IPSec VPN protocol depth detection method based on packet offset matching

Abstract

The invention discloses a depth-detecting method based on an IPSec VPN protocol which is matched with the offset of messages, being used for the field of network security. The method of the invention comprises the steps that: firstly, circular monitoring is carried out by opening the promiscuous mode of a network card on an intelligent agent or probe machines; a BPF filter is arranged to fetch IPSec VPN messages, to which depth detection is carried out. The algorithm can identify and analyze that whether the IPSec VPN messages are fabricated and whether the format of the IPSec VPN messages are standard or not. The method of the invention can not only detect a standard ISAKMP data packet, but also can correctly analyze the ISAKMP data packet which is non-standard IPSec and is added with padding data with unknown length, thereby realizing the detecting method generally used for detecting the IPSec messages. The same idea can be popularized for detecting other protocols.

Description

technical field [0001] The invention relates to a detection method in the field of network security, in particular to an IPSec VPN protocol depth detection method based on message offset matching. Background technique [0002] IPSec is an infrastructure security technology. Using IPSec can provide security features not in the original IP protocol: confidentiality, integrity, identity verification, anti-traffic analysis, etc. The IPSec VPN uses the IPSec security protocol to establish a VPN tunnel, which can establish a secure virtual channel on the public network for remote access. [0003] There are many international standards for various aspects of IPSec VPN technology. IPSec protocol has (IPSecurity-RFC 2401~2411, 2451) standards; encryption has ESP DES and 3DES (RFC 2406, 2451) standards, and authentication has X.509 digital certificate ( RSA signature), shared key, simple certificate enrollment protocol and other standards; integrity has HMAC-MD5 & HMAC-SHA-1 (RFC 24...

AI Technical Summary

Problems solved by technology

Although this method has advantages in speed and scalability, for non-standard format messages, due to the interference of non-standard headers, the protocol type of the message has become unrecognizable, and the contents of the fields inside are also unrecognizable. Because the non-standard headers are all misplaced, the parsing will cause errors, and the string matching will not be useful

[0009] In further searches, no literature reports on the deep detection method for IPSec VPN have been found

Images