WO2009121253A1

WO2009121253A1 - Network configuring method for preventing attack, method and device for preventing attack

Info

Publication number: WO2009121253A1
Application number: PCT/CN2009/070564
Authority: WO
Inventors: 吴迪
Original assignee: 华为技术有限公司
Priority date: 2008-03-31
Filing date: 2009-02-27
Publication date: 2009-10-08
Also published as: CN101257379A; CN101257379B

Abstract

A network configuring method for preventing attack, a method and device for preventing attack. In the network configuring method for preventing attack, the network comprises a route device and a user device, the user device communicates with the network of access operator through the route device. The method for configuring the network comprises: configuring VLAN ID of the user for the user device; configuring the user device to access in the QinQ way at the user access interface of the route device; encapsulating the message of the user device into the QinQ message and sending the QinQ message; configuring the suppressing rate and default behavior of particular type of message based on VLAN ID of the user in the inner layer of QinQ message.

Description

Method for configuring network to prevent attacks, method and device for preventing attacks This application claims to be filed on March 31, 2008, the Chinese Patent Office, the application number is 200810066440.1, and the invention name is "the method for preventing attacks and the method for preventing attacks" The priority of the Chinese Patent Application, the entire disclosure of which is incorporated herein by reference. Technical field

The embodiments of the present invention relate to the field of communications, and in particular, to a method for configuring an attack prevention network and a method and apparatus for preventing attacks. Background technique

The ARP (Address Resolution Protocol) attack is a common attack mode for network devices. The specific attack modes are as follows: (1) Sending a large number of ARP request/response packets to the gateway device. This attack mode will occupy the device. The port bandwidth, the gateway device is busy processing ARP packets, occupies the CPU resources of the device, causing network capacity degradation, interruption, etc.; (2) Sending scanning packets whose destination address changes continuously, such as the PING packet, to the gateway device; The gateway device generates a large number of ARP-snoop packets (messages indicating that ARP entries do not exist), occupies the CPU resources of the device, and causes network capability degradation and interruption.

In the prior art, an access control list (ACL) is used on the network device to filter packets entering the network device according to the source and destination addresses. When an ARP attack occurs, the source of the attack is identified by manual intervention. Then, the ACL rule is configured to filter the attack packets according to the characteristics of the attack packets. This solution requires manual intervention, which is difficult to achieve automatic protection when an attack occurs. Moreover, the attacker can filter the source and destination addresses of the packets to avoid filtering of ACL rules.

Another prior art is to limit the rate of ARP packets by source and destination addresses. The network administrator configures a reasonable ARP packet rate limit according to the actual situation of the network. When the rate of ARP packets of a source or destination address exceeds the upper limit. If an ARP attack occurs, the packets that exceed the upper limit of the rate limit will be discarded. Other ARP packets are not affected. Because this solution must retain the access time of all ARP packets, it consumes a large amount of resources and may fail when the attacker's address changes frequently. Summary of the invention

Embodiments of the present invention provide a method for configuring an attack prevention network, a method and apparatus for preventing an attack, and solving the problem of preventing a specific type of packet attack in a current communication network.

To solve the above technical problem, an embodiment of the present invention provides a method for configuring a network for preventing an attack, where the network includes a routing device and a user equipment, where the user equipment communicates with an access carrier network through the routing device. The method for configuring the network includes: configuring a user VLAN ID for the user equipment; configuring QinQ mode access for the user equipment on the user access interface of the routing device; and sending the user equipment packet as a QinQ message Configure the suppression rate and default behavior of specific types of packets based on the user VLAN ID of the inner layer of the QinQ packet.

To solve the above technical problem, another embodiment of the present invention provides a method for preventing an attack. The method is used to configure a QinQ access network, and identify a user according to a user VLAN ID of an inner layer of the QinQ. The method includes: Determining whether the rate of the packet of the specified type has been configured, and if so, determining whether the rate of the packet of the specific type reaches the upper limit of the rate. If yes, discarding the packet; The default action is performed if the packet rate limit is not configured for a specific type of packet.

In order to solve the above technical problem, another embodiment of the present invention provides an apparatus for preventing an attack, including a configuration unit, a speed limit determination unit, a speed limit upper limit determination unit, and an execution unit, where the configuration unit is configured to The user access interface of the routing device is configured to access the QinQ mode, and the rate limit and the default action of the specific type are configured according to the user VLAN ID of the inner layer of the QinQ packet. The rate limiting determining unit is configured to determine the received Whether the rate limit of the packet has been configured for a specific type of packet, and if yes, the rate limit determination unit determines whether the rate of the packet of the specific type reaches the upper limit of the rate. The row unit performs an action according to the determination result of the speed limit upper limit determining unit; if the speed limit determining unit determines that the received specific type message does not have the configured message speed limit, the execution unit performs the default action.

Compared with the prior art, the embodiment of the present invention can automatically protect a specific type of packet attack after the network configuration is completed, without manual intervention; even if an attack occurs, the scope of the attack can be narrowed down to a specific user, It affects the normal network connection of other users or user groups with different VLAN IDs on the same interface; it is difficult for an attacker to change the source and destination IP addresses to avoid the protection of the security policy, and does not bring additional performance overhead; The user configures the protection policy, which reduces the consumption of system resources and reduces the pressure on the hardware performance. It can prevent network type scanning attacks while blocking certain types of packet attacks. DRAWINGS

1 is a networking diagram of an embodiment of the present invention;

2 is a flowchart of a method for preventing an attack according to an embodiment of the present invention; FIG. 3 is a flowchart of a method for preventing an attack according to another embodiment of the present invention;

4 is a flow chart of an apparatus for preventing an attack according to another embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION In the IEEE 802.1Q standard, the Ethernet frame format is modified, and a 4-byte 802.1Q Tag is added between the source MAC address field and the protocol length/type field (Length/Typee). The 12-bit ID (Virtual Local Area Network Identifier) is used, as shown in the shaded message field in Table 1.

6 bytes 6 bytes 4 bytes 2 bytes 46-1517 bytes 4 bytes 802.1Q-based VLAN frame format As the network scale continues to expand, the 4K VLAN ID can no longer meet the current networking applications, in order to achieve more user access. Each manufacturer has launched its own solution, and QinQ is one of them. QinQ adds an 802.1Q tag in addition to the original 802.1 Q tag. It identifies a user with a two-layer VLAN ID, that is, 802.1Q in 802.1Q. Adds an 802.1Q tag to the 802.1Q tag packet. Head to the function of extending the VLAN space.

The earliest QinQ is to implement a VPN-like (Virtual Private Network) application, that is, the inner layer of the packet is the user VLAN ID, and the outer layer is the VLAN ID of the carrier. The outer VLAN ID of the packet traverses the carrier network and uses the inner VLAN ID to implement user interworking. Now QinQ technology has become more of a logo for users. In the technical solution of the embodiment of the present invention, this feature of QinQ is used as the purpose of access protection.

A networking diagram of an embodiment of the present invention is shown in FIG. 1. The network includes an access carrier network, an edge router, a Layer 2 switch, and User A, User B, and User C. User A, User B, and User C communicate with the access carrier network through switches and edge routers. Assume that the IP address of user A is 192.168.0.10, the VLAN ID of the user A (that is, the VLAN ID of user A) is 100, the IP address of user B is 192.168.0.11, and the VLAN ID of the user B (that is, the VLAN ID of user B) is 101. The IP address of user C is 192.168.0.12, the VLAN number to which it belongs (that is, the VLAN ID of user C) is 102; and the Layer 2 switch that communicates with users A, B, C, and edge routers communicates with users A, B, and C. The port is Tmnkl00 ~ 110, the IP address of the edge router is 192.168.0.1, and the outer VLAN ID of QinQ is 10. Any one of the users 8, B, and C may be a single user, or may be an outlet of a user network, and there are multiple user devices below, as long as the user network exits below These user devices are all within a single security policy domain. The IP address and the VLAN number indicated in FIG. 1 are examples for explaining the networking mode, and are not intended to limit the present embodiment or the present invention. The Layer 2 switch here can also be a Layer 3 switch, routing device or other network device capable of implementing QinQ access.

The process of configuring an edge router is shown in Figure 2, including the steps:

20. Configure the user VLAN ID for the user.

Take the networking diagram shown in Figure 1 as an example. Configure the user VLAN ID for all users A, B, and C. This step is basically the same as the normal access configuration. Assume that the IP address of user A is 192.168.0.10, and the VLAN ID of user A (that is, the VLAN ID of user A) is 100. The IP address of user B is 192.168.0.11, and the VLAN number of user B is 101. User B's VLAN ID); User C's IP address is 192.168.0.12, and user C's VLAN number is 102 (ie, user C's VLAN ID). The task of configuring the user VLAN ID for all users A, B, and C can be manually configured by the network administrator or set by the system. The IP addresses of users A, B, and C can be manually configured by the network administrator or set by the system.

22. Configure QinQ access on the user access interface.

Take the network shown in Figure 1 as an example. Configure the user access interface of the edge router as QinQ access.

24. Configure the suppression rate of ARP packets based on the user VLAN ID and configure the default behavior mode.

Configure the ARP packet suppression rate of each access user on the user access interface, that is, the upper limit of the rate of ARP packets for each access user. The network shown in Figure 1 is used as an example. The users who need to set the ARP packet suppression rate include users A, B, and C. In actual networking, you may include more users or user terminals. Configuration content is as follows:

- remote-host vlan 100 to 102 arp-speed-limit 15, that is, the upper limit of the rate of ARP packets sent from VLAN 100 to VLAN 102 is 15 / sec.

You can configure the default behavior mode for the unconfigured user's 1^>3⁄4 text. The network diagram shown in Figure 1 has users eight, B, and C. If only user A is configured with a limit. Therefore, the restrictions of users B and C are based on the default behavior. The default action, the default action, can include discarding or unrestricted, such as:

- remote-host default pass The ARP4 text of other users is allowed to pass without restriction.

- remote-host default drop All ARP packets of other users are discarded and are not allowed to pass.

In an embodiment of the present invention, the Layer 2 switch configures different VLAN IDs, that is, inner VLAN IDs, for users or user groups of different security policy domains, and may also be different users or users with the same security policy. The group is configured with different VLAN IDs. The edge router encapsulates the packets entering the same interface with the outer VLAN ID. In this way, packets from different users or user groups can be identified on the edge router based on different inner VLAN IDs. The edge router configures the ARP packet rate suppression according to the inner VLAN ID and configures the default action. In fact, when the user or the user group of the edge router has a VLAN ID, the Layer 2 switch can be used to configure the VLAN ID. The Layer 2 switch is used to implement QinQ access. The edge router can also be replaced with a normal router. This method can also be used to prevent other specific types of packet attacks. The interface can be a physical interface or a logical interface.

FIG. 3 is a flowchart of a method for preventing an attack according to another embodiment of the present invention. As shown in FIG. 3, when a user packet enters an edge router, the processing steps of the edge router include:

30. Determine whether the received packet is an ARP packet. If it is not an ARP packet, go to step 36. Otherwise, go to step 32.

32. Determine whether to limit the rate of ARP packets.

The edge router identifies the ARP packet rate limit for the user based on the inner VLAN ID. If the rate limit is not configured, go to step 38. For the user configured to limit the rate of ARP packets, go to step 34.

34. Determine whether the rate of ARP packets reaches the upper limit of the rate limit configuration.

For the user configured to limit the rate of ARP packets, the engine records the timestamp of the last ARP packet and compares the difference between the current time and the last recorded time. Compare the rate and the configured maximum rate of receiving ARP packets. If the rate limit of the ARP packet is not reached, go to Step 36 and process the timestamp according to the normal ARP packet process. Otherwise, discard the packet and keep the timestamp of the last record unchanged.

36. Process the message according to the normal process.

38. Determine the default action to perform the default action. If the default action is to discard, the user ARP packets are not configured to be insecure. The ARP packets are considered to be insecure. For the security ARP packet, go to Step 36.

380, all the received ARP>3⁄4 text of the user is discarded.

Of course, when discarding a received user's ARP>3⁄4 text, the discarded ARP packet can be counted for further analysis. If it is judged whether it is attacked according to the rate of counting growth, send an alarm, log, and so on to the NMS. Further, the inner VLAN ID of the discarded ARP packet can be recorded to track the attack source.

In this way, when a user of the edge router initiates an ARP packet attack, the large number of ARP packets sent by the attacker will be discarded because the ARP rate exceeds the ARP rate required for normal communication. Therefore, these attack packets will not affect the edge. The stability of the router and the carrier network. When an edge router calculates the ARP packet rate, it calculates the rate of ARP packets sent by each user according to different inner VLAN IDs. When discarding ARP packets, only ARP packets with a specific inner VLAN ID are discarded. Therefore, when any user sends an attack packet, it does not affect the normal connection of other users or user groups with different user VLAN IDs on the same access interface, and does not affect users on other access interfaces.

The identification of different users on the edge router is based on the inner VLAN ID of the packet and has no relationship with the IP address of the packet. It is difficult to circumvent the router's protection policy regardless of how the attacker changes the IP address.

Since the number of users or user groups under one access interface is limited, and the user information that needs to be recorded on the same inbound interface is limited, usually, the maximum number is 4k. In this way, the resources occupied on the edge router are within the controllable range, and the hardware is not required to be too high.

In the method of the embodiment of the present invention, taking the networking diagram shown in FIG. 1 as an example, the edge road The administrator can control the number of IP addresses that users can access by configuring ARP entries that are allowed to be generated by each user.

When an attacker initiates a network attack, it usually scans the network segment address, that is, sends a large number of PING messages whose destination address changes continuously to determine which addresses can be accessed, and then determines the next attack mode. ARP request packets are sent before, because users with different user VLAN IDs cannot communicate with each other on Layer 2 switches. If the switch in Figure 1 is a Layer 2 switch, you need to pass the edge router.

You can configure the upper limit of the allowed entry based on the VLAN ID of the user. After the upper limit is reached, it cannot be generated again. However, if the Layer 2 switch in Figure 1 is replaced with a Layer 3 switch or router, even if these users use different user VLAN IDs, the interworking of these users can be achieved. In this case, on the Layer 3 switch or router. Limit the ARP entries that each user can generate to control the IP addresses that each user can access at the same time to block network segment scanning attacks. For example, you can configure the upper limit of the allowed entry based on the user VLAN ID of the user. After the upper limit is reached, it cannot be generated.

The embodiment of the present invention further provides an apparatus for preventing an attack. As shown in FIG. 4, the apparatus 4 includes a configuration unit 41, a speed limit determination unit 42, a speed limit upper limit determination unit 43, and an execution unit 44, where

The configuration unit 41 is configured to configure the QinQ mode access on the user access interface of the edge router, and configure the suppression rate and default behavior of the ARP packet according to the user VLAN ID of the inner layer of the QinQ packet.

The rate limit determining unit 42 is configured to determine whether the ARP packet has been configured with the ARP packet rate limit. If the rate limit of the ARP packet is configured, the speed limit upper limit determining unit 43 determines the Whether the rate of the ARP packet reaches the upper limit of the rate, the executing unit 44 performs an action according to the determination result of the rate limit upper limit determining unit 43; if the rate limiting determining unit 42 determines that the received ARP packet is not configured with the ARP packet, After the speed limit is reached, the execution unit 44 performs the default action.

Preferably, the message determining unit 45 is further configured to determine whether the received message is The ARP packet, if yes, is sent to the rate limiting determining unit 42 to determine whether the ARP packet is configured with a rate limit; otherwise, the executing unit 44 performs a normal processing procedure. The step of performing the action includes: if the speed limit upper limit determining unit 43 determines that the rate of the ARP packet has reached the upper limit of the rate, discards the message, otherwise, the process is performed according to a normal process.

Preferably, if the user equipment does not have a VLAN ID, the VLAN ID configuration unit 46 may be further configured to configure a user VLAN ID for the user equipment.

In fact, the edge router can also be replaced with a normal router. This method can also be used to prevent other specific types of packet attacks. The interface can be a physical interface or a logical interface.

Another embodiment of the present invention is directed to a computer readable medium having stored therein a sequence of instructions for performing a method of preventing an attack, the method comprising:

The device determines whether the received packet is an ARP packet. If the packet is not an ARP packet, the packet is processed according to the normal process. Otherwise, the ARP packet is configured to limit the rate of the ARP packet.

The edge router determines whether the ARP packet is configured for the rate limit based on the inner VLAN ID. If the rate limit is not configured, the default action is determined to perform the default action. If the default action is to discard, the ARP packets of the user that are not configured with the rate limit are considered to be insecure ARP packets, and all the received ARP packets are discarded. If the user ARP packet is not configured with the rate limit, the device processes the packet according to the normal process.

If the ARP packet rate limit is set, the device determines whether the ARP packet rate is up to the upper limit. If the ARP packet rate is set, the engine records the timestamp of the last ARP packet. The difference between the current time and the last recorded time is compared to the rate of received ARP packets. If the rate limit is exceeded, the rate of the ARP packet is received. If the rate is not reached, the timestamp is processed and the timestamp is updated. Otherwise, the packet is discarded and the timestamp of the last record is kept unchanged.

After the configuration of the network is complete, the ARP packet attack can be automatically defended without manual intervention. Even if an attack occurs, the scope of the attack can be narrowed down to a specific user without affecting other devices on the same interface. The normal network connection of users or user groups with different user VLAN IDs; it is difficult for an attacker to change the source and destination IP addresses to circumvent the protection of the security policy without incurring additional performance overhead; configuring the protection policy according to the connected users, the system The resource consumption is limited, and the pressure on the hardware performance is reduced. The ARP packet attack can prevent the network segment scanning attack. Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by hardware, or can be implemented by means of software plus necessary general hardware platform, and the technical solution of the present invention. It can be embodied in the form of a software product that can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including a number of instructions for making a computer device (may It is a personal computer, a server, or a network device, etc.) that performs the methods described in various embodiments of the present invention.

In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Rights request

A method for configuring a network for preventing attacks, wherein the network includes a routing device and a user equipment, where the user equipment communicates with the network of the access carrier by using the routing device, and the method for configuring the network includes:

Configuring a user VLAN ID for the user equipment;

The user access interface of the routing device configures the QinQ mode for the user equipment; the user equipment packet is encapsulated into a QinQ packet and then sent;

Configure the suppression rate and default behavior of packets of a specific type based on the user VLAN ID of the inner layer of the QinQ packet.

2. The method according to claim 1, wherein the configuration manner is manually configured by an administrator of the routing device or the system is configured.

3. The method according to claim 1, wherein the specific type of message is an ARP message.

The method according to claim 1, wherein the default behavior mode comprises: allowing the specific type of packet to pass or discard the specific type of packet.

The method according to claim 1, wherein the user equipments with different security policies are located in different VLANs and have different VLAN IDs.

The method according to claim 1, wherein the user equipment is at least one network device having the same VLAN ID.

7. The method according to claim 1, wherein the routing device is a normal router or an edge router.

8. The method according to claim 1, wherein the network further comprises a switching device that implements QinQ access, and the user equipment communicates with the routing device through the switching device.

The method according to claim 8, wherein the switching device is a Layer 2 switch, a Layer 3 switch, or a routing device.

A method for preventing an attack, the method is configured to configure a QinQ access network, and identify a user according to a user VLAN ID of an inner layer of the QinQ, the method Includes:

Determining whether the rate of the specified type of packet has been configured, and if so, determining whether the rate of the packet of the specific type reaches the upper limit of the rate. If yes, discarding the packet; If the packet rate limit is not configured for a specific type of packets, the default action is performed.

The method of claim 10, wherein the default action comprises: allowing the particular type of message to pass or discard the particular type of message.

The method of claim 11, wherein when the default action is performed to discard the packet of the specific type, the method further includes:

Counts the specific type of packets discarded.

The method of claim 11, wherein the default action is to discard the specific type of the packet of the user equipment, the method further comprising:

Record the VLAN ID of the specified type of packet discarded.

The method according to claim 10, wherein, before the determining whether the received packet of the specific type has been configured with the rate limit of the packet, the method further includes:

It is determined whether the received packet is the specific type of packet. If yes, it is further determined whether the received packet has been configured with the rate limit of the packet; otherwise, the packet is processed according to a normal process.

The method according to claim 10, wherein the specific type of message is an ARP message.

A device for preventing an attack, comprising: a configuration unit, a speed limit determination unit, a speed limit upper limit determination unit, and an execution unit, wherein

The configuration unit is configured to configure a QinQ mode access on a user access interface of the routing device, and configure a rate limit and a default action of the packet of a specific type according to the user VLAN ID of the inner layer of the QinQ packet;

The speed limit determining unit is configured to determine whether the rate limit of the received packet is configured, and if yes, the speed limit upper determining unit determines whether the rate of the specific type of packet is reached. The upper limit of the rate, the execution unit performs an action according to the determination result of the speed limit upper limit determining unit; If the rate limit determination unit determines that the received specific type of message does not have a configured message rate limit, the execution unit performs the default action.

The device according to claim 16, further comprising: a message determining unit, configured to determine whether the received message is a specific type of message, and if yes, submit the speed limit determining unit to determine Whether the packet rate limit is configured for a specific type of packet; otherwise, the execution unit performs a normal processing flow.

The device according to claim 16, wherein the performing the action according to the determination result of the speed limit upper limit determining unit comprises:

If the rate limit determination unit determines that the rate of the specific type of packet has reached the upper rate limit, the packet is discarded, otherwise it is executed according to a normal procedure.

The device according to claim 16, wherein the specific type of message is an ARP message.

20. The apparatus of claim 16, wherein the routing device is a general router or an edge router.

The device according to claim 16, further comprising a VLAN ID configuration unit, configured to configure a user VLAN ID for the user equipment of the user.