Network attack protection method and device, electronic equipment and storage medium

Abstract

The present disclosure relates to a network attack protection method and device, electronic equipment and storage medium, the method comprising: obtaining an initial message to be sent and a random payload, the payload type of the random payload being one of the Internet Key Exchange (IKE) payload reserved types; generating a new message based on the initial message and the random payload; and sending the new message to a receiving end. The present disclosure achieves the fuzzing of the IKE message, so that a malicious terminal cannot identify the IKE message without knowing the IP of the network device. Furthermore, even if the intercepted message is identified as an IKE message, the network device cannot be accurately located, increasing the difficulty of identifying the network device, thereby avoiding the risk of malicious cracking and attack on the network device.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of communication network security, and particularly relates to a network attack protection method and device, electronic equipment and storage medium. BACKGROUND

[0002] In the field of mobile communication, a security gateway is used between a base station and a core network to ensure the security of service data in a backhaul network. The base station and the security gateway use Internet security (IP Security, IPsec) technology to achieve the above purpose, and an Internet Key Exchange (IKE) is used to complete the automatic management of IPsec, including the management of security association (IPsec SA) integrity protection and encryption-related secret keys. Therefore, the IKE process becomes a key process for malicious terminals to crack the service data of the backhaul network. In the case of increasingly stringent requirements for communication network security, how to strengthen the security of the mobile communication backhaul network, especially the security of the IKE process, has become a key problem that needs to be solved in the backhaul network. SUMMARY

[0003] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a network attack protection method and device, electronic equipment and storage medium.

[0004] In a first aspect, the present disclosure provides a network attack protection method, which comprises:

[0005] obtaining an initial message to be sent and a random payload, the payload type of the random payload being one of the Internet Key Exchange (IKE) payload reserved types;

[0006] generating a new message based on the initial message and the random payload;

[0007] sending the new message to a receiving end.

[0008] In a second aspect, the present disclosure provides a network attack protection device, which comprises:

[0009] an obtaining module, configured to obtain an initial message to be sent and a random payload, the payload type of the random payload being one of the Internet Key Exchange (IKE) payload reserved types;

[0010] a message generating module, configured to generate a new message based on the initial message and the random payload;

[0011] a message sending module, configured to send the new message to a receiving end.

[0012] In a third aspect, the present disclosure provides an electronic device, comprising a processor and a memory; the processor is configured to execute a network attack protection method according to the first aspect by invoking a program or instruction stored in the memory.

[0013] In a fourth aspect, the present disclosure provides a computer readable storage medium, wherein computer execution instructions are stored in the computer readable storage medium, and the computer execution instructions are configured to implement the network attack protection method according to the first aspect when executed by a processor.

[0014] In a fifth aspect, the present disclosure provides a computer program product, comprising a computer program, wherein the computer program is configured to implement the network attack protection method according to the first aspect when executed by a processor.

[0015] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:

[0016] In the present solution, an initial message to be sent and a random payload are obtained, the payload type of the random payload is one of the Internet Key Exchange (IKE) payload reserved types, a new message is generated based on the initial message and the random payload, and then the new message is sent to a receiving end. By adding the random payload to the initial message to obtain the new message and sending the new message to the receiving end, the IKE message is blurred, so that a malicious terminal cannot identify the IKE message without knowing the IP of the network device. Further, even if the intercepted message is identified as an IKE message, the network device cannot be accurately located, the difficulty of identifying the network device is increased, and the risk of malicious cracking and attack of the network device is avoided. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present disclosure and, together with the specification, serve to explain the principles of the present disclosure.

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0019] Figure 1 A flowchart of a network attack protection method provided by an exemplary embodiment of the present disclosure is shown in the following figure:

[0020] Figure 2 A flowchart of a network attack protection method provided by another exemplary embodiment of the present disclosure is shown in the following figure:

[0021] Figure 3A network architecture schematic diagram of an exemplary embodiment of the present disclosure is shown.

[0022] Figure 4 An internal structure schematic diagram of a base station and a security gateway of an exemplary embodiment of the present disclosure is shown.

[0023] Figure 5 An initial exchange processing flow schematic diagram of an exemplary embodiment of the present disclosure is shown.

[0024] Figure 6 A processing flow schematic diagram of re-negotiation of an IKE SA of an exemplary embodiment of the present disclosure is shown.

[0025] Figure 7 A processing flow schematic diagram of re-negotiation of a CHILD SA of an exemplary embodiment of the present disclosure is shown.

[0026] Figure 8 A structure schematic diagram of a network attack protection device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0027] In order to more clearly understand the above-mentioned purposes, features and advantages of the present disclosure, the schemes of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0028] In the following description, many specific details are set forth in order to fully understand the present disclosure, but the present disclosure can also be implemented in other ways different from those described herein; obviously, the embodiments in the description are only some of the embodiments of the present disclosure, not all the embodiments.

[0029] The security protection process of the base station and the security gateway can be divided into three stages: security device identification, IKE process key cracking and service flow identification. In the existing security enhancement control scheme of the IKE process, the security protection is mainly performed from the second stage (IKE process key cracking) or the third stage (service flow identification). For example, by identifying illegal IKE messages, discarding and recording the characteristics of illegal IKE messages, continuously filtering illegal IKE messages of subsequent same traffic, the purpose of enhancing the IKE process is achieved; by identifying illegal service IPsec messages, and then deleting the IPsec SA to which the service IPsec messages belong, the purpose of protecting the security of service data is achieved. However, the above methods are security protection measures after the network device is identified, and do not make any security protection for the network device identification.

[0030] In view of the deficiencies of the existing solutions, the scheme of the present disclosure proposes protective measures for network device identification, puts the security protection measures in the front, and designs corresponding countermeasures for the commonly used message filtering methods, so that the malicious terminal cannot accurately identify the base station and the security gateway device through conventional means on the premise of not knowing the IP of the base station and the security gateway device, thereby blocking the malicious attack behavior before the IKE process, increasing the difficulty of network device identification in the mass of live network traffic from the source, reducing the possibility of being maliciously brute-forced, avoiding the situation that the security gateway device cannot provide normal security protection services for the backhaul network of the base station and the core network after being identified due to malicious cracking and attack, and enhancing the security performance of the backhaul network between the base station and the security gateway. The present scheme can be implemented without relying on external network elements, has a simple implementation manner, and has good upward compatibility.

[0031] The implementation of the embodiment of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0032] Figure 1 A flowchart of a network attack protection method provided by an exemplary embodiment of the present disclosure is shown. The method can be executed by a network attack protection device provided by an embodiment of the present disclosure. The device can be implemented in software and / or hardware, and can be integrated in an electronic device, which can be a base station or a security gateway.

[0033] As shown in Figure 1 , the network attack protection method can include the following steps:

[0034] In step 101, an initial message to be sent and a random payload are obtained, and the payload type of the random payload is one of the IKE payload reserved types.

[0035] IKE is a key management protocol used to establish and manage secure connections between both ends of an IPsec tunnel, including the IKE_SA_INIT phase and the IKE-AUTH phase. Taking IKEv2 as an example, the main IKEv2 key protocol processes are:

[0036] (1) IKE_SA_INIT request: the initiator sends an IKE_SA_INIT request message to the responder, which generally carries a password algorithm suite group payload supported by the initiator, a Diffie-Hellman key exchange content payload, and a one-time random number payload, which are transmitted in plaintext.

[0037] (2) IKE_SA_INIT response: the IKE_SA_INIT response message is a response of the responder to the IKE_SA_INIT request message, generally carrying a cipher algorithm suite payload selected by the responder from the received initiator-supported cipher algorithm suite, a Diffie-Hellman key exchange content payload, a one-time random number payload, and an optional certificate request payload, transmitted in a plaintext manner; after receiving the IKE_SA_INIT response message, the initiator establishes the IKE SA according to the selected parameters. It can be concluded from the content composition of the IKE_SA_INIT response message that the payload composition is relatively fixed, the length is relatively fixed, and the message is more easily identified by a malicious terminal through filtering the message length;

[0038] (3) IKE_AUTH request: under the integrity protection and encryption protection of the IKE SA, used for establishing a CHILD SA; the initiator sends an IKE-AUTH request message to the responder, which is a subsequent message in the first phase of the IKE and is used for completing identity authentication and finally establishing an IKE security association (SA), and contains: (1) Initiator Nonce: a random value provided in the IKE_SA_INIT request message; (2) Responder Nonce: a responder random value obtained from the IKE_SA_INIT response message; Authentication Data: authentication data, which can be a hash value of a pre-shared key (PSK), a digital signature or data of other authentication methods; (4) Certificate Data: if a public key / private key certificate is used for identity authentication, certificate data is contained; (5) Notification Data: if there is an error or notification information to be sent, this field can be contained;

[0039] (4) IKE_AUTH response: under the integrity protection and encryption protection of the IKE SA, used for establishing a CHILD SA; the IKE_AUTH response message is a response of the responder to the IKE_AUTH request message;

[0040] (5) CREATE_CHILD_SA request: under the integrity protection and encryption protection of the IKE SA, used for adding a CHILD SA, re-negotiating a CHILD SA, and re-negotiating an IKE SA;

[0041] (6) CREATE_CHILD_SA response: under the integrity protection and encryption protection of the IKE SA, used for adding a CHILD SA, re-negotiating a CHILD SA, re-negotiating an IKE SA, wherein the CREATE_CHILD_SA response message of the re-negotiating IKE SA carries similar payloads as the IKE_INIT response message;

[0042] (7) Re-authentication: the re-authentication adopts a similar process as the initial exchange, which is not repeated here;

[0043] (8) INFORMATIONAL message for performing a dead peer detection (DPD) or a deletion notification.

[0044] In the authentication process, the IKE_AUTH, CREATE_CHILD_SA and INFORMATIONAL messages are under the integrity protection and encryption protection of the IKE SA, and it is difficult to directly intercept such messages for brute force cracking. The IKE_SA_INIT request / response message without integrity protection and encryption protection is more likely to be the primary target for interception and further brute force cracking by a malicious terminal. Therefore, the effect of the additional random payload is most obvious for the IKE_SA_INIT request and response messages.

[0045] In order to comprehensively protect security, in the embodiment, the random payload can be added to each link message in the IKE authentication process to blur the network fingerprint characteristics of the original IKE message, thereby increasing the difficulty of identifying the network device in a large amount of existing network service traffic. That is, in the embodiment, the initial message can be any one of an IKE_SA_INIT request message, an IKE_AUTH request message, a CREATE_CHILD_SA request message, and a DPD message for a base station. For a security gateway, the initial message can be any one of an IKE_SA_INIT response message, an IKE_AUTH response message, and a CREATE_CHILD_SA response message.

[0046] In the embodiment, the random payload is a payload carrying an IKE payload reserved type, that is, the payload type of the random payload is one of the IKE payload reserved types, which are payload types that are not carried in the negotiation message in the existing IKE authentication process. The payload content of the random payload can be preset or randomly generated. The payload type and / or the payload content of the random payload are randomly obtained.

[0047] In step 102, a new message is generated based on the initial message and the random payload.

[0048] In this embodiment, after the initial message and the random payload message are obtained, the random payload can be inserted into the initial message to obtain a new message.

[0049] As an example, the random payload can be inserted into a specified position of the initial message to obtain the new message. For example, the random payload can be inserted after the last payload of the initial message to obtain the new message, i.e., the random payload is the last payload in the new message.

[0050] As an example, the random payload can be inserted into a random position between the original payloads of the initial message to obtain the new message.

[0051] In step 103, the new message is sent to the receiving end.

[0052] In this embodiment, after the new message is generated, the generated new message can be sent to the receiving end.

[0053] As an example, the new message can be sent to the receiving end through a pre-configured fixed port.

[0054] As an example, the port can be randomly selected before sending, and the new message can be sent to the receiving end through the randomly selected port.

[0055] It can be understood that in this embodiment, if the new message is generated by the base station, the receiving end is a security gateway; if the new message is generated by the security gateway, the receiving end is a base station.

[0056] The network attack protection method of the embodiments of the present disclosure obtains an initial message to be sent and a random payload, the payload type of the random payload is one of the Internet Key Exchange (IKE) payload reserved types, generates a new message based on the initial message and the random payload, and then sends the new message to a receiving end. By adding the random payload to the initial message to obtain the new message and sending the new message to the receiving end, the IKE message is blurred, so that the malicious terminal cannot identify the IKE message without knowing the IP of the network device, and further, even if the intercepted message is identified as an IKE message, the network device cannot be accurately located, increasing the difficulty of identifying the network device, thereby avoiding the risk of malicious cracking and attack of the network device.

[0057] In an optional embodiment of the present disclosure, the load type of the random load can be randomly selected, based on which, when the random load is acquired, one of the IKE load reserved types can be randomly selected as a target load type, and then the load content is acquired, and then the random load is generated based on the target load type and the load content. By randomly selecting one of the IKE load reserved types as the load type of the random load, the malicious terminal cannot identify the IKE message through the load type, the network fingerprint feature of the IKE message between the base station and the security gateway is blurred, and the difficulty of identifying the network equipment is increased.

[0058] In an optional embodiment of the present disclosure, the load content of the random load can be randomly generated, based on which, in the present embodiment, when the random content is acquired to generate the random load, a target load length can be acquired first, the target load length indicating the length of the load content to be generated, i.e. the number of characters contained in the load content, then a target character corresponding to the number of the target load length can be randomly selected from the preset character set based on the acquired target load length, and then the load content is generated based on the target character. For example, the target load length is 10, then 10 characters are randomly selected from the preset character set as target characters, and the load content with a load length of 10 is generated by using the 10 target characters. It should be noted that in the present embodiment, when the load content is generated based on the target character, the target characters can be sequentially spliced in the order of the acquired target characters to obtain the load content, or the acquired target characters can be randomly spliced to obtain the load content. By randomly selecting a corresponding number of target characters from the preset character set to generate the load content, the malicious terminal cannot identify the IKE message through the content of the message, the network fingerprint feature of the IKE message between the base station and the security gateway is blurred, and the difficulty of identifying the network equipment is increased.

[0059] As an example, the target load length can be preset, and for the base station and the security gateway, a target load length is set in advance respectively, and the target load lengths of the base station and the security gateway can be the same or different, so that the base station inserts the random load with the same load length in the message when sending different messages in the authentication process, and similarly, the security gateway also inserts the random load with the same load length in the message when sending different messages in the authentication process.

[0060] As an example, the target payload length can be randomly selected, specifically, a payload length can be randomly selected from a preset payload length interval as the target payload length, where the preset payload length interval can be represented as [minimum length, maximum length], the value of the maximum length is greater than the value of the minimum length, and the value of the randomly selected target payload length is not less than the minimum length and not greater than the maximum length. Thus, by randomly selecting a payload length from the preset payload length interval as the target payload length, a random payload with a different payload length is generated each time, so that the malicious terminal cannot identify the IKE message through the length of the message, the network fingerprint characteristics of the IKE message between the base station and the security gateway are blurred, and the difficulty of identifying the network device is increased.

[0061] It should be noted that in the present embodiment, when the target payload length is randomly selected and / or the target character is randomly selected to generate the payload content, the current time can be used as the seed, that is, the current time is used as the input parameter of the random selection algorithm to select the target payload length and / or the target character, so that the target payload length and / or the target character selected at different times are different, ensuring that the random payloads constructed at adjacent two times cannot be exactly the same, and further increasing the difficulty of identifying the network device.

[0062] In an optional embodiment of the present disclosure, when a new message is generated based on the initial message and the random payload, the random payload can be inserted into a random position of the initial message. Specifically, a payload position in the initial message can be first randomly selected as a target payload position, and then the random payload is inserted into the target payload position in the initial message to obtain the new message. For example, assuming that the payloads contained in the initial message are payload 1, payload 2, and payload 3 in sequence, and the randomly selected target payload position is the position between payload 1 and payload 2, the random payload is inserted into the position between payload 1 and payload 2 in the initial message, and the new message obtained contains the payloads in the sequence of payload 1, random payload, payload 2, and payload 3. It should be noted that in the present embodiment, the randomly selected target payload position can be the position between the payloads in the initial message, or the position after the last payload, but cannot be the position before the first payload in the initial message, that is, the random payload cannot be the first payload in the new message, because the first payload of each message sent in the authentication process is specified by the protocol and needs to meet the protocol requirements. By randomly selecting a position in the initial message as the target payload position to insert the random payload, the malicious terminal cannot identify the IKE message through the offset of the original payload in the message, the network fingerprint characteristics of the IKE message between the base station and the security gateway are blurred, and the difficulty of identifying the network device is increased.

[0063] It should be noted that in the embodiment, the random load added in the initial message can satisfy only one of the four random types of load type randomness, load length randomness, load content randomness, and load position randomness, or can satisfy at least two of the random types, in a word, the protocol features of the original IKE message are blurred without destroying the normal protocol properties. It can be understood that the more random types satisfied, the higher the blurring degree of the network fingerprint features of the generated new message, the more difficult it is for the malicious terminal to be identified, and the safer the backhaul network between the base station and the security gateway.

[0064] The transmission port of each message in the authentication process is usually fixed. Taking IKEv2 as an example, the user datagram protocol (UDP) port for transmitting IKEv2 messages is 500 and 4500. Although the IKEv2 protocol allows the use of other UDP ports other than 500 and 4500, since it is still a single port configuration, even if other ports are replaced, it is still easy for the malicious terminal to be identified by summarizing the rules. Based on this, in an optional embodiment of the present disclosure, the present disclosure provides a scheme of randomly selecting a port to transmit a message each time a request message is sent, so that the IKE message transmission port is blurred, increasing the difficulty of identifying the base station and the security gateway. Specifically, in the case of a new message being a request message (for example, an IKE_SA_INIT request message, an IKE_AUTH request message, and a CREATE_CHILD_SA request message), that is, the network device sending the new message is a base station, the receiving end is a security gateway, and the base station sends the new message to the security gateway, two ports can be randomly selected from a preset port pool as a source port and a target port, respectively, wherein each port in the preset port pool is listened to by the sending end (i.e., the base station) and the receiving end (i.e., the security gateway), and then the new message is sent to the receiving end through the source port. The receiving end obtains the new message through the target port, and when feeding back a corresponding response message to the sending end, the source port of the new message is used as the target port of the response message, and the target port of the new message is used as the source port of the response message, and the response message is replied, and then the sending end can receive the response message through the target port of the response message.

[0065] In the embodiment, by designing a port pool, two ports are randomly selected from the port pool to transmit the message when a new message is sent, so that different base stations can randomly select different ports for IKE message interaction, and different times of access of the same base station can also randomly select different ports for IKE message interaction, so that the malicious terminal cannot identify the IKE message by filtering the UDP source port or target port, and the difficulty of identifying the base station or the security gateway is increased.

[0066] In the case that the new message is a request message, after the receiving end receives the new message through the target port, the receiving end will respond to the new message and reply a response message to the sending end, wherein the source port sending the new message is the target port of the replied response message, and the sending end will receive the response message from the receiving end through the source port. Further, in an optional embodiment of the present disclosure, in the case that the sending end receives the response message sent by the receiving end through the source port, the sending end acquires the target random payload from the response message, acquires the target payload content from the target random payload, and further stores the mapping relationship between the target payload content and the source port in the mapping relationship table.

[0067] It can be understood that the target random payload carried in the response message is the random payload acquired by the receiving end, and the receiving end acquires the random payload in a manner similar to the principle of acquiring the random payload explained in the foregoing embodiments, which will not be described here again.

[0068] In the present embodiment, after receiving the response message, the receiving end can identify whether each payload in the response message is a random payload according to the payload type of each payload carried in the response message. If the payload type of a certain payload in the response message matches one of the IKE payload reserved types, it is determined that the payload is a target random payload, and further the target payload content is extracted from the target random payload, the mapping relationship between the target payload content and the source port is recorded and stored in the mapping relationship table.

[0069] It should be noted that for the receiving end, after receiving the new message, the receiving end identifies the random payload from the new message, and records the mapping relationship between the payload content of the random payload and the target port and stores it in the mapping relationship table of the receiving end.

[0070] In the present embodiment, by storing the mapping relationship between the payload content of the random payload and the port, conditions are provided for subsequently identifying abnormal messages that may occur after the IKE message is identified according to the stored mapping relationship.

[0071] Further, in an optional embodiment of the present disclosure, when an IKE message is received, whether the received IKE message is legal can be judged based on the stored mapping relationship between the port and the payload content of the random payload, and corresponding processing measures are taken according to the judgment result. Specifically, as shown in Figure 2 The network attack protection method of the present disclosure can further include the following steps based on the foregoing embodiments:

[0072] Step 201, in response to receiving an IKE message, determining whether the IKE message contains a random payload according to the payload type of each payload in the IKE message.

[0073] The IKE message may be any message in the IKE authentication process, and may be sent by a legitimate terminal or an abnormal terminal.

[0074] In this embodiment, when an IKE message is received, the IKE message can be parsed to identify each payload in the IKE message, and based on the payload type carried by each payload, it is determined whether there is a random payload with a payload type of the IKE payload reserved type among these payloads. If so, it is determined that the IKE message contains a random payload, and step 202 is executed. If there is no random payload with a payload type of the IKE payload reserved type, it is determined that the IKE message does not contain a random payload, and step 204 is executed.

[0075] Step 202: When it is determined that the IKE message contains a random payload, a target mapping relationship is established between the payload content in the random payload contained in the IKE message and the port that receives the IKE message.

[0076] Step 203: If the target mapping relationship exists in the mapping relationship table, the IKE message is discarded.

[0077] In this embodiment, if it is determined that the received IKE message contains a random payload, the payload content is further extracted from the random payload of the IKE message, and a target mapping relationship is established between the payload content and the port that received the IKE message. A query is then performed to determine whether the target mapping relationship exists in the mapping relationship table. If the target mapping relationship exists in the mapping relationship table, the IKE message is discarded, the terminal that sent the IKE message is identified as an abnormal terminal, and an alarm may be generated to alert operations and maintenance personnel of the abnormal terminal access. If the target mapping relationship does not exist in the mapping relationship table, step 206 is executed to process the IKE message normally.

[0078] Step 204: If it is determined that the IKE message does not contain a random payload, determine based on the IKE message whether the authentication mode is pre-shared key PSK authentication.

[0079] In this embodiment, if it is determined that the received IKE message does not contain a random payload, it can be determined based on the IKE message whether the authentication mode is PSK authentication. If the authentication mode is PSK authentication, step 205 is executed; otherwise, step 206 is executed.

[0080] It is understandable that when different authentication modes are used for identity authentication, the payloads carried in the IKE message are different. Therefore, in this embodiment, whether the authentication mode used is PSK authentication can be determined based on the payload carried in the IKE message.

[0081] Step 205, in the case of determining that the authentication mode is PSK authentication, discarding the IKE message.

[0082] In the embodiment, in the case of determining that the authentication mode is PSK authentication, the received IKE message is discarded. In addition, a warning can be reported to remind the operation and maintenance personnel that there is an abnormal terminal access, so as to take further authentication measures.

[0083] Step 206, in the case of not existing target mapping relationship in the mapping relationship table or determining that the authentication mode is not PSK authentication, normally processing the IKE message.

[0084] In the embodiment, in the case of not existing target mapping relationship in the mapping relationship table or determining that the authentication mode is not PSK authentication, the IKE message is normally processed. The processing manner of the IKE message is similar to the existing processing manner of the IKE message, which is not described here. It can be understood that the random load carried in the IKE message is not processed when the IKE message is normally processed.

[0085] In an optional embodiment of the present disclosure, for the base station, after the initial exchange of IKE is successful, that is, after the base station receives the IKE_SA_INIT response message returned by the security gateway, the base station sends an Internet Key Exchange-Authentication (IKE_AUTH) request message to the security gateway and waits for the reply of the security gateway. When the base station receives the IKE message as the IKE_AUTH response message, the IKE_AUTH response message is verified. If the authentication mode of the IKE_AUTH response message is not PSK authentication, an aging time is assigned to the mapping relationship between the target load content and the source port, wherein the aging time can be a preset value or a random value set randomly. Within the aging time, the Internet Key Exchange-Security Association (IKE_SA_INIT) response message carrying the target load content received through the source port is considered as a pseudo IKE_SA_INIT response message, and the message is discarded. By assigning the aging time to the mapping relationship between the target load content and the source port, the IKE_SA_INIT response message carrying the random load with the same content received within the aging time can be identified and discarded, so that the identification of abnormal terminal access is realized.

[0086] The network attack protection method of the embodiment can identify abnormal terminals and ensure network security by judging whether the IKE message contains random load according to the load type of each load in the IKE message when the IKE message is received, constructing a target mapping relationship between the load content in the random load contained in the IKE message and the port receiving the IKE message when it is determined that the IKE message contains random load, discarding the IKE message when the target mapping relationship exists in the mapping relationship table, or judging whether the authentication mode is PSK authentication based on the IKE message when it is determined that the IKE message does not contain random load, and discarding the IKE message when it is determined that the authentication mode is PSK authentication.

[0087] It should be noted that, in the embodiment of the present disclosure, for the receiving end, after receiving a new message, the random load is identified from the new message, and the mapping relationship between the load content of the random load and the target port is recorded and stored in the mapping relationship table of the receiving end. When the receiving end subsequently receives an IKE message, a similar judgment process as that of the embodiment shown in Figure 2 will be performed to determine whether the received IKE message is legal, and corresponding processing measures will be taken according to the determination result to identify abnormal terminals and ensure network security.

[0088] Figure 3 A network architecture schematic diagram of an example embodiment of the present disclosure is shown in FIG. 1. Figure 3 As shown in FIG. 1, the base station and the security gateway perform authentication through the IKEv2 protocol. The internal structure diagrams of the base station and the security gateway are shown in FIGS. 2 and 3, respectively. Figure 4 As can be seen from the internal structure diagrams, the base station and the security gateway each include an IKEv2 protocol processing unit, a random load adding unit, and a port selection unit. Based on the internal structure diagrams shown in FIGS. 2 and 3, the processing flow of the base station and the security gateway for adding random load and randomly selecting a port in an IKE message is shown in FIGS. 4 and 5, respectively. Figure 4 Figure 5 Figure 6 Figure 7 As can be seen from the internal structure diagrams, the base station and the security gateway each include an IKEv2 protocol processing unit, a random load adding unit, and a port selection unit. Based on the internal structure diagrams shown in FIGS. 2 and 3, the processing flow of the base station and the security gateway for adding random load and randomly selecting a port in an IKE message is shown in FIGS. 4 and 5, respectively.

[0089] As shown in FIG. 4, the base station has completed listening to each port in the port pool. The following is explained one by one: Figure 5 ​​​As shown in step S3.1, the IKEv2 protocol processing unit of the base station constructs an IKE_SA_INIT request message, including an IKEv2 protocol header HDR, a cipher algorithm suite set payload SAl supported by the base station side, a Diffie-Hellman key exchange content payload KEi, and a one-time random number payload Ni. The random payload adding unit of the base station randomly selects a type (assuming type 1) from the IKEv2 payload reserved type {type 1, type 2, …, type M}, randomly selects a payload length (denoted as payload length 1) between [minimum length, maximum length] characters, and constructs a new random payload (denoted as random payload 1) with a character number of payload length 1 by randomly selecting payload length 1 characters from a specified character set. The random payload 1 is inserted into a random position between the original payloads of the IKE_SA_INIT request message to form a new IKE_SA_INIT request message, for example Figure 5 As shown in step S3.1, the IKEv2 protocol processing unit of the base station constructs an IKE_SA_INIT request message, including an IKEv2 protocol header HDR, a cipher algorithm suite set payload SAl supported by the base station side, a Diffie-Hellman key exchange content payload KEi, and a one-time random number payload Ni. The random payload adding unit of the base station randomly selects a type (assuming type 1) from the IKEv2 payload reserved type {type 1, type 2, …, type M}, randomly selects a payload length (denoted as payload length 1) between [minimum length, maximum length] characters, and constructs a new random payload (denoted as random payload 1) with a character number of payload length 1 by randomly selecting payload length 1 characters from a specified character set. The random payload 1 is inserted into a random position between the original payloads of the IKE_SA_INIT request message to form a new IKE_SA_INIT request message, for example

[0090] In step S3.2, the security gateway side receives the IKE_SA_INIT request message from port 2, records the mapping relationship between port 2 and the payload content of the random payload 1. The IKEv2 protocol processing unit of the security gateway side processes the IKE_SA_INIT request message that is determined to be legal by the port processing unit and the random payload adding unit, and constructs an IKE_SA_INIT response message, including an IKEv2 protocol header HDR, a payload SAr1 selected from the cipher algorithm suite set supported by the base station side, a Diffie-Hellman key exchange content payload KEr, and a one-time random number payload Nr. The determination process of whether the IKE_SA_INIT request message is legal can refer to the foregoing Figure 2 As shown in the embodiment, the random payload adding unit of the security gateway side randomly selects a type (assuming type 2) from the IKEv2 payload reserved type {type 1, type 2, …, type M}, randomly selects a payload length (denoted as payload length 2) between [minimum length, maximum length] characters, and constructs a new random payload (denoted as random payload 2) with a character number of payload length 2 by randomly selecting payload length 2 characters from a specified character set. The random payload 2 is inserted into a random position between the original payloads of the IKE_SA_INIT response message to form a new IKE_SA_INIT response message, for example Figure 5As shown, the random load 2 is inserted after the original load HDR of the IKE_SA_INIT response message; the IKEv2 port processing unit of the security gateway side takes the source port (i.e. port 1) of the IKE_SA_INIT request message as the target port of the IKE_SA_INIT response message, and takes the target port (i.e. port 2) of the IKE_SA_INIT request message as the source port of the IKE_SA_INIT response message, to reply a new IKE_SA_INIT response message;

[0091] Step S3.3, the base station side receives the IKE_SA_INIT response message from port 1, records the mapping relationship between port 1 and the load content of the random load 2; the IKEv2 protocol processing unit of the base station processes the IKE_SA_INIT response message, and constructs an IKE_AUTH request message, including an IKEv2 protocol header HDR, SK{base station identity information IDi, [base station certificate CERT,] [request for the security gateway to provide a certificate request CERTREQ,] [identity information IDr of the base station expected security gateway,] base station authentication load AUTH, cipher algorithm suite group load SAi2 of the base station side CHILD SA, flow selection load TSi of the base station side, flow selection load TSr expected by the base station of the security gateway side}, wherein SK{} indicates that the content is encrypted and integrity protected by the IKE SA established in steps S3.1 and S3.2; the random load appending unit of the base station randomly selects a type (assuming type 3) from the IKEv2 load reservation type {type 1, type 2, …, type M}, randomly selects a load length between [minimum length, maximum length] characters (denoted as load length 3), and randomly selects 3 characters of the load length from the specified character set to construct a new random load (denoted as random load 3) with a character number of load length 3, inserts the random load 3 into a random position between the original loads of the IKE_AUTH request message, to form a new IKE_AUTH request message, for example Figure 5 As shown, the random load 3 is inserted after the original load AUTH of the IKE_AUTH request message; the port selection unit of the base station randomly selects two ports (assuming port 3 and port 4) from the port pool {port 1, port 2, …, port N} as the source port and the target port for sending the new IKE_AUTH request message respectively, and sends the new IKE_AUTH request message;

[0092] Step S3.4: the IKEv2 protocol processing unit at the security gateway side processes the received IKE_AUTH request message, and constructs an IKE_AUTH response message, including an IKEv2 protocol header HDR, SK{the identity information IDr of the security gateway, [the security gateway CERT,] the security gateway authentication payload AUTH, the cipher algorithm suite payload SAr2 finally selected from the cipher algorithm suite group payload of the CHILD SA at the base station side, the flow selection payload TSi at the base station side, the flow selection payload TSr at the security gateway side}; the random payload appending unit at the security gateway side randomly selects a type (supposed to be type 4) from the IKEv2 payload reserved types {type 1, type 2, …, type M}, randomly selects a payload length between [minimum length, maximum length] characters (denoted as payload length 4), randomly selects 4 characters of the payload length 4 from the specified character set to construct a new random payload with the character number of the payload length 4 (denoted as random payload 4), inserts the random payload 4 into a random position between the original payloads of the IKE_AUTH response message, to compose a new IKE_AUTH response message, for example Figure 5 As shown in the figure, the random payload 4 is inserted after the original payload TSi of the IKE_AUTH response message; the port processing unit at the security gateway side takes the source port (i.e. port 3) of the IKE_AUTH request message as the target port of the IKE_AUTH response message, and takes the target port (i.e. port 4) of the IKE_AUTH request message as the source port of the IKE_AUTH response message, to reply the IKE_AUTH response message; the security gateway side randomly allocates an aging time time1 for the mapping relationship between the port 2 and the payload content of the random payload 1, if the authentication mode of the received IKE_AUTH request message is not PSK after the success of the IKEv2 initial exchange; within the aging time time1, if the random payload with the same content is carried in the IKE_SA_INIT request message received from the port 2, it is considered as a fake IKE_SA_INIT request message, discarded, and an alarm is reported; the IKEv2 protocol processing unit at the base station processes the received IKE_AUTH response message; in addition, for the base station side, the security gateway side randomly allocates an aging time time2 for the mapping relationship between the port 1 and the payload content of the random payload 2, if the authentication mode of the received IKE_AUTH response message is not PSK after the success of the IKEv2 initial exchange (i.e. the reception of the legal IKE_SA_INIT response message); within the aging time time2, if the random payload with the same content is carried in the IKE_SA_INIT response message received from the port 1, it is considered as a fake IKE_SA_INIT response message, and discarded.

[0093] Figure 6 and Figure 7The processing flow diagram of re-negotiating the IKE SA and the processing flow diagram of re-negotiating the CHILD SA are shown respectively, wherein the CREATE_CHILD_SA request / response message of re-negotiating the IKE SA carries similar payloads with the IKE_SA_INIT request / response message, so that the CREATE_CHILD_SA request / response message in the re-negotiation process performs the same additional random payload and port selection operation as the IKE_SA_INIT request / response message, which will not be described herein. In addition, the additional random payload is inserted into a random position between the original payloads of the CREATE_CHILD_SA request / response message, from Figure 6 It can be seen that the random payload 5 carried by the CREATE_CHILD_SA request message is randomly inserted after the original last payload KEi of the CREATE_CHILD_SA request message, and the random payload 6 carried by the CREATE_CHILD_SA response message is randomly inserted after the original payload Nr of the CREATE_CHILD_SA response message. Figure 7 It can be seen that the random payload 7 carried by the CREATE_CHILD_SA request message is randomly inserted after the original last payload TSr of the CREATE_CHILD_SA request message, and the random payload 8 carried by the CREATE_CHILD_SA response message is randomly inserted after the original payload Nr of the CREATE_CHILD_SA response message.

[0094] At this point, the establishment of the IKE SA and the CHILD SA is completed.

[0095] In order to realize the above-mentioned embodiments, the present disclosure further provides a network attack protection device.

[0096] Figure 8 The structure diagram of the network attack protection device provided by an embodiment of the present disclosure is shown, which is realized in the form of software and / or hardware and can be integrated in an electronic device. The electronic device can be a base station or a security gateway.

[0097] As shown in the structure diagram, the network attack protection device 50 can include an acquisition module 510, a message generation module 520, and a message sending module 530. Figure 8

[0098] The acquisition module 510 is configured to acquire an initial message to be sent and a random payload, wherein the payload type of the random payload is one of the Internet Key Exchange (IKE) payload reserved types.

[0099] The message generation module 520 is configured to generate a new message based on the initial message and the random payload.

[0100] ​The message sending module 530 is configured to send the new message to the receiving end.

[0101] Optionally, the obtaining module 510 comprises:

[0102] The payload type obtaining unit is configured to randomly select one from the IKE payload reserved types as a target payload type.

[0103] The payload content obtaining unit is configured to obtain the payload content.

[0104] The payload generating unit is configured to generate the random payload based on the target payload type and the payload content.

[0105] Further optionally, the payload content obtaining unit comprises:

[0106] The length obtaining sub-unit is configured to obtain a target payload length.

[0107] The character selecting sub-unit is configured to randomly select a number of target characters corresponding to the target payload length from the preset character set based on the target payload length.

[0108] The content generating sub-unit is configured to generate the payload content based on the target characters.

[0109] Optionally, the length obtaining sub-unit is further configured to:

[0110] randomly select one payload length from the preset payload length interval as the target payload length.

[0111] Optionally, the message generating module 520 is further configured to:

[0112] randomly select one payload position from the initial message as a target payload position;

[0113] insert the random payload into the target payload position in the initial message to obtain the new message.

[0114] Optionally, in the case that the new message is a request message, the message sending module 530 is further configured to:

[0115] randomly select two ports from a preset port pool as a source port and a target port respectively, wherein each port in the preset port pool is listened to by the sending end and the receiving end.

[0116] send the new message to the target port through the source port to send the new message to the receiving end.

[0117] Further optionally, the network attack protection device 50 further comprises a relationship building module, configured to:

[0118] In a case that the response message sent by the receiving end is received through the source port, the target random payload is obtained from the response message;

[0119] The target payload content is obtained from the target random payload;

[0120] The mapping relationship between the target payload content and the source port is stored in the mapping relationship table.

[0121] Optionally, the network attack protection device 50 further comprises a packet processing module, configured to:

[0122] In response to receiving the IKE packet, it is determined whether the IKE packet contains a random payload according to the payload type of each payload in the IKE packet;

[0123] In a case that it is determined that the IKE packet contains a random payload, a target mapping relationship between the payload content in the random payload contained in the IKE packet and the port receiving the IKE packet is constructed;

[0124] In a case that the target mapping relationship exists in the mapping relationship table, the IKE packet is discarded.

[0125] Optionally, the packet processing module is further configured to:

[0126] In a case that it is determined that the IKE packet does not contain a random payload, it is determined whether the authentication mode is a pre-shared key (PSK) authentication based on the IKE packet;

[0127] In a case that it is determined that the authentication mode is the PSK authentication, the IKE packet is discarded.

[0128] Optionally, the IKE packet is an Internet Key Exchange-Authentication (IKE_AUTH) response message, and the packet processing module is further configured to:

[0129] In a case that it is determined that the authentication mode is not the PSK authentication, an aging time is assigned to the mapping relationship between the target payload content and the source port;

[0130] Among the aging time, the Internet Key Exchange-Security Association (IKE_SA_INIT) response message carrying the target payload content received through the source port is discarded.

[0131] The network attack protection device provided by the embodiments of the present disclosure can execute the network attack protection method provided by the embodiments of the present disclosure, and has the corresponding function modules and beneficial effects of the execution method. The contents not described in detail in the device embodiments of the present disclosure can be referred to the description in any method embodiment of the present disclosure.

[0132] The embodiments of the present disclosure further provide an electronic device, comprising a processor and a memory; the processor is configured to execute steps of each of the embodiments of the network attack protection method by invoking programs or instructions stored in the memory, and details are not described herein to avoid repetition.

[0133] The embodiments of the present disclosure further provide a computer readable storage medium, which stores computer execution instructions, and the computer execution instructions are executed by a processor to implement steps of each of the network attack protection method according to the foregoing embodiments, and details are not described herein to avoid repetition.

[0134] The embodiments of the present disclosure further provide a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement steps of each of the network attack protection method according to the foregoing embodiments, and details are not described herein to avoid repetition.

[0135] It should be noted that, in this document, relational terms such as "first" and "second", and the like, are used solely to distinguish one entity or action from another entity or action, without necessarily requiring or implying any actual such relationship or order between or among the entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0136] The above description is merely that of specific embodiments of the present disclosure, to enable a person skilled in the art to understand or implement the present disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and generic principles defined herein can be applied to other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to these embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0137] Moreover, while operations are depicted in a particular order, this should not be understood as requiring such an order nor infringing on the scope of the disclosure. Certain of the operations described in the discussion are combinable into a single operation, and certain operations can be separated into several operations. In some embodiments, the operations described in the discussion can be performed in an order different than presented in the discussion. In some embodiments, the operations described in the discussion can be performed concurrently. Also, while several specific implementation details are discussed in the discussion, these should not be interpreted as limiting the scope of the disclosure. Rather, certain features described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable sub-combination.

[0138] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. A network attack protection method, characterized in that: The method comprises: Obtaining an initial message to be sent and a random payload, wherein the payload type of the random payload is one of the Internet Key Exchange (IKE) payload reserved types; generating a new message based on the initial message and the random payload; Sending the new message to the receiving end; Obtaining random payloads includes: Randomly select one of the reserved IKE payload types as the target payload type; Get the payload content; The random payload is generated based on the target payload type and the payload content.

2. The method according to claim 1, characterized in that The obtaining of the payload content includes: Get the target payload length; Based on the target payload length, randomly selecting target characters of a number corresponding to the target payload length from a preset character set; The payload content is generated based on the target character.

3. The method according to claim 2, characterized in that The obtaining of the target payload length includes: A payload length is randomly selected from a preset payload length interval as the target payload length.

4. The method according to claim 1, wherein The generating a new message based on the initial message and the random payload includes: Randomly selecting a payload position from the initial message as a target payload position; The random payload is inserted into the target payload position in the initial message to obtain the new message.

5. The method according to any one of claims 1 to 4, characterized in that In a case where the new message is a request message, sending the new message to the receiving end includes: Randomly selecting two ports from a preset port pool as a source port and a destination port, respectively, wherein each port in the preset port pool is monitored by the transmitting end and the receiving end; The new message is sent to the target port through the source port, so as to send the new message to the receiving end.

6. The method according to claim 5, characterized in that The method further comprises: When a response message sent by the receiving end is received through the source port, obtaining a target random payload from the response message; Obtaining target payload content from the target random payload; The mapping relationship between the target payload content and the source port is stored in a mapping relationship table.

7. The method according to claim 6, characterized in that The method further comprises: In response to receiving an IKE message, determining, based on a payload type of each payload in the IKE message, whether the IKE message includes a random payload; When it is determined that the IKE message includes a random payload, constructing a target mapping relationship between the payload content in the random payload included in the IKE message and the port that received the IKE message; If the target mapping relationship exists in the mapping relationship table, the IKE message is discarded.

8. The method according to claim 7, characterized in that After determining whether the IKE message includes a random payload, the method further includes: If it is determined that the IKE message does not include a random payload, determining, based on the IKE message, whether the authentication mode is pre-shared key (PSK) authentication; When it is determined that the authentication mode is the PSK authentication, the IKE message is discarded.

9. The method according to claim 8, characterized in that The IKE message is an Internet Key Exchange-Authentication IKE_AUTH response message, and the method further includes: When it is determined that the authentication mode is not the PSK authentication, allocating an aging time for the mapping relationship between the target payload content and the source port; Wherein, an Internet Key Exchange-Security Association IKE_SA_INIT response message carrying the target payload content received through the source port within the aging time is discarded.

10. A network attack protection device, characterized in that: include: an acquisition module, configured to acquire an initial message to be sent and a random payload, wherein the payload type of the random payload is one of the Internet Key Exchange (IKE) payload reserved types; A message generation module, configured to generate a new message based on the initial message and the random payload; A message sending module, configured to send the new message to a receiving end; Wherein, the acquisition module includes: a payload type acquiring unit, configured to randomly select one from the IKE payload reserved types as a target payload type; A payload content acquisition unit, used to acquire payload content; The payload generation unit is configured to generate the random payload based on the target payload type and the payload content.

11. An electronic device, characterized in that: including processor and memory; The processor is configured to execute the network attack protection method according to any one of claims 1 to 9 by calling the program or instruction stored in the memory.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the network attack protection method according to any one of claims 1 to 9 is implemented.

Images