Anti-attack method and network equipment
By creating an anti-attack table for access users using carrier-grade CGN, the problem of excessively large granularity in CGN protection is solved, enabling precise protection for individual users, avoiding the impact on normal user packets, and improving the efficiency and targeting of anti-attack measures.
Patent Information
- Application Number
- CN202511301356.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-11
- Publication Date
- 2025-11-18
AI Technical Summary
In existing technologies, CGN's attack protection granularity is too large, which affects the processing of normal user packets, and the defense scope is too broad, making it impossible to provide precise protection for individual users.
Carrier-grade Network Address Translation (CGN) creates an anti-attack table for access users, obtains user online notifications or the first packet through the BRAS board, assigns private network IPs and VPNs, sets anti-attack policies, including allowing, limiting or dropping, and processes user packet traffic according to the anti-attack table.
It achieves precise protection for individual users, avoids impacting the processing of normal user packets, and improves the targeting and efficiency of attack prevention.
Smart Images
Figure CN120979788A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present specification relates to the technical field of communication, and particularly relates to an attack prevention method and network equipment. BACKGROUND
[0002] NAT: Network Address Translation, network address translation.
[0003] CGN: Carrier Grade NAT, carrier-grade network address translation.
[0004] CGN board: a single board configured with CGN function.
[0005] BRAS board: a single board configured with BRAS function.
[0006] NAT (Network Address Translation) is a process of converting an IP address in an IP data packet header into another IP address. In actual application, NAT is mainly applied to edge devices connecting two networks, for the purpose of allowing internal network users to access external public networks and allowing external public networks to access part of internal network resources (such as internal servers).
[0007] When a message from the internal network to the external network passes through the NAT device, the NAT device replaces the source IP address in the original message with a legal public network address, and records this conversion; then, when the message returns from the external network side, the NAT device looks up the original record, replaces the destination address of the message back to the original private network address, and forwards it to the host on the internal network side. This process is transparent to the private network side or the public network side device.
[0008] As shown in FIG. 1, a NAT device connects an internal network and an external network, and an interface connecting the external network is a NAT interface. When a message passes through the NAT device, the basic working process of the NAT is as follows: Figure 1
[0009] When an IP message sent by an internal network user host (192.168.1.3) to an external network server (1.1.1.2) passes through the NAT device, the NAT device checks the IP header content of the message, finds that the message is sent to the external network, and then converts the internal network address 192.168.1.3 in the source IP address field of the message into a routable external network address 20.1.1.1, and sends the message to the external network server, while establishing a table entry record of this mapping on the NAT device.
[0010] The reply message sent by the external network server to the internal network user reaches the NAT device, and the NAT device uses the message information to match the established table item, and then finds the matched table record, and replaces the initial destination IP address 20.1.1.1 with the internal network private address 192.168.1.3.
[0011] The above NAT process is transparent to the terminal (such as Host and Server in the figure). For the external network server, it considers that the IP address of the internal network user host is 20.1.1.1, and does not know that there is an address 192.168.1.3. Therefore, the NAT "hides" the private network of the enterprise. SUMMARY
[0012] In order to realize the user-level attack prevention solution and reduce the influence range of attack prevention to a single user level, the present specification provides an attack prevention method and network device.
[0013] According to a first aspect of the embodiment of the present specification, an attack prevention method is provided, and the method comprises:
[0014] The operator-level network address translation CGN creates an attack prevention table for an access user;
[0015] When the user meets the attack condition, the message flow of the user is processed according to the attack prevention strategy in the attack prevention table of the user.
[0016] The operator-level network address translation CGN creates an attack prevention table for an access user, which comprises:
[0017] The user online notification is obtained through the BRAS board card;
[0018] The attack prevention table is created for the user according to the user online notification.
[0019] The operator-level network address translation CGN creates an attack prevention table for an access user, which comprises:
[0020] The first message of the user is obtained through the BRAS board card;
[0021] The attack prevention table is created for the user sending the first message.
[0022] The attack prevention table is created for the user sending the first message.
[0023] The private network IP, VPN and attack prevention strategy allocated for the user.
[0024] The attack prevention strategy comprises: pass, limit flow, and discard.
[0025] It can be seen from the above embodiments that the abnormal message attack from the client side can be effectively prevented by creating the attack prevention table, i.e., the attack prevention object is the user, and the normal user's service is not affected as the attack prevention object is not located in the message type.
[0026] According to a second aspect of the embodiments of the present specification, a network device is provided, and the network device comprises: a carrier-grade network address translation (CGN) board card, the CGN board card comprising:
[0027] a creating module configured to create an attack prevention table for an access user;
[0028] a processing module configured to process the message flow of the user according to the attack prevention policy in the attack prevention table of the user when the user meets an attack condition.
[0029] The creating module is specifically configured to acquire a user online notification through the BRAS board card, and create an attack prevention table for the user according to the user online notification.
[0030] The creating module is specifically configured to acquire a first message of the user through the BRAS board card, and create an attack prevention table for the user sending the first message.
[0031] The attack prevention table comprises:
[0032] a private network IP, a VPN, and an attack prevention policy allocated for the user.
[0033] The attack prevention policy comprises: pass, flow limiting, and discarding.
[0034] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present specification. BRIEF DESCRIPTION OF DRAWINGS
[0035] The accompanying drawings incorporated in the specification and forming a part of the specification illustrate embodiments consistent with the present specification and serve to explain the principles of the present specification.
[0036] Figure 1 is a network architecture schematic diagram of a NAT device according to an exemplary embodiment of the present specification.
[0037] Figure 2 is a flow schematic diagram of an attack prevention method according to an exemplary embodiment of the present specification.
[0038] Figure 3 is a network architecture schematic diagram of a NAT device according to an exemplary embodiment of the present specification. DETAILED DESCRIPTION
[0039] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this specification as detailed in the appended claims.
[0040] The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of this specification. The singular forms “a,” “the,” and “the” as used in this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.
[0041] It should be understood that although the terms first, second, third, etc., may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this specification, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."
[0042] Currently, CNG's attack protection primarily involves rate limiting for each service core individually to prevent an attack on one core from affecting the service processing of other cores. It can also classify rate limiting based on packet type (such as TCP, UDP, ICMP) and the direction of the attack packet (whether it comes from the client or the Internet) to ensure that packets for certain services are not affected to the greatest extent possible.
[0043] However, current attack protection methods suffer from technical problems such as excessively coarse granularity, indiscriminately defending against both normal user packets and attack packets, and affecting a large number of users. For example, current attack protection methods rate-limit based on packet type. If a TCP packet is identified as an attack packet, CGN will rate-limit all TCP packets, meaning that even the client's TCP packets will be rate-limited, thus affecting the services of normal users.
[0044] To address the aforementioned technical problems, embodiments of this disclosure provide a method for preventing attacks, such as... Figure 2 As shown, the method includes:
[0045] S201 Carrier-grade Network Address Translation (CGN) creates an attack prevention table for access users;
[0046] S202 When a user meets the attack conditions, process the user's packet traffic according to the anti-attack policy in the user's anti-attack table.
[0047] In this embodiment, the triggering method for CGN to create an anti-attack table for access users can include both linked and non-linked methods.
[0048] like Figure 3 As shown, during the anti-attack table generation phase, for scenarios where the user and CGN are linked for online deployment, the BRAS board, based on the user's online notification, instructs the CGN module to issue an anti-attack table based on user information (user address IP + VPN). For scenarios where the user and CGN are not linked for online deployment, the BRAS needs to send the user's first packet to the CGN, and the CGN, during the forwarding process, issues an anti-attack table based on the packet information (user address IP + VPN).
[0049] Different users can be uniquely identified by using the user address (IP) + VPN in the anti-attack table.
[0050] In this embodiment, the user address IP can be a private network IP assigned to the user by the operator. Normally, when a user accesses the network, they have their own address. For example, user A's address is 192.168.0.1. When user A accesses the system, they will obtain the user address IP 1.1.1.1 assigned to them by the operator, and the user's VPN is 1. Then the anti-attack table created by CGN for the user includes (user address IP 1.1.1.1 + VPN 1).
[0051] In this embodiment, an anti-attack policy is also set in the anti-attack table. The anti-attack policy may include all or part of the following: allow, rate limit, and drop. For example, 00, 01, and 11 can be used to represent the allow, rate limit, and drop commands, respectively.
[0052] In addition, corresponding matching conditions are configured. When a user meets the attack conditions, the corresponding processing action can be performed through the matching conditions. The matching conditions may include attack judgment conditions. For example, the matching conditions may be that the number of messages of the same type received within a specified time exceeds a preset value, or that the user's message carries matching field content.
[0053] In this embodiment, the attack conditions can be set by the administrator, and the attack conditions can be deployed in the processing unit of the network device, or the attack conditions can be deployed in the anti-attack table.
[0054] When the attack conditions are deployed in the processing unit, the processing unit first filters users. When users are found to meet the attack conditions, the filtering and processing strategy based on the anti-attack table is executed.
[0055] When the attack conditions are deployed in the attack prevention table, the attack prevention table can be used directly to screen users and determine whether the attack conditions are met.
[0056] For example, if the CGN receives more than 10 TCP packets from a target user within one second based on the anti-attack table, it can be considered that the attack conditions have been met. The target user can be locked based on the user's IP address in the anti-attack table. At the same time, according to the corresponding anti-attack policy in the anti-attack table, the packets sent by the target user can be rate-limited or dropped.
[0057] As can be seen from the above embodiments, by creating an anti-attack table for access users through CGN, actions such as allowing, limiting or dropping packets can be taken against users. This avoids the problem in the prior art where only packet type is processed, which affects the packet processing of normal users.
[0058] In this embodiment, when the CGN (Central Network Controller) rate-limits or drops user packets, it can send the rate-limited or dropped packet information to the administrator for the purpose of detecting and managing abnormal users in the network device.
[0059] In one example, during the anti-attack table deletion phase, for scenarios where a user is online in conjunction with CGN, the CGN module is notified to delete the anti-attack table while the user is offline; for scenarios where a user is online without CGN linkage, the anti-attack table needs to be deleted after the last CGN session associated with that user ages out. This ensures that the anti-attack table corresponding to a user can be consistently maintained while the user is online.
[0060] Based on the above method embodiments, this disclosure also provides a network device, the network device comprising: a carrier-grade network address translation (CGN) board, the CGN board comprising:
[0061] Create a module to create an anti-attack table for access users;
[0062] The processing module is used to process the user's packet traffic according to the anti-attack policy in the user's anti-attack table when the user meets the attack conditions.
[0063] Specifically, the creation module is used to obtain user online notifications through the BRAS board and create an anti-attack table for the user based on the user online notifications.
[0064] Specifically, the creation module is used to obtain the user's first message through the BRAS board and create an anti-attack table for the user who sent the first message.
[0065] Creating an anti-attack table includes:
[0066] The private IP address, VPN, and anti-attack policies assigned to users by the operator.
[0067] The anti-attack strategies include: allowing access, limiting traffic, and dropping requests.
[0068] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of the solution in this specification according to actual needs. Those skilled in the art can understand and implement this without creative effort.
[0069] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.
[0070] Other embodiments of this specification will readily occur to those skilled in the art upon consideration of the specification and practice of the invention claimed herein. This specification is intended to cover any variations, uses, or adaptations that follow the general principles of this specification and include common knowledge or customary techniques in the art not claimed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this specification are indicated by the following claims.
[0071] It should be understood that this specification is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this specification is limited only by the appended claims.
[0072] The above description is merely a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of protection of this specification.
Claims
1. A method for preventing attacks, characterized in that, The method includes: Carrier-grade Network Address Translation (CGN) creates an attack prevention table for access users; When a user meets the attack conditions, the user's packet traffic is processed according to the anti-attack policy in the user's anti-attack table.
2. The method according to claim 1, characterized in that, The Carrier-Grade Network Address Translation (CGN) creates an anti-attack table for access users, including: Receive user online notifications via BRAS board; Create an attack prevention table for users based on their online notifications.
3. The method according to claim 1, characterized in that, The Carrier-Grade Network Address Translation (CGN) creates an anti-attack table for access users, including: Obtain the user's first message through the BRAS board; Create an attack prevention table for the user who sent the first message.
4. The method according to claim 1, characterized in that, Creating a protection table includes: Private IP addresses, VPNs, and anti-attack policies assigned to users.
5. The method according to claim 1, characterized in that, Anti-attack strategies include: allowing, limiting, and dropping.
6. A network device, characterized in that, The network device includes: a carrier-grade network address translation (CGN) board, wherein the CGN board includes: Create a module to create an anti-attack table for access users; The processing module is used to process the user's packet traffic according to the anti-attack policy in the user's anti-attack table when the user meets the attack conditions.
7. The network device according to claim 6, characterized in that, The creation module is specifically used to obtain user online notifications through the BRAS board and create an anti-attack table for the user based on the user online notifications.
8. The network device according to claim 6, characterized in that, The creation module is specifically used to obtain the user's first message through the BRAS board and create an anti-attack table for the user who sent the first message.
9. The network device according to claim 6, characterized in that, Creating a protection table includes: Private IP addresses, VPNs, and anti-attack policies assigned to users.
10. The network device according to claim 6, characterized in that, Anti-attack strategies include: allowing, limiting, and dropping.