A method and device for suppressing attack messages

Abstract

The present application discloses a method and device for suppressing attack messages. The method for suppressing attack messages includes: recording the number of messages of each protocol type received by each port within a specified time; polling the number of messages of each protocol type received by each port according to the polling cycle; determining that the number of protocol messages of any protocol type received by the currently polled port exceeds the specified threshold of the speed limit value of the bound CPU queue; checking the number of packet losses of the bound CPU queue; determining that the number of packet losses exceeds the continuous packet loss threshold of the bound CPU queue; identifying that the currently polled port is the source port of the attack message and the protocol type received by the source port of the attack message exceeds the continuous packet loss threshold of the bound CPU queue as the attack message protocol type; configuring the source port suppression ACL table item; wherein the matching item is the port identifier of the source port of the attack message and the identified attack message protocol type.

Description

Technical Field

[0001] The present application relates to communication technology, and in particular to a method and device for suppressing attack messages. Background Art

[0002] The switching chip of the communication equipment sends the protocol messages that need software processing to the CPU queue based on factors such as protocol type, network scenario, and business requirements, and the processor CPU performs software forwarding and software processing.

[0003] The switching chip adds a CPU reason to the protocol packets that need to be sent up through the register inside the chip, and then sends the protocol packets with the CPU reason to the CPU queue bound to the CPU reason. For user-defined protocol packet types that need to be sent to the CPU for processing, you can configure the custom protocol type in the matching field of the ACL table entry through the switching chip, and send the matching protocol packets to the specified CPU queue.

[0004] However, network attackers flood the network with a large number of attack messages by eavesdropping, maliciously modifying and forwarding, consuming the processor resources and bandwidth of network devices. In order to prevent a large number of protocol messages received by network devices from being sent to the CPU and causing CPU failure, different CPU queues are speed-limited to control the speed at which each CPU queue sends protocol messages to the CPU. When the messages of each CPU queue are sent to the CPU through the CPU chip port, the CPU chip port is used to uniformly limit the speed of the protocol messages sent to the CPU by all CPU queues. When the CPU of a network device receives a large number of a certain type of protocol messages, the queue of this type of protocol messages is further speed-limited to prevent this type of protocol message from occupying the bandwidth of other types of protocol messages through the CPU chip port. However, the defect of this method is that normal protocol messages of the same type received by the port connected to the non-attack terminal will not be sent to the CPU because the attack message occupies the bandwidth. Summary of the invention

[0005] The purpose of the present application is to provide a method and device for suppressing attack messages, which suppress attack messages from being sent to the CPU of a network device from a source port.

[0006] To achieve the above-mentioned purpose, the present application provides a method for suppressing attack messages, the method comprising: recording the number of messages of each protocol type received by each port within a specified time; polling the number of messages of each protocol type received by each port according to a polling period; determining that the number of protocol messages of any protocol type received by the currently polled port exceeds the specified threshold of the speed limit value of the bound CPU queue; checking the number of packet losses of the bound CPU queue; determining that the number of packet losses exceeds the continuous packet loss threshold of the bound CPU queue; identifying that the currently polled port is the source port of the attack message and the protocol type received by the attack message source port that exceeds the continuous packet loss threshold of the bound CPU queue is the attack message protocol type; configuring the source port suppression ACL table item; wherein the matching item is the port identifier of the attack message source port and the identified attack message protocol type.

[0007] To achieve the above-mentioned purpose, the present application also provides a device for suppressing attack messages, which device, as a dynamic host configuration protocol relay device, includes a processor and a memory; the memory is used to store processor executable instructions; wherein the processor performs the following operations by running the processor executable instructions in the memory: recording the number of messages of each protocol type received by each port within a specified time; polling the number of messages of each protocol type received by each port that has been recorded according to a polling period; determining that the number of protocol messages of any protocol type received by the currently polled port exceeds the specified threshold of the speed limit value of the bound CPU queue; checking the number of packet losses of the bound CPU queue; determining that the number of packet losses exceeds the continuous packet loss threshold of the bound CPU queue; identifying that the currently polled port is an attack message source port and the protocol type received by the attack message source port that exceeds the continuous packet loss threshold of the bound CPU queue is the attack message protocol type; configuring the source port suppression ACL table entry; wherein the matching item is the port identifier of the attack message source port and the identified attack message protocol type.

[0008] The beneficial effect of the present application is that attack messages are suppressed and speed-limited from the source port, effectively protecting the effectiveness, balance, and diversity of queue messages, preventing the attack port from completely occupying the CPU queue or causing CPU queue congestion, causing the CPU to receive a large number of invalid protocol messages and be unable to effectively parse the protocol messages of normal business, resulting in business oscillation or failure. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 A schematic diagram of an example of a method for suppressing attack messages provided by the present application;

[0010] Figure 2A-2B Shown is a schematic diagram of suppressing attack messages provided by the present application;

[0011] Figure 3 Shown is a schematic diagram of a device for suppressing attack messages provided by the present application. DETAILED DESCRIPTION

[0012] The present invention will be described in detail with multiple examples shown in multiple figures. In the following detailed description, multiple specific details are used to provide a comprehensive understanding of the present application. Known methods, steps, components and circuits are not described in detail in the examples to avoid making these examples difficult to understand.

[0013] Among the terms used, the term "include" means including but not limited to; the term "contain" means including but not limited to; the terms "above", "within" and "below" are inclusive of the number; the terms "greater than" and "less than" are exclusive of the number. The term "based on" means based on at least a part thereof.

[0014] Figure 1 A schematic diagram of an example of a method for suppressing attack messages provided by the present application; recording the number of messages of each protocol type received by each port within a specified time;

[0015] Step 101, polling the number of received messages of each protocol type of each port recorded according to the polling cycle;

[0016] Step 102, determining whether the number of protocol messages of any protocol type currently received by the polled port exceeds a specified threshold of a rate limit value bound to a CPU queue;

[0017] Step 103, check the number of packet losses bound to the CPU queue;

[0018] Step 104, determining that the number of packet losses exceeds the continuous packet loss threshold of the bound CPU queue;

[0019] Step 105, identifying that the currently polled port is the attack message source port and the protocol type of the attack message source port that exceeds the continuous packet loss threshold of the bound CPU queue is the attack message protocol type;

[0020] Step 106, configure a source port suppression ACL entry; wherein the matching item is the port identifier of the attack message source port and the identified attack message protocol type.

[0021] The beneficial effect of the present application is that attack messages are suppressed and speed-limited from the source port, effectively protecting the effectiveness, balance, and diversity of queue messages, preventing the attack port from completely occupying the CPU queue or causing CPU queue congestion, causing the CPU to receive a large number of invalid protocol messages and be unable to effectively parse the protocol messages of normal business, resulting in business oscillation or failure.

[0022] Figure 2A-2B Shown is a schematic diagram of suppressing attack messages provided by the present application; Figure 2AIn the network device, the network interface protocol message is added with CPU reason by the register inside the switching chip for the protocol message to be sent up, such as Figure 2A The CPUreason of ARP protocol packets, IPv4 multicast protocol packets, IPv6 multicast protocol packets, BPDU protocol packets, and RIP protocol packets. The match fields of ACL table item 1 and ACL table item 2 sent by the switching chip of the network device are user-defined protocol types. According to the protocol packet types that need to be sent to the CPU for processing, the customized protocol type of the match field of the ACL table item can be configured through the switching chip, and the matching protocol packets are sent to the bound CPU queue Queue n. After the protocol packets sent to the CPU by the switching chip of the network device are sent to the CPU queue Queue n through ACL table items 1 and 2, the switching chip sends the ARP protocol packets, IPv4 multicast protocol packets, IPv6 multicast protocol packets, BPDU protocol packets, and RIP protocol packets with different CPU reasons to the bound CPU queues 1 to CPU queues 4. Figure 2A In the example, IPv4 multicast protocol packets and IPv6 multicast protocol packets with different CPU reasons can be bound to the same CPU Queue 2.

[0023] The protocol packets of CPU Queue 1-Queue n of the network device are sent to the CPU according to the unified speed limit value of the CPU chip port. The protocol packets sent by the switching chip of the network device to the CPU are marked with the source port (the inbound port of the protocol packet), and the CPU of the network device records the number of packets of each protocol type received by the port per second.

[0024] The CPU of the network device polls the recorded number of received packets of each protocol type for each port according to the polling period. When the CPU of the network device polls the recorded number of received packets of each protocol type for port Port1, and the number of received packets of the IPv4 multicast protocol for Port1 exceeds the specified threshold of the maximum rate limit of packets in CPU queue Queue 2, for example, 1 / 4 of the maximum rate limit, the CPU checks whether there is queue packet loss in CPU queue Queue2.

[0025] Since the CPU queue packet loss number recorded by the CPU check leads to a high CPU occupancy rate, this application considers that the port may be the source port of the attack message when the data of the protocol type that has been received by the port is greater than the specified threshold of the maximum speed limit of the CPU queue, and then calls the CPU resources to check whether there is queue packet loss in the bound CPU queue of the protocol type. When there is packet loss in the bound CPU queue and the number of packet losses is greater than the set packet loss threshold, it is considered that there is continuous packet loss caused by attack messages; if there is packet loss in the bound CPU queue but the number of packet losses is less than the set packet loss threshold, it is considered to be normal occasional packet loss, and there is no need to suppress the attack from the source port.

[0026] In this embodiment, assuming that the number of packet losses of CPU queue Queue 2 recorded by the CPU call of the network device has exceeded the packet loss threshold, Port 1 is identified as an attack message and the IPv4 multicast protocol message received by Port 1 is an attack message.

[0027] like Figure 2B As shown, the CPU of the network device configures a source port suppression ACL entry in the ACL table of the switching chip; the matching items are the port identifier of Port1 and the IPv4 multicast protocol type. The priority of the source port suppression ACL entry is higher than the priority of the ACL entry for sending protocol packets to the CPU queue, and the action item is discard. Source port suppression ACL entry; the matching items are the port identifier of the source port of the attack packet and the identified attack packet protocol type. Figure 2B In the example, the priority of the source port suppression ACL entry is higher than the priority of the sent ACL entry 1 and the sent ACL entry 2.

[0028] In this way, although the internal register of the switching chip of the network device adds the CPU reason for sending the IPv4 multicast protocol message received by Port1 to CPU queue Queue 2, the switching chip suppresses the ACL table entry according to the source port to discard the protocol message with the CPU reason of the IPv4 multicast protocol received by Port1, thereby preventing it from being sent to CPU queue Queue 2.

[0029] In this embodiment, when the CPU of the network device polls the recorded number of received packets of each protocol type of port Port1, the number of received packets of the custom protocol type received by Port1 sent by ACL entry 1 to CPU queue Queue n exceeds the specified threshold of the maximum rate limit of the packets of CPU queue Queue n, for example, 1 / 3 of the maximum rate limit. The user can set the specified threshold of the maximum rate limit of the CPU queue that the number of received packets exceeds according to the experience value.

[0030] The network device CPU considers that Port 1 may be the source port of the attack packets sent from ACL entry 1 to CPU queue n. When the CPU resource is called to check whether there is packet loss in CPU queue n and the number of lost packets is greater than the set packet loss threshold, the CPU considers that there is continuous packet loss caused by attack packets.

[0031] like Figure 2B As shown, the CPU of the network device configures a source port suppression ACL entry in the ACL table of the switching chip; the matching item is the port identifier of Port1 and the customized upstream protocol type, and the action item is discard.

[0032] Since the priority of the source port suppression ACL table item is higher than the priority of the upstream ACL table item 1 and the upstream ACL table item 2; although the matching item of the source port suppression ACL table item is the same as the customized upstream protocol type of the matching item of the upstream ACL table item 1, the attack message received by port1 is matched preferentially by the source port ACL table item, so that the protocol messages of the same protocol type received by other ports and sent to the CPU queue Queue n by the upstream ACL table item 1 are not affected. In this embodiment, the action item of the source port suppression ACL table item can also be set to low-speed forwarding, allowing only a small number of matching protocol messages to be sent to the CPU queue Queue n, without crowding out the bandwidth of the CPU queue.

[0033] The CPU of the network device marks port 1 as an attack port. When the next polling cycle arrives, if port 1 receives other types of protocol packets according to the above Figure 2A-2B If the packet is not identified as an attack packet, port 1 will not be marked. If the next polling cycle arrives, if port 1 receives other types of protocol packets according to the above Figure 2A-2B If the packet is still identified as an attack packet, port 1 will continue to be marked as an attack port.

[0034] When the CPU of the network device does not mark port 1 as an attack port in multiple consecutive polling cycles, the CPU of the network device deletes the source port suppression ACL entry set for port 1.

[0035] The beneficial effect of the present application is that attack messages are suppressed and speed-limited from the source port without affecting the same type of protocol messages received by other ports, effectively protecting the validity, balance, and diversity of queue messages, and preventing the attack port from completely occupying the CPU queue or causing CPU queue congestion, causing the CPU to receive a large number of invalid protocol messages and be unable to effectively parse the protocol messages of normal business, resulting in business oscillation or failure.

[0036] Figure 3The schematic diagram of the embodiment of the device for suppressing attack messages provided by the present application, the device 30 at least includes: a network interface, a switching chip, a processor CPU and a memory. The processor performs the following operations by running the processor executable instructions in the memory: recording the number of messages of each protocol type received by each port within a specified time; polling the number of messages of each protocol type received by each port according to the polling cycle; determining that the number of protocol messages of any protocol type currently received by the polled port exceeds the specified threshold of the speed limit value of the bound CPU queue; checking the number of packet losses of the bound CPU queue; determining that the number of packet losses exceeds the continuous packet loss threshold of the bound CPU queue; identifying that the currently polled port is the source port of the attack message and the protocol type received by the attack message source port that exceeds the continuous packet loss threshold of the bound CPU queue is the attack message protocol type; configuring the source port suppression ACL table item; wherein the matching item is the port identifier of the attack message source port and the identified attack message protocol type. The priority of the source port suppression ACL table item is higher than the priority of the ACL table item for sending protocol messages to the CPU queue.

[0037] The attack packet protocol type is the protocol packet type defined in the switch chip register or the user-defined protocol packet type value of the ACL entry.

[0038] The processor further performs the following operations by running the processor executable instructions in the memory: setting an attack source port mark of the current polling cycle for the identified attack message source port.

[0039] The processor further performs the following operations by running the processor executable instructions in the memory: when it is determined that the attack message source port has not been set with an attack source port mark within a plurality of consecutive polling cycles, deleting the attack source port mark and the source port suppression ACL table entry.

[0040] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for suppressing attack messages, characterized in that: The method comprises: Record the number of packets of each protocol type received by each port within a specified time; Poll the number of received messages of each protocol type on each port according to the polling period; Determine whether the number of protocol packets of any protocol type currently received by the polled port exceeds the specified threshold of the rate limit value of the bound CPU queue; Check the number of packet losses of the bound CPU queue; Determining that the number of packet losses exceeds a continuous packet loss threshold of the bound CPU queue; Identify that the currently polled port is an attack message source port and the protocol type received by the attack message source port that exceeds the continuous packet loss threshold of the bound CPU queue is an attack message protocol type; Configure a source port suppression ACL table entry; wherein the matching item is the port identifier of the attack message source port and the identified attack message protocol type.

2. The method according to claim 1, characterized in that The attack message protocol type is a protocol message type defined in a switch chip register or a user-defined protocol message type value of an ACL table item.

3. The method according to claim 1, characterized in that The priority of the source port suppression ACL entry is higher than the priority of the ACL entry for sending protocol packets to the CPU queue.

4. The method according to claim 1, characterized in that The method also includes setting an attack source port mark of a current polling cycle for the identified attack message source port.

5. The method according to claim 4, characterized in that The method further comprises, When it is determined that the attack message source port is not set with an attack source port mark in a plurality of consecutive polling cycles, the attack source port mark and the source port suppression ACL entry are deleted.

6. A device for suppressing attack messages, characterized in that: The device includes a processor and a memory; the memory is used to store processor-executable instructions; wherein the processor executes the processor-executable instructions in the memory to perform the following operations: Record the number of packets of each protocol type received by each port within a specified time; Poll the number of received messages of each protocol type on each port according to the polling period; Determine whether the number of protocol packets of any protocol type currently received by the polled port exceeds the specified threshold of the rate limit value of the bound CPU queue; Check the number of packet losses of the bound CPU queue; Determining that the number of packet losses exceeds a continuous packet loss threshold of the bound CPU queue; Identify that the currently polled port is an attack message source port and the protocol type received by the attack message source port that exceeds the continuous packet loss threshold of the bound CPU queue is an attack message protocol type; Configure a source port suppression ACL table entry; wherein the matching item is the port identifier of the attack message source port and the identified attack message protocol type.

7. The device according to claim 6, characterized in that The attack message protocol type is a protocol message type defined in a switch chip register or a user-defined protocol message type value of an ACL table item.

8. The device according to claim 6, characterized in that The priority of the source port suppression ACL entry is higher than the priority of the ACL entry for sending protocol packets to the CPU queue.

9. The device according to claim 6, characterized in that The processor further performs the following operations by running the processor executable instructions in the memory: setting an attack source port mark of a current polling cycle for the identified attack message source port.

10. The device according to claim 9, characterized in that The processor further performs the following operations by executing the processor executable instructions in the memory: When it is determined that the attack message source port is not set with an attack source port mark in a plurality of consecutive polling cycles, the attack source port mark and the source port suppression ACL entry are deleted.

Images