Mining protection method, device, electronic device and medium based on source address verification

Abstract

The present invention discloses a mining protection method, device, electronic device and medium based on source address verification, the method comprising: receiving a DNS request packet sent by a terminal; when the DNS request packet is not directed to a designated DNS for domain name resolution, performing terminal access control based on the aging time of the entries in the DHCPv6 Snooping binding table and the ND Snooping binding table in the source address verification. The method can reduce the probability of being infringed from the source and reduce the risk of university terminals being infringed, so as to achieve mining protection.

Description

Technical Field

[0001] The present disclosure relates to the field of Internet technology, and in particular to a mining protection method, device, electronic device and medium based on source address verification. Background Art

[0002] "Mining" is a process of using computer equipment resources (such as computing power, bandwidth, hard disk storage, etc.) to solve complex mathematical operations. At present, there are many high-performance servers, and users' personal network security awareness is relatively weak. There are a large number of computing power and other resources that can be used, so they often become important targets for hacker intrusions and virus transmission to carry out "mining" activities.

[0003] In the process of implementing the concept of the present invention, the applicant discovered that the existing mining protection technology cannot effectively block the mining problem caused by DNS hijacking from the root. Summary of the invention

[0004] In view of this, the main purpose of the present disclosure is to provide a mining protection method, device, electronic device and medium based on source address verification, aiming to partially solve the technical problem that the prior art cannot effectively block the mining caused by DNS hijacking from the root.

[0005] To achieve the above-mentioned purpose, the first aspect of the present disclosure provides a mining protection method based on source address verification, including: receiving a DNS request packet sent by a terminal; when the DNS request packet is not directed to a designated DNS for domain name resolution, performing terminal access control based on the aging time of the entries in the DHCPv6 Snooping binding table and the ND Snooping binding table in the source address verification.

[0006] According to the implementation of the present disclosure, terminal access control based on the aging time of the table entries in the DHCPv6 Snooping binding table and the ND Snooping binding table in the source address verification specifically includes: determining the method for the terminal to obtain the IPv6 source address according to the DNS request packet; when the terminal obtains the IPv6 source address through DHCPv6, deleting the table entry corresponding to the terminal in the DHCPv6 Snooping binding table, and releasing the IPv6 source address of the terminal; when the terminal obtains the IPv6 source address through stateless address automatic configuration, deleting the table entry corresponding to the terminal in the ND Snooping binding table, and sending a message to the terminal that the IPv6 source address has been used.

[0007] According to the implementation of the present disclosure, the DNS request packet includes an Autonomous flag field, a Managed flag field and an Other flag field, wherein the Autonomous flag field is used to indicate whether the terminal obtains the IPv6 source address through stateless address automatic configuration, the Managed flag field is used to indicate that the terminal obtains the IPv6 source address through DHCPv6, and the Other flag field indicates whether parameters other than the IPv6 source address are obtained through DHCPv6.

[0008] According to an implementation of the present disclosure, determining the way in which the terminal obtains the IPv6 source address according to the DNS request packet includes: determining the way in which the terminal obtains the IPv6 source address according to the value of the Autonomous flag field and the value of the Managed flag field.

[0009] According to the implementation of the present disclosure, it also includes: adding the captured mining pool domain name list to the DNS blacklist through the stratum+ssl protocol.

[0010] According to the implementation of the present disclosure, it also includes: obtaining the IPv6 source address through monitoring data, establishing a binding relationship based on the IPv6 source address, source MAC address and access device port for the terminal, and obtaining a DHCPv6 Snooping binding table and an NDSnooping binding table.

[0011] According to an implementation of the present disclosure, a process of acquiring an IPv6 source address by monitoring data through a simple network management protocol.

[0012] The second aspect of the present disclosure provides a mining protection device based on source address verification, including: a receiving module, used to receive a DNS request packet sent by a terminal; a control module, used to perform terminal access control based on the aging time of the table items in the DHCPv6 Snooping binding table and the ND Snooping binding table in the source address verification when the DNS request packet is not directed to a designated DNS for domain name resolution.

[0013] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the method described above.

[0014] A fourth aspect of the present disclosure provides a computer-readable storage medium, on which executable instructions are stored. When the instructions are executed by a processor, the processor executes the method described above.

[0015] A fifth aspect of the present disclosure provides a computer program product, including a computer program, which implements the above-described method when executed by a processor.

[0016] The mining protection method, device, electronic device and medium based on source address verification provided by the embodiments of the present disclosure have at least the following beneficial effects:

[0017] When the DNS request packet of the terminal is not directed to the designated DNS for domain name resolution request, the aging time of the DHCPv6 Snooping binding table and ND Snooping binding table entries in the source address verification (SAVI) is used to control terminal access. If it is a DNS resolution request for a malicious mining domain name, the request will be blocked and the terminal will be recorded, reducing the probability of being infringed from the source and the risk of university terminals being infringed, so as to achieve mining protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying any creative work.

[0019] Figure 1 The system architecture 100 of the mining protection method and device based on source address verification according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 2 The flowchart of the mining protection method based on source address verification according to an embodiment of the present disclosure is schematically shown.

[0021] Figure 3 The flowchart of the method for establishing a DHCPv6 Snooping binding table and an ND Snooping binding table according to an embodiment of the present disclosure is schematically shown.

[0022] Figure 4A The flowchart of obtaining an IP address in a Stateful DHCPv6 manner according to an embodiment of the present disclosure is schematically shown.

[0023] Figure 4B The flowchart of obtaining an IP address using the SLAAC method according to an embodiment of the present disclosure is schematically shown.

[0024] Figure 4C The flowchart of obtaining an IP address by using SLAAC with Stateless DHCPv6 according to an embodiment of the present disclosure is schematically shown.

[0025] Figure 5 The diagram schematically shows the communication interaction between the server DDI6 PLUS system and SAVI according to an embodiment of the present disclosure.

[0026] Figure 6 A block diagram of a mining protection device based on source address verification according to an embodiment of the present disclosure is schematically shown.

[0027] Figure 7 A block diagram of an electronic device suitable for implementing the method described above according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0028] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0029] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0030] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0031] In the case of using expressions such as "at least one of A, B, and C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). In the case of using expressions such as "at least one of A, B, or C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, or C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0032] Some block diagrams and / or flow charts are shown in the accompanying drawings. It should be understood that some boxes or combinations thereof in the block diagrams and / or flow charts can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that these instructions can create a device for implementing the functions / operations described in these block diagrams and / or flow charts when executed by the processor. The technology of the present disclosure can be implemented in the form of hardware and / or software (including firmware, microcode, etc.). In addition, the technology of the present disclosure can take the form of a computer program product on a computer-readable storage medium storing instructions, which can be used by an instruction execution system or used in conjunction with an instruction execution system.

[0033] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision, disclosure and application of user personal information involved comply with the provisions of relevant laws and regulations, take necessary confidentiality measures, and do not violate public order and good morals.

[0034] In the technical solution of the present disclosure, the user's authorization or consent is obtained before obtaining or collecting the user's personal information.

[0035] In view of the technical problems existing in the related technologies, the embodiments of the present disclosure provide a mining protection method based on source address verification, including: receiving a DNS request packet sent by a terminal; when the DNS request packet is not directed to a designated DNS for domain name resolution, performing terminal access control based on the aging time of the entries in the DHCPv6 Snooping binding table and the ND Snooping binding table in the source address verification.

[0036] Figure 1 The system architecture 100 of the mining protection method and device based on source address verification according to an embodiment of the present disclosure is schematically shown. It should be noted that: Figure 1 What is shown is merely an example of a system architecture to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0037] like Figure 1 As shown, the system architecture 100 according to this embodiment may include a terminal 101, a network 102 and a server 103. The network 102 is used to provide a communication link between the terminal 101 and the server 103, and to provide a communication link between the terminal 101 and the server 103 and a user.

[0038] Terminal 101 is used for users to send DNS request packets when they need to access relevant resources. Network 102 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc. The wired method can be, for example, a cable and any of the following interfaces: fiber channel, infrared interface, D-type data interface, serial interface, USB interface, USB Type-C interface or Dock interface. The wireless method can be, for example, a wireless communication method, wherein the wireless communication can be, for example, any of multiple wireless technology standards such as Bluetooth, Wi-Fi, Infrared, ZigBee, etc. Server 103 can use network core services (DDI, DHCP / DNS / IP address management), specifically using the DDI6 PLUS system to solve the "mining problem", without the need to install the Agent on the terminal, and without changing the network, it can quickly achieve comprehensive protection for all teachers and students in the school, wired and wireless networks, and data center servers.

[0039] The DDI6PLUS system can include a DHCPv6 module, a monitoring module, a control module, and a DNS module. Among them, the DHCPv6 module is used to allocate IPv6 addresses and DNS (whether DDI needs to be controlled). The monitoring module is used to collect data and alarm through the Simple Network Management Protocol (SNMP), which is implemented through the monitoring port. The control module is used to bypass blocking, revoke DHCPv6 addresses and spoof SLAAC addresses to age the entries in the DHCPv6 Snooping binding table and the ND Snooping binding table to control the terminal's network exit. The DNS module is used for local recursive resolution, updating the mining pool list, and linking with security vendor data.

[0040] It should be understood that Figure 1 The number of terminals, networks and servers in the embodiment is only for illustration. Any number of terminals, networks and servers may be provided according to the implementation requirements.

[0041] The mining protection method of the disclosed embodiment is based on Source Address Validation (SAVI). The SAVI feature is applied on the access device, and a binding relationship table of addresses and ports is established through the ND Snooping binding table feature, the DHCPv6 Snooping binding table feature, and the IP Source Guard feature, and the source address of the DHCPv6 protocol message, the ND protocol message, and the IPv6 data message is filtered and checked for legitimacy based on the binding relationship.

[0042] By monitoring control messages (such as ND, DHCPv6), namely CPS (Control Packet Snooping), a binding relationship based on the IPv6 source address, source MAC address and access device port is established for the terminal on the access device (AP or switch), and then the source address of the IP message passing through the specified port is verified. Only when the source address of the message matches the binding table entry can it be forwarded, ensuring the authenticity of the source address of the data message on the network.

[0043] The SAVI feature can be used in the following address allocation scenarios:

[0044] DHCPv6-Only: The host connected to the SAVI-enabled device can obtain an address only through DHCPv6.

[0045] SLAAC-Only: SLAAC (Stateless Address Autoconfiguration). Hosts connected to devices with the SAVI feature can obtain addresses only through automatic address allocation.

[0046] DHCPv6 and SLAAC hybrid: A host connected to a device with the SAVI feature can obtain an address through DHCPv6 and automatic address allocation.

[0047] To prevent attacks from DHCPv6 protocol messages, ND protocol messages, and IPv6 data messages with illegal IPv6 source addresses, you can enable the SAVI function on the device. With the cooperation of other security functions, the device checks the IPv6 source address of the message according to the table entries generated by the security function. If the message information matches the generated table entries, the message is considered to be a legal message and is processed normally; otherwise, the message is discarded. Security functions used in conjunction with SAVI include the DHCPv6 Snooping binding table, the ND Snooping binding table, and IP Source Guard.

[0048] Figure 2 The flowchart of the mining protection method based on source address verification according to an embodiment of the present disclosure is schematically shown.

[0049] like Figure 2 As shown, the mining protection method based on source address verification may include operations S201 to S202.

[0050] In operation S201, a DNS request packet sent by a terminal is received.

[0051] In operation S202, when the DNS request packet is not directed to a designated DNS for domain name resolution, terminal access control is performed based on the aging time of entries in the DHCPv6 Snooping binding table and the ND Snooping binding table in source address verification.

[0052] In the embodiment of the present disclosure, terminal access control based on the aging time of the entries in the DHCPv6 Snooping binding table and the ND Snooping binding table in the source address verification specifically includes: determining the method for the terminal to obtain the IPv6 source address according to the DNS request packet; in the case where the terminal obtains the IPv6 source address through DHCPv6, deleting the entry corresponding to the terminal in the DHCPv6 Snooping binding table, and releasing the IPv6 source address of the terminal; in the case where the terminal obtains the IPv6 source address through stateless address automatic configuration, deleting the entry corresponding to the terminal in the ND Snooping binding table, and sending a message to the terminal that the IPv6 source address has been used.

[0053] Exemplarily, there are two ways to automatically configure IPv6 addresses, as follows:

[0054] Stateless: Automatically configure IPv6 addresses based on the prefix information contained in the router advertisement message RA (Router Advertisement), which is composed of Prefix + (EUI64 or random). Stateless can also be called SLAAC (Stateless address autoconfiguration)

[0055] Stateful: Obtain an IPv6 address through DHCPv6

[0056] There are two types of "stateful":

[0057] Stateful DHCPv6: IPv6 address and other parameters (such as DNS) are obtained through DHCPv6;

[0058] Stateless DHCPv6: IPv6 addresses are still generated through router advertisements (RAs), and other parameters (such as DNS) are obtained through DHCPv6.

[0059] Stateful: controllable and manageable. There is an IP address manager in the network that can identify clients and allocate corresponding IPv6 addresses according to different clients. The client and server need to maintain the lease and renewal of IP addresses. Currently, the DHCPv6 protocol is used to achieve this effect, and the IP address manager is the DHCPv6 Server.

[0060] Stateless: Uncontrollable and difficult to manage. There is only a gateway in the network, but no IP address manager. Therefore, no one identifies the client, and each client configures its own IPv6 address based on the same RA message content sent by the gateway.

[0061] Based on this, the terminal obtains an IPv6 address through DHCPv6 and SLAAC. However, the outbound network must be configured with a specified recursive DNS for domain name resolution. The DHCPv6 terminal obtains IPv6 and the specified DNS through the DHCPv6 module, and the SLAAC terminal obtains the specified DNS through the DHCPv6 module.

[0062] In the embodiment of the present disclosure, by monitoring data to obtain the IPv6 source address, a binding relationship based on the IPv6 source address, source MAC address and access device port is established for the terminal to obtain a DHCPv6 Snooping binding table and an NDSnooping binding table.

[0063] Specifically, the Simple Network Management (SNMP) protocol is started in the network of the monitoring module. DDI6PLUS, as the network management center of the entire network, will manage the devices. Each managed device contains an agent residing on the device, multiple managed objects, and a management information base (MIB). The network management system (NMS) interacts with the agent running on the managed device, and the agent completes the instructions of the NMS by operating the MIB on the device side. The working principle of SNMP is to send a protocol data unit (also called an SNMP GET request) to a network device that responds to SNMP. Users can track all communication processes and obtain data from SNMP through network monitoring tools.

[0064] Figure 3 The flowchart of the method for establishing a DHCPv6 Snooping binding table and an ND Snooping binding table according to an embodiment of the present disclosure is schematically shown.

[0065] like Figure 3As shown in the figure, first, the normal terminal receives the RA announcement, obtains the prefix and automatically generates an IPv6 address. Then, after receiving the request, DDI6 PLUS replies with a reply message, sending the IPv6 address, DNS, Domain Name and other information to the DHCPv6 terminal. After receiving the reply message, the terminal will send a DAD message to detect address conflicts. If the NA message is not received within a certain period of time, the switch will establish a DHCP binding. The SLAAC terminal obtains the specified recursive DNS from the DDI6 PLUS, obtains information through the SLAAC+DHCPv6 method, and binds it in the ND snooping table of the SAVI switch.

[0066] Since the DHCPv6 Snooping binding table records the correspondence between the DHCP client's IP address and MAC address and other parameters, by matching the message with the DHCPv6 Snooping binding table, it can effectively prevent attacks from illegal users. The DHCPv6 Snooping binding table ages according to the DHCP lease period or automatically deletes the corresponding table entry according to the DHCPv6 Release message sent by the user when releasing the IP address.

[0067] The automatic aging time of ND Snooping binding entries is determined by the address lease of the ND user. After the device receives a user's NS (Neighbor Solicitation) message to create or update an ND Snooping dynamic binding entry, if it receives another user's NA (Neighbor Advertisement) message in response notifying that the user's address has been used, the device deletes the ND Snooping dynamic binding entry.

[0068] Based on the pre-set situation, when the DNS request packet of the terminal is not directed to the designated DNS for domain name resolution request, the monitoring module will obtain data information through the mirror port. If it is detected that the terminal IP is obtained by DHCPv6, the DHCPv6 module will release the user IP, and the terminal entry in the DHCPv6 Snooping binding table will be deleted; if it is detected that the terminal IP is obtained by SLAAC, the control module tool HPing3 will impersonate other users to respond to the NA message notifying that the user address has been used, and the entry in the ND Snooping binding table will be deleted.

[0069] In the embodiment of the present disclosure, the DNS request packet includes an Autonomous flag field, a Managed flag field and an Other flag field, wherein the Autonomous flag field is used to indicate whether the terminal obtains the IPv6 source address through stateless address automatic configuration, the Managed flag field is used to indicate that the terminal obtains the IPv6 source address through DHCPv6, and the Other flag field indicates whether parameters other than the IPv6 source address are obtained through DHCPv6.

[0070] Exemplarily, Autonomous flag (A flag for short): indicates whether to configure stateless IP. In an RA message, there may be multiple prefixes, such as 2401:: / 64, 2402:: / 64, 2403:: / 64, and each prefix can be independently configured with Aflag. When Aflag is on (the corresponding bit is 1): it indicates that the client should automatically generate an IPv6 address within the prefix range (the client ensures the address availability through DAD) and configure subnet routing entries and gateways. When Aflag is off (the corresponding bit is 0): it indicates that the client should not automatically generate an IPv6 address within the prefix range, but can configure subnet routing entries and gateways.

[0071] Managed flag (M flag for short): indicates whether stateful IP is configured. M flag is a global parameter of RA message, and one RA message has only one M flag. When M flag is on (corresponding bit is 1): it means that the stateful process starts after the stateless process ends, that is, it tells the client that it can obtain IPv6 address and other parameters (such as DNS list) through DHCPv6. When M flag is off (corresponding bit is 0): it means that IPv6 address is not obtained through DHCPv6.

[0072] Other flag (O flag for short): Indicates whether to obtain other parameters (such as DNS list) except IP through DHCPv6. O flag is also a global parameter in RA message. There is only one O flag in one RA message. Note: This parameter will be read only when M flag is off. When O flag is on (corresponding bit is 1): When M flag is on, or M flag is off and at least one A flag is on, other parameters will be obtained through DHCPv6. When O flag is off (corresponding bit is 0): When M flag is on, other parameters will still be obtained through DHCPv6; when M flag is also off, other parameters will not be obtained through DHCPv6.

[0073] The flag values ​​of different address acquisition methods are shown in Table 1:

[0074] Table 1

[0075] Way address Prefix Gateway DNS A M O Static Manual Manual Manual Manual none none none SLAAC RA RA RA none 1 0 0 Stateless DHCPv6 RA RA RA DHCPv6 1 0 1 Stateful DHCPv6 DHCPv6 DHCPv6 RA DHCPv6 0 1 none

[0076] It should be noted that stateless and stateful are not mutually exclusive. They can exist at the same time. That is, an IP generated through RA and an IP obtained through DHCPv6 can appear on a network card at the same time.

[0077] Figure 4A The flowchart of obtaining an IP address in a Stateful DHCPv6 manner according to an embodiment of the present disclosure is schematically shown. Figure 4B The flowchart of obtaining an IP address using the SLAAC method according to an embodiment of the present disclosure is schematically shown. Figure 4C The flowchart of obtaining an IP address by using SLAAC with Stateless DHCPv6 according to an embodiment of the present disclosure is schematically shown.

[0078] from Figure 4A-4B It can be seen that Stateful automatically configures the "global address" (or "unique local address") and other parameters, wherein Stateful DHCPv6 or Stateless DHCPv6 exists in the Stateful stage.

[0079] Based on this, determining the way in which the terminal obtains the IPv6 source address according to the DNS request packet includes: determining the way in which the terminal obtains the IPv6 source address according to the value of the Autonomous flag field and the value of the Managed flag field.

[0080] In the disclosed embodiment, the captured mining pool domain name list is added to the DNS blacklist through the stratum+ssl protocol.

[0081] Since Stratum is a long connection protocol, if the stratum+ssl mode is used, it will also be identified from external features; the captured mining pool domain name list is added to the DNS blacklist to block the DNS resolution requests of malicious mining domain names.

[0082] Specifically, the DNS module will update the list based on relevant malicious domain name notifications and the public "mining" domain name list on the Internet. For example, many of the currently public "mining pool" domain names and "mining pool" proxies use stratum+tcp or stratum+ssl formats. By using tools to collect content containing "stratum+tcp: / / " or "stratum+ssl: / / " on the Internet, a partial list of "mining pool" domain names can be extracted and sorted out.

[0083] Based on the above embodiment, the communication interaction process of the DHCPv6 module, monitoring module, control module, DNS module and SAVI of the DDI6 PLUS system.

[0084] Figure 5 The diagram schematically shows the communication interaction between the server DDI6 PLUS system and SAVI according to an embodiment of the present disclosure.

[0085] like Figure 5 As shown in the figure, when DDI6 PLUS detects that the M bit or O bit value is set to 1, the terminal can obtain the specified DNS. When the terminal's DNS request packet is not directed to the specified DNS for domain name resolution request, the aging time of the DHCPv6 snooping and ND snooping entries in SAVI is used to control terminal access. The DNS module of DDI6 PLUS is used for retrieval and comparison. If it is a DNS resolution request for a malicious mining domain name, the request will be blocked and the terminal will be recorded. Reduce the probability of being infringed from the source and reduce the risk of university terminals being infringed, so as to achieve mining protection.

[0086] Figure 6 A block diagram of a mining protection device based on source address verification according to an embodiment of the present disclosure is schematically shown.

[0087] like Figure 6 As shown, the mining protection device 600 based on source address verification may include a receiving module 610 and a control module 620 .

[0088] The receiving module 610 is used to receive a DNS request packet sent by a terminal.

[0089] The control module 620 is configured to perform terminal access control based on the aging time of the entries in the DHCPv6 Snooping binding table and the ND Snooping binding table in the source address verification when the DNS request packet is not directed to the designated DNS for domain name resolution.

[0090] According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, units, and subunits can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0091] For example, any multiple of the receiving module 610 and the control module 620 can be combined in one module / unit / subunit for implementation, or any one of the modules / units / subunits can be split into multiple modules / units / subunits. Alternatively, at least part of the functions of one or more of these modules / units / subunits can be combined with at least part of the functions of other modules / units / subunits and implemented in one module / unit / subunit. According to an embodiment of the present disclosure, at least one of the receiving module 610 and the control module 620 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the receiving module 610 and the control module 620 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0092] It should be noted that the mining protection device part based on source address verification in the embodiment of the present disclosure corresponds to the mining protection method part based on source address verification in the embodiment of the present disclosure, and their specific implementation details and the technical effects brought about are also the same, which will not be repeated here.

[0093] Figure 7 A block diagram of an electronic device suitable for implementing the method described above according to an embodiment of the present disclosure is schematically shown. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0094] like Figure 7 As shown, the electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 to a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include an onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0095] In RAM 703, various programs and data required for the operation of electronic device 700 are stored. Processor 701, ROM 702 and RAM 703 are connected to each other via bus 704. Processor 701 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 702 and / or RAM 703. It should be noted that the program can also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0096] According to an embodiment of the present disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to the bus 704. The electronic device 700 may further include one or more of the following components connected to the I / O interface 705: an input portion 706 including a keyboard, a mouse, etc.; an output portion 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 707 including a hard disk, etc.; and a communication portion 709 including a network interface card such as a LAN card, a modem, etc. The communication portion 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage portion 708 as needed.

[0097] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0098] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0099] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. For example, it may include, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device.

[0100] For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 702 and / or the RAM 703 described above and / or one or more memories other than the ROM 702 and the RAM 703 .

[0101] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram may represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions. It can be understood by those skilled in the art that the features recorded in the various embodiments and / or claims of the present disclosure can be combined and / or combined in a variety of ways, even if such a combination or combination is not explicitly recorded in the present disclosure. In particular, without departing from the spirit and teaching of the present disclosure, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

Claims

1. A mining protection method based on source address verification, characterized in that: include: Receive the DNS request packet sent by the terminal; In the case where the DNS request packet is not directed to a designated DNS for domain name resolution, terminal access control is performed based on the aging time of the entries in the DHCPv6 Snooping binding table and the ND Snooping binding table in the source address verification; The terminal access control based on the aging time of the entries in the DHCPv6 Snooping binding table and the ND Snooping binding table in the source address verification specifically includes: Determining a method for the terminal to obtain an IPv6 source address according to the DNS request packet; In the case that the terminal obtains the IPv6 source address in a manner of obtaining the IPv6 source address through DHCPv6, deleting the entry corresponding to the terminal in the DHCPv6 Snooping binding table, and releasing the IPv6 source address of the terminal; In the case where the terminal obtains the IPv6 source address in a stateless address automatic configuration manner, deleting the table entry corresponding to the terminal in the NDSnooping binding table, and sending a message to the terminal indicating that the IPv6 source address has been used; By monitoring the data to obtain the IPv6 source address, a binding relationship based on the IPv6 source address, the source MAC address and the access device port is established for the terminal to obtain the DHCPv6 Snooping binding table and the ND Snooping binding table; The DNS request packet includes an Autonomous flag field, a Managed flag field, and an Other flag field; The method for determining, according to the DNS request packet, that the terminal obtains the IPv6 source address includes: The method for the terminal to obtain the IPv6 source address is determined according to the value of the Autonomous flag field and the value of the Managed flag field.

2. The mining protection method based on source address verification according to claim 1 is characterized in that: The Autonomous flag field is used to indicate whether the terminal obtains the IPv6 source address through stateless address automatic configuration, the Managed flag field is used to indicate whether the terminal obtains the IPv6 source address through DHCPv6, and the Other flag field indicates whether parameters other than the IPv6 source address are obtained through DHCPv6.

3. The mining protection method based on source address verification according to claim 1 is characterized in that: Also includes: Add the captured mining pool domain name list to the DNS blacklist through the stratum+ssl protocol.

4. The mining protection method based on source address verification according to claim 1 is characterized in that: The process of obtaining the IPv6 source address by monitoring data through the Simple Network Management Protocol.

5. A mining protection device based on source address verification, characterized in that: include: A receiving module, used for receiving a DNS request packet sent by a terminal; A control module, configured to perform terminal access control based on the aging time of the entries in the DHCPv6 Snooping binding table and the ND Snooping binding table in the source address verification when the DNS request packet is not directed to the designated DNS for domain name resolution; The terminal access control based on the aging time of the entries in the DHCPv6 Snooping binding table and the ND Snooping binding table in the source address verification specifically includes: Determining a method for the terminal to obtain an IPv6 source address according to the DNS request packet; In the case that the terminal obtains the IPv6 source address in a manner of obtaining the IPv6 source address through DHCPv6, deleting the entry corresponding to the terminal in the DHCPv6 Snooping binding table, and releasing the IPv6 source address of the terminal; In the case where the terminal obtains the IPv6 source address in a stateless address automatic configuration manner, deleting the table entry corresponding to the terminal in the NDSnooping binding table, and sending a message to the terminal indicating that the IPv6 source address has been used; By monitoring the data to obtain the IPv6 source address, a binding relationship based on the IPv6 source address, the source MAC address and the access device port is established for the terminal to obtain the DHCPv6 Snooping binding table and the ND Snooping binding table; The DNS request packet includes an Autonomous flag field, a Managed flag field, and an Other flag field; The method for determining, according to the DNS request packet, that the terminal obtains the IPv6 source address includes: The method for the terminal to obtain the IPv6 source address is determined according to the value of the Autonomous flag field and the value of the Managed flag field.

6. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores executable instructions, which, when executed by a processor, cause the processor to execute the method according to any one of claims 1 to 4.

Images