CN100420197C - A Method for Realizing Attack Defense of Network Equipment - Google Patents

Abstract

The invention discloses a method for realizing network equipment attack prevention. The method is as follows: when a network equipment receives a message, it searches for the corresponding connection table item according to the relevant information in the message, and if the connection table item is found, it presses the corresponding switch Post item to forward the message; otherwise, according to the source IP address in the message, obtain the number of connections established by the user who sent the message and judge whether it is less than a predetermined value, if so, establish a connection table item and a forwarding table item for the user and perform Business processing, updating the number of connections corresponding to the source IP address stored in the statistics table; otherwise, discarding the packet. The invention prevents attacks by limiting the number of connections of the same user, and discards the new connection message of the user when the number of connections of the same user exceeds a specified value, so that the resources of the system can be guaranteed when being attacked by a network storm It will not be exhausted, and it can also provide normal services, thereby improving the system's ability to defend against attacks.

Description

A Method for Realizing Attack Defense of Network Equipment

technical field

The invention relates to network technology, in particular to a method for realizing network equipment attack prevention.

Background technique

In recent years, the application of the network has been popularized rapidly, and the rapid development of the network has left a large number of system and protocol loopholes. While enjoying the convenience brought by the network, users also face the threats it brings. The following are some commonly used attack methods and principles:

TCP SYN Flood: When a user makes a standard Transmission Control Protocol (TCP) connection, there will be a 3-way handshake process. The first is to request the server to send a synchronization message. After receiving the synchronization message, the server will send a synchronization confirmation message back to the requester to indicate confirmation. When the requester receives the synchronization confirmation message, it will send a reception confirmation message to the server again. In this way, a TCP connection is established successfully. The attack principle of TCP-SYN flood is: in the implementation process, only the first two steps are carried out. When the requester receives the synchronization confirmation message from the server, the requester stops sending the confirmation message to the server, and the server will The time spent waiting to receive an acknowledgment message from the requester. For a certain server, the available TCP connections are limited. If a malicious attacker sends such connection requests in rapid succession, the available TCP connection queue of the server will be blocked quickly, and the available resources of the system will decrease sharply. If it shrinks rapidly, if things go on like this, the network will not be able to provide normal services to users.

UDP Flood: Since the User Datagram Protocol (UDP) is widely used in the network, there are many types of attacks based on UDP. Nowadays, devices that provide services such as Internet browsing and e-mail usually use Unix servers, and they default to some UDP services that are maliciously used, such as echo and chargen services, which will display every data packet received, while the original The chargen service used as a test function will randomly feed back some characters when receiving each data packet. If a malicious attacker points these two UDP services to each other, the available network bandwidth will be exhausted quickly.

In order to prevent TCP SYN Flood attacks, the following two methods are usually adopted: the first is to shorten the server’s waiting deletion time (SYN Timeout), because the effect of SYN Flood attacks depends on the number of half-connections maintained on the server, this value = attack The frequency * SYN Timeout, so by shortening the time from receiving the synchronization message to confirming that the message is invalid and discarding the connection, for example, set it to less than 20 seconds (too low SYN Timeout setting may affect the normal access of customers) , can reduce the server load exponentially. The second method is to set a SYN cookie, which is to assign a cookie to each IP address that requests a connection. If you receive repeated SYN messages from a certain IP in a short period of time, it is considered to be under attack. All incoming packets are dropped.

In order to prevent UDP Flood attacks, the following methods are usually adopted. The first method is to close some unused UDP ports, do not provide Echo and Chargen services, and then use commands to enable this function when this function is needed; the second method is to use The flow control technology limits the flow within a certain range, and once the flow exceeds the new packet will be discarded, so as to ensure that other services of the system are still normal.

In addition, firewalls can also be used to protect the security of the network. When networking, add a firewall between each network device, and define what is a legal connection on the firewall, and prevent illegal users from invading. According to these predefined rules, the firewall can identify the attack methods used by these attacks and block the attack packets. Many commercial firewalls can be configured to promptly indicate signs of an attack. Detailed records of the firewall can be provided to the device management department. The more detailed the information, the faster they can filter out the data packets and prevent these attack data packets from entering the network. This information is also useful for tracking attackers.

Although the above method can play a role in preventing attacks in a certain program, it has the following disadvantages:

The two methods to deal with TCP SYN Flood can only deal with relatively primitive SYN Flood attacks. Shortening the SYN Timeout time is only effective when the attack frequency of the other party is not high, and the effect is poor when the attack frequency is high.

In order to prevent UDP Flood attacks, the relevant UDP ports are closed, and the normal functions provided by the ports are also shielded. If the flow control technology is used, it is only to ensure that the system does not crash under abnormal circumstances, because once the set flow rate is exceeded, the system will be blocked at the same time. Discarding many normal packets may cause unpredictable problems.

Using a firewall can effectively prevent various attacks, but operators need to purchase additional firewalls during networking, which increases the cost and complexity of the network.

Contents of the invention

The purpose of the present invention is to provide a method for realizing network equipment attack defense, so as to solve the problems of poor attack defense and normal business impact in the existing attack defense methods.

Realize the technical scheme of the present invention:

A method for realizing network device attack defense is that the network device performs the following steps when receiving a message:

A. Find the corresponding connection table item according to the relevant information in the message, if the connection table item is found, then forward the message according to the corresponding forwarding table item; otherwise, proceed to step B;

B. Obtain the number of connections established by the user sending the message at least according to the source IP address in the message;

C. Judging whether the number of connections is less than a predetermined value, if so, establishing a connection entry and a forwarding entry for the user and performing business processing, and updating the number of connections corresponding to the source IP address stored in the statistics table; otherwise The message is discarded.

in:

If the user disconnects the established connection, the number of connections corresponding to the source IP address stored in the statistical table is updated.

The relevant information is five-tuple information that can uniquely determine a connection.

The message is a Transmission Control Protocol (TCP) message or a User Datagram Protocol (UDP) message, and the connection is a Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) connection.

The invention can effectively prevent attacks by restricting the connection messages of the same user, enhance the ability of network equipment to prevent attacks, resist attacks from the network, and ensure that the equipment can still provide normal services when being attacked. network order.

Description of drawings

Fig. 1 is a flowchart of the present invention.

Detailed ways

The invention prevents the attacks of TCP SYN Flood and UDP Flood by limiting the number of transmission control protocol/user datagram protocol (TCP/UDP) connections of each user.

The network storm (SYN Flood) attack is that the attacker sends a large number of first packet packets SYN to the server, and the server will send the first packet response packet SYN ACK after receiving each first packet packet, and establish the transmission control protocol (TCP) Half-open the connection, and then wait for the response message ACK from the client side. But the attacker will not send the response message ACK that the server is waiting for, causing the server to be full of half-open connections. Because the server keeps sending out the first packet response message SYN ACK without any response, the server is in an abnormally busy state, making it difficult to process normal connection requests, and eventually causing normal business interruption.

Since the transmission control protocol is connection-oriented, while the user datagram protocol (UDP) is connection-oriented, but the switching/routing device still needs to allocate resources for the client after receiving the UDP message from the client, so a large number of resources are not available. The first and second packets of the UDP packet will occupy a lot of resources.

The abnormality of network devices under the attack of TCP SYN Flood and UDP Flood is because there are too many TCP/UDP connections in the system, which occupy too many system resources. Therefore, the system restricts each user to establish a certain number of TCP/UDP connections. Once it is found that the number of connections used by a user exceeds the predetermined value, the system prohibits the establishment of new connections unless the original connection is disconnected. new connection. This can limit the number of TCP/UDP connections in the system to a certain extent. The predetermined value is set to twice the number of normal Internet connections of a user.

A connection is determined by the quintuple of source IP address, destination IP address, source port number, destination port number and protocol type. A user may need to establish different connections on the network device to visit different websites, even if they visit the same Different content in the website may require different connections. Although the destination IP addresses, destination port numbers and protocol types of these connections may be different, the source IP addresses are the same, so a statistical (IP_CON) table is established, and the entries of this table record the number of connections established by each user in the system , indexed by the user's source IP address.

When the user creates a new connection or disconnects an established connection, update the number of connections of the user in the statistics table.

Referring to Figure 1, the processing flow of the message is as follows:

Step 10: The network device receives a message.

Step 20: Determine whether there is an established connection entry corresponding to the user according to the quintuple information in the message that can determine the unique connection, and if so, proceed to step 30; otherwise, proceed to step 40.

The five-tuple information includes source IP address, source port number, destination IP address, destination port number and protocol type, of course, the source port number and destination port number can also be source MAC address and destination MAC address.

Step 30: Forward the received message according to the forwarding entry corresponding to the connection entry.

Since the connection table entry can be found, it means that a similar message has been forwarded before. Therefore, the forwarding table entry of this connection can be found, and then the message is directly processed and forwarded.

Step 40: Obtain the number of connections established by the user according to the source IP address in the message.

If the connection entry of this connection is not found, it means that this is a new TCP or UDP connection, and the network device needs to send the message to the control platform for processing, and the processing module of the control platform checks how many connections the user has.

Step 50: Judging whether the number of connections established by the user exceeds a predetermined value, if yes, go to step 60, otherwise go to step 70.

Step 60: Discard the received message, and end the processing of the message.

Step 70: Create a corresponding connection entry and forwarding entry for the connection. After the entry is established successfully, search the IP_CON table according to the user's source IP address. If the corresponding entry is found, directly update the number of connections that have been established, otherwise it is The user creates a table entry, and sets the corresponding connection quantity to 1 at the same time.

After the connection table entry and the forwarding table entry are established, the subsequent messages from the connection are directly processed according to the connection table entry and the forwarding table entry.

The invention prevents attacks by limiting the number of connections of the same user, and discards the new connection message of the user when the number of connections of the same user exceeds the specified value, so that the resources of the system can be guaranteed when being attacked by a network storm It will not be exhausted, and it can also provide normal services, thereby improving the system's ability to defend against attacks.

Claims (6)

1. a method that realizes preventing network equipment from attacking is characterized in that, the network equipment carries out following step when receiving message:

A, search corresponding connection list item,, then E-Packet by corresponding forwarding-table item if find the connection list item according to relevant information in the message; Otherwise carry out step B;

B, to send the number of connection that the user of described message has set up according to the source IP address in the message;

C, whether judge described number of connection less than predetermined value, if then be engaged in handling for user's list item and forwarding-table item industry of going forward side by side that connects, the number of connection that will be stored in the described source IP address correspondence in the statistical form upgrades; Otherwise abandon described message.

2. the method for claim 1 is characterized in that, if the user disconnects the connection of having set up, then upgrades the number of connection of the source IP address correspondence of storing in the described statistical form.

3. the method for claim 1 is characterized in that, described relevant information is can unique five-tuple information of determining a connection.

4. method as claimed in claim 3 is characterized in that, described five-tuple information comprises source IP address, purpose IP address, source port number, destination slogan and protocol type.

5. the method for claim 1 is characterized in that, described predetermined value is set at normally the surf the Net twice of number of connection of user.

6. as the arbitrary described method of claim 1 to 5, it is characterized in that described message is transmission control protocol TCP message or User Datagram Protoco (UDP) UDP message, describedly be connected to that transmission control protocol TCP connects or User Datagram Protoco (UDP) UDP connects.

Images