址为所述第一报文的源地址、目的地址为所述受保护设备的IP地址的报文之后，对所述报文的报文头中的所述目标字段内容执行所述目标操作，以得到第二指示；
    如果所述报文的指定字段携带有所述第二指示，所述防护设备确定接收到所述响应报文，所述指定字段为预先约定的响应报文需要携带所述第一指示的字段。
  13. 根据权利要求10至12任一所述的方法，其特征在于，所述目标字段内容包括源IP地址、源端口号、目的IP地址、目的端口号、源连接标识或目的连接标识中的一个或多个。
  14. 根据权利要求1至13任一所述的方法，其特征在于，所述防护设备拦截目的地址为受保护设备的互联网协议IP地址的第一报文之前，所述方法还包括：
    所述防护设备确定所述受保护设备受到流量攻击。
  15. 一种防护设备，其特征在于，包括：存储器、网络接口和至少一个处理器，
    所述存储器用于存储程序指令，
    所述至少一个处理器读取所述存储器中保存的程序指令后，使得所述防护设备执行以下操作：
    拦截目的地址为受保护设备的互联网协议IP地址的第一报文，所述受保护设备基于快速 用户数据报协议网络连接QUIC协议提供服务；
    响应于所述第一报文为原始报文，向所述第一报文的源地址发送第一重传报文；
    如果所述防护设备未接收到所述第一重传报文对应的响应报文，将所述第一报文的源地址识别为攻击源地址。
  16. 根据权利要求15所述的防护设备，其特征在于，所述程序指令被所述至少一个处理器读取后，使得所述防护设备执行以下操作：
    如果所述防护设备未接收到所述第一重传报文对应的响应报文，更新所述第一报文的源地址对应的验证未通过次数；
    如果更新后的所述第一报文的源地址对应的验证未通过次数达到阈值，将所述第一报文的源地址识别为攻击源地址。
  17. 根据权利要求15或16所述的防护设备，其特征在于，所述程序指令被所述至少一个处理器读取后，还使得所述防护设备执行以下操作：
    如果所述防护设备接收到所述第一重传报文对应的响应报文，将所述第一报文的源地址识别为正常源地址。
  18. 根据权利要求17所述的防护设备，其特征在于，所述程序指令被所述至少一个处理器读取后，还使得所述防护设备在将所述第一报文的源地址识别为正常源地址之后，执行以下操作：
    向所述第一报文的源地址发送关闭连接报文，所述关闭连接报文用于指示结束本次连接，以便于发送所述第一报文的设备需要访问所述受保护设备时，向所述受保护设备重新发送原始报文。
  19. 根据权利要求15至18任一所述的防护设备，其特征在于，所述程序指令被所述至少一个处理器读取后，使得所述防护设备执行以下操作：
    响应于所述第一报文的源地址为未知地址、且所述第一报文为原始报文，向所述第一报文的源地址发送所述第一重传报文。
  20. 根据权利要求19所述的防护设备，其特征在于，所述程序指令被所述至少一个处理器读取后，还使得所述防护设备执行以下操作：
    拦截目的地址为所述受保护设备的IP地址的第二报文；
    响应于所述第二报文的源地址为未知地址、且所述第二报文不为原始报文，丢弃所述第二报文。
  21. 根据权利要求15至20任一所述的防护设备，其特征在于，所述第一重传报文携带有第一指示，所述响应报文是源地址为所述第一报文的源地址、目的地址为所述受保护设备的IP地址、并且携带有所述第一指示的报文。
  22. 根据权利要求21所述的防护设备，其特征在于，所述响应报文为原始报文。
  23. 根据权利要求21或22所述的防护设备，其特征在于，所述第一指示分别在所述第一重传报文的令牌字段以及所述响应报文的令牌字段。
  24. 根据权利要求21至23任一所述的防护设备，其特征在于，所述程序指令被所述至少一个处理器读取后，使得所述防护设备在向所述第一报文的源地址发送第一重传报文之前，还执行以下操作：
    根据所述第一报文的报文头中的目标字段内容生成所述第一指示；或者，
    根据随机数生成所述第一指示；或者，
    根据当前时间戳生成所述第一指示。
  25. 根据权利要求24所述的防护设备，其特征在于，所述程序指令被所述至少一个处理器读取后，使得所述防护设备执行以下操作：
    对所述目标字段内容执行目标操作，以得到所述第一指示，所述目标操作包括求和操作、异或操作或哈希操作中的一种或多种。
  26. 根据权利要求25所述的防护设备，其特征在于，所述程序指令被所述至少一个处理器读取后，还使得所述防护设备在向所述第一报文的源地址发送第一重传报文之后，执行以下操作：
    在接收到源地址为所述第一报文的源地址、目的地址为所述受保护设备的IP地址的报文之后，对所述报文的报文头中的所述目标字段内容执行所述目标操作，以得到第二指示；
    如果所述报文的指定字段携带有所述第二指示，确定接收到所述响应报文，所述指定字段为预先约定的响应报文需要携带所述第一指示的字段。
  27. 根据权利要求24至26任一所述的防护设备，其特征在于，所述目标字段内容包括源IP地址、源端口号、目的IP地址、目的端口号、源连接标识或目的连接标识中的一个或多个。
  28. 根据权利要求15至27任一所述的防护设备，其特征在于，所述程序指令被所述至少一个处理器读取后，使得所述防护设备执行以下操作：
    确定所述受保护设备受到流量攻击时，拦截目的地址为所述受保护设备的IP地址的报文。
  29. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有指令，当所述指令被处理器执行时，实现如权利要求1至14任一所述的报文源地址识别方法。
  30. 一种计算机程序产品，其特征在于，包括计算机程序，所述计算机程序被处理器执行时，实现如权利要求1至14任一所述的报文源地址识别方法。
PCT/CN2022/091003 2021-10-15 2022-05-05 报文源地址识别方法及装置 WO2023060881A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP22879831.0A EP4366236A1 (en) 2021-10-15 2022-05-05 Method and apparatus for identifying source address of message
US18/609,958 US20240223584A1 (en) 2021-10-15 2024-03-19 Method for identifying source address of packet and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111203775.5 2021-10-15
CN202111203775.5A CN115987536A (zh) 2021-10-15 2021-10-15 报文源地址识别方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/609,958 Continuation US20240223584A1 (en) 2021-10-15 2024-03-19 Method for identifying source address of packet and apparatus

Publications (1)

Publication Number Publication Date
WO2023060881A1 true WO2023060881A1 (zh) 2023-04-20

Family

ID=85964820

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/091003 WO2023060881A1 (zh) 2021-10-15 2022-05-05 报文源地址识别方法及装置

Country Status (4)

Country Link
US (1) US20240223584A1 (zh)
EP (1) EP4366236A1 (zh)
CN (1) CN115987536A (zh)
WO (1) WO2023060881A1 (zh)

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103685293A (zh) * 2013-12-20 2014-03-26 北京奇虎科技有限公司 拒绝服务攻击的防护方法和装置
CN103701794A (zh) * 2013-12-20 2014-04-02 北京奇虎科技有限公司 拒绝服务攻击的识别方法和装置
CN103701795A (zh) * 2013-12-20 2014-04-02 北京奇虎科技有限公司 拒绝服务攻击的攻击源的识别方法和装置
CN108667829A (zh) * 2018-04-26 2018-10-16 腾讯科技（深圳）有限公司 一种网络攻击的防护方法、装置及存储介质
CN109309685A (zh) * 2018-10-31 2019-02-05 北京百度网讯科技有限公司 信息传输方法和装置
CN110798451A (zh) * 2019-09-29 2020-02-14 新华三信息安全技术有限公司 一种安全认证的方法及装置
WO2021061250A1 (en) * 2019-09-26 2021-04-01 Radware, Ltd. Detection and mitigation ddos attacks performed over quic communication protocol
US20210136105A1 (en) * 2019-10-31 2021-05-06 Visa International Service Association Security mechanisms for preventing retry or replay attacks

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108551446B (zh) * 2018-04-08 2020-11-27 东软集团股份有限公司 防攻击的syn报文处理方法、装置、防火墙及存储介质

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103685293A (zh) * 2013-12-20 2014-03-26 北京奇虎科技有限公司 拒绝服务攻击的防护方法和装置
CN103701794A (zh) * 2013-12-20 2014-04-02 北京奇虎科技有限公司 拒绝服务攻击的识别方法和装置
CN103701795A (zh) * 2013-12-20 2014-04-02 北京奇虎科技有限公司 拒绝服务攻击的攻击源的识别方法和装置
CN108667829A (zh) * 2018-04-26 2018-10-16 腾讯科技（深圳）有限公司 一种网络攻击的防护方法、装置及存储介质
CN109309685A (zh) * 2018-10-31 2019-02-05 北京百度网讯科技有限公司 信息传输方法和装置
WO2021061250A1 (en) * 2019-09-26 2021-04-01 Radware, Ltd. Detection and mitigation ddos attacks performed over quic communication protocol
CN110798451A (zh) * 2019-09-29 2020-02-14 新华三信息安全技术有限公司 一种安全认证的方法及装置
US20210136105A1 (en) * 2019-10-31 2021-05-06 Visa International Service Association Security mechanisms for preventing retry or replay attacks

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4366236A4

Also Published As

Publication number Publication date
EP4366236A4 (en) 2024-05-08
EP4366236A1 (en) 2024-05-08
CN115987536A (zh) 2023-04-18
US20240223584A1 (en) 2024-07-04

Similar Documents

Publication Publication Date Title
US11818167B2 (en) Authoritative domain name system (DNS) server responding to DNS requests with IP addresses selected from a larger pool of IP addresses
US10581907B2 (en) Systems and methods for network access control
Mohammadi et al. Slicots: An sdn-based lightweight countermeasure for tcp syn flooding attacks
US8661522B2 (en) Method and apparatus for probabilistic matching to authenticate hosts during distributed denial of service attack
US6775704B1 (en) System and method for preventing a spoofed remote procedure call denial of service attack in a networked computing environment
US9843590B1 (en) Method and apparatus for causing a delay in processing requests for internet resources received from client devices
JP2009534001A (ja) 悪質な攻撃の検出システム及びそれに関連する使用方法
CN110266678B (zh) 安全攻击检测方法、装置、计算机设备及存储介质
Mohammadi et al. SYN‐Guard: An effective counter for SYN flooding attack in software‐defined networking
WO2023040303A1 (zh) 网络流量控制方法以及相关系统
Lu et al. An SDN‐based authentication mechanism for securing neighbor discovery protocol in IPv6
Boppana et al. Analyzing the vulnerabilities introduced by ddos mitigation techniques for software-defined networks
Cao et al. 0-rtt attack and defense of quic protocol
US20230367875A1 (en) Method for processing traffic in protection device, and protection device
De Donno et al. A taxonomy of distributed denial of service attacks
Nagesh et al. A survey on denial of service attacks and preclusions
US20180331957A1 (en) Policy Enforcement Based on Host Value Classification
WO2023060881A1 (zh) 报文源地址识别方法及装置
Ameyed et al. A slow read attack using cloud
Fowler et al. Impact of denial of service solutions on network quality of service
CRISTESCU et al. Volumetric Distributed Denial-of-Service and Session Replay Attacks-Resistant AAA-RADIUS Solution Based on EAP and LDAP
CN114553452B (zh) 攻击防御方法及防护设备
Bae et al. An efficient detection of TCP Syn flood attacks with spoofed IP addresses
CN104348785A (zh) IPv6网中防止主机PMTU攻击的方法、装置与系统
KR102651987B1 (ko) NDN 네트워크에서 DDoS 공격 대응 방법 및 장치

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22879831

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022879831

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022879831

Country of ref document: EP

Effective date: 20240202

NENP Non-entry into the national phase

Ref country code: DE