A tunnel message blocking method and a blocking device

Abstract

The application provides a tunnel message blocking method and a blocking device. The blocking method comprises the following steps: receiving a tunnel message; marking the tunnel message when it is determined that the protocol type of the tunnel message matches a preset first blocking strategy based on the outer encapsulated message header of the tunnel message; and intercepting the marked tunnel message when it is determined that the protocol type of the marked tunnel message matches a preset second blocking strategy based on the inner encapsulated message header of the marked tunnel message. The blocking device comprises a marking module and an intercepting module. The marking module is used for performing the first step of the blocking method, and the intercepting module is used for performing the second step of the blocking method. The inner and outer encapsulated message headers are used to mark all suspicious messages through a first blocking strategy matching, and then perform an additional blocking strategy matching on the marked messages, so that the accuracy of intercepting attack messages is improved.

Description

Technical Field

[0001] This application relates to the field of tunnel communication, and more particularly to a method and device for blocking tunnel messages. Background Technology

[0002] Tunnel packets are data packets transmitted within a tunnel channel, using an additional layer of encapsulation to achieve encryption, encapsulation, forwarding, and authentication. While achieving these functions, some attack packets have emerged that use secondary encapsulation to disguise themselves, especially masquerading as basic protocols while actually containing malicious intent. To address these attack packets, existing solutions use packet filtering technology to match the underlying protocol within the secondary encapsulation (i.e., the outer encapsulation) to determine if a packet is suspicious and block it directly. However, because legitimate access packets are also secondary encapsulated into these basic protocols for normal access, they are mistakenly identified as attack packets and blocked by packet filtering technology, thus preventing some legitimate access packets from functioning correctly. Summary of the Invention

[0003] In view of this, this application provides a method and device for blocking tunneling messages.

[0004] Specifically, this application is achieved through the following technical solution:

[0005] A first aspect of this application provides a method for blocking tunnel packets. The blocking method includes: receiving a tunnel packet; marking the tunnel packet if the protocol type of the tunnel packet matches a preset first blocking policy based on the outer encapsulated header of the tunnel packet; and intercepting the marked tunnel packet if the protocol type of the marked tunnel packet matches a preset second blocking policy based on the inner encapsulated header of the marked tunnel packet.

[0006] A second aspect of this application provides a tunnel packet blocking device, comprising: a marking module for receiving a tunnel packet and marking the tunnel packet if the protocol type of the tunnel packet matches a preset first blocking policy based on the outer encapsulated header of the tunnel packet; and an interception module for intercepting the marked tunnel packet if the protocol type of the marked tunnel packet matches a preset second blocking policy based on the inner encapsulated header of the marked tunnel packet.

[0007] Through the above technical solution, this application has at least the following beneficial effects:

[0008] By leveraging the characteristic that both layers of tunnel packet encapsulation correspond to a session establishment process, a blocking policy match is performed when an external session is established. Although a successful match is likely, the pending packets are not immediately blocked. Therefore, when a packet that should be accessed normally is accidentally marked, a second blocking policy match can be performed. By matching according to the preset fields of the attack packet, the attack packet is successfully identified and blocked. At this time, the accidentally marked packet can not match the second blocking policy and establish a connection normally, thus preventing packets that should be accessed normally from being blocked incorrectly to a certain extent. Attached Figure Description

[0009] Figure 1 This is a flowchart illustrating a tunneling message blocking method according to an exemplary embodiment of this application.

[0010] Figure 2 This is a flowchart illustrating a method for cleaning a hash table, as shown in an exemplary embodiment of this application.

[0011] Figure 3 This is a flowchart illustrating a method for limiting the number of sessions according to an exemplary embodiment of this application.

[0012] Figure 4 This is a block diagram illustrating a tunneling message blocking device according to an exemplary embodiment of this application.

[0013] Figure 5 This is a block diagram illustrating a destination device of a tunnel according to an exemplary embodiment of this application. Detailed Implementation

[0014] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0015] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0016] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0017] The present application will be described in detail below using specific embodiments.

[0018] Network protocols define the rules for information exchange between terminal devices on a network. Tunneling protocols allow the encapsulation of messages from one network protocol within messages from another, thus enabling transmission. Tunneling protocols can establish a secure channel between networks, encrypt communication content, and encapsulate messages from one network protocol within messages from another. Tunneling protocols perform two encapsulations on network packets: an outer encapsulation layer and an inner encapsulation layer. The outer encapsulation allows data packets to be relayed and transmitted across networks, while the inner encapsulation preserves the format of the local data packet.

[0019] During the outer encapsulation process, local data packets are encapsulated as data fields of the inner network protocol. A header is added to the outer network message, specifying the transmission path and processing method. The inner encapsulation ensures that the format and protocol of the local network message remain unchanged. After removing the outer header, the receiver can directly process the data packets from the inner network protocol.

[0020] Through inner and outer encapsulation, tunneling technology enables crucial capabilities such as cross-network transmission, filtering and circumvention, and ensuring secure communication.

[0021] While tunneling offers many advantages, the different encapsulation layers of tunneling technology allow malicious actors to circumvent filtering techniques, such as firewalls, to gain unauthorized access, maliciously establish sessions, and launch network attacks.

[0022] To reduce the likelihood of attacks, existing technologies enhance the filtering capabilities of tunnel destination devices and terminal devices, or add firewall devices with stronger filtering capabilities.

[0023] Among commonly used filtering techniques, packet filtering can be used to restrict outer packets of tunnel packets. Since the outer packets use similar network protocols, it can effectively block attack packets while blocking a large number of non-attack packets, causing service interruption or failure.

[0024] In this regard, you can refer to Figure 1 This application provides a method for blocking tunneling messages, which may include:

[0025] S101. Receive tunnel message; based on the message header encapsulated in the outer layer of the tunnel message, if the protocol type of the tunnel message matches the preset first blocking policy, mark the tunnel message.

[0026] S102. Based on the inner encapsulated header of the marked tunnel message, if it is determined that the protocol type of the marked tunnel message matches the preset second blocking policy, the marked tunnel message is intercepted.

[0027] This application, through the aforementioned technical solution, first marks all tunnel packets corresponding to suspicious protocol types, and then performs a second matching based on the inner encapsulated packet header. The second matching targets protocol types commonly used in attack packets. Since the first matching only marks the packets, and the second matching accurately identifies the attack packets, the first blocking strategy can employ a more stringent approach, using a stronger interception force than packet filtering techniques.

[0028] Meanwhile, because two policy matchings are performed, even if some non-attack packets that should be accessed normally are marked due to the strong interception in the first matching (i.e., the first blocking policy is successfully matched), the non-attack packets will not be blocked because the inner layer of the attack packets targeted by the second blocking policy is the corresponding network protocol. Therefore, the sessions can still be established normally. This can prevent non-attack packets from being blocked, causing service interruption or failure, and can also ensure higher accuracy than packet filtering technology.

[0029] Because packet filtering technology targets the outer encapsulation layer, reducing the probability of false interception requires minimizing the interception strength. However, this application, compared to packet filtering technology, maximizes the interception strength of the outer encapsulation layer to cover all suspicious packets. Packet filtering technology uses low interception strength to ensure access to a certain number of non-attack packets, while this application adopts the opposite approach to increase the interception strength, representing an unexpected improvement over packet filtering technology.

[0030] Based on this, those skilled in the art can set appropriate network protocols as blocking strategies. In one embodiment of this application, DNS (Domain Name System) and ICMP (Internet Control Message Protocol) are commonly used network protocol types for non-attack packets, and are also frequently disguised network protocol types for attack packets. Therefore, the first blocking strategy may include, but is not limited to, the DNS protocol or the ICMP protocol. SSH (Secure Shell) is a commonly used inner network protocol for attack packets, so the second blocking strategy may include, but is not limited to, the SSH protocol.

[0031] It is understood that in this application, the blocking strategy includes a certain network protocol, which may be a corresponding judgment strategy that includes this network protocol. Since different network protocols have different judgment methods, the content stored in the blocking strategy can be determined according to the type of network protocol that needs to be matched.

[0032] For example, the TCP (Transmission Control Protocol) protocol can be identified using port numbers and flags. Therefore, when using this protocol as a blocking strategy, the port numbers and flags that the TCP protocol might use can be pre-stored. Another example is the ICMP protocol. ICMP messages themselves do not carry transport layer port information, so the condition "source port is 0, destination port is also 0" can be pre-stored, along with other conditions (such as whether the message header length is 8 bytes, etc., which will not be elaborated further) for matching in the first blocking strategy. Other types of matching strategies will not be elaborated on one by one. If they can be directly obtained or modified from the content disclosed in this application, they should all fall within the protection scope of this application.

[0033] Based on the above scheme, in S102, the step of determining whether the protocol type of the tunnel message matches the preset second blocking strategy is performed before the inner session is established.

[0034] Intercepting attack packets before establishing an inner session can prevent the establishment of a connection with the attacker, thereby saving server connection resources and processing power. This is especially effective for DoS (Disk Operating System) attacks and DDoS (Distributed Denial of Service) attacks, and can also intercept SQL (Structured Query Language) injection attack packets to prevent illegal SQL execution.

[0035] Based on the above scheme, in order to adapt to different usage requirements, this application can match the first blocking strategy or the second blocking strategy based on at least one of the following attributes of the tunnel message:

[0036] Port number; flags; message length; field order; optional fields; interaction mode; correspondence between outer and inner protocols; port type.

[0037] It should be understood that different network protocols use different factors for identification. Therefore, those skilled in the art can make their own choices based on the specific type of network protocol used. Any of the above methods used as the first or second blocking strategy for matching should fall within the protection scope of this application.

[0038] In the scheme of this application, it is necessary to mark the packets that are successfully matched by the first blocking strategy. As an example, this application provides a variety of marking methods. Specifically, the steps of marking tunnel packets include any of the following:

[0039] If the protocol type of the tunnel message matches the preset first blocking policy, generate and record random characters to mark the tunnel message; or

[0040] If the protocol type of the tunnel message matches the preset first blocking policy, a first character marking the tunnel message is generated and recorded; if the protocol type of the tunnel message does not match the preset first blocking policy, a second character marking the tunnel message is generated and recorded; the first character and the second character are different.

[0041] It is important to understand that in the first marking method, the random characters can be one or more combinations of numbers, English letters, special characters, etc. Because the packets to be marked contain random characters, while the unmarked packets are empty in the same position, it is possible to detect which packets contain random characters and match them with the second blocking strategy before the second blocking strategy is performed. If the match is successful, the packets are blocked.

[0042] The second method can also produce the same technical effect. Specifically, different first and second characters are used to mark the packets that are matched by the first blocking strategy and the packets that are not matched by the first blocking strategy, respectively. Since the two are different, it is also possible to detect which packets contain random characters and match them with the second blocking strategy before the second blocking strategy is performed.

[0043] Specifically, in one embodiment, to facilitate judgment, numbers that are easy to compare using arithmetic operations can be used, such as random characters being random numbers; the first character being a random number other than 0, and the second character being 0; alternatively, the random numbers, the first character, and the second character can be set to fixed values. Correspondingly, English characters, special characters, etc., can also be used, as long as they can distinguish between the two types of messages.

[0044] In this application, random characters, the first character, or the second character used for marking can all be recorded as flags in a hash table. The hash table can be read by a program or system; therefore, reference is made to... Figure 2 Blocking methods may also include:

[0045] S201. If the protocol type of the marked tunnel message matches the preset second blocking policy, delete the flag bound to the marked tunnel message in the hash table.

[0046] Because hash tables occupy a certain amount of storage space, once the second blocking strategy is successfully matched, the corresponding flag in the hash table for this successfully matched message has no use value. The above method can avoid invalid flags from continuously occupying space.

[0047] However, since only the flags that successfully matched the second blocking strategy were cleared from the hash table, some packets that were considered potentially attacking when matching the first blocking strategy were marked, and their corresponding flags were stored in the hash table. These packets, however, did not match the second blocking strategy and were therefore established as non-attack packets. To prevent these flags for marked but unblocked packets from continuously occupying storage space, the blocking method also includes periodically deleting flags to be deleted from the hash table. The protocol type of the tunnel packets bound to these flags does not match the preset second blocking strategy.

[0048] It is understandable that only packets that successfully match the first blocking strategy will have a flag. Therefore, the flag to be deleted can be used to refer to the flags corresponding to packets that successfully match the first blocking strategy but failed to match the second blocking strategy. Using the above method, after clearing the flags of packets that successfully match the second blocking strategy, the flags of packets that failed to match the second blocking strategy can be additionally cleared. This allows for the periodic clearing of all invalid flags, reducing the size of the hash table and further reducing storage space usage.

[0049] Based on any of the above embodiments, before S101, that is, before the protocol type of the tunnel message is matched with the preset first blocking policy, the blocking method may further include: S301 intercepting the tunnel message when it is determined that the number of sessions of the tunnel message exceeds the first threshold.

[0050] Before S102, that is, before the protocol type of the tunnel packet is matched with the preset second blocking policy, the blocking method may further include: S302, if it is determined that the number of sessions of the marked tunnel packet exceeds the second threshold, the marked tunnel packet is blocked.

[0051] If a session limit is required for all suspicious packets, it can be implemented in the first blocking policy, i.e., by adding S301. If a limit is required on the number of sessions an attack packet attempts to establish, i.e., by limiting the number of attacks, it can be added using S302. If both suspicious access and attack counts need to be limited, refer to [the relevant documentation]. Figure 3 You can add both steps 301 and 302 at the same time.

[0052] It is understandable that the first threshold and the second threshold can be set according to requirements. Specifically, the first threshold may be set according to the protocol type corresponding to the first blocking strategy; the second threshold may be set according to the protocol type corresponding to the second blocking strategy.

[0053] For example, if an attack packet using the SSH protocol is encapsulated as an ICMP protocol packet, and the first blocking policy happens to include the ICMP protocol, and you want to limit the number of sessions of such attack packets to less than 10, you can set the second threshold to 10. When the first blocking policy is successfully matched 10 times, it will be blocked before the second blocking policy is matched because the second threshold has been reached, thus preventing excessive access.

[0054] The first threshold can be understood as a limit on the total number of accesses, while the second threshold can be understood as a limit on the number of times a packet is marked. Since the second restriction policy only applies to the marked packets (i.e., packets with a flag), the number of times the second restriction policy will be matched is exactly the number of times a packet will be marked. Therefore, the second threshold can be set to limit the number of times a packet is marked.

[0055] Since the session limit is placed before the blocking policy matching, it can reduce resource consumption to some extent. The combined use of the session limit and the blocking policy can balance the interception accuracy and resource consumption. In scenarios where the interception accuracy requirement is low or the possibility of being attacked is low, the session limit can be used for interception to reduce matching behavior and thus reduce resource consumption to some extent.

[0056] Corresponding to the embodiments of the aforementioned blocking method, refer to Figure 4 This application also provides a tunneling message blocking device 40, which may include:

[0057] The marking module 401 is used to receive tunnel messages and, based on the outer encapsulated message header of the tunnel message, mark the tunnel message if the protocol type of the tunnel message matches the preset first blocking policy.

[0058] The interception module 402 is used to intercept the marked tunnel message if the protocol type of the marked tunnel message matches the preset second blocking policy, based on the inner encapsulated message header of the marked tunnel message.

[0059] The embodiments of the blocking device of this application can be applied to the destination device of any type of tunnel. The device embodiments can be implemented through software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of the destination device in the tunnel loading the corresponding computer program instructions from the non-volatile memory into memory and executing them. From a hardware perspective, such as... Figure 5 The diagram shown is a hardware structure diagram of the destination device in the tunnel where the blocking device of this application is located. (Except for...) Figure 5 In addition to the processor 501, memory 502, network interface 503, non-volatile memory 504, and bus 505 shown, the destination device of the tunnel where the device is located in the embodiment may also include other hardware depending on the actual function of the destination device, which will not be described in detail here.

[0060] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope of the claims, but rather are primarily intended to describe features of specific embodiments of a particular invention. Certain features described in the various embodiments herein may also be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment may also be implemented separately in various embodiments or in any suitable sub-combination. Furthermore, while features may function in certain combinations as described above and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and a claimed combination may refer to a sub-combination or a variation thereof.

[0061] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order shown or sequentially, or requiring all illustrated operations to be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0062] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings are not necessarily shown in a specific order or sequence to achieve the desired result. In some implementations, multitasking and parallel processing may be advantageous.

[0063] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for blocking tunneling messages, characterized in that, The blocking method includes: Upon receiving a tunnel message, if the protocol type of the tunnel message matches a preset first blocking policy based on the outer encapsulated message header, the tunnel message is marked. Based on the inner encapsulated header of the marked tunnel packet, if it is determined that the protocol type of the marked tunnel packet matches the preset second blocking policy, the marked tunnel packet is intercepted. The step of marking the tunnel message includes any of the following: If the protocol type of the tunnel message matches a preset first blocking policy, generate and record random characters to mark the tunnel message; or If the protocol type of the tunnel message matches the preset first blocking policy, a first character marking the tunnel message is generated and recorded; if the protocol type of the tunnel message does not match the preset first blocking policy, a second character marking the tunnel message is generated and recorded; the first character and the second character are different.

2. The blocking method according to claim 1, characterized in that, The first blocking strategy includes the DNS protocol or the ICMP protocol, and the second blocking strategy includes the SSH protocol.

3. The blocking method according to claim 2, characterized in that, The step of determining whether the protocol type of the tunnel message matches the preset second blocking policy is performed before the inner session is established.

4. The blocking method according to claim 2, characterized in that, The tunnel message is matched against either the first or second blocking policy based on at least one of the following attributes: Port number; flags; message length; field order; optional fields; interaction mode; correspondence between outer and inner protocols; port type.

5. The blocking method according to claim 1, characterized in that, The random character, the first character, or the second character are recorded as flags in a hash table, and the blocking method further includes: If the protocol type of the marked tunnel packet matches the preset second blocking policy, delete the flag bound to the marked tunnel packet in the hash table.

6. The blocking method according to claim 5, characterized in that, The blocking method further includes: periodically deleting the pending deletion flag recorded in the hash table, wherein the protocol type of the tunnel message bound to the pending deletion flag does not match the preset second blocking strategy.

7. The blocking method according to any one of claims 1-6, characterized in that, Before the protocol type of the tunnel packet is matched with a preset first blocking policy, the blocking method further includes: intercepting the tunnel packet if it is determined that the number of sessions of the tunnel packet exceeds a first threshold; and / or Before the protocol type of the tunnel message is matched with the preset second blocking policy, the blocking method further includes: intercepting the marked tunnel message if it is determined that the number of sessions of the marked tunnel message exceeds a second threshold.

8. The blocking method according to claim 7, characterized in that, The first threshold is set according to the protocol type corresponding to the first blocking strategy; the second threshold is set according to the protocol type corresponding to the second blocking strategy.

9. A tunneling message blocking device, characterized in that, The blocking device includes: The marking module is used to receive tunnel packets and, based on the outer encapsulated packet header of the tunnel packet, mark the tunnel packet if the protocol type of the tunnel packet matches a preset first blocking policy. The interception module is used to intercept the marked tunnel packet if the protocol type of the marked tunnel packet matches a preset second blocking policy, based on the inner encapsulated packet header of the marked tunnel packet. The marking module is specifically used for: If the protocol type of the tunnel message matches a preset first blocking policy, generate and record random characters to mark the tunnel message; or If the protocol type of the tunnel message matches the preset first blocking policy, a first character marking the tunnel message is generated and recorded; if the protocol type of the tunnel message does not match the preset first blocking policy, a second character marking the tunnel message is generated and recorded; the first character and the second character are different.

Images