WO2008131658A1 - Method and device for dhcp snooping - Google Patents

Abstract

A method for DHCP snooping is provided. In order to track the attacks of attackers, a DHCP blacklist binding table is built when received user data packets can't hit the DHCP binding table. The frequency information of hitting the DHCP blacklist table is recorded. A device is also provided. Thus the attack action of attackers is tracked and some essential information is acquired. It helps the network manager to analyze the information.

Description

 DHCP monitoring method and device thereof

 The present invention relates to the field of communication network technologies, and in particular, to a DHCP listening method and device thereof. Background technique

 With the expansion of the network scale and the increase of network complexity, the Dynamic Host Configuration Protocol (DHCP) has been widely used. However, DHCP encounters many security problems during the application process. The main means for an attacker to use DHCP to attack include the following two:

 1) IP/MAC spoofing attack: The attacker sends a packet with its own media access control (MAC, Media Access Control) and victim Internet Protocol (IP, Internet Protocol) to the gateway router, including IP packet and address resolution protocol. (ARP, Address Resolution Protocol), etc., let the gateway router learn the binding relationship between the victim IP and its own MAC address, and all subsequent packets arriving at the victim will be forwarded to the attacker.

 2) Man-in-the-middle attack: The attacker sends a packet with its own MAC address and gateway IP address (including IP and ARP packets, often ARP packets) to the victim, so that the victim learns the wrong ARP. All packets that must be sent outside the gateway are sent to the attacker. The attacker can analyze the packet and steal the information. Then, you can choose to discard or forward it to the gateway.

 To solve these problems, the current common method is to enable the DHCP snooping function on the network device of the access user, such as the gateway switch.

DHCP snooping listens to DHCP packets and establishes a DHCP binding table. The entries in the binding table include: IP address, MAC address, inbound port number, and virtual local area network (VLAN). When forwarding a packet, the DHCP binding table is used to check the address resolution protocol (ARP) packet and the IP packet to solve the above-mentioned spoofing attack security problem. The basic scheme is shown in Figure 1. The MAC address and IP address of User B are: B, 10.1.1.2; The MAC address and IP address of User C are: C, 10.1.1.3; MAC address and IP address of network device A For: A, 10.1.1.1. If DHCP snooping is enabled on the gateway switch of the access user, the normal user, such as user B or other users who may have attack behavior, such as user C, must first apply for DHCP first address. The DHCP switch binding table created by the gateway switch to listen to DHCP packets sent by user B and user C during the application process is shown in Table 1.

 Table 1

 When the attacker initiates a spoofing attack, for example, user C initiates a gratuitous ARP packet to B, which is used to spoof user B: The MAC address of the gateway whose IP address is 10.1.1.1 is C, and the ARP packet is detected at the gateway switch. The information carried in the ARP packet is used to search for the DHCP binding table. The information carried in the ARP packet includes the source MAC address, the source IP address (or the IP address declared in the ARP payload), and the inbound port information. In the embodiment of the present invention, the gateway switch searches for the DHCP binding table according to the MAC address being C, the IP address is 10.1.1.1, the ingress port number is E2, and the VLAN number is 3. If there is no entry with a MAC address of C, an IP address of 10.1.1.1, and an inbound port number of E2 and a VLAN number of 3, the gateway switch discards the ARP packet. Therefore, spoofing ARP packets will not reach any other users, including user B, thus preventing user C's attack behavior.

 For a normal user, such as user B, there is no problem in using the network, because all the messages sent by it will follow the information when the DHCP address is applied, that is, the MAC address is B, and the source IP address is 10.1.1.2. Under normal circumstances, the DHCP binding table will be correctly hit at the gateway switch to access the external network normally.

 The DHCP snooping solution solves the DHCP security problem. However, the attacker packets are simply discarded. This solution cannot be used to learn any information about the attacker. Summary of the invention

 The technical problem to be solved by the embodiments of the present invention is to provide a DHCP listening method, which records and records the attack behavior when an attack is received.

 In order to solve the above technical problem, the embodiment of the present invention provides a DHCP listening method, including: receiving a user packet and determining whether it hits the first DHCP binding table, and if the determination result is yes, forwarding the user packet, Otherwise, proceed to the next step;

Extracting inbound port information, virtual local area network information, source MAC address, and source IP address of the user packet Creating a DHCP blacklist binding table, and forming a second DHCP binding table including the DHCP blacklist binding table entry and the first DHCP binding table entry;

 Record the frequency information of the subsequent received user packets hitting the DHCP blacklist binding table.

 Correspondingly, the embodiment of the present invention provides a DHCP listening device, which is configured to listen to user packets received by a network device, including:

 a binding table storage unit, configured to store a DHCP binding table;

 a hit determination unit, configured to search, according to information in the user packet received by the network device, a DHCP binding table stored in the binding table storage unit, to determine whether the user packet hits the first DHCP binding table And instructing the network device to forward the user message when the determination result is yes;

The DHCP blacklist binding table unit is configured to: when the judgment result of the hit determination unit is negative, extract the inbound port information, the virtual local area network information, the source MAC address, and the source IP address information of the packet to create a DHCP blacklist. The binding table is formed, and the second DHCP binding table including the DHCP blacklist binding table entry and the first DHCP binding table entry is formed in the binding table storage unit.

 The implementation of the present invention has the following beneficial effects:

 The DHCP snooping method and the device thereof are provided by the embodiment of the present invention. When the received user packet fails to hit the DHCP binding table, the DHCP blacklist binding table is established, and the DHCP blacklist binding table is recorded. The frequency information is used to track the attacker's purpose, so as to obtain the attacker's attack behavior information, which is convenient for the network management to analyze to obtain the necessary anti-attack measures. DRAWINGS

 1 is a schematic diagram of application of a DHCP snooping method in the prior art;

 2 is a schematic flowchart of Embodiment 1 of a DHCP snooping method according to the present invention;

 3 is a schematic flowchart of Embodiment 3 of a DHCP listening method in the present invention;

 4 is a schematic flow chart of an embodiment of S3003 in FIG. 3;

 5 is a schematic diagram of the functional module of the first embodiment of the DHCP listening device of the present invention; FIG. 6 is a schematic diagram of the functional module of the second embodiment of the DHCP monitoring device of the present invention; FIG. 7 is a schematic diagram of the third embodiment of the DHCP monitoring device of the present invention. Schematic diagram of module composition. detailed description

The present invention will be further described in detail with reference to the accompanying drawings. FIG. 2 is a schematic flowchart diagram of Embodiment 1 of a DHCP snooping method according to the present invention. The embodiment includes the following steps:

 S2001: Receive a user packet and determine whether it hits the first DHCP binding table. If the judgment result is yes, the user packet is forwarded. Otherwise, S2002 is performed.

 S2002: Extracting the inbound port information, the virtual local area network information, the source MAC address, and the source IP address information of the information to create a DHCP blacklist binding table, and forming the DHCP blacklist binding table entry and the first The second DHCP binding table of the DHCP binding table entry.

 S2003: Record the frequency information of the subsequent received user message hitting the DHCP blacklist binding table.

When the received user packet cannot be hit by the first DHCP binding table, the packet may be an attack packet sent by the attacker. In this embodiment of the present invention, the packet is no longer used. Simply discarding, but extracting related information from the packet to establish a DHCP blacklist binding table, and forming a second DHCP including the DHCP blacklist binding table entry and the first DHCP binding table entry. Bind the table to track subsequent attacks and then discard the user message. When the subsequent received user packet hits the DHCP blacklist binding table, the frequency information of the DHCP blacklist binding table is recorded. That is, the DHCP blacklist binding table is hit several times within a certain period of time. . For example, the access device (the network switch in the figure) shown in FIG. 1 receives the packet of the user C. Since the DHCP listening function is enabled on the ingress port, the DHCP listening unit of the access device extracts the packet. Information such as the source MAC address and the source IP address, plus the inbound port information (that is, the port number) and the VLAN number, to find the first DHCP binding table. If no corresponding first DHCP binding table is found, that is, there is no DHCP binding. The content of the table entry is consistent with the related information extracted from the message of user C. It is very likely that user C sends an attack message. At this time, the access device does not directly discard the packet, but establishes a DHCP blacklist binding according to the source MAC address, the source IP address, the ingress port, and the VLAN information extracted from the packet. Forming a second DHCP binding table including the DHCP blacklist binding table entry and the first DHCP binding table entry, as shown in Table 1, the first DHCP binding table includes a MAC address, In the four fields of the IP address, the inbound port number, and the VLAN number, the second DHCP binding table entry containing the DHCP blacklist binding table entry in this embodiment is two more than the normal first DHCP binding table. Field: Binding table type and hit frequency. The second DHCP binding table is shown in Table 2 below. The binding table type field (the BLK field in the following Table 2) is used to identify whether the second DHCP binding table entry is the first DHCP binding table or the DHCP blacklist binding table entry (the BLK field is true). Indicates that The second DHCP binding table entry is a DHCP blacklist binding table entry. The hit frequency field (the RATE field in Table 2) is used to record the frequency information of the DHCP blacklist binding table entry being hit by the user packet when the second DHCP binding table entry is a DHCP blacklist binding table entry. (of course, it is also possible to record the frequency information of the first DHCP binding table entry being hit by the user packet). . That is, after the DHCP blacklist binding table is established, if a user packet hits the second DHCP binding table that includes the DHCP blacklist binding table, the binding table type field determines that the hit is a DHCP blacklist. The binding table records the frequency information of the DHCP blacklist binding table entry being hit by the user packet in the hit frequency field. Table 2

 With this embodiment, the attacker's attack behavior information is obtained, which facilitates the network management to analyze and take further measures.

 As described above, when the received user packet is an attack packet, the packet cannot hit the second packet.

DHCP binding table. In a practical application, if a DHCP binding table is abnormally lost, the packet sent by the corresponding user cannot access the corresponding second DHCP binding table on the access device, but the user at this time A packet cannot be regarded as an attack packet, but must be taken differently from the attack packet.

To this end, the present invention provides another embodiment of the DHCP snooping method. The difference between the embodiment and the first embodiment is that the step S2002 further includes the step of: sending a DHCPNAK message to the user according to the DHCP server. That is, when the received user packet cannot be hit by the second DHCP binding table, the DHCP blacklist binding table is used to track the user according to the procedure of the first embodiment, and the DHCP server is sent to the user. DHCPNAK packet. After receiving the DHCPNAK packet, the user automatically re-initiates the first-time address request according to the DHCP protocol. The DHCP snooping unit re-establishes the DHCP binding table of the corresponding user by listening to the DHCP message in the first-time address application process. Then the user can go online as usual after applying for the address. The user does not need to manually operate the whole process, and the DHCP binding table can be re-established without the user's awareness, so that the user can access the Internet as usual. In this embodiment, when the DHCP binding table corresponding to the user is abnormally lost, the corresponding DHCP binding table may be re-established without the user being aware of, so that the user accesses the Internet as usual.

 On the basis of the first embodiment or the second embodiment, after the DHCP blacklist binding table is established and the frequency information of the hit is established, and the second DHCP binding table is formed, the DHCP listening method of the present invention can also As a further improvement, FIG. 3 shows a third embodiment of the DHCP listening method according to the embodiment of the present invention, which includes the following steps:

 S3001: After forming the second DHCP binding table, receiving a subsequent user packet and determining whether it hits the second DHCP binding table. If the determination result is yes, executing S3002, if the determination result is no, the DHCP server is modeled. Send a DHCPNAK message to the user.

 S3002: Determine whether the second DHCP binding table entry of the subsequent user packet is a DHCP blacklist binding table. If the determination result is yes, execute S3003. Otherwise, forward the user packet according to the prior art.

 S3003: Process the subsequent user message according to a predetermined configuration policy.

 When the received subsequent user packet cannot be hit by the second DHCP binding table, in the embodiment, as in the second embodiment, the DHCP server sends a DHCPNAK packet to the user, so that the user initiates the first address application, thereby re- Establish a corresponding DHCP binding table. When the received user packet hits the second DHCP binding table entry, the packet is not directly forwarded according to the prior art, but the second DHCP of the subsequent user packet is further determined. Whether the binding table entry is a DHCP blacklist binding table entry, that is, determining whether the user packet hits the normal first DHCP binding table entry or the DHCP blacklist according to the binding table type field in the binding table. Bind table entries. If the packet is not the spoofing attack packet, the packet is forwarded according to the prior art. If the binding binding table type is a DHCP blacklist binding table entry, the packet may be an attack packet, and the subsequent user packet may be processed according to a predetermined configuration policy, including recording the DHCP. The blacklist binding table corresponds to the frequency information that the entry is hit by the user packet, that is, how many times it is hit within a predetermined time period (the predetermined time period can be configured according to actual conditions).

 In this embodiment, the packet is processed according to the type of the DHCP binding table entry that is hit, which enhances the device's ability to identify the attack packet.

As an implementation manner, the predetermined configuration policy may be: if the rate at which the user sends the user packet exceeds a preset speed limit value, the packet is discarded, and if not, the user is discarded. Send a DHCPNAK packet. The rate of sending user packets can be set by the DHCP blacklist binding table entry. The frequency information recorded in the hit frequency field is calculated. For example, the recorded frequency information is

If the corresponding number of the DHCP blacklist binding table entry is hit 4 times within 2 minutes, the frequency information recorded in the hit frequency field of the corresponding DHCP blacklist binding table entry is 0.03/s, which can be obtained. The sending rate of the user packet is expressed in the RATE field in the second HDCP table. The sending rate of the user packet can be taken as 0.03/s.

 Corresponding to the foregoing configuration policy, a flowchart of an implementation manner of S3003 is as shown in FIG. 4, and includes the following steps:

 S4001: Record, according to the hit situation of the subsequent user packet, the frequency information that the corresponding entry of the DHCP blacklist binding table is hit by the user packet;

 S4002: Calculate a sending rate of the user packet according to the frequency information, and compare the calculated sending rate with a rate limit value. If the sending rate is greater than the rate limit value, discard the User message, otherwise, execute S4003.

 The frequency information is the frequency information of the DHCP blacklist binding table entry recorded in S2003, and the frequency information is converted into the sending rate of the user packet according to the foregoing method. The speed limit value can be preset as needed.

 S4003: Sends a DHCPNAK packet to the user in the same manner as the DHCP server.

 Through the above configuration policy, a denial of service attack by a malicious user can be effectively prevented.

 Correspondingly, the present invention further provides an embodiment of a DHCP listening device, and a schematic diagram of a functional module of the DHCP listening device is shown in FIG. 5. The DHCP snooping device embodiment is configured to listen to user packets received by the network device, including a binding table storage unit 3, a hit determining unit 8, and a DHCP blacklist binding table unit 1.

 The binding table storage unit 3 is configured to store a DHCP binding table.

 The hit determination unit 8 is configured to search the DHCP binding table stored in the binding table storage unit 3 according to the information in the user packet received by the network device, and determine whether the user packet hits the DHCP binding table. And, when the judgment result is yes, instructing the network device to forward the user message;

The DHCP blacklist binding table unit 1 is configured to: when the judgment result of the hit determination unit 8 is negative, extract the inbound port information, the virtual local area network information, the source MAC address, and the source IP address information of the user packet to create a DHCP black. The list binding table stores the DHCP blacklist binding table in the binding table storage unit 3. That is, when the received user packet does not match the DHCP binding table entry, the inbound port information of the packet and its source MAC address and source IP address information are extracted to create a DHCP blacklist binding table. Called DHCP The blacklist binding table is because the user packet is only an attack packet sent by the hacker. The DHCP binding table corresponding to the hacker is not lost. In this case, it is convenient to track the hacker's attack behavior. At this time, in order to facilitate the tracking of the attacker's attack behavior, the DHCP blacklist binding table unit 1 establishes a corresponding DHCP blacklist binding table.

 To distinguish between the normal DHCP binding table and the DHCP blacklist binding table, the binding table storage unit 3 further includes a binding table type storage unit 31, configured to store whether the type of the DHCP binding table is a DHCP blacklist binding table. Instructions. Specifically, two fields are added to the normal DHCP binding table (described below in the first DHCP binding table): a binding table type field and a hit frequency field, forming a new DHCP binding table (hereinafter referred to as The second binding table is as shown in Table 2. The binding table type field (the BLK field in Table 2 above) is used to identify whether the second DHCP binding table entry is the first DHCP binding table entry, or the DHCP blacklist binding table table mentioned in the present invention. item

(The BLK field is true to indicate that the second DHCP binding table entry is a DHCP blacklist binding table entry); the hit frequency field (the RATE field in Table 2 above) is used when the second DHCP binding table entry is DHCP. When the blacklist is bound to a table entry, the frequency information of the DHCP packet blacklist binding table entry being hit by the user packet is recorded (of course, the frequency information of the first DHCP binding table entry being hit by the user packet may also be recorded) .

 In this embodiment, by recording the frequency information of the user, the behavior information of the attacker can be effectively tracked, which facilitates the network management to analyze.

 It should be noted that the access device and the network device actually include all network devices that support DHCP snooping. The gateway switch mentioned above is only a special case of the network device, and is not limited thereto.

 A schematic diagram of a functional module of the second embodiment of the DHCP monitoring device of the present invention is shown in FIG. 6. It is different from the first embodiment in that it further includes a DHCP anti-confirmation unit 4 for determining that the result of the hit determination unit 8 is If the user packet does not match the DHCP binding table entry, the DHCP server sends a DHCPNAK packet to the user, telling the user that the IP address is no longer available, and instructing the user to re-initiate the first address request. After receiving the DHCPNAK packet, the user initiates the first address request, and the DHCP snooping device monitors the DHCP packet sent in the first address application process and re-establishes the corresponding DHCP binding table. After the user successfully addresses the address, they can go online as usual.

In this embodiment, in addition to the functions of the first embodiment, when the DHCP binding table is abnormally lost, the DHCP binding table is automatically re-established when the user does not notice, so that the user can access the Internet as usual. Further, the DHCP listening device can be further improved on the basis of the first or second embodiment to fully utilize the functions of the DHCP blacklist binding table unit 1, the binding table type storage unit 31. FIG. 7 is a schematic diagram showing the structure of a function of the improved DHCP listening device, that is, the function module of the third embodiment. In addition to all the functional units of the second embodiment, the method further includes a type determining unit 5, a first processing unit 6, and a second Processing unit 7.

 The type judging unit 5 is configured to: when the judgment result of the hit judging unit 8 is that the subsequent user packet received by the network device hits the second DHCP binding table, that is, when the received subsequent user packet hits The second DHCP binding table entry is determined according to the type field of the DHCP binding table, and the second DHCP binding table entry that is determined by the subsequent user packet is a DHCP blacklist binding table entry, that is, It is judged whether it is a DHCP blacklist binding table or a normal DHCP binding table, and the judgment result is sent to the first processing unit 6.

 The first processing unit 6 receives the determination result of the type judging unit 5, and the second DHCP binding table entry that is the result of the type judging unit 5 is the DHCP blacklist binding table. Processing the subsequent user message according to a predetermined configuration policy;

 The second processing unit receives the determination result of the type judging unit 5, and when the judgment result of the type judging unit 5 is that the second DHCP binding table entry of the subsequent user packet is not a DHCP blacklist as an implementation The first processing unit 6 further includes a recording unit 61, a rate calculating unit 62, and a comparing unit 63.

 The recording unit 61 is configured to record the frequency information that the DHCP blacklist binding table corresponding entry is hit according to the hit situation of the subsequent user packet; the rate calculating unit 62 is configured to use the frequency information recorded by the recording unit 61. Calculating the transmission rate of the user. For example, if the frequency information recorded by the recording unit 61 is hit by the user packet 4 times within 2 minutes of the blacklist binding table entry, the sending rate of the corresponding user packet can be calculated as 30s/time. The comparison unit 63 compares the relationship between the sending rate of the user packet and the preset speed limit value. When the sending rate of the user packet is less than the speed limit value, the anti-confirming unit 4 is triggered. The user sends a DHCP message for triggering the user to re-initiate the first-time address request, otherwise the network device is triggered to discard the subsequent user message.

As an implementation manner, the predetermined configuration policy that is stored in the first processing unit 6 may be: if the rate at which the user sends the packet exceeds a preset rate limit, the packet is discarded, if not exceeded. The DHCP anti-acknowledgment unit 4 sends a DHCPNAK message to the user, instructing the user to initiate First address application.

 With this embodiment, the behavior information of the attacker can be tracked, and the attack recognition capability of the device can be enhanced, thereby effectively preventing the denial of service attack by the malicious user.

 The above is only the preferred embodiment of the present invention, and the scope of the present invention is not limited thereto, and the equivalent changes made by the claims of the present invention are still within the scope of the present invention.

Claims

Rights request A DHCP snooping method, comprising:  Receiving a user packet and determining whether it hits the first DHCP binding table. If the determination result is yes, forwarding the user packet, otherwise, performing the next step;  Extracting the inbound port information, the virtual local area network information, the source MAC address, and the source IP address information of the user packet to create a DHCP blacklist binding table, and forming the DHCP blacklist binding table entry and the first DHCP binding a second DHCP binding table of the table entry;  Record the frequency information of the subsequent received user packets hitting the DHCP blacklist binding table. The DHCP snooping method according to claim 1, wherein when the user packet misses the first DHCP binding table, the DHCP server sends a DHCPNAK packet to the user, and the DHCPNAK packet is used. Triggers the user to re-initiate the first address request. The DHCP snooping method according to claim 1 or 2, wherein the second DHCP binding table includes indication information indicating whether the corresponding entry is a DHCP blacklist binding table entry, and the record The frequency information further includes:  Receiving a subsequent user message and determining whether it hits the second DHCP binding table. If the determination result is yes, the next step is performed; if the determination result is no, the DHCP server is sent to the user according to the DHCP server;  Determining, according to the indication information, whether the second DHCP binding table that the user packet hits is a DHCP blacklist binding table, and if the determination result is yes, performing the next step, if the determination result is no, forwarding the User "^艮文;  The subsequent user message is processed according to a predetermined configuration policy. The DHCP snooping method according to claim 3, wherein the step of processing the subsequent user message according to the predetermined configuration policy specifically includes: And obtaining, according to the frequency information, a sending rate of the corresponding user packet, and comparing a size relationship between the sending rate and a preset rate limit value, and if the sending rate is greater than the rate limit value, discarding The subsequent user message, otherwise, performs the next step; The DHCP NAK message is sent to the user in the same manner as the DHCP server. A DHCP listening device, configured to listen to user packets received by the network device, and is characterized by:  a binding table storage unit, configured to store a DHCP binding table;  a hit determination unit, configured to search, according to information in the user packet received by the network device, a DHCP binding table stored in the binding table storage unit, to determine whether the user packet hits the first DHCP binding table And instructing the network device to forward the user message when the determination result is yes; The DHCP blacklist binding table unit is configured to: when the judgment result of the hit determination unit is negative, extract the inbound port information, the virtual local area network information, the source MAC address, and the source IP address information of the packet to create a DHCP blacklist. The binding table is formed, and the second DHCP binding table including the DHCP blacklist binding table entry and the first DHCP binding table entry is formed in the binding table storage unit. The DHCP snooping device of claim 5, wherein the binding table storage unit comprises:  The binding table type storage unit is configured to store whether the type of the DHCP binding table is an indication of a DHCP blacklist binding table. The DHCP monitoring device of claim 5, further comprising:  a DHCP anti-confirmation unit, configured to: when the judgment result of the hit determination unit is no, The DHCP server sends a DHCPNAK packet to the user, and the DHCPNAK packet is used to trigger the user to re-initiate the first address request. The DHCP monitoring device according to any one of claims 5 to 7, wherein the device further comprises:  a type judging unit, configured to: when the judgment result of the hit judging unit is that the subsequent user packet received by the network device hits the second DHCP binding table, determine, according to the indication information in the binding table type storage unit, Whether the hit is the DHCP blacklist binding table entry in the second DHCP binding table entry. a first processing unit, configured to: when the determination result of the type determining unit is the subsequent user message When the second DHCP binding table entry that is hit is the DHCP blacklist binding table entry, the subsequent user packet is processed according to a predetermined configuration policy;  a second processing unit, configured to trigger the network when the second DHCP binding table entry of the subsequent user packet is not the DHCP blacklist binding table entry The device forwards the user packet. The DHCP monitoring device according to claim 8, wherein the first processing unit comprises:  The recording unit records and stores the frequency information that the corresponding entry of the DHCP blacklist binding table is hit according to the hit situation of the subsequent user packet;  a rate calculation unit, configured to calculate, according to the recorded frequency information, a corresponding sending rate of the user packet; and, when the sending rate of the user packet is less than the speed limit value, triggering the reverse The acknowledgment unit sends a DHCPNAK message to the user, otherwise the network device is triggered to discard the subsequent user message.