Dynamic link protection method and apparatus, storage medium, and electronic apparatus

Abstract

Embodiments of the present disclosure provide a dynamic link protection method and apparatus, a storage medium, and an electronic apparatus. The method comprises: when a first network device is attacked by a first packet, the first network device performing session information matching on a received second packet on the basis of a protection list, wherein session information of an established dynamic link is recorded in the protection list; and when session information matching the second packet is present in the protection list, processing the second packet on the basis of a set bandwidth and a set priority so as to protect a first dynamic link corresponding to the second packet from being influenced by the attack of the first packet.

Description

Dynamic link protection method, device, storage medium and electronic device Technical Field

[0001] The embodiments of the present disclosure relate to the field of communications, and in particular, to a dynamic link protection method, device, storage medium, and electronic device. Background Art

[0002] Traditional security approaches to dynamic link protection typically rely on various methods and means to verify identity legitimacy to address the problems of impersonation and attacks by unauthorized users. However, the integration of innovative technologies and emerging industries has increased the vulnerability of cyberspace, providing hackers with more attack methods. Traditional security approaches based on identity verification can no longer completely isolate network attacks, and normal message exchange between devices can still be affected by network attacks.

[0003] Summary of the Invention

[0004] The embodiments of the present disclosure provide a dynamic link protection method, device, storage medium, and electronic device to at least solve the problem that existing dynamic link protection solutions in related technologies cannot ensure that service interactions between devices are not affected by network attacks.

[0005] According to an embodiment of the present disclosure, a dynamic link protection method is provided, comprising: in a case where a first network device is attacked by a first message, the first network device matches session information of a received second message based on a protection list; wherein the protection list records session information of established dynamic links; in a case where session information matching the second message exists in the protection list, the second message is processed with a set bandwidth and a set priority to protect a first dynamic link corresponding to the second message from being affected by the attack of the first message.

[0006] According to another embodiment of the present disclosure, a dynamic link protection device is provided, which is located on the side of a first network device and includes: a first matching module, configured to match session information of a received second message based on a protection list when the first network device is attacked by a first message, wherein the protection list records session information of established dynamic links; and a protection module, configured to process the second message with high bandwidth and high priority when there is session information matching the second message in the protection list, so as to protect the first dynamic link corresponding to the second message from being affected by the attack of the first message.

[0007] According to another embodiment of the present disclosure, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the steps of any one of the above method embodiments when running.

[0008] According to another embodiment of the present disclosure, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any one of the above method embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] FIG1 is a hardware structure block diagram of a network device for executing a dynamic link protection method according to an embodiment of the present disclosure;

[0010] FIG2 is a flow chart of a dynamic link protection method according to an embodiment of the present disclosure;

[0011] FIG3 is a structural block diagram of a dynamic link protection device according to an embodiment of the present disclosure;

[0012] FIG4 is a structural block diagram of a dynamic link protection device according to another embodiment of the present disclosure;

[0013] FIG5 is a structural block diagram of a dynamic link protection device according to another embodiment of the present disclosure;

[0014] FIG6 is a schematic diagram of a dynamic link protection scenario according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0015] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings and in conjunction with embodiments.

[0016] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0017] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a network device, a computer terminal or a similar computing device. Taking operation on a network device as an example, FIG1 is a hardware structure block diagram of a network device running a dynamic link protection method in an embodiment of the present disclosure. As shown in FIG1 , the network device may include one or more (only one is shown in FIG1 ) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor or a programmable logic device) and a memory 104 for storing data, wherein the above-mentioned network device may also include a transmission device 106 and an input and output device 108 configured for a communication function. It will be understood by those skilled in the art that the structure shown in FIG1 is only for illustration and does not limit the structure of the above-mentioned network device. For example, the network device may also include more or fewer components than those shown in FIG1 , or have a configuration different from that shown in FIG1 .

[0018] The memory 104 can be configured to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the dynamic link protection method in the embodiment of the present disclosure. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, implements the above-mentioned method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories may be connected to a network device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0019] The transmission device 106 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by a communications provider of the network device. In one embodiment, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0020] In this embodiment, a dynamic link protection method running on the above-mentioned network device is provided. FIG2 is a flow chart of the dynamic link protection method according to an embodiment of the present disclosure. As shown in FIG2 , the flow chart includes the following steps:

[0021] In step S202, when the first network device is attacked by a first message, the first network device matches the session information of the received second message based on a protection list; wherein the protection list records the session information of the established dynamic link; and the first message is an attack message.

[0022] In related technologies, pre-configured protection lists for dynamic links can prioritize relevant sessions or reject malicious sessions, providing a certain level of security protection. However, existing dynamic link protection methods often manually pre-configure these lists. This is labor-intensive and cannot be maintained in real time based on link establishment status, making it easy to miss protection for normal services and failing to ensure network stability. In the disclosed embodiments, a protection list is automatically generated and added as a network device detects a protocol session for a dynamic link. The network device itself is not pre-configured, and the protection list is dynamically generated.

[0023] In one embodiment, the session information includes: source end quintuple information, destination end quintuple information, and identification information of the session information.

[0024] Before step S202 of this embodiment, the method further includes: the first network device synchronizing the session information corresponding to the detected first dynamic link to the protection list, wherein the first dynamic link is established when the first network device and the second network device need to interact with each other for data.

[0025] In one embodiment, the first network device synchronizes the session information corresponding to the first dynamic link to the protection list, including: the first network device receives the service flow sent by the second network device through the first dynamic link, and synchronizes the session information carried in the service flow to the protection list.

[0026] Step S204: If session information matching the second message exists in the protection list, the second message is processed with the set bandwidth and the set priority to protect the first dynamic link corresponding to the second message from being affected by the attack of the first message.

[0027] In one embodiment, the method also includes: the first network device receives a third message, wherein the second dynamic link corresponding to the third message is established by the first network device when it is attacked by the first message; and synchronizes the session information corresponding to the second dynamic link to the protection list.

[0028] In one embodiment, the method further includes: when the first network device detects that the dynamic link corresponding to the session information in the protection list is removed, deleting the session information from the protection list.

[0029] In one embodiment, the protocol corresponding to the dynamic link includes one of the following types: routing protocol, application protocol, management protocol, and multicast protocol.

[0030] In one embodiment, the method further includes: the first network device matches the first message with session information based on the protection list; and discarding the first message if there is no session information matching the first message in the protection list.

[0031] Through the above steps, when the first network device is attacked by an attacking message, the session information of other received messages is matched against the protection list. If matching session information exists in the protection list, the message is processed with the set bandwidth and priority. This ensures that the established protocol session corresponding to the message is not affected by the attacking message, ensuring that service interaction is not interrupted. Therefore, this solves the problem of existing dynamic link protection solutions in related technologies that cannot guarantee that service interaction between devices is not affected by network attacks, thereby achieving the effect of improving the stability of network operation.

[0032] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the embodiment of the present disclosure is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD-ROM), including a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present disclosure.

[0033] This embodiment also provides a dynamic link protection device configured to implement the aforementioned embodiments and preferred implementations. Details already described will not be repeated. As used below, the term "module" may refer to a combination of software and / or hardware that implements a predetermined function. While the devices described in the following embodiments are preferably implemented using software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.

[0034] FIG3 is a structural block diagram of a dynamic link protection device according to an embodiment of the present disclosure. The device is located in a first network device. As shown in FIG3 , the device includes a matching module 10 and a protection module 20 .

[0035] a matching module 10 configured to match session information of a received second message based on a protection list when the first network device is attacked by the first message, wherein the protection list records session information of the established dynamic link;

[0036] The protection module 20 is configured to process the second message with high bandwidth and high priority when there is session information matching the second message in the protection list, so as to protect the first dynamic link corresponding to the second message from being affected by the attack of the first message.

[0037] In one embodiment, the session information includes: source end quintuple information, destination end quintuple information, and identification information of the session information.

[0038] FIG4 is a structural block diagram of a dynamic link protection device according to another embodiment of the present disclosure. As shown in FIG4 , the device includes all the modules shown in FIG3 , and further includes:

[0039] The synchronization module 30 is configured to synchronize the session information corresponding to the detected first dynamic link to the protection list, wherein the first dynamic link is established when the first network device and the second network device need to interact with each other for data.

[0040] FIG5 is a structural block diagram of a dynamic link protection device according to another embodiment of the present disclosure. As shown in FIG5 , the device includes all the modules shown in FIG4 , and further includes:

[0041] The deleting module 40 is configured to delete the session information from the protection list when detecting that the dynamic link corresponding to the session information in the protection list is removed.

[0042] It should be noted that the above modules can be implemented through software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0043] To facilitate understanding of the technical solutions provided by the present disclosure, embodiments of specific scenarios will be described in detail below.

[0044] The embodiment of the present disclosure proposes a method for implementing dynamic link protection, which is mainly used in dynamic link protection scenarios. It can ensure that the protocol session of the established dynamic link is not affected when attacked by attack messages, ensure that business interaction is not interrupted, and achieve the effect of protecting against network attacks.

[0045] In this embodiment, the dynamic link protection feature adds application-layer data based on detected device sessions to a protection list. Specifically, whenever a dynamic link session is successfully established, the session information is added to the protection list, ensuring the normal operation of existing services during an attack. This feature presupposes that the routing protocol has established neighbor messages and that the management port has established secure and reliable links. When the dynamic link session is dismantled, it is removed from the protection list. This dynamically maintains the protection list, thereby ensuring the operational reliability and stability of session-related services.

[0046] In the embodiment of the present disclosure, the protection list is automatically generated and added as the network device detects a protocol session of a dynamic link. The network device itself is not pre-configured, and the protection list is dynamically generated.

[0047] The implementation method of the dynamic link protection includes two scenarios. FIG6 is a schematic diagram of a dynamic link protection scenario according to an embodiment of the present disclosure:

[0048] Scene 1

[0049] After the session information of a normal link establishment of a certain service is detected by the network device, the network device synchronizes the session information to the protection list, and then the message will be protected normally.

[0050] In this scenario, there is a situation where, when the network device is attacked by an attack message, it detects the session information of a normal link establishment of a certain service and still synchronizes the session information of the normal link establishment of the service to the protection list. That is, when the network device is attacked by the attack message, the protection list has not yet saved the session information corresponding to the service.

[0051] When a device detects a session for a specific protocol, it automatically sends this session information to the protection list. This information includes a five-tuple of information about the local end (i.e., source end) and the remote end (i.e., destination end), along with information identifying the protocol session. Subsequent incoming messages matching this session signature are treated as high-bandwidth, high-priority data, ensuring the reliability and stability of services associated with this session.

[0052] As shown in Scenario 1 in Figure 6, network device 1 detects the successful link establishment session information of normal business flow 1 and business flow 2 and simultaneously sends it to the protection list; when the device receives an attack flow, the subsequent received business flow 1 and business flow 2 match this session feature information. Business flow 1 and business flow 2 will have the right to high bandwidth and high priority processing, so that business flow 1 and business flow 2 are not affected; the attack flow will be discarded because it does not match the protection list session information, and network device 1 will not process it.

[0053] Scene 2

[0054] When a network device is attacked, the received message can match the corresponding session information in the protection list, and the message will be protected normally when it is attacked by the attack message.

[0055] As shown in Scenario 2 in Figure 6, when network device 1 detects the establishment of a protocol session with network device 2, it simultaneously sends this session information to the protection list. When receiving packets that match this session information, such data will receive high-bandwidth and high-priority processing. If network device 1 receives an attack stream but fails to match the session information on the protection list, it will not process it. This ensures that existing protocol sessions between this device and other devices are not affected.

[0056] When a network device detects that a session of a certain protocol has been removed, it must delete the session information from the protection list.

[0057] As shown in Figure 6, when a device receives multiple types of attack flows and service flows from the network connected to the device, the attack flows include but are not limited to at least one of the following: routing protocol ospf / isis / bgp / ldp message attacks; application protocol tcp / udp / ssh attack flows; management protocol netconf / pcep / snmp attack flows; multicast protocol pim / igmp attack flows.

[0058] It can be seen from the above technical solutions that as the requirements for information security become higher and higher, it is becoming more and more important to protect dynamic links from attacks; when subjected to attack messages, this invention protects the established protocol sessions from being affected and the services from being interrupted, thereby improving network stability.

[0059] In addition to the above two scenarios, in this embodiment, when the device detects that a session of a certain protocol is to be removed, the session information needs to be deleted from the protection list.

[0060] An embodiment of the present disclosure further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any one of the above method embodiments when run.

[0061] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0062] An embodiment of the present disclosure further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0063] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0064] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail here.

[0065] Obviously, those skilled in the art should understand that the modules or steps of the present disclosure described above can be implemented using a general-purpose computing device, they can be concentrated on a single computing device, or distributed across a network composed of multiple computing devices, they can be implemented using program code executable by the computing device, and thus, they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be performed in a different order than herein, or they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. Thus, the present disclosure is not limited to any particular combination of hardware and software.

[0066] The foregoing description is merely a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. Those skilled in the art will readily appreciate that various modifications and variations of the present disclosure are possible. Any modifications, equivalent substitutions, or improvements made within the principles of the present disclosure shall be included within the scope of protection of the present disclosure.

Claims

1. A dynamic link protection method, comprising: In the case where the first network device is attacked by the first message, the first network device matches the session information of the received second message based on the protection list; wherein the protection list records the session information of the established dynamic link; When session information matching the second message exists in the protection list, the second message is processed with a set bandwidth and a set priority to protect a first dynamic link corresponding to the second message from being affected by an attack by the first message.

2. The method according to claim 1, wherein: The session information includes: source end five-tuple information, destination end five-tuple information, and identification information of the session information.

3. The method according to claim 1, wherein: Before the first network device matches the received second message with session information based on the protection list, the method further includes: The first network device synchronizes the session information corresponding to the detected first dynamic link to the protection list, wherein the first dynamic link is established when the first network device and the second network device need to interact with each other for data.

4. The method according to claim 3, wherein: The first network device synchronizing the session information corresponding to the first dynamic link to the protection list includes: The first network device receives the service flow sent by the second network device through the first dynamic link, and synchronizes the session information carried in the service flow to the protection list.

5. The method according to claim 3, wherein: The method further comprises: The first network device receives a third message, wherein the second dynamic link corresponding to the third message is established when the first network device is attacked by the first message; The session information corresponding to the second dynamic link is synchronized to the protection list.

6. The method according to claim 1, wherein: The method further comprises: When the first network device detects that the dynamic link corresponding to the session information in the protection list is removed, the first network device deletes the session information from the protection list.

7. The method according to claim 1, wherein: The protocol corresponding to the dynamic link includes one of the following types: routing protocol, application protocol, management protocol, and multicast protocol.

8. The method according to claim 1, wherein: The method further comprises: The first network device matches the first message with session information based on the protection list; If there is no session information matching the first message in the protection list, the first message is discarded.

9. A dynamic link protection device, wherein: Located at the first network device side, including: a matching module, configured to match the received second message with session information based on a protection list when the first network device is attacked by the first message, wherein the protection list records the session information of the established dynamic link; The protection module is configured to process the second message with high bandwidth and high priority when there is session information matching the second message in the protection list, so as to protect the first dynamic link corresponding to the second message from being affected by the attack of the first message.

10. The device according to claim 9, wherein: The session information includes: source end five-tuple information, destination end five-tuple information, and identification information of the session information.

11. The device according to claim 9, wherein: Also includes: A synchronization module is configured to synchronize the session information corresponding to the detected first dynamic link to the protection list, wherein the first dynamic link is established when the first network device and the second network device need to interact with each other for data.

12. The device according to claim 9, wherein: Also includes: The deleting module is configured to delete the session information from the protection list when it is detected that the dynamic link corresponding to the session information in the protection list is removed.

13. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 8 when executed by a processor.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 8 are implemented.

Images