Network attack defense methods, CP equipment and UP equipment

Abstract

The present application provides a network attack defense method, CP device and UP device, belonging to the field of communication technology. The method disclosed in the present application is applied in a communication system in which CP and UP are separated, and the method includes: the CP device generates a first control message in response to the reception rate of the dial-up message meeting an abnormal condition, and the first control message is used to instruct the UP device to carry a watermark when sending a dial-up message to the CP device; the CP device sends the first control message to the UP device; the CP device identifies the attack message in the message stream according to the watermark; and the CP device discards the attack message. The method can effectively resist network attacks and ensure the security of the CP device.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a network attack defense method, a CP device, and a UP device. Background Art

[0002] With the development of software defined network (SDN) technology and network functions virtualization (NFV) technology, data communication networks have evolved from the traditional network-centric architecture to the data center-centric network architecture. Traditional network equipment has also evolved from specialization to generalization. In view of this, control plane and user plane disaggregated (CU separation) technology came into being and became a research hotspot in this field. CU separation refers to a network architecture in which the control plane (CP) and user plane (UP) are decoupled. When the CU separation architecture is adopted, the CP and UP are located on different hardware devices, or the CP and UP are located on the same hardware device and have separate functions. Nowadays, the CU separation architecture has become the next step in the evolution of many communication systems and has been recognized by mainstream manufacturers, operators and standard organizations.

[0003] Nowadays, CP devices are at great risk of being attacked by cyber attacks, which affects the security of CP devices. Summary of the invention

[0004] The embodiment of the present application provides a network attack defense method, a CP device and a UP device, which are helpful to ensure the security of the CP device. The technical solution is as follows:

[0005] In a first aspect, a method for defending against network attacks is provided. The method is applied in a communication system in which CP and UP are separated. The method is described from the perspective of a CP device. In response to a reception rate of a dial-up message satisfying an abnormal condition, the CP device generates a first control message, where the first control message is used to instruct the UP device to carry a watermark when sending a dial-up message to the CP device; the CP device sends the first control message to the UP device; the CP device identifies an attack message in a message stream based on the watermark; and the CP device discards the attack message.

[0006] Through the method of the first aspect, when the CP device finds that the reception rate of the dial-up message is abnormal, it believes that it is under network attack. In this case, the CP device will generate and send a control message to the UP device, so as to notify the UP device through the control message to carry the watermark when sending the dial-up message, so as to realize the function of CP controlling UP to enable the watermark. Since it is difficult for the attacker to know the watermark negotiated between the CP device and the UP device, the attacker cannot construct an attack message containing the watermark. Therefore, when the CP device receives the message stream later, it can judge whether the message is an attack message sent by the attacker or a normal message sent by the UP device based on whether the message includes a watermark, and then discard the attack message. Since the attack message is discarded by the CP device, it is avoided that the processing action of the attack message consumes the processing resources of the CP device. It can be seen that this method can effectively resist network attacks and ensure the security of the CP device.

[0007] Optionally, the watermark includes a first virtual extended local area network identifier (VXLAN network identifier, VNI), the message stream includes a first message, and the CP device identifies attack messages in the message stream based on the watermark, including: the CP device determines that the first message is a non-attack message based on the first message including the first VNI.

[0008] Through this optional method, the action of the CP device to determine the attack message according to the first VNI can be implemented by reusing the process of checking the VNI in the received VXLAN message in the virtual extended local area network (Virtual Extensible Local Area Network, VXLAN) forwarding process. Since the CP device can reuse the existing processing logic to achieve the defense capability of network attacks, the additional computing performance overhead of the CP device for adding new defense capabilities is saved. It can be seen that this solution for implementing defense against network attacks has low overhead and high practicality.

[0009] Optionally, the watermark includes a first random number, the message stream includes a second message, and the CP device identifies an attack message in the message stream according to the watermark, including: the CP device determines that the second message is a non-attack message according to the second message including the first random number.

[0010] Through this optional method, since it is difficult for the attacker to know the first random number sent by the CP device to the UP device, it is impossible to construct an attack message containing the first random number. Therefore, the CP device can effectively distinguish whether the message is an attack message sent by the attacker or a non-attack message (such as a normal message sent by the UP device) based on whether the message contains the first random number, thereby effectively defending against the attacker's network attack.

[0011] Optionally, the watermark includes a first timestamp, where the first timestamp is used to indicate a time point of synchronization between the CP device and the UP device, the message stream includes a third message, and the CP device identifies an attack message in the message stream according to the watermark, including: the CP device determines that the third message is a non-attack message according to the third message including the first timestamp.

[0012] Through this optional method, on the one hand, since it is difficult for the attacker to know the time point when the CP device is synchronized with the UP device, it is impossible to construct an attack message containing the first timestamp corresponding to the synchronization time point. Therefore, the CP device can effectively distinguish whether the message is an attack message sent by the attacker or a non-attack message (such as a normal message sent by the UP device) based on whether the message contains the first timestamp, thereby effectively defending against the attacker's network attack. On the other hand, the time synchronization mechanism between the CP device and the UP device can be reused, thereby reducing the implementation complexity.

[0013] Optionally, the watermark includes a first message authentication code, the message stream includes a fourth message, and the CP device identifies an attack message in the message stream according to the watermark, including: the CP device determines that the fourth message is a non-attack message according to the fourth message including the first message authentication code.

[0014] Through this optional method, since the CP device and the UP device use the message authentication code as a watermark for verifying the message, and the message authentication code needs to be obtained through a hash operation, it has high security and is difficult to forge, so it has a strong ability to resist network attacks.

[0015] Optionally, the first control message includes the watermark; or, the first control message includes watermark type information corresponding to the watermark; or, the first control message includes parameters related to generating the watermark.

[0016] Optionally, the first control message is a control plane and user plane separated protocol (CUSP) message, the CUSP message includes a watermark type length value (TLV), and the watermark TLV is a TLV that carries the watermark or the parameter.

[0017] Through this optional method, since the CP device sends the watermark to the UP device through the CUSP, the CP device and the UP device can be reused to implement the relevant architecture of CUSP communication, thereby improving the availability of the technical solution.

[0018] Optionally, the first control message is a Packet Forwarding Control Protocol (PFCP) message, the PFCP message includes a watermark information element (IE), and the watermark IE is an IE that carries the watermark or the parameter.

[0019] Through this optional method, since the CP device sends the watermark to the UP device through PFCP, the CP device and the UP device can be reused to implement the relevant architecture of PFCP communication, thereby improving the availability of the technical solution.

[0020] Optionally, the first control message is a PFCP node message; or, the first control message is a PFCP session message.

[0021] Optionally, the message stream includes a fifth message, and the CP device identifies an attack message in the message stream according to the watermark, including: the CP device determines that the fifth message is an attack message according to the fact that the fifth message does not include the watermark.

[0022] Optionally, after the CP device sends the first control message to the UP device, the method further includes:

[0023] In response to the receiving rate of the dial-up message meeting a normal condition, the CP device generates a second control message, where the second control message is used to instruct the UP device to cancel the watermark when sending the dial-up message to the CP device;

[0024] The CP device sends the second control message to the UP device.

[0025] Through this optional method, when the CP device finds that the reception rate of the dial-up message is normal, it confirms that the network attack has stopped. In this case, the CP device will generate and send a control message to the UP device, thereby notifying the UP device through the control message to cancel the watermark when sending the dial-up message, thereby supporting the function of CP controlling UP to turn off the watermark.

[0026] Optionally, the communication system is a broadband network gateway (BNG) system or a virtual broadband remote access server (BRAS) system.

[0027] In a second aspect, a method for defending against network attacks is provided. The method is applied in a communication system in which CP and UP are separated. The method is described from the perspective of a UP device. The UP device receives a first control message from the CP device. The first control message is used to instruct the UP device to carry a watermark when sending a dial-up message to the CP device; the UP device carries the watermark in the dial-up message according to the first control message; and the UP device sends a dial-up message including the watermark to the CP device.

[0028] According to the method of the second aspect, when the UP device receives the control message sent by the CP device, it carries the watermark in the dial-up message and sends the dial-up message containing the watermark to the CP device, which helps the CP device to effectively distinguish whether the message is an attack message sent by the attacker or a normal message sent by the UP device according to whether the message includes the watermark, and then discard the attack message. It can be seen that this method can effectively resist network attacks and ensure the security of the CP device.

[0029] Optionally, the watermark includes a first virtual extended local area network identifier VNI.

[0030] Optionally, the watermark comprises a first random number.

[0031] Optionally, the watermark comprises a first timestamp.

[0032] Optionally, the watermark includes a first message authentication code.

[0033] Optionally, the first control message includes the watermark; or, the first control message includes watermark type information corresponding to the watermark; or, the first control message includes parameters related to generating the watermark.

[0034] Optionally, the first control message is a Control and Forwarding Separation Protocol (CUSP) message, the CUSP message includes a watermark type length value TLV, and the watermark TLV is a TLV that carries the watermark or the parameter.

[0035] Optionally, the first control message is a Packet Forwarding Control Protocol (PFCP) message, the PFCP message includes a watermark information element (IE), and the watermark IE is an IE that carries the watermark or the parameter.

[0036] Optionally, the first control message is a PFCP node message; or, the first control message is a PFCP session message.

[0037] Optionally, the communication system is a broadband network gateway BNG system or a broadband remote access server BRAS system.

[0038] Optionally, after the UP device carries the watermark in a dial-up message according to the first control message, the method further includes:

[0039] The UP device receives a second control message from the CP device, where the second control message is used to instruct the UP device to cancel the watermark when sending a dial-up message to the CP device;

[0040] The UP device sends a dial-up message that does not include a watermark to the CP device according to the second control message.

[0041] In a third aspect, a CP device is provided, which has the corresponding functions of implementing the first aspect or any optional method of the first aspect. The CP device includes at least one unit, and the at least one unit is used to implement the method provided by the first aspect or any optional method of the first aspect.

[0042] In one example, the unit in the CP device is implemented by software, and the unit in the CP device is a program module. In another example, the unit in the CP device is implemented by hardware or firmware. The specific details of the CP device provided in the third aspect can be found in the first aspect or any optional method of the first aspect, which will not be repeated here.

[0043] In a fourth aspect, a UP device is provided, which has the corresponding functions of implementing the second aspect or any optional manner of the second aspect. The UP device includes at least one unit, and the at least one unit is used to implement the method provided by the second aspect or any optional manner of the second aspect.

[0044] In one example, the unit in the UP device is implemented by software, and the unit in the UP device is a program module. In another example, the unit in the UP device is implemented by hardware or firmware. The specific details of the UP device provided in the fourth aspect can be found in the above-mentioned second aspect or any optional manner of the second aspect, which will not be repeated here.

[0045] In a fifth aspect, a CP device is provided, the CP device comprising a processor and a communication interface, the processor is used to execute instructions so that the CP device performs the method provided by the first aspect or any optional manner of the first aspect, and the communication interface is used to receive or send a message. The specific details of the CP device provided in the fifth aspect can be found in the first aspect or any optional manner of the first aspect, and will not be repeated here.

[0046] In a sixth aspect, a UP device is provided, the UP device comprising a processor and a communication interface, the processor is used to execute instructions so that the UP device performs the method provided by the second aspect or any optional manner of the second aspect, and the communication interface is used to receive or send a message. The specific details of the UP device provided in the sixth aspect can be found in the second aspect or any optional manner of the second aspect, and will not be repeated here.

[0047] In a seventh aspect, a computer-readable storage medium is provided, wherein the storage medium stores at least one instruction, and the instruction is read by a processor to enable a CP device to execute the method provided in the first aspect or any optional manner of the first aspect.

[0048] In an eighth aspect, a computer-readable storage medium is provided, wherein the storage medium stores at least one instruction, and the instruction is read by a processor to enable a UP device to execute the method provided in the second aspect or any optional manner of the second aspect.

[0049] In a ninth aspect, a computer program product is provided, the computer program product comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a CP device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the CP device performs the method provided in the first aspect or any optional manner of the first aspect.

[0050] In a tenth aspect, a computer program product is provided, the computer program product comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a UP device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the UP device executes the method provided in the second aspect or any optional manner of the second aspect.

[0051] In an eleventh aspect, a chip is provided. When the chip runs on a CP device, the CP device executes the method provided in the first aspect or any optional manner of the first aspect.

[0052] In a twelfth aspect, a chip is provided. When the chip runs on a UP device, the UP device executes the method provided in the second aspect or any optional manner of the second aspect.

[0053] In a thirteenth aspect, a CP device is provided, the CP device comprising: a main control board and an interface board, and further, a switching network board. The CP device is used to execute the method in the first aspect or any possible implementation of the first aspect. Specifically, the CP device includes a unit for executing the method in the first aspect or any possible implementation of the first aspect.

[0054] In a fourteenth aspect, a UP device is provided, the UP device comprising: a main control board and an interface board, and further, a switching network board. The UP device is used to execute the method in the second aspect or any possible implementation of the second aspect. Specifically, the UP device includes a unit for executing the method in the second aspect or any possible implementation of the second aspect.

[0055] In a fifteenth aspect, a communication system with CP and UP separation is provided, the communication system comprising a CP device and a UP device. For example, the communication system comprises the CP device provided in any one of the third aspect, the fifth aspect, and the thirteenth aspect, and the communication system comprises the UP device provided in any one of the fourth aspect, the sixth aspect, and the fourteenth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a schematic diagram of the architecture of a CU separation system provided in an embodiment of the present application;

[0057] Figure 2 It is a schematic diagram of the working principle of a CU-separated BNG system provided in an embodiment of the present application;

[0058] Figure 3 It is a structural diagram of a communication system provided in an embodiment of the present application;

[0059] Figure 4 This is a functional architecture diagram of a CP device provided in an embodiment of the present application;

[0060] Figure 5 It is a flow chart of a network attack defense method provided by an embodiment of the present application;

[0061] Figure 6 It is a schematic diagram of a CP device and a UP device defending against network attacks provided by an embodiment of the present application;

[0062] Figure 7 It is a schematic diagram of the format of a dial-up message including a watermark provided in an embodiment of the present application;

[0063] Figure 8 It is a schematic diagram of the format of a dial-up message including a watermark provided in an embodiment of the present application;

[0064] Fig. 9 It is a schematic diagram of the format of a dial-up message including a watermark provided in an embodiment of the present application;

[0065] Fig.10 It is a schematic diagram of the format of a dial-up message including a watermark provided in an embodiment of the present application;

[0066] Fig.11is a structural diagram of a CP device 400 provided in an embodiment of the present application;

[0067] Fig.12 is a structural diagram of a UP device 500 provided in an embodiment of the present application;

[0068] Fig.13 is a schematic diagram of the structure of a device 600 provided in an embodiment of the present application;

[0069] Fig.14 is a schematic diagram of the structure of a device 700 provided in an embodiment of the present application;

[0070] Fig.15 It is a structural diagram of a communication system 800 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0071] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0072] The following is an introduction to some terminology-related concepts involved in the embodiments of the present application.

[0073] (1) CU separation

[0074] CU separation refers to a network architecture in which CP and UP are decoupled. CU separation includes but is not limited to the following implementation method A and implementation method B.

[0075] Implementation method A: The control plane and forwarding plane are located on different hardware devices.

[0076] When implementation method A is adopted, the CP device and the UP device are two separate and different devices. Optionally, the CP device and the UP device are distributed in different locations. For example, the CP device is located in a data center in the cloud, and the UP device is deployed at a suitable location in the network according to demand. In this way, the deployment of the control plane and the forwarding plane is more flexible.

[0077] Implementation method B: The control plane and forwarding plane are located on the same hardware device and have separate functions.

[0078] When implementation mode B is adopted, the physical entity of the CP device and the physical entity of the UP device are the same device. For example, the CP device and the UP device run in the same host, the same server or the same terminal.

[0079] In one example, both the CP device and the UP device are implemented through virtualization technology. The CP device is, for example, called a virtual CP (virtual CP, vCP), and the UP device is, for example, called a virtual UP (virtual UP, vUP). For example, the CP device is a virtual machine, and the UP device is a virtual router or a virtual switch. In one example, both the CP device and the UP device are implemented based on a general physical server combined with NFV technology, and the CP device and the UP device are two different virtualized network functions (virtualized network functions, VNFs). For example, both the CP device and the UP device are network elements virtualized from an X86 server.

[0080] In another example, the CP device is implemented by virtualization technology, and the UP device is implemented by a traditional network device. The UP device is, for example, called a physical UP (pUP).

[0081] This embodiment does not limit the quantitative relationship between CP devices and UP devices in the communication system. In one example, the CP device and the UP device are in a one-to-many relationship, that is, one CP device is used to control multiple UP devices. In another example, the CP device and the UP device are in a one-to-one relationship, that is, one CP device is used to control one UP device.

[0082] This embodiment does not limit the number of UP devices in the communication system. Optionally, the CU-separated communication system includes multiple UP devices. Optionally, the multiple UP devices in the CU-separated communication system are distributed in different locations. Optionally, the multiple UP devices in the CU-separated communication system collaboratively share forwarding tasks based on a distributed architecture.

[0083] It is worth pointing out that "CU separation" can have different names. For example, different standards, different versions of the same standard, different manufacturers, and different application scenarios may have different names for "CU separation". For example, the term "CU separation" can sometimes also be called "control and forwarding separation", "forwarding and control separation", "control plane and user plane separation", "control and user separation", etc.

[0084] It is worth pointing out that "CP" can have different names. For example, different standards, different versions of the same standard, different manufacturers, and different application scenarios may have different names for "CP". For example, the term "CP" may sometimes be referred to as "CP function (CP function, CPF)" or "CP surface". In this article, "CP", "CPF" and "CP surface" are used interchangeably. The term "CP device" refers to any device that implements the CP function.

[0085] It is worth noting that "UP" can have different names. For example, different standards, different versions of the same standard, different manufacturers, and different application scenarios may have different names for "UP". For example, the term "UP" may sometimes be referred to as "UP function (UPF)" or "UP surface". In this document, "UP", "UPF" and "UP surface" are used interchangeably. The term "UP device" refers to any device that implements the UP function.

[0086] (2) Broadband network gateway (BNG)

[0087] BNG is a telecommunications network element device used by operators for broadband access, which is used to connect user equipment to the broadband network. BNG is mainly responsible for access authentication and Internet protocol (IP) address allocation.

[0088] (3) CU-Separated BNG System

[0089] Traditional BNG is generally implemented by adding user management functions to routers. With the emergence of various Internet services, the number of user sessions supported by BNG is constantly increasing, the user access bandwidth is constantly increasing, and especially the requirements for the BNG system to provide external services and programmable capabilities are getting higher and higher. In view of these requirements, the SDN or NFV-based architecture decouples the control and forwarding of traditional BNG equipment and decouples the software and hardware, thereby forming a CU-separated BNG system. For details, see the attached Figure 1 , attached Figure 1 This is an example of the architecture of a CU-separated BNG system. The CU-separated BNG system extracts and centralizes the user management functions on multiple BNG devices to form CP devices, while the routing and forwarding functions are retained on the BNG devices to form UP devices.

[0090] The CU-separated BNG system has the advantages brought by the CU-separated architecture while maintaining the original functions of BNG. For example, the CU-separated BNG system can have multiple UP devices, and the CP device dispatches multiple UP devices to handle the forwarding tasks of traffic. The CP device allocates resources to multiple UP devices. Therefore, compared with the single-machine implementation of the BNG system, the utilization rate and reliability of the BNG system under the CU-separated architecture can be greatly improved. Nowadays, the CU-separated BNG system has become the next step in the evolution of BNG and has been fully recognized by mainstream BNG manufacturers, operators and standard organizations. For example, RFC 8772 in the request for comments (RFC, a series of numbered documents) of the Internet Engineering Task Force (IETF) group defines the architecture of the CU-separated BNG system and the control interface between the CP device and the UP device. The Broadband Forum (BBF) defines the basic architecture of the CU-separated BNG system in TR-384, and defines the module function definition and interface definition of the CU-separated BNG system in TR-459.

[0091] It is worth noting that the "CU-separated BNG system" in the embodiment of the present application may have different names. For example, different standards, different versions of the same standard, different manufacturers, and different application scenarios may have different names for the "CU-separated BNG system". For example, the term "CU-separated BNG system" may sometimes be referred to as a "separated BNG system (disaggregated BNG, DBNG)", and accordingly, the CP device in the CU-separated BNG system may be referred to as DBNG-CP, and the UP device in the CU-separated BNG system may be referred to as DBNG-UP. For another example, the term "CU-separated BNG system" may sometimes be referred to as a "virtual broadband network gateway (virtual BNG, vBNG) control plane and user plane separated system (controlplane and user plane disaggregated system, CU system)", that is, a "vBNG CU system", and accordingly, the CP device in the CU-separated BNG system may be referred to as vBNG-CP, and the UP device in the CU-separated BNG system may be referred to as vBNG-UP. For another example, the term "CU-separated BNG system" may sometimes also be referred to as "virtual broadband remote access server (vBRAS) CU system", i.e., "vBRAS CU system". Accordingly, the CP device in the CU-separated BNG system may be referred to as vBRAS-CP, and the UP device in the CU-separated BNG system may be referred to as vBRAS-UP. In this document, "DBNG", "vBNG CU system" and "vBRAS CU system" may be used interchangeably.

[0092] Please refer to the attached Figure 2 The working principle of the CU-separated BNG system is as follows: Figure 2 As shown, it includes the following S101 to S107.

[0093] S101, configure the BNG service on the CP device and configure the routing service on the UP device. The CP device sends part of the BNG configuration information to the UP device through the management interface (Mi).

[0094] S102, the home terminal initiates dialing, and the original dial-up message is transmitted to the UP device. The UP device encapsulates the original dial-up message according to the encapsulation format corresponding to the control packet redirect interface (CPRi) interface, and sends the encapsulated dial-up message to the CP device for processing. The CP device generates a response message based on the dial-up message, and sends the response message to the UP device through the CPRi interface. After decapsulating the response message, the UP device responds to the user.

[0095] The home terminal is, for example, customer premise equipment (CPE). The original dial-up message is, for example, a point-to-point protocol over Ethernet (PPPoE) message or a dynamic host configuration protocol (DHCP) message. The PPPoE dial-up message is, for example, a PPPOE Active Discovery Initiation (PADI). The DHCP dial-up message is, for example, a DHCP discover message.

[0096] S103: During the dialing process, the CP device interacts with a remote authentication dial-in user service (RADIUS) server to authenticate and authorize the user.

[0097] S104: After the user dials up successfully, the CP device sends the user forwarding entry to the UP device via the state control interface (SCi).

[0098] S105. The CP device uses the SCi interface to control the UP device to publish routes to the core router (CR).

[0099] S106: The user accesses the Internet.

[0100] S107: After the user comes online, the CP device sends a billing message to the RADIUS server. Optionally, the RADIUS server sends a change of authorization (COA) instruction to adjust the user's service level agreement (SLA).

[0101] The following introduces the system architecture provided by the embodiments of the present application.

[0102] See attached Figure 3 The embodiment of the present application provides a communication system 200, which is an example of a communication system in which CP and UP are separated. The communication system 200 includes a CP device 210, a UP device 220, an operation and maintenance (OM) 230, a RADIUS server 240, a DHCP server 250, and a CP device 211. Different network elements in the CP device 210, the UP device 220, the OM 230, the RADIUS server 240, the DHCP server 250, and the CP device 211 are connected via a wireless network or a wired network.

[0103] There are three interfaces between the CP device 210 and the UP device 220, which are the CPRi interface, the Mi interface and the SCi interface.

[0104] The CPRi interface is used to send the original dial-up message received by the UP device 220 to the CP device 210. Figure 3In the application scenario shown, when the CPE initiates dialing to access the network, the original dial-up message (such as a PPPoE message or a DHCP message) sent by the CPE will be transmitted to the UP device 220. The UP device 220 receives the original dial-up message, and after encapsulating the original dial-up message according to the message encapsulation format corresponding to the CPRi interface, the UP device 220 sends the encapsulated dial-up message to the CP device 210 through the CPRi interface. The CPRi interface is implemented through a tunnel between the UP device 220 and the CP device 210. For example, the CPRi interface is implemented through a tunnel based on the User Datagram Protocol (UDP), and the message encapsulation format corresponding to the CPRi interface is to encapsulate the tunnel header corresponding to the UDP-based tunnel into the original dial-up message. In one example, the UDP-based tunnel is a generic protocol encapsulation (GPE) tunnel based on a virtual extensible local area network (VXLAN), and the tunnel header encapsulated into the original dial-up message includes a VXLAN header and a GPE extension header. In another example, the UDP-based tunnel is a general packet radio service (GPRS) tunneling protocol (GTP) control plane (GTP-C) tunnel, and the tunnel header encapsulated into the original dial-up message includes a GTP-C header and a network service header (NSH).

[0105] The functions of the SCi interface include the CP device sending a flow table to the UP device, the UP device sending status information to the CP device, etc. In some embodiments of the present application, the SCi interface is used for the CP device to send a control message to the UP device, thereby instructing the UP device to carry a watermark when sending a dial-up message to the CP device through the CPRi interface. In one example, the SCi interface is implemented using the control plane and user plane separated protocol (CUSP). In another example, the SCi interface is implemented using the Packet Forwarding Control Protocol (PFCP).

[0106] The Mi interface is used for the CP device to send configuration information to the UP device. The Mi interface is implemented, for example, using the Network Configuration (NETCONF) protocol.

[0107] In addition, if attached Figure 3 As shown, the CP device 210 communicates with the OM 230, for example, through the Simple Network Management Protocol (SNMP) or NETCONF. The CP device 210 communicates with the RADIUS server 240, for example, through the RADIUS protocol. The CP device 210 communicates with the DHCP server 250, for example, through DHCP. The CP device 210 and the CP device 211 perform data synchronization, for example, through a data backup message. In one example, the CP device 211 and the CP device 210 collaborate to perform dial-up processing, for example, based on a load sharing mechanism; in another example, the CP device 210 is a primary device, and the CP device 211 is a backup device of the CP device 210.

[0108] The overall structure of the communication system 200 is introduced above by way of example. The CP device 210 in the communication system 200 is introduced in detail below.

[0109] The functions of the CP device 210 include: supporting management functions for the UP device 220, such as joining and exiting the UP device 220 and reporting interface resources of the UP device 220; supporting processing of PPPoE dial-up messages or DHCP dial-up messages of users sent by the UP device 220 to access users; supporting communication with the RADIUS server 240 to authenticate, authorize and bill users; supporting allocation of IP addresses to users; supporting issuing forwarding table entries for the UP device 220 for the UP device 220 to forward user traffic.

[0110] In one example, the CP device 210 is a VNF network element, and the CP device 210 is deployed in a NFV infrastructure (NFVI) environment. For example, the CP device 210 is a software, and the CP device 210 runs on an X86 server. For example, the CP device 210 is a distributed software, and different functional modules of the CP device 210 are distributed on different hardware devices.

[0111] For example, see Appendix Figure 4 , attached Figure 4 The CP device 210 includes multiple dial-up processing modules 2201 and input output (IO) / load balancing (LB) modules 2202. The multiple dial-up processing modules 2201 are distributed on different hardware devices. The IO / LB modules 2202 are used to communicate with the UP devices. In addition, the IO / LB modules 2202 share the received dial-up message load to the multiple dial-up processing modules 2201. Figure 4The architecture shown, on the one hand, can coordinate the computing power of multiple hardware devices to perform dial-up processing, thereby effectively ensuring the performance of the communication system 200 in processing user online users. On the other hand, when capacity expansion is required, it can be achieved by adding more dial-up processing modules 2201 to the CP device 210, so that the communication system 200 meets the elastic expansion requirements of the VNF.

[0112] The above is an illustrative introduction to the system architecture. The following is an illustrative introduction to application scenarios to which some embodiments of the present application are suitable, in combination with the system architecture described above.

[0113] In the system architecture described above, the CP device 210 serves as the control plane of the communication system 200. The CP device 210 needs to provide security functions to ensure the system security and service security of the communication system 200. Since the channels established between the CP device 210 and the UP device 220 through interfaces such as the CPRi interface, the Mi interface, and the SCi interface are generally in-band communication channels, they need to cross the metropolitan area network or even the core network, which poses security risks. Therefore, the CP device 210 needs to adopt security protection measures to defend against network attacks from the channel between the CP device 210 and the UP device 220.

[0114] Distributed denial of service attack (DDoS), as a typical way to attack servers, is one of the main threats faced by CP device 210. The main means of DDoS attack is Synchronize Sequence Numbers (SYN) flood attack. Among the three interfaces between CP device 210 and UP device 220, SCi interface and Mi interface are both based on Transmission Control Protocol (TCP) interfaces, and both SCi interface and Mi interface have encryption capabilities. DDoS protection (anti-DDoS) equipment can be used to defend against attacks on SCi interface and Mi interface of CP device 210. Therefore, it is relatively easy to defend against DDoS attacks, while it is relatively difficult to defend against DDoS attacks on CPRi interface.

[0115] Specifically, during the process of sending dial-up messages (such as PADI messages for PPPoE dial-up and DHCP discovery messages for DHCP dial-up) by the UP device 220, the attacker may intercept the PADI messages or DHCP discovery messages sent by the UP. The attacker jumps the media access control (MAC) address or virtual LAN (VLAN) number in such dial-up messages, constructs a large number of attack messages, and sends the encapsulated large number of attack messages directly to the CP device 210 according to the message encapsulation format of the CPRi interface, without passing through the UP device 220, thereby launching a replay attack. After a large number of attack messages enter the CP device 210, it is easy to cause the dial-up messages of normal online users to be flooded, and a large number of attack messages will cause the CP device 210 to establish a large number of invalid state machines, resulting in high CPU utilization and large memory consumption of the CP device 210, thereby causing a denial of service (DoS) effect. Therefore, how the CP device 210 defends against DDoS replay attacks from the CPRi interface is a demand that needs to be met in the art.

[0116] However, since it is necessary to determine whether a PADI message or a DHCP discovery message is an attack message through the subsequent process of dialing, that is, a user who only sends a PADI message or a DHCP discovery message but does not send a subsequent dial-up message is determined to be an attacker. Therefore, it is difficult for a general firewall or anti-DDoS system to identify attack messages, and it is necessary to defend against attack messages based on the CP device 210. For the CP device 210, since the implementation method of the CPRi interface is VXLAN-GPE or GTP-C, both of which are based on UDP, the CP device 210 cannot use technologies such as TCP keychain to verify the source IP address in the message received through the CPRi interface. In the dial-up message (such as the PADI message of PPPoE dial-up and the DHCP discovery message of DHCP dial-up), the source MAC address is the MAC address of the dial-up user. The CP device 210 cannot determine whether the source MAC address is legal, and it is also impossible to distinguish attack messages from normal online messages based solely on the source MAC address. It can be seen that how the CP device 210 identifies the attack message from the CPRi interface is one of the technical difficulties in this field.

[0117] In some cases, a speed limit is used to defend against replay attacks initiated by PADI messages or DHCP discovery messages. Specifically, the CP device 210 uses a token bucket technology on the IO / LB module 2202 to group users according to MAC addresses. Then, the CP device 210 performs a committed access rate (CAR) on the rate of each group of dial-up messages sent to the dial-up processing module 2201. When an attack occurs, the IO / LB module 2202 performs a hash operation based on the source MAC address, groups the received dial-up messages, and each group corresponds to a token bucket. The rate of dial-up messages sent to the dial-up processing module 2201 is limited according to the token rate, and messages exceeding the token rate will be randomly discarded. In this way, the dial-up processing module 2201 will not be hung due to the large number of messages sent exceeding the processing performance.

[0118] However, when the above method is adopted, since the number of groups is limited, the MAC address of the attack message and the MAC address of the normal message may be divided into the same group. Since the token bucket technology randomly discards the messages in the same group, the normal message may also be discarded by the CP device 210, resulting in the inability of normal users to go online. In addition, even if the speed limit is adopted, the CP device 210 still needs to process a lot of attack messages, which wastes the processing resources of the CP device 210.

[0119] In view of the needs of the above application scenarios, in some embodiments of the present application, a method for the CP device and the UP device 220 to jointly defend against DDoS attacks is provided. The CP device sends a control message from the SCi interface to notify the UP device 220 to carry a watermark in the dial-up message sent through the CPRi interface, so that the CP device can effectively distinguish between attack messages and normal messages according to the watermark, so that the attack message of the replayer can be discarded, and the normal message sent by the user through the UP device 220 can be processed. Through this method, not only can the normal user's access to the line be guaranteed, but also the computing resources of the CP can be saved. In addition, some embodiments extend the SCi interface between the CP device and the UP device 220, and provide how to extend the CUSP message format defined by the standard IETFRFC 8772 and the PFCP message format defined by BBF TR-459 to implement control messages, so that the CP device can use the extended message format to control the UP device 220 to use or turn off the watermark. In addition, some embodiments extend the CPRi interface between the CP device and the UP device 220, and provide information on how to extend the VXLAN-GPE message format to carry various types of watermarks.

[0120] The technical solution provided by this embodiment is specifically introduced below through method 300.

[0121] See attached Figure 5 , attached Figure 5 3 is a flow chart of a network attack defense method 300 provided in an embodiment of the present application. The interaction subjects of the method 300 include a CP device and a UP device.

[0122] In one example, the CP device in method 300 is an attached Figure 3 The CP device 210 or CP device 211 in the communication system 200 shown in the figure, the CP device in the method 300 is attached Figure 3 UP device 220 in the communication system 200 is shown.

[0123] In one example, the CP device in the method 300 is a CP device in a BNG system in which the CP and UP are separated, such as a CP or DBNG-CP in a vBNG system. The UP device in the method 300 is a UP device in a BNG system in which the CP and UP are separated, such as a UP or DBNG-UP in a vBNG system. In one example, the CP device in the method 300 is a CP device in a BRAS system in which the CP and UP are separated. The UP device in the method 300 is a UP device in a BRAS system in which the CP and UP are separated.

[0124] In another example, the CP device and the UP device in method 300 are implemented using other CU separation systems other than the BNG system. For example, the CP device in method 300 is a device where the control plane is located in other CU-separated wired access systems or wireless access systems, and the UP device in method 300 is a device where the forwarding plane is located in other CU-separated wired access systems or wireless access systems. For example, the CP device and the UP device in method 300 are implemented using a CU-separated 4G core network (EPC) system or a CU-separated 5G core network (5GC) system. For example, the CP device is implemented using the CP in the CU-separated serving gateway (S-GW). For another example, the CP device is implemented using the CP in the CU-separated packet data network gateway (PDN gateway, PGW). For another example, the CP device is implemented using a mobility management function (access and mobility management function, AMF) network element. For another example, the CP device is implemented using a session management function (session management function, SMF) network element. For another example, the access gateway function (AGF) network element in the WT-456 fixed and mobile converged communication system is used to implement the CP device.

[0125] In one example, method 300 is processed by a general-purpose central processing unit (CPU), or by a CPU and a network processor (NP), or by two or more hardwares of a CPU, a network processor (NP), and a physical interface card (PIC). Alternatively, NP or PIC may be omitted, and other processors suitable for message forwarding may be used. Method 300 is not limited. For example, CP performs the processing work corresponding to carrying a watermark in a message and identifying an attack message according to the watermark in method 300, and NP and PIC undertake the processing work corresponding to sending or receiving a message in method 300.

[0126] Exemplarily, method 300 includes steps S301 to S315.

[0127] S301: The attacker sends a dial-up message after jumping to the CP device.

[0128] When the dial-up message is transmitted from the UP device to the CP device through the network, the attacker captures the dial-up message sent by the UP device in the network, changes the parameters in the dial-up message (such as the source MAC address, VLAN number, etc.), and sends the changed dial-up message to launch an attack.

[0129] S303: In response to the reception rate of the dial-up message satisfying the abnormal condition, the CP device generates a first control message, where the first control message is used to instruct the UP device to carry a watermark when sending a dial-up message to the CP device.

[0130] The abnormal condition is used to detect whether the reception rate of the dial-up message is abnormal. In one example, the abnormal condition is satisfied when the reception rate exceeds the rate threshold for a preset time.

[0131] In one example, the CP device measures the speed of the dial-up message. Specifically, the CP device measures the reception rate of the dial-up message. If the reception rate exceeds the rate threshold for a preset time, the CP device determines that the reception rate meets the abnormal condition, and then executes S303. For example, the CP device limits the speed of the dial-up message through CAR. If it is found that the reception rate of the dial-up message exceeds the CAR value, the timing is performed. When the recorded time exceeds the preset time, it is determined that the reception rate meets the abnormal condition.

[0132] In an example, the dial-up message includes the dial-up message sent by the attacker to the CP device, and also includes the dial-up message sent by the UP device connected to the CP device.

[0133] S304: The CP device sends a first control message to the UP device.

[0134] Since the situation where the dial-up message reception rate meets the abnormal condition is very likely caused by a network attack, if the dial-up message reception rate meets the abnormal condition, the CP device can determine that it has been attacked by a network. In this case, the CP device generates a first control message. Since the first control message indicates that a watermark is carried when the dial-up message is sent, the CP device notifies the UP device to carry a watermark in the dial-up message by sending the first control message to the UP device. Therefore, the dial-up message subsequently sent by the UP device to the CP device will contain a watermark, thereby supporting the function of the CP device controlling the UP device to enable the watermark.

[0135] The watermark is used by the CP device to verify the legitimacy of the dial-up message it receives. The role of the watermark is similar to the identification of the UP device. The specific value of the watermark is negotiated between the CP device and the UP device by transmitting the first control message. If the message sent to the CP device does not include the watermark or includes the watermark but the watermark is incorrect, indicating that the message sent to the CP device is not from the UP device, then the message will not pass the verification of the CP device and will be identified as an attack message by the CP device.

[0136] There are many implementations for what kind of data the CP device and the UP device use as a watermark, which are described below using watermark type a to watermark type d as examples.

[0137] Watermark type a: Use the adjusted virtual extended local area network identifier (VXLAN network identifier, VNI) as the watermark.

[0138] Specifically, there is a VXLAN tunnel between the UP device and the CP device. When the UP device sends a dial-up message, it will add a VXLAN header containing the VNI to the original dial-up message, so that the dial-up message with the VXLAN header added can be forwarded using the VXLAN header after entering the VXLAN tunnel. When it is necessary to use watermark defense attacks, the CP device will notify the UP device to adjust the value of the VNI in the VXLAN header, so that the VNI in the VXLAN header of the dial-up message sent by the UP device is changed from the original VNI to the adjusted VNI, so that the CP device can use the adjusted VNI to verify the dial-up message sent.

[0139] Among them, VNI is a user identifier similar to VLAN ID. A VNI represents a tenant. When VXLAN packets are encapsulated, a 24-bit length space is allocated to the VNI, so that it can support the isolation of massive tenants.

[0140] Watermark type b: Use random numbers as watermarks.

[0141] When watermark type b is used, the CP device and the UP device will use a random number as the watermark of the dial-up message. Specifically, the CP device will notify the UP device to carry the random number when sending the dial-up message, so that the dial-up message sent by the UP device to the CP device includes the random number, so that the CP device can use the random number to verify the sent dial-up message.

[0142] Watermark type c: Use timestamp as watermark.

[0143] When watermark type c is used, the CP device and the UP device use the timestamp as the watermark of the dial-up message. Specifically, the CP device and the UP device will perform time synchronization. When it is necessary to use the watermark to defend against attacks, the CP device instructs the UP device to carry the timestamp when sending the dial-up message, so that the dial-up message sent by the UP device contains the timestamp, so that the CP device can verify the sent dial-up message by using whether the timestamp corresponds to the synchronization time point. For example, the CP device and the UP device perform time synchronization based on the Network Time Protocol (NTP) protocol. Both the CP device and the UP device use the NTP time server as the clock source. Both the CP device and the UP device receive the current time point from the NTP time server, thereby ensuring time synchronization between the UP device and the CP device.

[0144] Watermark type d: Use message authentication code as watermark.

[0145] The message authentication code is, for example, a hash value of at least one parameter in the dial-up message. For example, the message authentication code is a hash value of parameters in message headers such as an IP header, a MAC frame header, and a UDP header in the dial-up message. For example, the message authentication code is a hash value of the source MAC address and the destination MAC address in the dial-up message. For another example, the message authentication code is a hash value of the source MAC address, the destination MAC address, the source IP address, and the destination IP address in the dial-up message. For another example, the message authentication code is a hash value of the source MAC address, the destination MAC address, the source IP address, the destination IP address, and the UDP header in the dial-up message. The message authentication code is obtained, for example, by performing a hash operation based on a hash function.

[0146] Several types of watermarks are illustrated above through watermark type a to watermark type d. This embodiment does not limit which type of watermark from watermark type a to watermark type d is used by the CP device and the UP device. In one example, the CP device selects a specific watermark type according to the intensity of the attack. For example, when the attack intensity suffered by the CP device is strong, watermark type d is selected, that is, the message authentication code is used as the watermark used by the CP device and the UP device to defend against the attack, thereby achieving the best defense effect. For example, when the attack intensity suffered by the CP device is weak, watermark type a is selected, that is, the VNI is adjusted as the watermark used by the CP device and the UP device to defend against the attack, thereby reducing the performance overhead of the CP device and the UP device.

[0147] This embodiment does not limit the specific content of the first control message. In one example, the first control message includes a watermark. In other words, the CP device carries the watermark itself in the first control message and sends it to the UP device. In another example, the first control message includes watermark type information corresponding to the watermark. In another example, the first control message includes parameters related to generating the watermark. For example, the CP device carries at least one of the following items: the watermark format, the watermark type, the position where the watermark is carried in the dial-up message, the number of digits of the watermark, and the name of the input parameter for generating the watermark in the first control message and sends it to the UP device. In combination with the above-mentioned watermark types a to d, the following examples of the content of the first control message are used to illustrate the content of the first control message through the following cases a to d.

[0148] Case a: the content of the first control message when the adjusted VNI is used as the watermark.

[0149] Specifically, the CP device obtains the first VNI, and carries the first VNI in the first control message, so that the first control message includes the first VNI. The first VNI refers to the adjusted VNI. The first VNI is different from the VNI used by the UP device when originally sending the dial-up message. Among them, this embodiment does not limit how the CP device obtains the first VNI. In one example, the CP device reserves a VNI according to the configuration, and the CP device selects an unoccupied VNI from the reserved VNI as the first VNI. In another example, the CP device carries the watermark type information corresponding to the first VNI in the first control message, so that the first control message includes the watermark type information corresponding to the first VNI. The watermark type information corresponding to the first VNI indicates that the watermark type is VNI.

[0150] Case b: the content of the first control message when a random number is used as the watermark.

[0151] For example, the first control message includes a first random number. Specifically, the CP device obtains the first random number and carries the first random number in the first control message. This embodiment does not limit how the CP device obtains the first random number. In one example, the CP device generates a first random number by calculating through a random number generation algorithm. In another example, the CP device receives the first random number from another device. In another example, the CP device carries the watermark type information corresponding to the first random number in the first control message, so that the first control message includes the watermark type information corresponding to the first random number. The watermark type information corresponding to the first random number indicates that the watermark type is a random number.

[0152] In one example, when the same CP device controls multiple UP devices, the CP device generates a corresponding random number for each UP device, and sends each random number to the corresponding UP device. Optionally, the CP device generates different random numbers for different UP devices, and sends different random numbers to different UP devices. For example, the UP devices controlled by the CP device include a first UP device, and the CP device carries the first random number corresponding to the first UP device in a first control message, and sends the first control message to the first UP device. In this way, it helps the CP device to use different random numbers to verify the dial-up messages of different UP devices.

[0153] In one example, when multiple interfaces on the same UP device are connected to the CP device, the CP device generates a corresponding random number for each interface of the UP device, and sends the correspondence between the interface and the random number to the UP device. Optionally, the CP device generates different random numbers for different interfaces of the UP device. For example, the UP device is connected to the CP device through the first interface, and the CP device carries the first random number corresponding to the first interface in the first control message, and sends the first control message to the first UP device, thereby indicating to the first UP device that the first random number is carried when sending the dial-up message through the first interface. In this way, it helps the CP device to use different random numbers to verify the dial-up messages of different interfaces on the same UP device.

[0154] Case c: the content of the first control message when the timestamp is used as the watermark.

[0155] In one example, the first control message includes a first timestamp. Specifically, the CP device obtains the first timestamp corresponding to the synchronization time point according to the time synchronization mechanism between the UP device and the CP device, and carries the first timestamp in the first control message. In another example, the CP device carries the watermark type information corresponding to the first timestamp in the first control message, so that the first control message includes the watermark type information corresponding to the first timestamp. The watermark type information corresponding to the first timestamp indicates that the watermark type is a timestamp.

[0156] In another example, the first control message does not include the first timestamp itself, but includes any information that can identify the first timestamp. For example, the first control message includes a one-bit flag field, and when the flag field is set, it indicates that the UP device carries the first timestamp when sending a dial-up message to the CP device.

[0157] Case d: the content of the first control message when a message authentication code is used as a watermark.

[0158] In one example, the first control message includes the format of the message verification code. For example, the format of the message verification code is used to indicate which part of the dial-up message the UP device performs a hash operation on to obtain the first message verification code. In another example, the format of the message verification code is used to indicate the hash algorithm used to generate the first message verification code. The format of the message verification code in the first control message is represented by, for example, numbers, letters, or strings. In another example, the CP device carries the watermark type information corresponding to the first message verification code in the first control message, so that the first control message includes the watermark type information corresponding to the first message verification code. The watermark type information corresponding to the first message verification code indicates that the watermark type is a message verification code.

[0159] Taking the format of the message verification code represented by numbers as an example, the CP device and the UP device agree that different numbers represent different formats of the message verification code. For example, when the format of the message verification code is represented by 0, the UP device is instructed to obtain the first message verification code by performing a hash operation on the two types of information, the source MAC address and the destination MAC address, in the dial-up message. When the format of the message verification code is represented by 1, the UP device is instructed to obtain the first message verification code by performing a hash operation on the four types of information, the source MAC address, the destination MAC address, the source IP address, and the destination IP address, in the dial-up message. When the format of the message verification code is represented by 2, the UP device is instructed to obtain the first message verification code by performing a hash operation on the five types of information, the source MAC address, the destination MAC address, the source IP address, the destination IP address, and the UDP header, in the dial-up message.

[0160] In another example, the first control message does not include the format of the message authentication code, but includes any information that can identify the first message authentication code. For example, the CP device and the UP device negotiate the format of the message authentication code in advance, such as negotiating the format of the message authentication code during the handshake phase between the CP device and the UP device, or the CP device and the UP device preconfigure the format of the message authentication code, and the CP device uses a one-bit flag field in the first control message to instruct the UP device to carry the first message authentication code when sending a dial-up message to the CP device. When the flag field is set, it instructs the UP device to carry the first message authentication code when sending a dial-up message to the CP device.

[0161] In one example, there is an SCi interface between the CP device and the UP device, and the CP device sends a first control message to the UP device through the SCi interface. When this method is adopted, the first control message is also called an SCi message. In one example, the communication protocol for implementing the SCi interface is extended, and a new type of SCi message is added. The new type of SCi message is used to instruct the UP device to carry a watermark when sending a dial-up message to the CP device. The new type of SCi message is the first control message.

[0162] There are multiple implementation methods for extending the communication protocol of the SCi interface to implement the first control message, which are described below by taking extension method 1 and extension method 2 as examples.

[0163] Expansion method 1: Expand CUSP.

[0164] IETF RFC 8772 stipulates that CUSP is used to implement the SCi interface between the CP device and the UP device. In some embodiments of the present application, a new type of CUSP message is extended. The new type of CUSP message is used to instruct the UP device to carry a watermark when sending a dial-up message to the CP device, and the new type of CUSP message is the first control message. Specifically, the CUSP message as the first control message includes a type field. The type field in the CUSP message includes a type value. The type value identifies that the CUSP message instructs the UP device to carry a watermark when sending a dial-up message to the CP device. In an example, the type value is the type of control messages in Table 2 (table 2) in RFC 8772.

[0165] For example, see Table 1 below, which is an example of a CUSP message as the first control message. The type in Table 1 is 9, indicating that the control message is a message that requires the UP dial-up message to carry a watermark, and its corresponding control message name can be Watermark Start, which also includes the type of watermark information that is desired to be carried. For example: when its value is CRPI_WATERPRINT_VNI, it indicates that when the UP sends a dial-up message, it is desired to carry VNI watermark information; when its value is CRPI_WATERPRINT_RANDOM, it indicates that when the UP sends a dial-up message, it is desired to carry random number watermark information; when its value is CRPI_WATERPRINT_TIMESTAMP, it indicates that when the UP sends a dial-up message, it is desired to carry timestamp watermark information; when its value is CRPI_WATERPRINT_MAC, it indicates that when the UP sends a dial-up message, it is desired to carry message verification code watermark information. Optionally, the control message also includes information about specific watermark values ​​or related parameters for generating related watermarks, such as information about the VNI value, random value, timestamp value, or message verification code value included in the watermark that needs to be carried in the dial-up message sent by the UP. After the UP device receives the control message sent by the CP device, it can send the corresponding watermark information according to pre-configured or pre-agreed information, such as: sending a default VNI value, generating a random number according to a pre-agreed rule, carrying a timestamp, and sending a message verification code according to a default rule; it can also obtain the corresponding value from the control message, carry it in the dial-up message, and send it to the CP device; it can also generate a watermark based on the parameters carried by the control message, carry it in the dial-up message, and send it to the CP device.

[0166] Table 1

[0167]

[0168] In another example, a TLV may be added to the CUSP message to carry watermarks or generate parameters related to watermarks. In one example, the value of the type part of these TLVs can be used to indicate the type of watermark corresponding to this TLV, that is, the type of watermark that the UP device needs to carry. For example, the CUSP message includes a watermark TLV, and the watermark TLV is a TLV that carries a watermark; or, the watermark TLV is a TLV that carries watermark type information corresponding to the watermark; or, the watermark TLV is a TLV that carries parameters related to generating a watermark, and the type value of the watermark TLV may be, for example, 901, indicating that it is a watermark TLV.

[0169] This embodiment does not limit the type of watermark TLV. In one example, the watermark TLV is a new type of TLV, and the watermark TLV includes a newly applied type value, which identifies that the watermark TLV carries a watermark or generates parameters related to the watermark. In another example, the watermark TLV is an existing type of TLV. For example, when using the adjusted VNI as a watermark, the TLV used to carry the VNI in the VXLAN standard is reused as the watermark TLV in this embodiment. The watermark TLV includes at least one of a VNI watermark TLV, a random number watermark TLV, a timestamp watermark TLV, and a message authentication code watermark TLV. The following uses (1) to (4) to illustrate these types of watermark TLVs.

[0170] (1) VNI watermark TLV.

[0171] The VNI watermark TLV includes the first VNI. The value of the type part of the VNI watermark TLV is used to indicate that the watermark type corresponding to this TLV is VNI. For example, the VNI watermark TLV includes a VNI field, and the VNI field includes the first VNI. The VNI watermark TLV may also be referred to as CRPI_WATERPRINT_VNI (CRPI_watermark_VNI). For example, refer to Table 2 below, which is an example of the format of the VNI watermark TLV. The VNI in Table 2 is the first VNI. The VNI watermark TLV occupies, for example, 4 bytes. Among them, the VNI occupies, for example, 3 bytes in the VNI watermark TLV, for example, the 2nd byte to the 4th byte. The first byte of the VNI watermark TLV is, for example, all set to 0 for padding.

[0172] Table 2

[0173]

[0174] (2) Random number watermark TLV.

[0175] The random number watermark TLV includes a first random number. The value of the type part of the random number watermark TLV is used, for example, to indicate that the watermark type corresponding to this TLV is a random number. The random number watermark TLV may also be referred to as CRPI_WATERPRINT_RANDOM (CRPI_watermark_random number). For example, the random number watermark TLV includes a random number field, and the random number field includes a first random number. For example, see Table 3 below, which is an example of the format of the random number watermark TLV, and the random number in Table 3 is the first random number. The random number occupies 2 bytes, for example.

[0176] Table 3

[0177]

[0178] (3) Timestamp watermark TLV.

[0179] The timestamp watermark TLV includes a first timestamp. The value of the type part of the timestamp watermark TLV is used, for example, to indicate that the watermark type corresponding to this TLV is a timestamp. The timestamp watermark TLV may also be referred to as CRPI_WATERPRINT_TIMESTAMP (CRPI_watermark_timestamp). For example, the timestamp watermark TLV includes a timestamp field, and the timestamp field includes a first timestamp. For example, see Table 4 below, which is an example of the format of the timestamp watermark TLV, and the timestamp in Table 4 is the first timestamp. The timestamp, for example, occupies 1 byte.

[0180] Table 4

[0181]

[0182] (4) Message authentication code watermark TLV.

[0183] The message authentication code watermark TLV includes the format of the message authentication code. The value of the type part of the message authentication code watermark TLV is used, for example, to indicate that the watermark type corresponding to this TLV is a message authentication code. The message authentication code watermark TLV may also be referred to as CRPI_WATERPRINT_MAC (CRPI_watermark_message authentication code). For example, the message authentication code watermark TLV includes a message authentication code format field. When the message authentication code format field takes a value of 0, it indicates that the UP device obtains the first message authentication code by performing a hash operation on the source MAC address and the destination MAC address in the dial-up message. When the message authentication code format field takes a value of 1, it indicates that the UP device obtains the first message authentication code by performing a hash operation on the source MAC address, the destination MAC address, the source IP address, and the destination IP address in the dial-up message. When the message authentication code format field takes a value of 2, it indicates that the UP device obtains the first message authentication code by performing a hash operation on the source MAC address, the destination MAC address, the source IP address, the destination IP address, and the UDP header in the dial-up message. For example, see Table 5 below, which is an example of the format of the message authentication code watermark TLV. The message authentication code format in Table 5 is a message authentication code format field. The message authentication code format field occupies 1 byte in the message authentication code watermark TLV, for example.

[0184] Table 5

[0185]

[0186] Extension method 2: Extend PFCP.

[0187] For ease of understanding, the following first briefly introduces PFCP, and then introduces how to extend PFCP to implement the first control message.

[0188] PFCP is a protocol defined by the 3rd Generation Partnership Project (3GPP) and carried on UDP. PFCP defines an abstract UP model based on the 5th generation mobile networks (5th generation wireless systems, 5th-Generation, 5G) service. Based on this model, node messages, session messages and a series of information elements (IE) between CP and UP are defined. PFCP refers to UP devices as UPFs, CP devices as CPFs, and the connection between CP devices and UP devices as PFCP associations. PFCP messages are divided into PFCP node-related messages and PFCP session-related messages. PFCP messages include two parts: PFCP message header and IE. The PFCP message header includes fields such as message type and message length. IE uses the TLV encapsulation format. IE is divided into grouped IE and embedded IE. Embedded IE is the smallest unit of IE. A packet IE may optionally contain multiple embedded IEs. BBF TR-459 stipulates that the SCi interface between the CP device and the UP device is implemented using PFCP.

[0189] In one example, the CP device uses an IE in a PFCP message to carry a watermark or generate watermark-related parameters. For example, the PFCP message as the first control message includes a watermark IE, and the watermark IE is an IE that carries a watermark; or, the watermark IE is an IE that carries watermark type information corresponding to the watermark; or, the watermark IE is an IE that carries parameters related to generating a watermark. The watermark type information carried by the watermark IE is, for example, the value of the type part in the watermark IE. For example, the value of the type part of the VNI watermark IE is used to indicate that the watermark type corresponding to this IE is VNI. For example, the value of the type part of the random number watermark IE is used to indicate that the watermark type corresponding to this IE is a random number. For example, the value of the type part of the timestamp watermark IE is used to indicate that the watermark type corresponding to this IE is a timestamp. For example, the value of the type part of the message authentication code watermark IE is used to indicate that the watermark type corresponding to this IE is a message authentication code. In one example, the watermark IE is a packet IE. In another example, the watermark IE is an embedded IE. For example, see Table 6 below, which is an introduction to the watermark IE.

[0190] Table 6

[0191] IE P Conditions / Comments IE Type Watermark IE C This IE contains a watermark when the CP is attacked by DDoS. Watermark

[0192] Among them, C in Table 6 represents conditional, indicating that the watermark IE is carried when a condition is met, and the condition is that the CP device may be attacked by DDoS. In this embodiment, when the CP device detects that the reception rate of the dial-up message is abnormal, it will determine that the condition for carrying the watermark IE is met.

[0193] Please refer to Table 7 below, which is an example of the format of the watermark IE. In Table 7, the type field includes the type of the watermark IE. The type field occupies 2 bytes. The type value in the type field is, for example, a decimal value. The length field includes the length of the watermark IE. The length in the length field does not include, for example, the 4 bytes of the type field and the length field. The enterprise ID field includes the enterprise number. The enterprise ID field is an optional field of the watermark IE. The watermark type field and the watermark parameter field belong to the data part of the watermark IE or the sub-IE of the watermark IE.

[0194] Table 7

[0195]

[0196] The definition of the type field in Table 7 is shown in Table 8 below. In Table 8, 7 / 1 represents the first bit of a byte (type field); 7 / 2 represents the second bit of a byte (type field); 7 / 3 represents the third bit of a byte (type field); 7 / 4 represents the fourth bit of a byte (type field); 7 / 5 represents the fifth bit of a byte (type field). The definitions of the four watermark parameters, watermark parameter 0 to watermark parameter 3, are the same or similar to the definitions of the four types of watermark TLVs, namely, VNI watermark TLV, random number watermark TLV, timestamp watermark TLV, and message authentication code watermark TLV, described in extension mode 1.

[0197] Table 8

[0198]

[0199] There are many ways to use PFCP messages to carry watermark IE. In one example, a PFCP node message is used to carry the watermark IE. In other words, the first control message is a PFCP node message. In another example, a PFCP session message is used to carry the watermark IE. In other words, the first control message is a PFCP session message.

[0200] In one example, a new type of PFCP message is extended, and a new type of PFCP message is used to carry a watermark IE. The new type of PFCP message is used to instruct the UP device to carry a watermark when sending a dial-up message to the CP device, and the new type of PFCP message is the first control message provided in this embodiment. Among them, the PFCP message as the first control message includes a type field. The type field in the PFCP message includes a type value. The type value identifies that the PFCP message instructs the UP device to carry a watermark when sending a dial-up message to the CP device.

[0201] In which, in the case of implementing the first control message by extending a new type of PFCP message, this embodiment does not limit whether the PFCP node message is extended or the PFCP session message is extended. For example, a new type of PFCP node message is added, such as a new type value is applied between 16 and 49, and the watermark IE is carried by this new type of PFCP node message, and the CP device implements the function of sending the watermark by sending this new type of PFCP node message to the UP device. For another example, a new type of PFCP session message is added, such as a new type value is applied between 58 and 99, and the watermark IE is carried by this new type of PFCP session message, and the CP device implements the function of sending the watermark by sending this new type of PFCP session message to the UP device.

[0202] In another example, an existing PFCP message carrying a watermark IE is reused. The existing PFCP message carrying a watermark IE can instruct the UP device to carry a watermark when sending a dial-up message to the CP device. The existing PFCP message is also the first control message provided in this embodiment. For example, a PFCP session update request (PFCP Session ModificationRequest) is reused to carry a watermark IE. The PFCP session update request carrying the watermark IE is the first control message provided in this embodiment. Among them, the PFCP session update request is a PFCP session message, and the message type value of the PFCP session update request is 52. For example, in the PFCP session update request, the IE shown in Table 9 below is added to the Update Forwarding Parameters IE.

[0203] Table 9

[0204]

[0205] Wherein, P in Table 9 represents Preferance. C in Table 9 represents Conditional, indicating that the watermark IE is carried when a condition is met, and the condition is that the CP is attacked by DDoS. In this embodiment, when the CP detects that the reception rate of the dial-up message is abnormal, it will determine that the condition for carrying the watermark IE is met.

[0206] S305: The UP device receives a first control message from the CP device, where the first control message is used to instruct the UP device to carry a watermark when sending a dial-up message to the CP device.

[0207] S307. The UP device adds a watermark to the dial-up message according to the first control message.

[0208] The dial-up message sent by the UP device includes, for example, an original dial-up message and a watermark. In one example, the original dial-up message is sent by a user device. In another example, the original dial-up message may also be sent by an access device connected to the user device. The original dial-up message is transmitted to the UP device. When the UP device receives the original dial-up message, it obtains the watermark according to the first control message sent by the CP device. The UP device encapsulates the obtained watermark with the original dial-up message to obtain a dial-up message including the watermark, thereby carrying the watermark in the dial-up message, so that the watermark is added to the dial-up message sent by the UP device.

[0209] The following focuses on the method in which the user device sends the original dial-up message to introduce the relevant contents of the dial-up message sent by the UP device.

[0210] The dialing method includes but is not limited to PPPoE dialing or DHCP dialing. In the case of PPPoE dialing, the original dialing message sent by the user equipment is a PPPoE dialing message. In the case of DHCP dialing, the original dialing message sent by the user equipment is a DHCP dialing message.

[0211] The PPPoE dial-up message is, for example, a PADI message. See Table 10 below, which is an example of the PADI message format.

[0212] Table 10

[0213]

[0214] The meaning of each field in the PADI message shown in Table 10 is shown in Table 11 below.

[0215] Table 11

[0216]

[0217] See Table 12 below, which is an example of the DHCP dial-up message format. The numbers in brackets in Table 12 represent the length of the field, for example, message type (1) indicates that the length of the message type field is 1 byte, and transaction ID (4) indicates that the length of the transaction ID field is 4 bytes.

[0218] Table 12

[0219]

[0220]

[0221] The meaning of each field in the DHCP dial-up message shown in Table 12 above is shown in Table 13 below.

[0222] Table 13

[0223]

[0224]

[0225] The first message of the DHCP dial-up message is the DHCP discover message. Specifically, during the DFCP dial-up process, when the DHCP client requests an address, it does not know the location of the DHCP server, so the DHCP client will broadcast a request message in the local network. This message is called a DHCP discover message. The DHCP discover message is used to discover DHCP servers in the network. All DHCP servers that receive the DHCP discover message will send a response message, so that the DHCP client can know the location of the DHCP servers in the network. See Table 14 below, which is an example of the format of the DHCP discover message. The meaning of each field in the DHCP dial-up message shown in Table 14 is shown in Table 13 above.

[0226] Table 14

[0227]

[0228]

[0229] The above is an example of the format of the dial-up message. The following describes how the UP device adds a watermark to the dial-up message.

[0230] For example, when watermark type a is used, the UP device obtains the first VNI from the first control message; or, the UP device obtains the pre-agreed first VNI, or, the UP device generates the first VNI according to the parameters carried in the first control message. After the UP device obtains the first VNI in any of the three ways, the UP device carries the first VNI in the dial-up message, so that the VNI in the dial-up message sent by the UP device changes from the original VNI to the adjusted VNI.

[0231] For example, when watermark type b is used, the UP device obtains the first random number from the first control message; or, the UP device obtains the pre-agreed first random number, or, the UP device generates the first random number according to the parameters carried in the first control message. After the UP device obtains the first random number in any of the three ways, the UP device carries the first random number in the dial-up message, so that the dial-up message sent by the UP device adds the random number sent by the CP device.

[0232] For example, when watermark type c is used, the UP device determines a first timestamp based on the time synchronization mechanism between the UP device and the CP device, and the first timestamp is used to indicate the time point of synchronization between the UP device and the CP device. The UP device carries the first timestamp in the dial-up message, so that the dial-up message sent by the UP device adds a timestamp corresponding to the synchronization time point. Optionally, the accuracy of the first timestamp is in seconds. For example, the time point of synchronization between the UP device and the CP device is 17:43:05 on July 20, 2020, and the first timestamp is 20200720174305.

[0233] Alternatively, the UP device generates a first timestamp and carries the generated first timestamp in the dial-up message. In one example, the first control message carries a timestamp format, and the UP device generates the first timestamp according to the timestamp format. In this way, the CP device and the UP device agree on the timestamp format by transmitting the first control message, thereby adding a watermark according to the pre-agreed timestamp format. The timestamp format is, for example, the precision of the timestamp, the number of digits of the timestamp, etc.

[0234] This embodiment does not limit whether the first timestamp is a complete timestamp. Optionally, the first timestamp is a part of a complete timestamp. For example, the first timestamp is the hour, minute, and second in a complete timestamp. For example, a complete timestamp is 20200720174305, and the first timestamp is 170510.

[0235] For example, when watermark type d is used, the UP device performs a hash operation on at least one parameter in the dial-up message to obtain a first message authentication code; the UP device carries the first message authentication code in the dial-up message, so that the message authentication code is added to the dial-up message sent by the UP device. Specifically, the UP device obtains the format of the message authentication code according to the first control message; or, the UP device obtains a pre-agreed format of the message authentication code. After the UP device determines the format of the message authentication code in either of these two ways, it performs a hash operation on at least one parameter in the dial-up message according to the format of the message authentication code. For example, if the format of the message authentication code in the first control message is 1, which means that the format of the message authentication code is the hash value of the source MAC address and the destination MAC address in the dial-up message, then the UP device performs a hash operation on the two types of information, the source MAC address and the destination MAC address in the dial-up message, and uses the obtained hash value as the first message authentication code.

[0236] S308: The UP device sends a dial-up message including a watermark to the CP device.

[0237] There are multiple ways for the UP device to send the dial-up message. In one example, a UDP-based tunnel is established between the UP device and the CP device, and the UP device sends the dial-up message including the watermark through the UDP-based tunnel. The dial-up message including the watermark is a UDP message.

[0238] For example, see Appendix Figure 6 , attached Figure 6 (a) in Figure 1 is an example of the network architecture formed by the UP device, CP device and attacker. Figure 6 (b) in Figure 1 is an example of the format of the dial-up message sent by the UP device when the watermark function is disabled. Figure 6 (c) in the figure is an example of the format of the dial-up message sent by the attacker. Figure 6 (d) in FIG. 1 is an example of the format of the dial-up message sent by the UP device when the watermark function is turned on. Specifically, when the watermark function is turned off, the UP device will encapsulate the UDP-based tunnel header based on the original dial-up message sent by the user device, and then send the dial-up message including the UDP-based tunnel header. Therefore, as shown in the attached figure, Figure 6 As shown in (b) in the figure, the dial-up message sent by the UP device includes two parts, namely the UDP-based tunnel header and the original dial-up message sent by the user device. After the attacker captures the dial-up message sent by the UP device to the CP device, the attacker jumps the MAC address or VLAN number in the dial-up message to obtain the jumped dial-up message. The attacker also sends the jumped dial-up message through the UDP-based tunnel. Therefore, as shown in the attached figure Figure 6 As shown in (c) in the figure, the dial-up message sent by the attacker includes two parts, namely, a UDP-based tunnel header and a hop dial-up message. After the attacker initiates a replay attack by sending a hop dial-up message, the CP device finds that the rate of the dial-up message exceeds the rate threshold for a certain period of time, and then sends a control message to the UP device to instruct the UP device to add a watermark. After receiving the control message, the UP device turns on the watermark function. The UP device encapsulates the UDP-based tunnel header and watermark based on the original dial-up message sent by the user device, and then sends the dial-up message including the UDP-based tunnel header and watermark. Therefore, as shown in the attached figure Figure 6 As shown in (d) in FIG. 5 , the dial-up message sent by the UP device includes three parts, namely, a UDP-based tunnel header, a watermark field, and the original dial-up message sent by the user device.

[0239] This embodiment does not limit the carrying position of the watermark field in the dial-up message. Figure 6 In (d), the watermark field is carried between the UDP-based tunnel header and the original dial-up message sent by the user device. For example, when watermark type b is used, the attached Figure 6The watermark field shown in (d) is specifically a random number field, and the random number field carries a first random number. For another example, when watermark type c is used, the attached Figure 6 The watermark field shown in (d) in FIG. 1 is specifically a timestamp field, and the timestamp field carries a first timestamp. For another example, in the case of using watermark type d, the attached Figure 6 The watermark field shown in (d) is specifically a message authentication code field, and the message authentication code field carries a first message authentication code. In another example, the watermark field is carried in a UDP-based tunnel header. For example, in the case of using watermark type a, the UDP-based tunnel header includes a VXLAN header, and the watermark field is specifically a VNI field, and the VNI field carries a first VNI. The VNI field including the first VNI is, for example, located in the VXLAN header.

[0240] In one example, there is a CPRi interface between the CP device and the UP device, and the CP device sends a dial-up message including a watermark to the UP device through the CPRi interface. When this method is adopted, the dial-up message including the watermark is also called a CPRi message or a CPRi message. The specific implementation methods of the CPRi interface include but are not limited to the VXLAN GPE method and the GTP-C method. When the CPRi interface is implemented in different ways, the location of the watermark in the dial-up message sent by the UP device is different. The following uses case A to illustrate how the UP device carries the watermark in the dial-up message sent when the VXLAN GPE method is adopted, and uses case B to illustrate how the UP device carries the watermark in the dial-up message sent when the GTP-C method is adopted.

[0241] Case A: The CPRi interface is implemented using VXLAN GPE.

[0242] When VXLAN GPE is used to implement the CPRi interface, Figure 6 The UDP-based tunnel header shown is specifically a VXLAN GPE header, and the dial-up message including the watermark sent by the UP device is specifically a VXLAN GPE message. Figure 7 , attached Figure 7 This is an example of two encapsulation formats of dial-up message-VXLAN GPE message including watermark. Figure 7 As shown in (a) in FIG. 1 , a dial-up message including a watermark includes three parts, namely a VXLAN GPE header, a watermark field, and an original dial-up message sent by a user device. The watermark field is located between the VXLAN GPE header and the original dial-up message sent by the user device. Figure 7As shown in (b), the dial-up message including the watermark includes two parts, namely the VXLAN GPE header and the original dial-up message sent by the user equipment, and the watermark field is located in the VXLAN GPE header.

[0243] As attached Figure 7 As shown, the VXLAN GPE header includes a destination MAC address (DA) field, a source MAC address (SA) field, a destination IP (DIP) field, a source IP (SIP) field, a UDP header (UDP Header), a VXLAN header (VXLAN Header), and a GPE extension header.

[0244] For example, the format of the VXLAN header is shown in Table 15 below. The VXLAN header includes a VNI field, a reserved (R) field, and an I field. Among them, the I field is, for example, an instance bit (I bit, I field or I flag for short), and the I field is used to identify whether the VNI is valid. When the I field value is 1, the VNI is valid; when the I field value is 0, the VNI is invalid. The reserved field includes one or more reserved bits. The VNI field includes the VNI. In this embodiment, the VNI field includes the first VNI.

[0245] Table 15

[0246]

[0247] In one example, referring to Table 16 below, the VXLAN header in the VXLAN GPE header also includes a Next Protocol field. When applied to a BNG system with separated CP and UP, the value of the Next Protocol field is, for example, 0x7. In one example, as shown in Table 16, the VXLAN header in the VXLAN GPE header also includes a version (Ver) field. The Ver field indicates the version of the VXLAN GPE, and the initial value is 0; the VXLAN header in the VXLAN GPE header also includes an instance bit (I bit or I field or I flag for short). When the I bit carries 1, it indicates that the VNI included in the VXLAN header is a valid VNI. The VXLAN header in the VXLAN GPE header also includes a Next Protocol Bit (P bit or next protocol flag for short). The P bit is used to indicate that the value of the Next Protocol field is valid. The VXLAN header in the VXLAN GPE header also includes a broadcast & unknown-unicast & multicast traffic bit (BUM trafficBit, referred to as B bit or B field or B flag), which is used to identify that the message is a broadcast message or an unknown unicast message or a multicast message (broadcast & unknown-unicast & multicast, BUM) message. The VXLAN header in the VXLAN GPE header also includes an operation administration and maintenance flag bit (OAMflag bit, referred to as O bit or O field or O flag), which is used to identify that the message is an OAM message.

[0248] Table 16

[0249]

[0250] The format of the GPE extension header is shown in Table 17 below. The GPE extension header includes a P field, a Class field, and a Port Info field. The P field is used to indicate the type of dialing, such as DHCP dialing or PPPoE dialing. The Type field is used to indicate the specific type of the original dialing message. For example, the Type field indicates that the original dialing message is a PADI message. For example, the Type field indicates that the original dialing message is a DHCP discovery message. The Port Info field indicates the interface information to which the user device is connected on the UP device.

[0251] Table 17

[0252]

[0253] The above generally introduces the format of the VXLAN GPE message including the watermark sent by the UP device. The following uses examples to illustrate the format of the VXLAN GPE message in combination with specific watermark types from watermark type a to watermark type d.

[0254] For example, when watermark type a is used, the VXLAN GPE message sent by the UP device includes the adjusted VNI (first VNI). Figure 7 In (b), the first VNI is located at the adjacent Figure 7 In the VXLAN header in (b). For example, referring to Table 15, the first VNI is located in the VXLAN header shown in Table 15, such as in the VNI field in Table 15; for another example, referring to Table 16, the first VNI is located in the VXLAN header shown in Table 16, such as in the VNI field in Table 16.

[0255] For example, when watermark type b is used, the VXLAN GPE message sent by the UP device includes a random number (first random number) generated by the CP device. Figure 8 , attached Figure 8 This is an example of a VXLAN GPE message including a first random number. The first random number is located, for example, in the Figure 8 In the random number field in . Figure 8 Please refer to the above description for the meaning of each field.

[0256] For example, when watermark type c is used, the VXLAN GPE message sent by the UP device includes a timestamp (first timestamp) of the synchronization time point between the UP device and the CP device. Fig. 9 , attached Fig. 9 This is an example of a VXLAN GPE message including a first timestamp. The first timestamp is, for example, located at the Fig. 9 The timestamp field in the . Fig. 9 Please refer to the above description for the meaning of each field.

[0257] For example, when watermark type d is used, the VXLAN GPE message sent by the UP device includes a message authentication code (first message authentication code) obtained by performing a hash operation on the parameters in the dial-up message. Fig.10 , attached Fig.10 This is an example of a VXLAN GPE message including a first message authentication code. The first message authentication code is located, for example, in the attached Fig.10 The message authentication code field in the . Fig.10 Please refer to the above description for the meaning of each field.

[0258] Case B: The CPRi interface is implemented using GTP-C.

[0259] When the CPRi interface is implemented in GTP-C mode, the dial-up message including the watermark sent by the UP device is specifically a GTP-C message. Figure 6 The UDP-based tunnel header shown in (d) specifically includes a GTP-C header and an NSH header. Figure 7 , Attachment Figure 8 , Attachment Fig. 9 And attached Fig.10 The VXLAN GPE headers in the four dial-up messages including watermarks are replaced by GTP-C headers and NSH headers. In one example, a field in the GTP-C header or a field in the NSH header is used to carry the watermark.

[0260] S309: The CP device identifies attack messages in the message stream according to the watermark.

[0261] A message stream refers to a series of messages received by the CP device after sending the first control message. For example, the message stream includes messages received by the CP device through the CPRi interface. For a message in the message stream, the CP device verifies the message according to the watermark to identify whether the message is an attack message sent by an attacker or a normal message sent by a UP device.

[0262] There are multiple implementations for how the CP device identifies attack messages. In one example, the attack message sent by the attacker does not carry a watermark. In this case, the CP device determines that the message is an attack message based on the fact that the message does not include a watermark. Take the process of identifying the fifth message as an example. For example, the message stream includes the fifth message, and the CP device determines that the fifth message is an attack message based on the fact that the fifth message does not include a watermark. In another example, the attack message sent by the attacker carries a watermark but the watermark is incorrect. In this case, the CP device determines that the message is an attack message based on the fact that the watermark carried by the message is not the watermark that the CP device previously sent to the UP device. Below, in combination with the four specific watermark types described above, the specific implementation methods of the CP device identifying attack messages are illustrated through identification methods A to D.

[0263] Identification method A: The CP device uses the VNI to identify attack packets.

[0264] Taking the application of identification method A in identifying the first message as an example, the first message refers to a message in the message stream received by the CP device after sending the first VNI. If the first message does not include the first VNI previously sent by the CP device to the UP device, this indicates that the first message is not a message from the UP device, so the CP device fails to verify the first message, and the CP device determines that the first message is an attack message. In one example, after the CP device adjusts the original VNI to the first VNI, it saves the first VNI in the local table entry; when the CP device receives the first message, it reads the first VNI from the local table entry, thereby using the pre-saved first VNI to identify the attack message.

[0265] In the following situations A-1 and A-2, the CP device can use identification method A to find that the received message is an attack message sent by the attacker.

[0266] Case A-1: ​​The packet sent by the attacker does not have a VNI.

[0267] For example, the first message does not include the VNI, and the CP device determines that the first message is an attack message based on the fact that the first message does not include the VNI.

[0268] Case A-2: The message sent by the attacker contains a VNI, but the VNI is incorrect.

[0269] For example, the CP device obtains the second VNI from the first message; the CP device determines whether the second VNI is the same as the first VNI; if the second VNI is different from the first VNI, the CP device determines that the first message is an attack message. The second VNI refers to the VNI carried by the first message. For example, the first message is also sent based on the VXLAN tunnel, and the second VNI is the VNI in the VXLAN header of the first message.

[0270] CP devices and UP devices can achieve the following two effects by using identification method A to defend against network attacks.

[0271] On the one hand, since it is difficult for an attacker to know the adjusted VNI (i.e., the first VNI) sent by the CP device to the UP device, it is impossible to construct an attack message containing the adjusted VNI. Therefore, the CP device can distinguish whether the message is an attack message sent by the attacker or a normal message sent by the UP device based on whether the message contains the adjusted VNI, thereby effectively defending against the attacker's network attack.

[0272] On the other hand, when using VNI to implement the function of defending against network attacks, it is possible to reuse many processes involved in the communication between the CP device and the UP device based on VXLAN. For example, the step of the CP device determining the attack message according to the first VNI can be implemented by reusing the process of verifying the VNI in the received VXLAN message in VXLAN, and the step of the UP device carrying the first VNI in the message can be implemented by reusing the process of carrying the VNI in the sent VXLAN message in VXLAN. Since the CP device and the UP device can reuse the existing processing logic to implement the defense capability against network attacks, the computing performance overhead added by the CP device for the addition of the defense capability is saved, and the forwarding performance overhead added by the UP device for the addition of the defense capability is also saved. Therefore, this solution for implementing defense against network attacks has low overhead and high practicality.

[0273] This embodiment does not limit how to identify normal messages when using identification method A. In one example, if the first message includes the first VNI previously sent by the CP device to the UP device, the first message is verified and the CP device determines that the first message is a non-attack message (e.g., a normal message). In another example, when the CP device uses not only the VNI but also other features other than the VNI to identify the message, if the first message includes the first VNI previously sent by the CP device to the UP device and the other features of the first message meet normal conditions, the CP device determines that the first message is a normal message.

[0274] Identification method B: CP devices use random numbers to identify attack messages.

[0275] Taking the application of identification method B in identifying the second message as an example, the second message refers to a message in the message stream received by the CP device after sending the first random number. If the second message does not include the first random number previously sent by the CP device to the UP device, this indicates that the second message is not a message from the UP device, so the CP device fails to verify the second message, and the CP device determines that the second message is an attack message. In one example, after the CP device generates the first random number, it saves the first random number in a local table entry; when the CP device receives the second message, it reads the first random number from the local table entry, thereby using the pre-saved first random number to identify the attack message.

[0276] In the following cases B-1 and B-2, the CP device can use identification method B to find that the received message is an attack message sent by the attacker.

[0277] Case B-1: The message sent by the attacker does not contain a random number.

[0278] For example, the second message does not include a random number, and the CP device determines that the second message is an attack message based on the fact that the second message does not include a random number.

[0279] Case B-2: The message sent by the attacker contains a random number but the random number is incorrect.

[0280] For example, the CP device obtains a second random number from the second message; the CP device determines whether the second random number is the same as the first random number; if the second random number is different from the first random number, the CP device determines that the second message is an attack message. The second random number refers to the random number carried by the second message.

[0281] This embodiment does not limit how to identify normal messages when using identification method B. In one example, if the second message includes the first random number previously sent by the CP device to the UP device, the second message is verified and the CP device determines that the second message is a non-attack message (e.g., a normal message). In another example, when the CP device uses not only random numbers but also other features other than random numbers to identify messages, if the second message includes the first random number previously sent by the CP device to the UP device and other features of the second message meet normal conditions, the CP device determines that the second message is a normal message.

[0282] Identification method C: CP devices use timestamps to identify attack messages.

[0283] Taking the application of identification mode C in identifying the third message as an example, the third message refers to a message in the message stream received by the CP device after sending the first control message. If the third message does not include the first timestamp corresponding to the time point of synchronization between the CP device and the UP device, this indicates that the third message is not a message from the UP device, so the CP device fails to verify the third message, and the CP device determines that the third message is an attack message.

[0284] There are multiple ways for the CP device to obtain the first timestamp. For example, since the time between the CP device and the UP device is synchronized, when the CP device receives the third message, it reads the timestamp corresponding to the local time point as the first timestamp. Alternatively, when the CP device receives the third message, it uses an algorithm to compensate the timestamp corresponding to the local time point, and uses the compensated timestamp as the first timestamp.

[0285] In the following cases C-1 and C-2, the CP device can use identification method C to find that the received message is an attack message sent by the attacker.

[0286] Case C-1: The message sent by the attacker has no timestamp.

[0287] For example, the third message does not include a timestamp, and the CP device determines that the third message is an attack message based on the fact that the third message does not include a timestamp.

[0288] Case C-2: The message sent by the attacker contains a timestamp but the timestamp is incorrect.

[0289] For example, the CP device obtains a second timestamp from the third message; the CP device compares the second timestamp with the first timestamp; if the time difference between the second timestamp and the first timestamp is greater than the time difference threshold, the CP device determines that the third message is an attack message. The second timestamp refers to the timestamp carried by the third message.

[0290] This embodiment does not limit how to identify normal messages when using identification method C. In one example, if the third message includes the first timestamp, the third message is verified and the CP device determines that the third message is a non-attack message (e.g., a normal message). In another example, if the time difference between the second timestamp and the first timestamp included in the third message is less than the time difference threshold, for example, the time difference between the second timestamp and the first time difference is within the range of plus or minus 1 second, the CP device determines that the third message is a normal message. In another example, when the CP device uses not only the timestamp but also other features other than the timestamp to identify the message, if the third message includes the first timestamp and other features of the third message meet normal conditions, the CP device determines that the third message is a normal message.

[0291] Identification method D: The CP device uses the message authentication code to identify the attack message.

[0292] Taking the application of identification method D in identifying the fourth message as an example, the fourth message refers to a message in the message stream received by the CP device after sending the first control message. If the fourth message does not include the first message authentication code, this indicates that the fourth message is not a message from the UP device, so the CP device fails to verify the fourth message, and the CP device determines that the fourth message is an attack message. For example, after the CP device sends the format of the message authentication code through the first control message, it saves the format of the message authentication code in the local table entry; when the CP device receives the fourth message, it reads the format of the message authentication code from the local table entry, and performs a hash operation on at least one parameter in the dial-up message according to the pre-saved format of the message authentication code to obtain the first message authentication code.

[0293] In the following situations D-1 and D-2, the CP device can use identification method D to find that the received message is an attack message sent by the attacker.

[0294] Case D-1: The message sent by the attacker does not have a message authentication code.

[0295] For example, the fourth message does not include a message authentication code, and the CP device determines that the fourth message is an attack message based on the fact that the fourth message does not include a message authentication code.

[0296] Case D-2: The message sent by the attacker contains a message authentication code, but the message authentication code is incorrect.

[0297] For example, the CP device obtains a second message authentication code from the fourth message; the CP device determines whether the second message authentication code is the same as the first message authentication code; if the second message authentication code is different from the first message authentication code, the CP device determines that the fourth message is an attack message. The second message authentication code refers to the message authentication code carried by the fourth message.

[0298] This embodiment does not limit how to identify normal messages when using identification method D. In one example, if the fourth message includes the first message authentication code, the fourth message is verified to be passed, and the CP device determines that the fourth message is a non-attack message (e.g., a normal message). In another example, when the CP device uses not only the message authentication code but also other features other than the message authentication code to identify the message, if the fourth message includes the first message authentication code and other features of the fourth message meet normal conditions, the CP device determines that the fourth message is a normal message.

[0299] Identification methods a to d can be combined in any manner. In one example, only one type of watermark defense attack from identification methods a to d is used; in another example, two or more types of watermark defense attacks from identification methods a to d are used simultaneously. Taking the combination of identification methods a and b as an example, the CP device generates and sends a first control message, and the first control message is used to instruct the UP device to carry the first VNI and the first random number when sending a dial-up message to the CP device; the UP device carries the first VNI and the first random number in the dial-up message according to the first control message; the UP device sends a dial-up message including the first VNI and the first random number to the CP device. When the CP device receives the first message, it determines that the first message is an attack message based on the fact that the first message does not include the first VNI or the first random number. The CP device determines that the first message is a normal message based on the fact that the first message includes the first VNI and the first random number.

[0300] In one example, the CP device also determines whether the attack message is sent from the UP device based on the watermark. If the attack message is sent from the UP device, the CP device limits the speed of the user-side interface on the UP device. Among them, the user-side interface refers to the interface connected to the access network or the aggregation network. The user-side interface is the interface used by the UP device when receiving the original dial-up message from the user device. For example, the CP device sends a third control message to the UP device, and the third control message is used to instruct the UP device to limit the speed of the user-side interface. In response to the third control message, the UP device limits the speed of the original dial-up message received through the user-side interface. In this way, in scenarios such as home terminal poisoning, by limiting the speed of the user-side interface of the UP device, the problem of the home terminal frantically dialing the UP device can be solved.

[0301] S310: The CP device discards the attack message.

[0302] The CP device distinguishes attack packets from normal packets based on watermarks and discards attack packets. This saves the computing resources of the CP device by eliminating the need for dial-up processing such as response dial-up and authentication for attack packets. In addition, the CP device can perform dial-up processing for normal packets to ensure that normal users can go online, as normal packets are not randomly discarded by the token bucket.

[0303] In one example, the CP device links with a designated UP device to defend against attacks through watermarks. For example, the CP device measures the speed of the dial-up message of each source IP address respectively to obtain the receiving rate corresponding to the dial-up message of each source IP address. If the receiving rate of the dial-up message of the first source IP address meets the abnormal condition, the CP device determines the first UP device with the first source IP address in at least one UP device associated with the CP device, and sends a first control message to the first UP device. Afterwards, the first UP device carries a watermark in the dial-up message. Based on the watermark, the CP device identifies the attack message in the message stream whose IP address is the first source IP address. In this way, since the attacker often impersonates the identity of the UP device when launching an attack, that is, the attacker uses the same source IP address as a certain UP device to send a message, if the receiving rate of the dial-up message of the first source IP address meets the abnormal condition, it indicates that the dial-up message of the first source IP address is likely to be impersonated by the attacker. Therefore, the CP device defends against the attack by linking with the designated first UP device. Compared with the method of requiring all UP devices in the system to carry watermarks when sending dial-up messages and the CP device to use watermark verification on all received message streams, the defense function of network attacks is more accurate and the overhead is lower.

[0304] S311: In response to the reception rate of the dial-up message meeting a normal condition, the CP device generates a second control message, where the second control message is used to instruct the UP device to cancel the watermark when sending the dial-up message to the CP device.

[0305] If the receiving rate of the dial-up message meets the normal conditions, the CP device will determine that the network attack has stopped. The CP device will generate and send a second control message to instruct the UP device to cancel the watermark when sending the dial-up message, thereby turning off the function of defending against attacks through watermarks, thereby reducing network overhead and device pressure.

[0306] For example, the CP device measures the reception rate of the dial-up message. If the duration that the reception rate exceeds the rate threshold is less than the preset duration, or the duration that the reception rate is less than the rate threshold is greater than the preset duration, or the reception rate of the dial-up message is lower than the rate threshold, the CP device determines that the reception rate meets the normal condition.

[0307] In one example, CUSP is extended to implement a second control message. Specifically, a new type of CUSP message is extended. The new type of CUSP message is used to instruct the UP device to cancel the watermark when sending a dial-up message to the CP device, and the new type of CUSP message is the second control message. Specifically, the CUSP message as the second control message includes a type field. The type field in the CUSP message includes a type value. The type value identifies that the CUSP message instructs the UP device to cancel the watermark when sending a dial-up message to the CP device. In one example, the type value is the type of control message (controlmessages) in Table 2 in RFC 8772. For example, see Table 18 below, which is an example of a CUSP message as a second control message. The watermark end (waterprint_End) in Table 18 is an example of the type name of the CUSP message as the second control message. 10 in Table 18 is an example of the type value of the CUSP message as the second control message.

[0308] Table 18

[0309] Type Name Notes 10 End of watermark Stop watermarking

[0310] In one example, the PFCP is extended to implement the second control message. For example, the PFCP message as the second control message includes a watermark IE. For the format of the watermark IE, please refer to the introduction of Table 6, Table 7 and Table 8 above. In one example, the second control message is a PFCP node message. In one example, the second control message is a PFCP session message.

[0311] S312: The CP device sends a second control message to the UP device.

[0312] S313: The UP device receives a second control message from the CP device.

[0313] S315. The UP device sends a dial-up message without a watermark to the CP device according to the second control message.

[0314] The dial-up message sent by the UP device in S315, for example, includes the original dial-up message but does not include the watermark. In one example, the original dial-up message is sent by the user device, and in another example, the original dial-up message may also be sent by an access device connected to the user device. The original dial-up message will be transmitted to the UP device. Since the second control message indicates that the UP device cancels the watermark when sending the dial-up message to the CP device, when the UP device receives the original dial-up message, it will cancel the watermark in the dial-up message according to the second control message sent by the CP device, so that the dial-up message sent by the UP device no longer includes the watermark.

[0315] In the method provided in this embodiment, the CP device sends a control message to the UP device when the reception rate of the dial-up message is found to be abnormal, thereby notifying the UP device through the control message to carry the watermark when sending the dial-up message. Since the dial-up message sent by the UP device includes the watermark, and the attack message sent by the attacker does not include the watermark, the CP device can effectively identify the attack message in the received message stream according to the watermark, so that the attack message can be discarded by the CP device, thereby effectively resisting network attacks, reducing the risk of the CP device being attacked by the network, and improving the security of the CP device and the communication system.

[0316] The above method 300 exemplifies the interaction process between the CP device and the UP device. The following describes the CP device and the UP device of the embodiment of the present application. The CP device and the UP device described below respectively have any functions of the CP device and the UP device in the above method 300.

[0317] Attached Fig.11 FIG. 1 shows a possible structural diagram of the CP device involved in the above embodiment. Fig.11 The CP device 400 shown implements the function of the CP device in the method 300 , for example.

[0318] Please refer to the attached Fig.11 , the CP device 400 includes a processing unit 401 and a sending unit 402. Each unit in the CP device 400 is implemented in whole or in part by software, hardware, firmware or any combination thereof. Each unit in the CP device 400 is used to perform the corresponding function of the CP device in the above method 300. Specifically, the processing unit 401 is used to support the CP device 400 to execute S303, S309 and S310. The sending unit 402 is used to support the CP device 400 to execute S304.

[0319] In one example, the processing unit 401 and the sending unit 402 are also used to support the CP device 400 to perform other processes performed by the CP device in the technology described herein. For example, the processing unit 401 is also used to support the CP device 400 to perform S311. The sending unit 402 is also used to support the CP device 400 to perform S312. For the specific execution process, please refer to the detailed description of the corresponding steps in the method 300, which will not be repeated here.

[0320] The division of units in the embodiments of the present application is schematic and is merely a logical function division. In actual implementation, other division methods may be optional.

[0321] For example, in another example, each unit in the CP device 400 is integrated into a processing unit. For example, each unit in the CP device 400 is integrated on the same chip. The chip includes a processing circuit and an input interface and an output interface that are connected and communicated with the internal part of the processing circuit. The processing unit 401 is implemented by the processing circuit in the chip. The sending unit 402 is implemented by the output interface in the chip. For example, the chip is implemented by one or more field programmable gate arrays (field-programmable gate array, English abbreviation: FPGA), programmable logic devices (PLD), controllers, state machines, gate logic, discrete hardware components, any other suitable circuits, or any combination of circuits that can perform the various functions described throughout this application.

[0322] For example, in another example, each unit of the CP device 400 exists physically separately. In another example, a part of the units of the CP device 400 exists physically separately, and another part of the units are integrated into one unit. For example, in one example, the processing unit 401 and the sending unit 402 are the same unit. In another example, the processing unit 401 and the sending unit 402 are different units. In one example, the integration of different units is implemented in the form of hardware, that is, different units correspond to the same hardware. For another example, the integration of different units is implemented in the form of software units.

[0323] In the case of being implemented by hardware in the CP device 400, in one example, the processing unit 401 in the CP device 400 is implemented by at least one of the processor 701 or the processor 705 in the device 700. The sending unit 402 in the CP device 400 is implemented by the communication interface 704 in the device 700. In another example, the processing unit 401 in the CP device 400 is implemented by at least one of the central processor 611 in the device 600, the central processor 631 on the interface board 603, the network processor 632, the central processor 641 on the interface board 640, or the network processor 642. The sending unit 402 in the CP device 400 is implemented by at least one of the physical interface card 633 or the physical interface card 643 in the device 600.

[0324] In the case of software implementation in the CP device 400, for example, each unit in the CP device 400 is software generated after the processor 701 or processor 705 in the device 700 reads the program code stored in the memory 703; for another example, each unit in the CP device 400 is software generated after the central processor 611 in the device 600, the central processor 631 on the interface board 603, the network processor 632, the central processor 641 on the interface board 640, or the network processor 642 reads the program code stored in the memory 612. For example, the CP device 400 is a virtualized device. Virtualized devices include but are not limited to at least one of virtual machines, containers, and Pods. In one example, the CP device 400 is deployed on a hardware device (such as a physical server) in the form of a virtual machine. For example, the CP device 400 is implemented based on a general physical server combined with the Network Function Virtualization (NFV) technology. When implemented in the form of a virtual machine, the CP device 400 is, for example, a virtual host, a virtual router, or a virtual switch. Those skilled in the art can virtualize the CP device 400 on a general physical server in combination with NFV technology by reading this application. In another example, the CP device 400 is deployed on a hardware device in the form of a container (e.g., a docker container). For example, the process of the CP device 400 executing the above method embodiment is encapsulated in an image file, and the hardware device creates the CP device 400 by running the image file. In another example, the CP device 400 is deployed on a hardware device in the form of a Pod. The Pod includes multiple containers, each of which is used to implement one or more units in the CP device 400.

[0325] Attached Fig.12 FIG. 1 shows a possible structural diagram of the UP device involved in the above embodiment. Fig.12 The UP device 500 shown, for example, implements the functions of the UP device in the method 300 .

[0326] Please refer to the attached Fig.12 , the UP device 500 includes a receiving unit 501, a processing unit 502 and a sending unit 503. Each unit in the UP device 500 is implemented in whole or in part by software, hardware, firmware or any combination thereof. Each unit in the UP device 500 is used to perform the corresponding function of the UP device in the above method 300. Specifically, the receiving unit 501 is used to support the UP device 500 to execute S305. The processing unit 502 is used to support the UP device 500 to execute S307. The sending unit 503 is used to support the UP device 500 to execute S308.

[0327] In one example, the receiving unit 501, the processing unit 502 or the sending unit 503 is also used to support the UP device 500 to perform other processes performed by the UP device in the technology described herein. For example, the receiving unit 501 is used to support the UP device 500 to perform other receiving operations performed by the UP device in the method 300, such as S313. The sending unit 503 is used to support the UP device 500 to perform other sending operations performed by the UP device in the method 300, such as S315. For the specific execution process, please refer to the detailed description of the corresponding steps in the method 300, which will not be repeated here.

[0328] The division of units in the embodiments of the present application is schematic and is merely a logical function division. In actual implementation, other division methods may be optional.

[0329] In one example, each unit in the UP device 500 is integrated into a processing unit. For example, each unit in the UP device 500 is integrated on the same chip. The chip includes a processing circuit and an input interface and an output interface that are connected and communicated with the internal part of the processing circuit. The processing unit 502 is implemented by the processing circuit in the chip. The receiving unit 501 is implemented by the input interface in the chip. The sending unit 503 is implemented by the output interface in the chip. For example, the chip is implemented by one or more field programmable gate arrays (field-programmable gate array, English abbreviation: FPGA), programmable logic devices (PLD), controllers, state machines, gate logic, discrete hardware components, any other suitable circuits, or any combination of circuits that can perform the various functions described throughout this application.

[0330] In another example, each unit of the UP device 500 exists physically separately. In another example, some units of the UP device 500 exist physically separately, and other units are integrated into one unit. For example, in one example, the processing unit 502 and the sending unit 503 are the same unit. In another example, the processing unit 502 and the sending unit 503 are different units. In one example, the integration of different units is implemented in the form of hardware, that is, different units correspond to the same hardware. For another example, the integration of different units is implemented in the form of software units.

[0331] In the case of being implemented by hardware in the UP device 500, in one example, the processing unit 502 in the UP device 500 is implemented by at least one of the processor 701 or the processor 705 in the device 700. The receiving unit 501 and the sending unit 503 in the UP device 500 are implemented, for example, by the communication interface 704 in the device 700. In another example, the processing unit 502 in the UP device 500 is implemented by at least one of the central processor 611 in the device 600, the central processor 631 on the interface board 603, the network processor 632, the central processor 641 on the interface board 640, or the network processor 642. The receiving unit 501 and the sending unit 503 in the UP device 500 are implemented by at least one of the physical interface card 633 or the physical interface card 643 in the device 600.

[0332] In the case of implementation by software in the UP device 500, for example, each unit in the UP device 500 is software generated after the processor 701 or processor 705 in the device 700 reads the program code stored in the memory 703. For another example, each unit in the UP device 500 is software generated after the central processor 611 in the device 600, the central processor 631 on the interface board 603, the network processor 632, the central processor 641 on the interface board 640, or the network processor 642 reads the program code stored in the memory 612. For example, the UP device 500 is a virtualized device. Virtualized devices include but are not limited to at least one of virtual machines, containers, and Pods. In one example, the UP device 500 is deployed on a hardware device (such as a physical server) in the form of a virtual machine. For example, the UP device 500 is implemented based on a general physical server combined with the Network Function Virtualization (NFV) technology. When implemented in the form of a virtual machine, the UP device 500 is, for example, a virtual host, a virtual router, or a virtual switch. Those skilled in the art can virtualize the UP device 500 on a general physical server in combination with NFV technology by reading this application. In another example, the UP device 500 is deployed on a hardware device in the form of a container (e.g., a docker container). For example, the process of the UP device 500 executing the above method embodiment is encapsulated in an image file, and the hardware device creates the UP device 500 by running the image file. In another example, the UP device 500 is deployed on a hardware device in the form of a Pod. The Pod includes multiple containers, each of which is used to implement one or more units in the UP device 500.

[0333] The above describes how to implement the CP device and the UP device from the perspective of logical functions through the CP device 400 and the UP device 500. The following describes how to implement the CP device or the UP device from the perspective of hardware through the device 600 and the device 700. Fig.13 The device 600 shown or attached Fig.14 The device 700 shown is an example of the hardware structure of a CP device or a UP device.

[0334] Device 600 or device 700 corresponds to the CP device or UP device in the above method 300. The hardware, modules and other operations and / or functions in device 600 or device 700 are respectively for implementing the various steps and methods implemented by the CP device or UP device in the method embodiment. For the detailed process of how device 600 or device 700 defends against network attacks, the specific details can be found in the above method 300. For the sake of brevity, it will not be repeated here. Among them, each step of method 300 is completed by the hardware integrated logic circuit or software instruction in the processor of device 600 or device 700. The steps of the method disclosed in the embodiment of the present application can be directly embodied as the execution of the hardware processor, or the execution is completed by the combination of hardware and software modules in the processor. The software module is located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it is not described in detail here.

[0335] See attached Fig.13 , attached Fig.13 The schematic diagram of the hardware structure of a device provided by an exemplary embodiment of the present application is shown. The device 600 is configured as a CP device or a UP device in the method 300 . The device 600 includes: a main control board 610 and an interface board 630 .

[0336] The main control board 610 is also called a main processing unit (MPU) or a route processor card. The main control board 610 is used to control and manage various components in the device 600, including route calculation, device management, device maintenance, and protocol processing functions. The main control board 610 includes: a central processing unit 611 and a memory 612.

[0337] The interface board 630 is also called a line processing unit (LPU), a line card or a service board. The interface board 630 is used to provide various service interfaces and implement data packet forwarding. Service interfaces include but are not limited to Ethernet interfaces, POS (Packet over SONET / SDH) interfaces, etc., and Ethernet interfaces are, for example, Flexible Ethernet Clients (FlexE Clients). The interface board 630 includes: a central processing unit 631, a network processor 632, a forwarding table entry memory 634 and a physical interface card (physical interface card, PIC) 633.

[0338] The central processor 631 on the interface board 630 is used to control and manage the interface board 630 and communicate with the central processor 611 on the main control board 610 .

[0339] The network processor 632 is used to implement the forwarding processing of the message. The form of the network processor 632 is, for example, a forwarding chip. Specifically, the network processor 632 is used to forward the received message based on the forwarding table stored in the forwarding table entry memory 634. If the destination address of the message is the address of the device 600, the message is sent to the CPU (such as the central processor 611) for processing; if the destination address of the message is not the address of the device 600, the next hop and the output interface corresponding to the destination address are found from the forwarding table according to the destination address, and the message is forwarded to the output interface corresponding to the destination address. Among them, the processing of the uplink message includes: processing of the message input interface, forwarding table search; processing of the downlink message: forwarding table search, etc.

[0340] The physical interface card 633 is used to implement the connection function of the physical layer, and the original traffic enters the interface board 630 from it, and the processed message is sent from the physical interface card 633. The physical interface card 633 is also called a daughter card, which can be installed on the interface board 630, and is responsible for converting the optical signal into a message and forwarding the message to the network processor 632 for processing after checking the legitimacy of the message. In an example, the central processor can also perform the functions of the network processor 632, such as realizing software forwarding based on a general-purpose CPU, so that the network processor 632 is not required in the physical interface card 633.

[0341] Optionally, the device 600 includes a plurality of interface boards. For example, the device 600 further includes an interface board 640 . The interface board 640 includes a central processor 641 , a network processor 642 , a forwarding table entry memory 644 , and a physical interface card 643 .

[0342] Optionally, the device 600 further includes a switching fabric board 620. The switching fabric board 620 is also called, for example, a switch fabric unit (SFU). When the network device has multiple interface boards 630, the switching fabric board 620 is used to complete data exchange between the interface boards. For example, the interface board 630 and the interface board 640 communicate with each other, for example, through the switching fabric board 620.

[0343] The main control board 610 is coupled to the interface board 630. For example, the main control board 610, the interface board 630, the interface board 640, and the switching network board 620 are connected to the system backplane through a system bus to achieve intercommunication. In a possible implementation, an inter-process communication (IPC) channel is established between the main control board 610 and the interface board 630, and the main control board 610 and the interface board 630 communicate through the IPC channel.

[0344] Logically, the device 600 includes a control plane and a forwarding plane. The control plane includes a main control board 610 and a central processor 631. The forwarding plane includes various components for performing forwarding, such as a forwarding table entry memory 634, a physical interface card 633, and a network processor 632. The control plane performs functions such as a router, generating a forwarding table, processing signaling and protocol messages, and configuring and maintaining the status of the device. The control plane sends the generated forwarding table to the forwarding plane. On the forwarding plane, the network processor 632 forwards the message received by the physical interface card 633 based on the forwarding table sent by the control plane. The forwarding table sent by the control plane is, for example, stored in the forwarding table entry memory 634. In some embodiments, the control plane and the forwarding plane are, for example, completely separated and are not on the same device.

[0345] It should be understood that the operation on the interface board 640 in the embodiment of the present application is consistent with the operation of the interface board 630, and for the sake of brevity, it will not be repeated. It should be understood that the device 600 of this embodiment can correspond to the CP device or UP device in the above-mentioned various method embodiments, and the main control board 610, the interface board 630 and / or 640 in the device 600, for example, implement the functions and / or various steps implemented by the CP device or UP device in the above-mentioned various method embodiments, and for the sake of brevity, it will not be repeated here.

[0346] It is worth noting that there may be one or more main control boards, and when there are multiple boards, for example, they include a main main control board and a backup main control board. There may be one or more interface boards. The stronger the data processing capability of the network device, the more interface boards are provided. There may also be one or more physical interface cards on the interface board. There may be no switching network board, or there may be one or more switching network boards. When there are multiple switching network boards, they can jointly realize load sharing and redundant backup. Under the centralized forwarding architecture, the network device may not need a switching network board, and the interface board is responsible for the processing function of the business data of the entire system. Under the distributed forwarding architecture, the network device can have at least one switching network board, and the switching network board is used to realize data exchange between multiple interface boards, providing large-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of the network equipment with a distributed architecture are greater than those of the equipment with a centralized architecture. Optionally, the network device may have only one board, that is, no switching board, and the functions of the interface board and the main control board are integrated on the board. In this case, the central processor on the interface board and the central processor on the main control board can be combined into one central processor on the board to perform the functions of the two. This type of device has low data exchange and processing capabilities (for example, low-end switches or routers and other network devices). The specific architecture to be adopted depends on the specific networking deployment scenario, and no limitation is made here.

[0347] See attached Fig.14 , attached Fig.14 The schematic diagram of the structure of a device 700 provided by an exemplary embodiment of the present application is shown, and the device 700 is configured as a CP device or a UP device in the method 300. The device 700 may be a host, a server, or a personal computer, etc. The device 700 may be implemented by a general bus architecture.

[0348] The device 700 includes at least one processor 701 , a communication bus 702 , a memory 703 , and at least one communication interface 704 .

[0349] The processor 701 is, for example, a general-purpose central processing unit (CPU), a network processor (NP), a graphics processing unit (GPU), a neural-network processing units (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the solution of the present application. For example, the processor 701 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0350] The communication bus 702 is used to transmit information between the above components. The communication bus 702 can be divided into an address bus, a data bus, a control bus, etc. Fig.14 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0351] The memory 703 is, for example, a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 703 is, for example, independent and connected to the processor 701 via the communication bus 702. The memory 703 can also be integrated with the processor 701.

[0352] The communication interface 704 uses any transceiver-like device for communicating with other devices or communication networks. The communication interface 704 includes a wired communication interface and may also include a wireless communication interface. Among them, the wired communication interface may be, for example, an Ethernet interface. The Ethernet interface may be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface may be a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof, etc.

[0353] In a specific implementation, as an embodiment, the processor 701 may include one or more CPUs, such as the attached Fig.14 CPU0 and CPU1 are shown in the figure.

[0354] In a specific implementation, as an embodiment, the device 700 may include multiple processors, such as the attached Fig.14 1 and 10. Each of these processors may be a single-CPU or a multi-CPU. A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0355] In a specific implementation, as an embodiment, the device 700 may also include an output device and an input device. The output device communicates with the processor 701 and may display information in a variety of ways. For example, the output device may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device communicates with the processor 701 and may receive user input in a variety of ways. For example, the input device may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0356] In one example, the memory 703 is used to store the program code 710 for executing the solution of the present application, and the processor 701 can execute the program code 710 stored in the memory 703. That is, the device 700 can implement the network attack defense method provided by the method embodiment through the processor 701 and the program code 710 in the memory 703.

[0357] The device 700 of the embodiment of the present application may correspond to the CP device or UP device in the above-mentioned various method embodiments, and the processor 701, communication interface 704, etc. in the device 700 may implement the functions and / or various steps and methods implemented by the CP device or UP device in the above-mentioned various method embodiments. For the sake of brevity, it will not be repeated here.

[0358] See attached Fig.15 The present application embodiment provides a communication system 800, the system 800 includes: a CP device 801 and a UP device 802. Optionally, the CP device 801 is as shown in the attached Fig.11 The CP device 400 shown or attached Fig.14 The device 600 shown or attached Fig.15 The device 700 shown in the figure, the UP device 802 is as shown in the attached Fig.12 UP device 500 or attached Fig.14 The device 600 shown or attached Fig.15 Device 700 is shown.

[0359] In one example, a computer program product is provided, the computer program product including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a CP device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the CP device performs the relevant steps of the CP device side in the above method 300.

[0360] In one example, a computer program product is provided, the computer program product including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a UP device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the UP device performs the relevant steps on the UP device side in the above method 300.

[0361] Those of ordinary skill in the art will appreciate that the various method steps and units described in the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0362] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0363] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the unit is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or it can be an electrical, mechanical or other form of connection.

[0364] The unit described as a separate component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit, that is, it may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiment of the present application.

[0365] In addition, each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or software unit.

[0366] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0367] In the present application, the words such as "first" and "second" are used to distinguish the same or similar items with basically the same effects and functions. It should be understood that there is no logical or temporal dependency between "first" and "second", nor is the quantity and execution order limited. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another. For example, without departing from the scope of various examples, the first message can be referred to as the second message, and similarly, the second message can be referred to as the first message. Both the first message and the second message can be messages, and in some cases, can be separate and different messages.

[0368] The term "at least one" in this application means one or more, and the term "multiple" in this application means two or more, for example, multiple messages means two or more messages. The terms "system" and "network" are often used interchangeably herein.

[0369] It should also be understood that the term "if" may be interpreted to mean "when" or "upon" or "in response to determining" or "in response to detecting." Similarly, the phrase "if it is determined that ..." or "if [a stated condition or event] is detected" may be interpreted to mean "upon determining that ..." or "in response to determining that ..." or "upon detecting [a stated condition or event]" or "in response to detecting [a stated condition or event]," depending on the context.

[0370] The above description is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0371] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer program instructions. When the computer program instructions are loaded and executed on a computer, the process or function in accordance with the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.

[0372] The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer program instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wired or wireless means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a digital video disc (DVD), or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0373] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0374] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for defending against network attacks, characterized in that: A CP device applied to a communication system in which a control plane CP and a user plane UP are separated, the communication system comprising the CP device and a UP device, and the method comprising: In response to a reception rate of the dial-up message satisfying an abnormal condition, the CP device generates a first control message, wherein the first control message is used to instruct the UP device to carry a watermark when sending a dial-up message to the CP device; The CP device sends the first control message to the UP device; The CP device identifies the attack message in the message stream according to the watermark; The CP device discards the attack message.

2. The method according to claim 1, characterized in that The watermark includes a first virtual extended local area network identifier VNI, the message stream includes a first message, and the CP device identifies an attack message in the message stream according to the watermark, including: The CP device determines that the first message is a non-attack message based on the first message including the first VNI.

3. The method according to claim 1, characterized in that The watermark includes a first random number, the message stream includes a second message, and the CP device identifies the attack message in the message stream according to the watermark, including: The CP device determines, according to the second message including the first random number, that the second message is a non-attack message.

4. The method according to claim 1, characterized in that The watermark includes a first timestamp, where the first timestamp is used to indicate a time point of synchronization between the CP device and the UP device, the message stream includes a third message, and the CP device identifies an attack message in the message stream according to the watermark, including: The CP device determines that the third message is a non-attack message according to that the third message includes the first timestamp.

5. The method according to claim 1, characterized in that The watermark includes a first message authentication code, the message stream includes a fourth message, and the CP device identifies the attack message in the message stream according to the watermark, including: The CP device determines that the fourth message is a non-attack message according to that the fourth message includes the first message authentication code.

6. The method according to any one of claims 1 to 5, characterized in that The first control message includes the watermark; or, the first control message includes watermark type information corresponding to the watermark; or, the first control message includes parameters related to generating the watermark.

7. The method according to any one of claims 1 to 5, characterized in that The first control message is a Control and Forwarding Separation Protocol (CUSP) message, and the CUSP message includes a watermark type length value (TLV); The watermark TLV is a TLV that carries the watermark; or, the watermark TLV is a TLV that carries watermark type information corresponding to the watermark; or, the watermark TLV is a TLV that carries parameters related to generating the watermark.

8. The method according to any one of claims 1 to 5, characterized in that The first control message is a Packet Forwarding Control Protocol (PFCP) message, and the PFCP message includes a watermark information element (IE); The watermark IE is an IE that carries the watermark; or, the watermark IE is an IE that carries watermark type information corresponding to the watermark; or, the watermark IE is an IE that carries parameters related to generating the watermark.

9. The method according to claim 8, characterized in that The first control message is a PFCP node message; or, the first control message is a PFCP session message.

10. The method according to any one of claims 1 to 5 or 9, characterized in that The message stream includes a fifth message, and the CP device identifies an attack message in the message stream according to the watermark, including: The CP device determines that the fifth message is an attack message according to the fact that the fifth message does not include the watermark.

11. The method according to any one of claims 1 to 5 or 9, characterized in that After the CP device sends the first control message to the UP device, the method further includes: In response to the receiving rate of the dial-up message meeting a normal condition, the CP device generates a second control message, where the second control message is used to instruct the UP device to cancel the watermark when sending the dial-up message to the CP device; The CP device sends the second control message to the UP device.

12. The method according to any one of claims 1 to 5 or 9, characterized in that The communication system is a broadband network gateway BNG system or a broadband remote access server BRAS system.

13. A message processing method, characterized in that: A UP device applied to a communication system in which a control plane CP and a user plane UP are separated, the communication system comprising a CP device and the UP device, and the method comprising: The UP device receives a first control message from the CP device, where the first control message is used to instruct the UP device to carry a watermark when sending a dial-up message to the CP device, where the watermark is used to enable the CP device to identify an attack message in a message stream according to the watermark; The UP device carries the watermark in a dial-up message according to the first control message; The UP device sends a dial-up message including the watermark to the CP device.

14. The method according to claim 13, characterized in that After the UP device carries the watermark in a dial-up message according to the first control message, the method further includes: The UP device receives a second control message from the CP device, where the second control message is used to instruct the UP device to cancel the watermark when sending a dial-up message to the CP device; The UP device sends a dial-up message that does not include a watermark to the CP device according to the second control message.

15. A control plane CP device, characterized in that: The CP device is located in a communication system in which a CP and a user plane UP are separated, the communication system includes the CP device and a UP device, and the CP device includes: a processing unit, configured to generate a first control message in response to a reception rate of the dial-up message satisfying an abnormal condition, wherein the first control message is used to instruct the UP device to carry a watermark when sending a dial-up message to the CP device; A sending unit, configured to send the first control message to the UP device; The processing unit is further used to identify attack messages in the message stream according to the watermark; The processing unit is further configured to discard the attack message.

16. The CP device according to claim 15, characterized in that: The watermark includes a first virtual extended local area network identifier VNI, the message stream includes a first message, and the processing unit is used to determine that the first message is a non-attack message based on the first message including the first VNI.

17. The CP device according to claim 15, characterized in that: The watermark includes a first random number, the message stream includes a second message, and the processing unit is configured to determine that the second message is a non-attack message according to the second message including the first random number.

18. The CP device according to claim 15, characterized in that: The watermark includes a first timestamp, where the first timestamp is used to indicate a time point of synchronization between the CP device and the UP device. The message stream includes a third message. The processing unit is used to determine that the third message is a non-attack message based on the third message including the first timestamp.

19. The CP device according to claim 15, characterized in that: The watermark includes a first message authentication code, the message stream includes a fourth message, and the processing unit is configured to determine that the fourth message is a non-attack message according to the fourth message including the first message authentication code.

20. The CP device according to any one of claims 15 to 19, characterized in that: The processing unit is further configured to generate a second control message in response to the reception rate of the dial-up message satisfying a normal condition, wherein the second control message is used to instruct the UP device to cancel the watermark when sending the dial-up message to the CP device; The sending unit is further configured to send the second control message to the UP device.

21. The CP device according to any one of claims 15 to 19, characterized in that: The message flow includes a fifth message, and the processing unit is configured to determine that the fifth message is an attack message according to the fact that the fifth message does not include the watermark.

22. A user plane UP device, characterized in that: The UP device is located in a communication system in which a control plane CP and a UP are separated, the communication system includes a CP device and the UP device, and the UP device includes: a receiving unit, configured to receive a first control message from the CP device, wherein the first control message is used to instruct the UP device to carry a watermark when sending a dial-up message to the CP device, wherein the watermark is used to enable the CP device to identify an attack message in a message stream according to the watermark; A processing unit, configured to carry a watermark in a dial-up message according to the first control message; A sending unit is used to send a dial-up message including the watermark to the CP device.

23. The UP device according to claim 22, characterized in that: The receiving unit is further configured to receive a second control message from the CP device, wherein the second control message is used to instruct the UP device to cancel the watermark when sending a dial-up message to the CP device; The sending unit is further configured to send a dial-up message that does not include a watermark to the CP device according to the second control message.

24. A communication system with separate control plane CP and user plane UP, characterized in that: The system comprises a CP device as claimed in any one of claims 15 to 21 and a UP device as claimed in any one of claims 22 to 23.

Images