Network packet processing device and network packet processing method

Abstract

A network packet processing apparatus includes a processing unit, an operating system, and an analysis unit. The processing unit is electrically connected to a network interface card (NIC). The operating system, in conjunction with the processing unit, controls the NIC to be in promiscuous mode to receive data packets from the Internet. The analysis unit obtains the data packets from the NIC and parses the destination address within the data packets. The analysis unit also includes multiple honeypot units and stores multiple honeypot addresses corresponding to these honeypot units. When the analysis unit determines that the destination address of the data packet corresponds to one of these honeypot addresses, the analysis unit selectively sends a response message using one of these honeypot addresses or a preset address.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to a network packet processing device and method, and more particularly to a technique for receiving data packets through a network card and generating response information. BACKGROUND

[0002] With the development of technology, network communication technology is widely used in people's life, and people's demand for network communication is also increasing. Correspondingly, the security of network communication is also increasingly important. How to effectively defend against network attacks has become an important issue in today's Internet technology. SUMMARY

[0003] The present disclosure relates to a network packet processing device and method, and more particularly to a technique for receiving data packets through a network card and generating response information.

[0004] The present disclosure also relates to a network packet processing method, comprising the following steps: setting a network interface card in a mixed mode through a processing unit and an operating system to receive data packets from the Internet; analyzing the destination address of the data packet through an analysis unit, wherein the analysis unit comprises a plurality of honeypot units and stores a plurality of honeypot addresses corresponding to the honeypot units; when the destination address of the data packet corresponds to one of the honeypot addresses, transmitting the data packet to the honeypot unit corresponding to one of the honeypot addresses; and selectively sending a response information with one of the honeypot addresses or a preset address.

[0005] The present disclosure also relates to a network packet processing device, comprising a processing unit, an operating system and an analysis unit. The processing unit is electrically connected to a network interface card. The operating system is used in cooperation with the processing unit to control the network interface card in a mixed mode to receive data packets from the Internet. The analysis unit is used to receive data packets. The analysis unit also comprises a plurality of honeypot units and stores a plurality of honeypot addresses corresponding to the honeypot units. When the analysis unit determines that the data packet corresponds to one of the honeypot addresses, the analysis unit determines whether to send a response information with a preset address according to the response setting conditions of one of the honeypot addresses.

[0006] Since the network packet processing device runs the operating system through the processing unit to drive the network interface card, and then receives the data packet to the analysis unit, the analysis unit does not need to install the corresponding operating system for each honeypot unit, thereby effectively improving the construction cost of the network packet processing device. BRIEF DESCRIPTION OF DRAWINGS

[0007] Figure 1 a schematic diagram of a network packet processing device according to some embodiments of the present disclosure;

[0008] Figure 2 a flowchart of a network packet processing method according to some embodiments of the present disclosure.

[0009] BRIEF DESCRIPTION OF DRAWINGS

[0010] 100: network packet processing device

[0011] 110: processing unit

[0012] 120: network interface card

[0013] 130: operating system

[0014] 140: analysis unit

[0015] 141: analysis module

[0016] T: response table

[0017] T1: first honeypot address

[0018] T2: second honeypot address

[0019] H1-Hn: honeypot unit

[0020] S201-S208: steps DETAILED DESCRIPTION

[0021] In the following, a plurality of embodiments of the present application will be disclosed with reference to the accompanying drawings. For the purpose of clear illustration, many practical details will be described in the following description. However, it should be understood that these practical details should not be used to limit the present application. That is, in some embodiments of the present application, these practical details are not necessary. In addition, for the purpose of simplifying the drawings, some conventional structures and elements will be shown in a simple schematic manner in the drawings.

[0022] When an element is referred to as being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element or be electrically connected or coupled to the other element. "Connected" or "coupled" can also mean that two or more elements cooperate or interact with each other to also operate or interact. Additionally, although the terms "first", "second",... are used herein to describe various elements, these terms are merely used to distinguish one element from another. Unless the context clearly indicates otherwise, these terms are not necessarily used to describe a sequence or order, nor to limit the scope of or to imply a specific order or sequence. The terms "comprises", "comprising", "includes", "including", "has", "having", "contains", "containing", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises, includes, has, contains a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0023] Figure 1 Fig. 1 shows a schematic diagram of a network packet processing device 100 according to some embodiments of the present disclosure. The network packet processing device 100 includes a processing unit 110, a network interface card 120, an operating system 130, and an analysis unit 140. The processing unit 110 is electrically connected to the network interface card 120, and is configured to control the network interface card 120 to receive data from or transmit data to a network via the network interface card 120 in cooperation with the operating system 130.

[0024] The processing unit 110 is configured to perform various operations, and can be implemented as a microcontroller, a microprocessor, a digital signal processor, an application specific integrated circuit (ASIC), a central processing unit (CPU), a system on chip (SoC), or a special function processor or controller.

[0025] In some embodiments, the operating system 130 is installed in a data storage unit (not shown) in the network packet processing device 100. The data storage unit is electrically connected to the processing unit 110, and can be implemented as a read only memory, a flash memory, a hard disk, a portable disk, a database accessible via a network, or any other storage medium having the same function as can be easily conceived by those skilled in the art.

[0026] The processing unit 110 executes the operating system 130 to manage the hardware (processor, memory, network card, etc.) in the network packet processing device 100, determine system resource supply and demand, and control input and output devices, among other basic tasks. Simultaneously, the operating system 130 also provides a user interface for interacting with the network packet processing device 100. In one embodiment, the architecture of the operating system 130 may include a hardware abstraction layer, a system service layer, and a subsystem layer. The system service layer provides a unified library of function calls, while the subsystem layer, located above the system service layer, operates in user mode and prevents user programs from performing illegal actions.

[0027] In one embodiment, the analysis unit 140 may be an analysis program for a pre-built database. In other embodiments, the analysis unit 140 may be firmware, a computing chip, or circuitry disposed in the network packet processing device 100. The analysis unit 140 may be stored in a data storage unit in the network packet processing device 100, or may be an application installed in the operating system 130, or may be part of the operating system. In other embodiments, the operating system 130 includes a system service layer, and the analysis unit 140 is disposed / installed on the upper layer of the system service layer.

[0028] like Figure 1 As shown, the analysis unit 140 includes an analysis module 141 and multiple honeypot units H1 to Hn, and stores a response table T (e.g., stored in memory). In one embodiment, the analysis module 141 is a pre-built operating program in the analysis unit 140 used to analyze received data, such as analyzing the internal data and composition of a packet or frame. The response table T stores multiple honeypot addresses corresponding to the honeypot units H1 to Hn. The honeypot units H1 to Hn can also be implemented by independent applications and independently connected to the analysis unit 140. In other words, the honeypot units implemented by the application can be driven by other hardware devices, and are not limited to the analysis unit 140 in the network packet processing device 100. The honeypot address may include at least one of various parameters such as Internet Protocol address (IP address), Media Access Control address (MAC address), Fully Qualified Domain Name (FQDN), or Transport Port Code. In some embodiments, the response table T may include a first honeypot address T1 and a second honeypot address T2, where the first honeypot address T1 may be an IP address and the second honeypot address T2 may be a MAC address.

[0029] The network packet processing device 100 of the present disclosure is used to construct a "honeypot system". A honeypot is a network host specially designed with security vulnerabilities but closely monitored to attract intruders (attackers, hackers) to attack. The honeypot records attack behaviors and data during the attack of the intruder and traces and investigates the intruder. Since those skilled in the art can understand the construction and operation principle of the honeypot, no further description is provided herein.

[0030] The honeypot can be a physical device or a virtual device generated by software. In some technologies, a separate operating system needs to be installed for the physical device or the virtual device to enable the intruder to believe that the honeypot is a real attack target (such as a terminal device, a communication device, a mechanical arm, etc.).

[0031] In the present embodiment, the honeypot units H1-Hn also have logic modules and functional modules for recording and tracing the intruder, but do not need to install a separate operating system. The processing unit 110 sends and receives data packets for the honeypot units H1-Hn through the operating system 130 and the network interface card 120, so the analysis unit 140 does not need to set a complete operating system for each honeypot unit H1-Hn.

[0032] When the network packet processing device 100 receives data packets from the Internet through the network interface card 120 and the operating system 130, the processing unit 110 transmits the data packets to the analysis unit 140. The analysis unit 140 obtains the data packets from the network interface card 120 and determines whether the data packets correspond to any honeypot address in the response table T through the analysis module 141. Specifically, the analysis module 141 first analyzes a destination address in the data packets and then determines whether the destination address corresponds to any honeypot address. In an embodiment, the destination address refers to the source address of layer 2 (data link layer) and layer 3 (network layer) in the OSI (open system interconnection) seven-layer architecture, such as the IP address and the MAC address mentioned above.

[0033] When the analysis module 141 determines that the destination address of the data packet corresponds to one of the honeypot addresses, if the analysis module 141 further determines that the data packet needs to be responded, the analysis module 141 will selectively generate response information according to the honeypot address or a preset address. The analysis module 141 will send the response information through the processing unit 110 and the network interface card 120 with the honeypot address or the preset address. Accordingly, since the network packet processing device 100 runs the operating system to drive the network interface card 120 through the processing unit 110 to receive the data packet to the analysis module 141, the analysis module 141 does not need to install a corresponding operating system for each honeypot unit H1-Hn, thereby effectively improving the construction cost of the network packet processing device 100.

[0034] Figure 2 A flowchart of a network packet processing method according to some embodiments of the present disclosure is shown. In step S201, the processing unit 110 controls the network interface card 120 through the operating system 130 to set the network interface card 120 to a promiscuous mode. When the network interface card 120 is in the promiscuous mode, the network interface card 120 will receive all data packets transmitted to the network packet processing device 100, even if the destination address of the data packet is not the network packet processing device 100.

[0035] In step S202, the processing unit 110 transmits the received data packet to the analysis unit 140 through the network interface card 120. The analysis unit 140 determines whether the data packet corresponds to any one of the plurality of honeypot addresses or any one of the plurality of honeypot units.

[0036] If the data packet does not correspond to any honeypot address, in step S203, the analysis module 141 of the analysis unit 140 determines whether a response is needed. If the analysis module 141 determines that a response is needed, the analysis module 141 will generate error information, and the processing unit 110 will return the error information to the Internet.

[0037] In some embodiments, when the data packet does not correspond to any honeypot address or the format of the data packet is incorrect, the analysis unit 140 can use a set of virtual addresses to send error information. This way can be responded by a physical driver in the operating system to ensure resource utilization efficiency.

[0038] In step S204, if the data packet does correspond to one of the honeypot addresses, the analysis module 141 transmits the data packet to the honeypot unit corresponding to the honeypot address. For example, if the destination address in the data packet is "Addla", which corresponds to the first honeypot address Tl of the honeypot unit HI in the response table T, the analysis module 141 transmits the data packet to the honeypot unit HI. In step S205, the honeypot unit HI receiving the data packet generates corresponding response information according to the type and / or content of the data packet, and transmits the response information back to the analysis module 141.

[0039] In step S206, the analysis module 141 determines whether to send the response information according to a preset address, or whether the honeypot unit HI has specified an address to be used when sending the response information. The "preset address" is used to simulate a firewall. When the network packet processing device 100 transmits the response information according to the preset address, the intruder receiving the response information will think that the honeypot unit is behind a firewall, and thus the information is responded to according to the address of the firewall.

[0040] If the analysis module 141 determines to send the response information according to the preset address, or the honeypot unit has not specified an address to be used when sending the response information, in step S207, the analysis module transmits the response information according to the preset address through the processing unit 110, the operating system 130, and the network interface card 120.

[0041] If the analysis module 141 determines not to send the response information according to the preset address, or the honeypot unit has specified a specific address (i.e., the corresponding honeypot address) to be used when transmitting the response information, in step S208, the analysis module transmits the response information according to the corresponding honeypot address in the response table through the processing unit 110, the operating system 130, and the network interface card 120. In other words, the analysis module 141 selectively transmits the response information according to the honeypot address or the preset address.

[0042] In an embodiment, the response table T can further store a plurality of response setting conditions, each of which corresponds to one of the honeypot units HI-Hn. Each response setting condition sets the manner of response to be sent by the corresponding honeypot unit HI-Hn when receiving a data packet. In other words, the analysis module 141 can determine the result of the aforementioned step S206 according to the response setting conditions in the response table T. The response setting conditions are generated according to the type of device simulated by each honeypot unit HI-Hn. For example, if the honeypot units HI-Hn simulate a robot arm on a production line, and the management network of the robot arm is usually protected by a firewall, the response setting condition of the honeypot units HI-Hn will be "respond according to the preset address when the honeypot units HI-Hn simulate the robot arm behind the firewall", so as to ensure that the response information can make the intruder mistakenly think that a device behind a firewall has been successfully attacked.

[0043] In one embodiment, the network packet processing device 100 of the present disclosure installs the analysis unit 140 in the operating system, and sets the honeypot unit in a software simulation manner. Accordingly, when the virtual honeypot unit needs to respond to information, the response can be uniformly performed by the operating system 130 through the physical driver, thereby having better resource utilization.

[0044] The elements, method steps, or technical features in the foregoing embodiments can be combined with each other without being limited by the order of the textual description or the order presented in the drawings.

[0045] Although the present disclosure has been disclosed in the above embodiments, it is not intended to limit the present disclosure, and any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present disclosure, and therefore the protection scope of the present disclosure shall be subject to the claims.

Claims

1. A network packet processing apparatus, comprising: a processing unit electrically connected to a network interface card; an operating system configured to cooperate with the processing unit to control the network interface card to be in a promiscuous mode to receive a data packet from a network; and an analyzing unit configured to obtain the data packet from the network interface card and to parse a destination address in the data packet, wherein the analyzing unit further comprises a plurality of honeypot units and stores a plurality of honeypot addresses corresponding to the plurality of honeypot units, and the analyzing unit is configured to selectively send a response message with one of the plurality of honeypot addresses or a preset address when the analyzing unit determines that the destination address of the data packet corresponds to one of the plurality of honeypot addresses; wherein the preset address is used to simulate a firewall; wherein the analyzing unit further comprises a response table storing the plurality of honeypot addresses, and the analyzing unit determines to send the response message with one of the plurality of honeypot addresses or the preset address according to a response setting condition in the response table.

2. The network packet processing apparatus of claim 1, wherein the analyzing unit is installed in the operating system.

3. The network packet processing apparatus of claim 1, wherein the operating system comprises a system service layer, and the analyzing unit is disposed in an upper layer of the system service layer.

4. The network packet processing apparatus of claim 1, wherein one of the plurality of honeypot addresses comprises at least one of an Internet Protocol address, a Media Access Control address or a transmission port code.

5. The network packet processing apparatus of claim 1, wherein the analyzing unit generates an error message when the analyzing unit determines that the destination address of the data packet does not correspond to one of the plurality of honeypot addresses.

6. A network packet processing method, comprising: setting a network interface card in a promiscuous mode by a processing unit and an operating system to receive a data packet from a network; parsing a destination address of the data packet by an analyzing unit, wherein the analyzing unit comprises a response table and stores a plurality of honeypot addresses corresponding to a plurality of honeypot units; when the destination address of the data packet corresponds to one of the plurality of honeypot addresses, transferring the data packet to the honeypot unit corresponding to one of the plurality of honeypot addresses; and selectively sending a response message with one of the plurality of honeypot addresses or a preset address; wherein the preset address is used to simulate a firewall; wherein the method of sending the response message comprises: determining to send the response message with one of the plurality of honeypot addresses or the preset address according to a response setting condition stored by the analyzing unit.

7. The network packet processing method of claim 6, wherein the analyzing unit is installed in the operating system.

8. The network packet processing method of claim 6, wherein the operating system comprises a system service layer, and the analyzing unit is disposed in an upper layer of the system service layer.

9. The network packet processing method of claim 6, wherein one of the plurality of honeypot addresses comprises at least one of an Internet Protocol address, a Media Access Control address, or a Transmission Port Code.

10. The network packet processing method of claim 6, further comprising: generating an error message when the destination address of the data packet does not correspond to one of the plurality of honeypot addresses.

11. A network packet processing apparatus, comprising: a processing unit electrically connected to a network interface card; an operating system configured to cooperate with the processing unit to control the network interface card to be in a promiscuous mode to receive a data packet from a network; and an analyzing unit configured to receive the data packet, wherein the analyzing unit further comprises a plurality of honeypot units and is configured to store a plurality of honeypot addresses corresponding to the plurality of honeypot units and a response table storing the plurality of honeypot addresses, and when the analyzing unit determines that the data packet corresponds to one of the plurality of honeypot addresses, the analyzing unit determines whether to send a response message with a preset address according to a response setting condition of the one of the plurality of honeypot addresses; wherein the preset address is used to simulate a firewall; wherein when the analyzing unit determines not to send the response message with the preset address, the analyzing unit is configured to send the response message with the one of the plurality of honeypot addresses.

12. The network packet processing apparatus of claim 11, wherein the analyzing unit is configured to determine whether a destination address of the data packet corresponds to one of the plurality of honeypot addresses to determine whether the data packet corresponds to one of the plurality of honeypot addresses.

13. The network packet processing apparatus of claim 11, wherein the analyzing unit is installed in the operating system.

14. The network packet processing apparatus of claim 11, wherein the operating system comprises a system service layer, and the analyzing unit is disposed in an upper layer of the system service layer.

15. The network packet processing apparatus of claim 11, wherein one of the plurality of honeypot addresses comprises at least one of an Internet Protocol address, a Media Access Control address, or a Transmission Port Code.

16. The network packet processing apparatus of claim 11, wherein when the analyzing unit determines that the data packet does not correspond to one of the plurality of honeypot addresses, the analyzing unit generates an error message.

Images