CN118540107A - P4-based session data packet multimode character string matching method and system - Google Patents

Abstract

The present invention provides a method and system for multi-mode string matching of session data packets based on P4, belonging to the field of network security technology. The method of the present invention uses P4 to execute a deep packet inspection algorithm, and uses an NFA state transition algorithm to convert the effective load into a bitmap form and record it in a local register; when the P4 network device receives a response packet, a hash result is calculated based on the 32-bit MD5 of a five-tuple that uniquely determines the type of the data packet to find the corresponding request packet, and the session rule is detected based on the NFA state of the request packet. By implementing the present invention, the computational overhead of multi-mode string matching can be effectively reduced, and the efficiency of extracting session rules by the system can be significantly improved without caching session request data packets.

Description

A multi-mode string matching method and system for session data packets based on P4

Technical Field

The invention belongs to the technical field of network security, and in particular relates to a multi-mode string matching method and system for session data packets based on P4.

Background Art

Session is an important concept in the field of network security. It is usually used to consist of a set of request packets and response packets. Session rules refer to multi-pattern string matching rules that carry pattern information in a specified database in the payload of request packets and response packets in a set of sessions. As network attack techniques become increasingly complex and covert, session-level attacks are becoming more and more serious in network security, such as man-in-the-middle attacks, phishing attacks, and session hijacking attacks. These attacks are usually not carried out through a single packet, but through a series of ordered and related packets in a session. These attacks may involve multiple stages, including reconnaissance, exploitation, command and control communications, and data theft or service destruction. Session-level rule matching can track and analyze packets throughout the session, thereby revealing the attacker's behavior patterns and attack links. Through comprehensive analysis of all packets in a session, attacks that are not obvious in the analysis of a single packet can be identified. This approach can reduce the probability of false positives and false negatives, thereby improving the accuracy of detection. In this context, multi-pattern matching of session-level packets is particularly important.

Multi-pattern matching is a key technology in the field of network security, which involves real-time identification and matching of specific pattern sets in network traffic to detect malware, prevent network intrusions, and achieve data loss prevention. However, with the growing demand for network bandwidth and processing power, traditional multi-pattern matching methods are gradually unable to meet these needs.

With the emergence of programmable networks, P4 (Programming Protocol-Independent Packet Processors) programmable switches provide a new solution for multi-mode matching of session-level packets. P4 switches allow developers to write code to customize the way packets are processed, which can meet specific network functions. For example, PPS and BOLT systems can meet the multi-mode matching of simple environments in today's high-bandwidth network environments. However, in the context of session packet flows, PPS and BOLT cannot detect session-level packets, and the lack of comprehensive analysis of session flows will lead to a lack of detection accuracy.

Summary of the invention

In order to solve the above problems, the present invention provides a P4-based session data packet multi-mode string matching method and system.

In a first aspect, an embodiment of the present invention provides a method for matching session data packets using multiple modes based on P4, the method comprising the following steps:

S1: The P4 network device obtains the NFA state transition entry and session rule entry from the entry input port;

S2: The P4 network device receives a data packet from a receiving port and parses the data packet header;

S3: the P4 network device mirrors the data packet, inputs the mirrored data packet into the recirculation port, and forwards the data packet from the forwarding port;

S4: Based on the data packet header information, determine whether the mirrored data packet is a session data packet; if the mirrored data packet is not a session data packet, end the entire process; if the mirrored data packet is a session data packet, execute step S5;

S5: According to the NFA state transition entry, perform NFA state transition processing on the payload part of the mirrored data packet; when the P4 network device pipeline completes the state transition of all payloads, return a mode bitmap and enter step S6, otherwise forward the mirrored data packet to the recirculation port;

S6: The P4 network device maps the mode bitmap into a unidirectional flow rule and temporarily stores it in a memory;

S7: The P4 network device calculates the five-tuple hash of the mirrored data packet, and determines whether the mirrored data packet is a request packet or a response packet; if the mirrored data packet is a request packet in the session, the P4 network device reads the register based on the five-tuple hash index value; if the mirrored data packet is a response packet in the session, the P4 network device reads the one-way flow rule number of the request packet in the register based on the reverse five-tuple hash index value, and enters step S8;

S8: Combine the unidirectional flow rule number of the register request packet and the unidirectional flow rule number of the mirror data packet to determine whether they hit the session rule number of the input session rule entry; if they hit, it means that the session where the mirror data packet is located may have attack behavior, and then upload the session rule number to the server; if they do not hit, then end the entire process.

In some possible implementations, the NFA state transition entry includes the logical content of the NFA state transition, and the P4 network device can parse the data packet payload based on the NFA state transition entry; each of the NFA state transition entries includes the following components: current state, input symbol, and transition type.

In some possible implementations, the session rule entry is used to perform rule matching on the session flow, and specifically includes: pattern, pattern bitmaps, unidirectional flow bitmaps, unidirectional flow rule number unidirectional rule id, and session rule number session rule id.

In some possible implementations, the session rule entry is designed through a Snort3 intrusion detection system.

In some possible implementations, parsing the data packet header includes: the P4 network device gradually extracting each field in the packet header in a predefined order and performing recursive parsing; and storing the source port number, destination port number, and IP number of the data packet obtained by parsing into the memory of the P4 network device.

In some possible implementations, determining whether the mirrored data packet is a session data packet based on data packet header information includes: determining whether the data packet is a session data packet by parsing a session identifier and a protocol interaction feature in the data packet.

In some possible implementations, the pattern bitmap in step S5 maps a set of patterns matched by the payload of the mirrored data packet in all pipelines of the P4 network device.

In some possible implementations, if the mirrored data packet is a request packet in a session, the P4 network device reads a register based on a five-tuple hash index value, including: if there is no hash value conflict, updating the five-tuple information, mode bitmap, and unidirectional flow rule number of the mirrored data packet to the register offset corresponding to the hash value; if a hash conflict occurs, using a linear detection method in an open addressing method to gradually detect empty hash buckets, and writing the five-tuple information, mode bitmap, and unidirectional flow rule number of the mirrored data packet into the hash bucket.

In some possible implementations, in step S7, the P4 network device uses the MD5 algorithm to calculate the five-tuple hash of the mirrored data packet.

In a second aspect, the present application also proposes a session data packet multi-mode string matching system based on P4, the system specifically comprising:

A sending module, used for inputting NFA state transition entries and session rule entries into an entry input port of a P4 network device;

A P4 network device module, comprising a P4 network device, configured to execute any one of the P4-based session data packet multi-mode string matching methods described in the first aspect above;

The server module includes a server, which is used to receive a session rule number from the P4 network device, extract corresponding session rule information according to the session rule number, and update a database log based on the session rule information.

By implementing the present invention, the following beneficial technical effects are achieved but not limited to:

(1) Compared with the traditional multi-pattern matching algorithm, the method of the present invention offloads the multi-pattern string matching method to the programmable switch, thereby reducing the computing resource overhead.

(2) The present invention proposes a deep packet inspection (DPI) method that does not require caching, which can efficiently extract session rules without caching session request packets.

(3) The present invention utilizes P4 to execute a deep packet inspection algorithm. It does not cache data packets, but directly extracts the payload in the data packets. It converts the payload into a bitmap using the NFA state transition algorithm and records it in a local register, thereby avoiding the memory overhead of caching data packets.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application.

FIG1 is a flow chart of a method for multi-mode string matching of session data packets based on P4 according to an embodiment of the present application;

FIG2 is a schematic diagram of a P4-based session data packet multi-mode string matching system framework according to an embodiment of the present application;

FIG. 3 is an operational state of a P4 network device register in an application scenario provided according to an embodiment of the present application.

DETAILED DESCRIPTION

The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present disclosure belongs. Although any methods similar or equivalent to those described herein can also be used in the practice or testing of the present disclosure, only exemplary methods are now described.

It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and/or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and/or combinations thereof.

It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

In the first aspect, please refer to FIG. 1-2. FIG. 1 is a multi-mode string matching method for session data packets based on P4 provided in an embodiment of the present application, comprising the following steps:

S1: The P4 network device obtains the NFA state transition entry and the session rule entry from the entry input port.

Specifically, the NFA state transition entry includes the logical content of the NFA state transition, and the P4 network device can parse the data packet payload based on the NFA state transition entry. For example, each of the NFA state transition entries can include the following components: current state, input symbol, transition type, etc.

The session rule entry is used to perform rule matching on the session flow. In some possible implementations, the session rule entry may include: pattern, pattern bitmaps, unidirectional flow bitmaps, unidirectional rule id, and session rule id.

Preferably, the session rule entry can be designed by a Snort3 intrusion detection system.

S2: The P4 network device receives a data packet from a receiving port and parses the data packet header.

Specifically, the parsing of the data packet header includes parsing to obtain the source port number, destination port number and IP number of the data packet, and storing them in the memory of the P4 network device. The process of parsing the data packet header occurs in the "parsing stage" (Parser). In this stage, the P4 network device gradually extracts each field in the packet header in a predefined order and performs recursive parsing to process some multi-layer encapsulation protocols, such as IP-in-IP, GRE, VXLAN, etc. The P4 network device parser can define multiple parsing states, each state is responsible for parsing a specific packet header or performing a specific action, such as jumping to the next state, extracting field values, discarding the packet header, etc.

S3: The P4 network device mirrors the data packet and inputs the mirrored data packet into a recirculation port, and forwards the data packet from a forwarding port.

S4: Based on the data packet header information, determine whether the mirrored data packet is a session data packet; if the mirrored data packet is not a session data packet, end the entire process; if the mirrored data packet is a session data packet, execute step S5.

Specifically, it is possible to determine whether the data packet is a session data packet by parsing the session identifier (such as a five-tuple, etc.) or the protocol interaction characteristics (such as the protocol handshake and termination process, request and response mode, etc.) in the data packet, or to query whether the data packet belongs to a known session through the network device session table maintained by the P4 network device. For example, if the source port number or the destination port number of the mirrored data packet obtained by parsing is 80, it can be determined that the data packet is an HTTP session data packet.

S5: According to the NFA state transfer entry, perform NFA state transfer processing on the payload part of the mirrored data packet; when the P4 network device pipeline completes the state transfer of all payloads, return a mode bitmap and enter step S6, otherwise forward the mirrored data packet to the recycling port.

Specifically, the pattern bitmap maps a set of patterns matched by the payload of the mirrored data packet in all pipelines of the P4 network device.

S6: The P4 network device maps the mode bitmap into a unidirectional flow rule and temporarily stores it in the memory. The unidirectional flow rule exists in the form of a compressed bitmap, which is responsible for recording the rule number matched by the current data packet mode bitmap.

S7: The P4 network device calculates the five-tuple hash of the mirrored data packet and determines whether the mirrored data packet is a request packet or a response packet; if the mirrored data packet is a request packet in a session, the P4 network device reads the register based on the five-tuple hash index value; if the mirrored data packet is a response packet in a session, the P4 network device reads the one-way flow rule number of the request packet in the register based on the reverse five-tuple hash index value, and enters step S8. As shown in Figure 3, Figure 3 is one of the operating states of the P4 network device register in this embodiment.

Specifically, the five-tuple consists of a source IP, a destination IP, a source port, a destination port, and a transport layer protocol type. After locating the response characteristics of the data packet based on the data packet header information and the five-tuple hash, it can be determined whether the mirror data packet is a request packet or a response packet. If the mirror data packet is a request packet in a session, the P4 network device reads the register based on the five-tuple hash index value, including: if there is no hash value conflict, the five-tuple information, mode bitmap, and unidirectional flow rule number of the mirror data packet are updated to the register offset corresponding to the hash value; if a hash conflict occurs, the linear detection method in the open addressing method is used to gradually detect empty hash buckets, and the five-tuple information, mode bitmap, and unidirectional flow rule number of the mirror data packet are written into the hash bucket.

Preferably, the P4 network device may use an MD5 algorithm in a hash function to calculate a five-tuple hash of the mirrored data packet.

S8: Combine the unidirectional flow rule number of the register request packet and the unidirectional flow rule number of the mirror data packet to determine whether they hit the session rule number of the input session rule entry; if they hit, it means that the session where the mirror data packet is located may have attack behavior, and then upload the session rule number to the server; if they do not hit, then end the entire process.

In a second aspect, an embodiment of the present invention further provides a session data packet multi-mode string matching system based on P4, the system comprising the following modules:

The sending module is used to input NFA state transition entries and session rule entries to the entry input port of the P4 network device.

The P4 network device module includes a P4 network device, which is used to execute the P4-based session data packet multi-mode string matching method described in the first aspect embodiment.

The server module includes a server, which is used to receive a session rule number from the P4 network device, extract corresponding session rule information according to the session rule number, and update a database log based on the session rule information.

In the embodiments provided by the present invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of each module is only a logical function division, and there may be other division methods in actual implementation. In addition, the steps in the method of the embodiment of the present invention can also be adjusted in order, merged and deleted according to actual needs.

The preferred specific embodiments of the present invention are described in detail above. It should be understood that ordinary technicians in the field can make many modifications and changes based on the concept of the present invention without creative work. Therefore, all technical solutions that can be obtained by technicians in the technical field based on the concept of the present invention through logical analysis, reasoning or limited experiments on the basis of the prior art should be within the scope of protection determined by the claims.

Claims (10)

1. A multi-mode string matching method for session data packets based on P4, characterized in that it comprises the following steps: S1: The P4 network device obtains the NFA state transition entry and session rule entry from the entry input port; S2: The P4 network device receives a data packet from a receiving port and parses the data packet header; S3: the P4 network device mirrors the data packet, inputs the mirrored data packet into the recirculation port, and forwards the data packet from the forwarding port; S4: Based on the data packet header information, determine whether the mirrored data packet is a session data packet; if the mirrored data packet is not a session data packet, end the entire process; if the mirrored data packet is a session data packet, execute step S5; S5: According to the NFA state transition entry, perform NFA state transition processing on the payload part of the mirrored data packet; when the P4 network device pipeline completes the state transition of all payloads, return a mode bitmap and enter step S6, otherwise forward the mirrored data packet to the recirculation port; S6: The P4 network device maps the mode bitmap into a unidirectional flow rule and temporarily stores it in a memory; S7: The P4 network device calculates the five-tuple hash of the mirrored data packet, and determines whether the mirrored data packet is a request packet or a response packet; if the mirrored data packet is a request packet in the session, the P4 network device reads the register based on the five-tuple hash index value; if the mirrored data packet is a response packet in the session, the P4 network device reads the one-way flow rule number of the request packet in the register based on the reverse five-tuple hash index value, and enters step S8; S8: Combine the unidirectional flow rule number of the register request packet and the unidirectional flow rule number of the mirror data packet to determine whether they hit the session rule number of the input session rule entry; if they hit, it means that the session where the mirror data packet is located may have attack behavior, and then upload the session rule number to the server; if they do not hit, then end the entire process. 2. The method for multi-mode string matching of session data packets based on P4 according to claim 1, characterized in that: The NFA state transition entry includes the logical content of the NFA state transition, and the P4 network device can parse the data packet payload based on the NFA state transition entry; each of the NFA state transition entries includes the following components: current state, input symbol, and transition type. 3. The method for multi-mode string matching of session data packets based on P4 according to claim 1, characterized in that: The session rule entry is used to perform rule matching on the session flow, and specifically includes: pattern pattern, pattern bitmaps, unidirectional flow bitmaps, unidirectional flow rule number unidirectionalruleid, and session rule number session ruleid. 4. The method for multi-mode string matching of session data packets based on P4 according to claim 1, characterized in that: The session rule entries are designed through the Snort3 intrusion detection system. 5. The method for multi-mode string matching of session data packets based on P4 according to claim 1, characterized in that the parsing of the data packet header comprises: The P4 network device gradually extracts each field in the packet header in a predefined order and performs recursive parsing; the source port number, destination port number and IP number of the data packet obtained by parsing are stored in the memory of the P4 network device. 6. The method for multi-mode string matching of session data packets based on P4 according to claim 1, characterized in that judging whether the mirror data packet is a session data packet based on data packet header information comprises: By parsing the session identifier and protocol interaction characteristics in the data packet, it is determined whether the data packet is a session data packet. 7. The P4-based session data packet multi-mode string matching method according to claim 1 is characterized in that the mode bitmap in step S5 maps the set of patterns matched by the payload of the mirrored data packet in all pipelines of the P4 network device. 8. The method for multi-mode string matching of session data packets based on P4 according to claim 1, characterized in that if the mirror data packet is a request packet in a session, the P4 network device reads a register based on a five-tuple hash index value, comprising: If there is no conflict in the hash value, the five-tuple information, mode bitmap and unidirectional flow rule number of the mirrored data packet are updated to the register offset corresponding to the hash value; If a hash conflict occurs, a linear detection method in an open addressing method is used to gradually detect empty hash buckets, and the five-tuple information, mode bitmap and unidirectional flow rule number of the mirrored data packet are written into the hash bucket. 9. The method for multi-mode string matching of session data packets based on P4 according to claim 1, characterized in that: In step S7, the P4 network device uses the MD5 algorithm to calculate the five-tuple hash of the mirrored data packet. 10. A multi-mode string matching system for session data packets based on P4, characterized by comprising: A sending module, used for inputting NFA state transition entries and session rule entries into an entry input port of a P4 network device; A P4 network device module, comprising a P4 network device, for executing a P4-based session data packet multi-mode string matching method according to any one of claims 1 to 9; The server module includes a server, which is used to receive a session rule number from the P4 network device, extract corresponding session rule information according to the session rule number, and update a database log based on the session rule information.