CN116232690A - DDOS attack resistance method, device, smart network card, medium and product - Google Patents

Abstract

The disclosure provides a method, a device, an intelligent network card, a medium and a product for resisting DDOS attack, which can be applied to the technical field of network transmission. The method comprises the following steps: and receiving an access request packet sent to the server by the client, judging whether the access request packet is attacked by the DDOS, and responding to the access request packet under the condition that the access request packet is attacked by the DDOS. On one hand, the response is realized by using hardware through the intelligent network card, compared with the firewall server, the performance is higher, on the other hand, the response operation is integrated into the intelligent network card, a server does not need to be independently configured to serve as a firewall mechanism, the intelligent network card directly replies the access request packet, the access request packet does not need to be uploaded to the server, the server resource is not occupied, and the DDOS attack is effectively resisted.

Description

DDOS attack resistance method, device, smart network card, medium and product

technical field

The present disclosure relates to the field of network transmission, in particular to a DDOS attack resistance method, device, smart network card, medium and product.

Background technique

Distributed denial of service attack (DDOS, Distributed Denial of Service) means that multiple attackers in different locations launch attacks on one or several targets at the same time, or an attacker controls multiple machines in different locations and uses these machines to Simultaneous attacks on victims. Since the origin of the attack is distributed in different places, this type of attack is called a distributed denial-of-service attack, and there can be multiple attackers.

The most common way to resist DDOS attacks is to build a firewall, but this method still uses software to solve DDOS attacks, which has particularly high performance requirements for servers acting as firewalls.

Contents of the invention

In view of the above problems, the present disclosure provides a DDOS attack resistance method, device, smart network card, medium and product.

According to a first aspect of the present disclosure, a method for resisting DDOS attacks is provided, which is applied to a smart network card, the smart network card is set on a server, and the method includes:

receiving the access request packet sent by the client to the server;

Judging whether the access request packet is attacked by DDOS;

When the access request packet is attacked by DDOS, respond to the access request packet.

In an embodiment of the present disclosure, the responding to the access request packet includes:

Analyzing the protocol type of the access request packet, the protocol type includes ICMP type and TCP type;

When the protocol type is the ICMP type, reply the access request packet to the client;

If the protocol type is the TCP type, determine the connection phase of the access request packet, and respond to the access request packet according to the connection phase of the access request packet.

In an embodiment of the present disclosure, when the connection phase of the access request packet is the first handshake, responding to the access request packet according to the connection phase of the access request packet includes:

For the same access request packet, obtain the currently received SYN message and the carried Seq value, the historically received SYN message and the carried Seq value;

Judging whether there is a SYN message received in history and the Seq value carried is the same as the currently received SYN message and the Seq value carried;

In the case that there is a historically received SYN message and the carried Seq value is the same as the currently received SYN message and the carried Seq value, discarding the received SYN message;

Replying the SYN message and the ACK message to the client if there is no historically received SYN message and the carried Seq value are the same as the currently received SYN message and the carried Seq value.

In an embodiment of the present disclosure, when the connection phase of the access request packet is the second handshake, responding to the access request packet according to the connection phase of the access request packet includes:

Construct a semi-join waiting list, and the semi-join waiting list is used to store SYN messages of a preset threshold quantity;

Add the received SYN message to the preset semi-connection waiting list;

Judging whether the number of SYN messages in the current semi-join waiting list is greater than the threshold;

If the number of SYN packets in the semi-join waiting list is greater than the threshold, the target SYN packets in the semi-join waiting list will be deleted.

In an embodiment of the present disclosure, when the connection phase of the access request packet is the second handshake, the method further includes:

In the case of receiving a SYN message sent by the same IP address, the SYN message is discarded.

In an embodiment of the present disclosure, when the connection phase of the access request packet is the third handshake, the responding to the access request packet according to the connection phase of the access request packet includes:

Obtain the currently received ACK message;

Find the SYN message corresponding to the 5-tuple of the ACK message from the semi-join waiting list;

When the SYN message corresponding to the 5-tuple of the ACK message is found, remove the SYN message corresponding to the AK message from the semi-join waiting list, and complete the processing of the access request packet Connect, and send the relevant information of the access request packet to the server.

In an embodiment of the present disclosure, the method further includes:

When the protocol type is the TCP type, determine whether the access request packet has an RST bit;

In case the access request packet has the RST bit, the access request packet is discarded.

In an embodiment of the present disclosure, the method further includes:

When the access request packet is not attacked by DDOS, upload the access request packet to the server.

The second aspect of the present disclosure provides a DDOS attack resistance device, which is applied to a smart network card, and the smart network card is set on a server, including:

A receiving module, configured to receive an access request packet sent by the client to the server;

A judging module, configured to judge whether the access request packet is attacked by a DDOS;

A response module, configured to respond to the access request packet when the access request packet is attacked by DDOS.

In an embodiment of the present disclosure, the response module includes:

A parsing module, configured to parse the protocol type of the access request packet, where the protocol type includes ICMP type and TCP type;

A first reply module, configured to reply the access request packet to the client when the protocol type is the ICMP type;

A second reply module, configured to determine the connection phase of the access request packet when the protocol type is the TCP type, and respond to the access request packet according to the connection phase of the access request packet .

In an embodiment of the present disclosure, when the connection phase of the access request packet is the first handshake, responding to the access request packet according to the connection phase of the access request packet includes:

For the same access request packet, obtain the currently received SYN message and the carried Seq value, the historically received SYN message and the carried Seq value;

Judging whether there is a SYN message received in history and the Seq value carried is the same as the currently received SYN message and the Seq value carried;

In the case that there is a historically received SYN message and the carried Seq value is the same as the currently received SYN message and the carried Seq value, discarding the received SYN message;

Replying the SYN message and the ACK message to the client if there is no historically received SYN message and the carried Seq value are the same as the currently received SYN message and the carried Seq value.

In an embodiment of the present disclosure, when the connection phase of the access request packet is the second handshake, responding to the access request packet according to the connection phase of the access request packet includes:

Construct a semi-join waiting list, and the semi-join waiting list is used to store SYN messages of a preset threshold quantity;

Add the received SYN message to the preset semi-connection waiting list;

Judging whether the number of SYN messages in the current semi-join waiting list is greater than the threshold;

If the number of SYN packets in the semi-join waiting list is greater than the threshold, the target SYN packets in the semi-join waiting list will be deleted.

In an embodiment of the present disclosure, when the connection phase of the access request packet is the second handshake, the device further includes:

The discarding module is configured to discard the SYN message when receiving the SYN message sent by the same IP address.

In an embodiment of the present disclosure, when the connection phase of the access request packet is the third handshake, the responding to the access request packet according to the connection phase of the access request packet includes:

Obtain the currently received ACK message;

Find the SYN message corresponding to the 5-tuple of the ACK message from the semi-join waiting list;

When the SYN message corresponding to the 5-tuple of the ACK message is found, remove the SYN message corresponding to the AK message from the semi-join waiting list, and complete the processing of the access request packet Connect, and send the relevant information of the access request packet to the server.

In an embodiment of the present disclosure, the device further includes:

When the protocol type is the TCP type, determine whether the access request packet has an RST bit;

In case the access request packet has the RST bit, the access request packet is discarded.

In an embodiment of the present disclosure, the device further includes:

An uploading module, configured to upload the access request packet to the server when the access request packet is not attacked by DDOS.

A third aspect of the present disclosure provides an electronic device, including: one or more processors; a memory for storing one or more programs, wherein, when the one or more programs are executed by the one or more When the processor executes, one or more processors are made to execute the above method.

The fourth aspect of the present disclosure also provides a computer-readable storage medium, on which executable instructions are stored, and when executed by a processor, the processor causes the processor to perform the above method.

A fifth aspect of the present disclosure further provides a computer program product, including a computer program, which implements the above method when executed by a processor.

According to the DDOS attack resistance method, device, smart network card, medium and product provided by the present disclosure, the access request packet sent by the client to the server is received, and it is judged whether the access request packet is attacked by DDOS. In the case of , respond to the access request packet. On the one hand, the smart network card uses hardware to implement the reply, which will have higher performance than the firewall server. On the other hand, the response operation is integrated into the smart network card, no longer need to configure a separate server to act as a firewall mechanism, and the smart network card can directly reply The access request package does not need to upload the access request package to the server, does not occupy server resources, and effectively resists DDOS attacks.

Description of drawings

Through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, the above content and other objects, features and advantages of the present disclosure will be more clear, in the accompanying drawings:

FIG. 1 schematically shows an application scenario diagram of a DDOS attack resistance method, device, smart network card, medium, and program product according to an embodiment of the present disclosure;

Fig. 2 schematically shows a flow chart of a method for resisting DDOS attacks according to an embodiment of the present disclosure;

FIG. 3 schematically shows a schematic diagram of a three-way handshake based on the TCP protocol according to an embodiment of the present disclosure;

FIG. 4 schematically shows a flow chart of a method for resisting DDOS attacks based on the first handshake of the TCP type according to an embodiment of the present disclosure;

FIG. 5 schematically shows a flow chart of a method for resisting DDOS attacks based on the second handshake of the TCP type according to an embodiment of the present disclosure;

FIG. 6 schematically shows a flowchart of a method for resisting DDOS attacks based on the TCP type third handshake according to an embodiment of the present disclosure;

Fig. 7 schematically shows a flow chart of a method for resisting a DDOS attack based on a TCP type according to an embodiment of the present disclosure.

FIG. 8 schematically shows a block diagram of a device for resisting DDOS attacks according to an embodiment of the present disclosure; and

Fig. 9 schematically shows a block diagram of an intelligent network card suitable for implementing a DDOS attack resistance method according to an embodiment of the present disclosure.

Detailed ways

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. It should be understood, however, that these descriptions are exemplary only, and are not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the present disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. Also, in the following description, descriptions of well-known structures and techniques are omitted to avoid unnecessarily obscuring the concept of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only, and is not intended to be limiting of the present disclosure. The terms "comprising", "comprising" and the like used herein indicate the presence of such features, steps, operations and/or components, but do not exclude the presence or addition of one or more other features, steps, operations or components.

All terms (including technical and scientific terms) used herein have the meaning commonly understood by one of ordinary skill in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted to have a meaning consistent with the context of this specification, and not be interpreted in an idealized or overly rigid manner.

Where expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted as those skilled in the art would normally understand the expression (for example, "having A, B, and C A system of at least one of "shall include, but not be limited to, systems with A alone, B alone, C alone, A and B, A and C, B and C, and/or A, B, C, etc. ).

In the technical solution of this disclosure, the collection, storage, use, processing, transmission, provision, disclosure, and application of the user's personal information involved are all in compliance with relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate the Public order and good customs.

In the technical solution of this disclosure, the acquisition, collection, storage, use, processing, transmission, provision, disclosure, and application of data are all in compliance with relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good customs.

Smart NICs have become crucial infrastructure equipment in the field of cloud computing. Smart NICs can complete the transformation of network virtualization, so that users of bare metal servers or virtual machines can use smart NICs like ordinary NICs.

Fig. 1 schematically shows an application scene diagram of a DDOS attack resistance method, device, smart network card, medium and product according to an embodiment of the present disclosure.

As shown in Figure 1, in the process of resisting DDOS attacks, the smart network card of the embodiment of the present disclosure receives the access request packet sent by the client to the server, and judges whether the access request packet is attacked by DDOS. In the case of an attack, respond to the access-request packet. On the one hand, the smart network card uses hardware to implement the reply, which will have higher performance than the firewall server. On the other hand, the response operation is integrated into the smart network card, no longer need to configure a separate server to act as a firewall mechanism, and the smart network card can directly reply The access request package does not need to upload the access request package to the server, does not occupy server resources, and effectively resists DDOS attacks.

Based on the scenario described in FIG. 1 , the DDOS attack resistance method of the disclosed embodiment will be described in detail below through FIGS. 2 to 6 .

Fig. 2 schematically shows a flowchart of a method for resisting DDOS attacks according to an embodiment of the present disclosure.

As shown in FIG. 2 , the method for resisting DDOS attacks in this embodiment is applied to the smart network card, and the smart network card is set on a server. The method for resisting DDOS attacks in this embodiment includes operation S210 to operation S230 .

In operation S210, an access request packet sent by the client to the server is received.

In operation S220, it is judged whether the access request packet is attacked by DDOS;

In operation S230, respond to the access request packet in case the access request packet is under DDOS attack.

In an embodiment of the present disclosure, when the access request packet is not attacked by DDOS, the access request packet is uploaded to the server.

The most common DDOS attack method is Flood attack, also known as flood attack and flood attack. Flood attack types include Internet Control Message Protocol (ICMP, Internet Control Message Protocol) type and Transmission Control Protocol (TCP, Transmission Control Protocol) type. These two types occupy server resources by sending a large number of related messages, making the service unavailable. Specifically, an ICMP-type Flood attack means that the attacker keeps sending ICMP_ECHO REQEST packets. The TCP type of Flood attack means that the attacker keeps sending syn, syn_ack, ack and other packets.

In an embodiment of the present disclosure, responding to the access request packet in operation S230 includes: analyzing the protocol type of the access request packet, the protocol type includes ICMP type and TCP type, and in the case where the protocol type is the ICMP type Next, reply the access request packet to the client, if the protocol type is the TCP type, determine the connection phase of the access request packet, and respond to the access request packet according to the connection phase of the access request packet .

ICMP is a sub-protocol of the TCP/IP protocol cluster, which is used to transfer control messages between IP hosts and routers. The control message refers to the message of the network itself such as whether the network is unreachable, whether the host is reachable, and whether the route is available. ICMP transmits error messages and other network management messages, which are used to locate network devices, determine the number of hops or round-trip time from source to end, etc.

When an attacker implements an ICMP flood attack, a large number of ICMP access request packets are sent to the server, which almost completely occupies the server's connection resources, resulting in the failure to establish a normal TCP connection. The smart network card of the present disclosure receives the access request packet sent by the client to the server. When the access request packet is attacked by DDOS and the smart network card determines that the protocol type of the access request packet is the ICMP type, the access request The packet is uploaded to the server, but the smart network card directly replies the access request packet to the client, which does not occupy host resources and effectively resists Flood attacks.

TCP is a connection-oriented, reliable, byte stream-based transport layer communication protocol. In the TCP protocol, the TCP protocol provides a reliable connection service, and the connection is initialized through a three-way handshake. The purpose of the three-way handshake is to synchronize the sequence numbers and confirmation numbers of both parties and exchange TCP window size information.

In related technologies, Fig. 3 illustrates the process of TCP three-way handshake to establish a connection as follows: first, the client sends a SYN message to the server, which contains the initialization sequence number of the local end, and sets the connection status of the local end to SYN-SENT. Then, after receiving the synchronization message, the server responds to the client with a SYN+ACK message, which contains the initialization sequence number of the local end. At the same time, set the connection status of the local end to SYN-RCVD. Finally, after receiving the SYN+ACK from the server, the client sends an ACK message to the server for confirmation, and at the same time sets the connection status of the local end to ESTABLISHED. After receiving the ACK message, the server sets the local connection status to ESTABLISHED. The completion of the three-way handshake marks the successful establishment of a TCP connection. The smart network card of the present disclosure receives the access request packet sent by the client to the server. When the access request packet is attacked by DDOS and the smart network card determines that the protocol type of the access request packet is the TCP type, it does not send the access request The packet is uploaded to the server, but the connection stage of the access request packet is determined, and the access request packet is responded to according to the connection stage of the access request packet, which does not occupy host resources and effectively resists Flood attacks.

Fig. 4 schematically shows a flow chart of a method for resisting DDOS attacks based on the first handshake of TCP type according to an embodiment of the present disclosure.

As shown in Figure 4, the DDOS attack resistance method of this embodiment is applied to the smart network card, and the smart network card is set on the server, and the DDOS attack resistance method of this embodiment is except operation S210～operation S230 shown in Figure 2, It also includes operation S410 to operation S430.

In operation S410, for the same access request packet, the currently received SYN message and the carried Seq value, the historically received SYN message and the carried Seq value are acquired.

In operation S420, it is determined whether there is a historically received SYN message and the carried Seq value is the same as the currently received SYN message and carried the Seq value.

In operation S430, if there is a historically received SYN message and the carried Seq value are the same as the currently received SYN message and the carried Seq value, the received SYN message is discarded.

In operation S440, if there is no SYN message received in history and the Seq value carried is the same as the currently received SYN message and the Seq value carried, reply the SYN message and the ACK message to the client end.

Each byte in the data transmitted by TCP is numbered in sequence, and the sequence number (Sequence Number, SN/Seq) is the sequence number of the first byte of the data sent this time. Each byte in the byte stream transmitted in a TCP connection is numbered sequentially. The starting sequence number of the entire byte stream to be transmitted must be set when the connection is established. The sequence number field value in the header refers to the sequence number of the first byte of the data sent in this message segment. For example, the sequence number of a message segment is 301, and the received data has a total of 100 bytes. This shows that: the serial number of the first byte of the data in this message segment is 301, and the serial number of the last byte is 400. Obviously, the data sequence number of the next message segment (if any) should start from 401, that is, the value of the sequence number field of the next message segment should be 401. The sequence number of this field is also called "segment sequence number".

According to the embodiment of the present disclosure, if the same SYN message and repeated Seq value are received for the same TCP connection, it indicates that it is an illegal message, and the intelligent network card will directly discard it. If the same TCP connection does not receive the same SYN message, the smart network card will reply the SYN message and ACK message to the client.

Fig. 5 schematically shows a flow chart of a method for resisting DDOS attacks based on a second handshake of TCP type according to an embodiment of the present disclosure.

As shown in Figure 5, the DDOS attack resistance method of this embodiment is applied to the smart network card, and the smart network card is set on the server, and the DDOS attack resistance method of this embodiment is except operation S210～operation S230 shown in Figure 2, It also includes operation S510 to operation S540.

In operation S510, a semi-join waiting list is constructed, and the semi-join waiting list is used to store a preset threshold number of SYN packets.

In operation S520, the received SYN message is added to a preset semi-connect waiting list.

In operation S530, it is determined whether the number of SYN packets currently in the semi-join waiting list is greater than the threshold.

In operation S540, if the number of SYN packets in the semi-join waiting list is greater than the threshold, the target SYN packets in the semi-join waiting list will be deleted.

In this disclosure, the target SYN message may be the first SYN message that enters the semi-connection waiting list, or the SYN message whose waiting time exceeds a specified value, or any other message with any set conditions. There is no limitation on this, and the present embodiment takes the target SYN message as an example that the target SYN message enters the semi-join waiting list first as an example for schematic illustration.

In this disclosure, after the server replies with the SYN+ACK message. In the next step, there are two situations: the first one is a legal connection, and the client returns an ACK message, then the entire TCP handshake connection is a legal connection, which is uploaded to the server for subsequent connection and processing; the first one is a semi- In the connection state, the client does not return an ACK message. At this time, the SYN message sent by the client this time is not recognized as a legal request, that is, a semi-connection.

According to the embodiment of the present disclosure, the iNIC maintains a half-connection waiting list, which is used to store and maintain the current number of half-connections. For a TCP connection in the semi-connected state, the smart network card will save it to the semi-connection waiting list inside the smart network card, waiting for subsequent processing.

The smart network card stores the newly added semi-connection into the semi-connection waiting list. Assuming that the total number of SYN messages received within a period of time is recorded as SYN_COUNT, and the total number of received ACK messages is recorded as ACK COUNT, the current need The number of semi-joins maintained can be obtained using the following formula:

N _half = ACK_COUNT-SYN_COUNT

Considering the time window, using the formula N _half (T _w ), the total number of half-joins stored in the current time window T _w can be obtained. When the number of half-joins in a time window T _w exceeds the preset threshold N _th , which satisfies the formula N _half (T _w ) > N _th value, the head of the half-join waiting list (the earliest entry into the waiting list )’s semi-join is deleted and discarded, and then the new semi-join is entered into the waiting list and saved at the end of the list.

If the current formula N _half (T _w )>N _th is not satisfied, that is, the half-join waiting list is not full, there is no need to delete the first element of the waiting list. Instead, directly enter the new semi-join into the waiting list and save it at the end of the waiting list.

In an embodiment of the present disclosure, when the connection phase of the access request packet is the second handshake, if the SYN message sent by the same IP address is received, the SYN message is discarded. For clients in the semi-connected state, they will be recorded in the semi-connected waiting list. If at this time, the SYN message from the same IP of the client is received, the smart network card will directly discard it without processing it. Prevent an IP from establishing multiple semi-connections at the same time.

Due to packet loss, there may be a lot of SYN messages accumulated in a certain period of time, but none of the ACK messages are received. In fact, the client has already replied to the SYN message, but lost the packet halfway. In an embodiment of the present disclosure, the entire semi-join waiting list may be cleared to 0 in a regular or irregular manner. In one example, the entire waiting list is cleared to 0 periodically with T _reset as the time period, and the counters SYN_COUNT and ACK_COUNT are cleared to 0 at the same time, so as to ensure that it will not fall into the state of infinite waiting and deadlock.

Fig. 6 schematically shows a flow chart of a method for resisting DDOS attacks based on the third handshake of TCP type according to an embodiment of the present disclosure.

As shown in Figure 6, the DDOS attack resistance method of this embodiment is applied to the smart network card, and the smart network card is set on the server, and the DDOS attack resistance method of this embodiment is except operation S210～operation S230 shown in Figure 2, It also includes operation S610 to operation S630.

In operation S610, the currently received ACK message is acquired.

In operation S620, the SYN message corresponding to the 5-tuple of the ACK message is searched from the semi-join waiting list.

In operation S630, if the SYN message corresponding to the 5-tuple of the ACK message is found, the SYN message corresponding to the AK message is removed from the semi-join waiting list, and the access request packet is completed. Connect, and send the relevant information of the access request packet to the server.

After the server sends the SYN+ACK message, it will establish a semi-connected socket socket and start a timer at the same time. If the server does not receive an ACK message from the other party within the timeout period, the server will retransmit the SYN over time. +ACK message to the client, therefore, if the client keeps sending SYN messages and ignores the message that the server responds to, it will cause the server to create half-connected sockets and run out of resources, so that the server cannot Handle normal client connection requests.

After receiving an ACK packet from a client, the network card on the server will traverse the waiting queue from the header, and if it finds a TCP connection corresponding to the quintuple, it will directly complete the TCP connection establishment process, and upload its relevant information to the server. The server performs subsequent TCP connection processing and data transmission.

Fig. 7 schematically shows a flow chart of a method for resisting a DDOS attack based on a TCP type according to an embodiment of the present disclosure.

As shown in Figure 7, the DDOS attack resistance method of this embodiment is applied to the smart network card, and the smart network card is set on the server, and the DDOS attack resistance method of this embodiment is in addition to operation S210～operation S230 shown in Figure 2, It also includes operation S610 to operation S620.

In operation S710, if the protocol type is the TCP type, it is determined whether the access request packet has an RST bit.

In operation S720, in case the access request packet has the RST bit, the access request packet is discarded.

RST means reset, which is used to close abnormal connections. In an example, a TCP connection is established between A and B. If C forges a TCP-type access request packet and sends it to B, so that B abnormally disconnects the TCP connection with A, then it is RST attack.

In the present disclosure, when the protocol type is the TCP type, the smart network card judges whether the access request packet has an RST bit, and if the access request packet has an RST bit, the smart network card discards the access request packet, thereby solving the TCP type of RST attack in question.

Based on the above DDOS attack resistance method, the present disclosure also provides a DDOS attack resistance device. The device will be described in detail below with reference to FIG. 8 .

FIG. 8 schematically shows a structural block diagram of a device for resisting DDOS attacks according to an embodiment of the present disclosure.

As shown in FIG. 8 , the DDOS attack resistance device of this embodiment is applied to an intelligent network card, which is set on a server and includes a receiving module 810 , a judging module 820 and a responding module 830 .

The receiving module 810 is configured to receive the access request packet sent by the client to the server. In an embodiment, the receiving module 810 may be configured to perform operation S210 described above, which will not be repeated here.

The judging module 820 is used for judging whether the access request packet is attacked by DDOS. In an embodiment, the judging module 820 may be configured to perform the operation S220 described above, which will not be repeated here.

The response module 830 is configured to respond to the access request packet when the access request packet is under DDOS attack. In an embodiment, the response module 830 may be configured to perform the operation S230 described above, which will not be repeated here.

In an embodiment of the present disclosure, the response module 830 includes:

A parsing module, configured to parse the protocol type of the access request packet, the protocol type including ICMP type and TCP type;

A first reply module, configured to reply the access request packet to the client when the protocol type is the ICMP type;

The second reply module is configured to determine the connection phase of the access request packet when the protocol type is the TCP type, and respond to the access request packet according to the connection phase of the access request packet.

In an embodiment of the present disclosure, when the connection phase of the access request packet is the first handshake, the response to the access request packet according to the connection phase of the access request packet includes:

For the same access request packet, obtain the currently received SYN message and the carried Seq value, the historically received SYN message and the carried Seq value;

Judging whether there is a SYN message received in history and the Seq value carried is the same as the currently received SYN message and the Seq value carried;

When there is a SYN message received in history and the Seq value carried is the same as the currently received SYN message and the Seq value carried, the received SYN message is discarded;

If there is no historically received SYN message and the carried Seq value are the same as the currently received SYN message and the carried Seq value, reply the SYN message and the ACK message to the client.

In an embodiment of the present disclosure, when the connection phase of the access request packet is the second handshake, the response to the access request packet according to the connection phase of the access request packet includes:

Build a semi-join waiting list, which is used to store SYN messages with a preset threshold number;

Add the received SYN message to the preset semi-connection waiting list;

Judging whether the number of SYN messages in the current semi-join waiting list is greater than the threshold;

If the number of SYN packets in the semi-join waiting list is greater than the threshold, the target SYN packets in the semi-join waiting list will be deleted.

In an embodiment of the present disclosure, when the connection phase of the access request packet is the second handshake, the device further includes:

The discarding module is used for discarding the SYN message when receiving the SYN message sent by the same IP address.

In an embodiment of the present disclosure, when the connection phase of the access request packet is the third handshake, the response to the access request packet according to the connection phase of the access request packet includes:

Obtain the currently received ACK message;

Find the SYN message corresponding to the five-tuple of the ACK message from the semi-join waiting list;

When the SYN message corresponding to the five-tuple of the ACK message is found, the SYN message corresponding to the AK message is removed from the semi-join waiting list, the connection of the access request packet is completed, and the The relevant information of the access request packet is sent to the server.

In an embodiment of the present disclosure, the device further includes:

When the protocol type is the TCP type, determine whether the access request packet has an RST bit;

In the case where the access request packet has the RST bit, the access request packet is discarded.

In an embodiment of the present disclosure, the device further includes:

The upload module is used to upload the access request packet to the server when the access request packet is not attacked by DDOS.

According to the embodiment of the present disclosure, any multiple modules of the receiving module 810 , the judging module 820 and the responding module 830 may be implemented in one module, or any one of the modules may be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules may be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the receiving module 810, the judging module 820, and the responding module 830 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), A system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuits, such as hardware or firmware, or in a combination of software, hardware, and firmware Any one of these implementations or an appropriate combination of any of them. Alternatively, at least one of the receiving module 810, the judging module 820 and the responding module 830 may be at least partially implemented as a computer program module, and when the computer program module is executed, corresponding functions may be performed.

Fig. 9 schematically shows a block diagram of an intelligent network card suitable for implementing a DDOS attack resistance method according to an embodiment of the present disclosure.

As shown in FIG. 9, an intelligent network card 400 according to an embodiment of the present disclosure includes a processor 401, which can be loaded into a random access memory (RAM) 403 according to a program stored in a read-only memory (ROM) 402 or from a storage part 408. Various appropriate actions and processing are performed by the program. The processor 401 may include, for example, a general-purpose microprocessor (eg, a CPU), an instruction set processor and/or a related chipset, and/or a special-purpose microprocessor (eg, an application-specific integrated circuit (ASIC)), and the like. Processor 401 may also include on-board memory for caching purposes. The processor 401 may include a single processing unit or a plurality of processing units for executing different actions of the method flow according to the embodiments of the present disclosure.

In the RAM 403, various programs and data necessary for the operation of the smart network card 400 are stored. The processor 401 , ROM 402 and RAM 403 are connected to each other through a bus 404 . The processor 401 executes various operations according to the method flow of the embodiment of the present disclosure by executing programs in the ROM 402 and/or RAM 403 . It should be noted that the program may also be stored in one or more memories other than ROM 402 and RAM 403 . The processor 401 may also perform various operations according to the method flow of the embodiments of the present disclosure by executing programs stored in the one or more memories.

According to an embodiment of the present disclosure, the smart network card 400 may further include an input/output (I/O) interface 405 , and the input/output (I/O) interface 405 is also connected to the bus 404 . The electronic device 400 may also include one or more of the following components connected to the I/O interface 405: an input section 406 including a keyboard, a mouse, etc.; including a cathode ray tube (CRT), a liquid crystal display (LCD), etc. An output section 407 of a speaker or the like; a storage section 408 including a hard disk or the like; and a communication section 409 including a network interface card such as a LAN card, a modem, or the like. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the I/O interface 405 as needed. A removable medium 411 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is mounted on the drive 410 as necessary so that a computer program read therefrom is installed into the storage section 408 as necessary.

In an embodiment of the present disclosure, the processor 401 is a Neural Network Processing Unit (NPU).

The present disclosure also provides a computer-readable storage medium. The computer-readable storage medium may be included in the device/apparatus/system described in the above embodiments; it may also exist independently without being assembled into the device/system device/system. The above-mentioned computer-readable storage medium carries one or more programs, and when the above-mentioned one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as may include but not limited to: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM) , erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include ROM402 and/or RAM403 and/or one or more memories other than ROM402 and RAM403 described above.

Embodiments of the present disclosure also include a computer program product, which includes a computer program including program codes for executing the methods shown in the flowcharts. When the computer program product runs in the computer system, the program code is used to make the computer system realize the method provided by the embodiments of the present disclosure.

When the computer program is executed by the processor 401, the above-mentioned functions defined in the system/apparatus of the embodiment of the present disclosure are performed. According to the embodiments of the present disclosure, the above-described systems, devices, modules, units, etc. may be implemented by computer program modules.

In one embodiment, the computer program may rely on tangible storage media such as optical storage devices and magnetic storage devices. In another embodiment, the computer program can also be transmitted and distributed in the form of a signal on a network medium, downloaded and installed through the communication part 409, and/or installed from the removable medium 411. The program code contained in the computer program can be transmitted by any appropriate network medium, including but not limited to: wireless, wired, etc., or any appropriate combination of the above.

In such an embodiment, the computer program may be downloaded and installed from a network via communication portion 409 and/or installed from removable media 411 . When the computer program is executed by the processor 401, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to the embodiments of the present disclosure, the above-described systems, devices, devices, modules, units, etc. may be implemented by computer program modules.

According to the embodiments of the present disclosure, the program codes for executing the computer programs provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages, specifically, high-level procedural and/or object-oriented programming language, and/or assembly/machine language to implement these computing programs. Programming languages include, but are not limited to, programming languages such as Java, C++, python, "C" or similar programming languages. The program code can execute entirely on the user computing device, partly on the user device, partly on the remote computing device, or entirely on the remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (for example, using an Internet service provider). business to connect via the Internet).

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or portion of code that includes one or more logical functions for implementing specified executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved. It should also be noted that each block in the block diagrams or flowchart illustrations, and combinations of blocks in the block diagrams or flowchart illustrations, can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a A combination of dedicated hardware and computer instructions.

Those skilled in the art can understand that various combinations and/or combinations of the features described in the various embodiments and/or claims of the present disclosure can be made, even if such combinations or combinations are not explicitly recorded in the present disclosure. In particular, without departing from the spirit and teaching of the present disclosure, the various embodiments of the present disclosure and/or the features described in the claims can be combined and/or combined in various ways. All such combinations and/or combinations fall within the scope of the present disclosure.

The embodiments of the present disclosure have been described above. However, these examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the various embodiments have been described separately above, this does not mean that the measures in the various embodiments cannot be advantageously used in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of the present disclosure, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims (12)

1. The DDOS attack resistance method is characterized by being applied to an intelligent network card, wherein the intelligent network card is arranged on a server, and the method comprises the following steps:

Receiving an access request packet sent to the server by a client;

judging whether the access request packet is attacked by DDOS or not;

in the event that the access request packet is under DDOS attack, responding to the access request packet.

2. The method of claim 1, wherein said responding to said access request packet comprises:

analyzing the protocol type of the access request packet, wherein the protocol type comprises an ICMP type and a TCP type;

replying the access request packet to the client under the condition that the protocol type is the ICMP type;

and under the condition that the protocol type is the TCP type, determining the connection stage of the access request packet, and responding to the access request packet according to the connection stage of the access request packet.

3. The method according to claim 2, wherein in the case where the connection phase of the access request packet is a first handshake, the responding to the access request packet according to the connection phase of the access request packet includes:

for the same access request packet, acquiring a currently received SYN message and a carried Seq value, and a historically received SYN message and a carried Seq value;

Judging whether a SYN message received in a history and a carried Seq value exist, wherein the SYN message received in the history and the carried Seq value are the same as the SYN message received in the current;

discarding the received SYN message under the condition that a historical received SYN message and a carried Seq value are the same as the current received SYN message and the carried Seq value exist;

and replying the SYN message and the ACK message to the client under the condition that a SYN message received in history and a carried Seq value are not present and are the same as the SYN message received currently and the carried Seq value.

4. The method of claim 2, wherein, in the case where the connection phase of the access request packet is a second handshake, the responding to the access request packet according to the connection phase of the access request packet comprises:

constructing a semi-connection waiting list, wherein the semi-connection waiting list is used for storing SYN messages with preset threshold quantity;

adding the received SYN message into a preset semi-connection waiting list;

judging whether the number of SYN messages in the current semi-connection waiting list is larger than the threshold value or not;

and deleting the target SYN message in the semi-connection waiting list under the condition that the number of SYN messages in the semi-connection waiting list is larger than the threshold value.

5. The method of claim 4, wherein in the case where the connection phase of the access request packet is a second handshake, the method further comprises:

and discarding the SYN message under the condition of receiving the SYN message sent by the same IP address.

6. The method according to claim 4, wherein in the case where the connection phase of the access request packet is a third handshake, the responding to the access request packet according to the connection phase of the access request packet comprises:

acquiring a currently received ACK message;

searching SYN messages corresponding to the five-tuple of the ACK message from the semi-connection waiting list;

and under the condition that the SYN message corresponding to the five-tuple of the ACK message is found, removing the SYN message corresponding to the AK message from the semi-connection waiting list, completing the connection of the access request packet, and sending the related information of the access request packet to the server.

7. A method of combating a DDOS attack according to claim 2, wherein said method further comprises:

judging whether the access request packet has a RST bit or not under the condition that the protocol type is the TCP type;

In the case where the access request packet has a RST bit, the access request packet is discarded.

8. The method of combatting a DDOS attack of claim 1, further comprising:

and uploading the access request packet to the server under the condition that the access request packet is not attacked by the DDOS.

9. The utility model provides a resistance device of DDOS attack, its characterized in that is applied to intelligent network card, intelligent network card sets up in the server, includes:

the receiving module is used for receiving an access request packet sent to the server by the client;

the judging module is used for judging whether the access request packet is attacked by the DDOS or not;

and the response module is used for responding to the access request packet under the condition that the access request packet is attacked by the DDOS.

10. An intelligent network card, comprising:

one or more processors;

storage means for storing one or more programs,

wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method of any of claims 1-8.

11. A computer readable storage medium having stored thereon executable instructions which, when executed by a processor, cause the processor to perform the method according to any of claims 1-8.

12. A computer program product comprising a computer program which, when executed by a processor, causes the processor to perform the method according to any one of claims 1 to 8.

Images