A double LSA attack defense method, device, equipment and storage medium

Abstract

The present application discloses a double LSA attack defense method, device, equipment and storage medium, which relates to the field of network security technology, including: when the first LSA message and the second LSA message are obtained successively within a preset time range, it is judged in turn whether the two LSA messages are sent by itself; if they are sent by itself, it is judged in turn whether the two LSA messages are new messages; if they are old messages, it is judged in turn whether the LSA information carried in the two LSA messages is the same as the LSA information recorded in the local link state database; if not, it is determined that the network communication device node has been attacked by a double LSA, and a new LSA instance with a link state sequence number larger than the LSA message is generated in turn, and the new LSA instance is encapsulated into a message and sent to the network. The present application can effectively defend against the persistent harm caused by the double LSA message attack, enhance the security and reliability of network equipment, and correct the erroneous LSA data of the attacked network equipment in the network.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a double LSA attack defense method, device, equipment and storage medium. Background Art

[0002] The rapid development of the Internet has brought about the continuous growth of network scale and the increasing complexity of topology, and has also posed a huge challenge to cyber security, which has become one of the important factors restricting the development of the Internet. OSPF (Open Shortest Path First) has become the most widely used routing protocol in network deployment. As a typical link state protocol, OSPF publishes routes in the form of LSA (Link State Advertisement) and relies on the interaction of OSPF messages between devices in the OSPF area to achieve the unification of routing information.

[0003] However, in the actual network environment, there is a large amount of maliciously forged false OSPF routing information. If there are no preventive measures, the routing information will be tampered with. When malicious routing information is inserted and flooded into the network, it will cause cascading network paralysis.

[0004] At present, for common single LSA attack, such as maximum sequence number attack, sequence number increment attack, maximum age attack, periodic injection LSA attack, etc., although it can cause routing information to be tampered, the counterattack protection mechanism that OSPF carries, such as reliable authentication mechanism, hierarchical routing, bidirectional link mechanism, counterattack mechanism, etc., can make the tampered routing information be corrected, and its influence is short-lived. But for double LSA attack, including triggering LSA and camouflage LSA, due to utilizing the defect of OSPF checksum predictability, such as when the OSPF router in the network receives the camouflage LSA, the link state database (LSDB, Link State Data Base) is updated, but due to the counterattack LSA used to counter the described triggering LSA may arrive later than the camouflage LSA, it will be mistakenly regarded as a copy and discarded, making the counterattack LSA invalid, so the double LSA attack can circumvent the counterattack mechanism that OSPF carries, and, once the attacker controls a certain internal device in the network, and obtains the key value of MD5 (Message-Digest Algorithm, information digest algorithm) by a special method, initiates this type of attack, the harm to the network autonomous system constructed by the OSPF protocol is serious and lasting. In addition, updating the link state database will increase fields, which will lead to the problem of large memory space occupation of network communication equipment.

[0005] In summary, how to defend against the most serious and persistent double LSA attack in OSPF protocol attacks is a problem that needs to be further solved. Summary of the invention

[0006] In view of this, the purpose of this application is to provide a double LSA attack defense method, device, equipment and storage medium, which can effectively defend against the persistent harm caused by double LSA message attacks without increasing the fields of the OSPF link state database, enhance the security and reliability of network devices, and correct the erroneous LSA data of the attacked network devices in the network. The specific scheme is as follows:

[0007] In a first aspect, the present application discloses a dual LSA attack defense method, which is applied to a network communication device node supporting the OSPF protocol, comprising:

[0008] When the first LSA message and the second LSA message are obtained successively within a preset time range, determining in turn whether the first LSA message and the second LSA message are sent by itself;

[0009] If the first LSA message and the second LSA message are sent by the first LSA message and the second LSA message, determining in sequence whether the first LSA message and the second LSA message are new messages;

[0010] If the first LSA message and the second LSA message are old messages, determining in sequence whether the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database;

[0011] If not, it is determined that the network communication device node has been attacked by a double LSA, and a first new LSA instance with a link state sequence number larger than that of the first LSA message and a second new LSA instance with a link state sequence number larger than that of the second LSA message are generated in sequence, and the first new LSA instance and the second new LSA instance are encapsulated into a message and sent to the network to correct the erroneous LSA information in all the network communication device nodes attacked in the network.

[0012] Optionally, the determining whether the first LSA message and the second LSA message are sent by the user includes:

[0013] Determine whether the first LSA message and the second LSA message are sent by itself according to the link state ID and the advertising router in the first LSA message and the second LSA message.

[0014] Optionally, after determining whether the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database, the method further includes:

[0015] If the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database, the first LSA message and the second LSA message are discarded as copies.

[0016] Optionally, the correcting the erroneous LSA information in all network communication device nodes attacked in the network includes:

[0017] When other network communication device nodes in the network except the network communication device node receive the first new LSA instance and the second new LSA instance, the LSA information stored in the link state database thereof is overwritten with the LSA information carried in the first new LSA instance and the second new LSA instance in turn.

[0018] Optionally, the determining whether the LSA information carried in the first LSA message is the same as the LSA information recorded in the local link state database includes:

[0019] Respectively obtain the length of the first LSA message and the LSA information in the local link state database to obtain corresponding first length and second length;

[0020] Respectively obtain the first LSA message and the content of the LSA information in the local link state database to obtain corresponding first content and second content;

[0021] It is determined whether the first length and the second length, and the first content and the second content are the same.

[0022] Optionally, if not, determining that the network communication device node is attacked by a double LSA includes:

[0023] If the first length and the second length, and / or the first content and the second content are different, it is determined that the network communication device node is attacked by a double LSA.

[0024] Optionally, the determining whether the first LSA message and the second LSA message are new messages includes:

[0025] According to the LSA new and old comparison principle, it is determined whether the first LSA message and the second LSA message are new messages.

[0026] In a second aspect, the present application discloses a dual LSA attack defense device, which is applied to a network communication device node supporting the OSPF protocol, including:

[0027] A first judgment module, configured to, when the first LSA message and the second LSA message are acquired successively within a preset time range, determine in sequence whether the first LSA message and the second LSA message are sent by itself;

[0028] A second judgment module, configured to judge in sequence whether the first LSA message and the second LSA message are new messages if the first LSA message and the second LSA message are sent by the first LSA message and the second LSA message;

[0029] A third judgment module, used for judging whether the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database in turn if the first LSA message and the second LSA message are old messages;

[0030] A double LSA attack determination module, configured to determine that the network communication device node is under a double LSA attack if the LSA information carried in the first LSA message and the second LSA message is different from the LSA information recorded in the local link state database;

[0031] An attack defense module is used to sequentially generate a first new LSA instance with a link state sequence number greater than that of the first LSA message and a second new LSA instance with a link state sequence number greater than that of the second LSA message, and then encapsulate the first new LSA instance and the second new LSA instance into a message and send it to the network to correct the erroneous LSA information in all network communication device nodes attacked in the network.

[0032] In a third aspect, the present application discloses an electronic device, comprising a processor and a memory; wherein the processor implements the aforementioned double LSA attack defense method when executing a computer program stored in the memory.

[0033] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned double LSA attack defense method is implemented.

[0034] It can be seen that the present application is applied to a network communication device node supporting the OSPF protocol. When the first LSA message and the second LSA message are obtained successively within a preset time range, it is judged in turn whether the first LSA message and the second LSA message are sent by itself; if the first LSA message and the second LSA message are sent by itself, it is judged in turn whether the first LSA message and the second LSA message are new messages; if the first LSA message and the second LSA message are old messages, it is judged in turn whether the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database; if not, it is determined that the network communication device node has been attacked by a double LSA, and a first new LSA instance with a link state sequence number larger than the first LSA message and a second new LSA instance with a link state sequence number larger than the second LSA message are generated in turn, and the first new LSA instance and the second new LSA instance are encapsulated into messages and sent to the network to correct the erroneous LSA information in all network communication device nodes attacked in the network. The present application adds OSPF attack detection and defense functions to network communication device nodes that support the OSPF routing protocol, and can effectively identify and defend against double LSA attacks in network communication device nodes, thereby effectively defending against the persistent harm caused by double LSA message attacks without increasing the fields of the OSPF link state database, enhancing the security and reliability of network communication equipment, and immediately notifying a correct new LSA instance to the network when a maliciously forged double LSA attack message is identified, thereby correcting the erroneous LSA data in the attacked node in the network, and there is no need to find the router or host of the double LSA attack message, and LSA attacks can be accurately identified without the help of third-party detection equipment. In addition, the present application can also provide guidance for the defense of other protocol attacks, and at the same time solve the problem of excessive space and memory usage caused by adding fields. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0036] Figure 1 A flow chart of a double LSA attack defense method disclosed in this application;

[0037] Figure 2 A schematic diagram of a specific LSA field structure disclosed in this application;

[0038] Figure 3 A flow chart of a specific double LSA attack defense method disclosed in this application;

[0039] Figure 4 A schematic diagram of the structure of a dual LSA attack defense device disclosed in this application;

[0040] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0042] The present application embodiment discloses a dual LSA attack defense method, which is applied to a network communication device node supporting the OSPF protocol. Figure 1 As shown, the method includes:

[0043] Step S11: when the first LSA message and the second LSA message are acquired successively within a preset time range, it is determined in turn whether the first LSA message and the second LSA message are sent by itself.

[0044] In this embodiment, when any network communication device node supporting the OSPF protocol in the network successively obtains two LSA messages within a preset time range (such as within 5 seconds), the following operations are performed in sequence when the LSA messages are obtained: in chronological order, for the first LSA message obtained first, when the first LSA message is obtained, the network communication device node determines whether it is sent by itself; for the second LSA message obtained later, the network communication device node determines whether it is sent by itself. Wherein, the network communication device node supporting the OSPF protocol includes but is not limited to routers, hosts, etc., and the first LSA message and the second LSA message are a specific type of OSPF message.

[0045] In a specific implementation manner, the determining whether the first LSA message and the second LSA message are sent by the router itself may include: determining whether the first LSA message and the second LSA message are sent by the router itself according to the link state ID and the advertising router in the first LSA message and the second LSA message. Figure 2 As shown, Figure 2The structure of the LSA message is shown, which specifically includes field information such as link state aging time, link state ID, notification router, link state sequence number, link state checksum, and LSA content field. In this embodiment, when the first LSA message and the second LSA message are successively obtained within a preset time range, they can be analyzed in turn, and the link state ID (Identity Document, ID card identification number) and the notification router carried in the first LSA message and the second LSA message are compared with the information of the network communication device node itself. If the two are the same, it means that the LSA message is sent by the network communication device node itself, and if the two are different, it means that the LSA message is not sent by itself.

[0046] Step S12: If the first LSA message and the second LSA message are sent by themselves, it is determined in turn whether the first LSA message and the second LSA message are new messages.

[0047] In this embodiment, after determining in turn whether the first LSA message and the second LSA message are sent by themselves, if it is determined through comparative analysis that the first LSA message and the second LSA message are sent by themselves, it can be further determined whether the first LSA message and the second LSA message are new messages.

[0048] Specifically, the determining whether the first LSA message and the second LSA message are new messages may include: determining whether the first LSA message and the second LSA message are new messages according to the LSA new and old comparison principle. For example, according to the routing information carried in the first LSA message and the second LSA message, such as using Figure 2The link state sequence number, link state checksum, link state aging time, options, type, and length other than the link state ID, the advertising router, and the LSA content field are determined, and the first LSA message and the second LSA message are judged whether they are new messages according to the preset LSA old and new comparison principle. The LSA old and new comparison principle specifically includes: the LSA message with a higher link state sequence number is considered the latest; the LSA message with a larger checksum is considered the latest; if the aging time in the received LSA message is set to Max-Age (the default is 1 hour), the LSA message is considered the latest; when the aging time of the local LSA message and the newly received LSA message exceeds Max-Age-Diff (the default is 15 minutes), the two LSAs are considered to be different messages, and the LSA message with the smaller aging time is considered to be the latest message; if the above four points cannot be judged, the two LSA messages are considered to be the same LSA message. It should be noted that the above LSA comparison principle is to match from top to bottom. When a certain rule is matched, subsequent matching will not be continued.

[0049] It should be pointed out that when other network communication device nodes in the network except the above-mentioned network communication device node receive the above-mentioned first LSA message and the above-mentioned second LSA message, they will also judge whether the above-mentioned first LSA message and the above-mentioned second LSA message are new messages in turn. If the judgment result is a new message, the LSA information carried in the above-mentioned first LSA message and the above-mentioned second LSA message will be directly used to update the LSA information in its own link state database.

[0050] It should be noted that when the first LSA message and the second LSA message are not sent by the current node, the current node will also determine whether the first LSA message and the second LSA message are new messages in turn. If the judgment result is a new message, the current node will directly use the LSA information carried in the first LSA message and the second LSA message to update the LSA information in its own link state database. If it is an old message, it will be automatically discarded.

[0051] Step S13: If the first LSA message and the second LSA message are old messages, it is determined in turn whether the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database.

[0052] In this embodiment, if it is determined that the above-mentioned first LSA message and the above-mentioned second LSA message are old messages, the LSA information carried in the above-mentioned first LSA message and the above-mentioned second LSA message is further compared with the LSA information already recorded in the local link state database in sequence, and it is determined whether the LSA information carried in the above-mentioned first LSA message and the above-mentioned second LSA message is the same as the LSA information stored in the local link state database.

[0053] It should be noted that after determining whether the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database, the method further includes: if the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database, the first LSA message and the second LSA message are discarded as copies. In this embodiment, if the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database, it means that the received LSA message has not been attacked by LSA and is an old message sent by itself, and can be directly discarded as a copy.

[0054] Step S14: If not, it is determined that the network communication device node has been attacked by a double LSA, and a first new LSA instance with a link state sequence number larger than that of the first LSA message and a second new LSA instance with a link state sequence number larger than that of the second LSA message are generated in sequence, and the first new LSA instance and the second new LSA instance are encapsulated into a message and sent to the network to correct the erroneous LSA information in all the network communication device nodes attacked in the network.

[0055] In this embodiment, if the LSA information carried in the above-mentioned first LSA message and the above-mentioned second LSA message is different from the LSA information recorded in the local link state database, it indicates that the network communication device node has been subjected to a malicious double LSA attack. At this time, it can be determined that the above-mentioned first LSA message is a triggering LSA in the double LSA attack, and the above-mentioned second LSA message is a disguised LSA in the double LSA attack. Furthermore, corresponding measures can be taken to counter the double LSA attack. Specifically, for the above-mentioned first LSA message, a first new LSA instance with a link state sequence number larger than that of the above-mentioned first LSA message can be generated, and the above-mentioned local link state database can be updated, and then the above-mentioned first new LSA instance can be encapsulated into a message supporting the OSPF protocol and sent to the network; similarly, for the above-mentioned second LSA message, a second new LSA instance with a link state sequence number larger than that of the above-mentioned second LSA message can be generated, and then the above-mentioned second new LSA instance can be encapsulated into a message supporting the OSPF protocol and sent to the network. In this way, all network communication device nodes attacked in the network can use the obtained first new LSA instance and the second new LSA instance to correct the erroneous LSA information stored in their own link state database.

[0056] It can be seen that the embodiment of the present application is applied to a network communication device node that supports the OSPF protocol. When the first LSA message and the second LSA message are successively obtained within a preset time range, it is determined in turn whether the first LSA message and the second LSA message are sent by itself; if the first LSA message and the second LSA message are sent by itself, it is determined in turn whether the first LSA message and the second LSA message are new messages; if the first LSA message and the second LSA message are old messages, it is determined in turn whether the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database; if not, it is determined that the network communication device node has been attacked by a double LSA, and a first new LSA instance with a link state sequence number larger than the first LSA message and a second new LSA instance with a link state sequence number larger than the second LSA message are generated in turn, and the first new LSA instance and the second new LSA instance are encapsulated into messages and sent to the network to correct the erroneous LSA information in all network communication device nodes attacked in the network. The embodiment of the present application adds OSPF attack detection and defense functions to network communication device nodes that support the OSPF routing protocol, so that the network communication device nodes can effectively identify and defend against double LSA attacks, thereby effectively defending against the persistent harm caused by double LSA message attacks without increasing the fields of the OSPF link state database, enhancing the security and reliability of network communication equipment, and immediately notifying a correct new LSA instance to the network when a maliciously forged double LSA attack message is identified, thereby correcting the erroneous LSA data in the attacked node in the network, and there is no need to find the router or host of the double LSA attack message, and the LSA attack can be accurately identified without the help of a third-party detection device. In addition, the embodiment of the present application can also provide guidance for the defense of other protocol attacks, and at the same time solve the problem of excessive space and memory usage caused by adding fields.

[0057] The present application embodiment discloses a specific double LSA attack defense method, which is applied to a network communication device node supporting the OSPF protocol. Figure 3 As shown, the method includes:

[0058] Step S21: when the first LSA message and the second LSA message are acquired successively within a preset time range, determine whether the first LSA message and the second LSA message are sent by itself according to the link state ID and the advertising router in the first LSA message and the second LSA message.

[0059] Step S22: If the first LSA message and the second LSA message are sent by themselves, then judging whether the first LSA message and the second LSA message are new messages according to the LSA new and old comparison principle.

[0060] Step S23: If the first LSA message and the second LSA message are old messages, it is determined in turn whether the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database.

[0061] In this embodiment, if the first LSA message and the second LSA message are old messages, the LSA information carried in the first LSA message and the second LSA message are compared with the LSA information recorded in the local link state database in turn, and it is determined whether the information contained in the two is the same.

[0062] In a specific implementation, the determination of whether the LSA information carried in the first LSA message is the same as the LSA information recorded in the local link state database may specifically include: obtaining the length of the first LSA message and the LSA information in the local link state database, respectively, to obtain the corresponding first length and second length; obtaining the content of the first LSA message and the LSA information in the local link state database, respectively, to obtain the corresponding first content and second content; and determining whether the first length and the second length, and the first content and the second content are the same. That is, when determining whether the LSA information carried in the LSA message is the same as the LSA information recorded in the local link state database, whether the LSA messages are the same is determined specifically by the length and content of the LSA information. For example, assuming that the LSA information in the received LSA message is A, and the LSA information in the local link state database is B, based on the principle of comparing the old and new LSAs, determine whether A and B are the same. If they are the same, further perform the following comparison: obtain the length field (lsaLength) of A, obtain the LSA header (LSA Header) address addressA of A and the LSA header address addressB of B, and then compare the contents of A and B: Memcomp(A.addressA+length(LSAHeader),A.addressB+length(LSA Header),lsaLength). If they are the same, no processing is performed. If they are different, it is considered that a double LSA attack has been carried out.

[0063] Step S24: If not, it is determined that the network communication device node has been attacked by a double LSA, and a first new LSA instance with a link state sequence number larger than that of the first LSA message and a second new LSA instance with a link state sequence number larger than that of the second LSA message are generated in sequence, and the first new LSA instance and the second new LSA instance are encapsulated into a message and sent to the network.

[0064] In this embodiment, if the LSA information carried in the above-mentioned first LSA message and the above-mentioned second LSA message is different from the LSA information recorded in the local link state database, that is, there is at least one difference between the above-mentioned first length and the above-mentioned second length and the above-mentioned first content and the above-mentioned second content, then it can be determined that the above-mentioned network communication device node has been attacked by a double LSA, and then a first new LSA instance with a larger link state sequence number than the above-mentioned first LSA message and a second new LSA instance with a larger link state sequence number than the above-mentioned second LSA message are generated in sequence, and then the above-mentioned first new LSA instance and the above-mentioned second new LSA instance are encapsulated to obtain a new message supporting the OSPF protocol and send it to the network.

[0065] Step S25: When other network communication device nodes in the network except the network communication device node receive the first new LSA instance and the second new LSA instance, they use the LSA information carried in the first new LSA instance and the second new LSA instance to overwrite the LSA information stored in their own link state databases.

[0066] In this embodiment, after a first new LSA instance having a link state sequence number greater than that of the first LSA message and a second new LSA instance having a link state sequence number greater than that of the second LSA message are notified to the network, when other network communication device nodes in the network except the above-mentioned network communication device node receive the above-mentioned first new LSA instance and the second new LSA instance, the LSA information already stored in their own link state database is overwritten with the LSA information carried in the above-mentioned first new LSA instance and the above-mentioned second new LSA instance in turn, that is, the erroneous LSA information in their own link state database is updated, thereby correcting the LSA information that has been attacked.

[0067] For more specific processing procedures of the above steps S21 and S22, reference may be made to the corresponding contents disclosed in the above embodiments, which will not be described in detail here.

[0068] It can be seen that if the embodiment of the present application obtains, within a preset time range, that the LSA information carried in the first LSA message and the second LSA message is different from the LSA information recorded in the local link state database, it is determined that the network communication device node has been attacked by a double LSA, and a first new LSA instance with a link state sequence number larger than that of the first LSA message and a second new LSA instance with a link state sequence number larger than that of the second LSA message are successively notified to the network. When other network communication device nodes in the network except the network communication device node receive the first new LSA instance and the second new LSA instance, they utilize the first new LSA instance and the second in turn. The embodiment of the present application does not need to find out the network communication device node of the attacked message. Without the help of a third-party detection device, the network communication device node of the attacked message can judge the received LSA message forged as sent by itself, and further compare the specific content contained in the LSA message with its own link state database information in detail. If they are different, it is considered to have been attacked by a double LSA, and a correct new LSA instance is notified to the network, thereby correcting the erroneous LSA information in all the network communication device nodes attacked in the network. In this way, the double LSA attack can be accurately identified and effectively defended, thereby enhancing the security and reliability of the network.

[0069] Correspondingly, the embodiment of the present application also discloses a dual LSA attack defense device, which is applied to a network communication device node supporting the OSPF protocol, see Figure 4 As shown, the device comprises:

[0070] A first judgment module 11 is used to determine whether the first LSA message and the second LSA message are sent by itself in sequence when the first LSA message and the second LSA message are obtained successively within a preset time range;

[0071] A second judgment module 12 is used to judge whether the first LSA message and the second LSA message are new messages in sequence if the first LSA message and the second LSA message are sent by themselves;

[0072] A third judgment module 13 is used for judging whether the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database in turn if the first LSA message and the second LSA message are old messages;

[0073] A double LSA attack determination module 14, configured to determine that the network communication device node is under a double LSA attack if the LSA information carried in the first LSA message and the second LSA message is different from the LSA information recorded in the local link state database;

[0074] The attack defense module 15 is used to sequentially generate a first new LSA instance with a link state sequence number greater than that of the first LSA message and a second new LSA instance with a link state sequence number greater than that of the second LSA message, and then encapsulate the first new LSA instance and the second new LSA instance into a message and send it to the network to correct the erroneous LSA information in all network communication device nodes attacked in the network.

[0075] Among them, the specific working processes of the above-mentioned modules can refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0076] It can be seen that the embodiment of the present application is applied to a network communication device node that supports the OSPF protocol. When the first LSA message and the second LSA message are successively obtained within a preset time range, it is determined in turn whether the first LSA message and the second LSA message are sent by itself; if the first LSA message and the second LSA message are sent by itself, it is determined in turn whether the first LSA message and the second LSA message are new messages; if the first LSA message and the second LSA message are old messages, it is determined in turn whether the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database; if not, it is determined that the network communication device node has been attacked by a double LSA, and a first new LSA instance with a link state sequence number larger than the first LSA message and a second new LSA instance with a link state sequence number larger than the second LSA message are generated in turn, and the first new LSA instance and the second new LSA instance are encapsulated into messages and sent to the network to correct the erroneous LSA information in all network communication device nodes attacked in the network. The embodiment of the present application adds OSPF attack detection and defense functions to network communication device nodes that support the OSPF routing protocol, so that the network communication device nodes can effectively identify and defend against double LSA attacks, thereby effectively defending against the persistent harm caused by double LSA message attacks without increasing the fields of the OSPF link state database, enhancing the security and reliability of network communication equipment, and immediately notifying a correct new LSA instance to the network when a maliciously forged double LSA attack message is identified, thereby correcting the erroneous LSA data in the attacked node in the network, and there is no need to find the router or host of the double LSA attack message, and the LSA attack can be accurately identified without the help of a third-party detection device. In addition, the embodiment of the present application can also provide guidance for the defense of other protocol attacks, and at the same time solve the problem of excessive space and memory usage caused by adding fields.

[0077] In some specific embodiments, the first determination module 11 may specifically include:

[0078] The first judging unit is configured to judge whether the first LSA message and the second LSA message are sent by itself according to the link state ID and the advertising router in the first LSA message and the second LSA message.

[0079] In some specific embodiments, after the third judgment module 13, the following may also be included:

[0080] A discard processing unit is used to discard the first LSA message and the second LSA message as copies if the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database.

[0081] In some specific embodiments, the attack defense module 15 may specifically include:

[0082] A data overlay unit is used to overwrite the LSA information stored in its own link state database with the LSA information carried in the first new LSA instance and the second new LSA instance in turn when other network communication device nodes in the network except the network communication device node receive the first new LSA instance and the second new LSA instance.

[0083] In some specific embodiments, the third determination module 13 may specifically include:

[0084] A length information acquisition unit, used to respectively acquire the length of the first LSA message and the LSA information in the local link state database to obtain corresponding first length and second length;

[0085] An example content acquisition unit is used to respectively acquire the content of the first LSA message and the LSA information in the local link state database to obtain corresponding first content and second content;

[0086] The second judging unit is configured to judge whether the first length and the second length, and the first content and the second content are the same.

[0087] In some specific embodiments, the double LSA attack determination module 14 may specifically include:

[0088] The double LSA attack determination unit is used to determine that the network communication device node is attacked by a double LSA if the first length is different from the second length and / or the first content is different from the second content.

[0089] In some specific embodiments, the second determination module 12 may specifically include:

[0090] The new message judging unit is used to judge whether the first LSA message and the second LSA message are new messages according to the LSA new and old comparison principle.

[0091] Furthermore, the present application also discloses an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0092] Figure 5 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the double LSA attack defense method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0093] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0094] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0095] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, and may be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program that can be used to complete the double LSA attack defense method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 may further include a computer program that can be used to complete other specific tasks.

[0096] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed double LSA attack defense method. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, and no further description will be given here.

[0097] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0098] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0099] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0100] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0101] The above is a detailed introduction to a dual LSA attack defense method, device, equipment and storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A double LSA attack defense method, characterized in that: Applicable to network communication device nodes that support the OSPF protocol, including: When the first LSA message and the second LSA message are obtained successively within a preset time range, determining in turn whether the first LSA message and the second LSA message are sent by itself; If the first LSA message and the second LSA message are sent by themselves, then determine whether the first LSA message and the second LSA message are new messages according to the LSA old and new comparison principle; the LSA old and new comparison principle includes: the LSA message with a higher link state sequence number is considered to be the latest; the LSA message with a larger checksum is considered to be the latest; if the aging time in the received LSA message is set to Max-Age, the LSA message is considered to be the latest; when the aging time of the local LSA message and the newly received LSA message exceeds Max-Age-Diff, the LSA message with the smaller aging time is considered to be the latest message; If the first LSA message and the second LSA message are old messages, determining in sequence whether the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database; If not, it is determined that the network communication device node has been attacked by a double LSA, and a first new LSA instance with a link state sequence number larger than that of the first LSA message and a second new LSA instance with a link state sequence number larger than that of the second LSA message are generated in sequence, and the first new LSA instance and the second new LSA instance are encapsulated into a message and sent to the network to correct the erroneous LSA information in all the network communication device nodes attacked in the network.

2. The double LSA attack defense method according to claim 1, characterized in that: The determining whether the first LSA message and the second LSA message are sent by the user includes: Determine whether the first LSA message and the second LSA message are sent by itself according to the link state ID and the advertising router in the first LSA message and the second LSA message.

3. The double LSA attack defense method according to claim 1, characterized in that: After determining whether the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database, the method further includes: If the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database, the first LSA message and the second LSA message are discarded as copies.

4. The double LSA attack defense method according to claim 1, characterized in that: The correcting the erroneous LSA information in all the attacked network communication device nodes in the network comprises: When other network communication device nodes in the network except the network communication device node receive the first new LSA instance and the second new LSA instance, the LSA information stored in the link state database thereof is overwritten with the LSA information carried in the first new LSA instance and the second new LSA instance in turn.

5. The double LSA attack defense method according to claim 1, characterized in that: The determining whether the LSA information carried in the first LSA message is the same as the LSA information recorded in the local link state database includes: Respectively obtain the length of the first LSA message and the LSA information in the local link state database to obtain corresponding first length and second length; Respectively obtain the first LSA message and the content of the LSA information in the local link state database to obtain corresponding first content and second content; It is determined whether the first length and the second length, and the first content and the second content are the same.

6. The double LSA attack defense method according to claim 5, characterized in that: If not, determining that the network communication device node is attacked by a double LSA includes: If the first length and the second length, and / or the first content and the second content are different, it is determined that the network communication device node is attacked by a double LSA.

7. A dual LSA attack defense device, characterized in that: Applicable to network communication device nodes that support the OSPF protocol, including: A first judgment module, configured to, when the first LSA message and the second LSA message are acquired successively within a preset time range, determine in sequence whether the first LSA message and the second LSA message are sent by itself; The second judgment module is used to judge whether the first LSA message and the second LSA message are new messages according to the LSA old-new comparison principle if the first LSA message and the second LSA message are sent by themselves; the LSA old-new comparison principle includes: the LSA message with a higher link state sequence number is considered to be the latest; the LSA message with a larger checksum is considered to be the latest; if the aging time in the received LSA message is set to Max-Age, the LSA message is considered to be the latest; when the aging time of the local LSA message and the newly received LSA message exceeds Max-Age-Diff, the LSA message with a smaller aging time is considered to be the latest message; A third judgment module, used for judging whether the LSA information carried in the first LSA message and the second LSA message is the same as the LSA information recorded in the local link state database in turn if the first LSA message and the second LSA message are old messages; A double LSA attack determination module, configured to determine that the network communication device node is under a double LSA attack if the LSA information carried in the first LSA message and the second LSA message is different from the LSA information recorded in the local link state database; An attack defense module is used to sequentially generate a first new LSA instance with a link state sequence number greater than that of the first LSA message and a second new LSA instance with a link state sequence number greater than that of the second LSA message, and then encapsulate the first new LSA instance and the second new LSA instance into a message and send it to the network to correct the erroneous LSA information in all network communication device nodes attacked in the network.

8. An electronic device, characterized in that: The method comprises a processor and a memory; wherein, when the processor executes the computer program stored in the memory, the double LSA attack defense method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: Used to store a computer program; wherein, when the computer program is executed by a processor, the double LSA attack defense method according to any one of claims 1 to 6 is implemented.

Images