Port defense method, system and device based on MAC address and medium

Abstract

The invention provides a port defense method, system and device based on an MAC address and a medium, and the defense comprises the steps: obtaining a data frame sent by an access device, the data frame comprising the MAC address of the access device; when it is detected that the table item of the MAC address exists in the MAC address table, the survival time number of the table item is obtained; the number of times of survival time is used for identifying the effective time of the MAC address, the number of times of survival time of the table entry is reduced every preset time, and the number of times of survival time of the table entry is increased every time when the MAC address is learned and the corresponding receiving port is changed; learning the MAC address when judging that the number of survival times is smaller than or equal to a set threshold value; when it is judged that the survival times are larger than a set threshold value, the data frames are discarded; according to the above steps, attack behaviors caused by MAC drift in a short time can be identified, automatic defense is carried out, namely, the MAC is not learned and the frame data is discarded, meanwhile, configuration is simple, regular updating is not needed, and the network performance and the data transmission rate are not affected.

Description

Technical Field

[0001] The present application relates to the technical field of switches, and in particular to a port defense method, system, device and medium based on MAC address. Background Art

[0002] Switch port security technology protects network devices from unauthorized access and attacks by limiting access to network resources, thereby ensuring the security of network resources and data. With the continuous expansion of network scale and the increasing diversity of network attack methods, port security technology has become an important means to ensure network security; Common switch port security technologies include: Port security address binding, that is, by binding the MAC address to the port, precise control of the device can be achieved; when a device is connected to the switch, the switch will check whether its MAC address is in the allowed list, if not, it will be denied access; Port access control, that is, by setting an access control list (ACL), the data flow entering the switch port is filtered, and only specific MAC addresses, IP addresses or protocols are allowed to pass, so as to effectively prevent unauthorized devices from accessing the network; Port security protection, that is, protecting the switch port by setting port security parameters, such as the maximum number of MAC addresses allowed, the handling method when the rules are violated (such as disabling the port), etc. Port security isolation, that is, protecting specific devices or network areas by isolating certain ports from other ports to prevent unauthorized access and attacks; Port security dynamic learning: By configuring the port security dynamic learning function, you can limit the number of MAC addresses learned by the switch, thereby reducing the risk of MAC drift; Port security is enabled to improve network security by limiting the number of devices that can communicate through the port to authorized devices only.

[0003] However, the above methods still have problems such as complex configuration, the need for regular updates, affecting network performance, and reducing data transmission rates. In addition, false alarms are prone to occur if the configuration is improper. For example, port security address binding may be restricted by attack methods, such as bypassing port security restrictions by changing MAC addresses. Summary of the invention

[0004] The purpose of this application is to provide a MAC address-based port defense method, system, device and medium to address the above problems.

[0005] In a first aspect, the present application provides a port defense method based on a MAC address, comprising: Acquire a data frame sent by an access device, wherein the data frame includes a MAC address of the access device; When detecting that the MAC address entry exists in the MAC address table: Obtaining the number of survival times of the table entry; the number of survival times is used to identify the effective time of the MAC address, the number of survival times of the table entry decreases every preset time, and each time the MAC address is learned and the corresponding receiving port changes, the number of survival times of its table entry increases; When it is determined that the number of survival times is less than or equal to a set threshold, learning the MAC address; When it is determined that the survival time is greater than a set threshold, the data frame is discarded.

[0006] According to the technical solution provided by the present application, after obtaining the data frame sent by the access device, it also includes: when detecting that the entry of the MAC address does not exist in the MAC address table, learning the MAC address.

[0007] According to the technical solution provided by the present application, the lifetime number of the table entry is reduced by 1 at every preset time, and the lifetime number of the table entry is increased by 1 each time the MAC address is learned.

[0008] According to the technical solution provided in this application, the preset time is 1-3600 seconds.

[0009] According to the technical solution provided in this application, the set threshold is 1-3600 times.

[0010] In a second aspect, the present application provides a port defense method based on a MAC address, comprising: Acquire a data frame sent by an access device, wherein the data frame includes a MAC address of the access device; Obtaining a receiving port change frequency f of a data frame corresponding to the MAC address, wherein the receiving port change frequency f is used to represent the number of changes of the receiving port corresponding to the MAC address within a preset period T; the preset period T includes time t-T+1 to current time t; When it is determined that the receiving port change frequency f is greater than a preset frequency, the data frame is discarded.

[0011] According to the technical solution provided in the present application, the preset period T is 1-3600s; the preset frequency is f=(1-500) times / T.

[0012] In a third aspect, the present application provides a port defense system based on a MAC address, comprising: A receiving module, wherein the receiving module is configured to: obtain a data frame sent by an access device, wherein the data frame includes a MAC address of the access device; The processing module, the detection module is configured to: When detecting that the MAC address entry exists in the MAC address table: Obtaining the number of survival times of the table entry; the number of survival times is used to identify the effective time of the MAC address, the number of survival times of the table entry decreases every preset time, and each time the MAC address is learned and the corresponding receiving port changes, the number of survival times of its table entry increases; When it is determined that the number of survival times is less than or equal to a set threshold, learning the MAC address; When it is determined that the survival time is greater than a set threshold, the data frame is discarded.

[0013] In a fourth aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described above when executing the computer program.

[0014] In a fourth aspect, the present application provides a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the method described above is implemented. Compared with the prior art, the beneficial effects of the present application are as follows: when a table entry with the same MAC address is received, the lifetime number of the table entry is increased, and the lifetime number of the table entry is reduced every preset time, and then the lifetime number is compared with the threshold to identify the attack behavior caused by MAC drift in a short period of time, and make automatic defense, that is, do not learn the MAC and discard the frame data. The above steps can realize the defense protection of the MAC port, and the configuration is simple, no regular update is required, and network performance and data transmission rate are not affected.

[0015] It should be understood that the description of technical features, technical solutions, beneficial effects or similar language in this application does not imply that all features and advantages can be realized in any single embodiment. On the contrary, it is understood that the description of features or beneficial effects means that specific technical features, technical solutions or beneficial effects are included in at least one embodiment. Therefore, the description of technical features, technical solutions or beneficial effects in this specification does not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions and beneficial effects described in the present embodiment can also be combined in any appropriate manner. Those skilled in the art will understand that the embodiment can be realized without one or more specific technical features, technical solutions or beneficial effects of a specific embodiment. In other embodiments, additional technical features and beneficial effects can also be identified in a specific embodiment that does not embody all embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solution in this embodiment, the drawings required for use in the description of the embodiment will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A flowchart of a port defense method based on MAC address provided in an embodiment of the present application; Figure 2 A schematic diagram of a MAC address-based port defense system provided in an embodiment of the present application; Figure 3 A schematic diagram of a computer system of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to enable those skilled in the art to better understand the technical solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings. The description in this section is only exemplary and explanatory and should not have any limiting effect on the protection scope of the present application. Specifically, the described embodiments are only embodiments of a part of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work should fall within the scope of protection of the present application.

[0019] It should be noted that similar reference numerals and letters represent similar items in the following figures, so once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0020] In order to facilitate the understanding of this application, a brief introduction to the related technology is first given: MAC: Media Access Control, also known as physical address or hardware address; Learning MAC addresses: When a switch receives a data frame, it checks the source MAC address of the frame and stores the address and the port information that received the frame in the MAC address table. This process is called MAC address learning; Switch port security technology can prevent MAC drift attacks, protect network devices from unauthorized access and attacks, and ensure the security of network resources and data. However, there are still problems such as complex configuration, the need for regular updates, affecting network performance, and reducing data transmission rates. In addition, false alarms are prone to occur if the configuration is improper. For example, port security address binding may be restricted by attack methods, such as bypassing port security restrictions by changing the MAC address.

[0021] In view of this, an embodiment of the present application provides a port defense method based on MAC address, the method comprising: S100: Acquire a data frame sent by an access device, where the data frame includes a MAC address of the access device; S201: When detecting that a MAC address entry exists in the MAC address table: Get the lifetime count of the table entry; the lifetime count is used to identify the effective time of the MAC address. The lifetime count of the item decreases every preset time table, and the lifetime count of the item increases every time a MAC address is learned and the corresponding receiving port changes; When the survival time is less than or equal to the set threshold, the MAC address is learned; When the survival time is judged to be greater than the set threshold, the data frame is discarded.

[0022] In some embodiments, after acquiring the data frame sent by the access device, the method further includes: S202: When it is detected that the MAC address entry does not exist in the MAC address table, the MAC address is learned; and at this time, the number of lifetime times corresponding to the MAC address is 1; In some embodiments, the lifetime count of each preset schedule item is reduced by 1, and each time a MAC address is learned and the corresponding receiving port is changed, the lifetime count of its table item is increased by 1.

[0023] Furthermore, learning the MAC address also includes updating the MAC address table; the updating includes updating the port information corresponding to the MAC address.

[0024] Furthermore, the number of survival times is recorded in the MAC address table or in other storage space.

[0025] In order to facilitate the understanding of those skilled in the art, a specific example is used below for explanation. In this example, the access device is device A, the MAC address of the access device is MAC-A, the preset time is 10s, the threshold is set to 3, and the initial MAC address table is shown in Table-1: Table 1 Initial MAC address table

[0026] The specific process is as follows: Get the data frame M1 sent by device A. The data frame M1 contains the MAC address of device A, that is, MAC-A. Detect that there is no MAC-A entry in the MAC address table, learn MAC-A, and the lifetime of the entry corresponding to MAC-A is 1. For ease of understanding, take the current receiving port = 200 as an example. The learned MAC address table is shown in Table-2: Table-2 First update of MAC address table

[0027] At 1s, the data frame M2 containing MAC-A sent by device A is obtained through receiving port 300; Detect that there is an entry of MAC-A in the MAC address table, obtain the lifetime count of the entry of MAC-A, that is, 1, and when it is determined that the lifetime count 1 is less than the set threshold 3, learn the MAC address. The updated MAC address table is shown in Table-3. Since the port information of MAC-A has changed at this time, the lifetime count of the entry of MAC-A is updated to 2. Table-3 Second update of MAC address table

[0028] At 8s, the data frame M3 containing MAC-A sent by device A is obtained through receiving port 300; Detect that there is a MAC-A entry in the MAC address table, obtain the lifetime count of the MAC-A entry, which is 2, determine that the lifetime count 2 is less than the set threshold 3, learn the MAC address, and because the receiving port has not changed, the lifetime count of the MAC-A entry is still 2; At 10s, the data frame M4 containing MAC-A sent by device A is obtained through receiving port 200; Detect that there is an entry of MAC-A in the MAC address table, obtain the lifetime count of the entry of MAC-A, that is, 2, determine that the lifetime count 2 is less than the set threshold 3, learn the MAC address, and the updated MAC address table is shown in Table-4. Since the port information of MAC-A has changed at this time, the lifetime count of the entry of MAC-A is updated to 3, but since the lifetime count of the entry is reduced by 1 every preset time of 10s, the final lifetime count of the entry of MAC-A is 2 at this time; Table-4 The third update of MAC address table

[0029] At 11 seconds, the data frame M5 containing MAC-A sent by device A is obtained through port 400; Similarly, the lifetime of MAC-A's entry is updated to 3. At 12 seconds, the data frame M6 containing MAC-A sent by device A is obtained through port 200; Similarly, the lifetime of MAC-A's entry is updated to 4. At 13 seconds, the data frame M7 containing MAC-A sent by device A is obtained through port 100; It is detected that there is a table entry of MAC-A in the MAC address table, and the survival time count of the table entry of MAC-A, that is, 4, is obtained. When it is determined that the survival time count 4 is greater than the set threshold 3, the data frame M7 is discarded.

[0030] At 20s, since the lifetime of the entry is reduced by 1 every 10s, the lifetime of MAC-A's entry is 3. It should be noted that the above examples are only for the convenience of understanding of those skilled in the art and are not intended to limit the present application. At the same time, it is not difficult to see from the above process that the present solution can identify attack behaviors caused by MAC drift in a short period of time and make automatic defense, that is, not learning the MAC and discarding the frame data.

[0031] In some embodiments, the preset time is 1-3600 seconds, for example, 10 seconds.

[0032] In some embodiments, the threshold is set to be 1-3600 times, for example, set to 3; the threshold and the survival time are count values, and the unit may be times, for example.

[0033] This embodiment also provides another port defense method based on MAC address, including: Acquire a data frame sent by an access device, wherein the data frame includes a MAC address of the access device; Obtaining a receiving port change frequency f of a data frame corresponding to the MAC address, wherein the receiving port change frequency f is used to represent the number of changes of the receiving port corresponding to the MAC address within a preset period T; the preset period T includes time t-T+1 to current time t; When it is determined that the receiving port change frequency f is greater than a preset frequency, the data frame is discarded.

[0034] Among them, t-T+1>0; In the above steps, the receiving frequency is obtained to identify the attack behavior caused by MAC drift in a short period of time, and automatic defense is performed, that is, the MAC is not learned and the frame data is discarded.

[0035] In some embodiments, the MAC address-based port defense method further includes: retaining the data frame when it is determined that the receiving port change frequency f is less than or equal to a preset frequency; In some embodiments, according to the technical solution provided in the present application, the preset period T is 1-3600s; the preset frequency is f=(1-500) times / T.

[0036] For example, the preset period T is 10s, and the preset frequency is 3 times / 10s; To facilitate understanding by those skilled in the art, the following description is given with a preset period T=5s, a preset frequency f=2 times / 5s, and a MAC address of device B as MAC-B.

[0037] At 1s, a data frame containing the MAC-B address is received through receiving port 100; At 2s, a data frame containing a MAC-B address is received through receiving port 100; At 3s, a data frame containing a MAC-B address is received through receiving port 100; At 4s, a data frame containing a MAC-B address is received through receiving port 200; At 5s, a data frame containing a MAC-B address is received through receiving port 300; At 6s, a data frame containing a MAC-B address is received through receiving port 300; at this time, within the preset period T=5 (i.e., 2s-6s), the receiving port corresponding to the MAC-B address changes twice, i.e., at 4s, receiving port 100 changes to receiving port 200, and at 5s, receiving port 200 changes to receiving port 300, and then the receiving port change frequency f=2 times / 5s is obtained. At this time, it is determined that 2 times / 5s is equal to the preset frequency, so the data frame is retained; At 7s, a data frame containing a MAC-B address is received through receiving port 400; at this time, within the preset period T=5 (i.e., 3s-7s), the receiving port corresponding to the MAC-B address changes 3 times, that is, at 4s, receiving port 100 changes to receiving port 200, at 5s, it changes from receiving port 200 to receiving port 300, and at 7s, receiving port 300 changes to receiving port 400, thereby obtaining a receiving port change frequency f=3 times / 5s. At this time, it is determined that 3 times / 5s is greater than the preset frequency, so the data frame is discarded.

[0038] like Figure 2 As shown, this figure is a schematic diagram of a port defense system based on MAC address provided by the present application, and the system includes: A receiving module 1, wherein the receiving module 1 is configured to: obtain a data frame sent by an access device, wherein the data frame includes a MAC address of the access device; Processing module 2, the detection module 2 is configured to: When detecting that the MAC address entry exists in the MAC address table: Obtaining the number of survival times of the table entry; the number of survival times is used to identify the effective time of the MAC address, the number of survival times of the table entry decreases every preset time, and each time the MAC address is learned, the number of survival times of its table entry increases; When it is determined that the number of survival times is less than or equal to a set threshold, learning the MAC address; When it is determined that the survival time is greater than a set threshold, the data frame is discarded.

[0039] The MAC address-based port defense system provided in the embodiment of the present application may correspond to executing the MAC address-based port defense method described in the embodiment of the present application, and the above functions of each module of the system correspond to implementing Figure 1 For the sake of brevity, the corresponding process of the method shown will not be repeated here.

[0040] An embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the MAC address-based port defense method as described in the above embodiment is implemented.

[0041] like Figure 3 As shown, the computer system 400 of the electronic device includes a CPU 401, which can perform various appropriate actions and processes according to the program stored in the ROM 402 or the program loaded from the storage part 408 to the RAM 403. In the RAM 403, various programs and data required for system operation are also stored. The CPU 401, the ROM 402 and the RAM 403 are connected to each other through a bus 404. The I / O interface 405 is also connected to the bus 404. Among them, CPU 401 represents a central processing unit, ROM 402 represents a read-only memory, RAM 403 represents a random access memory, and I / O represents input / output.

[0042] The following components are connected to the I / O interface 405: an input section 406 including a keyboard, a mouse, etc.; an output section 407 including a cathode ray tube, a liquid crystal display, etc., and a speaker, etc.; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN card, a modem, etc. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the I / O interface 405 as needed. A removable medium 411, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 410 as needed, so that a computer program read therefrom is installed into the storage section 408 as needed.

[0043] In particular, the process of the port defense method based on MAC address described in the above embodiment can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains program code for executing the port defense method based on MAC address described in the above embodiment. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 409, and / or installed from the removable medium 411. When the computer program is executed by the CPU 401, the above functions defined in the present computer system 400 are executed.

[0044] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the port defense method based on MAC address as described in the above embodiment is implemented.

[0045] Specifically, the computer-readable storage medium may be included in the electronic device described in the above embodiment; or it may exist independently without being assembled into the electronic device. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the port defense method based on MAC address as described in the above embodiment.

[0046] It should be noted that the computer-readable storage medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical fiber, a portable compact disk read-only memory, an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above.

[0047] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and its core ideas of this application. The above is only the preferred implementation method of this application. It should be pointed out that due to the limitations of textual expression and the objective existence of infinite specific structures, ordinary technicians in this technical field can make several improvements, modifications or changes without departing from the principles of the present invention, and can also combine the above technical features in an appropriate manner; these improvements, modifications, changes or combinations, or the direct application of the inventive concept and technical solution to other occasions without improvement, should be regarded as the scope of protection of this application.

Claims

1. A port defense method based on MAC address, characterized in that: include: Acquire a data frame sent by an access device, wherein the data frame includes a MAC address of the access device; When detecting that the MAC address entry exists in the MAC address table: Obtaining the number of survival times of the table entry; the number of survival times is used to identify the effective time of the MAC address, the number of survival times of the table entry decreases every preset time, and each time the MAC address is learned and the corresponding receiving port changes, the number of survival times of its table entry increases; When it is determined that the number of survival times is less than or equal to a set threshold, learning the MAC address; When it is determined that the survival time is greater than a set threshold, the data frame is discarded.

2. The port defense method based on MAC address according to claim 1, characterized in that: After acquiring the data frame sent by the access device, the method further includes: learning the MAC address when detecting that an entry of the MAC address does not exist in the MAC address table.

3. The port defense method based on MAC address according to claim 1, characterized in that: The number of lifetime times of the table entry is reduced by 1 at every preset time, and the number of lifetime times of the table entry is increased by 1 each time the MAC address is learned and the corresponding receiving port is changed.

4. The port defense method based on MAC address according to claim 3 is characterized in that: The preset time is 1-3600 seconds.

5. The port defense method based on MAC address according to claim 3, characterized in that: The set threshold is 1-3600 times.

6. A port defense method based on MAC address, characterized in that: include: Acquire a data frame sent by an access device, wherein the data frame includes a MAC address of the access device; Obtaining a receiving port change frequency f of a data frame corresponding to the MAC address, wherein the receiving port change frequency f is used to represent the number of changes of the receiving port corresponding to the MAC address within a preset period T; the preset period T includes time t-T+1 to current time t; When it is determined that the receiving port change frequency f is greater than a preset frequency, the data frame is discarded.

7. The port defense method based on MAC address according to claim 6, characterized in that: The preset period T is 1-3600s; the preset frequency is f=(1-500) times / T.

8. A port defense system based on MAC address, characterized in that: include: A receiving module, wherein the receiving module is configured to: obtain a data frame sent by an access device, wherein the data frame includes a MAC address of the access device; The processing module, the detection module is configured to: When detecting that the MAC address entry exists in the MAC address table: Obtaining the number of survival times of the table entry; the number of survival times is used to identify the effective time of the MAC address, the number of survival times of the table entry decreases every preset time, and each time the MAC address is learned and the corresponding receiving port changes, the number of survival times of its table entry increases; When it is determined that the number of survival times is less than or equal to a set threshold, learning the MAC address; When it is determined that the survival time is greater than a set threshold, the data frame is discarded.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images