A near-destination DDoS defense method based on bidirectional source address verification

Abstract

The present invention provides a near-destination DDoS defense method based on bidirectional source address verification (SAV‑B). The method deploys SAV‑B devices near the DDoS attack target (i.e., the protected area). The SAV‑B devices are used to collect five-tuple information of network data packets transmitted into and out of the network. The five-tuple information includes source IP address, destination IP address, source port number, destination port number, and transmission protocol. An efficient hash function is used to generate a hash digest for the information. The hash digest is used to verify the authenticity of the source address of the data packet to achieve efficient and accurate source address verification. This dynamic update and verification mechanism enables the SAV‑B device to adapt to changes in the network environment and emerging security threats, thereby providing an efficient defense method for ensuring network security.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a near-destination DDoS defense method based on bidirectional source address verification. Background Art

[0002] Reflection amplification attack is a major problem in the field of network security, posing a huge threat to the normal operation of Internet applications. Reflection amplification attack is a common DDoS attack. Its initiation is roughly divided into two stages. In the first stage, hackers use zombies to forge the response target IP of Internet application protocols such as DNS (Domain Name Server) and NTP (Network Time Protocol) that can amplify the reply message, and then send the data packet to open services such as DNS and NTP; in the second stage, after receiving the message, open services such as DNS and NTP amplify the message according to the amplification factor, and then send the reply message to the received target IP address. Since the two stages involve forged source addresses and real source addresses respectively, the complex source address change behavior and message amplification make this type of attack extremely lethal and require in-depth protection.

[0003] There are many methods for defending against reflection amplification attacks. Basically, these methods are based on different stages of reflection amplification attacks. Currently, the most commonly used methods for DDoS defense are as follows:

[0004] (1) The first stage of reflection amplification attack: verify the forged source address, such as uRPF and other commonly used methods, to infer whether it is a forged source address through the path. However, uRPF and other verification methods may cause false positives when the routing path is asymmetric.

[0005] (2) Targeting open servers for reflection amplification attacks: Detection is performed on servers running open services such as DNS and NTP, and the messages to be sent are analyzed to determine whether a reflection amplification attack is occurring. However, this type of general method has deployment problems. That is, there are many open services in the network, and corresponding services cannot be deployed on all open servers.

[0006] (3) The second stage of reflection amplification attacks: defense against the real source address. This type of defense is relatively rare at present. It mainly uses IP address intelligence to block. However, this type of method usually requires real-time analysis of a large amount of IP address intelligence, which may cause processing delays. In addition, methods that rely on IP address intelligence may mistakenly block legitimate traffic, especially when the attacker uses a forged or frequently changing IP address. Summary of the invention

[0007] In view of the problems existing in the above-mentioned main protection methods for reflection amplification attacks, the present invention uses a two-way source address verification technology to make up for them. The two-way source address verification technology mainly detects and extracts the five-tuple information of a specific type of network data packet packet by packet, and uses an efficient hash function to generate a hash summary for this information to verify the authenticity and legality of the source address of the data packet. This method can effectively prevent source address forgery attacks and improve the overall security protection capabilities of the network. Especially in the stage of reflection amplification attacks and open services sending corresponding data packets to DDoS attack targets, the two-way source address verification method can well protect the area where the SAV-B device is deployed to prevent the target from being attacked.

[0008] The present invention provides a near-destination DDoS defense method based on bidirectional source address verification (SAV-B), in which a bidirectional source address verification SAV-B device is deployed near a DDoS attack target (protected area); the SAV-B device is used to collect and process network data packet information and perform source address verification; the SAV-B device maintains an open service IP address list, and uses the open service IP address list to perform bidirectional verification of the source address of the network data packet.

[0009] The method comprises the following steps:

[0010] Step (1), the SAV-B device generates a message information table, collects five-tuple information of the request packet of the open service concerned, and stores the collected five-tuple information into the message information table, wherein the five-tuple information includes the source IP address, the destination IP address, the source port number, the destination port number and the transmission protocol;

[0011] Optionally, a hash value of the five-tuple information is calculated using a hash algorithm and then cached;

[0012] In step (2), the SAV-B device performs bidirectional source address verification, including the SAV-B device using the five-tuple information and the hash function to generate a hash summary, and using the hash summary to verify the authenticity of the source address of the data packet.

[0013] Furthermore, the SAV-B device performs bidirectional source address verification in two stages:

[0014] In the first stage, the data packet is sent out through the SAV-B device. The SAV-B device extracts the five-tuple information from the request information sent by the host in the protected area, generates a hash summary of the corresponding five-tuple information, and then caches it in the message information table. While caching, the summary is set with a life cycle. When the summary exceeds the life cycle, it is automatically deactivated, and the five-tuple information within the life cycle is verified.

[0015] In the second stage, the data packet is received by the SAV-B device. The SAV-B device receives the data packet from the open service, generates a hash digest based on the data packet, and compares and verifies it with the hash digest in the life cycle in the message information table to identify the false source.

[0016] Furthermore, the SAV-B device is deployed close to the DDoS attack target to optimize the defense effect against reflection amplification attacks and source address spoofing attacks.

[0017] Furthermore, the source address verification includes comparing the hash digest generated by the SAV-B device with the hash digest of the five-tuple information of the network data packet to confirm the legitimacy of the data packet.

[0018] Furthermore, the SAV-B device adopts a dynamic update mechanism during the verification process to adapt to changes in the network environment and emerging security threats.

[0019] Furthermore, the SAV-B device uses an efficient hash function to generate a hash summary for the five-tuple information of the network data packet, so as to quickly and accurately verify the authenticity and legitimacy of the source address of the data packet.

[0020] Through the above steps, DDoS defense can be achieved for reflection amplification attacks near the destination, and source address verification can be performed through the SAV-B device to accurately identify forged source attacks.

[0021] The present invention realizes effective defense against DDoS attacks by deploying a two-way source address verification (SAV-B) device on the side close to the DDoS attack target, extracting the five-tuple information of the network data packet through the SAV-B device, and performing two-way source address verification in combination with a hash function. Through the two-way verification mechanism and the efficient defense method close to the DDoS attack target, the false source address can be accurately identified and the real source DDoS attack can be defended, thereby significantly improving the security and protection efficiency of the network. At the same time, a mechanism for dynamically updating the summary life cycle is adopted to adapt to the continuous changes in the network environment and the emerging security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 This is a network architecture diagram of a bidirectional source address verification defense close to a DDoS attack target provided by an embodiment of the present invention;

[0024] Figure 2 It is a working principle diagram of the bidirectional source address verification mechanism provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] In order to facilitate understanding, the present invention first briefly introduces relevant technical terms.

[0027] Distributed Denial of Service Attack: English name is Distributed Denial of Service, abbreviated as DDoS. DDoS attack is a network attack method that uses a large number of controlled computers or devices to send a large number of requests to the target at the same time, causing the target system to be overloaded, making it impossible for legitimate users to access normally.

[0028] Network 5-tuple: Network 5-tuple in English. Network 5-tuple is a method used to uniquely identify and distinguish data streams in network communications, including source IP address, destination IP address, source port number, destination port number and transport protocol (usually TCP or UDP). This combination of information is crucial in network monitoring, security analysis, load balancing, routing decisions and session management. It allows network devices and applications to accurately identify, filter and manage specific network traffic, ensuring the correct routing and secure transmission of data.

[0029] Hash: The English name is Hash. Hash is a technology widely used in computer science, mainly used for fast data retrieval, data integrity verification and encryption algorithms. Hashing involves converting input (usually a string) into a usually shorter fixed-length value or key, which is implemented by a hash function. Hash functions are designed to map different inputs to unique or as few repetitive hash values ​​as possible. Hashing is often used in data storage, information security or programming.

[0030] Hash Digest: The English name is Hash Digest. Hash Digest is a fixed-size string or numeric value generated by a hash function, which represents a unique identifier of the input data.

[0031] Reverse Path Forwarding: Reverse Path Forwarding, abbreviated as RPF, is a network security technology that is often used to defend against source address forgery and distributed denial of service (DDoS) attacks. The working principle of RPF is to verify whether the source address of the incoming data packet is legitimate. Specifically, RPF checks the source address of the incoming data packet and confirms that the data packet arrives via the best path recorded in its routing table. If the source address of the data packet does not match the information in the routing table, that is, the data packet did not arrive through its expected path, then the data packet will be considered suspicious and may be discarded.

[0032] Forged source address: Also known as IP Spoofing in English. Forged source address is a network attack technique in which the attacker forges the source IP address when sending network data packets, making the data packets look like they come from another legitimate or trusted source. This technique is often used to launch a range of malicious activities, including denial of service attacks (DoS), distributed denial of service attacks (DDoS), session hijacking and network intrusion.

[0033] Reflection Amplification Attack: Reflection Amplification Attack is a distributed denial of service (DDoS) attack method in which the attacker sends a small number of requests to multiple reflection servers by forging the IP address of the target server, inducing these servers to respond to the attack target with a larger amount of data. This attack exploits the characteristics of a specific network protocol, making the response traffic significantly larger than the initial request traffic, thereby amplifying the attack effect. The attacker's identity is hidden due to the involvement of the reflection server, making it more difficult to track and defend against. Defensive measures include limiting the response size, network filtering, source address verification, and response rate limiting, which are designed to mitigate the impact of this attack.

[0034] Source Address Verification: English name is Source Address Validation, abbreviated as SAV. Source address verification is a verification mechanism under the Source Address Validation Architecture (SAVA), which can realize the real source address verification in the network environment to improve the security of the network.

[0035] Bidirectional source address verification: Source Address Validation-Bidirectional, abbreviated as SAV-B, refers to a device or mechanism that can perform bidirectional source address verification on network data packets. Bidirectional source address verification extracts the five-tuple information of the data packet of the managed network terminal, generates a hash summary for each extracted five-tuple information, and registers it in the hash summary record. Each hash summary will have a specific life cycle. Hash summaries that exceed the life cycle will be discarded. For hash summaries within the life cycle, any form of comparison, calculation and verification of hash summaries is supported, so as to achieve the purpose of verifying the source address through status information.

[0036] The network architecture of the near-destination DDoS defense method based on bidirectional source address verification provided by the present invention is as follows: Figure 1 As shown, a bidirectional source address verification SAV-B device is deployed near the DDoS attack target (protected area); the SAV-B device is used to collect and process network data packet information and perform source address verification; the SAV-B device maintains an open service IP address list and uses the open service IP address list to perform bidirectional verification of the source address of the network data packet.

[0037] The method comprises the following steps:

[0038] Step (1), the SAV-B device generates a message information table, collects five-tuple information of the request packet of the open service concerned, and stores the collected five-tuple information into the message information table, wherein the five-tuple information includes the source IP address, the destination IP address, the source port number, the destination port number and the transmission protocol;

[0039] Optionally, a hash value of the five-tuple information is calculated using a hash algorithm and then cached;

[0040] In step (2), the SAV-B device performs bidirectional source address verification, including the SAV-B device using the five-tuple information and the hash function to generate a hash summary, and using the hash summary to verify the authenticity of the source address of the data packet.

[0041] Furthermore, the SAV-B device performs bidirectional source address verification in two stages, such as Figure 2 As shown:

[0042] In the first stage, the data packet is sent out through the SAV-B device. The SAV-B device extracts the five-tuple information from the request information sent by the host in the protected area, generates a hash summary of the corresponding five-tuple information, and then caches it in the message information table. While caching, the summary is set with a life cycle. When the summary exceeds the life cycle, it is automatically deactivated, and the five-tuple information within the life cycle is verified.

[0043] In the second stage, the data packet is received by the SAV-B device. The SAV-B device receives the data packet from the open service, generates a hash digest based on the data packet, and compares and verifies it with the hash digest in the life cycle in the message information table to identify the false source.

[0044] Furthermore, the SAV-B device is deployed close to the DDoS attack target to optimize the defense effect against reflection amplification attacks and source address spoofing attacks.

[0045] Furthermore, the source address verification includes comparing the hash digest generated by the SAV-B device with the hash digest of the five-tuple information of the network data packet to confirm the legitimacy of the data packet.

[0046] Furthermore, the SAV-B device adopts a dynamic update mechanism during the verification process. The life cycle of the summary will be continuously updated. After the summary exceeds the life cycle and is automatically deactivated, if there is a new data packet quintuple information that is the same as the previous quintuple information, the life cycle of the summary will be refreshed and the deactivation timer will be restarted to adapt to the ever-changing network environment and emerging security threats.

[0047] Furthermore, the SAV-B device uses an efficient hash function to generate a hash summary for the five-tuple information of the network data packet, so as to quickly and accurately verify the authenticity and legitimacy of the source address of the data packet.

[0048] Through the above steps, DDoS defense can be implemented near the destination end for reflection amplification attacks.

[0049] The method achieves effective defense against DDoS attacks by deploying a bidirectional source address verification (SAV-B) device close to the DDoS attack target.

[0050] The following is a comprehensive and complete description of a near-destination DDoS defense method based on bidirectional source address verification provided by the present invention in conjunction with the accompanying drawings and specific embodiments.

[0051] Example: Using a near-destination DDoS defense method based on bidirectional source address verification (SAV-B) in a DNS reflection amplification attack scenario

[0052] Step 1: Initial request reception and quintuple information extraction

[0053] At this stage, network security devices, such as proxy servers or border defense devices, play the role of gatekeepers for network traffic. When a DNS query request arrives, the first task of the SAV-B device is to extract key network layer and transport layer information, namely the five-tuple information. The five-tuple information consists of the source IP address, destination IP address, source port number, destination port number, and protocol type (such as TCP or UDP). Together, this information forms the basis of network communication and is crucial for subsequent security detection.

[0054] For example, consider the following three DNS query requests with five-tuple information:

[0055] "172.168.1.1:10.0.0.1:12345:53:UDP"

[0056] "192.168.1.1:10.0.0.1:12345:53:UDP"

[0057] "192.168.1.3:10.0.0.1:12345:53:UDP"

[0058] This five-tuple information not only identifies the source and destination of the request, but also hints at the type of request (in this case, a DNS query, which typically uses port 53). The SAV-B device uses this information to determine whether the request is of concern, such as whether it comes from a known suspicious source.

[0059] Step 2: SAV-B provides bidirectional source address verification

[0060] For DNS query requests whose source addresses appear on the watch list, step 2 involves an in-depth security audit of these specific requests. The SAV-B device will compare and verify the source IP address in the five-tuple information with the hash summary stored by SAV-B. If the corresponding hash summary exists, the verification passes. If not, it is considered non-compliant. This step is the key to achieving two-way source address verification, which aims to confirm whether the client initiating the query is the legal holder of its IP address.

[0061] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A near-destination DDoS defense method based on bidirectional source address verification, characterized in that: Deploy a bidirectional source address verification SAV-B device near the DDoS attack target, i.e. the protected area; the SAV-B device is used to collect and process network data packet information and perform source address verification; The SAV-B device maintains an open service IP address list and uses the open service IP address list to perform two-way verification of the source address of the network data packet; the defense method includes the following steps: Step (1), the SAV-B device generates a message information table, collects five-tuple information of the request packet of the open service concerned, and stores the collected five-tuple information into the message information table, wherein the five-tuple information includes the source IP address, the destination IP address, the source port number, the destination port number and the transmission protocol; Step (2), the SAV-B device performs bidirectional source address verification, including the SAV-B device using the five-tuple information and the hash function to generate a hash summary, and using the hash summary to verify the authenticity of the source address of the data packet; The SAV-B device performs bidirectional source address verification in two stages: In the first stage, the data packet is sent out through the SAV-B device. The SAV-B device extracts the five-tuple information from the request information sent by the host in the protected area, generates a hash summary of the corresponding five-tuple information, and then caches it in the message information table. While caching, the summary is set with a life cycle. When the summary exceeds the life cycle, it is automatically deactivated, and the five-tuple information within the life cycle is verified. In the second stage, the data packet is received by the SAV-B device. The SAV-B device receives the data packet from the open service, generates a hash digest based on the data packet, and compares and verifies it with the hash digest in the life cycle in the message information table to identify the false source.

2. The method according to claim 1, characterized in that In step (1), a hash algorithm is used to calculate the hash value of the five-tuple information, and then the calculated hash value is stored in the message information table.

3. The method according to claim 1, characterized in that The SAV-B device is deployed close to the DDoS attack target to optimize the defense effect against reflection amplification attacks and source address spoofing attacks.

4. The method according to any one of claims 1 to 3, characterized in that: The source address verification includes comparing the hash digest generated by the SAV-B device with the hash digest of the five-tuple information of the network data packet to confirm the legitimacy of the data packet.

5. The method according to any one of claims 1 to 4, characterized in that: The SAV-B device uses a dynamic update mechanism during the verification process to adapt to changes in the network environment and emerging security threats.

Images