CN108400968A - A kind of efficient method for realizing mimicry defence model distributor - Google Patents

Abstract

The invention discloses an efficient method for realizing a mimic defense model distributor. The steps of the present invention are as follows: Step (1) stores the data packet sent by each client in the distributor, maintains a mapping table from a virtual SessionId to a real SessionId in the distributor, and in the request sent by the client SessionId is a virtual SessionId, which is replaced with a real SessionId in the mapping table; Step (2) When the user request is too large, we adopt the method of "header copy, body link", only the HTTP request header is copied, and the request body The data can be linked. After the distributor copies and distributes the request to N servers, the space occupied by the request can be recovered; after step (3) has undergone the two preprocessing steps mentioned above, the distributor can efficiently send the user request to the server On the execution body of the terminal, the function of the distributor is realized. The present invention reduces delay as much as possible, improves efficiency, and provides a more efficient solution for the entire system.

Description

An Efficient Method for Implementing a Mimic Defense Model Distributor

technical field

The invention belongs to the technical field of computer software, in particular to an efficient method for realizing a mimic defense model distributor.

Background technique

The security problems faced by the Web server system are becoming more and more serious, and the traditional defense technology is in a passive defense position, and it is difficult to deal with the unknown attack threat well. Therefore, the United States proposed the idea of moving target defense (MTD), which is a "game-changing" network security development direction proposed by the United States in response to the current disadvantaged position of defenders. It is expected that through the implementation of continuous and dynamic changes Confuse attackers to increase the cost and complexity of their attacks and reduce their attack success rate.

Someone proposed a mimic defense model based on the "dynamic heterogeneous redundancy" structure, expecting to dynamically and pseudo-randomly select and execute various hardware variants and corresponding software variants under active and passive trigger conditions, so that internal and external attacks The hardware execution environment and software working conditions observed by the researchers are very uncertain, and it is impossible or difficult to build an attack chain based on bugs or backdoors to achieve the purpose of reducing system security risks. The "dynamic heterogeneous redundancy" structure uses a heterogeneous executive body set for processing in the "processing" link. The same input is copied into N copies through the input agent and distributed to N heterogeneous executive bodies in the executive body set for processing. The processing results are collected to the voter for voting, and the only relatively correct output is obtained. This can greatly improve the security of the Web server.

Contents of the invention

The purpose of the present invention is to provide an efficient method for realizing a mimic defense model distributor aiming at the deficiencies of the prior art.

The technical solution adopted by the present invention to solve its technical problems comprises the steps:

Step (1) For each data packet sent by the client, store it in the distributor. Since there are multiple different SessionIds stored in multiple back-end servers, it is necessary to maintain a virtual SessionId in the distributor. SessionId mapping table, the SessionId in the request sent by the client is a virtual SessionId, which is replaced by the real SessionId in the mapping table, the key value of the mapping table is the virtual SessionId, the value is the real SessionId of N servers, and the virtual SessionId is provided by the distributor Generated, in the HTTP return packet received by the client, there is only this virtual SessionId, and the client only needs to use this virtual SessionId to interact with the server;

Step (2) When the user's request is too large, if the requested data is simply copied N times, it will take up N times more space in the distributor, and the method of "copying the header and linking the body" is adopted, that is, only for HTTP requests The HTTP request header contains Cookie, SessionId and other information, and the data of the request body does not need to be changed, so it is only necessary to save the link of the HTTP request body. When the distributor copies and distributes the request to N servers, the space occupied by the request can be recovered;

Step (3) After the two preprocessing steps of steps (1) and (2), the distributor can efficiently send user requests to the execution body at the backend of the server to realize the function of the distributor.

Beneficial effects of the present invention:

The present invention maintains the mapping from the virtual SessionId to the real SessionId by using the mapping table, and adopts the scheme of "head copying, body linking" to realize the distributor module, thereby reducing the delay as much as possible, improving the efficiency, and providing a more efficient session for the whole system. s solution.

The present invention realizes a high-efficiency distributor module of the mimetic defense model by virtue of the fine operation of the mapping table and the pointer.

Description of drawings

Fig. 1 is a schematic diagram of the present invention.

Detailed ways

The present invention will be further described below in conjunction with drawings and embodiments.

As shown in Figure 1, an efficient method for implementing a mimic defense model distributor includes the following steps:

Step (1) For each data packet sent by the client, store it in the distributor. Since there are multiple different SessionIds stored in multiple back-end servers, it is necessary to maintain a virtual SessionId in the distributor. SessionId mapping table, the SessionId in the request sent by the client is a virtual SessionId, which is replaced by the real SessionId in the mapping table, the key value of the mapping table is the virtual SessionId, the value is the real SessionId of N servers, and the virtual SessionId is provided by the distributor Generated, in the HTTP return packet received by the client, there is only this virtual SessionId, and the client only needs to use this virtual SessionId to interact with the server;

Step (2) When the user request is too large, if the requested data is simply copied N copies, it will take up N times more space in the distributor. We have adopted the method of "head copy, body link", that is, only for The HTTP request header is copied. The HTTP request header contains Cookie, SessionId and other information, and the data of the request body does not need to change, so it is only necessary to save the link of the HTTP request body. When the distributor copies and distributes the request to N servers, the space occupied by the request can be recovered;

Step (3) After the above two preprocessing steps, the distributor can efficiently send the user request to the execution body at the backend of the server to realize the function of the distributor.

Claims (1)

1. a kind of efficient method for realizing mimicry defence model distributor, it is characterised in that include the following steps：

The data packet that step (1) sends each client, is deposited into distributor, due in multiple back-end servers Multiple and different SessionId is preserved, so needing to safeguard a virtual SessionId to really in distributor The mapping table of SessionId, SessionId is virtual SessionId in the request that client is sent, and is replaced in the mapping table The key values of true SessionId, mapping table are virtual SessionId, and value values are the true SessionId of N number of server, Virtual SessionId is generated by distributor, and the HTTP that client receives returns to only this virtual SessionId, visitor in packet Family end also only needs to interact using this virtual SessionId and server end；

Step (2) takes the mode of " head replicates, body link " when user's request is excessive：Only HTTP request head is answered It makes, includes Cookie, SessionId information in HTTP request head, and the data of body is asked not need to change, so Only need the link of preservation HTTP request body；After distributor, which replicates request, is distributed to N number of server, shared by this request With space, that is, recoverable；

After the pretreatment twice of step (1) and (2), user's request can be efficiently sent to step (3) by distributor On the execution body of server back end, the function of distributor is realized.