A method for preventing network address translation (NAT) device from being attacked by network user

Abstract

This invention provides a method for preventing network users from attacking NAT devices including: calculating link information of network users to be stored in a network-user-statistical list and setting up a limited-user-statistical list reflecting the information of said network users needing to be limited and requesting to link to the public network server, listing or withdrawing from the limited user statistical list based on the information in the network user statistical list, controlling the link of network users in light of the limited user statistical list to give up the newly built link for users having overlarge links and apply effective flow control algorithm to control the user's new link for users having too quick link rate.

Description

technical field [0001] The invention relates to network security technology, in particular to a method for preventing network users from attacking network address translation (NAT) equipment. Background technique [0002] With the rapid development of the network, the number of network users also increases rapidly, but the address resources of the public network are limited after all. NAT (Network Address Translation) technology is usually used to solve the problem of shortage of address resources in the public network, so that network resources can be fully utilized, but it also creates a network security problem of malicious attacks on Network Address Translation (NAT) devices. This kind of attack usually manifests itself in the form that the attacker continuously applies for the public network address and port number to establish a link, consumes NAT resources and processing performance, and achieves the purpose of malicious attack. [0003] Usually, NAT does not conside...

AI Technical Summary

Problems solved by technology

At present, considering network security issues, many NAT devices have adopted Traffic Regulation (CAR) restriction, that is, the method of restricting the total flow of packets entering NAT to protect against the phenomenon that some private network users may maliciously attack public network servers. Network Address Translation (NAT) devices are protected from malicious attacks caused by heavy traffic, as shown in the attached figure 1 As shown, the threshold of the total traffic is set in advance. After the total number of online users exceeds the set threshold, when there is a connection again, the packet data will be discarded.

Although this has played a role in protecting network security to a certain extent, this method cannot identify which network users have attack tendencies and which are legitimate users. Therefore, the following two methods are used for network users to attack network address translation (NAT) devices. Helpless:

[0004] (1) Network users maliciously occupy NAT resources by establishing a large number of links, so that other users cannot perform normal network access;

[0005] (2) Network users maliciously consume the processing power of NAT by continuously establishing links and then disconnecting them quickly, slowing down the access rate of other network users

Images