A decoy routing deployment system and method for refractive networks

Abstract

The present invention provides a decoy route deployment system and method for refractive networks. The method comprises: Step 1: constructing a network resource pool, including a censored area AS set and a free area AS set. The censored area AS set is a set of ASs under the actual control of the country / region where the target user is located; the free area AS set is a friendly AS set used to deploy decoy routes to provide the target user with the required network censorship circumvention services; Step 2: using cyberspace mapping technology to monitor and update the status of all ASs in the network resource pool in real time; Step 3: constructing an AS inter-domain topology map based on the status of all ASs in the network resource pool; Step 4: generating a decoy route deployment strategy based on the AS inter-domain topology map using a predetermined iterative solution algorithm; Step 5: distributing the decoy route deployment strategy to the corresponding ASs in the network resource pool to control them to deploy decoy routes according to the decoy route deployment strategy.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security technology, and in particular to a decoy routing deployment system and method for a refractive network. Background Art

[0002] The rapid development of network and communication technologies in recent years has fundamentally changed people's lifestyles. The internet has gradually become an indispensable part of people's daily work, study, entertainment, and daily life. It plays a particularly significant role in sharing daily life, accessing learning and entertainment resources, and disseminating social information. Consequently, some countries and regions around the world monitor and restrict internet access, access to resources, and information dissemination by users within their network control areas. This is known as internet censorship. In terms of form, internet censorship includes two types: content censorship and access censorship.

[0003] To combat network access censorship, researchers have developed a variety of end-to-end censorship circumvention systems, including the widely used Tor, Lantern, and Psiphon. Their core concept is to utilize terminals deployed by project developers or volunteers outside the censored area as proxies to provide network access services to users within the censored area. While end-to-end censorship circumvention systems remain the most widely used and widely deployed censorship circumvention tools worldwide due to their user-friendliness, technical maturity, and superior performance, recent research and cybersecurity incidents have demonstrated, both theoretically and practically, that these systems carry significant security risks. Censors can obtain large amounts of proxy information through resource enumeration and launch blocking attacks, leaving legitimate users within the censored area without proxies.

[0004] Essentially, end-to-end network censorship circumvention systems utilize edge nodes at the network edge as proxies. This allows not only users within the censored area to access proxy information, but also censors with extensive networks and human resources to easily obtain proxy information and launch blocking attacks at minimal cost. Therefore, to defend against resource enumeration and blocking attacks by censors, and to prevent network censorship circumvention systems from becoming trapped in a cat-and-mouse game, different research and development teams from the University of Michigan, the University of Illinois at Urbana-Champaign, and BBN Technologies independently proposed three new end-to-mid architecture network censorship circumvention systems in 2011: Telex, Cirripede, and Decoy Routing. Subsequent technological iterations gradually shaped the concept of "refracting networks." By collaborating with friendly autonomous systems (ASs), refraction networks bring proxies originally located at the network edge into the core, deployed on backbone routers in a process known as decoy routing. When using a refraction network, users select a large number of IP addresses outside the censored area as cover addresses to initiate connections. Decoy routers intercept the user's connection to the cover addresses, hijacking the user's session and proxying the user's data to the actual destination IP address. Refraction networks can significantly increase the cost of censorship for censors, increase the number of available cover addresses, and enhance the secrecy of users using network censorship circumvention services.

[0005] However, as Professor VanderSloot pointed out in his latest work "Running refraction networking for real, Proceedings on Privacy Enhancing Technologies, 2020 (4): 321-355", although the protocol design and prototype system development of decoy routing have been fully studied, its practical application in large-scale networks still faces considerable difficulties and challenges. Specifically, censors can still render the decoy routing deployed in the refraction network ineffective by implementing Routing Around Decoys (RAD) attacks. Considering the RAD attack and the offensive and defensive game between censors and deployers, how to strategically deploy decoy routing to enhance the quality of service and security of users in the refraction network has rarely been reported. Summary of the Invention

[0006] Aiming at the problem of decoy route deployment in a refractive network under a decoy route attack, the present invention provides a decoy route deployment system and method for the refractive network.

[0007] In one aspect, the present invention provides a decoy routing deployment method for a refractive network, comprising:

[0008] Step 1: Build a network resource pool, including reviewing the regional AS set and free zone AS set The censored zone AS set is the AS set actually controlled by the country / region where the target user is located; the free zone AS set is the friendly AS set used to deploy decoy routes to provide the target user with the required network censorship circumvention services;

[0009] Step 2: Monitor and update the status of all ASs in the network resource pool in real time based on cyberspace mapping technology;

[0010] Step 3: Build an inter-AS topology map based on the status of all ASs in the network resource pool;

[0011] Step 4: Generate a decoy routing deployment strategy using a set iterative solution algorithm based on the AS inter-domain topology map;

[0012] Step 5: Send the decoy route deployment policy to the corresponding AS in the network resource pool to control it to deploy the decoy route according to the decoy route deployment policy.

[0013] Furthermore, the cyberspace mapping technology includes at least one of: IP positioning technology, topology mapping technology, router positioning technology based on Traceroute, business relationship inference technology between ASs based on routing table information, and big data processing technology.

[0014] Furthermore, the inter-AS domain topology map adopts any one of a weighted directed inter-AS domain topology map, an unweighted directed inter-AS domain topology map, a weighted undirected inter-AS domain topology map, and an unweighted undirected inter-AS domain topology map.

[0015] Furthermore, step 4 specifically includes:

[0016] Step 4.1: Initialize the review strategy;

[0017] Step 4.2: Based on the inter-AS topology map and the current review policy, a deployment policy solving sub-algorithm in the iterative solution algorithm is used to generate a decoy route deployment policy;

[0018] Step 4.3: Based on the inter-AS topology map and the current decoy routing deployment strategy, a new censorship strategy is generated using the censorship strategy solving sub-algorithm in the iterative solution algorithm;

[0019] Step 4.4: Determine whether the entire iterative solution algorithm has reached the convergence condition. If not, return to step 4.2; if so, use the current decoy routing deployment strategy as the final decoy routing deployment strategy.

[0020] Furthermore, the deployment strategy solving sub-algorithm adopts a greedy algorithm; correspondingly, the deployment strategy solving process specifically includes:

[0021] Step A1: For Any AS in n , calculated in AS n The utility value u of deploying the decoy route n , cost value c n And price / performance ratio n =u n / c n ;

[0022] Step A2: According to ρ n Size pair Arrange all AS in descending order and obtain a new set, denoted as

[0023] Step A3: Under the condition that the deployment cost does not exceed the deployment budget, Select the AS with the highest ranking from the list, store it in the deployment policy s, and then update the deployment cost and move the current AS from Removed; where deployment cost refers to the sum of the cost values ​​of all ASs in deployment policy s;

[0024] Step A4: Repeat step A3 until the deployment cost exceeds the deployment budget. The deployment strategy s at this time is the final decoy routing deployment strategy.

[0025] Furthermore, the review strategy solving sub-algorithm adopts a greedy algorithm; accordingly, the review strategy solving process specifically includes:

[0026] Step B1: For Any AS in m arrive Any AS in n Any potential network path P m,n , calculate the utility value ν of implementing the review m,n and the cost value c m,n ;

[0027] Step B2: All the conditions that satisfy ν m,n >c m,n The potential network path P m,n This is the review strategy.

[0028] Furthermore, the convergence condition is to reach an ε-equilibrium solution.

[0029] Furthermore, the AS status includes the AS number of the audit area, the AS number of the free area, the country / region to which the AS belongs, the AS scale, the business relationship between ASs, and the routing policy information between ASs.

[0030] On the other hand, the present invention provides a decoy routing deployment system for a refractive network, comprising: a network resource pool, a network resource monitoring module, a network topology construction module, a policy generation module, and an instruction issuing module;

[0031] The network resource pool includes a censored zone AS set and a free zone AS set. The censored zone AS set is an AS set under the actual control of the country / region where the target user is located. The free zone AS set is a friendly AS set used to deploy decoy routes to provide the target user with the required network censorship circumvention services.

[0032] The network resource monitoring module is used to monitor and update the status of all ASs in the network resource pool in real time based on network space mapping technology;

[0033] The network topology building module is used to build an AS inter-domain topology map based on the status of all ASs in the network resource pool;

[0034] The strategy generation module is used to generate a decoy routing deployment strategy based on the AS inter-domain topology map using a set iterative solution algorithm;

[0035] The instruction issuing module is used to issue the decoy route deployment strategy to the corresponding AS in the network resource pool to control it to deploy the decoy route according to the decoy route deployment strategy.

[0036] Furthermore, the strategy generation module includes a deployment strategy solution submodule and a review strategy solution submodule;

[0037] The deployment strategy solving submodule is used to generate a decoy routing deployment strategy using the deployment strategy solving subalgorithm in the iterative solution algorithm according to the AS inter-domain topology map and the current review strategy;

[0038] The review strategy solving submodule is used to generate a new review strategy based on the AS inter-domain topology map and the current bait routing deployment strategy using the review strategy solving subalgorithm in the iterative solution algorithm; and to determine whether the entire iterative solution algorithm has reached the convergence condition. If not, the new review strategy is sent to the deployment strategy solving submodule for it to continue to generate a new bait routing deployment strategy. If so, the current bait routing deployment strategy is used as the final bait routing deployment strategy and sent to the instruction issuing module.

[0039] Beneficial effects of the present invention:

[0040] To address the issue of decoy routing deployment in refractive networks under RAD attacks, the present invention provides a decoy routing deployment system and method for refractive networks. The system includes a network status monitoring module that uses cyberspace mapping technology to monitor the status of ASes in the network resource pool in real time. A network topology construction module constructs an inter-AS topology map based on this status information. A policy generation module utilizes an iterative algorithm to generate decoy routing deployment policies based on the attack-defense game between deployers and reviewers. The instruction delivery module then delivers targeted instructions to the corresponding ASes based on the deployment policies. The system and method provided by the present invention support the deployment of multiple mainstream decoy routing protocols, effectively enhancing the security and user service quality of refractive networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A flowchart of a decoy routing deployment method for a refractive network provided by an embodiment of the present invention;

[0042] Figure 2 A block diagram of a decoy routing deployment system for a refractive network provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0043] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0044] Example 1

[0045] like Figure 1 As shown, an embodiment of the present invention provides a decoy routing deployment method for a refractive network, comprising the following steps:

[0046] S101: Build a network resource pool, including reviewing the regional AS set and free zone AS set The censored zone AS set is the AS set actually controlled by the country / region where the target user is located; the free zone AS set is the friendly AS set used to deploy decoy routes to provide the target user with the required network censorship circumvention services;

[0047] For example, the target users of the service may be Internet users in China. The friendly AS can be the set of all ASs in China; the friendly AS can be all ASs actually controlled by countries / regions outside China that do not implement network censorship. is the set of friendly ASs.

[0048] S102: Real-time monitoring and updating of the status of all ASs in the network resource pool based on cyberspace mapping technology;

[0049] Specifically, the cyberspace mapping technology includes at least one of: IP positioning technology, topology mapping technology, router positioning technology based on Traceroute, business relationship inference technology between ASs based on routing table information, and big data processing technology.

[0050] The status of an AS includes the audit area AS number, the free area AS number, the country / region to which the AS belongs, the AS size, the business relationship between ASs, and the routing policy information between ASs.

[0051] For example, for and Any AS m , its state can be expressed as the following tuple form, namely State m =<'number','country','cone','degree'>. The 'number' field indicates the AS m The country=<'ISO','countryname'> field indicates the AS m The ISO identifier and full name of the country / region. The cone=<'numberPrefixes','numberAddresses'> field indicates AS m Scale, degree=<'provider','peer','customer','transit','sibling'>field indicates AS m Business relationships with other ASes and routing policies.

[0052] S103: Build an inter-AS topology map based on the status of all ASs in the network resource pool;

[0053] Specifically, the AS inter-domain topology map adopts any one of a weighted directed AS inter-domain topology map, an unweighted directed AS inter-domain topology map, a weighted undirected AS inter-domain topology map, and an unweighted undirected AS inter-domain topology map. Among them, vertex represents the vertex, edge represents the edge, and weight represents the corresponding weight.

[0054] S104: Generate a decoy routing deployment strategy using a set iterative solution algorithm according to the AS inter-domain topology map;

[0055] Specifically, this embodiment uses an iterative solution algorithm to generate a decoy routing deployment strategy from the perspective of the attack and defense game between the deployer and the reviewer. This step specifically includes the following sub-steps:

[0056] S1041: Initialize review strategy;

[0057] S1042: Generate a decoy routing deployment strategy using a deployment strategy solving sub-algorithm in the iterative solution algorithm according to the inter-AS domain topology map and the current review strategy;

[0058] S1043: Generate a new censorship policy using the censorship policy solving sub-algorithm in the iterative solution algorithm according to the inter-AS domain topology map and the current decoy route deployment policy;

[0059] S1044: Determine whether the entire iterative solution algorithm has reached the convergence condition. If not, return to step S1042; if so, use the current decoy routing deployment strategy as the final decoy routing deployment strategy.

[0060] As an implementation method, the iterative solution algorithm converges to an ε-equilibrium solution. Specifically, the iterative solution algorithm is considered to have reached an ε-equilibrium solution if the utility value of the deployment strategy or review strategy generated during the current iteration does not differ by more than ε from the utility value of the deployment strategy or review strategy generated during the previous iteration.

[0061] S105: Send the decoy route deployment policy to the corresponding AS in the network resource pool to control it to deploy the decoy route according to the decoy route deployment policy.

[0062] To address the issue of decoy routing deployment in refractive networks under RAD attacks, an embodiment of the present invention proposes a decoy routing deployment method for refractive networks. This method uses cyberspace mapping technology to monitor and update the status of ASs in a network resource pool in real time, construct an inter-AS domain topology map, and utilizes an iterative solution algorithm to generate a decoy routing deployment strategy from the perspective of the attack and defense game between deployers and reviewers. This method supports the deployment of multiple current mainstream decoy routing protocols and can effectively enhance the security and user service quality of the refractive network.

[0063] Example 2

[0064] Based on the above embodiment, as an implementable method, the deployment strategy solving sub-algorithm adopts a greedy algorithm; correspondingly, the deployment strategy solving process specifically includes:

[0065] Step A1: For Any AS in n , calculated in AS n The utility value u of deploying the decoy route n , cost value cn And price / performance ratio n =u n / c n ;

[0066] Step A2: According to ρ n Size pair Arrange all AS in descending order and obtain a new set, denoted as

[0067] Step A3: Under the condition that the deployment cost does not exceed the deployment budget, Select the AS with the highest ranking from the list, store it in the deployment policy s, and then update the deployment cost and move the current AS from Removed; where deployment cost refers to the sum of the cost values ​​of all ASs in deployment policy s;

[0068] Step A4: Repeat step A3 until the deployment cost exceeds the deployment budget. The deployment strategy s at this time is the final decoy routing deployment strategy.

[0069] Example 3

[0070] Based on the above embodiments, as an implementable method, the review strategy solving sub-algorithm adopts a greedy algorithm; accordingly, the review strategy solving process specifically includes:

[0071] Step B1: For Any AS in m arrive Any AS in n Any potential network path P m,n , calculate the utility value ν of implementing the review m,n and the cost value c m,n ;

[0072] Step B2: All the conditions that satisfy ν m,n >c m,n The potential network path P m,n This is the review strategy.

[0073] Example 4

[0074] Corresponding to the above method, such as Figure 2 As shown, an embodiment of the present invention provides a decoy routing deployment system for a refractive network, including a network resource pool, a network resource monitoring module, a network topology construction module, a policy generation module, and an instruction issuing module;

[0075] The network resource pool includes a set of censored ASes (ASs) under the effective control of the country / region serving the target user, and a set of friendly ASes (ASs) used to deploy decoy routes to provide the target user with the required network censorship circumvention services. The network resource monitoring module uses cyberspace mapping technology to monitor and update the status of all ASes in the network resource pool in real time, reporting this status to the network topology construction module for construction of an inter-AS domain topology map. The network topology construction module constructs an inter-AS domain topology map based on the status of all ASes in the network resource pool and transmits this information to the policy generation module for use in executing its policy solution algorithm. The policy generation module uses a predefined iterative solution algorithm based on the inter-AS domain topology map to generate a decoy route deployment policy and sends it to the instruction distribution module to instruct the corresponding ASes in the network resource pool to deploy the decoy routes. The instruction distribution module distributes the decoy route deployment policy to the corresponding ASes in the network resource pool, directing them to deploy the decoy routes according to the decoy route deployment policy to provide the target user with network censorship circumvention services.

[0076] As an implementable embodiment, the policy generation module includes a deployment policy solution submodule and a review policy solution submodule;

[0077] The deployment strategy solving submodule is used to generate a decoy routing deployment strategy based on the AS inter-domain topology map and the current review strategy using the deployment strategy solving sub-algorithm in the iterative solution algorithm. The review strategy solving submodule is used to generate a new review strategy based on the AS inter-domain topology map and the current decoy routing deployment strategy using the review strategy solving sub-algorithm in the iterative solution algorithm; and to determine whether the entire iterative solution algorithm has reached a convergence condition. If not, the new review strategy is sent to the deployment strategy solving submodule for it to continue to generate a new decoy routing deployment strategy. If so, the current decoy routing deployment strategy is used as the final decoy routing deployment strategy and sent to the instruction issuing module.

[0078] It should be noted that the embodiment of the present invention provides a decoy routing deployment system for refractive networks, which is intended to implement the above-mentioned method embodiments. Its specific functions can be found in the above-mentioned method embodiments and will not be described in detail here.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A decoy routing deployment method for a refractive network, characterized in that: include: Step 1: Build a network resource pool, including reviewing the regional AS set and free zone AS set The censored zone AS set is the AS set actually controlled by the country / region where the target user is located; the free zone AS set is the friendly AS set used to deploy decoy routes to provide the target user with the required network censorship circumvention services; Step 2: Monitor and update the status of all ASs in the network resource pool in real time based on cyberspace mapping technology; Step 3: Build an inter-AS topology map based on the status of all ASs in the network resource pool; Step 4: Based on the AS inter-domain topology map, a set iterative solution algorithm is used to generate a decoy routing deployment strategy; specifically, the following steps are included: Step 4.1: Initialize the review strategy; Step 4.2: Based on the inter-AS topology map and the current review policy, a deployment policy solving sub-algorithm in the iterative solution algorithm is used to generate a decoy route deployment policy; Step 4.3: Based on the inter-AS topology map and the current decoy routing deployment strategy, a new censorship strategy is generated using the censorship strategy solving sub-algorithm in the iterative solution algorithm; Step 4.4: Determine whether the entire iterative solution algorithm has reached the convergence condition. If not, return to step 4.2; if so, use the current decoy routing deployment strategy as the final decoy routing deployment strategy; Step 5: Send the decoy route deployment policy to the corresponding AS in the network resource pool to control it to deploy the decoy route according to the decoy route deployment policy.

2. A decoy routing deployment method for a refractive network according to claim 1, characterized in that: The cyberspace mapping technology includes at least one of: IP positioning technology, topology mapping technology, router positioning technology based on Traceroute, business relationship inference technology between ASes based on routing table information, and big data processing technology.

3. The method for deploying decoy routing in a refractive network according to claim 1, wherein: The AS inter-domain topology map adopts any one of a weighted directed AS inter-domain topology map, an unweighted directed AS inter-domain topology map, a weighted undirected AS inter-domain topology map and an unweighted undirected AS inter-domain topology map.

4. The method for deploying decoy routing in a refractive network according to claim 1, wherein: The deployment strategy solving sub-algorithm adopts a greedy algorithm; accordingly, the deployment strategy solving process specifically includes: Step A1: For Any AS in n , calculated in AS n The utility value u of deploying the decoy route n , cost value c n And price / performance ratio n =u n / c n ; Step A2: According to ρ n Size pair Arrange all AS in descending order and obtain a new set, denoted as Step A3: Under the condition that the deployment cost does not exceed the deployment budget, Select the AS with the highest ranking from the list, store it in the deployment policy s, and then update the deployment cost and move the current AS from Removed; where deployment cost refers to the sum of the cost values ​​of all ASs in deployment policy s; Step A4: Repeat step A3 until the deployment cost exceeds the deployment budget. The deployment strategy s at this time is the final decoy routing deployment strategy.

5. The method for deploying decoy routing in a refractive network according to claim 1, wherein: The review strategy solving sub-algorithm adopts a greedy algorithm; accordingly, the review strategy solving process specifically includes: Step B1: For Any AS in m arrive Any AS in n Any potential network path P m,n , calculate the utility value ν of implementing the review m,n and the cost value c m,n ; Step B2: All the conditions that satisfy ν m,n >c m,n The potential network path P m,n This is the review strategy.

6. The method for deploying decoy routing in a refractive network according to claim 1, wherein: The convergence condition is to reach an ε-equilibrium solution.

7. The method for deploying decoy routing in a refractive network according to claim 1, wherein: The status of the AS includes the AS number of the audit area, the AS number of the free area, the country / region to which the AS belongs, the size of the AS, the business relationship between ASs, and the routing policy information between ASs.

8. A decoy routing deployment system for refractive networks, characterized in that: include: Network resource pool, network resource monitoring module, network topology construction module, policy generation module and instruction issuance module; The network resource pool includes a censored zone AS set and a free zone AS set. The censored zone AS set is an AS set under the actual control of the country / region where the target user is located. The free zone AS set is a friendly AS set used to deploy decoy routes to provide the target user with the required network censorship circumvention services. The network resource monitoring module is used to monitor and update the status of all ASs in the network resource pool in real time based on network space mapping technology; The network topology building module is used to build an AS inter-domain topology map based on the status of all ASs in the network resource pool; The strategy generation module is used to generate a decoy routing deployment strategy based on the AS inter-domain topology map using a set iterative solution algorithm; the strategy generation module includes a deployment strategy solution submodule and a review strategy solution submodule; The deployment strategy solving submodule is used to generate a decoy routing deployment strategy using the deployment strategy solving subalgorithm in the iterative solution algorithm according to the AS inter-domain topology map and the current review strategy; The review strategy solving submodule is used to generate a new review strategy based on the AS inter-domain topology map and the current decoy routing deployment strategy using the review strategy solving subalgorithm in the iterative solution algorithm; and to determine whether the entire iterative solution algorithm has reached a convergence condition. If not, the new review strategy is sent to the deployment strategy solving submodule for it to continue to generate a new decoy routing deployment strategy. If so, the current decoy routing deployment strategy is used as the final decoy routing deployment strategy and sent to the instruction issuing module. The instruction issuing module is used to issue the decoy route deployment strategy to the corresponding AS in the network resource pool to control it to deploy the decoy route according to the decoy route deployment strategy.

Images