Mimicry security defense method for preventing longitudinal attack

Abstract

The invention relates to an anti-longitudinal attack mimicry security defense method, which adopts a mimicry security framework, adds an identity verification module on a distribution component of the mimicry security framework, and opens a TCP port after completing identity verification through multiple UDP requests, so that a client and a server can perform normal interaction operation. The clients failing in identity verification cannot interact with each other; the problem that normal service cannot be carried out when the mimicry security defense faces external longitudinal attacks is solved, a port detection tool cannot perceive the existence of the service, after identity verification is passed, a TCP service port is dynamically opened to realize a session, the longitudinal defense capability of the mimicry security defense architecture is enhanced, and the service performance of the mimicry security defense architecture is improved. And network port blockage and application service capability reduction are prevented, so that huge waste of internal resources of the mimicry security architecture is avoided.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and provides a mimicry system security defense method for network services with high security characteristics. Background Art

[0002] The mimetic security defense of network services is a technology that uses a dynamic heterogeneous redundant architecture to perform majority voting through the output of multiple heterogeneous executors, continuously changes the heterogeneous service executors after anomalies are found, and can output correct and stable results. This dynamic change makes it difficult for attackers to discover system vulnerabilities and exploit them, thereby protecting the real system from detection and attack by attackers.

[0003] In the Internet environment, network services are often threatened by DoS attacks, which are designed to deliberately consume target system or network resources, causing serious impact on normal user access, manifested as slow or unavailable service response, especially slow attacks (such as Slowloris and Slow HTTP Post). These attacks establish legitimate connections but send data slowly, occupying server resources for a long time without releasing them, thereby consuming resources. In addition, there are protocol layer attacks, such as HTTP GET Flood, which use the characteristics of specific protocols to send a large number of HTTP GET requests to consume server resources and cause service interruptions.

[0004] In order to improve the availability and robustness of the system, the mimic service uses a redundant structure to resist internal vulnerabilities. However, when it is attacked by an external DoS, the redundant structure will consume resources exponentially. Although traditional firewalls and intrusion detection systems can be used to suppress frequent attacks, this will increase the investment of a lot of resources. This problem requires the use of dynamic mimic security technology to dynamically change the structure and behavior of the service to solve such attacks.

[0005] The mimetic security defense framework is usually composed of a distribution component, a decision component, a management component, and an executor. The distribution component resolves external input requests and distributes them to the executor for computational processing. After processing, the result is returned to the distribution component. The distribution component performs a consistency vote through the decision component. The majority of identical results are correct. If there is an abnormality in the result, the decision component sends a scheduling notification to the management component to start the cleaning process and restore the abnormal executor to its initial state. In order to prevent internal vulnerabilities in the operating environment from damaging a single executor, a horizontal redundant structure is used internally. Since the executor is encapsulated in a read-only binary package, tampering can only occur during the running process. When the executor stops running, it is reset and repaired, while other executors are still running normally at this time, so this structure can provide correct output. For details, see Mimetic Security Defense Framework Figure 1:

[0006] When the attack comes from an external vertical attack, the distribution component inside the mimetic security defense cannot distinguish whether the request is safe, and passes the request to the executor to further verify the legitimacy of the request. Since the background executor adopts a redundant structure, the request is forwarded in multiples, and the corresponding executor will consume resources in multiples. A small number of illegal requests are blocked by identity authentication, but normal services are affected. Once hackers launch a large number of Dos attacks, the number far exceeds the upper limit of the application's service capacity, and the application service protected by the mimetic framework will be more likely to crash. For details, see the mimetic security defense framework under attack. Figure 2 .

[0007] The reason is that the distribution component service of the mimetic security framework is static, and the port is directly exposed on the network. Once the port is discovered by the scanning tool, even if the hacker cannot penetrate the system, he will block the port with a large number of invalid requests, resulting in the inability to perform normal services. The traditional method is to use a firewall for filtering and prohibit requests from sources in the blacklist. However, DoS attacks usually use a large number of "zombies" (controlled computers). During the attack, the firewall cannot establish a new blacklist in time, resulting in the firewall being unable to effectively identify it. Given the limitations of traditional firewalls, a dynamic response method is needed to adjust the protection strategy in real time, improve the system's anti-attack capabilities, and ensure the stable operation of normal services. Summary of the invention

[0008] Aiming at the problem that normal services may not be able to be carried out when the mimetic security defense faces external vertical attacks, a mimetic security defense method for preventing vertical attacks is proposed. Based on the original mimetic security defense architecture, the present invention uses UDP identity authentication technology and adds a "gate" device, so that the port detection tool cannot detect the existence of the service. After passing the identity authentication, the TCP service port is dynamically opened to realize the session, thereby effectively solving the vertical defense problem of the mimetic security framework.

[0009] The technical solution of the present invention is:

[0010] A mimetic security defense method for preventing vertical attacks, which adopts a mimetic security framework and adds an authentication module to the distribution component of the mimetic security framework; the method is to install a "gate" on the service port, complete the authentication through multiple UDP requests, and then open the TCP port, so that the client and the server can interact normally, while the client that fails the authentication cannot interact;

[0011] The identity authentication module is as follows: the UDP port corresponds to the identity authentication service, which verifies three types of information. The client randomly sends information to three ports. When the identity information is sent to the server for the first and second time, the identity authentication service records this information and does not respond to the request to prevent external detection tools from finding it; when the identity information is sent for the third time, the three recorded identity information are verified together. After the verification is successful, the user session ID is returned for the client to log in to the forwarding service, and then the TCP port is opened, otherwise the client is ignored;

[0012] The mimic security defense method specifically includes the following steps:

[0013] Step 1: The client randomly sends three sets of identity information to three UDP ports. If successful, the user session ID is returned from the last request. The server receives the identity information and temporarily stores it in the verification queue according to the client source. Each time the identity information is received, the last verification information is queried according to the source information. Once the three sets of information are found, the client identity is verified. If successful, a user session ID is generated to maintain the subsequent session between the service and the client, and then the TCP port is opened. Otherwise, no response is given and the client is deleted from the verification queue.

[0014] Step 2: The client uses the user session ID to start communicating with the server using the TCP protocol, maintaining the same identity to communicate with the server; the server copies and forwards the client request to multiple executors that process the transaction in the background;

[0015] Step 3: The client waits for the service to complete; multiple executors on the server return results to the distribution component, which passes the results to the judgment component for consistency voting. The same results are returned as correct results. The voting process is based on the time sequence of the returned results. When the first and second returned results arrive, they can be compared. If the contents of the two are consistent, the returned results are passed to the client; if there is a difference in the contents of the two, wait for the third returned result to arrive. If the third returned result is consistent with one of the first two returned results, this returned result is passed to the client, otherwise it means that the service is abnormal and the fault information is returned to the client; if an abnormality is found, the judgment component notifies the management component to clean the corresponding executor;

[0016] Step 4: The client receives the consistency result; after the distribution component passes the consistency result to the client, it waits for a new TCP request initiated by the client. If the client sends a request within the specified time, the server executes the requested service; otherwise, if the client does not send a request beyond the specified time range, the client is judged to have exited, and the distribution component closes the TCP port and keeps it closed until a new user request arrives; after closing the service port, the management component can perform cleaning tasks. If an exception occurs inside the server, the abnormal execution body will be stopped and the original image will be restored.

[0017] Furthermore, the composition structure of the distribution component also includes:

[0018] 3 groups of UDP service ports: The server distribution component has 3 UDP ports, which receive three groups of identity information from the client respectively, mainly to prevent the single authentication information from being cracked. Only after three identity authentications are successful can the client be responded to return the user session ID;

[0019] TCP service port: The TCP service port is opened by the authentication service and supports various common services; normal services are implemented through the TCP port;

[0020] Forwarding service: after receiving the data message through the TCP port, forward the message to the three execution bodies in the background; set the time range, when the client stops accessing for a period of time or actively exits, stop the service and wait for the new user to restart.

[0021] Furthermore, a Docker container is deployed on the server operating system as the deployment environment of the execution body to build a mimic security defense system.

[0022] Furthermore, the distribution component in the mimic security framework can be implemented by using the net library of the Golang language. The net library contains the usage of UDP and TCP. During the identity authentication stage, the program needs to temporarily store the received UDP message. After the identity authentication is passed, a UUID is generated as the user session ID, and then the TCP port is opened to start listening for other requests from the client. After receiving the request, the message is read and temporarily stored for forwarding, and then forwarded to the corresponding execution body interface in the background.

[0023] Furthermore, the mimic security framework also includes a judgment component, whose implementation method can be directly installed in the distribution component. It adopts a competitive hierarchical judgment algorithm internally and sets a time window for waiting for the return result. During the period of receiving the return result, the distribution component compares the messages in the time window according to the time sequence of the return result messages. When the message comparison content is consistent, this message is selected to return to the client. When the message comparison content is inconsistent, it is fed back to the management component for cleaning and recovery.

[0024] Furthermore, the mimetic security framework also includes a management component, and its implementation method can be implemented based on the interactive command API of the container Docker. It can stop, delete and create new containers for running containers, restart containers, and replace attacked containers in time to achieve dynamic recovery of various executable bodies of the system.

[0025] Furthermore, the mimic security framework also includes an executor component, and its transformation method is based on the original application requirements, extracting the identity authentication function, and implementing the identity authentication function in the distribution component to prevent multiple executors from repeating the identity authentication process, while other content does not need to be modified.

[0026] Preferably, the three sets of identity information include a username and password, a customer device ID, and a user's mobile phone number.

[0027] The beneficial effects of the present invention are:

[0028] 1) Hidden Services

[0029] The present invention adds a "gate" device on the basis of the original mimic security defense architecture, so that the port detection tool cannot detect the existence of the service.

[0030] 2) Non-deterministic return verification results

[0031] The present invention utilizes UDP identity authentication technology and does not return results on fixed ports, thereby preventing attackers from locating effective UDP service port information.

[0032] 3) Unable to detect the real service port

[0033] The present invention dynamically opens the TCP service port after UDP identity authentication, so that attackers cannot find the service port, and the real service port is protected, thereby being able to resist vertical DoS attacks.

[0034] 4) Heterogeneous service ports

[0035] The present invention utilizes the characteristics of the TCP and UDP protocols and uses dynamic heterogeneous service ports, thereby reducing the probability of the system being detected on the network.

[0036] Through these improvements, the present invention enhances the vertical defense capability of the mimetic security defense architecture, prevents the network from blocking ports and reducing the service capabilities of applications, thereby avoiding a huge waste of resources within the mimetic security architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a horizontal defense diagram of the mimic security framework;

[0038] Figure 2 Mimic security framework diagram for vertical attacks;

[0039] Figure 3 This is a diagram of the interactive process of the security verification against vertical attacks of the present invention;

[0040] Figure 4 It is a diagram of the composition of the distribution components of the present invention;

[0041] Figure 5A consistency voting diagram for the decision component of the present invention;

[0042] Figure 6 This is a workflow diagram of the client and server of the present invention; DETAILED DESCRIPTION

[0043] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0044] The present invention proposes a mimetic security defense method for preventing vertical attacks. The solution is to install a "gate" on the service port, complete the identity authentication through multiple UDP requests, and then open the TCP port so that the client and the server can interact normally, while the client that fails the identity authentication cannot interact. This design is based on the characteristics of the TCP protocol: TCP is a connected, reliable transmission protocol that requires a three-way handshake confirmation to clarify the port status. Even if no data packets are returned, some network detection tools can still discover the port through covert scanning (such as FIN scanning, XMAS scanning, and NULL scanning). These scanning methods send data packets with specific flags, such as FIN, URG, ACK, etc. to the target port. If the port is closed, an RST packet is returned; if the port is open, other data packets are returned. In contrast, the UDP protocol itself is characterized by connectionless and unreliable transmission. There is no need to clarify the port status through handshake confirmation, so the UDP port cannot be directly detected. Through this design, the characteristics of the UDP protocol are used for identity authentication, which can effectively avoid common covert scanning methods and improve the security of the system, while using the TCP protocol to provide stable and reliable forwarding services. For details, see Figure 3 :

[0045] In order to effectively deal with DoS attacks, an authentication module is added to the distribution component of the mimic security framework, as described below:

[0046] 1) 3 groups of UDP service ports

[0047] The server distribution component has three UDP ports, which receive three different user identification information from the client, including the user's name and password, the user's device ID or the user's mobile phone information, etc. This is mainly to prevent a single authentication information from being cracked. Only after three successful identity authentications can the server respond to the client and return the user session ID.

[0048] 2) Identity verification service

[0049] The UDP port corresponds to the identity authentication service, which verifies three types of information. The client randomly sends information to three ports. The identity authentication service is similar to port knocking. When the identity information is sent to the server for the first and second time, the identity authentication service records this information and does not respond to the request to prevent external detection tools from discovering it. When the identity information is sent for the third time, the three recorded identity information will be verified together. After successful verification, the user session ID will be returned for the client to log in to the forwarding service, and then the TCP port will be opened. Otherwise, the client will be ignored.

[0050] 3) TCP service port

[0051] The TCP service port is opened by the authentication service and supports various common services, such as http or https, etc. Normal services are implemented through the TCP port.

[0052] 4) Forwarding service

[0053] After receiving the data message through the TCP port, forward the message to the three execution bodies in the background. Set the time range. When the client stops accessing for a period of time or actively logs out, stop the service and wait for the new user to restart.

[0054] like Figure 4 As shown above, this is the composition structure of the distribution component in the mimetic security defense method against vertical attacks. The following introduces the workflow of the entire system.

[0055] Step 1: The client randomly sends three sets of identity information (user name and password, client device ID and user mobile phone number, etc.) to three UDP ports. If successful, the user session ID is returned from the last request. The server receives the identity information and temporarily stores it in the verification queue according to the client source. Each time the identity information is received, the last verification information is queried based on the source information. Once the three sets of information are found, the client identity is verified. If successful, a user session ID is generated to maintain the subsequent session between the service and the client, and then the TCP port is opened. Otherwise, no response is given and the client is deleted from the verification queue.

[0056] Step 2: The client uses the user session ID to start communicating with the server using the TCP protocol, maintaining the same identity to communicate with the server. The server copies and forwards the client request to multiple executors that process the transaction in the background.

[0057] Step 3: The client waits for the service to complete. Multiple executors on the server return results to the distribution component, which passes the results to the judgment component for consistency voting. The same results are returned as correct results. The voting process is based on the time sequence of the returned results. When the first and second returned results arrive, they can be compared. If the contents of the two are consistent, the returned results are passed to the client. If there is a difference in the contents of the two, wait for the third returned result to arrive. If the third returned result is consistent with one of the first two returned results, this returned result is passed to the client. Otherwise, it means that the service is abnormal and the fault information is returned to the client. See Figure 5 If an abnormality is found, the judgment component notifies the management component to clean the corresponding execution body.

[0058] Step 4: The client receives the consistency result. After the distribution component passes the consistency result to the client, it waits for a new TCP request initiated by the client. If the client sends a request within the specified time, the server executes the requested service; otherwise, if the client does not send a request beyond the specified time range, the client is judged to have exited, and the distribution component closes the TCP port and keeps it closed until a new user request arrives. After closing the service port, the management component can perform cleaning tasks. If an exception occurs inside the server, the abnormal execution body will stop running and restore the original image.

[0059] In specific implementation, the Docker container can be deployed on the server operating system as the deployment environment of the execution body to build this system.

[0060] 1) The distribution component in the anti-vertical attack mimetic security framework can be implemented using the Golang language's net library. The net library contains methods for using UDP and TCP. During the identity authentication phase, the program needs to temporarily store the received UDP message. After the identity authentication is passed, a UUID (universally unique identifier) ​​is generated as the user session ID, and then the TCP port is opened to listen to other requests from the client. After receiving the request, the message is read and temporarily stored for forwarding, and then forwarded to the corresponding execution body interface in the background.

[0061] 2) The judgment component in the anti-vertical attack mimetic security framework can be directly installed in the distribution component. It adopts a competitive hierarchical judgment algorithm internally and sets a time window for waiting for the return result. During the period of receiving the return result, the distribution component compares the messages in the time window according to the time sequence of the return result messages. When the message comparison content is consistent, this message is selected to return to the client. When the message comparison content is inconsistent, it is fed back to the management component for cleaning and recovery.

[0062] 3) The management component in the mimic security framework can be implemented based on the interactive command API of the container (Docker). It can stop, delete and create new containers for running containers, restart containers, and replace attacked containers in time to achieve dynamic recovery of various executable bodies of the system.

[0063] 4) The transformation method of the executive component in the mimic security framework is to extract the authentication function based on the original application requirements, implement the authentication function in the distribution component, and prevent multiple executives from repeating the authentication process, while other contents do not need to be modified.

[0064] The above-mentioned embodiment only expresses one implementation mode of the present invention, and its description is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention patent. It should be pointed out that for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be based on the attached claims.

Claims

1. A mimic security defense method for preventing vertical attacks, characterized in that: This method adopts the mimetic security framework and adds an authentication module to the distribution component of the mimetic security framework; This method is to install a "gate" on the service port, complete the identity authentication through multiple UDP requests, and then open the TCP port, so that the client and server can interact normally, while the client that fails the identity authentication cannot interact; The identity authentication module is as follows: the UDP port corresponds to the identity authentication service, which verifies three types of information. The client randomly sends information to three ports. When the identity information is sent to the server for the first and second time, the identity authentication service records this information and does not respond to the request to prevent external detection tools from finding it; when the identity information is sent for the third time, the three recorded identity information are verified together. After the verification is successful, the user session ID is returned for the client to log in to the forwarding service, and then the TCP port is opened, otherwise the client is ignored; The mimic security defense method specifically includes the following steps: Step 1: The client randomly sends three sets of identity information to three UDP ports. If successful, the user session ID is returned from the last request. The server receives the identity information and temporarily stores it in the verification queue according to the client source. Each time the identity information is received, the last verification information is queried according to the source information. Once the three sets of information are found, the client identity is verified. If successful, a user session ID is generated to maintain the subsequent session between the service and the client, and then the TCP port is opened. Otherwise, no response is given and the client is deleted from the verification queue. Step 2: The client uses the user session ID to start communicating with the server using the TCP protocol, maintaining the same identity to communicate with the server; the server copies and forwards the client request to multiple executors that process the transaction in the background; Step 3: The client waits for the service to complete; multiple executors on the server return results to the distribution component, which passes the results to the judgment component for consistency voting. The same results are returned as correct results. The voting process is based on the time sequence of the returned results. When the first and second returned results arrive, they can be compared. If the contents of the two are consistent, the returned results are passed to the client; if there is a difference in the contents of the two, wait for the third returned result to arrive. If the third returned result is consistent with one of the first two returned results, this returned result is passed to the client, otherwise it means that the service is abnormal and the fault information is returned to the client; if an abnormality is found, the judgment component notifies the management component to clean the corresponding executor; Step 4: The client receives the consistency result; after the distribution component passes the consistency result to the client, it waits for a new TCP request initiated by the client. If the client sends a request within the specified time, the server executes the requested service; otherwise, if the client does not send a request beyond the specified time range, the client is judged to have exited, and the distribution component closes the TCP port and keeps it closed until a new user request arrives; after closing the service port, the management component can perform cleaning tasks. If an exception occurs inside the server, the abnormal execution body will be stopped and the original image will be restored.

2. The mimic security defense method for preventing vertical attacks according to claim 1 is characterized in that: The distribution component also includes: 3 groups of UDP service ports: The server distribution component has 3 UDP ports, which receive three groups of identity information from the client respectively, mainly to prevent the single authentication information from being cracked. Only after three identity authentications are successful can the client be responded to return the user session ID; TCP service port: The TCP service port is opened by the authentication service and supports various common services; normal services are implemented through the TCP port; Forwarding service: after receiving the data message through the TCP port, forward the message to the three execution bodies in the background; set the time range, when the client stops accessing for a period of time or actively exits, stop the service and wait for the new user to restart.

3. The mimic security defense method for preventing vertical attacks according to claim 1 is characterized in that: Deploy Docker containers on the server operating system as the deployment environment of the execution body to build a mimic security defense system.

4. The mimetic security defense method for preventing vertical attacks according to claim 1 is characterized in that: The distribution component in the mimic security framework can be implemented using the net library of the Golang language. The net library contains methods for using UDP and TCP. During the identity authentication phase, the program needs to temporarily store the received UDP message. After the identity authentication is passed, a UUID is generated as the user session ID, and then the TCP port is opened to listen to other requests from the client. After receiving the request, the message is read and temporarily stored for forwarding, and then forwarded to the corresponding execution body interface in the background.

5. The mimic security defense method for preventing vertical attacks according to claim 1 is characterized in that: The mimic security framework also includes a judgment component, whose implementation method can be directly installed in the distribution component. It uses a competitive hierarchical judgment algorithm to implement it internally, and sets a time window for waiting for the return result. During the period of receiving the return result, the distribution component compares the messages in the time window according to the time sequence of the return result messages. When the message comparison content is consistent, this message is selected to return to the client. When the message comparison content is inconsistent, it is fed back to the management component for cleaning and recovery.

6. The mimetic security defense method for preventing vertical attacks according to claim 1 is characterized in that: The mimetic security framework also includes a management component, whose implementation method can be implemented based on the interactive command API of the container Docker. It can stop, delete and create new containers for running containers, restart containers, and replace attacked containers in time to achieve dynamic recovery of various executable bodies of the system.

7. The mimetic security defense method for preventing vertical attacks according to claim 1 is characterized in that: The mimic security framework also includes an executor component. The transformation method is based on the original application requirements, extracting the authentication function and implementing it in the distribution component to prevent multiple executors from repeating the authentication process, while other content does not need to be modified.

8. The mimetic security defense method for preventing vertical attacks according to claim 1 or 2, characterized in that: The three sets of identity information include username and password, customer device ID and user mobile phone number.

Images